WO2011069325A1 - Procédé permettant de vérifier la validité d'un numéro d'identification personnel dans les transactions avec autorisation d'un mandataire - Google Patents

Procédé permettant de vérifier la validité d'un numéro d'identification personnel dans les transactions avec autorisation d'un mandataire Download PDF

Info

Publication number
WO2011069325A1
WO2011069325A1 PCT/CN2010/001823 CN2010001823W WO2011069325A1 WO 2011069325 A1 WO2011069325 A1 WO 2011069325A1 CN 2010001823 W CN2010001823 W CN 2010001823W WO 2011069325 A1 WO2011069325 A1 WO 2011069325A1
Authority
WO
WIPO (PCT)
Prior art keywords
pin
pvn
key
card
authorized
Prior art date
Application number
PCT/CN2010/001823
Other languages
English (en)
Chinese (zh)
Inventor
李伟
李凯
周文
Original Assignee
***股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by ***股份有限公司 filed Critical ***股份有限公司
Publication of WO2011069325A1 publication Critical patent/WO2011069325A1/fr

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/04—Payment circuits
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/02—Payment architectures, schemes or protocols involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/22—Payment schemes or models
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07F—COIN-FREED OR LIKE APPARATUS
    • G07F7/00—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
    • G07F7/08—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means
    • G07F7/10—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means together with a coded signal, e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
    • G07F7/1025—Identification of user by a PIN code
    • G07F7/1075—PIN is checked remotely
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07F—COIN-FREED OR LIKE APPARATUS
    • G07F7/00—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
    • G07F7/08—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means
    • G07F7/10—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means together with a coded signal, e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
    • G07F7/1025—Identification of user by a PIN code
    • G07F7/1091—Use of an encrypted form of the PIN

