Secure keyboard verification method, terminal, program product and storage medium

Abstract

The invention provides a security keyboard verification method, a terminal, a program product and a storage medium, and relates to the technical field of information security. Through a default closed built-in keyboard communication channel and a verification function, dual security assurance is provided on hardware and software levels, a user needs to input an instruction and a terminal device carries out dual confirmation in the verification process to allow the secure keyboard to transmit data, and a complex encryption and decryption process is not needed, so that the data transmission speed and the response speed are improved, and the security of the security keyboard is improved. The calculation burden of the terminal equipment is reduced, and the user experience is improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to the information security of a security keyboard separated from a terminal. Background Art

[0002] Some industries that are sensitive to information data security are very concerned about preventing data from being stolen in some application scenarios. However, for some terminal devices, considering certain application scenarios, the keyboard is not designed as an integrated part of the whole device, but is implemented through an external keyboard. The security keyboard described below is such an external keyboard.

[0003] After receiving user input, the security keyboard of the related technology encrypts the user input in real time through its internally integrated security encryption chip according to a preset encryption algorithm, and then transmits it to the terminal device so that the terminal device decrypts the encrypted data.

[0004] Since the data transmission from the security keyboard to the terminal device involves the encryption and decryption process, this results in a reduction in the data transmission speed, which directly affects the response speed of the security keyboard, thereby reducing the user experience. Summary of the invention

[0005] The present application provides a secure keyboard verification method, a terminal, a program product and a storage medium, which are used to increase the data transmission speed and thus change the response speed of the secure keyboard.

[0006] In a first aspect, the present application provides a secure keyboard verification method, comprising: in response to an instruction input by a user, turning on a switch connected to a keyboard path, and establishing a connection with a secure keyboard through the keyboard path, wherein the keyboard path is a built-in keyboard communication channel that is closed by default; after connecting to the secure keyboard, obtaining identification information of the secure keyboard, wherein the identification information is a unique identification code built into the secure keyboard; verifying the secure keyboard based on the identification information; and if the verification is successful, allowing the secure keyboard to transmit data.

[0007] By adopting the above technical solution, double security protection is provided at the hardware and software levels through the built-in keyboard communication channel and verification function that are closed by default. The verification process requires double confirmation by the user input command and the terminal device before the secure keyboard is allowed to transmit data. There is no need for a complicated encryption and decryption process, thereby improving data transmission speed and response speed, reducing the computing burden of the terminal device, and improving user experience.

[0008] In combination with some embodiments of the first aspect, in some embodiments, the step of verifying the security keyboard based on the identification information specifically includes: mapping the identification information into verification information based on a preset mapping relationship; comparing the verification information with the original information in a pre-stored original information library; when the verification information matches any original information in the original information library, the verification is determined to be successful; the built-in unique identification code is generated by applying the preset mapping relationship to the original information in the original information library; when the verification information does not match any original information in the original information library, the verification is determined to have failed.

[0009] By adopting the above technical solution, the identification information is mapped to the verification information using a preset mapping relationship, and compared with the original information library, and the use of unauthorized keyboards is prohibited. At the same time, it ensures that the customer's original data (original information library) is protected and will not be leaked. The keyboard manufacturer can only obtain the mapped data (built-in unique identification code) and cannot reversely deduce the original information, thereby further enhancing the security of the secure keyboard.

[0010] In combination with some embodiments of the first aspect, in some embodiments, after the step of comparing the verification information with the original information in a pre-stored original information library, the method further includes: when the original information library does not contain the original information, determining that the verification is successful.

[0011] By adopting the above technical solution, when the original information database does not contain the original information, the verification is determined to be successful. The verification conditions are relaxed under certain circumstances, allowing customers who do not have special security needs to choose to bypass the verification process and directly use the security keyboard, thereby expanding the scope of application of the security keyboard, so that users who do not need high security can also use this type of keyboard conveniently, thereby increasing the versatility and practicality of the security keyboard.

