Authorization use method and system of self-service equipment module

Abstract

The invention discloses an authorized use method and system of a self-service equipment module, and the method comprises the steps: a mobile terminal obtains hardware information of an upper computer and a unique number of the self-service equipment module, and transmits the hardware information and the unique number to an authorization service; the authorization service calls the public key to encrypt the received information to generate an encrypted information packet, and returns the encrypted information packet to the mobile terminal; the upper computer obtains an encrypted information packet from the mobile terminal and sends the encrypted information packet to the self-service equipment module, and the self-service equipment module decrypts the encrypted information packet by using a private key to obtain an abstract of hardware information of the upper computer and stores the abstract to a firmware ROM (Read Only Memory); when the upper computer sends an instruction, hardware information of the upper computer is collected in real time, a communication random number and a unique number are obtained from the self-service equipment module, a working key is constructed to encrypt the instruction, and an encrypted instruction packet is sent to the self-service equipment module; the self-service equipment module constructs a decryption key according to the random number and the digest value called from the random number, and decrypts the encryption instruction packet; and if the decryption is successful, executing an instruction obtained by decryption, otherwise, returning abnormal information. According to the method, illegal upper computer access or equipment replacement is avoided, and unauthorized control is completely eradicated from the source.

Description

Technical Field

[0001] This invention belongs to the field of financial data processing technology, specifically relating to a method and system for authorizing the use of a self-service equipment module. Background Technology

[0002] With the development of intelligent technology, self-service equipment has been widely used in finance, government affairs, healthcare, and other fields. Its core function often involves the output of key credentials (such as bank cards, checks, cash, and identification documents). However, the authorization mechanisms of existing self-service equipment have significant shortcomings:

[0003] (1) Insufficient authorization security: Most devices rely only on the device's unique number or a simple password for authorization, without establishing a strong association with the host computer (the terminal that controls the operation of the device). This allows unauthorized host computers to issue instructions at will after access, leading to the false transmission of critical credentials.

[0004] (2) Lack of dynamic verification: Some authorization mechanisms only perform verification once when the device is first started, and there is no real-time verification during subsequent use. If the host computer is tampered with or replaced, the device will still respond to illegal commands.

[0005] (3) Poor compatibility of encryption algorithms: Existing technologies mostly use international encryption algorithms (such as RSA and AES) and do not comply with the national cryptographic algorithm standards required by my country's "Financial Technology Development Plan" and other policies, which pose compliance risks and data security risks.

[0006] The aforementioned issues make self-service devices vulnerable to attacks in unattended scenarios, potentially leading to financial losses or information leaks for users. There is an urgent need for an authorized usage solution that combines high security, strong binding capabilities, and compatibility with domestically produced technologies. Summary of the Invention

[0007] This invention provides a method and system for authorizing the use of a self-service equipment module, which can achieve strong binding between the "device and host computer", dynamic instruction verification and compliance with national cryptographic standards, and avoid the mis-execution of key instructions in unauthorized scenarios.

[0008] To achieve the above technical objectives, the present invention adopts the following technical solution:

[0009] A method for authorizing the use of a self-service device module, comprising:

[0010] Step 1, Install and activate;

[0011] Mobile terminal: Obtains the hardware information and unique number of the self-service device module from the host computer and sends them to the authorization service;

[0012] Authorization service: (1) retrieve the corresponding public key according to the unique number of the self-service equipment module received; (2) use the public key to encrypt the hardware information of the host computer and the digest value of the unique number of the self-service equipment module to generate an encrypted information packet; (3) send the encrypted information packet back to the mobile terminal.

[0013] The self-service equipment module obtains encrypted information packets from the mobile terminal through the host computer, and uses the private key to decrypt them to obtain the digest value of the host computer hardware information and the unique number of the self-service equipment module, and then stores it in the firmware ROM;

[0014] Step 2, instruction execution;

[0015] The host computer: (1) collects its own hardware information in real time and obtains communication random number and unique number from the self-service equipment module; (2) constructs working key based on its own hardware information in real time, the unique number of the self-service equipment module and communication random number; (3) uses the working key to encrypt the instruction and sends the generated encrypted instruction package to the self-service equipment module.