Definitions

  • the present invention relates to a bank card authorization service, and more particularly to a method for password authentication in a bank card authorization service.
  • BACKGROUND When a member bank system fails to process a bank card service, it needs to be authorized by an authorized organization (for example, China UnionPay). In order to improve the accuracy of the agent authorization, the card authenticity and card security are required.
  • the current common practice is to verify the information including the length of the card number, the check digit of the card number, and the CVN according to the requirements of the card issuer.
  • the card number length check is to check whether the length of the card number in the transaction message sent by the acquiring bank is the same as that provided by the issuing bank.
  • the card number check digit check is check, and the last digit of the card number in the transaction message sent by the acquiring bank is the same as that calculated by the standard card number check digit algorithm.
  • the CVN check is to check whether the CVN value in the track information in the transaction message sent by the acquiring bank is correct.
  • the main function of the card number length check and the card number check bit check is to prevent misuse, and the CVN check prevents the situation of the fake card and the fake card to a certain extent.
  • none of the above solutions can verify the correctness of card passwords.
  • the invention provides a method for verifying the correctness of the PIN, and solves the problem of correcting the password in the bank card authorization service. The method is further used on the basis of the traditional calibration method, thereby reducing the wrong authorization in the authorized service. The probability of improving the security of the card.
  • the object of the present invention is to provide a method for verifying PIN correctness in an authorized service, which can reduce the probability of erroneous authorization in the authorized service and improve the security of the card.
  • the invention discloses a method for verifying PIN correctness in the authorization service.
  • Step 1 The card issuing bank adopts the PVN algorithm and uses the key.
  • KEY PVN encrypts each PIN with a secret card to obtain the PVN value of each card.
  • Step 2 The issuing bank transmits the PVN value information of all cards to the authorized organization through the file form, and after receiving the authorization, the issuing organization will The PVN value is stored in the database;
  • Step 3 The issuing bank informs the authorized organization of the cardholder's password modification, and replaces the original PVN value in the database after receiving the system of the authorized organization;
  • Step 4 When the bank card transaction needs to be authorized
  • the authorized authorization system of the authorized organization receives the encrypted PIN, it searches through the database through the card number. If it is not found, it indicates that the card does not need to be verified by PVN. The password verification is passed. If found, the next step is performed.
  • step 5 if found, the authorization system first decrypts the encrypted PIN, and then uses the PVN algorithm to make Key KEY PVN, PVN calculated value, and for comparison with PVN values stored in the database, and if the same then the correct PIN, password authentication. Otherwise, explain PIN is incorrect, the end of the transaction.
  • the PVN value information is transmitted to the authorized organization in a file format in the form of a card number and a PVN value.
  • the cardholder password modification is performed by using the card number and the PVN value. The format of the pair is transferred to the authorized organization by file.
  • the encrypted PIN received by the authorized authorization system of the authorized organization in step 4 is received by the bank and encrypted by the PIN input by the card KEY PIf .
  • Authorized organization, in step 5, the authorization system of the authorized organization is decrypted by the key KEY 1) If ⁇ ⁇ encrypted PIN, the acceptance bank is the accepting unit of the cardholder to conduct the transaction. Further, the cardholder password modification in step 3 is automatically transmitted to the authorized organization at a set frequency, and the set frequency is at least once a day. Further, the steps of calculating the PVN value in step 1 are as follows: a. Setting the left 64 bits of the PIN verification key PVK is the key KeyA, and the right 64 bits are the key KeyB;
  • Block3 performs DES encryption operation on the Block with the key KeyA, and get the result Blockl; d. Perform DES decryption operation on the Block1 with the key KeyB, and obtain the result Block 2 ; e. Perform DES encryption operation on the Block2 with the key KeyA, and obtain the result.
  • DRAWINGS 1 is a basic flow chart of the authorization service;
  • FIG. 2 is a flow chart of PVN information transmission according to the present invention;
  • FIG. 3 is a flow chart of PVN information verification according to the present invention.
  • DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT Based on the above situation, we propose a method for verifying PIN correctness in the authorized service, which reduces the probability of erroneous authorization in the authorized service, and improves the security of the card.
  • the verification method of the authorized service of the present invention is opened.
  • the issuing bank of the authorized business first encrypts each PIN with a PIN card by using the PVN (PIN verification number) algorithm developed by an authorized organization (for example, China UnionPay) to obtain the PVN value (PVN VALUE ) of each card.
  • PVN PIN verification number
  • an authorized organization for example, China UnionPay
  • the PVN value information of all cards is automatically transmitted to the authorized organization through the file form in a paired format (card number, PVN value), and stored on behalf of the authorized organization for storage; when the member bank system has problems, the bank card business cannot be processed.
  • the authorization system will decrypt the received encrypted PIN with the key of the acquiring bank, regenerate the PVN value according to the card issuing bank's key, and compare it with the stored PVN value. Consistent to verify the legality of the card.
  • Figure 1 reveals the basic process of the authorized business. The basic process of the bank's authorized business is as follows:
  • the member bank system may notify the authorized organization to authorize the transaction of the bank card
  • the authorization system will perform the inter-bank transaction on behalf of the member bank. Inspection (including PVN verification) and quota control inspection, direct authorization of the transaction passed through the inspection and return to the acceptance bank via the transfer system, if the inspection fails, the transaction fails;
  • the issuing bank that initiates the authorization service first uses the PVN algorithm to encrypt each PIN with a PIN card to obtain the PVN value of each card, and the PVN value of all cards in the paired format (card number, PVN value). The information is automatically transferred to the authorized organization through the file form, and is stored on behalf of the authorized organization.
  • the specific process is shown in Figure 2. The steps are as follows:
  • the issuing bank adopts the PVN algorithm, encrypts each PIN with a secret card using the key KEY PVN , and obtains the PVN value of each card;
  • the issuing bank transmits the PVN value information of all cards to the authorized organization in the form of card number and PVN value pair. After receiving the data, the PVN value is stored in the database.
  • the issuing bank will set the frequency (for example, once a day, or twice, three times or more times a day, the specific time interval can be set as needed), automatically through the file form (with the card number, the modified PVN value The format of the pair) informs the authorized organization of the modification of the cardholder's password, and replaces the original PVN value on behalf of the authorized organization's system.
  • the authorized organization starts the generation of the authorization service.
  • Figure 3 shows the process of PVN verification. The steps are as follows:
  • the acceptance bank adopts the PIN encryption algorithm, encrypts the PIN input by the cardholder with the key KEY PIN , and sends it to the authorized organization.
  • the acceptance bank refers to the accepting unit that the cardholder conducts the transaction;
  • the authorized authorization system of the authorized organization After the authorized authorization system of the authorized organization receives the encrypted PIN, it searches through the PVN value database through the card number. If it is not found, it indicates that the card does not need to be verified by PVN, and the password verification is passed; 3. If found, the authorization system first decrypts with the key KEYPIN, then uses the PVN algorithm to calculate the PVN value using the key KEY PVN , and compares it with the PVN value stored in the database. The PIN is correct, otherwise the PIN is incorrect.
  • step 2 when the PVN value corresponding to the card number is not found, it indicates that the card does not need to perform PVN verification, and the password verification is passed, and the generation authorization is directly performed; in step 3, if the calculated PVN value is in the database If the stored PVN values are the same, the verification is passed, and the authorization is performed. Otherwise, the authorization is rejected and the transaction is terminated.
  • the basic principle of the PVN algorithm, the calculation steps of the PVN value are as follows:
  • step 8 Take the first 4 digits of the result of step 8, which is the PVN value.
  • the verification problem of the correctness of the password in the authorized service is solved, so that the generation authorization of the password card is more accurate and reliable, and the security level is equivalent to the PIN conversion method adopted in the current inter-bank service, but irreversible decryption, that is, The PVN value cannot decrypt the clear code of the PIN, that is, the authorized organization that engages in the authorized service cannot obtain the clear code of the bank card PIN.
  • the foregoing PVN algorithm is only one of the algorithms capable of achieving the object of the present invention. Those skilled in the art can achieve equivalent purposes by making simple mathematical changes to the algorithm or using other similar algorithms, which are all within the scope of the present invention. Inside.
  • the interval is too long, it is easy for the cardholder to change the password, but the PVN value in the database of the authorized organization is not updated, causing the PIN verification to fail; if the interval is too short, causing frequent file transfer, it needs to be based on the actual Appropriate adjustments are made to the usage, and it is generally recommended to update it once a day.