[0012] In combination with some embodiments of the first aspect, in some embodiments, the step of obtaining identification information of the security keyboard specifically includes: receiving reordered data segments sent by the security keyboard, the security keyboard splitting the identification information of the reordered data segments into multiple data segments, and reordering the multiple data segments according to preset interspersed splicing rules; restoring the reordered data segments based on restoration rules corresponding to the preset interspersed splicing rules to obtain identification information.

[0013] By adopting the above technical solution, the security keyboard splits the identification information into multiple data segments, increasing the complexity of the data. The terminal device uses the preset interlaced splicing rules to reorder the data segments and restore the identification information. Even if the identification information is maliciously exported, it is difficult for the attacker to restore the original identification information. Therefore, it not only improves the security of the data transmission process, but also enhances the resistance to potential attacks and reduces the risk of information leakage.

[0014] In combination with some embodiments of the first aspect, in some embodiments, after the step of allowing the security keyboard to transmit data when the verification is successful, the method also includes: obtaining new identification information of the currently connected keyboard at a preset time interval, the currently connected keyboard being a security keyboard or other keyboard, and the new identification information being identification information or other information; verifying the currently connected keyboard based on the new identification information; and prohibiting the currently connected keyboard from transmitting data when the verification fails.

[0015] By adopting the above technical solution, the keyboard identification information is re-acquired at preset time intervals and the currently connected keyboard is re-verified, which can effectively prevent the keyboard from being replaced, improve the security of the terminal device, and make it difficult for the currently connected keyboard to maintain a connection for a long time even if the initial verification passes.

[0016] In combination with some embodiments of the first aspect, in some embodiments, after the step of allowing the security keyboard to transmit data when the verification is successful, the method also includes: when it is detected that the duration of the currently connected keyboard being in an inactive state reaches a predetermined threshold, obtaining new identification information of the currently connected keyboard, the currently connected keyboard is a security keyboard or other keyboard, and the new identification information is identification information or other information; verifying the currently connected keyboard based on the new identification information; and when the verification fails, prohibiting the currently connected keyboard from transmitting data.

[0017] By adopting the above technical solution, based on the actual situation that the keyboard is not easy to be replaced when it is active, re-verification is triggered when the keyboard is inactive for a long time, ensuring that even if the keyboard is replaced without the user's knowledge, the terminal device can still discover it in time. Since the verification process is mainly carried out during the inactive period of the keyboard, the user will not feel any lag or interruption during use, thereby ensuring smooth operation.

[0018] In combination with some embodiments of the first aspect, in some embodiments, the judgment condition of the inactive state is: monitoring the key value signal of the currently connected keyboard; when no level change of the key value signal is detected, it is determined that the currently connected keyboard is in an inactive state.

[0019] By adopting the above technical solution, the terminal device determines the activity state of the keyboard by monitoring the key value signal of the keyboard, and can determine whether the keyboard is in an inactive state. Therefore, it has lower computing resource consumption, will not cause a significant impact on the performance of the terminal device, and optimizes the use of computing resources of the terminal device.

[0020] In a second aspect, the present application provides a secure keyboard verification terminal, which includes: one or more processors and a memory; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and one or more processors call the computer instructions to enable the secure keyboard verification terminal to execute the method described in the first aspect and any possible implementation method of the first aspect.

[0021] In a third aspect, the present application provides a computer program product comprising instructions, which, when executed on a secure keyboard verification terminal, enables the secure keyboard verification terminal to execute the method described in the first aspect and any possible implementation of the first aspect.

[0022] In a fourth aspect, the present application provides a computer-readable storage medium comprising instructions, which, when executed on a secure keyboard verification terminal, causes the secure keyboard verification terminal to execute the method described in the first aspect and any possible implementation of the first aspect.

