CN110867018B - System and method for realizing safe PIN input on cash register with Android intelligent platform - Google Patents
System and method for realizing safe PIN input on cash register with Android intelligent platform Download PDFInfo
- Publication number
- CN110867018B CN110867018B CN201911190663.3A CN201911190663A CN110867018B CN 110867018 B CN110867018 B CN 110867018B CN 201911190663 A CN201911190663 A CN 201911190663A CN 110867018 B CN110867018 B CN 110867018B
- Authority
- CN
- China
- Prior art keywords
- card reading
- reading module
- password keyboard
- ciphertext
- smk
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G07—CHECKING-DEVICES
- G07F—COIN-FREED OR LIKE APPARATUS
- G07F7/00—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
- G07F7/08—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means
- G07F7/10—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means together with a coded signal, e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
- G07F7/1025—Identification of user by a PIN code
- G07F7/1033—Details of the PIN pad
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
- H04L63/067—Network architectures or network communication protocols for network security for supporting key management in a packet data network using one-time keys
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0869—Network architectures or network communication protocols for network security for authentication of entities for achieving mutual authentication
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
- H04L9/3273—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response for mutual authentication
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/56—Financial cryptography, e.g. electronic payment or e-cash
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
Abstract
The invention relates to the technical field of POS machine safety systems, in particular to a system and a method for realizing safe PIN input on an Android intelligent platform cash register; the system comprises a password keyboard, a card reading module and an android application, wherein the password keyboard is used for acquiring PIN data of a user; the card reading module is used for acquiring account data; the transaction key is downloaded at the card reading module end; and the android application end is used for packaging and analyzing the 8583 transaction message.
Description
Technical Field
The invention relates to the technical field of POS machine security systems, in particular to a system and a method for realizing security PIN input on an Android intelligent platform cash register.
Background
Compared with a cash register with a traditional closed system, the intelligent desktop cash register based on the Android system is a new product form in the market at present, the Android platform is more developed, the corresponding transaction risk is higher, the cash register cannot store and process sensitive data such as transaction keys, bank card information, user PIN and the like, in a bank card transaction scene, the bank card data of a user needs to be processed through an external or internal safety card reading module, and the PIN data input by the user needs to be processed through an external password keyboard.
The card reading module and the password keyboard in the intelligent desktop cash register system in the current market are two mutually independent functional modules, are not directly connected on hardware, but are respectively connected or embedded on a cash register host, and the card reading module and the password keyboard are communicated by forwarding data through a host end. Because the password keyboard is not necessarily integrated with a card processing function, information such as a card primary account number and the like needs to be transmitted to the password keyboard through a host terminal by a card reading module, the sensitive information needs to be protected according to the safety design requirements of the industry, and a plaintext cannot be directly exposed to the host terminal based on an Android system.
On the other hand, when the bank card is transacted, the transaction keys issued by the bank background mainly comprise a data encryption key (TDK) for encrypting card data, a PIN encryption key (TPK) for encrypting a user PIN and an MAC encryption key (TAK) for calculating 8583 transaction message MAC, because a PIN input function is input at a password keyboard end, three types of transaction passwords are mostly installed in a card reading module and a password keyboard respectively in the existing design, the design needs to ensure that the transaction keys of the bank background, the card reading module and the password keyboard are consistent, the password keyboard is used as an external device and is not in standard configuration, and most of the time, the user can pull and insert the transaction keys, which causes the complexity of transaction key data synchronization.
The method for carrying out mutual authentication between the card reader module and the password keyboard of the desktop cash register and constructing the safe encryption channel between the card reader module and the password keyboard meets the protection requirement of sensitive data of a user, and a new user PIN encryption scheme is designed, so that a transaction key only needs to be stored at the safe card reading module end and does not need to be issued to the password keyboard, the transaction can be completed only by ensuring that the transaction keys of the bank background and the card reading module are consistent, and the complexity of transaction key management in the whole system is simplified.
Disclosure of Invention
The invention provides a system and a method for realizing safe PIN input on an Android intelligent platform cash register, which can effectively solve the problems.
