WO2011069325A1

WO2011069325A1 - Method for verifying validity of personal identification number in proxy authorization business

Info

Publication number: WO2011069325A1
Application number: PCT/CN2010/001823
Authority: WO
Inventors: 李伟; 李凯; 周文
Original assignee: 中国银联股份有限公司
Priority date: 2009-12-09
Filing date: 2010-11-15
Publication date: 2011-06-16
Also published as: CN102096968A

Abstract

A method for verifying the validity of a personal identification number(PIN) in proxy authorization business is provided, which comprises: the issuing bank that opens the proxy authorization business encrypts the PIN of every card with a cryptogram using the PIN verification number(PVN) algorithm to acquire the PVN value of every card, and automatically transmits the information about PVN values of all the cards in the format of pairs consisting of card numbers and PVN values, in the form of a file, to the proxy authorization organization that receives and stores it; when the authorization is made by the proxy authorization on behalf of a member banking system that fails to deal with the bank card business, the proxy authorization system decrypts the received encrypted PIN with the key from an accepting bank, regenerates a PVN value with the key from the issuing bank, and compares it with the stored PIN value to verify the validity of the cryptogram. The method reduces the probability of authorization errors in the proxy authorization business and enhances the security of using cards.

Description

Method for correcting PIN correctness in generation authorization business

TECHNICAL FIELD The present invention relates to a bank card authorization service, and more particularly to a method for password authentication in a bank card authorization service. BACKGROUND When a member bank system fails to process a bank card service, it needs to be authorized by an authorized organization (for example, China UnionPay). In order to improve the accuracy of the agent authorization, the card authenticity and card security are required. To confirm to a certain extent, the current common practice is to verify the information including the length of the card number, the check digit of the card number, and the CVN according to the requirements of the card issuer. The card number length check is to check whether the length of the card number in the transaction message sent by the acquiring bank is the same as that provided by the issuing bank. The card number check digit check is check, and the last digit of the card number in the transaction message sent by the acquiring bank is the same as that calculated by the standard card number check digit algorithm.

The CVN check is to check whether the CVN value in the track information in the transaction message sent by the acquiring bank is correct. The main function of the card number length check and the card number check bit check is to prevent misuse, and the CVN check prevents the situation of the fake card and the fake card to a certain extent. Due to the domestic payment environment based on password credit cards, cardholders generally use passwords to ensure the security of their accounts. However, none of the above solutions can verify the correctness of card passwords. The invention provides a method for verifying the correctness of the PIN, and solves the problem of correcting the password in the bank card authorization service. The method is further used on the basis of the traditional calibration method, thereby reducing the wrong authorization in the authorized service. The probability of improving the security of the card.

Confirmation SUMMARY OF THE INVENTION The object of the present invention is to provide a method for verifying PIN correctness in an authorized service, which can reduce the probability of erroneous authorization in the authorized service and improve the security of the card. The invention discloses a method for verifying PIN correctness in the authorization service. When the bank card needs to be authorized in the transaction process, the PIN verification is performed, including the following steps: Step 1. The card issuing bank adopts the PVN algorithm and uses the key. KEY _PVN encrypts each PIN with a secret card to obtain the PVN value of each card. Step 2: The issuing bank transmits the PVN value information of all cards to the authorized organization through the file form, and after receiving the authorization, the issuing organization will The PVN value is stored in the database; Step 3: The issuing bank informs the authorized organization of the cardholder's password modification, and replaces the original PVN value in the database after receiving the system of the authorized organization; Step 4: When the bank card transaction needs to be authorized When the authorized authorization system of the authorized organization receives the encrypted PIN, it searches through the database through the card number. If it is not found, it indicates that the card does not need to be verified by PVN. The password verification is passed. If found, the next step is performed. a step; step 5, if found, the authorization system first decrypts the encrypted PIN, and then uses the PVN algorithm to make Key KEY _PVN, PVN calculated value, and for comparison with PVN values stored in the database, and if the same then the correct PIN, password authentication. Otherwise, explain PIN is incorrect, the end of the transaction. Further, in the step 2, the PVN value information is transmitted to the authorized organization in a file format in the form of a card number and a PVN value. In the step 3, the cardholder password modification is performed by using the card number and the PVN value. The format of the pair is transferred to the authorized organization by file. Further, the encrypted PIN received by the authorized authorization system of the authorized organization in step 4 is received by the bank and encrypted by the PIN input by the card KEY _PIf . Authorized organization, in step 5, the authorization system of the authorized organization is decrypted by the key KEY _{1) If} ^ 加密 encrypted PIN, the acceptance bank is the accepting unit of the cardholder to conduct the transaction. Further, the cardholder password modification in step 3 is automatically transmitted to the authorized organization at a set frequency, and the set frequency is at least once a day. Further, the steps of calculating the PVN value in step 1 are as follows: a. Setting the left 64 bits of the PIN verification key PVK is the key KeyA, and the right 64 bits are the key KeyB;

