WO2019178760A1 - 一种传输密钥的方法及pos终端 - Google Patents

一种传输密钥的方法及pos终端 Download PDF

Info

Publication number
WO2019178760A1
WO2019178760A1 PCT/CN2018/079727 CN2018079727W WO2019178760A1 WO 2019178760 A1 WO2019178760 A1 WO 2019178760A1 CN 2018079727 W CN2018079727 W CN 2018079727W WO 2019178760 A1 WO2019178760 A1 WO 2019178760A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
pos terminal
protection
sender
working
Prior art date
Application number
PCT/CN2018/079727
Other languages
English (en)
French (fr)
Inventor
王明伟
陈磊
Original Assignee
福建联迪商用设备有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 福建联迪商用设备有限公司 filed Critical 福建联迪商用设备有限公司
Priority to PCT/CN2018/079727 priority Critical patent/WO2019178760A1/zh
Priority to CN201880000197.5A priority patent/CN108496336A/zh
Publication of WO2019178760A1 publication Critical patent/WO2019178760A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/061—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0822—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using key encryption key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0863—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving passwords or one-time passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/56—Financial cryptography, e.g. electronic payment or e-cash
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/062—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00 applying encryption of the keys

Definitions

  • the present invention relates to the field of data security, and in particular, to a method for transmitting a key and a POS terminal.
  • both parties of the transaction in order to transmit a work key, both parties of the transaction usually need to negotiate a protection key, also known as a zone master key (ZMK).
  • ZMK zone master key
  • the protection key is used to securely transfer the work key between the sender and the receiver.
  • ZMK zone master key
  • the usual practice is that each party to the transaction generates a ZMK component, and then arranges a special key administrator to complete the key injection in the security room of the other party. Or one of the two key components is generated by one party, and then key injection is performed in the hardware security module (HSM) of the other security room.
  • HSM hardware security module
  • protection key negotiation methods require the operator to move to the customer site to complete the protection key injection.
  • the above solution is required to manage the protection keys of multiple customers. In order to meet the different security requirements of different customers, a higher level of security facilities and a dedicated key management team are required for operation and maintenance. Operating costs of equipment manufacturers.
  • the technical problem to be solved by the present invention is how to improve the convenience of setting a protection key for securely transmitting a work key.
  • the technical solution adopted by the present invention is:
  • the invention provides a method for transmitting a key, comprising:
  • a POS terminal acquires a first protection key corresponding to the sender.
  • the POS terminal acquires a second protection key corresponding to the receiver.
  • the POS terminal decrypts the first working key ciphertext from the sender according to the first protection key, to obtain a working key plaintext;
  • the POS terminal encrypts the working key plaintext according to the second protection key to obtain a second working key ciphertext
  • the POS terminal sends the second working key ciphertext to the receiver.
  • the present invention also provides a POS terminal comprising one or more processors and a memory, the memory storing a program and configured to perform the following steps by the one or more processors:
  • the utility model has the beneficial effects that the POS terminal has a security authentication security module and has the characteristics of attack detection and key attack self-destruction.
  • the present invention uses a POS terminal as an intermediary for forwarding the sender's work key to the receiver. It has high security.
  • the sender injects the first protection key into the POS terminal in a secure manner, so that the work key can be securely transmitted between the sender and the POS terminal. Thereafter, the sender can deliver the POS terminal to the receiver by mail or other physical transportation, and the receiver injects the second protection key into the POS terminal in a secure manner.
  • the POS terminal After receiving the work key ciphertext sent by the sender, the POS terminal obtains the work key plaintext by using the first protection key, and encrypts the work key plaintext by using the second protection key, so that the work key can be
  • the POS terminal and the receiver are securely transmitted, and the receiver can obtain the working key plaintext according to the second protection key.
  • encryption conversion in the security area of the POS terminal has high security.
  • the key manager injects the protection key in the security room of the sender and the receiver respectively. In the present invention, the sender and the receiver do not need to negotiate.
  • the protection key each of which uses its own protection key to ensure that the work key can be securely transmitted with the POS terminal.
  • the method for transmitting a key and the POS terminal provided by the present invention do not require special key management.
  • the member negotiates the protection key between the sender and the receiver, and the POS terminal as the intermediary has high security. There is no need to worry about the security management mechanism vulnerability of the other security room during the process of injecting the protection key. sexual impact, with high convenience and security.
  • the sender does not need to manage the protection keys of different receivers, and the receiver can replace the second protection key as needed to improve the security of the work key transmission.
  • FIG. 1 is a flow chart of a specific implementation manner of a method for transmitting a key according to the present invention
  • FIG. 2 is a structural block diagram of a specific implementation manner of a POS terminal according to the present invention.
  • the most critical technical idea of the present invention is that the present invention uses a POS terminal as an intermediary for forwarding the working key of the sender to the recipient, and the sender and the receiver respectively set the protection secret for securely transmitting data with the POS terminal.
  • the key improves the convenience of setting a protection key for securely transferring a work key.
  • FIG. 1 and FIG. 2 Please refer to FIG. 1 and FIG. 2,
  • the present invention provides a method for transmitting a key, including:
  • a POS terminal acquires a first protection key corresponding to the sender.