In order to achieve the purpose, the invention is realized by the following technical scheme:
a system for realizing safe PIN input on an Android intelligent platform cash register comprises a password keyboard, a card reading module and an Android application, wherein the password keyboard is used for acquiring PIN data of a user; the card reading module is used for acquiring account data; the transaction key is downloaded at the card reading module end; and the android application end is used for packaging and analyzing the 8583 transaction message.
Further, the password keyboard end only stores a temporary session key for protecting sensitive data.
The invention further provides a method for realizing safe PIN input on the cash register with the Android intelligent platform, which comprises the following steps:
s1: when the system is initialized, the android application at the host end triggers the mutual authentication between the card reading module and the password keyboard, and after the mutual authentication is successful, the same terminal Session Master Key (SMK) is negotiated between the password keyboard and the card reading module and is used for the subsequent trans-encryption of the user PIN;
s2: the card reading module and the password keyboard carry out encryption conversion on the PIN input by the user by utilizing a PAN randomly generated by the card reading module each time and a random PIN protection key (TSK) of one-time pad according to the card reading information and the PIN information input by the user, generate an actual transaction ciphertext, and package and send the actual transaction ciphertext to a bank transaction background through android application.
Further, the steps of the bidirectional authentication between the card reading module and the password keyboard in S1 are as follows:
s1.1, when equipment leaves a factory, the same authentication key (AUK) for terminal identity authentication is injected into a card reading module and a password keyboard, and the AUK corresponds to terminal information and has one secret;
s1.2, injecting the same terminal key encryption key (TEK) for decrypting and installing the session key master key SMK into the card reading module and the password keyboard when the equipment leaves a factory, wherein the TEK corresponds to the terminal information and is one secret for one machine;
s1.3, calling an authentication initialization interface of a card reading module by android application at a host terminal, generating an authentication random number RN1 by the card reading module and forwarding the authentication random number RN1 to a password keyboard through the android application;
s1.4 the password keyboard uses AUK to encrypt RN1 to obtain RN1 ciphertext;
s1.5, the password keyboard generates a random number RN2, and the RN1 ciphertext and the RN2 are forwarded to the card reading module through android application;
s1.6 the card reading module decrypts RN1 by using AUK and compares the plain texts of RN1 to determine whether the plain texts are consistent;
s1.7, the card reading module encrypts RN2 by using AUK to obtain an RN2 ciphertext;
the S1.8 card reading module generates a random number RN3, and forwards an RN2 ciphertext and RN3 to a password keyboard through android application;
s1.9 the password keyboard uses AUK to decrypt RN2, and whether the plain texts of RN2 are consistent or not is compared;
s1.10 the keypad uses AUK to encrypt RN 3;
s1.11, generating a random SMK by the password keyboard, and encrypting an SMK plaintext by using a TEK to obtain an SMK ciphertext;
s1.12, the RN3 ciphertext and the SMK ciphertext are forwarded to the card reading module through android application by the password keyboard;
s1.13 card reading module uses AUK to decrypt RN3, and compares the plaintext of RN3 to determine whether the plaintext is consistent;
s1.14, the card reading module decrypts the SMK ciphertext by using the TEK to obtain an SMK plaintext;
the TEK is used for installing the SMK after passing the authentication; the SMK as a session key master key is invalid after the terminal exits the online transaction mode, the session key is required to be handshake negotiated again when the transaction mode is restarted, and if any step fails in the process, the SMK is returned to the initial state.
Further, the user PIN encryption conversion process in S2 includes the following steps:
s2.1, calling a card reading module random primary account number generation interface by the android application at the host end, and generating a random primary account number PAN by the card reading module;
s2.2, the android application forwards the random PAN to the password keyboard;
s2.3, generating a random PIN protection key (TSK) by the password keyboard;
s2.4, the user inputs PIN at the end of the password keyboard, and the password keyboard encrypts the PIN by using the TSK and the random PAN to obtain a ciphertext PinBlock _ Enc 1;
s2.5, the SMK is used by the password keyboard to encrypt the TSK to obtain a TSK ciphertext;
s2.6, the PinBock _ Enc1 and the TSK ciphertext are forwarded to the card reading module through android application by the password keyboard;
s2.7, the card reading module decrypts the TSK ciphertext by using the SMK to obtain a TSK plaintext;
s2.8, the card reading module decrypts PinBlock _ Enc1 by using TSK plaintext and random PAN to restore a plaintext PIN input by a user;
s2.9, the card reading module encrypts a plaintext PIN by using a terminal transaction key (TPK) and an actual PAN of a user to obtain a ciphertext PinBlock _ Enc2 for actual transaction;
and the S2.10 card reading module returns PinBlock _ Enc2 to the android application, and the android application packages the PinBlock _ Enc2 into 8583 transaction messages and sends the transaction messages to the bank transaction background.