[0016] Self-service equipment module: (1) Construct a decryption key based on the communication random number and the digest value retrieved from the firmware ROM, and decrypt the encrypted instruction packet; (2) If the decryption is successful, execute the decrypted instruction; if the decryption fails, return an exception message.

[0017] Furthermore, the hardware information of the host computer includes: CPU serial number, hard disk physical serial number, and network card MAC address.

[0018] Furthermore, the method for the mobile terminal to obtain the host computer's hardware information is as follows: the host computer collects its own hardware information, generates a hardware information data packet, and converts it into a QR code; the mobile terminal scans the host computer's QR code to obtain the host computer's hardware information.

[0019] Furthermore, the hardware information of the host computer and the unique number of the self-service equipment module are summarized by performing SM2 digest calculation on the hardware information of the host computer and the unique number of the self-service equipment module to generate a fixed-length digest value.

[0020] Furthermore, after receiving the encrypted information packet, the mobile terminal converts it into a QR code, which is then scanned by the self-service device module to obtain the encrypted information packet.

[0021] Furthermore, the host computer constructs a working key based on its real-time hardware information, the unique number of the self-service device module, and the communication random number. This includes: firstly, calculating the digest content composed of the host computer's own hardware information and the unique number of the self-service device module using the same method as the authorized service, and obtaining the digest value; then, using the digest value as the master key, encrypting the communication random number through the SM4 symmetric algorithm, and using the encrypted content as the working key.

[0022] The self-service device module constructs a decryption key based on the communication random number and the digest value retrieved from the firmware ROM. This includes: first, retrieving the digest value of the host computer hardware information and the unique number of the self-service device module from the firmware ROM; then, using the retrieved digest value as the master key, encrypting the communication random number through the SM4 symmetric algorithm, and the resulting content is the decryption key.

[0023] Furthermore, the host computer collects its own hardware information by calling the system API.

[0024] Furthermore, the mobile terminal communicates with the authorized service via the HTTPS protocol.

[0025] Furthermore, the authorization service pre-stores a mapping table between the unique number of the self-service device module and the public key; and implements digest value calculation and encryption based on the national cryptographic algorithm.

[0026] A self-service equipment module authorization system includes a self-service equipment module, a mobile terminal, an authorization service, and a host computer, which communicate with each other to implement the self-service equipment module authorization method described above.

[0027] Compared with the prior art, the present invention has the following technical effects:

[0028] 1. Strong binding: By binding with "unique device number + host computer hardware information", it avoids unauthorized host computer access to the self-service device module or the replacement of the self-service device module, thus eliminating unauthorized control from the source;

[0029] 2. High security: It adopts a combination of SM2 (asymmetric encryption, used for information transmission during the activation phase) and SM4 (symmetric encryption, used for instruction verification) national cryptographic algorithms, which comply with domestic security standards. The dynamic instruction verification mechanism ensures that every critical operation is verified to prevent tampering.

[0030] 3. Ease of implementation: Information is transferred through mobile terminals and QR codes, requiring no additional hardware equipment. The host computer and authorization service do not require a network connection, making it suitable for on-site installation scenarios.

[0031] 4. Risk controllability: The system refuses to respond to critical commands when inactive, and returns an exception immediately upon decryption failure, effectively preventing the accidental return of critical credentials and reducing the risk of property loss. Attached Figure Description

[0032] Figure 1 This is a diagram showing the composition of the authorized use system of the self-service equipment module described in the embodiments of this application.

[0033] Figure 2 This is a flowchart illustrating the steps of the authorized use method of the self-service equipment module described in the embodiments of this application. Detailed Implementation

[0034] The embodiments of the present invention will be described in detail below. These embodiments are based on the technical solutions of the present invention and provide detailed implementation methods and specific operation processes to further explain the technical solutions of the present invention.

[0035] Example 1

[0036] This embodiment provides a method for authorizing the use of a self-service equipment module, referencing... Figure 1 , 2 As shown, it includes the following steps:

[0037] 1. Equipment pre-installation stage.

[0038] Before the self-service device module leaves the factory, a private key paired with the public key of the authorization service is written into the firmware ROM of the self-service device module to ensure that the private key cannot be tampered with or exported. At the same time, a unique device number (such as an SN code) is assigned to the self-service device module, and the device number and the corresponding public key are associated and stored in the public key management module of the authorization service.

