CN104361489B - A kind of mark system and method for sensitive information - Google Patents

Abstract

The present invention relates to the field of information security, in particular to an information identification system and method thereof, including: a transaction platform for obtaining sensitive information and simultaneously forming and sending a transaction request; a gateway connected to the transaction platform for accessing the transaction platform The payment platform provides an access port; the payment platform is connected to the gateway to realize the payment of the transaction request; the key management platform is connected to the payment platform to manage and distribute the key information of the transaction platform; the first FPE encryption machine is connected to the gateway , used to implement identification of the sensitive information in the transaction request; the second FPE encryption machine, connected to the key management platform, is used to implement the decryption of the identified sensitive information. The invention takes the key management platform as the center, distributes the key to each trading platform, and uses FPE to encrypt sensitive information at the same time, which ensures that the data length of the sensitive information does not change during the transmission process, and at the same time ensures the security of the sensitive information.

Description

A system and method for identifying sensitive information

technical field

The present invention relates to the field of information security, in particular to an information marking system and method thereof.

Background technique

With the rapid development of computer technology and network technology, the security problem of database information is becoming more and more serious. For example, the leakage of a large amount of sensitive information occurred on the Internet in China at the end of 2011. The fundamental reason is that this information is mostly stored in plain text. security risks.

Especially at present, the popularity of online payment, as the basis of e-commerce, the widespread application of electronic payment has promoted the rapid development of e-commerce, but it has also brought about the leakage of personal sensitive information, especially bank card information, during the entire payment process. .

In practical applications, it is very necessary to encrypt sensitive data such as credit card numbers and ID numbers. However, the use of traditional block ciphers usually expands data and changes the length and type of data. It is necessary to modify the database structure or application to adapt to these changes. The cost is very high; in addition, the password manager is the center of the traditional information identification method, which requires the establishment of a centralized password server, centralized deployment, procurement of related equipment, and a large amount of cost.

Contents of the invention

Aiming at the problem that the traditional block cipher will expand the data, the length and type of the data change, the present invention takes the key management platform as the center, distributes the key to each trading platform, and uses FPE to encrypt sensitive information at the same time, ensuring This ensures that the data length of sensitive information does not change during transmission, and at the same time ensures the security of sensitive information.

The technical solution of the sensitive information identification system and method provided by the present invention is as follows:

A sensitive information identification system, including:

Trading platform, gateway, payment platform, key management platform, a first FPE (Format Preserving Encryption, format preserving encryption) encryption machine, and a second FPE encryption machine, wherein,

The transaction platform is used to obtain the sensitive information, and simultaneously form and send a transaction request;

The gateway is connected to the transaction platform and provides an access port for the transaction platform to access the payment platform;

The payment platform, connected to the gateway, is used to realize the payment of the transaction request;

The key management platform is connected to the payment platform to manage and distribute the key information of the transaction platform;

The first FPE encryption machine, connected to the gateway, is used to realize the identification of sensitive information in the transaction request;

The second FPE encryption machine is connected to the key management platform, and is used to decrypt the marked sensitive information.

Format-preserving encryption is a symmetric cipher that requires the ciphertext to have the same format as the plaintext. For the format-retaining encryption of sensitive information in the database, it is necessary to ensure that the ciphertext meets the constraints of the database on the data format, mainly including: the data cannot be expanded, that is, when encrypting an N-digit number, another N-digit number must be output; the data type cannot be changed Change; data must be able to be encrypted deterministically, for the data in the database as the primary key or index field, after being encrypted, it will retain the characteristics of the column where it is located as the primary key or index; and the encryption and decryption process is reversible.

Preferably, the gateway is a payment gateway of the transaction platform or an online gateway of the payment platform.

Gateway (Gateway) is also called Internet connector and protocol converter. The gateway implements network interconnection above the network layer and is the most complex network interconnection device, which is only used for the interconnection of two networks with different high-level protocols. Gateways can be used for both WAN interconnection and LAN interconnection. A gateway is a computer system or device that acts as a switch. A gateway is a translator between two systems that use different communication protocols, data formats or languages, or even completely different architectures. Unlike bridges, which simply convey information, gateways repackage received information to suit the needs of the destination system.