Further, the temporary session key TSK is regenerated every time it is transcrypted, once for one time.
Compared with the prior art, the invention has the beneficial effects that:
compared with the common asymmetric key authentication mode, the authentication speed based on the symmetric key is higher, the requirement on the operational capability of a CPU is lower, and the method better conforms to the characteristics of a password keyboard and a low-cost security module.
In addition, the PIN-to-encryption scheme of one-time pad design meets the safety requirement of PCI authentication, and the transaction key only needs to be stored at the safe card reading module end and does not need to be issued to a password keyboard, thereby simplifying the complexity of transaction key management in the whole system.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts.
FIG. 1 is a logical functional block diagram of a system of the present invention;
FIG. 2 is a flow chart of mutual authentication;
fig. 3 is a flow chart of encryption conversion of a user PIN.
Detailed Description
In order to make the objects, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are some, but not all, embodiments of the present invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
Referring to fig. 1 to 3, an embodiment of the present invention provides a system for implementing secure PIN input on an Android intelligent platform cash register, including a password keyboard, a card reading module, and an Android application, where the password keyboard is used to obtain PIN data of a user; the card reading module is used for acquiring account data such as IC \ magnetic card \ non-connected card and the like; the transaction key is downloaded at the card reading module end; the password keyboard end only stores a temporary session key for protecting sensitive data, and the android application end is used for packaging and analyzing 8583 transaction messages.
The invention further provides a method for realizing safe PIN input on the cash register with the Android intelligent platform, which comprises the following steps:
s1: when the system is initialized, the android application at the host end triggers the mutual authentication between the card reading module and the password keyboard, and after the mutual authentication is successful, the same terminal Session Master Key (SMK) is negotiated between the password keyboard and the card reading module and is used for the subsequent trans-encryption of the user PIN;
s2: the card reading module and the password keyboard carry out encryption conversion on the PIN input by the user by utilizing a PAN randomly generated by the card reading module each time and a random PIN protection key (TSK) of one-time pad according to the card reading information and the PIN information input by the user, generate an actual transaction ciphertext, and package and send the actual transaction ciphertext to a bank transaction background through android application.
Further, the steps of the bidirectional authentication between the card reading module and the password keyboard in S1 are as follows:
s1.1, when equipment leaves a factory, the same authentication key (AUK) for terminal identity authentication is injected into a card reading module and a password keyboard, and the AUK corresponds to terminal information and has one secret;
s1.2, injecting the same terminal key encryption key (TEK) for decrypting and installing the session key master key SMK into the card reading module and the password keyboard when the equipment leaves a factory, wherein the TEK corresponds to the terminal information and is one secret for one machine;
s1.3, calling an authentication initialization interface of a card reading module by android application at a host terminal, generating an authentication random number RN1 by the card reading module and forwarding the authentication random number RN1 to a password keyboard through the android application;
s1.4 the password keyboard uses AUK to encrypt RN1 to obtain RN1 ciphertext;
s1.5, the password keyboard generates a random number RN2, and the RN1 ciphertext and the RN2 are forwarded to the card reading module through android application;
s1.6 the card reading module decrypts RN1 by using AUK and compares the plain texts of RN1 to determine whether the plain texts are consistent;
s1.7, the card reading module encrypts RN2 by using AUK to obtain an RN2 ciphertext;
the S1.8 card reading module generates a random number RN3, and forwards an RN2 ciphertext and RN3 to a password keyboard through android application;
s1.9 the password keyboard uses AUK to decrypt RN2, and whether the plain texts of RN2 are consistent or not is compared;
s1.10 the keypad uses AUK to encrypt RN 3;
s1.11, generating a random SMK by the password keyboard, and encrypting an SMK plaintext by using a TEK to obtain an SMK ciphertext;
s1.12, the RN3 ciphertext and the SMK ciphertext are forwarded to the card reading module through android application by the password keyboard;
s1.13 card reading module uses AUK to decrypt RN3, and compares the plaintext of RN3 to determine whether the plaintext is consistent;
s1.14, the card reading module decrypts the SMK ciphertext by using the TEK to obtain an SMK plaintext;
the TEK is used for installing the SMK after passing the authentication; the SMK as a session key master key is invalid after the terminal exits the online transaction mode, the session key is required to be handshake negotiated again when the transaction mode is restarted, and if any step fails in the process, the SMK is returned to the initial state.