[0023] One or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages: Through the built-in keyboard communication channel and verification function that are closed by default, double security protection is provided at the hardware and software levels respectively. The verification process requires double confirmation by the user input command and the terminal device before the secure keyboard is allowed to transmit data. There is no need for a complicated encryption and decryption process, thereby improving data transmission speed and response speed, reducing the computing burden of the terminal device, and improving the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 It is a flowchart of a secure keyboard verification method in an embodiment of the present application; Figure 2 is a hardware structure diagram in this application; Figure 3 is another hardware structure diagram in this application; Figure 4 is another flowchart of the secure keyboard verification method in an embodiment of the present application; Figure 5 is another flowchart of the secure keyboard verification method in an embodiment of the present application; Figure 6 is another flowchart of the secure keyboard verification method in an embodiment of the present application; Figure 7 is another flowchart of the secure keyboard verification method in an embodiment of the present application; Figure 8 It is a schematic diagram of an exemplary hardware structure of a secure keyboard verification terminal in an embodiment of the present application. DETAILED DESCRIPTION

[0025] The terms used in the following embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to be used as limitations to the present application. As used in the specification and appended claims of the present application, the singular expressions "one", "a kind of", "said", "above", "the" and "this" are intended to also include plural expressions, unless there is a clear indication to the contrary in the context. It should also be understood that the term "and / or" used in the present application refers to and includes any or all possible combinations of one or more listed items.

[0026] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features, and in the description of the embodiments of the present application, unless otherwise specified, "plurality" means two or more.

[0027] The executor of the present application is a terminal device, which may be, but is not limited to, various personal computers, laptops, tablet computers, portable wearable devices, and other devices capable of connecting to an external keyboard.

[0028] See also Figure 1 , Figure 1 It is a flow chart of the secure keyboard verification method in the embodiment of the present application.

[0029] S101, in response to an instruction input by a user, turning on a switch of a keyboard path, and realizing connection with a secure keyboard through the keyboard path, where the keyboard path is a built-in keyboard communication channel that is closed by default; It should be noted in advance that the built-in keyboard communication channel of the terminal device of this application is closed by default. To be more precise, both the hardware level (built-in keyboard communication channel) and the software level (verification required) are in a closed state.

[0030] The instructions input by the user represent requests triggered by specific operations or commands, and are generally used directly to open the secure keyboard. The keyboard path refers to the communication channel connecting the device and the secure keyboard, specifically the internal connection path in an inactive state at the hardware level.

[0031] In some embodiments, the instructions input by the user may be operations in the client management software, for example, selecting relevant options through a software interface, etc., which is not limited here.

[0032] In some specific embodiments, a signal switching switch is provided in the interface path for communication between the terminal device and the keyboard. The conduction permission of the switch is controlled by the terminal device. The management software embedded in the terminal device is strongly related to the user, and only authorized users have the authority to open or close the switch of the above-mentioned keyboard signal path. When the user uses the keyboard, the user needs to open the corresponding switch control option through the management software to realize the connection of the built-in keyboard communication channel, which is not limited here.

[0033] In other embodiments, the terminal device activates the virtual communication port through the software level, and finally initializes the driver of the secure keyboard to establish a connection, which is not limited here.

[0034] It should be noted that the switch referred to here does not refer to a physical switch element, but rather to a structure having a switch function.

[0035] To implement the above technical solution, the following exemplary hardware structure may be used. It should be noted that the hardware structure is for reference only, and other hardware structures may be selected according to requirements in actual applications, and are not limited here.

[0036] See also Figure 2 , Figure 2 is a hardware structure diagram in this application; The terminal device motherboard integrates a conversion chip and SOC (system-on-chip). The secure keyboard is connected to the SOC through the conversion chip. Based on this hardware structure, the SOC can open or close the keyboard path by controlling the power supply of the conversion chip.

[0037] See also Figure 3 , Figure 3 is another hardware structure diagram in this application; The terminal device mainboard integrates a signal switching switch, a conversion chip and a SOC. The secure keyboard is connected to the SOC via the signal switching switch and the conversion chip in turn. Based on this hardware structure, the SOC can open or close the keyboard path by controlling the signal switching switch.

[0038] It should be noted that a major difference between the present application and the related art is that the security keyboard of the present application may not require a security encryption chip.

[0039] In other embodiments, in order to improve the user experience, the terminal device will pop up a prompt window when it detects that the security keyboard is inserted, to guide the user to perform subsequent operations.

