An online POS application signature method based on ukey communication data security protection.

Abstract

This invention relates to the field of information processing technology, specifically an online POS application signing method based on ukey communication data security protection, comprising the following steps: S1: generating a certificate request file for the Ukey device and issuing a trusted certificate to it; S2: using the Ukey for identity authentication and obtaining a list of signing private keys; S3: after identity authentication, using the Ukey to sign and reassemble the application package; The online POS application signing method based on ukey communication data security protection provided by this invention can reduce the cost of manufacturing security devices. Relatively speaking, the manufacturing cost of ukey is one-tenth of the cost of security devices, which is more user-friendly for customers with small demand. Small customers generally do not build their own signature security system, and this solution can be used immediately; In addition, the Ukey device performs identity authentication, which, while balancing convenience and security, prevents the possibility of signing private key leakage and provides the convenience of being carried around, making it suitable for further promotion and application.

Description

Technical Field

[0001] This invention relates to the field of information processing technology, specifically to an online POS application signature method based on ukey communication data security protection. Background Technology

[0002] POS machines fall under the category of financial transactions, and in most cases, they do not come pre-installed with the applications customers require. Even if a device already has customer applications pre-installed, subsequent use will inevitably require downloading new applications. Therefore, the security of application downloads must be extremely high. Applications downloaded to the device must be secure, traceable, and non-repudiable.

[0003] Existing POS application signature schemes mainly fall into two categories:

[0004] 1. Store the signing private key locally and use a specific protocol for secure signing;

[0005] 2. Store the signing private key in a special secure POS and perform signing offline.

[0006] The advantages of existing technical solutions 1 and 2 are that both can operate offline. However, this also prevents the upload of signature records to a server. If subsequent checks reveal signature errors or installation failures, the query can only be performed locally. Furthermore, solution 1 has relatively low security, as the private key file is stored locally, posing a significant risk of leakage. Solution 2 allows signing with a secure storage device, without requiring authentication. Additionally, these security devices are relatively large and inconvenient to carry, typically stored in a data center. Summary of the Invention

[0007] To address the aforementioned issues, this invention provides an online POS application signature method based on ukey communication data security protection.

[0008] To achieve the above-mentioned technical objectives, the technical solution adopted by this invention is as follows:

[0009] An online POS application signature method based on ukey communication data security protection includes the following steps:

[0010] S1: Generate a certificate request file for the Ukey device and issue a trusted certificate to it;

[0011] S2: Use Ukey for authentication and obtain a list of signing private keys;

[0012] S3: After identity verification, the application package is signed and reassembled using the Ukey.

[0013] Furthermore, S1: Create a certificate request generation file for the Ukey device and issue a trusted certificate to it. The specific steps are as follows:

[0014] S1.1: Set the initial combination PIN code for the new Ukey device;

[0015] S1.2: Enable the Ukey certificate issuance tool and connect the Ukey to the PC for login;

[0016] S1.3: Use the certificate issuance tool to generate a private key and a CSR certificate request file for the Ukey;

[0017] S1.4: Send the generated CSR certificate request file to the trusted CA for certificate issuance;

[0018] S1.5: Import the certificate issued by the trusted CA into the UKey and verify that it matches the previously generated private key;

[0019] S1.6: The parent CA that issues the certificate to the Ukey will also be pre-configured on the web server for verifying the certificate chain;

[0020] S1.7: Bind the ukey information and the user's information into the database one by one.

[0021] Furthermore, S2: Use the Ukey for authentication and obtain the list of signing private keys. The specific steps are as follows:

[0022] S2.1: After connecting the Ukey to the PC, use the accompanying signature tool to authenticate the Ukey's PIN code login.

[0023] S2.2: Obtain timestamp information from the web server, combine it with a random number, and use the private key of Ukey for signature processing;

[0024] S2.3: Send the signature data to the Web server. The Web server verifies the signature of the data it sends. The data also contains a certificate with a built-in Ukey. After receiving it, the server will parse it and verify its certificate chain using the superior CA.