b. Take the U-digit number except the check digit at the right end of the card number, the index number of the PIN verification key PVK, and the 4-digit digit of the left end of the PIN plaintext, which in turn form a 16-digit string, each digit is represented by a compressed BCD code, forming 1 a 64-bit long binary computation block Block;

c. Perform DES encryption operation on the Block with the key KeyA, and get the result Blockl; d. Perform DES decryption operation on the Block1 with the key KeyB, and obtain the result Block ² ; e. Perform DES encryption operation on the Block2 with the key KeyA, and obtain the result. Block3; f, extract all the numbers (0 ~ 9) from left to right for Block3;

g. Extract all hexadecimal characters (A ~ F) from left to right for Block3, and subtract 10 from each hexadecimal character to make it a number; h, get steps f and g The numbers are sequentially arranged from left to right, and the number obtained in step g is placed after the number obtained in step f; i. The first 4 digits of the result of step h are taken as the PVN value. Through the method of the invention, the verification problem of the correctness of the password in the authorization service is solved, which makes the generation authorization of the password card more accurate and reliable. DRAWINGS 1 is a basic flow chart of the authorization service; FIG. 2 is a flow chart of PVN information transmission according to the present invention; FIG. 3 is a flow chart of PVN information verification according to the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT Based on the above situation, we propose a method for verifying PIN correctness in the authorized service, which reduces the probability of erroneous authorization in the authorized service, and improves the security of the card. The verification method of the authorized service of the present invention is opened. The issuing bank of the authorized business first encrypts each PIN with a PIN card by using the PVN (PIN verification number) algorithm developed by an authorized organization (for example, China UnionPay) to obtain the PVN value (PVN VALUE ) of each card. And the PVN value information of all cards is automatically transmitted to the authorized organization through the file form in a paired format (card number, PVN value), and stored on behalf of the authorized organization for storage; when the member bank system has problems, the bank card business cannot be processed. When authorized by the authorized organization for its behalf, the authorization system will decrypt the received encrypted PIN with the key of the acquiring bank, regenerate the PVN value according to the card issuing bank's key, and compare it with the stored PVN value. Consistent to verify the legality of the card. Figure 1 reveals the basic process of the authorized business. The basic process of the bank's authorized business is as follows:

1. Member banks wishing to carry out the agency business on behalf of the company shall sign a delegation agreement with the authorized organization to clarify the rights and obligations of both parties;

2. The member banks will transmit the required parameter information (including PVN information) on behalf of the authorized business to the authorized organization through file transfer;

3. When the member bank system plans to upgrade or emergency downtime, it may notify the authorized organization to authorize the transaction of the bank card;

4. On behalf of the authorized organization, the authorization system will perform the inter-bank transaction on behalf of the member bank. Inspection (including PVN verification) and quota control inspection, direct authorization of the transaction passed through the inspection and return to the acceptance bank via the transfer system, if the inspection fails, the transaction fails;

5. When the member bank system is upgraded or the fault is resolved, the authorized organization can be notified to release the authorization. The issuing bank that initiates the authorization service first uses the PVN algorithm to encrypt each PIN with a PIN card to obtain the PVN value of each card, and the PVN value of all cards in the paired format (card number, PVN value). The information is automatically transferred to the authorized organization through the file form, and is stored on behalf of the authorized organization. The specific process is shown in Figure 2. The steps are as follows:

1. The issuing bank adopts the PVN algorithm, encrypts each PIN with a secret card using the key KEY _PVN , and obtains the PVN value of each card;

2. The issuing bank transmits the PVN value information of all cards to the authorized organization in the form of card number and PVN value pair. After receiving the data, the PVN value is stored in the database.

