世界上哪些地方需要收银机中的加密软件？在这种情况下需要什么安全措施？
背景
瑞典正在向所有处理现金或银行卡交易的企业主过渡强制法，以实施/购买部分加密的 POS（销售点）/收银机：
签名和加密用于 安全地存储来自的信息 控制单元中的收银机。 经认证的控制系统 控制单元是基于 每个控制单元的制造商 模型获取主加密密钥 来自瑞典税务局。这 然后制造商使用主密钥 创建唯一的加密密钥 期间放置在控制单元中 制造过程。为了 获取主要加密密钥， 制造商必须提交一份 向瑞典税务局提出申请。 来源 SKV
这在瑞典交易者中引起了一些骚动因为需要使用必要的复杂性和强大的加密，以及从店主的角度来看高度复杂的技术实现，因为替代方案是从已经浏览过文档、获得安全密钥并构建了软件的公司购买系统，将其集成到硬件中。
所以我的第一个问题是，世界上是否有任何其他国家能够达到瑞典税务局对其公司要求的精确性（以及广泛的簿记指南）？
我想听听任何其他感兴趣的加密方案以及在验证交易和簿记条目时如何通过立法应用它们。此类立法的示例可能类似于瑞典的另一项规则；簿记条目（交易）必须是只写的，最多在发生后 4 天写入，并且只能通过（日期、执行人员签名、新预订）元组进行更改。
最后，您对这些规则有何看法？我们是否会朝着税务机构服务器的簿记 + POS 系统的所有时间上行链路，以类似于集体智能算法的方式实时验证和检测欺诈模式，或者是否会因税务机构复杂性的增加而产生强烈反对？经营业务？
Background
Sweden is transitioning to a compulsory law for all business owners handling cash or card transactions, to implement/buy partially-encrypted POS (point of sale)/cash registers:
Signing and encryption are used to
securely store the information from
the cash register in the control unit.
The control system with a certified
control unit is based on the
manufacturer for each control unit
model obtaining a main encryption key
from the Swedish Tax Agency. The
manufacturer then uses the main key to
create unique encryption keys that are
placed in the control unit during the
manufacturing process. In order to
obtain main encryption keys,
manufacturers must submit an
application to the Swedish Tax Agency.
Source SKV
This has caused somewhat of an uproar among Swedish traders because of the necessitated complexity and strong encryption to be used, along with a highly sophisticated technical implementation from the shop owner's perspective, as the alternative is to buy the system from companies who have traversed the documentation, gotten their security keys and built the software and integrated it into the hardware.
So my first question is if any other countries in the world even comes close to the preciseness that the Swedish Tax Agency requires of its companies (alongside having extensive guidelines for bookkeeping)?
I'd like to hear about any other encryption schemes of interest and how they are applied through legislation when it comes to verifying the transactions and book keeping entries. Examples of such legislation could be similar to another Swedish rule; that book keeping entries (transactions) must be write-only, at most written 4 days after the occurrance and only changeable through a tuple of (date, signature of person doing it, new bookings).
Finally, what are your opinions on these rules? Are we going towards all-time uplinks for book keeping + POS systems to the tax agency's servers which verify and detect fraudulent patterns in real-time similar to the collective intelligence algorithms out there or will there be a back-lash against the increased complexity of running business?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
顺便说一句，我想不出世界上有任何其他地方可以实现如此严格的要求。然而，一些现有的 POS 系统可能会根据“控制单元”的定义以及“控制单元”和“收银机”之间的区别来实现这种加密。
我这么说的原因是因为许多 POS 系统（至少是我使用过的系统）本质上是一堆连接到中央数据库和交易处理服务器的哑终端。收银机本身实际上没有存储任何数据，因此只需要在服务器端对其进行加密（并通过网络进行加密，但我假设正在使用安全网络协议）。您需要请律师来解释“控制单元”的确切构成，但如果可以将其定义为服务器端的某些东西（在像这样的联网 POS 案例中），那么实现此类系统所需的复杂性就不会增加太繁重了。
困难的情况是每个收银机都需要唯一的加密密钥，无论是加密要存储在收银机本身内部的数据还是在将数据发送到中央服务器之前对其进行加密。这将需要修改或更换每个收银机，根据企业规模和现有设备的使用年限，这确实可能成本高昂。在许多国家（特别是美国），强制进行如此广泛且成本高昂的变革可能必须附有向企业提供资金（以帮助支付设备转换费用）的法案，或者以更像“所有点”的方式编写- 在 {{{some future date}}} 之后制造或销售的待售设备必须实现以下功能：”。实施给企业带来昂贵负担的规则是政治家失去大量支持的好方法，因此如果不提供某种援助，这样的规则不太可能在短时间内得到实施。
可能有趣的案例是“老式”风格的收银机，其本质上由现金抽屉、计算器和收据打印机组成，并且不存储任何数据。该法律可能要求此类系统开始记录交易信息（询问您的律师）。相关的情况是，交易是手工进行的，写在纸质票据上（就像美国的一些餐馆和小商店通常所做的那样）。我经常觉得有趣的是，立法重点关注高科技系统的安全性，但对“模拟”系统却保持不变，并且容易出现问题。话又说回来，瑞典可能不再使用这样的旧系统。
我不确定美国法律对加密记录的具体要求，但我确实知道许多非政府实体需要一定程度的安全性。例如，如果企业想要接受信用卡付款，那么信用卡公司将要求他们在处理和提交信用卡付款信息时遵循一定的安全和加密准则。这部分是由当地法律责任规则决定的。如果交易记录被篡改、丢失或被第三方劫持，交易和记录保存系统的安全性将受到调查。如果企业没有采取合理的努力来保证数据的安全和验证，那么企业（或者可能是设备制造商）可能会因安全漏洞而承担过错，这可能会通过诉讼导致巨大损失。因此，公司倾向于自愿保护其系统，以减少安全漏洞的发生率，并在发生此类漏洞时限制其法律责任。
由于设备制造商可以在国际上销售其设备，因此随着时间的推移，符合瑞典这些限制的设备也可能最终在其他地方使用。如果该系统最终取得成功，其他企业可能会自愿使用这种加密系统，即使没有立法强制他们这样做。我将其与欧盟几年前通过的 RoHS 规则进行比较。许多没有签署 RoHS 立法的国家现在生产和使用 RoHS 认证的材料，不是因为法律强制，而是因为它们是可用的。
编辑：我刚刚在链接的文章中读到了这一点：
对我来说，这听起来像是经过认证的控制单元连接到收银机，但不一定与其连接（或者对于收银机来说不一定是唯一的）。仅这个定义（在我的非律师耳中）听起来并不像是禁止现有收银机通过网络连接到服务器端经过认证的控制单元。如果是这样，这可能就像在服务器端安装一些附加软件（可能还有外围设备）一样简单。详细信息链接可能会澄清这一点，但它不是英文的，所以我不确定它说的是什么。
Offhand, I can't think of anywhere else in the world that implements this strict of a requirement. However, some existing POS systems may implement this sort of encryption depending on what the definition of "control unit" is and where the differentiation between "control unit" and "cash register" lies.