[0025] S2.4: After the data is verified by the web server, the data is passed through to the OSS server, which verifies whether the Ukey is in a valid and active state.

[0026] S2.5: If the Ukey is in legitimate use, the database will be queried for the list of private key signatures bound to this Ukey, and the list information will be returned to the web server.

[0027] S2.6: The web server receives data from the OSS client and directly transmits the data to the PC tool. After receiving the list, the tool parses it and displays it on the user interface.

[0028] Furthermore, S3: After identity authentication, the application package is signed and reassembled using a Ukey. The specific steps are as follows:

[0029] S3.1: On the PC tool, select the application to be signed and the name of the private key to be used;

[0030] S3.2: After the user selects the signing action, the digest information of the file is calculated in the PC tool and packaged. The private key in the Ukey is also added to the data sent to the web server to sign the combination of the timestamp and random number of this interaction. After the combined data is completed, it is sent to the web server for data verification and review.

[0031] S3.3: After the data is verified on the web server, the data is passed through to the OSS. The OSS verifies whether the Ukey has permission to sign the data using the selected private key.

[0032] S3.4: After verifying the legality of the data, the digest data is sent to the signing machine to sign the data using its corresponding private key;

[0033] S3.5: The signed data will be returned to the web server, which will then pass it through to the PC tool.

[0034] S3.6: After receiving the data, the PC tool writes the corresponding signature data into the application package and reassembles the application package according to the custom format.

[0035] Furthermore, both the signature digest data and the signature data are exchanged and sent using the HTTPS transport protocol.

[0036] Based on the above, the present invention also provides a computer-readable storage medium storing at least one instruction, at least one program, code set, or instruction set, wherein the at least one instruction, at least one program, code set, or instruction set is loaded and executed by a processor to implement the above-mentioned online POS application signature method based on ukey communication data security protection.

[0037] By adopting the above technical solution, the present invention has the following beneficial effects compared with the prior art:

[0038] 1) The online POS application signature method based on ukey communication data security protection provided by this invention can reduce the cost of manufacturing security devices. Relatively speaking, the manufacturing cost of ukey is one-tenth of the cost of security devices. It is more user-friendly for customers with small demand. Small customers generally do not build their own signature security system. Using this solution, they can start using it immediately. In addition, the Ukey device is used for identity authentication. It can prevent the possibility of signing private key leakage and provide the convenience of carrying it with them, while taking into account both convenience and security. It is suitable for further promotion and application.

[0039] 2) This invention transforms local key management or security device key management into a server-managed system, thereby improving the security of the key management system and ensuring that key pairs are not subject to human leakage.

[0040] 3) This invention creates a private key pair generated internally by the ukey. Although it is not a signing private key, but an authentication private key, this private key cannot be manually exported, thus preventing the signature data from being tampered with. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1 This is a schematic diagram of the process of the present invention;

[0043] Figure 2 This is a schematic diagram of the combined pin cipher in this invention. Detailed Implementation

[0044] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to represent selected embodiments of the invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0045] See attached document Figure 1 As shown, this embodiment provides an online POS application signature method based on ukey communication data security protection, including:

[0046] S1: Create a certificate request file for the Ukey device and issue a trusted certificate to it; the specific steps are as follows:

[0047] S1.1: Set the initial combination PIN code for the new Ukey device;

[0048] S1.2: Enable the Ukey certificate issuance tool and connect the Ukey to the PC for login;

[0049] S1.3: Use the certificate issuance tool to generate a private key and a CSR certificate request file for the Ukey;

[0050] S1.4: Send the generated CSR certificate request file to the trusted CA for certificate issuance;

[0051] S1.5: Import the certificate issued by the trusted CA into the UKey and confirm whether it matches the previously generated private key; if it matches, the ukey certificate was successfully created.