3. The issuing bank will set the frequency (for example, once a day, or twice, three times or more times a day, the specific time interval can be set as needed), automatically through the file form (with the card number, the modified PVN value The format of the pair) informs the authorized organization of the modification of the cardholder's password, and replaces the original PVN value on behalf of the authorized organization's system. When the member bank system is upgraded or the outbreak is abnormal and the inter-row service cannot be processed, the authorized organization starts the generation of the authorization service. Figure 3 shows the process of PVN verification. The steps are as follows:

1. The acceptance bank adopts the PIN encryption algorithm, encrypts the _PIN input by the cardholder with the key KEY _PIN , and sends it to the authorized organization. The acceptance bank refers to the accepting unit that the cardholder conducts the transaction;

2. After the authorized authorization system of the authorized organization receives the encrypted PIN, it searches through the PVN value database through the card number. If it is not found, it indicates that the card does not need to be verified by PVN, and the password verification is passed; 3. If found, the authorization system first decrypts with the key KEYPIN, then uses the PVN algorithm to calculate the PVN value using the key KEY _PVN , and compares it with the PVN value stored in the database. The PIN is correct, otherwise the PIN is incorrect. In step 2, when the PVN value corresponding to the card number is not found, it indicates that the card does not need to perform PVN verification, and the password verification is passed, and the generation authorization is directly performed; in step 3, if the calculated PVN value is in the database If the stored PVN values are the same, the verification is passed, and the authorization is performed. Otherwise, the authorization is rejected and the transaction is terminated. The basic principle of the PVN algorithm, the calculation steps of the PVN value are as follows:

1. Set the PIN verification key PVK ( PIN verification key ) to the left 64 bits for the key eyA and the right 64 bits for the key KeyB;

2. Take the 11 digits except the check digit at the right end of the card number, the index number of the key PVK, and the 4 digits at the left end of the PIN plain text, which in turn form a 16-digit string. Each digit is represented by a compressed BCD code, forming a 64. Bit length binary calculation block Block;

3. Use KeyA to perform DES encryption on Block and get the result Blockl;

4, use KeyB to perform DES decryption operation on Blockl, and get the result Block2;

5, using KeyA to do DES encryption operation on Block2, and get the block 3;

6. Extract all numbers (0 ~ 9) from Block left to right.

7. Extract all hexadecimal characters (A ~ F) from left to right for Block3, and subtract 10 from each hexadecimal character to make it a number;

8. The numbers from steps 6 and 7 are arranged in order from left to right, and the numbers from step 7 are placed after the number from step 6.

9. Take the first 4 digits of the result of step 8, which is the PVN value. Through the above method, the verification problem of the correctness of the password in the authorized service is solved, so that the generation authorization of the password card is more accurate and reliable, and the security level is equivalent to the PIN conversion method adopted in the current inter-bank service, but irreversible decryption, that is, The PVN value cannot decrypt the clear code of the PIN, that is, the authorized organization that engages in the authorized service cannot obtain the clear code of the bank card PIN. The foregoing PVN algorithm is only one of the algorithms capable of achieving the object of the present invention. Those skilled in the art can achieve equivalent purposes by making simple mathematical changes to the algorithm or using other similar algorithms, which are all within the scope of the present invention. Inside.