[0040] S102, after the security keyboard is connected, obtaining identification information of the security keyboard, where the identification information is a unique identification code built into the security keyboard; Identification information refers to data used to identify and verify the identity of the security keyboard; the unique identification number represents a unique, non-repeatable identifier for each security keyboard.

[0041] Specifically, as a simple control terminal device, the keyboard will have a single-chip microcomputer or MCU as a control unit. Here we take MCU as an example. Each MCU will be written with a unique 96-bit identification code during production. The identification code is a unique code burned into the MCU when the keyboard is manufactured.

[0042] In some embodiments, the terminal device sends a specific command request identification information to the security keyboard, then waits for the security keyboard to send data, and finally parses the received data to extract a unique identification code, which is not limited here.

[0043] S103, verifying the security keyboard according to the identification information; Specifically, the terminal device will use a pre-set verification mechanism to check and compare the acquired identification information.

[0044] More specifically, in some embodiments, the terminal device queries an authorized secure keyboard database (white list) to check whether the currently connected secure keyboard is in a known list of trusted keyboards, which is not limited here.

[0045] In other embodiments, the terminal device may first send the identification information to the remote authentication server, then wait for the verification result of the server, and finally determine whether the verification of the currently connected security keyboard is passed according to the returned result, which is not limited here.

[0046] S104: When the verification is successful, the secure keyboard is allowed to transmit data.

[0047] Specifically, after confirming the identity and legitimacy of the security keyboard, the terminal device will lift restrictions on data transmission, allowing the data of the security keyboard to be transmitted to the terminal device.

[0048] This means that at the software level, the keyboard communication channel is fully open and can correctly receive and parse signals from the secure keyboard. At this point, the secure keyboard can begin to securely transmit user input information to the terminal device, including but not limited to key events, special function key status, etc.

[0049] In other embodiments, in the event of a verification failure, the secure keyboard is prohibited from transmitting data. Based on this, in some embodiments, the terminal device will activate a security protection mechanism, for example, the terminal device records the verification failure event, including a timestamp, keyboard identification information, etc., for subsequent auditing, or triggers an internal security alarm, etc., which is not limited here.

[0050] It can be seen that through the built-in keyboard communication channel and verification function that are closed by default, double security protection is provided at the hardware and software levels respectively. The verification process requires double confirmation by the user input command and the terminal device before the secure keyboard is allowed to transmit data. There is no need for a complicated encryption and decryption process, thereby improving data transmission speed and response speed, reducing the computing burden of the terminal device, and improving the user experience.

[0051] The above embodiments have solved the problem of slow data transmission speed, resulting in slow response speed of the security keyboard. However, in actual use, there is still a key problem: how can the user (i.e., the user of the terminal device) effectively manage and control the security keyboard according to his or her own needs (such as confidentiality level, limiting the number of security keyboards, etc.).

[0052] See also Figure 4 , Figure 4 is another flowchart of the secure keyboard verification method in an embodiment of the present application; Step S103 specifically includes: S401, mapping identification information into verification information based on a preset mapping relationship; The preset mapping relationship refers to a predefined data conversion rule, and the verification information represents the data for comparison after conversion; Specifically, the terminal device uses a pre-set mapping algorithm or conversion rule to convert the acquired identification information into a new form, namely, verification information.

[0053] In some embodiments, the terminal device may first base64 encode the identification information, then calculate a hash value using the SHA-256 algorithm, and finally use the hash value as verification information, which is not limited here.

[0054] In other embodiments, the terminal device may first use the AES encryption algorithm to encrypt the identification information, and then perform a hash calculation on the encryption result to obtain the verification information, which is not limited here.

[0055] S402, comparing the verification information with the original information in the pre-stored original information database; The original information database refers to a collection of original information data, and the original information represents the identification data of the legal security keyboard stored in the database; It should be noted that the original information is completely determined and kept independently by the customer. It is generally used as the basis for generating identification information or as a comparison benchmark during the verification process, and is not provided to the outside world.

[0056] In some embodiments, the terminal device compares the verification information obtained in step S201 with each piece of original information in the original information library. The purpose of the comparison is to determine whether the currently connected security keyboard is a known and authorized security keyboard.