A gateway is essentially an IP address from one network to another. For example, there are network A and network B, the IP address range of network A is "192.168.1.1～192.168.1.254", the subnet mask is 255.255.255.0; the IP address range of network B is "192.168.2.1～192.168.2.254" , the subnet mask is 255.255.255.0. In the absence of a router, TCP/IP communication cannot be performed between two networks. Even if the two networks are connected to the same switch (or hub), the TCP/IP protocol will use the subnet mask (255.255 .255.0) to determine that the hosts in the two networks are in different networks. And to realize the communication between these two networks, you must go through the gateway. If the host in network A finds that the destination host of the data packet is not in the local network, it forwards the data packet to its own gateway, and then forwards the data packet to the gateway of network B, and the gateway of network B forwards it to a certain network B host (as shown in the attached picture). The process of forwarding data packets from network A to network B.

Therefore, only by setting the IP address of the gateway, the TCP/IP protocol can realize the mutual communication between different networks. So which machine's IP address is this IP address? The IP address of the gateway is the IP address of the device with routing function. The devices with routing function include routers, servers with routing protocols enabled (essentially equivalent to a router), and proxy servers (also equivalent to a router).

In the context of interoperating with Novell NetWare networks, a gateway acts as a bridge between the Server Message Block (SMB) protocol used in Windows networks and the NetWare Core Protocol (NCP) used in NetWare networks. Gateways are also known as IP routers.

Preferably, the sensitive information includes information for uniquely identifying the user and a payment card number.

A sensitive information identification method, applied to the above sensitive information identification system, is characterized in that it includes the following steps:

S1 The transaction platform obtains the sensitive information, forms and sends the transaction request;

S2 The gateway receives the transaction request, and at the same time sends the transaction request to the first FPE encryption machine;

S3 the first FPE encryption machine implements the identification of the sensitive information in the transaction request to form a new transaction request;

S4 The payment platform acquires the new transaction request, and simultaneously sends the request to the key management platform;

S5, the key management platform sends the new transaction request to the second EPF encryption machine for decryption;

S6 Send the decrypted information to the payment platform to implement the transaction requested by the transaction.

Preferably, it is characterized in that: before realizing the transaction of the transaction platform, the transaction platform registers in the identification system, and obtains the encryption key and initial vector sent by the key management platform, and completes all The registration of the transaction platform; and store the initial vector, decryption key, FPE encryption key, and data format in the first FPE encryption machine; store the registration information associated with the transaction platform in the key management platform The ciphertext of the sensitive information, the initialization vector, and the data format.

Specifically, the communication between the easy platform and the first FPE encryption machine needs to be transmitted through the public network, so an asymmetric algorithm is used for encryption. The transaction request is first encrypted with the public key on the trading platform, that is, the above-mentioned encryption key, which is encrypted on the trading platform. Formed during the registration process; then decrypted in the first FPE encryption machine through the private key of the trading platform, that is, the decryption key in the above-mentioned first FPE encryption machine, and then use the FPE encryption key to decrypt the decrypted information. Encryption algorithm FPE encryption.

Preferably, step S1 specifically includes:

S11 The transaction platform obtains the transaction information including the sensitive information, and forms the transaction request;

S12 uses the encryption key in the transaction platform to realize the encryption of the transaction request to generate encrypted information;

S13 The trading platform sends the encrypted information.

Preferably, the transaction request includes the sensitive information and the transaction platform registration information.

Preferably, step S3 specifically includes:

S31, the first FPE encryption machine receives the encrypted information;

S32 The first FPE encryption machine implements decryption of the encrypted information by using the decryption key and the initial vector, and acquires the sensitive information;

S33 The first FPE encryption machine uses the initial vector, the FPE encryption key, and the data format to realize the identification of the sensitive information to form a ciphertext, and at the same time form a new transaction request;

S34 The first FPE encryptor sends the transaction request.

Preferably, step S5 specifically includes:

S51 The key management platform acquires the initial vector associated with the ciphertext, the data format, and ciphertext information stored in the key management platform according to the received ciphertext information;

S52, the key management platform compares the received ciphertext information with the stored ciphertext information, and realizes the confirmation of the ciphertext information;

S53 If the comparison is successful, the key management platform sends the initial vector, the data format, and the received ciphertext to the second FPE encryption machine;

S53, the second FPE encryption machine implements decryption of the ciphertext to obtain sensitive information;

S54 The second FPE encryption machine sends the sensitive information to the payment platform to realize the payment of the transaction request.