The PVN check is one of the checks that need to be performed in the authorized service. It is used to verify the correctness of the password. Other verifications cannot verify the correctness of the password. However, it does not mean that only this type of verification is performed. In the authorization service, other card number check digit verification, card number length verification, CVN verification, etc., which are mentioned above, are also required, and the authorized organization system will When multiple verifications are passed, the transaction is authorized on behalf of the transaction. At the same time, the invention adopts the automatic file transmission method, and solves the verification failure problem caused by the cardholder changing the PIN relatively quickly, and the cardholder password modification situation is automatically transmitted to the authorized organization at the set frequency, and the setting is set here. If the interval is too long, it is easy for the cardholder to change the password, but the PVN value in the database of the authorized organization is not updated, causing the PIN verification to fail; if the interval is too short, causing frequent file transfer, it needs to be based on the actual Appropriate adjustments are made to the usage, and it is generally recommended to update it once a day.

Claims

Rights request

A method for verifying the correctness of a PIN in an authorized service. When a bank card needs to be authorized in the transaction process, the PIN verification is performed, and the method includes the following steps: Step 1. The card issuing bank adopts a PVN algorithm, and uses The key KEY _PVN encrypts each PIN with a secret card to obtain the PVN value of each card. Step 2. The issuing bank transmits the PVN value information of all the cards to the authorized organization through the file form, and the authorized organization receives the data. , the PVN value is stored in the database; Step 3, the issuing bank informs the authorized organization of the cardholder password modification, and replaces the original PVN value in the database after receiving the system of the authorized organization; Step 4: When the bank card transaction needs to be carried out On behalf of the authorization, the authorized authorization system of the authorized organization receives the encrypted PIN and searches through the database through the card number. If it is not found, it indicates that the card does not need to be verified by PVN. The password verification is passed. Go to the next step; Step 5, if found, then the authorization system first decrypts the encrypted PIN, and then uses the PVN algorithm. With key KEYPVN, PVN calculated value, and for comparison with PVN values stored in the database, and if the same then the correct PIN, password authentication. Otherwise, explain PIN is incorrect, the end of the transaction.

The method for verifying PIN correctness in a generation authorization service according to claim 1, wherein: in the step 2, the PVN value information is transmitted in a file format in a format paired with a card number and a PVN value. Authorized organization.

The method for verifying PIN correctness in a generation authorization service according to claim 1, wherein in the step 3, the cardholder password modification is in a format in which the card number and the PVN value are paired. The form is transmitted to the authorized organization.

The method for verifying PIN correctness in a generation authorization service according to claim 1, wherein: the encrypted PIN received by the authorization system of the authorized organization in step 4 is accepted by the bank. The PIN input by the cardholder is encrypted by the key 1^丫^ and sent to the authorized organization; in step 5, the authorized authorization system of the authorized organization decrypts the encrypted P1N by the key KEY _PIN .

The method for verifying PIN correctness in a generation authorization service according to claim 4, wherein: the acceptance bank is an acceptance unit for the cardholder to perform the transaction.

The method for verifying PIN correctness in a generation authorization service according to claim 3, wherein: the cardholder password modification condition is automatically transmitted to the authorized organization according to the set frequency, and the setting is The frequency is fixed at least once a day.

The method for verifying PIN correctness in a generation authorization service according to claim 1, wherein: the step of calculating the PVN value in the step 1 is as follows: a. setting the left side of the PIN verification key PVK 64-bit is the key KeyA, and the right 64-bit is the key KeyB; b. The 1st digit of the right end of the card number except the check digit, the index number of the PIN verification key PVK, and the 4 digits of the left end of the PIN plaintext, which in turn constitute one 16-digit string, each digit is represented by a compressed BCD code, forming a 64-bit binary computing block Block; c, using the key KeyA to perform DES encryption on the Block, and obtaining the result Bl.ockl; d, using the key KeyB performs DES decryption operation on Block1, and obtains result Block2; e, DES encryption operation on Block2 with key KeyA, and the result Block3; f, extracts all numbers (0 ~ 9) from left to right for Block3; g, Extract all hexadecimal characters (A ~ F) from left to right for Block3, and subtract 10 from each hexadecimal character to make it a number; h, the numbers obtained in steps f and g are sequentially arranged from left to right, and the numbers obtained in step g are placed after the numbers obtained in step f;

i. Take the first 4 digits of the result of step h, which is the PVN value.