[0057] When the amount of data in the original information database is small, the terminal device can use bit operations to compare each piece of original information in the original information database bit by bit, and finally determine whether there is a match, which is not limited here.

[0058] When the original information database has a large amount of data, the terminal device can first use indexing technology to quickly locate a subset of the original information that may match, then perform a detailed string comparison on this subset, and finally determine whether there is a match based on the comparison results. This is not limited here.

[0059] S403, when the verification information matches any original information in the original information library, the verification is determined to be successful; the built-in unique identification code is generated by applying a preset mapping relationship to the original information in the original information library; In some embodiments, if the terminal device finds during the comparison process that the verification information matches any original information in the original information library, it will determine that the verification is successful, which means that the currently connected security keyboard is considered to be a legal and authorized security keyboard.

[0060] In some embodiments, the customer first uses a random number tool (such as Python's Random.randint() function) or an encryption tool (such as RSA) to generate a series of original serial numbers (original information) to form an original information library. Then, the original serial number is converted into an exported serial number (identification information) through a specific processing method. The customer also gives the exported serial number to the keyboard manufacturer, who writes different exported serial numbers to the keyboards during the production stage of the production line; and the customer group adds the original serial number to the whitelist library at the same time. A one-to-one mapping relationship is formed between the two sets of serial numbers. The exported serial number is stored in the secure keyboard, and the original serial number is stored in the terminal device.

[0061] When the secure keyboard is connected to a terminal device, it sends its built-in export serial number (i.e. identification information). After receiving this export serial number, the terminal device will try to map it back to the original serial number, and then compare the verification information (i.e. the received export serial number) with the original information (i.e. the original serial number) pre-stored in the terminal device whitelist library. If the terminal device successfully maps the received export serial number back to an original serial number that exists in its whitelist library, the verification is considered successful, ensuring that only authorized secure keyboards (i.e., their export serial numbers are correctly written during production) can pass the verification.

[0062] It is worth noting that this method allows customers to create different serial number libraries for different groups, thereby achieving more refined access control. At the same time, since the original serial number is only controlled by the customer, the security of the terminal device is greatly improved.

[0063] S404: When the verification information does not match any original information in the original information database, it is determined that the verification has failed.

[0064] Verification failure may be caused by a variety of reasons, such as using an unauthorized keyboard, the identification information of the secure keyboard being tampered with, or the original information database not being updated in a timely manner.

[0065] In other embodiments, in the event of a verification failure, the secure keyboard is prohibited from transmitting data. Based on this, in some embodiments, the terminal device will activate a security protection mechanism, for example, the terminal device records the verification failure event, including a timestamp, keyboard identification information, etc., for subsequent auditing, or triggers an internal security alarm, etc., which is not limited here.

[0066] It can be seen that the identification information is mapped to the verification information by using the preset mapping relationship, and compared with the original information library to prohibit the use of unauthorized keyboards. At the same time, it ensures that the customer's original data (original information library) is protected and will not be leaked. The keyboard manufacturer can only obtain the mapped data (built-in unique identification code) and cannot reversely deduce the original information, thereby further enhancing the security of the secure keyboard.

[0067] The above embodiments are based on a user with high security requirements. However, in actual use, not all users require high security performance. For ordinary users, a complex verification mechanism may cause usage obstacles.

[0068] Therefore, in some other embodiments, after step S402, the following further includes: S405: when the original information library does not contain the original information, determining that the verification is successful.

[0069] Specifically, when performing a comparison operation, the terminal device will first check the status of the original information database. If it is found that no original information is stored in the original information database, that is, the database is empty, the terminal device will directly determine that the verification is successful, rather than determining that the verification has failed as usual.

[0070] It can be seen that when the original information database does not contain the original information, the verification is judged to be successful. The verification conditions are relaxed under certain circumstances, allowing customers who do not have special security needs to choose to bypass the verification process and directly use the security keyboard, which expands the scope of application of the security keyboard and allows users who do not need high security to use this type of keyboard conveniently, thereby increasing the versatility and practicality of the security keyboard.

