CN112583592A - How an encryption system works - Google Patents

本发明公开了一种加密系统的工作方法，包括以下步骤：S1，服务端生成密钥，并且将DUKPT应用导入到卡片，所述卡片具有防消磁护套；S2，服务端根据KSN生成IPEK密钥做备用；S3，客户端注入IPEK密钥，所述客户端在注入IPEK密钥时，客户端会对注入的信息进行验证；S4，客户端使用IPEK计算交易密钥。本发明加密系统在工作时，分别产生不同的密钥，而且对交易密钥和交易数据进行加密保护，保证信息初始的安全性，实现个人化BDK，IPEK，KEK和PEK多密钥类型进行加密，保证加密的稳定性和安全性，而且所有操作基于芯片卡内部运算，确保交易安全。The invention discloses a working method of an encryption system, comprising the following steps: S1, a server generates a key, and imports a DUKPT application into a card, the card has an anti-degaussing sheath; S2, the server generates an IPEK encryption key according to KSN The key is used as a backup; S3, the client injects the IPEK key, and when the client injects the IPEK key, the client verifies the injected information; S4, the client uses the IPEK to calculate the transaction key. When the encryption system of the present invention is working, different keys are generated respectively, and the transaction key and transaction data are encrypted and protected, so as to ensure the initial security of information, and realize the encryption of personalized BDK, IPEK, KEK and PEK multi-key types. , to ensure the stability and security of encryption, and all operations are based on the internal operation of the chip card to ensure transaction security.

Working method of encryption system

Technical Field

The invention relates to the technical field of information encryption, in particular to a working method of an encryption system.

Background

The online transaction is a transaction performed through the internet, and the transaction mainly completes purchase of various physical goods, information services and virtual products by virtue of virtual currency. The online transaction mainly is a transaction performed in a virtual environment of a network, and is similar to a store in the real world, and the difference is that a virtual transaction process from buying to selling is achieved by various means of electronic commerce. With the increasing deepening of the information era, chips gradually become the core of information products in various fields, and the chips cannot be separated from communication satellites and common mobile phones, identity cards, bank cards, automobiles, internet of things equipment and the like in life. In the digital age, information loss and divulgence can become hidden dangers affecting personal, social and even national security at any time. The important importance of ensuring the information security is to ensure the security of the information product core chip. At present, the security chip industry has been listed as one of the national information security strategies, and under the vigorous promotion of policies, a large number of security chips applied to different fields and even different business scenes emerge in the market,

dukpt (derived Unique Key Per transaction) is a set of Key management system and algorithm defined by ANSI, is used to solve the Key management problem in information security transmission in the field of financial payment, and is applied to data security aspects such as symmetric Key encryption MAC and PIN. The unique key is used in each transaction process, and an irreversible key conversion algorithm is adopted, so that the last transaction key cannot be cracked from the current transaction data information. It is required that the acquirer and the terminal must be synchronized to support the key management technology. Consists of two parts, a transaction initiating endpoint (S-TRSM, e.g., pos, ATM) and a transaction receiving endpoint (R-TRSM, e.g., acquirer). Note: TRSM (pointer-resistor Security Module) is a Security Module with attack blocking capability, and TRSM has attack resistance capability.

When a transaction is carried out, a lot of information of a user is needed, for example, fund information, position information and identity information of the user are needed, and the information is important to the privacy and safety of individuals in the current internet environment, so that the encryption protection of the personal information is very important when the transaction is carried out.

Disclosure of Invention

The invention aims to solve the defects in the prior art and provides a working method of an encryption system.