The system and method for identifying sensitive information provided by the present invention have the beneficial effects of:

1. In the identification system of sensitive information of the present invention, FPE is used to encrypt sensitive information, which ensures that the data length of sensitive information does not change during the entire communication process, and at the same time ensures the security of sensitive information; and in the present invention, As long as the encryption key and the initial vector are used, the encryption of sensitive information can be realized, and the password information can be generated to ensure that the generated password information uniquely corresponds to the trading platform;

2. In the present invention, the key management platform is the center, and the key is sent to each trading platform, and each trading platform uses FPE to encrypt the corresponding sensitive information, so as to realize the distributed arrangement of the system. Compared with the traditional system, it is easier to change It is small and achieves the effect of lower cost at the same time.

Description of drawings

Below in conjunction with accompanying drawing and specific embodiment the present invention is described in further detail:

Fig. 1 is a schematic structural diagram of the identification system of sensitive information in the present invention;

Fig. 2 is a schematic flowchart of a method for identifying sensitive information in the present invention.

detailed description

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the present invention will be specifically described below in conjunction with the accompanying drawings and embodiments. The drawings in the following description are only some embodiments of the invention. For those skilled in the art, other drawings can also be obtained based on these drawings without creative effort.

As shown in Fig. 1, the present invention provides a sensitive information identification system, which specifically includes: a transaction platform, a gateway, a payment platform, a key management platform, a first FPE encryption machine, and a second FPE encryption machine.

Specifically, the trading platform is used to obtain sensitive information, and at the same time form and send a transaction request. In practical applications, trading platforms include e-commerce platforms, such as JD.com, Taobao, Suning, etc. And the trading platform needs to register in the key management platform before using the system of the present invention to conduct transactions. The registered information includes: merchant name, organization code, legal person certificate and contact information, etc., then the key management platform is a trading platform Allocate encryption keys and initial vectors for encryption, and at the same time store the association between the transaction platform and initial vectors and other information on the key management platform. Furthermore, the encryption key in the trading platform, if the transaction can request regular replacement. In particular, the present invention does not specifically limit the specific form of the transaction platform and the specific form of the registration information of the transaction platform, as long as they can achieve the purpose of the present invention, they are all included in the content of the present invention.

Furthermore, in order to ensure the security performance of the information during the transmission process, during the registration process of the trading platform, the key management platform will also correspondingly distribute the certificate used by the security control to encrypt the data. In particular, the communication between the trading platform and the first FPE encryption machine must be transmitted through the public network, so an asymmetric algorithm is used for encryption. The trading platform generates a public key and a private key during the registration process of the key management platform. Among them, the public key The key is used to encrypt the transaction request in the trading platform, and the public key is packaged into the security control; the private key is used to decrypt the private key and stored in the first FPE encryption machine.

The gateway is connected to the transaction platform and provides an access port for the transaction platform to access the payment platform. Further, in the present invention, the gateway is the payment gateway of the transaction platform or the online gateway of the payment platform, that is, the system provided by the present invention includes two payment methods, and the user can choose to use the payment gateway of the transaction platform and the payment platform Communication connection, or you can choose to communicate with the payment platform through the online gateway of the payment platform. Specifically, the online gateway of the payment platform includes the previous payment gateway of UnionPay or the bank; the payment gateway of the transaction platform may be, for example, Alipay.

The payment platform, connected with the gateway, is used to realize the payment of the transaction request, that is, to realize the settlement of the transaction request. Specifically, the payment platform in the present invention includes a bank's clearing system, which receives the transaction request sent by the transaction platform, including transaction amount, transaction card number and other information to implement the clearing process.

The key management platform is connected with the payment platform to manage and distribute the key information of the transaction platform. In practical applications, in addition to being responsible for managing and distributing key information, it also includes key maintenance. Store the encryption key associated with the registration information of the trading platform, the ciphertext of sensitive information, the initial vector, certificate and other information. In particular, in the present invention, the key distributed to each trading platform in the key management platform is a random number generated by hardware such as an encryption machine. Of course, the present invention does not limit the generation form of the FPE encryption key, as long as it All that can realize the purpose of the present invention are included in the content of the present invention.