[0071] In actual use, there is a potential security risk that an attacker may try to obtain the identification information of the security keyboard through illegal means and use this information to circumvent the verification mechanism of the terminal device.

[0072] See also Figure 5 , Figure 5 is another flowchart of the secure keyboard verification method in an embodiment of the present application; Therefore, step S102 specifically includes: S501, receiving the reordered data segments sent by the security keyboard, the reordered data segments are obtained by the security keyboard by splitting the identification information into multiple data segments, and reordering the multiple data segments according to a preset interleaving splicing rule; A data segment refers to a small piece of information after the complete data is divided; a reordered data segment refers to a data fragment reorganized according to specific rules; a preset interspersed splicing rule refers to a predefined data reorganization method used to increase the security of data transmission.

[0073] The secure keyboard will first split its own identification information into multiple smaller data segments. Then, the secure keyboard will rearrange and combine these data segments according to a pre-agreed segmentation and transmission rule. This reordering process can be regarded as a simple encryption measure, the purpose of which is to increase the security of data transmission and prevent the identification information from being directly intercepted or easily interpreted. The terminal device receives the reordered data segment instead of the original identification information. This method increases the complexity of data transmission and improves security.

[0074] Continuing with the above example, in some specific embodiments, the identification information is a verification code composed of the MCU ID (mentioned in step S102 ) and the serial number (mentioned in step S403 ); To avoid potential problems and reduce R&D costs, this terminal device uses a traditional serial port protocol. The format of the data sent and received by the security keyboard follows the standard structure: start bit + 8 data bits + stop bit. In some embodiments, the data bit length of the MCUID is 96 bits, and the data bit length of the serial number is assumed to be 6 characters (48 bits).

[0075] The secure keyboard defines MCU ID and serial number information into 12 and 6 states respectively according to the different characteristics of characters. Each state is split into 8 bits of data for transmission, and the change of each bit of the character represents the difference of serial port input data.

[0076] In some embodiments, the preset interleaving splicing rule is: MCU ID + serial number are sent in sequence; In some other embodiments, the preset interleaving splicing rule is: the serial number + MCU ID are sent in sequence; In other embodiments, the preset interleaving and splicing rules are: each character between the MCU ID and the serial number is shuffled and spliced, the security keyboard sends in a specific data sending state, and the terminal device decodes, identifies and verifies in the same specific state.

[0077] S502: restore the reordered data segments based on a restoration rule corresponding to a preset interlaced splicing rule to obtain identification information.

[0078] The restoration rule refers to a method corresponding to the interlaced splicing rule and used to restore the original data order.

[0079] Continuing with the above example, in some embodiments, the corresponding restoration rule is: MCU ID + serial number concatenated in sequence; In some other embodiments, the corresponding restoration rule is: serial number + MCU ID concatenated in sequence; In other embodiments, the corresponding restoration rule is: the terminal device decodes, identifies and verifies in the same specific state.

[0080] It can be seen that the security keyboard splits the identification information into multiple data segments, which increases the complexity of the data. The terminal device uses the preset interlaced splicing rules to reorder the data segments and restore the identification information. Even if the identification information is maliciously exported, it is difficult for the attacker to restore the original identification information. Therefore, it not only improves the security of the data transmission process, but also enhances the resistance to potential attacks and reduces the risk of information leakage.

[0081] However, in actual use, there is a potential security threat. Even if the security keyboard has passed the initial authentication, there is still a risk of being maliciously replaced.

[0082] See also Figure 6 , Figure 6 is another flowchart of the secure keyboard verification method in an embodiment of the present application; Therefore, after step S104, the following steps are also included: S601, obtaining new identification information of a currently connected keyboard at a preset time interval, where the currently connected keyboard is a security keyboard or other keyboard, and the new identification information is identification information or other information; Among them, the preset time interval refers to the fixed time period during which the terminal device performs regular security checks; the currently connected keyboard refers to the input device that is currently connected to the terminal device and is in use; other keyboards refer to keyboards other than the secure keyboard.

[0083] The terminal device will actively request new identification information from the currently connected keyboard at a preset time interval (eg, every 10 minutes or every hour).