Landscapes

  • Business, Economics & Management (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Engineering & Computer Science (AREA)
  • Accounting & Taxation (AREA)
  • Strategic Management (AREA)
  • General Business, Economics & Management (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Finance (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
  • Storage Device Security (AREA)

Abstract

L'invention se rapporte à un procédé permettant de vérifier la validité d'un numéro d'identification personnel (PIN) dans les transactions avec autorisation d'un mandataire. Au cours de ce procédé : la banque d'émission qui initie la transaction avec autorisation d'un mandataire chiffre le PIN de chaque carte en le dotant d'un cryptogramme au moyen de l'algorithme du numéro de vérification de PIN (PVN) afin d'obtenir la valeur PVN de chaque carte, et elle transmet automatiquement à l'organisation d'autorisation mandataire les informations relatives aux valeurs PVN de toutes les cartes sous un format constitué de paires qui se composent des numéros de cartes et des valeurs PVN, et ce sous la forme d'un fichier, puis cette organisation reçoit et enregistre le fichier; lorsque l'autorisation est donnée par l'organisation d'autorisation mandataire pour le compte d'un système bancaire membre qui ne parvient pas à traiter la transaction de carte bancaire, le système d'autorisation mandataire déchiffre le PIN chiffré reçu à l'aide de la clé provenant d'une banque acceptante, il génère à nouveau une valeur PVN à l'aide de ladite clé, et il la compare à la valeur du PIN enregistré pour vérifier la validité du cryptogramme. Ce procédé limite les risques d'erreurs d'autorisation dans les transactions avec autorisation d'un mandataire et rend l'utilisation des cartes plus sûre.
PCT/CN2010/001823 2009-12-09 2010-11-15 Procédé permettant de vérifier la validité d'un numéro d'identification personnel dans les transactions avec autorisation d'un mandataire WO2011069325A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN2009102001741A CN102096968A (zh) 2009-12-09 2009-12-09 一种代授权业务中pin正确性验证的方法
CN200910200174.1 2009-12-09

Publications (1)

Publication Number Publication Date
WO2011069325A1 true WO2011069325A1 (fr) 2011-06-16

Family

ID=44130043

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2010/001823 WO2011069325A1 (fr) 2009-12-09 2010-11-15 Procédé permettant de vérifier la validité d'un numéro d'identification personnel dans les transactions avec autorisation d'un mandataire

Country Status (2)