  • the POS terminal acquires a second protection key corresponding to the receiver.
  • the POS terminal decrypts the first working key ciphertext from the sender according to the first protection key, to obtain a working key plaintext;
  • the POS terminal encrypts the working key plaintext according to the second protection key to obtain a second working key ciphertext
  • the POS terminal sends the second working key ciphertext to the receiver.
  • S1 is specifically:
  • the POS terminal joins a local area network corresponding to the sender
  • the POS terminal receives a first protection key from the sender.
  • the sender injects the first protection key into the POS terminal in a secure transmission manner, so that the work key can be securely transmitted to the POS terminal.
  • S2 is specifically:
  • the POS terminal joins a local area network corresponding to the receiving party
  • the POS terminal receives a second protection key from the recipient.
  • the receiver injects the second protection key into the POS terminal in a secure transmission manner, so that the POS terminal can securely transmit the work key to the receiver.
  • S3 is specifically:
  • the first protection key includes a first key component and a second key component
  • the POS terminal acquires a first data packet corresponding to the first work key ciphertext
  • the POS terminal acquires a MAC value corresponding to the first data packet from the sender, to obtain a first MAC value;
  • the POS terminal performs MAC operation on the first data packet according to the first key component to obtain a second MAC value
  • the POS terminal decrypts the first working key ciphertext according to the second key component to obtain a working key plaintext.
  • the POS terminal verifies the integrity and certifiability of the data packet sent by the sender through the MAC check, so as to prevent the data packet carrying the work key from being tampered during the transmission process, which is beneficial to improving the transmission work confidentiality. Key security.
  • S4 is specifically:
  • the second protection key includes a fourth key component
  • the POS terminal encrypts the working key plaintext according to the fourth key component to obtain a second working key ciphertext.
  • S5 is specifically:
  • the second protection key further includes a third key component
  • the POS terminal generates a second data packet corresponding to the second work key ciphertext
  • the POS terminal performs MAC operation on the second data packet according to the third key component to obtain a third MAC value
  • the POS terminal sends the third MAC value to the receiver, so that the receiving verifies the integrity of the second data packet according to the third MAC value.
  • the POS terminal calculates the MAC value of the second data packet by using the third key component agreed with the receiver in advance, so that the receiver can use the third key component to verify after receiving the second data packet.
  • the integrity and certifiability of the second data packet is such that the second data packet carrying the working key is tampered with during the transmission process, which is beneficial to improving the security of the transmission working key.
  • the POS terminal uses the X9.19 algorithm for MAC operations.
  • the symmetric key algorithm generally uses the X9.9 or X9.19 algorithm for MAC operations, and the X9.19 algorithm with X9.9 has higher complexity and is more difficult to be cracked. It is beneficial to improve the accuracy of verifying whether the data message has been tampered with.
  • the POS terminal adds an IP address corresponding to the recipient.
  • the POS terminal can establish a communication connection with the sender and the receiver to transmit data through the IP addresses of the sender and the receiver.
  • the present invention also provides a POS terminal including one or more processors 1 and a memory 2, the memory 2 storing a program and configured to be executed by the one or more processors 1. The following steps:
  • S1 is specifically:
  • S2 is specifically:
  • S3 is specifically:
  • the first protection key includes a first key component and a second key component
  • S4 is specifically:
  • the second protection key includes a fourth key component
  • S5 is specifically:
  • the second protection key further includes a third key component
  • the X9.19 algorithm is used for MAC operations.
  • Embodiment 1 of the present invention is:
  • This embodiment provides a method for transmitting a key, including:
  • a POS terminal acquires a first protection key corresponding to the sender. Specifically:
  • the POS terminal joins a local area network corresponding to the sender; the POS terminal receives a first protection key from the sender.
  • the POS terminal adds an IP address corresponding to the sender.
  • the POS vendor prepares the key POS (the POS terminal) and injects two key components respectively, and the key POS synthesizes the final first protection key PK1 in the security zone and stores In the secure storage area; then set the IP address of the vendor system. After the preparation is completed, the key POS is mailed to the customer.
  • the POS terminal acquires a second protection key corresponding to the receiver. Specifically:
  • the POS terminal joins a local area network corresponding to the recipient; the POS terminal receives a second protection key from the recipient.
  • the POS terminal adds an IP address corresponding to the receiver.
  • the client After receiving the parent POS, the client (receiver) checks whether the device is attacked (checks whether the POS appearance is damaged. If an attack occurs, the parent POS interface will have obvious attack alarm prompt information after power-on startup). After confirming the security, generate the security. Two key components are injected into the parent POS, and the key mother POS synthesizes the final second protection key PK2 in the security zone and stores it in the secure storage area; then the client needs to set the IP address of the receiving key system. .
  • the POS terminal decrypts the first working key ciphertext from the sender according to the first protection key, to obtain a working key plaintext. Specifically:
  • the first protection key includes a first key component and a second key component
  • the POS terminal acquires a first data packet corresponding to the first work key ciphertext
  • the POS terminal acquires a MAC value corresponding to the first data packet from the sender, to obtain a first MAC value;
  • the POS terminal performs MAC operation on the first data packet according to the first key component to obtain a second MAC value
  • the POS terminal decrypts the first working key ciphertext according to the second key component to obtain a working key plaintext.