The authentication random number used in the process is encrypted by AUK, and each step of data interaction is provided with the authentication random number, so that the aim of preventing replay attack is fulfilled.
Further, the user PIN encryption conversion process in S2 includes the following steps:
s2.1, calling a card reading module random primary account number generation interface by the android application at the host end, and generating a random primary account number PAN by the card reading module;
s2.2, the android application forwards the random PAN to the password keyboard;
s2.3, generating a random PIN protection key (TSK) by the password keyboard;
s2.4, the user inputs PIN at the end of the password keyboard, and the password keyboard encrypts the PIN by using the TSK and the random PAN to obtain a ciphertext PinBlock _ Enc 1;
s2.5, the SMK is used by the password keyboard to encrypt the TSK to obtain a TSK ciphertext;
s2.6, the PinBock _ Enc1 and the TSK ciphertext are forwarded to the card reading module through android application by the password keyboard;
s2.7, the card reading module decrypts the TSK ciphertext by using the SMK to obtain a TSK plaintext;
s2.8, the card reading module decrypts PinBlock _ Enc1 by using TSK plaintext and random PAN to restore a plaintext PIN input by a user;
s2.9, the card reading module encrypts a plaintext PIN by using a terminal transaction key (TPK) and an actual PAN of a user to obtain a ciphertext PinBlock _ Enc2 for actual transaction;
and the S2.10 card reading module returns PinBlock _ Enc2 to the android application, and the android application packages the PinBlock _ Enc2 into 8583 transaction messages and sends the transaction messages to the bank transaction background.
In the above steps, the temporary session key TSK is regenerated every time encryption is performed, once for one time.
The random PAN used to generate PinBlock _ Enc1 is generated by the card reading module to avoid replay attacks.
It is noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in a process, method, article, or apparatus that comprises the element.
The above examples are only intended to illustrate the technical solution of the present invention, but not to limit it; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some technical features may be equivalently replaced; and such modifications or substitutions do not depart from the spirit and scope of the corresponding technical solutions of the embodiments of the present invention.
Claims (3)
1. A method for realizing safe PIN input on an Android intelligent platform cash register is characterized by comprising the following steps:
s1: when the system is initialized, the android application at the host end triggers the mutual authentication between the card reading module and the password keyboard, and after the mutual authentication is successful, the same terminal Session Master Key (SMK) is negotiated between the password keyboard and the card reading module and is used for the subsequent trans-encryption of the user PIN;
s2: the card reading module and the password keyboard carry out encryption conversion on the PIN input by the user by utilizing a PAN randomly generated by the card reading module each time and a random PIN protection key (TSK) of one-time pad according to the card reading information and the PIN information input by the user, generate an actual transaction ciphertext, and package and send the actual transaction ciphertext to a bank transaction background through android application;
the process of mutual authentication between the card reading module and the password keyboard in the step S1 includes the following steps:
s1.1, when equipment leaves a factory, the same authentication key (AUK) for terminal identity authentication is injected into a card reading module and a password keyboard, and the AUK corresponds to terminal information and has one secret;