In order to achieve the purpose, the invention adopts the following technical scheme:

a method of operation of an encryption system comprising the steps of:

s1, the server generates a key and imports the DUKPT application into a card, and the card is provided with a degaussing prevention sheath;

s2, the server generates IPEK key for standby according to KSN;

s3, the client side injects IPEK key, when the client side injects IPEK key, the client side verifies the injected information;

s4, the client calculates the trade key by using IPEK;

s5, encrypting and protecting the password and the sensitive data by the client side by using the transaction key, wherein the client side is provided with an information packaging module and an information encoding module, the information packaging module packages the information generated by the transaction, and the information encoding module encodes the packaged information;

s6, the server side starts to analyze after receiving the KSN and the encrypted data of the client side;

s7, the server side starts to locate the BDK key;

s8, the server side generates IPEK again, the same transaction is simulated, the transaction data and KSN are collated, the data are analyzed, and the result is compared;

and S9, the server displays the comparison result and approves or rejects the encryption and decryption operation.

Preferably, the client is provided with a verification module, the server is provided with a verification information generation module, the verification information generation module generates verification information to the client, and the verification module on the client is used for verification.

Preferably, the server is provided with an analysis module for analyzing the KSN and the encrypted data sent by the client.

Preferably, the server and the client are both provided with encryption algorithms, the encryption algorithms on the server and the client are different and require different keys, and the server and the client are both provided with decoding modules for decoding the keys.

Preferably, the key generated by the server and the IPEK key generated by the server according to the KSN both have a use time limit, and the use time limit is 60 s.

Preferably, the client is provided with a positioning module for positioning the BDK key by the server, the client can be a handheld terminal and a fixed terminal, and the server is a server.

The encryption system provided by the invention respectively generates different keys when in work, and encrypts and protects the transaction key and transaction data, thereby ensuring the initial security of information, realizing the encryption of multiple key types of personal BDK, IPEK, KEK and PEK, ensuring the stability and security of encryption, and ensuring the transaction security based on the internal operation of a chip card.

Detailed Description

The technical solutions in the embodiments of the present invention will be clearly and completely described below, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all embodiments.

Examples

A method of operation of an encryption system comprising the steps of:

s1, the server generates a key and leads the DUKPT application into a card, and the card is provided with a demagnetization-preventing sheath;

s2, the server generates IPEK key for standby according to KSN;

s3, the client side injects IPEK key, when the client side injects IPEK key, the client side verifies the injected information;

s4, the client calculates the trade key by using IPEK;

s5, the client uses the trade key to encrypt and protect the password and the sensitive data, the client has an information packing module and an information coding module, the information packing module packs the information generated by the trade, and the information coding module codes the packed information;

s6, the server side starts to analyze after receiving the KSN and the encrypted data of the client side;

s7, the server side starts to locate the BDK key;

s8, the server side generates IPEK again, the same transaction is simulated, the transaction data and KSN are collated, the data are analyzed, and the result is compared;

and S9, the server displays the comparison result and approves or rejects the encryption and decryption operation.

In this embodiment, the client is provided with a verification module, the server is provided with a verification information generation module, the verification information generation module generates verification information to the client, and the verification module on the client is used for verification.

In this embodiment, the server is provided with an analysis module, and analyzes the KSN and the encrypted data sent by the client.

In this embodiment, the server and the client are both provided with encryption algorithms, the encryption algorithms on the server and the client are different, and different keys are required, and the server and the client are both provided with decoding modules for decoding the keys.

In this embodiment, both the key generated by the server and the IPEK key generated by the server according to the KSN have a use time limit, and the use time limit is 60 s.

In this embodiment, the client is provided with a positioning module for the server to position the BDK key, the client may be a handheld terminal or a fixed terminal, and the server is a server.

When the encryption system works, different keys are respectively generated, the transaction key and the transaction data are encrypted and protected, the initial security of information is guaranteed, the encryption of multiple key types of personal BDK, IPEK, KEK and PEK is realized, the encryption stability and security are guaranteed, and all operations are based on the internal operation of a chip card, so that the transaction security is guaranteed.

The above description is only for the preferred embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art should be considered to be within the technical scope of the present invention, and the technical solutions and the inventive concepts thereof according to the present invention should be equivalent or changed within the scope of the present invention.