  • the key POS derives two keys, PK1_TEK (second key component) and PK1_MAK (first key component) from PK1, and then initiates a transaction request to the POS vendor to connect to the POS vendor's key management system.
  • PK1_TEK is used to encrypt the work key to ensure the confidentiality of the key
  • PK1_MAK is used to calculate the check value MAC for the data message using the X9.19 algorithm to ensure the integrity and certifiability of the transaction message.
  • the POS terminal encrypts the working key plaintext according to the second protection key to obtain a second working key ciphertext. Specifically:
  • the second protection key includes a third key component and a fourth key component
  • the POS terminal encrypts the working key plaintext according to the fourth key component to obtain a second working key ciphertext.
  • the POS terminal sends the second working key ciphertext to the receiver. Specifically:
  • the POS terminal generates a second data packet corresponding to the second work key ciphertext
  • the POS terminal performs MAC operation on the second data packet according to the third key component to obtain a third MAC value
  • the POS terminal sends the third MAC value to the receiver, so that the receiving verifies the integrity of the second data packet according to the third MAC value.
  • the key mother POS derives PK2, obtains two keys PK2_TEK (fourth key component) and PK2_MAK (third key component), and converts the working key from PK1_TEK encryption into a local security zone.
  • PK2_TEK encryption verifying that the check value of the working key is correct during the encryption process, and then calculating the X9.19MAC value using PK2_MAK for the message; the key parent POS will use the PK2_TEK encrypted work key ciphertext using the transaction form.
  • the key management system sent to the client; the client's key management system uses PK2 to verify the integrity and authenticity of the received key data in the same way, and confirms that the check value is correct and stores it in the database.
  • the X9.19 algorithm is used for MAC operations.
  • the present embodiment stores two protection keys through a key POS, and the key POS establishes a secure channel with both parties of the transaction, and the key POS can automatically transfer the key in the secure channel. It eliminates most of the manual operations, which is indeed feasible and effective.
  • PK1 is the key that the manufacturer injects into the parent POS in the form of key component (PK1 belongs to the regional master key, according to the management principle of the regional master key. It should be generated and injected through at least two key components.
  • the work key to encryption phase is performed in the security zone of the key parent POS.
  • the self-destruction of the POS itself and the protection against various attacks ensure the phase.
  • Security the work key is sent to the customer's key management system stage, encrypted with the customer's protection key PK2, which is the protection key that the customer injects into the parent POS in its own location. Security requirements are met at all stages of key storage and transmission, and the reliance on the other system is minimized.
  • the MAK derived from PK1 and PK2 is used to calculate the MAC for the transaction message to ensure the integrity and certifiability in the data transmission process.
  • the key consistency is also ensured by means of Key Check Value (KCV).
  • Embodiment 2 of the present invention is:
  • the embodiment provides a POS terminal comprising one or more processors 1 and a memory 2, the memory 2 storing a program and configured to perform the following steps by the one or more processors 1:
  • S1 Obtain a first protection key corresponding to the sender.
  • the method includes: adding a local area network corresponding to the sender; and receiving a first protection key from the sender.
  • the method includes: adding a local area network corresponding to the receiver; and receiving a second protection key from the receiver.
  • the first protection key includes a first key component and a second key component
  • the second protection key includes a third key component and a fourth key component
  • the X9.19 algorithm is used for MAC operations.
  • the present invention provides a method for transmitting a key and a POS terminal.
  • the sender and the receiver do not need to negotiate a protection key, and each uses its own protection key to ensure that it can be associated with the POS terminal. It is sufficient to transmit the work key securely. Therefore, the method for transmitting a key and the POS terminal provided by the present invention do not require a special key administrator to negotiate a protection key between the sender and the receiver, and the POS terminal acts as an intermediary. It has high security, and there is no need to worry about the impact of the security management mechanism vulnerability of the other security room on the security of the protection key during the process of injecting the protection key, which has high convenience and security.
  • the sender does not need to manage the protection keys of different receivers, and the receiver can replace the second protection key as needed to improve the security of the work key transmission.
  • the sender injects the first protection key into the POS terminal in a secure transmission manner, so that the work key can be securely transmitted to the POS terminal.
  • the receiving party injects the second protection key into the POS terminal in a secure transmission manner, so that the POS terminal can securely transmit the working key to the receiving party.
  • the POS terminal verifies the integrity and certifiability of the data packet sent by the sender through the MAC check, so as to prevent the data packet carrying the work key from being tampered during the transmission process, which is beneficial to improving the transmission work key. safety.
  • the POS terminal calculates the MAC value of the second data packet by using the third key component agreed with the receiver in advance, so that the receiver can use the third key component to verify the second after receiving the second data packet.
  • the integrity and authentiability of the data packet are in case the second data packet carrying the working key is tampered with during the transmission process, which is beneficial to improving the security of the transmission working key.
  • the symmetric key algorithm generally uses the X9.9 or X9.19 algorithm for MAC operations, and the X9.19 algorithm with X9.9 has higher complexity and is more difficult to be cracked. Improve the accuracy of verifying that data packets have been tampered with.
  • the POS terminal can establish a communication connection with the sender and the receiver to transmit data through the IP addresses of the sender and the receiver.