[0039] 2. On-site installation and activation stage.

[0040] First, the mobile terminal obtains the hardware information and the unique number of the self-service device module from the host computer and sends it to the authorization service.

[0041] Specifically, the installer operates a mobile terminal (such as a smartphone) to access the authorization service through a backend connection module (e.g., via app login authentication). Simultaneously, the host computer activates the hardware information collection module, which calls system APIs to collect its own hardware information (CPU serial number, hard drive physical serial number, network card MAC address, etc.) and the unique serial number of the self-service device module. This generates an authorization information data packet, which is then converted into a scannable QR code using a QR code generation tool. The mobile terminal accessing the authorization service then scans the QR code on the host computer to obtain the hardware information data packet and the unique serial number of the self-service device module.

[0042] After obtaining the "hardware information data packet + device unique number", the mobile terminal sends it to the authorization service.

[0043] Then, the authorization service: (1) retrieves the corresponding public key based on the unique number of the self-service device module received. (2) uses the public key to encrypt the hardware information of the host computer and the digest value of the unique number of the self-service device module, generating an encrypted information packet. (3) sends the encrypted information packet back to the mobile terminal.

[0044] Specifically, the public key management module of the authorization service retrieves the corresponding public key based on the device's unique identifier. The information encryption module performs SM2 digest calculation on the "hardware information data packet + device unique identifier" (generating a fixed-length digest value), and then encrypts the digest value with the public key to generate an encrypted information packet. The authorization service then sends the encrypted information packet back to the mobile terminal, which converts it into a QR code.

[0045] Finally, the self-service device module: obtains encrypted information packets from the mobile terminal through the host computer, and uses the private key to decrypt them to obtain a digest of the host computer hardware information and the unique number of the self-service device module, and then stores it in the firmware ROM.

[0046] Specifically, the host computer program scans the QR code information, reads the encrypted information packet, and sends it to the self-service device module. The self-service device module obtains the encrypted information packet; then, it decrypts the encrypted information packet using the decryption module and a private key to obtain the SM2 digest of the host computer hardware information and the unique number of the self-service device module; finally, the SM2 digest of the host computer hardware information and the unique number of the self-service device module is stored in the firmware ROM, completing the activation (in the inactive state, the self-service device module refuses to execute any critical instructions).

[0047] 3. Execution phase of key instructions.

[0048] First, the host computer: (1) When the host computer needs to send an instruction (such as "dispense bank card" or "issue cash"), the hardware information acquisition module collects its own CPU number, hard disk physical number, and network card MAC address in real time to generate real-time hardware information; at the same time, the host computer obtains the unique number and communication random number of the self-service equipment module from the self-service equipment module. (2) Construct a working key based on the real-time hardware information, the unique number of the self-service equipment module, and the communication random number: the host computer's instruction encryption module performs SM2 digest calculation on the real-time hardware information and the unique number of the self-service equipment module to obtain a real-time digest value (consistent with the digest value stored in the activation phase), and uses this real-time digest value as the master key, and encrypts the random number using the SM4 symmetric algorithm as the working key. (3) After obtaining the working key, the host computer uses the working key to encrypt the instruction and sends the generated encrypted instruction packet to the self-service equipment module.

[0049] Then, the self-service equipment module: (1) Constructs a decryption key based on the communication random number and the digest value (SM2 digest) retrieved from the firmware ROM: First, retrieves the digest value of the host computer hardware information and the unique number of the self-service equipment module from the firmware ROM; then, using the retrieved digest value as the master key, the communication random number is encrypted using the SM4 symmetric algorithm, and the obtained content is the decryption key; then, the decryption key is used to decrypt the encrypted instruction packet; (2) If the decryption is successful (the instruction data is complete), the self-service equipment module executes the decrypted instruction; if the decryption fails (the key does not match or the data is tampered with), the self-service equipment module refuses to execute the instruction and returns an exception message.

[0050] Example 2

[0051] This embodiment provides an authorization system for a self-service equipment module, including a mobile terminal, an authorization service, and a host computer, which communicate with each other to implement the authorization method for the self-service equipment module described in Embodiment 1.