[0052] S1.6: The parent CA that issues the certificate to the Ukey will also be pre-configured on the web server for verifying the certificate chain;

[0053] S1.7: Bind the ukey information and the user's information one by one into the database; the ukey and the user information are bound one by one, that is, after the ukey and the user information are bound one by one, only the device private key list of the corresponding user can be obtained for signing. When the device is finally downloaded for verification, the user information will also be verified. Only after successful verification can it be installed normally, effectively preventing the installation without a signature.

[0054] In this embodiment, a certificate request file is generated by creating a Ukey private key pair, and a certificate is issued using a securely certified CA to ensure the security of application downloads.

[0055] As a further preferred method, in S1.1, the PIN password is combined by splitting the password into two input boxes, and the passwords in the two input boxes are combined in a non-ending-end concatenation manner. For ease of understanding, the following example illustrates this: The actual ukey password is 16 characters long; we split it into two 8-character password input boxes, and only in our accompanying tool will there be two boxes where the password can be entered (see attached...). Figure 2As shown, other tools that can log in to the uke only have one input box. Since the user does not know the password combination in the two input boxes, even if the user knows the passwords in both input boxes, they cannot know the correct order of the 16-digit password. Therefore, without using the accompanying client tool, PIN code login is not possible, which improves the security of its use.

[0056] S2: Use the Ukey for authentication and obtain the list of signing private keys. The specific steps are as follows:

[0057] S2.1: After connecting the Ukey to the PC, use the accompanying signature tool to authenticate the Ukey's PIN code login.

[0058] S2.2: Obtain timestamp information from the web server, combine it with a random number, and use the private key of Ukey for signature processing;

[0059] S2.3: Send the signature data to the Web server. The Web server verifies the signature of the data it sends. The data also contains a certificate with a built-in Ukey. After receiving it, the server will parse it and verify its certificate chain using the superior CA.

[0060] S2.4: After the data is verified by the web server, the data is passed through to the OSS server, which verifies whether the Ukey is in a valid and active state.

[0061] S2.5: If the Ukey is in legitimate use, the database will be queried for the list of private key signatures bound to this Ukey, and the list information will be returned to the web server.

[0062] S2.6: The web server receives data from the OSS client and directly transmits the data to the PC tool. After receiving the list, the tool parses it and displays it on the user interface.

[0063] S3: After identity authentication, the application package is signed and reassembled using the Ukey. The specific steps are as follows:

[0064] S3.1: On the PC tool, select the application to be signed and the name of the private key to be used;

[0065] S3.2: After the user selects the signature action, the digest information of the file is calculated in the PC tool and packaged according to specific rules. The private key in the Ukey is also added to the data sent to the web server to sign the combination of the timestamp and random number of this interaction (same as step S2.2). After the combined data is completed, it is sent to the web server for data verification and review.

[0066] S3.3: After the data is verified on the web server, the data is passed through to the OSS. The OSS verifies whether the Ukey has permission to sign the data using the selected private key.

[0067] In this implementation, the server adopts a multi-terminal mode. The data sent needs to be authenticated by the web client before it can be transmitted to the OSS client for data processing. The OSS client adopts a whitelist mode. Data sent outside the whitelist will be rejected and not processed.

[0068] The OSS uses a whitelist approach; data not on the whitelist will be rejected and not processed.

[0069] S3.4: After verifying the legality of the data, the digest data is passed to the signature machine (HSM) to sign the data using its corresponding private key;

[0070] S3.5: The signed data will be returned to the web server, which will then pass it through to the PC tool.

[0071] S3.6: After receiving the data, the PC tool writes the corresponding signature data into the application package and reassembles the application package according to the custom format. Once the package is assembled, the signing process ends.

[0072] As mentioned above, both the digest data and the signature data are transmitted and received using the HTTPS transport protocol, and a custom data conversion and encryption (a combination of timestamp information and random numbers) is performed before transmission to prevent the digest data and signature data from being tampered with during transmission.