Abstract

本发明涉及数据安全领域，尤其涉及一种传输密钥的方法及POS终端。本发明通过一POS终端获取与发送方对应的第一保护密钥；所述一POS终端获取与接收方对应的第二保护密钥；所述一POS终端根据所述第一保护密钥解密来自所述发送方的第一工作密钥密文，得到工作密钥明文；所述一POS终端根据所述第二保护密钥加密所述工作密钥明文，得到第二工作密钥密文；所述一POS终端发送所述第二工作密钥密文至所述接收方。实现提高设置用于安全传输工作密钥的保护密钥的便利性。

Description

一种传输密钥的方法及POS终端 技术领域
本发明涉及数据安全领域，尤其涉及一种传输密钥的方法及POS终端。
 背景技术
在金融交易系统中，为了传输工作密钥，交易双方通常需要协商保护密钥，又称为区域主密钥（ZMK）。其中，保护密钥用于安全地在发送方与接收方之间传输工作密钥。目前，为了保证ZMK的安全性，通常的做法是交易双方各自生成一个ZMK的分量，然后安排专门的密钥管理员到对方的安全房分别完成密钥注入。或者由一方生成2个密钥分量，然后到对方安全房的硬件安全模块（HSM）中进行密钥注入。
上述常用的保护密钥协商方式，都需要操作人员移步客户现场以完成保护密钥注入。注入保护密钥过程中需要彼此信任对方的安全管控流程，且后续交易过程中，如果出现保护密钥不一致问题时，需要较为繁琐的确认流程，人力成本开销大，且开发调试流程繁琐。对于POS设备厂商来说，采用上述方案，需要管理多个客户的保护密钥，为满足不同客户不同的安全需求，需要较高级别的安全设施以及专门的密钥管理团队进行运维，增加了设备厂商的运营成本。
 技术问题
本发明所要解决的技术问题是：如何提高设置用于安全传输工作密钥的保护密钥的便利性。
 技术解决方案
为了解决上述技术问题，本发明采用的技术方案为：
本发明提供一种传输密钥的方法，包括：
S1、一POS终端获取与发送方对应的第一保护密钥；
S2、所述一POS终端获取与接收方对应的第二保护密钥；
S3、所述一POS终端根据所述第一保护密钥解密来自所述发送方的第一工作密钥密文，得到工作密钥明文；
S4、所述一POS终端根据所述第二保护密钥加密所述工作密钥明文，得到第二工作密钥密文；
S5、所述一POS终端发送所述第二工作密钥密文至所述接收方。
本发明还提供一种POS终端，包括一个或多个处理器及存储器，所述存储器存储有程序，并且被配置成由所述一个或多个处理器执行以下步骤：
S1、获取与发送方对应的第一保护密钥；
S2、获取与接收方对应的第二保护密钥；
S3、根据所述第一保护密钥解密来自所述发送方的第一工作密钥密文，得到工作密钥明文；
S4、根据所述第二保护密钥加密所述工作密钥明文，得到第二工作密钥密文；
S5、发送所述第二工作密钥密文至所述接收方。
 有益效果
本发明的有益效果在于：POS终端具有经过安全认证的安全模块，还具有攻击检测和密钥攻击自毁的特性，本发明将一POS终端作为将发送方的工作密钥转发至接收方的中介具有较高的安全性。发送方通过安全的方式往所述一POS终端注入第一保护密钥，使得工作密钥可安全地在发送方与所述一POS终端之间传输。此后，发送方即可将所述一POS终端以邮寄等其它物理运输方式交付至接收方，接收方通过安全的方式往所述一POS终端注入第二保护密钥。所述一POS终端在接收到发送方发送的工作密钥密文后，使用第一保护密钥获取工作密钥明文，并使用第二保护密钥加密工作密钥明文，使得工作密钥可在所述一POS终端和接收方之间安全传输，且接收方可根据第二保护密钥获取工作密钥明文。其中，在POS终端的安全区域内进行加密转换具有较高的安全性。区别于现有技术需在发送方和接收方协商好保护密钥后，再由密钥管理人员分别在发送方和接收方的安全房注入保护密钥，本发明中发送方和接收方无需协商保护密钥，各自使用自身的保护密钥保证可与所述一POS终端之间安全地传输工作密钥即可，因此本发明所提供的传输密钥的方法及POS终端无需专门的密钥管理员在发送方与接收方之间协商保护密钥，且作为中介的POS终端具有较高的安全性，无需担心在注入保护密钥过程中，对方安全房的安全管控机制漏洞对保护密钥安全性的影响，具有较高的便利性和安全性。此外，发送方无需管理不同接收方的保护密钥，接收方可根据需要随时更换第二保护密钥以提高工作密钥传输的安全性。
 附图说明
图1为本发明提供的一种传输密钥的方法的具体实施方式的流程框图；
图2为本发明提供的一种POS终端的具体实施方式的结构框图；
标号说明：
1、处理器；    2、存储器。
具体实施方式
本发明最关键的技术构思在于：本发明以一POS终端作为将发送方的工作密钥转发至接收方的中介，并由发送方和接收方分别设置与POS终端之间安全传输数据的保护密钥，提高了设置用于安全传输工作密钥的保护密钥的便利性。
请参照图1以及图2，
如图1所示，本发明提供一种传输密钥的方法，包括：
S1、一POS终端获取与发送方对应的第一保护密钥；
S2、所述一POS终端获取与接收方对应的第二保护密钥；
S3、所述一POS终端根据所述第一保护密钥解密来自所述发送方的第一工作密钥密文，得到工作密钥明文；
S4、所述一POS终端根据所述第二保护密钥加密所述工作密钥明文，得到第二工作密钥密文；
S5、所述一POS终端发送所述第二工作密钥密文至所述接收方。
进一步地，所述S1具体为：
所述一POS终端加入与所述发送方对应的局域网；
所述一POS终端接收来自所述发送方的第一保护密钥。
由上述描述可知，发送方采用安全地传输方式将第一保护密钥注入POS终端，使得可将工作密钥安全地传输至POS终端。
进一步地，所述S2具体为：
所述一POS终端加入与所述接收方对应的局域网；
所述一POS终端接收来自所述接收方的第二保护密钥。
由上述描述可知，接收方采用安全地传输方式将第二保护密钥注入POS终端，使得POS终端可安全地将工作密钥传输至接收方。
进一步地，所述S3具体为：
所述第一保护密钥包括第一密钥分量和第二密钥分量；
所述一POS终端获取与所述第一工作密钥密文对应的第一数据报文；