[0052] 1. Self-service device module: Includes a built-in private key (pre-installed in the device firmware ROM at the factory), decryption module, digest storage module, and instruction execution module; among which:

[0053] Private key: forms an asymmetric encryption pair with the device public key stored in the authorization service, and is used only to decrypt encrypted information sent by the authorization service;

[0054] Decryption module: Supports SM2 asymmetric decryption (for the activation phase) and SM4 symmetric decryption (for the instruction verification phase).

[0055] Summary storage module: Used to permanently store SM2 summaries of host computer hardware information;

[0056] Instruction execution module: Executes the host computer instruction after verifying successful decryption; otherwise, returns an exception message.

[0057] 2. Host computer: Communicates with the self-service equipment and is equipped with a hardware information acquisition module and a command encryption module; among which:

[0058] Hardware information acquisition module: Collects unique hardware identifiers such as its own CPU serial number, hard disk physical serial number, and network card MAC address;

[0059] Instruction encryption module: Using the SM2 digest of the host computer hardware information as a fixed key, it encrypts critical instruction data using the SM4 symmetric algorithm.

[0060] Mobile terminal: As a communication bridge between "host computer - authorization service - self-service device module", it is equipped with a background connection module and a QR code scanning / generation module; it supports scanning hardware information QR codes generated by the host computer, receiving encrypted information from the authorization service and generating QR codes for self-service devices to scan and obtain.

[0061] 3. Authorization Service: Deployed on a cloud server, it includes a public key management module and an information encryption module; among which:

[0062] Public key management module: Stores the unique identifier (such as device SN code) of all self-service devices and their corresponding public keys, forming a device-public key mapping library;

[0063] Information encryption module: Receives "host computer hardware information + device unique number" sent by the mobile terminal, performs SM2 digest calculation on the combined information using the device public key, and then encrypts it with the public key to generate an encrypted data packet.

[0064] Example 3

[0065] The following uses a "bank smart teller machine" as an example to illustrate the authorized use method and system of the self-service equipment module of the present invention.

[0066] 1. Authorize the use of the system implementation.

[0067] Ticket sending module (belonging to the self-service equipment module): adopts an industrial-grade motherboard, the firmware ROM uses an encrypted storage chip (such as SPI Flash), the private key is written through a hardware programming tool and is prohibited from being read by software; built-in camera (for scanning mobile phone QR codes), the decryption module is implemented through a national cryptographic algorithm chip (such as SM2 / SM4 hardware encryption chip) to ensure encryption efficiency.

[0068] The intelligent teller machine control terminal (the host computer) uses a hardware information acquisition module to collect hardware information, such as QR code generation, by calling system APIs (to obtain hard drive number, CPU number, MAC address, etc.).

[0069] Mobile terminal: A dedicated APP is developed based on the Android / iOS system, and the backend connection module communicates with the authorization service via the HTTPS protocol.

[0070] Authorized services: Deployed on the equipment manufacturer's cloud server, the public key management module uses a database to store the "device SN code-public key" mapping table, and the information encryption module implements SM2 digest and encryption based on the national cryptographic algorithm library.

[0071] 2. Specific steps for authorizing the use of the method.

[0072] Pre-installed at the factory: When the smart teller machine leaves the factory, the SN code of the ticket issuance module is obtained through the burning tool, and the public and private key pairs are obtained through the authorization service. The private key is written into the encrypted ROM of the ticket issuance module, and the corresponding public key and SN information are saved to the background database.

[0073] On-site activation: The installer logs into the manufacturer's maintenance account via the mobile app. The smart teller machine control terminal collects its own CPU number, hard drive number, MAC address, and the serial number (SN) of the ticket issuing module, and generates a QR code. The mobile phone scans the QR code and sends it to the authorization service. The authorization service retrieves the public key using the SN of the ticket issuing module, performs an SM2 digest on the hardware information and the SN, encrypts it, and sends it back to the mobile phone. The mobile phone generates an encrypted QR code, which the smart teller machine control terminal scans and sends the encrypted digest value to the ticket issuing module. The ticket issuing module decrypts the digest using its private key and saves it to the ROM.

[0074] Instruction Execution: When a user operates the smart teller machine to issue a check, the system retrieves the SN code and a random number from the check issuance module. The control terminal collects real-time hardware information and generates a digest value identical to the SN code from the check module, which is the key SM4. The random number is encrypted using key SM4 and used as the working key. The "Dispense Check" command is then encrypted with the working key and sent to the check issuance module. Upon successful verification, the check issuance module controls the cash dispensing module to dispense the check. If the control terminal is replaced (hardware information changes, digest value mismatch), the check issuance module returns an error and refuses to dispense the check.