[0084] S602, verifying the currently connected keyboard based on the new identification information; It should be noted that the principle and process of this step are similar to those of step S103. For the relevant principles and processes, please refer to step S103 and will not be described in detail here.

[0085] S603: If the verification fails, prohibit the currently connected keyboard from transmitting data.

[0086] It should be noted that the principle and process of this step are similar to those of step S404. For the relevant principles and processes, please refer to step S404 and will not be described in detail here.

[0087] It can be seen that re-acquiring the keyboard's identification information at preset time intervals and re-verifying the currently connected keyboard can effectively prevent the keyboard from being replaced, improve the security of the terminal device, and make it difficult for the currently connected keyboard to maintain a long-term connection even if the initial verification passes.

[0088] The above embodiments have solved the problem of malicious replacement of the security keyboard. However, in actual use, since the terminal device needs to perform periodic verification, the user may experience obvious lag or short interruption during daily use, affecting the smoothness of the operation.

[0089] Therefore, in a preferred embodiment, please refer to Figure 7 , Figure 7 is another flowchart of the secure keyboard verification method in an embodiment of the present application; Therefore, after step S104, the following steps are also included: S701, when it is detected that the duration of the currently connected keyboard being in an inactive state reaches a predetermined threshold, obtaining new identification information of the currently connected keyboard, where the currently connected keyboard is a security keyboard or other keyboard, and the new identification information is identification information or other information; The inactive state means that the keyboard has no input operation for a certain period of time; the predetermined threshold refers to the maximum allowable inactive time set by the terminal device; In some specific embodiments, the judgment condition of the inactive state is: S7011, monitoring the key value signal of the currently connected keyboard; The key value signal refers to the electronic signal generated when a keyboard key is pressed or released; the level change refers to the switching of the key value signal between high and low levels, which is used to indicate the pressed or released state of the key.

[0090] In some embodiments, the terminal device captures the signal changes generated by each key operation, and the terminal device records the timestamp of each signal change to facilitate subsequent determination of the activity status of the keyboard.

[0091] S7012: When no level change of the key value signal is detected, it is determined that the currently connected keyboard is in an inactive state.

[0092] It can be seen that the terminal device determines the activity state of the keyboard by monitoring the key value signal of the keyboard, and can determine whether the keyboard is in an inactive state. Therefore, it has lower computing resource consumption, will not cause a significant impact on the performance of the terminal device, and optimizes the use of computing resources of the terminal device.

[0093] S702, verifying the currently connected keyboard based on the new identification information; It should be noted that the principle and process of this step are similar to those of step S103. For the relevant principles and processes, please refer to step S103 and will not be described in detail here.

[0094] S703: If the verification fails, prohibit the currently connected keyboard from transmitting data.

[0095] It should be noted that the principle and process of this step are similar to those of step S404. For the relevant principles and processes, please refer to step S404 and will not be described in detail here.

[0096] It can be seen that based on the actual situation that the keyboard is not easy to be replaced when it is active, re-verification is triggered when the keyboard is inactive for a long time, ensuring that even if the keyboard is replaced without the user's knowledge, the terminal device can still discover it in time. Since the verification process is mainly carried out during the inactive period of the keyboard, the user will not feel any lag or interruption during use, ensuring smooth operation.

[0097] The following introduces an exemplary secure keyboard verification terminal 800 provided in an embodiment of the present application. Figure 8 Schematic diagram of an exemplary hardware structure of the secure keyboard verification terminal 800 provided in an embodiment of the present application.

[0098] In some embodiments, the security keyboard verification terminal 800 is a computer device or the security keyboard verification terminal 800 includes a computer device. The computer device includes a processor, a memory and a network interface connected via a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data. The network interface of the computer device is used to communicate with other external terminals or servers through a network connection. In some embodiments, the network interface can be a wired network interface, and in some embodiments, the network interface can also be a wireless network interface. When the computer program is executed by the processor, the method in the embodiment of the present application is implemented.