所述一POS终端获取来自所述发送方的与所述第一数据报文对应的MAC值，得到第一MAC值；
所述一POS终端根据所述第一密钥分量对所述第一数据报文进行MAC运算，得到第二MAC值；
当所述第一MAC值与所述第二MAC值相同时，所述一POS终端根据所述第二密钥分量解密所述第一工作密钥密文，得到工作密钥明文。
由上述描述可知，POS终端通过MAC校验验证发送方发送的数据报文的完整性和可认证性，以防在传输过程中携带工作密钥的数据报文被篡改，有利于提高传输工作密钥的安全性。
进一步地，所述S4具体为：
所述第二保护密钥包括第四密钥分量；
所述一POS终端根据所述第四密钥分量加密所述工作密钥明文，得到第二工作密钥密文。
进一步地，所述S5具体为：
所述第二保护密钥还包括第三密钥分量；
所述一POS终端生成与所述第二工作密钥密文对应的第二数据报文；
所述一POS终端根据所述第三密钥分量对所述第二数据报文进行MAC运算，得到第三MAC值；
所述一POS终端发送所述第二数据报文至所述接收方；
所述一POS终端发送所述第三MAC值至所述接收方，以使所述接收根据所述第三MAC值验证所述第二数据报文的完整性。
由上述描述可知，POS终端采用与接收方事先约定的第三密钥分量计算第二数据报文的MAC值，使得接收方在接收到第二数据报文后，可采用第三密钥分量验证第二数据包文的完整性和可认证性，以防携带工作密钥的第二数据报文在传输过程中被篡改，有利于提高传输工作密钥的安全性。
进一步地，还包括：
所述一POS终端采用X9.19算法进行MAC运算。
由上述描述可知，在金融支付领域，对称密钥算法一般使用X9.9或X9.19算法进行MAC运算，而X9.19相对X9.9的算法复杂性更高，被破解的难度更大，有利于提高验证数据报文是否被篡改的准确性。
进一步地，还包括：
所述一POS终端添加与所述发送方对应的IP地址；
所述一POS终端添加与所述接收方对应的IP地址。
由上述描述可知，通过发送方和接收方的IP地址使得所述一POS终端可与发送方和接收方之间建立通信连接以传输数据。
如图2所示，本发明还提供一种POS终端，包括一个或多个处理器1及存储器2，所述存储器2存储有程序，并且被配置成由所述一个或多个处理器1执行以下步骤：
S1、获取与发送方对应的第一保护密钥；
S2、获取与接收方对应的第二保护密钥；
S3、根据所述第一保护密钥解密来自所述发送方的第一工作密钥密文，得到工作密钥明文；
S4、根据所述第二保护密钥加密所述工作密钥明文，得到第二工作密钥密文；
S5、发送所述第二工作密钥密文至所述接收方。
进一步地，所述S1具体为：
加入与所述发送方对应的局域网；
接收来自所述发送方的第一保护密钥。
进一步地，所述S2具体为：
加入与所述接收方对应的局域网；
接收来自所述接收方的第二保护密钥。
进一步地，所述S3具体为：
所述第一保护密钥包括第一密钥分量和第二密钥分量；
获取与所述第一工作密钥密文对应的第一数据报文；
获取来自所述发送方的与所述第一数据报文对应的MAC值，得到第一MAC值；
根据所述第一密钥分量对所述第一数据报文进行MAC运算，得到第二MAC值；
当所述第一MAC值与所述第二MAC值相同时，根据所述第二密钥分量解密所述第一工作密钥密文，得到工作密钥明文。
进一步地，所述S4具体为：
所述第二保护密钥包括第四密钥分量；
根据所述第四密钥分量加密所述工作密钥明文，得到第二工作密钥密文。
进一步地，所述S5具体为：
所述第二保护密钥还包括第三密钥分量；
生成与所述第二工作密钥密文对应的第二数据报文；
根据所述第三密钥分量对所述第二数据报文进行MAC运算，得到第三MAC值；
发送所述第二数据报文至所述接收方；
发送所述第三MAC值至所述接收方，以使所述接收根据所述第三MAC值验证所述第二数据报文的完整性。
进一步地，还包括：
采用X9.19算法进行MAC运算。
进一步地，还包括：
添加与所述发送方对应的IP地址；
添加与所述接收方对应的IP地址。
本发明的实施例一为：
本实施例提供一种传输密钥的方法，包括：
S1、一POS终端获取与发送方对应的第一保护密钥。具体为：
所述一POS终端加入与所述发送方对应的局域网；所述一POS终端接收来自所述发送方的第一保护密钥。
S2、所述一POS终端添加与所述发送方对应的IP地址。
其中，POS厂商（发送方）准备密钥母POS（所述一POS终端），并分别注入2个密钥分量，密钥母POS在安全区内合成最终的第一保护密钥PK1，并存储在安全存储区；然后设置访问厂商系统的IP地址。准备完毕后，将密钥母POS邮寄给客户。
S3、所述一POS终端获取与接收方对应的第二保护密钥。具体为：
所述一POS终端加入与所述接收方对应的局域网；所述一POS终端接收来自所述接收方的第二保护密钥。
S4、所述一POS终端添加与所述接收方对应的IP地址。
其中，客户（接收方）收到母POS之后，检查设备是否受到攻击（检查POS外观是否损坏，如果出现攻击，上电启动后母POS界面会有明显的攻击报警提示信息），确认安全后，生成2个密钥分量，分别注入到母POS中，密钥母POS在安全区内合成最终的第二保护密钥PK2，并存储在安全存储区；随后客户需要设置其接收密钥系统的IP地址。
S5、所述一POS终端根据所述第一保护密钥解密来自所述发送方的第一工作密钥密文，得到工作密钥明文。具体为：
所述第一保护密钥包括第一密钥分量和第二密钥分量；
所述一POS终端获取与所述第一工作密钥密文对应的第一数据报文；
所述一POS终端获取来自所述发送方的与所述第一数据报文对应的MAC值，得到第一MAC值；
所述一POS终端根据所述第一密钥分量对所述第一数据报文进行MAC运算，得到第二MAC值；
当所述第一MAC值与所述第二MAC值相同时，所述一POS终端根据所述第二密钥分量解密所述第一工作密钥密文，得到工作密钥明文。
其中，密钥母POS将PK1衍生出2个密钥，PK1_TEK（第二密钥分量）和PK1_MAK（第一密钥分量），然后向POS厂商发起交易请求，连接到POS厂商的密钥管理系统获取工作密钥，PK1_TEK用于加密工作密钥，确保密钥的机密性；PK1_MAK用于对数据报文使用X9.19算法计算校验值MAC，确保交易报文的完整性和可认证性。