The first FPE encryption machine is connected to the gateway and is used to realize the identification of sensitive information in the transaction request. In practical applications, before use, that is, during the initialization process of the system, it is necessary to configure the encryption machine, including storing the certificate distributed by the key management platform to the merchant and importing the decryption key (that is, the private key) of the trading platform for giving Sensitive information encrypted FPE encryption key, initialization vector, and data format and other information. In particular, the FPE encryption key mentioned here is a safe random number generated by the encryption machine. Of course, the present invention does not limit the generation form of the FPE encryption key. As long as it can realize the purpose of the present invention, it is included in this document. the content of the invention.

Further, the above-mentioned sensitive information includes information for uniquely identifying the user, payment card number, etc., such as SSN (Social Security Number).

The present invention also provides a sensitive information identification method, which is applied to the above sensitive information identification system, including the following steps:

S1 trading platform obtains sensitive information, forms and sends transaction requests;

The S2 gateway receives the transaction request and sends the transaction request to the first FPE encryption machine at the same time;

The S3 first FPE encryption machine realizes the identification of sensitive information in the transaction request and forms a new transaction request;

The S4 payment platform obtains a new transaction request and sends the request to the key management platform at the same time;

The S5 key management platform sends the new transaction request to the second EPF encryption machine for decryption;

S6 sends the decrypted information to the payment platform to implement the transaction requested by the transaction.

Specifically, before realizing the transaction on the trading platform, the trading platform registers in the identification system, and obtains the encryption key and initial vector sent by the key management platform to complete the registration of the trading platform; and in the first FPE encryption machine Store the initial vector, decryption key, FPE encryption key, and data format; store the ciphertext, initial vector, and data format of sensitive information associated with the registration information of the trading platform in the key management platform.

Further, in step S1, the transaction platform obtains sensitive information, forms and sends a transaction request which specifically includes:

The S11 trading platform obtains transaction information containing sensitive information and forms a transaction request. In particular, the sensitive information mentioned here includes the card number and ID information to be used in the transaction process; the transaction request includes sensitive information and transaction platform registration information, that is, the transaction request information includes not only sensitive information but also transaction platform organization information Wait.

S12 uses the encryption key in the trading platform to encrypt the transaction request and generate encrypted information. In particular, in order to further ensure the security of information during transmission, the present invention also uses corresponding security controls and certificates to implement data encryption. In particular, the security controls described in the present invention include a browser that includes all controls OCX security control installed in IE.

The S13 trading platform sends encrypted information.

Further, in step S3, the first FPE encryption machine implements the identification of sensitive information in the transaction request to form a new transaction request, specifically including:

S31 The first FPE encryption machine receives the encrypted information;

S32 The first FPE encryption machine uses the decryption key and the initial vector to decrypt the encrypted information and obtain sensitive information. In particular, if the transaction platform uses security controls and certificates to encrypt the data, it will be decrypted in the first FPE encryption machine using the corresponding internally stored certificates.

S33 The first FPE encryption machine uses the initial vector, FPE encryption key, and data format to realize the identification of sensitive information to form ciphertext, and at the same time form a new transaction request. Specifically, in general, sensitive information is encrypted, and the middle part is encrypted, and the first and last four digits will be reserved accordingly. For example, if the SSN is 7412345678900000, the ciphertext after FPE encryption is 7412342335260000, and then the encrypted The information is sent to the second FPE for decryption.

S34 The first FPE encryption machine sends out the transaction request.

Further, in step S5, the key management platform sends the new transaction request to the second EPF encryption machine for decryption, which specifically includes:

S51 The key management platform obtains the initial vector associated with the ciphertext, the data format, and the ciphertext information stored in the key management platform according to the received ciphertext information. Specifically, after the key management platform receives the ciphertext, it searches the internally stored association table according to the received ciphertext, and finds other relevant information at the same time. If not found, it means that the ciphertext is being transmitted. If it has been tampered with, the transaction will be terminated.

The S52 key management platform compares the received ciphertext information with the stored ciphertext information to realize the confirmation of the ciphertext information;

S53 If the comparison is successful, the key management platform sends the initial vector, the data format, and the received ciphertext to the second FPE encryption machine; if the comparison fails, the transaction is terminated.

S53 second FPE encryption machine implements decryption of ciphertext to obtain sensitive information;

S54 The second FPE encryption machine sends the sensitive information to the payment platform to realize the payment of the transaction request. The settlement system in the payment platform performs settlement based on the decrypted sensitive information, such as card number, amount and other information. After the liquidation is completed, the liquidation result will be sent to the trading platform for the user to confirm.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included in the protection of the present invention. within range.