s1.2, injecting the same terminal key encryption key (TEK) for decrypting and installing the session key master key SMK into the card reading module and the password keyboard when the equipment leaves a factory, wherein the TEK corresponds to the terminal information and is one secret for one machine;
s1.3, calling an authentication initialization interface of a card reading module by android application at a host terminal, generating an authentication random number RN1 by the card reading module and forwarding the authentication random number RN1 to a password keyboard through the android application;
s1.4 the password keyboard uses AUK to encrypt RN1 to obtain RN1 ciphertext;
s1.5, the password keyboard generates a random number RN2, and the RN1 ciphertext and the RN2 are forwarded to the card reading module through android application;
s1.6 the card reading module decrypts RN1 by using AUK and compares the plain texts of RN1 to determine whether the plain texts are consistent;
s1.7, the card reading module encrypts RN2 by using AUK to obtain an RN2 ciphertext;
the S1.8 card reading module generates a random number RN3, and forwards an RN2 ciphertext and RN3 to a password keyboard through android application;
s1.9 the password keyboard uses AUK to decrypt RN2, and whether the plain texts of RN2 are consistent or not is compared;
s1.10 the keypad uses AUK to encrypt RN 3;
s1.11, generating a random SMK by the password keyboard, and encrypting an SMK plaintext by using a TEK to obtain an SMK ciphertext;
s1.12, the RN3 ciphertext and the SMK ciphertext are forwarded to the card reading module through android application by the password keyboard;
s1.13 card reading module uses AUK to decrypt RN3, and compares the plaintext of RN3 to determine whether the plaintext is consistent;
s1.14, the card reading module decrypts the SMK ciphertext by using the TEK to obtain an SMK plaintext;
the TEK is used for installing the SMK after passing the authentication; the SMK as a session key master key is invalid after the terminal exits the online transaction mode, the session key is required to be handshake negotiated again when the transaction mode is restarted, and if any step fails in the process, the SMK is returned to the initial state.
2. The method for realizing safe PIN input on the Android intelligent platform cash register according to claim 1, wherein the user PIN encryption conversion process in S2 comprises the following steps:
s2.1, calling a card reading module random primary account number generation interface by the android application at the host end, and generating a random primary account number PAN by the card reading module;
s2.2, the android application forwards the random PAN to the password keyboard;
s2.3, generating a random PIN protection key (TSK) by the password keyboard;
s2.4, the user inputs PIN at the end of the password keyboard, and the password keyboard encrypts the PIN by using the TSK and the random PAN to obtain a ciphertext PinBlock _ Enc 1;
s2.5, the SMK is used by the password keyboard to encrypt the TSK to obtain a TSK ciphertext;
s2.6, the PinBock _ Enc1 and the TSK ciphertext are forwarded to the card reading module through android application by the password keyboard;
s2.7, the card reading module decrypts the TSK ciphertext by using the SMK to obtain a TSK plaintext;
s2.8, the card reading module decrypts PinBlock _ Enc1 by using TSK plaintext and random PAN to restore a plaintext PIN input by a user;
s2.9, the card reading module encrypts a plaintext PIN by using a terminal transaction key (TPK) and an actual PAN of a user to obtain a ciphertext PinBlock _ Enc2 for actual transaction;
and the S2.10 card reading module returns PinBlock _ Enc2 to the android application, and the android application packages the PinBlock _ Enc2 into 8583 transaction messages and sends the transaction messages to the bank transaction background.