S6、所述一POS终端根据所述第二保护密钥加密所述工作密钥明文，得到第二工作密钥密文。具体为：
所述第二保护密钥包括第三密钥分量和第四密钥分量；
所述一POS终端根据所述第四密钥分量加密所述工作密钥明文，得到第二工作密钥密文。
S7、所述一POS终端发送所述第二工作密钥密文至所述接收方。具体为：
所述一POS终端生成与所述第二工作密钥密文对应的第二数据报文；
所述一POS终端根据所述第三密钥分量对所述第二数据报文进行MAC运算，得到第三MAC值；
所述一POS终端发送所述第二数据报文至所述接收方；
所述一POS终端发送所述第三MAC值至所述接收方，以使所述接收根据所述第三MAC值验证所述第二数据报文的完整性。
其中，密钥母POS对PK2进行衍生，得到2个密钥PK2_TEK（第四密钥分量）和PK2_MAK（第三密钥分量），并在本地的安全区内将工作密钥由PK1_TEK加密转为PK2_TEK加密，转加密过程中同时验证工作密钥的校验值是否正确，然后对报文使用PK2_MAK计算X9.19MAC值；密钥母POS将使用交易形式将采用PK2_TEK加密后的工作密钥密文发送给客户的密钥管理系统；客户的密钥管理系统按照同样的方式，使用PK2验证收到的密钥数据的完整性和真实性，确认校验值无误后存储在数据库。
可选地，采用X9.19算法进行MAC运算。
由上述描述可知，本实施例通过一个密钥母POS存储2个保护密钥，密钥母POS分别与交易的双方建立了安全通道，密钥母POS可以在这个安全通道内自动传递密钥，免去了大部分的人工操作，这是确实可行的，有效的。
本实施例在密钥传输的3个阶段，都有专用的密钥进行保护。密钥母POS从厂商的密钥管理系统获取密钥时，使用PK1保护，PK1是厂商以密钥分量形式注入母POS的密钥(PK1属于区域主密钥，按照区域主密钥的管理原则应通过至少2个密钥分量的形式生成和注入)；工作密钥转加密阶段，是在密钥母POS的安全区进行，POS本身的攻击自毁和防范各种攻击的特性保证了该阶段的安全性；工作密钥上送到客户的密钥管理系统阶段，使用客户的保护密钥PK2加密，PK2是客户在自己所在地以分量形式注入到母POS的保护密钥。在密钥存储和传输的各个阶段，均满足安全性的要求，且在最大程度上降低了对对方系统的依赖。
本实施例采用PK1和PK2衍生出的MAK对交易报文计算MAC，保证数据传输过程中的完整性和可认证性。对密钥部分，还通过密钥校验值（Key Check Value， KCV）的方式保证了密钥的一致性。
本发明的实施例二为：
本实施例提供一种POS终端，包括一个或多个处理器1及存储器2，所述存储器2存储有程序，并且被配置成由所述一个或多个处理器1执行以下步骤：
S1、获取与发送方对应的第一保护密钥。具体为：加入与所述发送方对应的局域网；接收来自所述发送方的第一保护密钥。
S2、添加与所述发送方对应的IP地址。
S3、获取与接收方对应的第二保护密钥。具体为：加入与所述接收方对应的局域网；接收来自所述接收方的第二保护密钥。
S4、添加与所述接收方对应的IP地址。
S5、根据所述第一保护密钥解密来自所述发送方的第一工作密钥密文，得到工作密钥明文。具体为：
所述第一保护密钥包括第一密钥分量和第二密钥分量；
获取与所述第一工作密钥密文对应的第一数据报文；
获取来自所述发送方的与所述第一数据报文对应的MAC值，得到第一MAC值；
根据所述第一密钥分量对所述第一数据报文进行MAC运算，得到第二MAC值；
当所述第一MAC值与所述第二MAC值相同时，根据所述第二密钥分量解密所述第一工作密钥密文，得到工作密钥明文。
S6、根据所述第二保护密钥加密所述工作密钥明文，得到第二工作密钥密文。具体为：
所述第二保护密钥包括第三密钥分量和第四密钥分量；
根据所述第四密钥分量加密所述工作密钥明文，得到第二工作密钥密文。
S7、发送所述第二工作密钥密文至所述接收方。具体为：
生成与所述第二工作密钥密文对应的第二数据报文；
根据所述第三密钥分量对所述第二数据报文进行MAC运算，得到第三MAC值；
发送所述第二数据报文至所述接收方；
发送所述第三MAC值至所述接收方，以使所述接收根据所述第三MAC值验证所述第二数据报文的完整性。
可选地，采用X9.19算法进行MAC运算。
综上所述，本发明提供的一种传输密钥的方法及POS终端，本发明中发送方和接收方无需协商保护密钥，各自使用自身的保护密钥保证可与所述一POS终端之间安全地传输工作密钥即可，因此本发明所提供的传输密钥的方法及POS终端无需专门的密钥管理员在发送方与接收方之间协商保护密钥，且作为中介的POS终端具有较高的安全性，无需担心在注入保护密钥过程中，对方安全房的安全管控机制漏洞对保护密钥安全性的影响，具有较高的便利性和安全性。此外，发送方无需管理不同接收方的保护密钥，接收方可根据需要随时更换第二保护密钥以提高工作密钥传输的安全性。进一步地，发送方采用安全地传输方式将第一保护密钥注入POS终端，使得可将工作密钥安全地传输至POS终端。进一步地，接收方采用安全地传输方式将第二保护密钥注入POS终端，使得POS终端可安全地将工作密钥传输至接收方。进一步地，POS终端通过MAC校验验证发送方发送的数据报文的完整性和可认证性，以防在传输过程中携带工作密钥的数据报文被篡改，有利于提高传输工作密钥的安全性。进一步地，POS终端采用与接收方事先约定的第三密钥分量计算第二数据报文的MAC值，使得接收方在接收到第二数据报文后，可采用第三密钥分量验证第二数据包文的完整性和可认证性，以防携带工作密钥的第二数据报文在传输过程中被篡改，有利于提高传输工作密钥的安全性。进一步地，在金融支付领域，对称密钥算法一般使用X9.9或X9.19算法进行MAC运算，而X9.19相对X9.9的算法复杂性更高，被破解的难度更大，有利于提高验证数据报文是否被篡改的准确性。进一步地，通过发送方和接收方的IP地址使得所述一POS终端可与发送方和接收方之间建立通信连接以传输数据。