[0075] The above embodiments are preferred embodiments of this application. Those skilled in the art can make various changes or improvements based on them. Without departing from the overall concept of this application, these changes or improvements should fall within the scope of protection claimed in this application.

Claims

1. A method for authorizing the use of a self-service equipment module, characterized in that, include: Step 1, Install and activate; Mobile terminal: Obtains the hardware information and unique number of the self-service device module from the host computer and sends them to the authorization service; Authorization service: (1) retrieve the corresponding public key according to the unique number of the self-service equipment module received; (2) use the public key to encrypt the hardware information of the host computer and the digest value of the unique number of the self-service equipment module to generate an encrypted information packet; (3) send the encrypted information packet back to the mobile terminal. The self-service equipment module obtains encrypted information packets from the mobile terminal through the host computer, and uses the private key to decrypt them to obtain the digest value of the host computer hardware information and the unique number of the self-service equipment module, and then stores it in the firmware ROM; Step 2, instruction execution; The host computer: (1) collects its own hardware information in real time and obtains communication random number and unique number from the self-service equipment module; (2) constructs working key based on its own hardware information in real time, the unique number of the self-service equipment module and communication random number; (3) uses the working key to encrypt the instruction and sends the generated encrypted instruction package to the self-service equipment module. Self-service equipment module: (1) Construct a decryption key based on the communication random number and the digest value retrieved from the firmware ROM, and decrypt the encrypted instruction packet; (2) If the decryption is successful, execute the decrypted instruction; if the decryption fails, return an exception message.

2. The authorized use method of the self-service equipment module according to claim 1, characterized in that, The host computer's hardware information includes: CPU serial number, hard disk physical serial number, and network card MAC address.

3. The authorized use method of the self-service equipment module according to claim 1, characterized in that, The method for a mobile terminal to obtain hardware information from a host computer is as follows: the host computer collects its own hardware information, generates a hardware information data packet, and converts it into a QR code; the mobile terminal scans the host computer's QR code to obtain the host computer's hardware information.

4. The authorized use method of the self-service equipment module according to claim 1, characterized in that, The hardware information of the host computer and the unique number of the self-service equipment module are summarized by performing SM2 digest calculation on the hardware information of the host computer and the unique number of the self-service equipment module to generate a fixed-length digest value.

5. The authorized use method of the self-service equipment module according to claim 1, characterized in that, After receiving the encrypted information packet, the mobile terminal converts it into a QR code, which is then scanned by the self-service equipment module to obtain the encrypted information packet.

6. The authorized use method of the self-service equipment module according to claim 1, characterized in that, The host computer constructs a working key based on its real-time hardware information, the unique number of the self-service device module, and the communication random number. This includes: first, calculating the digest content composed of the host computer's own hardware information and the unique number of the self-service device module using the same method as the authorized service, and obtaining the digest value; then, using the digest value as the master key, encrypting the communication random number through the SM4 symmetric algorithm, and using the encrypted content as the working key. The self-service device module constructs a decryption key based on the communication random number and the digest value retrieved from the firmware ROM. This includes: first, retrieving the digest value of the host computer hardware information and the unique number of the self-service device module from the firmware ROM; then, using the retrieved digest value as the master key, encrypting the communication random number through the SM4 symmetric algorithm, and the resulting content is the decryption key.

7. The authorized use system for the self-service equipment module according to claim 1, characterized in that, The host computer collects its own hardware information by calling the system API.

8. The authorized use system for the self-service equipment module according to claim 1, characterized in that, Mobile terminals communicate with authorized services via the HTTPS protocol.

9. The authorized use system for the self-service equipment module according to claim 1, characterized in that, The authorization service pre-stores a mapping table between the unique number of the self-service device module and the public key; and implements digest value calculation and encryption based on the national cryptographic algorithm.

10. An authorization system for a self-service equipment module, characterized in that, It includes a self-service equipment module, a mobile terminal, an authorization service, and a host computer, which communicate with each other to implement the authorized use method of the self-service equipment module as described in any one of claims 1-9.

Images