DUAL-MODE OPERATION, SECURE SOFTWARE UPDATE, AND VISUAL SIGNALING FILTERING METHOD FOR SECURE PRODUCTION AND INITIAL DEVICES WITH A SINGLE PHYSICAL USB INTERFACE.

Abstract

The invention describes a system that, while operating as a USB-CCID class smart card reader in normal operating mode via a single physical USB interface, can dynamically switch to Virtual Serial Port mode via software command without requiring any additional physical connection, power cycle, or hardware trigger when a firmware update is needed. In this mode, it verifies the packet-by-packet transmission integrity of transmitted firmware data packets using the CRC-1021 algorithm with an initial value of 0x1021, and in case of CRC mismatch, generates a second-generation negative acknowledgment response that is differentiated by byte sequence from the previous negative acknowledgment format. When the transmission of all firmware blocks is complete, it writes the independently calculated SHA-512 cryptographic hash value on the host side to a reserved area of ​​persistent memory as a parameter for the update end command, thus establishing a two-layer end-to-end integrity verification chain in the transmission and storage layers.By detecting the status query commands that the host operating system periodically sends in the background at the command pattern recognition block in the firmware layer before they are transmitted to the visual indicator driving subsystem, it prevents unnecessary triggering of the visual indicator, hardware strain, and unnecessary power consumption;This encompasses systems and methods related to smart card reader-based electronic signature token devices that implement an integrated secure manufacturing and initialization flow, including the automatic detection of a device containing an unprogrammed microcontroller on the factory production line via a wired connection through a USB interface, the dynamic matching of the hardware serial number with the serial number of the physically inserted smart card, the verification of the generated matching record by the cloud server, the subsequent loading of the RSA key pair generated on the remote server directly into the secure memory area of ​​the smart card via an encrypted secure tunnel without being stored in plain text in local memory at any stage, and the storage of all initialization records in the central manufacturing database.