Claims (16)

  1. 一种传输密钥的方法，其特征在于，包括：
    S1、一POS终端获取与发送方对应的第一保护密钥；
    S2、所述一POS终端获取与接收方对应的第二保护密钥；
    S3、所述一POS终端根据所述第一保护密钥解密来自所述发送方的第一工作密钥密文，得到工作密钥明文；
    S4、所述一POS终端根据所述第二保护密钥加密所述工作密钥明文，得到第二工作密钥密文；
    S5、所述一POS终端发送所述第二工作密钥密文至所述接收方。
  2. 根据权利要求1所述的传输密钥的方法，其特征在于，所述S1具体为：
    所述一POS终端加入与所述发送方对应的局域网；
    所述一POS终端接收来自所述发送方的第一保护密钥。
  3. 根据权利要求1所述的传输密钥的方法，其特征在于，所述S2具体为：
    所述一POS终端加入与所述接收方对应的局域网；
    所述一POS终端接收来自所述接收方的第二保护密钥。
  4. 根据权利要求1所述的传输密钥的方法，其特征在于，所述S3具体为：
    所述第一保护密钥包括第一密钥分量和第二密钥分量；
    所述一POS终端获取与所述第一工作密钥密文对应的第一数据报文；
    所述一POS终端获取来自所述发送方的与所述第一数据报文对应的MAC值，得到第一MAC值；
    所述一POS终端根据所述第一密钥分量对所述第一数据报文进行MAC运算，得到第二MAC值；
    当所述第一MAC值与所述第二MAC值相同时，所述一POS终端根据所述第二密钥分量解密所述第一工作密钥密文，得到工作密钥明文。
  5. 根据权利要求1所述的传输密钥的方法，其特征在于，所述S4具体为：
    所述第二保护密钥包括第四密钥分量；
    所述一POS终端根据所述第四密钥分量加密所述工作密钥明文，得到第二工作密钥密文。
  6. 根据权利要求5所述的传输密钥的方法，其特征在于，所述S5具体为：
    所述第二保护密钥还包括第三密钥分量；
    所述一POS终端生成与所述第二工作密钥密文对应的第二数据报文；
    所述一POS终端根据所述第三密钥分量对所述第二数据报文进行MAC运算，得到第三MAC值；
    所述一POS终端发送所述第二数据报文至所述接收方；
    所述一POS终端发送所述第三MAC值至所述接收方，以使所述接收根据所述第三MAC值验证所述第二数据报文的完整性。
  7. 根据权利要求4或6所述的传输密钥的方法，其特征在于，还包括：
    所述一POS终端采用X9.19算法进行MAC运算。
  8. 根据权利要求1所述的传输密钥的方法，其特征在于，还包括：
    所述一POS终端添加与所述发送方对应的IP地址；
    所述一POS终端添加与所述接收方对应的IP地址。
  9. 一种POS终端，其特征在于，包括一个或多个处理器及存储器，所述存储器存储有程序，并且被配置成由所述一个或多个处理器执行以下步骤：
    S1、获取与发送方对应的第一保护密钥；
    S2、获取与接收方对应的第二保护密钥；
    S3、根据所述第一保护密钥解密来自所述发送方的第一工作密钥密文，得到工作密钥明文；
    S4、根据所述第二保护密钥加密所述工作密钥明文，得到第二工作密钥密文；
    S5、发送所述第二工作密钥密文至所述接收方。
  10. 根据权利要求9所述的POS终端，其特征在于，所述S1具体为：
    加入与所述发送方对应的局域网；
    接收来自所述发送方的第一保护密钥。
  11. 根据权利要求9所述的POS终端，其特征在于，所述S2具体为：
    加入与所述接收方对应的局域网；
    接收来自所述接收方的第二保护密钥。
  12. 根据权利要求9所述的POS终端，其特征在于，所述S3具体为：
    所述第一保护密钥包括第一密钥分量和第二密钥分量；
    获取与所述第一工作密钥密文对应的第一数据报文；
    获取来自所述发送方的与所述第一数据报文对应的MAC值，得到第一MAC值；
    根据所述第一密钥分量对所述第一数据报文进行MAC运算，得到第二MAC值；
    当所述第一MAC值与所述第二MAC值相同时，根据所述第二密钥分量解密所述第一工作密钥密文，得到工作密钥明文。
  13. 根据权利要求9所述的POS终端，其特征在于，所述S4具体为：
    所述第二保护密钥包括第四密钥分量；
    根据所述第四密钥分量加密所述工作密钥明文，得到第二工作密钥密文。
  14. 根据权利要求13所述的POS终端，其特征在于，所述S5具体为：
    所述第二保护密钥还包括第三密钥分量；
    生成与所述第二工作密钥密文对应的第二数据报文；
    根据所述第三密钥分量对所述第二数据报文进行MAC运算，得到第三MAC值；
    发送所述第二数据报文至所述接收方；
    发送所述第三MAC值至所述接收方，以使所述接收根据所述第三MAC值验证所述第二数据报文的完整性。
  15. 根据权利要求12或14所述的POS终端，其特征在于，还包括：
    采用X9.19算法进行MAC运算。
  16. 根据权利要求9所述的POS终端，其特征在于，还包括：
    添加与所述发送方对应的IP地址；
    添加与所述接收方对应的IP地址。
PCT/CN2018/079727 2018-03-21 2018-03-21 一种传输密钥的方法及pos终端 WO2019178760A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2018/079727 WO2019178760A1 (zh) 2018-03-21 2018-03-21 一种传输密钥的方法及pos终端
CN201880000197.5A CN108496336A (zh) 2018-03-21 2018-03-21 一种传输密钥的方法及pos终端