The reason I say this is because many POS systems (at least the ones that I've worked with) are essentially a bunch of dumb terminals that are networked to a central database and transaction processing server. No data is actually stored in the cash register itself, so there is only a need to encrypt it on the server side (and over the wire, but I'm assuming a secure network protocol is being used). You would need to get a lawyer to interpret what exactly constitutes a "control unit", but if this can be defined as something on the server side (in a networked POS case like this) then the necessary complexity to implement such a system would not be too onerous.
The difficult case would be where each individual cash register requires a unique encryption key, whether to encrypt data to be stored inside the register itself or to encrypt data before sending it to a central server. This would require a modification or replacement of each cash register, which could indeed prove costly depending on the size of the business and the age of the existing equipment. In many countries (the US in particular), mandating such an extensive and costly change would likely have to be either accompanied by a bill providing funds to businesses (to help pay for the equipment conversion) or written in a manner more like "all Point-Of-Sale equipment manufactured or sold after {{{some future date}}} must implement the following features:". Implementing rules that place expensive burdens on businesses is a good way for politicians to lose a lot of support, so it's not likely that a rule like this will get implemented over a short period of time without some kind of assistance being offered.
The possibly interesting case would be the "old-fashioned" style of cash registers which essentially consist of a cash drawer, calculator, and receipt printer and store no data whatsoever. This law may require such systems to start recording transaction information (ask your lawyer). Related would be the case where transactions are rung up by hand, written on a paper ticket (like is commonly done in some restaurants and small stores in the US). I often find it amusing how legislation focuses on such security for high-tech systems but leaves the "analog" systems unchanged and wide open for problems. Then again, Sweden may not be using older systems like this anymore.
I'm not sure exactly what US law requires in terms of encrypted records, but I do know that certain levels of security are required by many non-government entities. For example, if a business wants to accept credit card payments, then the credit card company will require them to follow certain security and encryption guidelines when handling and submitting credit card payment information. This is in part dictated by the local rules of legal liability. If a transaction record gets tampered with, lost, or hijacked by a third party the security of the transaction and record-keeping systems will be investigated. If the business did not make a reasonable effort to keep the data secure and verified, then the business may be held at fault (or possibly the equipment manufacturer) for the security breach which can lead to large losses through lawsuits. Because of this, companies tend to voluntarily secure their systems in order to reduce the incidence of security breaches and to limit their legal liability should such a breach happen.
Since device manufacturers can sell their equipment internationally, equipment complying with these Swedish restrictions will likely end up being used in other places as well over time. If the system ends up being successful, other businesses will probably volunteer to use such an encrypted system, even in the absence of legislation forcing them to do so. I compare it to the RoHS rules that the EU passed several years ago. Many countries that did not sign the RoHS legislation now manufacture and use RoHS-certified materials, not because of a legal mandate but because they are available.
Edit: I just read this in the linked article:
To me, this sounds like the certified control unit attaches to the register but is not necessarily connected to it (or necessarily unique to a register). This definition alone doesn't (to my non-lawyer ears) sound like it prohibits existing cash registers from being connected over a network to a certified control unit on the server side. If so, this might be as simple as installing some additional software (and possibly a peripheral device) on the server side. The details link may clarify this, but it's not in English so I'm not sure what it says.
这些类型的要求在欧洲大部分地区（北美的范围较小，但在不断增加）变得越来越普遍。我不确定哪些欧洲银行在这方面进展最快，但在北美，领先者之一是 First Data（他们已经提供了您所描述的需要的完全加密的 POS 设备）。
我进一步假设，大多数商家不会在内部开发执行此操作的系统（由于 PCI 要求以及这样做的挑战），而是会依赖其商家提供商来获取所需的技术。
These types of requirements are becoming more and more common across most of Europe (and to a lesser, but increasing, extent North America). I'm not sure exactly which Europe-based banks are moving fastest on this, but in North America one of the front-runners is First Data (who have already made available the fully-encrypted POS devices like you describe needing).
I would further postulate that most merchants will not develop systems internally that do this (due to the PCI requirements, and challenges in doing so), but will instead rely on their merchant providers for the required technology.