[0073] This invention addresses the issues of signature recording and authentication in POS applications, while also providing portability. It introduces a POS application signature mode based on a ukey. The ukey is a USB-like hardware device, relatively lightweight and portable compared to other security devices. Before signing, a secure PIN code needs to be set for the ukey. During signing, the private key stored within the ukey is combined with a random number and timestamp to create a signature (note: this signature is not an application signature, but a signature using the ukey's internal private key for server authentication), which is then sent to the server for verification. Next, the certificate stored within the ukey is also sent to the server (the server will have a pre-configured parent certificate of the ukey's internal certificate). Only after both verifications pass can the client upload the signature digest data to the server for signing. Each upload is recorded for future traceability.

[0074] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0075] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods of various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0076] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the invention by those skilled in the art. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the invention should be included within the scope of protection of the invention.

Claims

1. An online POS application signature method based on ukey communication data security protection, characterized in that, Includes the following steps: S1: Generate a certificate request file for the Ukey device and issue a trusted certificate to it; The specific steps are as follows: S1.1: Set the initial combination PIN code for the new Ukey device; S1.2: Enable the Ukey certificate issuance tool and connect the Ukey to the PC for login; S1.3: Use the certificate issuance tool to generate a private key and a CSR certificate request file for the Ukey; S1.4: Send the generated CSR certificate request file to the trusted CA for certificate issuance; S1.5: Import the certificate issued by the trusted CA into the UKey and verify that it matches the previously generated private key; S1.6: The parent CA that issues the certificate to the Ukey will also be pre-configured on the web server for verifying the certificate chain; S1.7: Bind the ukey information and the user's information one by one and enter them into the database; S2: Use the Ukey for authentication and obtain the list of signing private keys; the specific steps are as follows: S2.1: After connecting the Ukey to the PC, use the accompanying signature tool to authenticate the Ukey's PIN code login. S2.2: Obtain timestamp information from the web server, combine it with a random number, and use the private key of Ukey for signature processing; S2.3: Send the signature data to the Web server. The Web server verifies the signature of the data it sends. The data also contains a certificate with a built-in Ukey. After receiving it, the server will parse it and verify its certificate chain using the superior CA. S2.4: After the data is verified by the web server, the data is passed through to the OSS server, which verifies whether the Ukey is in a valid and active state. S2.5: If the Ukey is in legitimate use, the database will be queried for the list of private key signatures bound to this Ukey, and the list information will be returned to the web server. S2.6: The web server receives data from the OSS and directly transmits the data to the PC tool. After receiving the list, the tool parses it and displays it on the user interface. S3: After identity authentication, the application package is signed and reassembled using the Ukey; the specific steps are as follows: S3.1: On the PC tool, select the application to be signed and the name of the private key to be used; S3.2: After the user selects the signing action, the digest information of the file is calculated in the PC tool and packaged. The private key in the Ukey is also added to the data sent to the web server to sign the combination of the timestamp and random number of this interaction. After the combined data is completed, it is sent to the web server for data verification and review. S3.3: After the data is verified on the web server, the data is passed through to the OSS. The OSS verifies whether the Ukey has permission to sign the data using the selected private key. S3.4: After verifying the legality of the data, the digest data is sent to the signing machine to sign the data using its corresponding private key; S3.5: The signed data will be returned to the web server, which will then pass it through to the PC tool. S3.6: After receiving the data, the PC tool writes the corresponding signature data into the application package and reassembles the application package according to the custom format. Only after both verifications pass can the client send the signature digest data to the server for signing. Each submission will be recorded as a basis for future traceability.

2. The online POS application signature method based on ukey communication data security protection as described in claim 1, characterized in that, Both the signature digest data and the signature data are exchanged and sent using the HTTPS transport protocol.

3. A computer-readable storage medium, characterized in that: The storage medium stores at least one instruction, at least one program, code set, or instruction set, wherein the at least one instruction, at least one program, code set, or instruction set is loaded and executed by a processor to implement the online POS application signature method based on ukey communication data security protection as described in any one of claims 1 to 2.

Images