# US 11,443,293 B2 · Secure network accessing method for POS terminal, and system thereof

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,443,293 B2
- Document ID: US11443293B2
- Status: Granted
- Kind: B2
- Application number: 15/038,164
- Filed: 2014-11-20
- Published: 2016-11-03
- Granted: 2022-09-13
- Earliest claimed: 2013-12-10
- Assignees: China Unionpay Co., Ltd.
- Applicants: China Unionpay Co., Ltd.
- Inventors: Zhiqiang Cheng; Hua Cai; Qi Wang; Zhou He
- Web page: https://patentgrep.com/patent/US11443293B2

## CPC

- G06Q 20/206: {comprising security or operator identification provisions, e.g. password entry}
- G06Q 20/20: Point-of-sale [POS] network systems
- G06Q 20/38215: {Use of certificates or encrypted proofs of transaction rights}
- G06Q 20/3829: {involving key management}
- H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)}
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

The present invention relates to the method and the system for initializing secure network access for POS terminals. Said system comprises a terminal backend system and a POS terminal. The POS terminal is provided with: a security module, which was preloaded with a terminal default public key certificate, a private key file, and a CA public key certificate of the terminal backend system in the setting of leaving the factory; a transaction module, which is used for performing the acquiring operation with the following core trading module; and a parameter initializing module, which is used for implementing network access. The terminal backend system is provided with: a core trading module, which determines whether an acquiring transaction is able to be executed based on the transaction unique identifier sent from the POS terminal, and completes the acquiring operation with the above transaction module in the case that the acquiring transaction is able to be executed; and a terminal certificate issuing module, which is used for generating a terminal transaction certificate and returning said terminal transaction certificate to said POS terminal. According to the present invention, remotely and securely initializing network access for POS terminals can be achieved.

## Claims

### Claim 1

A method for initializing secure network access for POS terminals, which is used to connect a POS terminal to a terminal backend system, the method comprising:
loading a terminal default public key certificate, a default private key file, and a CA public key certificate of the terminal backend system into the POS terminal when leaving factory, wherein said terminal default public key certificate comprises a terminal transaction unique identifier;
after the POS terminal leaves factory and when initializing secure network access for the POS terminal, establishing a terminal transaction certificate secure downloading channel,
wherein the terminal transaction certificate secure downloading channel is a mutual authenticated secure channel based on a secure socket layer (SSL)/transport layer security (TLS) protocol that utilizes said terminal default public key certificate, said default private key file, and said CA public key certificate of the terminal backend system for authentication, and the terminal transaction certificate secure downloading channel is used for downloading a terminal transaction certificate, between the POS terminal and the terminal backend system;
generating, by the POS terminal, a terminal transaction public/private key pair, storing the transaction private key within the POS terminal;
uploading, by the POS terminal, at least said terminal transaction public key and said terminal transaction unique identifier as a certificate signing request to the terminal backend system via the terminal transaction certificate secure downloading channel;
signing and issuing, by the terminal backend system, a terminal transaction certificate, wherein the terminal backend system generates the terminal transaction certificate based on the certificate signing request uploaded from the POS terminal via the terminal transaction certificate secure downloading channel, and returning the terminal transaction certificate to the POS terminal via the terminal transaction certificate secure downloading channel for downloading the terminal transaction certificate by the POS terminal;
after the terminal transaction certificate is downloaded by the POS terminal, establishing a secure channel for transaction for executing financial transactions between the POS terminal and the terminal backend system, according to the terminal transaction certificate, the transaction private key of said terminal transaction public/private key pair, and the CA public key certificate of the terminal backend system;
executing a first transaction between the POS terminal and the terminal backend system via the secure channel;
after executing the first transaction, receiving, by the POS terminal via the terminal transaction certificate secure downloading channel that utilizes said terminal default public key certificate, an updated terminal transaction certificate generated by the terminal backend system;
establishing an updated secure channel for the financial transactions between the POS terminal and the terminal backend system, according to the updated terminal transaction certificate; and
executing a second transaction between the POS terminal and the terminal backend system via the updated secure channel;
wherein the terminal default public key certificate and the private key file is only used for accessing the terminal backend system and performing terminal management directed to the terminal transaction certificate secure downloading channel, and not used for executing the first transaction or the second transaction between the POS terminal and the terminal backend system.

### Claim 2 (depends on 1)

The method of claim 1, wherein, posterior to establishing the secure channel for transactions, the method further comprises:
determining, by the terminal backend system, whether a transaction is able to be executed based on the terminal transaction unique identifier of the POS terminal accessed through said secure channel for transaction.

### Claim 3 (depends on 2)

The method of claim 2, wherein the terminal transaction unique identifier is composed of a merchant ID and a terminal ID.

### Claim 4 (depends on 3)

The method of claim 3, wherein, in issuing the terminal transaction certificate, the terminal backend system executes certificate signing for the transaction public key and the terminal transaction unique identifier uploaded from the POS terminal to generate the terminal transaction certificate.

### Claim 5 (depends on 1)

The method of claim 1, wherein establishing the terminal transaction certificate secure downloading channel includes:
authenticating, through the SSL protocol, users and servers to ensure that data is sent to a correct client and a correct server, the data including the terminal transaction certificate;
encrypting, through the SSL protocol, the data to prevent the data from being stolen;
maintaining, through the SSL protocol, data integrity to ensure that the data is not altered during transmitting; and
providing, through the TLS protocol, confidentiality and the data integrity between two communication applications.