[0099] Those skilled in the art will understand that Figure 8 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0100] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

[0101] As used in the above embodiments, the term "when..." may be interpreted to mean "if..." or "after..." or "in response to determining..." or "in response to detecting...", depending on the context. Similarly, the phrases "upon determining..." or "if (the stated condition or event) is detected" may be interpreted to mean "if determining..." or "in response to determining..." or "upon detecting (the stated condition or event)" or "in response to detecting (the stated condition or event)", depending on the context.

[0102] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk), etc.

[0103] Those skilled in the art can understand that to implement all or part of the processes in the above-mentioned embodiments, the processes can be completed by computer programs to instruct related hardware, and the programs can be stored in computer-readable storage media. When the programs are executed, they can include the processes of the above-mentioned method embodiments. The aforementioned storage media include: ROM or random access memory RAM, magnetic disk or optical disk and other media that can store program codes.

Claims

1. A secure keyboard verification method, characterized in that: include: In response to an instruction input by a user, a switch to a keyboard path is turned on to achieve connection with a secure keyboard through the keyboard path, wherein the keyboard path is a built-in keyboard communication channel that is closed by default; After connecting to the security keyboard, obtaining identification information of the security keyboard, the identification information being a unique identification code built into the security keyboard; verifying the security keyboard according to the identification information; In case the authentication is successful, the secure keyboard is allowed to transmit data.

2. The method according to claim 1, characterized in that The step of verifying the security keyboard according to the identification information specifically includes: Mapping the identification information into verification information based on a preset mapping relationship; Comparing the verification information with the original information in a pre-stored original information database; When the verification information matches any original information in the original information library, the verification is determined to be successful; the built-in unique identification code is generated by applying the preset mapping relationship to the original information in the original information library; When the verification information does not match any original information in the original information library, it is determined that the verification has failed.

3. The method according to claim 2, characterized in that After the step of comparing the verification information with the original information in the pre-stored original information database, the method further comprises: When the original information database does not contain the original information, it is determined that the verification is successful.

4. The method according to claim 1, characterized in that The step of obtaining the identification information of the security keyboard specifically includes: Receiving the reordered data segments sent by the security keyboard, the reordered data segments are obtained by the security keyboard splitting the identification information into multiple data segments and reordering the multiple data segments according to a preset interleaving and splicing rule; The identification information is obtained by restoring the reordered data segments based on a restoration rule corresponding to the preset interspersed splicing rule.

5. The method according to claim 1, characterized in that After the step of allowing the secure keyboard to transmit data if the verification is successful, the method further comprises: Acquire new identification information of a currently connected keyboard at a preset time interval, wherein the currently connected keyboard is the security keyboard or other keyboard, and the new identification information is the identification information or other information; authenticating the currently connected keyboard based on the new identification information; In case of verification failure, the currently connected keyboard is prohibited from transmitting data.

6. The method according to claim 1, characterized in that After the step of allowing the secure keyboard to transmit data if the verification is successful, the method further comprises: When it is detected that the duration of the currently connected keyboard being in an inactive state reaches a predetermined threshold, acquiring new identification information of the currently connected keyboard, wherein the currently connected keyboard is the security keyboard or other keyboard, and the new identification information is the identification information or other information; authenticating the currently connected keyboard based on the new identification information; In case of verification failure, the currently connected keyboard is prohibited from transmitting data.

7. The method according to claim 6, characterized in that The judgment condition of the inactive state is: Monitoring the key value signals of the currently connected keyboard; When no level change of the key value signal is detected, it is determined that the currently connected keyboard is in the inactive state.

8. A secure keyboard verification terminal, characterized in that: The security keyboard verification terminal includes: one or more processors and a memory; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and the one or more processors call the computer instructions to enable the security keyboard verification terminal to execute the method described in any one of claims 1-7.

9. A computer program product comprising instructions, characterized in that When the computer program product runs on a secure keyboard authentication terminal, the secure keyboard authentication terminal is enabled to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium comprising instructions, characterized in that: When the instruction is executed on the secure keyboard verification terminal, the secure keyboard verification terminal is caused to execute the method as claimed in any one of claims 1 to 7.

Images