Abstract: Disclosed is a key downloading method. The method comprises: sending a hardware series number (SN) and a first random number (Rnd1) to a key server; receiving a second random number (Rnd2), a first encrypted text (C1) and a key server working certificate (KSWCRT) sent by the key server; authenticating the validity of KSWCRT by using a KSRCRT; if valid, extracting a public key (PuKS) from the KSWCRT, and decrypting the first encrypted text (C1) by using the PuKS to obtain a third random number (Rnd1?); determining whether Rnd1 is consistent with Rnd1?; if consistent, encrypting the second random number (Rnd2) by using a terminal authentication public key (TKP_Pu) to generate a third encrypted text (C2?), and sending the C2? to the key server; receiving an key encrypted text (Ctmk) sent by the key server; and obtain a master key (TMK), and storing the TMK in a security control module.

Abstract: Disclosed are a key management method and system. A master key is remotely downloaded to avoid the problem that the master key is not issued to a merchant until the master key needs be downloaded on a POS terminal, so as to reduce logistics costs and maintenance costs. When a key is remotely downloaded, a KMS system uses a symmetric algorithm to encrypt the key to be transmitted to ensure that the encrypted key can only be decrypted by a corresponding POS terminal, thereby ensuring the security of data transmission. During bidirectional authentication, an application program of the POS terminal can only contact an encrypted text form of the key instead of a plain text key needing to be remotely downloaded to the POS terminal, thereby ensuring security in reproduction.

Abstract: Disclosed is a key downloading method. The method comprises: sending a hardware series number (SN) and a first random number (Rnd1) to a key server; receiving a second random number (Rnd2), a first encrypted text (C1) and a key server working certificate (KSWCRT) sent by the key server; authenticating the validity of KSWCRT by using a KSRCRT; if valid, extracting a public key (PuKS) from the KSWCRT, and decrypting the first encrypted text (C1) by using the PuKS to obtain a third random number (Rnd1?); determining whether Rnd1 is consistent with Rnd1?; if consistent, encrypting the second random number (Rnd2) by using a terminal authentication public key (TKP_Pu) to generate a third encrypted text (C2?), and sending the C2? to the key server; receiving an key encrypted text (Ctmk) sent by the key server; and obtain a master key (TMK), and storing the TMK in a security control module.

Abstract: Disclosed are a key management method and system. A master key is remotely downloaded to avoid the problem that the master key is not issued to a merchant until the master key needs be downloaded on a POS terminal, so as to reduce logistics costs and maintenance costs. When a key is remotely downloaded, a KMS system uses a symmetric algorithm to encrypt the key to be transmitted to ensure that the encrypted key can only be decrypted by a corresponding POS terminal, thereby ensuring the security of data transmission. During bidirectional authentication, an application program of the POS terminal can only contact an encrypted text form of the key instead of a plain text key needing to be remotely downloaded to the POS terminal, thereby ensuring security in reproduction.