Claims (5)

1. An identification system for sensitive information, characterized in that it includes: Trading platform, gateway, payment platform, key management platform, first FPE encryption machine, and second FPE encryption machine, wherein, The transaction platform is used to obtain sensitive information, and simultaneously form and send a transaction request; the transaction request includes sensitive information and transaction platform registration information; the encryption key is used in the transaction platform to realize the encryption of the transaction request to generate encrypted information, and the transaction platform will encrypt information sent out; The gateway is connected to the transaction platform and provides an access port for the transaction platform to access the payment platform; The payment platform, connected to the gateway, is used to realize the payment of the transaction request; The key management platform is connected with the payment platform, manages and distributes the key information of the transaction platform; obtains the initial vector associated with the ciphertext according to the received ciphertext information, the data format, and stores in the key management The ciphertext information in the platform; compare the received ciphertext information with the stored ciphertext information; if the comparison is successful, the key management platform will send the initial vector and data format, as well as the received ciphertext to the second FPE encryption machine; The first FPE encryption machine is connected with the gateway, and is used to realize the identification of sensitive information in the transaction request; use the decryption key and the initial vector to realize the decryption of the encrypted information, and obtain sensitive information; use the initial vector, FPE encryption key and data format realize the identification of sensitive information to form ciphertext, and at the same time form a new transaction request; send the new transaction request; The second FPE encryption machine is connected to the key management platform, and is used to decrypt the marked sensitive information. 2. The system for identifying sensitive information according to claim 1, wherein the gateway is a payment gateway of the transaction platform or an online gateway of the payment platform. 3. The system for identifying sensitive information according to claim 1, wherein the sensitive information includes information for uniquely identifying a user and a payment card number. 4. A method for marking sensitive information, applied to the marking system for sensitive information according to any one of claims 1-3, characterized in that it comprises the following steps: S1 The transaction platform obtains the sensitive information, forms and sends the transaction request; S2 The gateway receives the transaction request, and at the same time sends the transaction request to the first FPE encryption machine; S3 the first FPE encryption machine implements the identification of the sensitive information in the transaction request to form a new transaction request; S4 The payment platform acquires the new transaction request, and simultaneously sends the request to the key management platform; S5, the key management platform sends the new transaction request to the second FEP encryption machine for decryption; S6 sends the decrypted information to the payment platform to implement the transaction requested by the transaction; Step S1 specifically includes: S11, the transaction platform obtains the transaction information including the sensitive information, and forms the transaction request; S12 uses the encryption key in the transaction platform to realize the encryption of the transaction request to generate encrypted information; S13, the trading platform sends the encrypted information; In step S3, it specifically includes: S31, the first FPE encryption machine receives the encrypted information; S32 The first FPE encryption machine implements decryption of the encrypted information by using the decryption key and the initial vector, and obtains the sensitive information; S33 The first FPE encryption machine uses the initial vector, the FPE encryption key, and the data format to realize the identification of the sensitive information to form a ciphertext, and at the same time form a new transaction request; S34 The first FPE encryption machine sends the transaction request; Step S5 specifically includes: S51 The key management platform obtains the initial vector associated with the ciphertext according to the received ciphertext information, the data format, and stores it in the key management platform The ciphertext information in; S52, the key management platform compares the received ciphertext information with the stored ciphertext information, and realizes the confirmation of the ciphertext information; S53 If the comparison is successful, the key management platform sends the initial vector, the data format, and the received ciphertext to the second FPE encryption machine; S53, the second FPE encryption machine implements decryption of the ciphertext to obtain sensitive information; S54 The second FPE encryption machine sends the sensitive information to the payment platform to realize the payment of the transaction request. 5. The method for identifying sensitive information according to claim 4, characterized in that: Before realizing the transaction of the transaction platform, the transaction platform registers in the identification system, and obtains the encryption key and initial vector sent by the key management platform, and completes the registration of the transaction platform; The key management platform stores the ciphertext of the sensitive information associated with the transaction platform registration information, the initial vector, and the data format; and stores the initial data used in the steps S31 to S34 in the first FPE encryption machine. vector, decryption key, FPE encryption key, and data format.