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2018/079727 WO2019178760A1 (zh) 2018-03-21 2018-03-21 一种传输密钥的方法及pos终端

Publications (1)

Publication Number Publication Date
WO2019178760A1 true WO2019178760A1 (zh) 2019-09-26

Family

ID=63343455

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/079727 WO2019178760A1 (zh) 2018-03-21 2018-03-21 一种传输密钥的方法及pos终端

Country Status (2)

Country Link
CN (1) CN108496336A (zh)
WO (1) WO2019178760A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114039728A (zh) * 2021-12-24 2022-02-11 中电长城(长沙)信息技术有限公司 一种报文加解密方法及其系统

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2020133068A1 (zh) * 2018-12-27 2020-07-02 福建联迪商用设备有限公司 一种传递密钥的方法、终端及系统
CN110795743B (zh) * 2019-09-12 2022-03-25 连连银通电子支付有限公司 数据写入、读取、加密方法和装置，及数据传输系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060093149A1 (en) * 2004-10-30 2006-05-04 Shera International Ltd. Certified deployment of applications on terminals
CN101841809A (zh) * 2010-03-31 2010-09-22 候万春 一种支持仿真pos交易的移动电话终端和系统
CN105260884A (zh) * 2015-11-18 2016-01-20 北京微智全景信息技术有限公司 Pos机密钥分发方法及装置
CN106357394A (zh) * 2016-08-29 2017-01-25 福建新大陆支付技术有限公司 一种母pos灌装密钥的安全方法

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102752309A (zh) * 2005-04-22 2012-10-24 汤姆森特许公司 用于移动设备对无线局域网的安全匿名接入的方法
CN105978856B (zh) * 2016-04-18 2019-01-25 随行付支付有限公司 一种pos机密钥下载方法、装置及系统
CN105897748B (zh) * 2016-05-27 2019-05-10 飞天诚信科技股份有限公司 一种对称密钥的传输方法及设备
CN107070653B (zh) * 2017-05-05 2020-07-10 长沙卡友信息服务股份有限公司 一种pos交易加密系统、方法、posp前置服务器和pos终端
CN107733639B (zh) * 2017-08-24 2020-08-04 深圳壹账通智能科技有限公司 密钥管理方法、装置及可读存储介质

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060093149A1 (en) * 2004-10-30 2006-05-04 Shera International Ltd. Certified deployment of applications on terminals
CN101841809A (zh) * 2010-03-31 2010-09-22 候万春 一种支持仿真pos交易的移动电话终端和系统
CN105260884A (zh) * 2015-11-18 2016-01-20 北京微智全景信息技术有限公司 Pos机密钥分发方法及装置
CN106357394A (zh) * 2016-08-29 2017-01-25 福建新大陆支付技术有限公司 一种母pos灌装密钥的安全方法

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114039728A (zh) * 2021-12-24 2022-02-11 中电长城(长沙)信息技术有限公司 一种报文加解密方法及其系统

Also Published As

Publication number Publication date
CN108496336A (zh) 2018-09-04

Similar Documents

Publication Publication Date Title
CN109728909B (zh) 基于USBKey的身份认证方法和系统
CN103118027B (zh) 基于国密算法建立tls通道的方法
CN111416807B (zh) 数据获取方法、装置及存储介质
CN104158653B (zh) 一种基于商密算法的安全通信方法
CN103338215B (zh) 基于国密算法建立tls通道的方法
US8291231B2 (en) Common key setting method, relay apparatus, and program
CN108513704B (zh) 终端主密钥的远程分发方法及其系统
CN107888560B (zh) 一种移动智能终端邮件安全传输系统及方法
CN101409619B (zh) 闪存卡及虚拟专用网密钥交换的实现方法
CN109495274A (zh) 一种去中心化智能锁电子钥匙分发方法及系统
US9876773B1 (en) Packet authentication and encryption in virtual networks
US11831753B2 (en) Secure distributed key management system
CN102957708B (zh) 应用软件加解密方法、服务器和终端
CN106411926A (zh) 一种数据加密通信方法及系统
CN107104795B (zh) Rsa密钥对和证书的注入方法、架构及系统
CN105162808A (zh) 一种基于国密算法的安全登录方法
TWI501614B (zh) Symmetric Dynamic Authentication and Key Exchange System and Its
WO2018120938A1 (zh) 密钥离线传输方法、终端和存储介质
WO2019178760A1 (zh) 一种传输密钥的方法及pos终端
CN107635227A (zh) 一种群组消息加密方法及装置
CN104767766A (zh) 一种Web Service接口验证方法、Web Service服务器、客户端
CA2561644C (en) A method to leverage a secure device to grant trust and identity to a second device
CN110266485A (zh) 一种基于NB-IoT的物联网安全通信控制方法
CN108959962B (zh) 一种动态库的api安全调用方法
JPH10240826A (ja) 電子契約方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18910907

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18910907

Country of ref document: EP

Kind code of ref document: A1