Country Link
CN (1) CN102096968A (fr)
WO (1) WO2011069325A1 (fr)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103177388B (zh) * 2011-12-22 2016-12-07 ***股份有限公司 代授权***以及代授权方法
CN103903178B (zh) * 2012-12-27 2018-03-27 ***股份有限公司 一种用于代授权启停触发的集中监控装置和方法
CN103679965B (zh) * 2013-12-28 2016-06-22 汪风珍 带预警功能的银行卡***及其实施方法
CN104881595B (zh) * 2015-04-27 2017-08-04 广东省电子商务认证有限公司 基于pin码管理的自助远程解锁方法
CN113536287B (zh) * 2021-06-21 2024-06-21 苏州工业园区服务外包职业学院 信息校验方法、***、计算机设备及存储介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1260894A (zh) * 1997-06-27 2000-07-19 国民西敏寺银行 付款方法及其***
WO2002063580A2 (fr) * 2001-02-02 2002-08-15 Hodgson Robert B Dispositif et procede permettant des transactions securisees par carte de debit et carte de credit atm via internet
US20080077798A1 (en) * 2006-09-26 2008-03-27 Nachtigall Ernest H System and method for secure verification of electronic transactions

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
BR0308965A (pt) * 2002-04-03 2005-02-01 Swivel Secure Ltd Sistema e método para transação segura com cartão de crédito e/ou débito
EP1752937A1 (fr) * 2005-07-29 2007-02-14 Research In Motion Limited Système et méthode d'entrée chiffrée d'un numéro d'identification personnel d'une carte à circuit intégré

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1260894A (zh) * 1997-06-27 2000-07-19 国民西敏寺银行 付款方法及其***
WO2002063580A2 (fr) * 2001-02-02 2002-08-15 Hodgson Robert B Dispositif et procede permettant des transactions securisees par carte de debit et carte de credit atm via internet
US20080077798A1 (en) * 2006-09-26 2008-03-27 Nachtigall Ernest H System and method for secure verification of electronic transactions

Also Published As

Publication number Publication date
CN102096968A (zh) 2011-06-15

Similar Documents

Publication Publication Date Title
US7366903B1 (en) Card activated cash dispensing automated banking machine system and method
US8517262B2 (en) Automated banking machine that operates responsive to data bearing records
US7904713B1 (en) Card activated cash dispensing automated banking machine system and method
US6705517B1 (en) Automated banking machine system and method
US11182783B2 (en) Electronic payment method and electronic device using ID-based public key cryptography
US8090663B1 (en) Automated banking machine system and method
CN1831865B (zh) 一种基于cpk的电子银行安全认证***和方法
WO2021008453A1 (fr) Procédé et système de transaction de chaîne de blocs hors ligne sur la base d'une authentification d'identifiant
US20180276664A1 (en) Key download method and apparatus for pos terminal
US20160028548A1 (en) Key downloading method, management method, downloading management method, device and system
KR20170005400A (ko) 암호화 시스템 및 방법
WO2018096559A1 (fr) Système et procédé de traduction et d'authentification d'un pin sécurisée et de données sensibles
CN112419021B (zh) 电子***验证方法、***、存储介质、计算机设备、终端
TWI578253B (zh) 使用行動通訊裝置申請金融憑證之系統及其方法
WO2011069325A1 (fr) Procédé permettant de vérifier la validité d'un numéro d'identification personnel dans les transactions avec autorisation d'un mandataire
US9224144B2 (en) Securing communications with a pin pad
CN101097626A (zh) 带有电子标签的汇票的监管***和方法
US7434726B2 (en) Method and system for postdating of financial transactions
EP3675013A1 (fr) Procédé et dispositif pour des paiements push sécurisés
AU2018282255A1 (en) System and method for secure transmission of data and data authentication
CN201017377Y (zh) 带有电子标签的汇票的监管***
EP1547298B1 (fr) Systemes et procedes d'authentification securisee de transactions electroniques
RU2713873C1 (ru) Система удаленной загрузки комплекта ключей в смарт-терминал
US20240235841A1 (en) System and method for parallel manufacture and verification of one-time-password authentication cards
JP4334021B2 (ja) 読取り装置内の累積の証明方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 10835362

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 10835362

Country of ref document: EP

Kind code of ref document: A1