银行卡个人化流程.doc

Personalization Workflow in Eastcom Peace System Overview Detail workflow of personalization The issuer prepares the data for Eastcom, the possible connection is VPN via a secure tunnel. The Issuer pushes the data into the External Data Receiving Server in a certain time of a day. The encrypted data is only stored temporarily inside the External Data Receiving Server, it will be pulled by the Internal data hosting server. The encrypted data retrieved via internal FTP to PMP order import admin Client by Pull mode ( In the future, the encrypted data file will be deciphered at the Internal Data hosting server by it’s HSM, and make the transformation into XOF, then re-encoded the necessary data section of the XOF again by Eastcom Peace internal transport keys) In this stage, the transport Keys of the encrypted data from issuer TKissuer will be distributed into the Eracom PL50 HSM that attached to the PMP servers Also, the internal Keys of Eastcom Peace DKep for the data attributes will be generated in the Eracom PL50 HSM that attached to the PMP servers. The encrypted data file received by the PMP Order Client, it will be deciphered by the TKissuer inside the Eracom PL50 HSM that attached to the PMP servers and immediately transformed to the XOF file format, all data attributes will then be parsed and re-encoded by the internal keys DKep and will be put inside of the XOF file format. The PMP product Administrator will create the product for each specific task, the product can be considered as the Order Profile, including the reference of all the DKep for the data attributes. Before a product is actually created, all the Visa related Keys and Certificates will be ready in the CardInk Server side for each issuer. At the same time, the related applications, application profiles should be configured at the CardInk Server side. Also, the KTK, PTK, MTK should have been generated by the CardInk Server and be distributed into the PL50 HSM that associated to the Produc