3. The method for realizing the safe PIN input on the Android intelligent platform cash register is characterized in that the temporary session key TSK is regenerated once every encryption.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911190663.3A CN110867018B (en) | 2019-11-28 | 2019-11-28 | System and method for realizing safe PIN input on cash register with Android intelligent platform |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911190663.3A CN110867018B (en) | 2019-11-28 | 2019-11-28 | System and method for realizing safe PIN input on cash register with Android intelligent platform |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN110867018A CN110867018A (en) | 2020-03-06 |
| CN110867018B true CN110867018B (en) | 2020-11-27 |
Family
ID=69656714
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201911190663.3A Active CN110867018B (en) | 2019-11-28 | 2019-11-28 | System and method for realizing safe PIN input on cash register with Android intelligent platform |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110867018B (en) |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111914312B (en) * | 2020-08-07 | 2024-02-13 | 上海方付通科技服务股份有限公司 | Terminal password keyboard system based on film card hardware and PIN code protection method |
| CN114330396B (en) * | 2021-12-31 | 2023-10-13 | 福建新大陆支付技术有限公司 | External password keyboard and identity card information interaction method based on Android platform |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| EP1152378A2 (en) * | 2000-04-28 | 2001-11-07 | Ncr International Inc. | Encrypting keypad module |
| CN103237005A (en) * | 2013-03-15 | 2013-08-07 | 福建联迪商用设备有限公司 | Method and system for key management |
| CN204965627U (en) * | 2015-08-12 | 2016-01-13 | 浙江联亿家科技有限公司 | Intelligence cash registering machine device |
| CN205656721U (en) * | 2016-05-17 | 2016-10-19 | 福建新大陆支付技术有限公司 | Based on intelligence POS safety circuit of android system |
| CN108809925A (en) * | 2017-10-26 | 2018-11-13 | 深圳市移卡科技有限公司 | POS terminal data encryption and transmission method, terminal device and storage medium |
| CN109033771A (en) * | 2012-12-12 | 2018-12-18 | 环汇***有限公司 | System and method for carrying out PIN input on the mobile apparatus |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20110071949A1 (en) * | 2004-09-20 | 2011-03-24 | Andrew Petrov | Secure pin entry device for mobile phones |
-
2019
- 2019-11-28 CN CN201911190663.3A patent/CN110867018B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| EP1152378A2 (en) * | 2000-04-28 | 2001-11-07 | Ncr International Inc. | Encrypting keypad module |
| CN109033771A (en) * | 2012-12-12 | 2018-12-18 | 环汇***有限公司 | System and method for carrying out PIN input on the mobile apparatus |
| CN103237005A (en) * | 2013-03-15 | 2013-08-07 | 福建联迪商用设备有限公司 | Method and system for key management |
| CN204965627U (en) * | 2015-08-12 | 2016-01-13 | 浙江联亿家科技有限公司 | Intelligence cash registering machine device |
| CN205656721U (en) * | 2016-05-17 | 2016-10-19 | 福建新大陆支付技术有限公司 | Based on intelligence POS safety circuit of android system |
| CN108809925A (en) * | 2017-10-26 | 2018-11-13 | 深圳市移卡科技有限公司 | POS terminal data encryption and transmission method, terminal device and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN110867018A (en) | 2020-03-06 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| EP2991267B1 (en) | Apparatus for providing puf-based hardware otp and method for authenticating 2-factor using same | |
| CN112805967B (en) | System and method for password authentication of contactless card | |
| CN108234132B (en) | Secure communication system and method for main control chip and encryption chip | |
| US10909531B2 (en) | Security for mobile applications | |
| US6073237A (en) | Tamper resistant method and apparatus | |
| ES2456815T3 (en) | User authentication procedures in data processing systems | |
| CN1913427B (en) | System and method for encrypted smart card PIN entry | |
| BR102014023229A2 (en) | method for multi-factor transaction authentication using wearable devices | |
| CN105656862B (en) | Authentication method and device | |
| CN104579679B (en) | Wireless public network data forwarding method for agriculture distribution communication equipment | |
| TW201428529A (en) | A fingerprint authentication system and fingerprint authentication method based on the near field communication (NFC) | |
| CA2838763A1 (en) | Credential authentication methods and systems | |
| CN101483654A (en) | Method and system for implementing authentication and data safe transmission | |
| CN108323230B (en) | Method for transmitting key, receiving terminal and distributing terminal | |
| CN110867018B (en) | System and method for realizing safe PIN input on cash register with Android intelligent platform | |
| CN114567470B (en) | SDK-based multi-system key splitting verification system and method | |
| KR100968494B1 (en) | Tag security processing method using One Time Password | |
| CN108768941A (en) | A kind of method and device of remote de-locking safety equipment | |
| CN105608775B (en) | A kind of method of authentication, terminal, access card and SAM card | |
| CN110100411B (en) | Cryptographic system management | |
| CN111901312A (en) | Method, system, equipment and readable storage medium for network access control | |
| EP3556046B1 (en) | Method for secure management of secrets in a hierarchical multi-tenant environment | |
| KR101947408B1 (en) | Puf-based hardware device for providing one time password, and method for 2-factor authenticating using thereof | |
| CN114692120A (en) | State password authentication method, virtual machine, terminal equipment, system and storage medium | |
| KR20190002388A (en) | Puf-based hardware device for providing one time password, and method for 2-factor authenticating using thereof |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |