A software-hardware combined secure communication method and system for self-service equipment

Abstract

The present invention discloses a software-hardware combined secure communication method and system for self-service equipment, the method comprising: when the self-service equipment establishes a communication connection with an application server, the application client uses a password keyboard and an asymmetric encryption algorithm to negotiate a session key with the application server to generate a session key; the application client generates a working key according to the application encryption and decryption scenario; the application client uses the session key to encrypt the working key to obtain an encrypted working key, and transmits it to the application server; the application server decrypts the encrypted working key using the session key to obtain the working key.

Description

Technical Field

[0001] The present invention belongs to the technical field of secure communication, and in particular, relates to a secure communication method and system combining software and hardware for self-service equipment. Background Art

[0002] The self-service equipment application system is a software application system that is closely related to the self-service equipment hardware. As the business complexity of the self-service equipment application field continues to increase, the amount of data processed by the equipment application continues to increase, and the financial industry's requirements for autonomous security continue to increase, the original security mechanisms in the self-service equipment application field and the currently immature basic software for autonomous security cannot meet the autonomous security requirements of the self-service equipment application field.

[0003] At present, most of the applications developed in the self-service field of the industry adopt the B / S architecture mode that is easy to expand and maintain. The B / S architecture must rely on the browser on the client side. Currently, the mainstream browsers do not support autonomous and secure national secret https secure communication. Many security vendors have launched national secret https secure communication plug-ins, which implement the secure communication mechanism in a pure software way at the application layer of the self-service application system; some vendors have also exited the proxy mode and implemented the national secret security mechanism through the proxy layer.

[0004] Therefore, the security mechanism in the field of self-service equipment applications faces the following problems: if a large amount of data is processed using pure hardware, the processing speed will be slow and inefficient; and if software-based https secure communication is used, it does not support the national encryption algorithm and requires secure communication through plug-ins at the application layer or at the proxy layer, which increases the complexity. Summary of the invention

[0005] The present invention provides a software-hardware combined secure communication method and system for self-service equipment, which realizes software-hardware combined secure communication by combining an application with a password keyboard of the self-service equipment, thereby improving the processing efficiency of secure communication and reducing complexity.

[0006] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0007] In a first aspect, a software-hardware combined secure communication method for a self-service device is provided, which is applied to a software-hardware combined secure communication system for a self-service device. The secure communication system comprises a self-service device and an application server, and the self-service device comprises an application client and a password keyboard. The secure communication method comprises:

[0008] When the self-service device establishes a communication connection with the application server, the application client uses the password keyboard and asymmetric encryption algorithm to negotiate the session key with the application server to generate a session key;

[0009] The application client generates a working key based on the application encryption and decryption scenario;

[0010] The application client encrypts the working key using the session key to obtain the encrypted working key and transmits it to the application server;

[0011] The application server decrypts the encrypted working key using the session key to obtain the working key.

[0012] Furthermore, the application server has an application system and a hardware encryption and decryption module.

[0013] The application client uses the password keyboard and asymmetric encryption algorithm to negotiate the session key with the application server. Before generating the session key, it also includes:

[0014] When the self-service device leaves the factory, the manufacturer's public key and the PIN pad public key signature are imported into the PIN pad. The PIN pad public key signature is the signature of the manufacturer's private key on the PIN pad public key.

[0015] When the application of the self-service device goes online, the manufacturer's public key and the application system public key signature are imported into the hardware encryption and decryption module. The application system public key signature is the signature of the manufacturer's private key on the application system public key.

[0016] Furthermore, the application client uses the password keyboard and the asymmetric encryption algorithm to negotiate a session key with the application server to generate a session key, including:

[0017] The application client obtains the manufacturer's public key and the public key signature of the cipherpad in the cipherpad, and sends the public key of the cipherpad and the public key signature of the cipherpad to the application system;

[0018] The application system imports the password keyboard public key and the password keyboard public key signature into the hardware encryption and decryption module;

[0019] After the hardware encryption and decryption module successfully verifies the signature of the password keyboard public key using the manufacturer's public key, it saves the password keyboard public key;

[0020] The application system obtains the manufacturer's public key and the application system public key signature in the hardware encryption and decryption module, and sends the application system public key and the application system public key signature to the application client;

[0021] The application client imports the application system public key and the application system public key signature into the password keyboard;

[0022] After the password keyboard successfully verifies the signature of the application system public key using the manufacturer's public key, the application system public key is saved;

[0023] The cipher keyboard generates a session key of a symmetric encryption algorithm and a random number of an asymmetric encryption algorithm, encrypts the session key using the cipher keyboard private key to obtain an encrypted session key, and encrypts the random number using the session key to obtain an encrypted value;

[0024] The application client obtains the encrypted session key, random number and encrypted value from the password keyboard and sends them to the application system;

[0025] The application system imports the encrypted session key, random number and encrypted value into the hardware encryption and decryption module;

[0026] The hardware encryption and decryption module uses the password keyboard public key to decrypt the encrypted session key to obtain the session key;

[0027] The hardware encryption and decryption module uses the session key to encrypt the random number and obtain the encryption result;

[0028] When the encryption result is equal to the encrypted value, the hardware encryption and decryption module determines that the verification is successful and saves the session key;

[0029] The application system obtains the encryption result from the hardware encryption and decryption module and sends it to the application client.

[0030] Furthermore, application encryption and decryption scenarios include customer password encryption and decryption scenarios, computer message verification scenarios, and message data encryption and decryption scenarios.

[0031] The application client generates a working key based on the application encryption and decryption scenario, including:

[0032] The application client generates a PIN key according to the customer password encryption and decryption scenario, generates a MAC key according to the computer message verification scenario, and generates a message key according to the message data encryption and decryption scenario.

[0033] Furthermore, the application client encrypts the working key using the session key to obtain the encrypted working key and transmits it to the application server, including:

[0034] The application client uses the session key to encrypt the PIN key, MAC key and message key respectively to obtain an encrypted PIN key, an encrypted MAC key and an encrypted message key;

[0035] The application client saves the encrypted MAC key and the encrypted message key;

[0036] The application client sends the encrypted PIN key, encrypted MAC key and encrypted message key to the application server.

[0037] Furthermore, the application server decrypts the encrypted working key using the session key to obtain the working key, including:

[0038] The application system of the application server stores the encrypted MAC key and the encrypted message key;

[0039] The application system imports the encrypted PIN key into the hardware encryption and decryption module;

[0040] The hardware encryption and decryption module uses the session key to decrypt the encrypted PIN key, obtains and saves the PIN key.

[0041] Furthermore, the method also includes:

[0042] The hardware encryption and decryption module decrypts the PIN key and sends the decryption result to the application system.

[0043] Furthermore, the method also includes:

[0044] The working key is used for encryption and decryption between the self-service device and the application server.

[0045] Furthermore, the self-service device and the application server use the working key for encryption and decryption, including:

[0046] When the customer enters the account password on the password keyboard, the password keyboard uses the PIN key to encrypt the account password to obtain the account password ciphertext;

[0047] The application client obtains the ciphertext of the account password from the password keyboard;

[0048] The application client imports the MAC key and message encryption key into the password keyboard;

[0049] The password keyboard uses the session key to decrypt the MAC key and the message encryption key to obtain the MAC key plaintext and the message key plaintext;

[0050] The application client obtains the MAC key plaintext and message key plaintext from the password keyboard;

[0051] The application client uses the MAC key plaintext and the message key plaintext to calculate the message MAC and message encryption value;

[0052] The application client generates a request message based on the message MAC, message encryption value, and account password ciphertext, and sends it to the application server;

[0053] The hardware encryption and decryption module of the application server uses the session key to decrypt the MAC key and the message encryption key to obtain the MAC key plaintext and the message key plaintext;

[0054] The application system obtains the MAC key plaintext and message key plaintext from the hardware encryption and decryption module

[0055] The application system uses the MAC key plaintext and the message key plaintext to decrypt the request message and verify the message MAC;

[0056] When the MAC of the verification message succeeds, the hardware encryption and decryption module uses the PIN key to decrypt the account password ciphertext and obtain the account password;

[0057] After the application system performs the operation using the account and password, it sends a response message to the application client.

[0058] In a second aspect, a software-hardware combined secure communication system for a self-service device is provided, comprising:

[0059] Self-service equipment and application server, the self-service equipment has an application client and a password keyboard;

[0060] A communication connection is established between the self-service device and the application server to execute the software-hardware combined secure communication method for the self-service device of the first aspect above.

[0061] The beneficial effects achieved by the present invention are:

[0062] When the self-service device establishes a communication connection with the application server, the application client uses the password keyboard and asymmetric encryption algorithm to negotiate the session key with the application server to generate a session key. The application client generates a working key according to the application encryption and decryption scenario. The application client encrypts the working key with the session key to obtain an encrypted working key and transmits it to the application server. The application server decrypts the encrypted working key with the session key to obtain the working key. By combining the application with the password keyboard of the self-service device, a combination of software and hardware is achieved. Compared with the existing security mechanism using pure hardware, the processing efficiency of secure communication is improved. Compared with the existing secure communication at the application layer through plug-ins or at the proxy layer, there is no need for plug-in and proxy layer operations, which reduces complexity. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 It is a flow chart of the software-hardware combined secure communication method for self-service equipment of the present invention;

[0064] Figure 2 It is a flow chart of the session key negotiation process of the present invention;

[0065] Figure 3 A flowchart of a working key determination process of the present invention;

[0066] Figure 4 The figure is a flow chart of the encryption and decryption implementation process of the present invention. DETAILED DESCRIPTION

[0067] The present invention will be further described below in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and cannot be used to limit the protection scope of the present invention.

[0068] like Figure 1 As shown, an embodiment of the present invention provides a software and hardware combined secure communication method for a self-service device, including:

[0069] 101, when the self-service device establishes a communication connection with the application server, the application client uses the password keyboard and the asymmetric encryption algorithm to negotiate a session key with the application server to generate a session key;

[0070] Among them, the system used in this embodiment has a self-service device and an application server. The self-service device has an application client and a password keyboard. When the self-service device establishes a communication connection with the application server, in order to realize the normal transmission of data / messages, it is necessary to negotiate the session mechanism. The self-service device is usually equipped with a password keyboard when leaving the factory, such as ATM machines and other devices. The password keyboard itself has data storage and encryption and decryption functions. Therefore, the application client can use the password keyboard and asymmetric encryption algorithm to negotiate the session key with the application server to generate a session key.

[0071] 102, the application client generates a working key according to the application encryption and decryption scenario;

[0072] Among them, application encryption and decryption scenarios are divided into different types, such as password encryption and decryption scenarios, computer message verification scenarios, and message data encryption and decryption scenarios. For different scenarios, the corresponding working keys are different. The application client generates a PIN key according to the customer password encryption and decryption scenario, generates a MAC key according to the computer message verification scenario, and generates a message key according to the message data encryption and decryption scenario.

[0073] 103, the application client encrypts the working key using the session key to obtain the encrypted working key, and transmits the encrypted working key to the application server;

[0074] The application client encrypts the working key using the session key generated in step 101, so that the working key can only be decrypted by the application server, thereby improving the security of the working key.

[0075] 104. The application server decrypts the encrypted working key using the session key to obtain the working key.

[0076] After receiving the encrypted working key, the application server uses the session key to decrypt the encrypted working key. Since the session key is obtained through negotiation in step 101, it is known to both the application client and the application server, and thus can be successfully decrypted to obtain the working key. After obtaining the working key, subsequent message encryption and decryption can be performed to achieve data transmission.

[0077] The implementation principle of the embodiment of the present invention is:

[0078] When the self-service device establishes a communication connection with the application server, the application client uses the password keyboard and asymmetric encryption algorithm to negotiate the session key with the application server to generate a session key. The application client generates a working key according to the application encryption and decryption scenario. The application client encrypts the working key with the session key to obtain an encrypted working key and transmits it to the application server. The application server decrypts the encrypted working key with the session key to obtain the working key. By combining the application with the password keyboard of the self-service device, a combination of software and hardware is achieved. Compared with the existing security mechanism using pure hardware, the processing efficiency of secure communication is improved. Compared with the existing secure communication at the application layer through plug-ins or at the proxy layer, there is no need for plug-in and proxy layer operations, which reduces complexity.

[0079] In the above Figure 1 In the embodiment shown, the application server has an application system and a hardware encryption and decryption module, and before executing step 101, it also includes:

[0080] When the self-service device leaves the factory, the manufacturer's public key and the PIN pad public key signature are imported into the PIN pad. The PIN pad public key signature is the signature of the manufacturer's private key on the PIN pad public key.

[0081] When the application of the self-service device goes online, the manufacturer's public key and the application system public key signature are imported into the hardware encryption and decryption module. The application system public key signature is the signature of the manufacturer's private key on the application system public key.

[0082] Among them, when the self-service device leaves the factory, the manufacturer needs to pre-set the public key and the private key to sign the password keyboard public key, and import the manufacturer's public key and the password keyboard public key signature into the password keyboard. Similarly, when the application of the self-service device is launched, the manufacturer's public key and the application system public key signature also need to be imported into the hardware encryption and decryption module.

[0083] In the above Figure 1 In the embodiment shown, the process of negotiating a session key is as follows: Figure 2 As shown, the specific steps include:

[0084] 201, the application client obtains the manufacturer's public key and the public key signature of the cipherpad in the cipherpad, and sends the public key of the cipherpad and the public key signature of the cipherpad to the application system;

[0085] 202, the application system imports the cipher pad public key and the cipher pad public key signature into the hardware encryption and decryption module;

[0086] 203, after the hardware encryption and decryption module successfully verifies the signature of the password keyboard public key using the manufacturer's public key, the password keyboard public key is saved;

[0087] 204, the application system obtains the manufacturer's public key and the application system public key signature in the hardware encryption and decryption module, and sends the application system public key and the application system public key signature to the application client;

[0088] 205, the application client imports the application system public key and the application system public key signature into the password keyboard;

[0089] 206, after the password keyboard successfully verifies the signature of the application system public key using the manufacturer's public key, the application system public key is saved;

[0090] 207, the cipher keyboard generates a session key of a symmetric encryption algorithm and a random number of an asymmetric encryption algorithm, encrypts the session key using the cipher keyboard private key to obtain an encrypted session key, and encrypts the random number using the session key to obtain an encrypted value;

[0091] 208, the application client obtains the encryption session key, random number and encryption value from the password keyboard, and sends them to the application system;

[0092] 209, the application system imports the encrypted session key, random number and encrypted value into the hardware encryption and decryption module;

[0093] 210, the hardware encryption and decryption module decrypts the encrypted session key using the password keyboard public key to obtain the session key;

[0094] 211, the hardware encryption and decryption module encrypts the random number using the session key to obtain an encryption result;

[0095] 212, when the encryption result is equal to the encrypted value, the hardware encryption and decryption module determines that the verification is successful and saves the session key;

[0096] 213, the application system obtains the encryption result from the hardware encryption and decryption module and sends it to the application client.

[0097] Among them, after receiving the encryption result sent by the application system, the application client compares the encryption result with the encryption value to determine whether the session key on the application server side is correct.

[0098] In the embodiment of the present invention, the password keyboard of the self-service device and the hardware encryption and decryption module of the application server are combined into the process of session key negotiation, so that the application software is associated with the hardware facilities during the session negotiation process.

[0099] In the above Figure 2In the embodiment, after the session key is determined, in order to meet the computing performance of the encryption or verification operation of large amounts of data such as fingerprint information, ID card information, and electronic credentials of the self-service application, the encryption and decryption of these large amounts of data are not performed in the password keyboard with weak computing performance, but in the application client with high computing performance. At the same time, considering the confidentiality of the encryption and decryption keys, the working key is encrypted by the session key stored in the password keyboard and transmitted to the server. The specific working key determination process is as follows Figure 3 As shown:

[0100] 301, the application client uses the session key to encrypt the PIN key, the MAC key and the message key respectively, to obtain an encrypted PIN key, an encrypted MAC key and an encrypted message key;

[0101] 302, the application client saves the encrypted MAC key and the encrypted message key;

[0102] 303, the application client sends the encrypted PIN key, the encrypted MAC key and the encrypted message key to the application server;

[0103] 304, the application system of the application server saves the encrypted MAC key and the encrypted message key;

[0104] 305, the application system imports the encrypted PIN key into the hardware encryption and decryption module;

[0105] 306, the hardware encryption and decryption module decrypts the encrypted PIN key using the session key, obtains and saves the PIN key;

[0106] 307, the hardware encryption and decryption module sends the decryption result of the PIN key to the application system.

[0107] In an embodiment of the present invention, the keys for different application encryption and decryption scenarios are not placed in a cipher keyboard with weaker computing performance, but in an application client with higher computing performance, and the working keys are encrypted by calling the session keys stored in the cipher keyboard, which takes the confidentiality of the encryption and decryption keys into consideration and alleviates the hardware performance limitations of the cipher keyboard itself.

[0108] In the above Figure 3 The embodiments shown are summarized. After the working keys for different application encryption and decryption scenarios are generated, encryption and decryption can be performed according to different application encryption and decryption scenarios. For example, encryption and decryption operations are performed on large amounts of fingerprint information, identity card information, electronic certificates, etc. The specific encryption and decryption implementation process is as follows Figure 4 As shown:

[0109] 401, when the customer enters the account password on the password keyboard, the password keyboard uses the PIN key to encrypt the account password to obtain the account password ciphertext;

[0110] 402, the application client obtains the ciphertext of the account password from the password keyboard;

[0111] 403, the application client imports the MAC key and the message encryption key into the password keyboard;

[0112] 404, the cipher keyboard decrypts the MAC key and the message encryption key using the session key to obtain the MAC key plaintext and the message key plaintext;

[0113] 405, the application client obtains the MAC key plaintext and the message key plaintext from the password keyboard;

[0114] 406, the application client uses the MAC key plaintext and the message key plaintext to calculate the message MAC and the message encryption value;

[0115] 407, the application client generates a request message according to the message MAC, the message encryption value and the account password ciphertext, and sends it to the application server;

[0116] 408, the hardware encryption and decryption module of the application server uses the session key to decrypt the MAC key and the message encryption key to obtain the plaintext MAC key and the plaintext message key;

[0117] 409, the application system obtains the MAC key plaintext and the message key plaintext from the hardware encryption and decryption module;

[0118] 410, the application system uses the MAC key plaintext and the message key plaintext to decrypt the request message and verify the message MAC;

[0119] 411, when the verification message MAC succeeds, the hardware encryption and decryption module uses the PIN key to decrypt the account password ciphertext to obtain the account password;

[0120] 412. After the application system performs the operation using the account and password, it feeds back a response message to the application client.

[0121] Among them, the customer enters the account number and password through the self-service device in order to perform certain operations, for example, to check the account limit. Then, after the application system decrypts the account number and password, the account limit in the customer's account is queried through the account number and password. The account limit data is then generated into a response message, which is encrypted and sent to the application client.

[0122] In the embodiment of the present invention, it is specifically described that after the session negotiation is completed and the working key is determined, encryption and decryption operations on large amounts of fingerprint information, identity card information, electronic credentials, etc. are performed on the application client, relieving the encryption and decryption processing pressure of the password keyboard.

[0123] In the above embodiments, the execution steps of the secure communication method combining software and hardware of the self-service device are described. The following is an explanation of the multi-channel service deployment system of the financial device through an embodiment. The embodiment of the present invention provides a multi-channel service deployment system of the financial device, including:

[0124] Self-service equipment and application server, the self-service equipment has an application client and a password keyboard;

[0125] A communication connection is established between the self-service device and the application server to execute the software-hardware combined secure communication method for the self-service device in the above embodiment.

[0126] Based on the same technical solution, the present invention also discloses a computing device, including one or more processors, one or more memories and one or more programs, wherein the one or more programs are stored in the one or more memories and are configured to be executed by one or more processors, and the one or more programs include instructions for executing the multi-channel business deployment method of the financial device described above.

[0127] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0128] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0129] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0130] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0131] The above are merely embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention are included in the scope of the claims of the present invention to be approved.

Claims

1. A software-hardware combined secure communication method for self-service equipment, characterized in that: A software-hardware combined secure communication system for a self-service device, the secure communication system having a self-service device and an application server, the self-service device having an application client and a password keyboard, and the secure communication method comprising: When the self-service device establishes a communication connection with the application server, the application client uses the password keyboard and the asymmetric encryption algorithm to negotiate a session key with the application server to generate a session key; The application client generates a working key according to the application encryption and decryption scenario; The application client encrypts the working key using the session key to obtain an encrypted working key, and transmits the encrypted working key to the application server; The application server decrypts the encrypted working key by using the session key to obtain the working key; The application server has an application system and a hardware encryption and decryption module. The application client uses the password keyboard and the asymmetric encryption algorithm to negotiate a session key with the application server, and before generating the session key, it also includes: When the self-service device leaves the factory, the manufacturer's public key and the PIN pad public key signature are imported into the PIN pad, and the PIN pad public key signature is the signature of the manufacturer's private key on the PIN pad public key; When the application of the self-service device is online, the manufacturer's public key and the application system public key signature are imported into the hardware encryption and decryption module, and the application system public key signature is the signature of the manufacturer's private key on the application system public key; The application client uses the password keyboard and the asymmetric encryption algorithm to negotiate a session key with the application server to generate a session key, including: The application client obtains the manufacturer's public key and the public key signature of the cipher keyboard in the cipher keyboard, and sends the public key of the cipher keyboard and the public key signature of the cipher keyboard to the application system; The application system imports the cipher keyboard public key and the cipher keyboard public key signature into the hardware encryption and decryption module; After the hardware encryption and decryption module successfully verifies the signature of the password keyboard public key using the manufacturer's public key, the hardware encryption and decryption module saves the password keyboard public key; The application system obtains the manufacturer's public key and the application system public key signature in the hardware encryption and decryption module, and sends the application system public key and the application system public key signature to the application client; The application client imports the application system public key and the application system public key signature into the password keyboard; After the password keyboard successfully verifies the signature of the application system public key using the manufacturer public key, the application system public key is saved; The cipher keyboard generates a session key of a symmetric encryption algorithm and a random number of an asymmetric encryption algorithm, encrypts the session key using a cipher keyboard private key to obtain an encrypted session key, and encrypts the random number using the session key to obtain an encrypted value; The application client obtains the encrypted session key, the random number and the encrypted value from the PIN pad, and sends them to the application system; The application system imports the encrypted session key, the random number and the encrypted value into the hardware encryption and decryption module; The hardware encryption and decryption module uses the password keyboard public key to decrypt the encrypted session key to obtain the session key; The hardware encryption and decryption module encrypts the random number using the session key to obtain an encryption result; When the encryption result is equal to the encryption value, the hardware encryption / decryption module determines that the verification is successful and saves the session key; The application system obtains the encryption result from the hardware encryption and decryption module and sends it to the application client; The application encryption and decryption scenarios include customer password encryption and decryption scenarios, computer message verification scenarios, and message data encryption and decryption scenarios. The application client generates a working key according to the application encryption and decryption scenario, including: The application client generates a PIN key according to the customer password encryption and decryption scenario, generates a MAC key according to the computer message verification scenario, and generates a message key according to the message data encryption and decryption scenario.

2. The software-hardware combined secure communication method for self-service equipment according to claim 1, characterized in that: The application client encrypts the working key using the session key to obtain the encrypted working key, and transmits the encrypted working key to the application server, including: The application client uses the session key to encrypt the PIN key, the MAC key and the message key respectively to obtain an encrypted PIN key, an encrypted MAC key and an encrypted message key; The application client stores the encrypted MAC key and the encrypted message key; The application client sends the encrypted PIN key, the encrypted MAC key and the encrypted message key to the application server.

3. The software-hardware combined secure communication method for self-service equipment according to claim 2, characterized in that: The application server decrypts the encrypted working key by using the session key to obtain the working key, including: The application system of the application server stores the encrypted MAC key and the encrypted message key; The application system imports the encrypted PIN key into the hardware encryption and decryption module; The hardware encryption and decryption module uses the session key to decrypt the encrypted PIN key to obtain and save the PIN key.

4. The software-hardware combined secure communication method for self-service equipment according to claim 3, characterized in that: The method further comprises: The hardware encryption and decryption module decrypts the PIN key and sends the decryption result to the application system.

5. The software-hardware combined secure communication method for self-service equipment according to claim 4, characterized in that: The method further comprises: The self-service device and the application server perform encryption and decryption processing using the working key.

6. The software-hardware combined secure communication method for self-service equipment according to claim 5, characterized in that: The self-service device and the application server use the working key to perform encryption and decryption processing, including: When the customer enters the account password on the password keyboard, the password keyboard encrypts the account password using the PIN key to obtain the account password ciphertext; The application client obtains the account password ciphertext from the password keyboard; The application client imports the MAC key and the message encryption key into the PIN pad; The cipher keyboard uses the session key to decrypt the MAC key and the message encryption key to obtain the MAC key plaintext and the message key plaintext; The application client obtains the MAC key plaintext and the message key plaintext from the password keyboard; The application client calculates the message MAC and the message encryption value using the MAC key plaintext and the message key plaintext; The application client generates a request message according to the message MAC, the message encryption value and the account password ciphertext, and sends it to the application server; The hardware encryption and decryption module of the application server uses the session key to decrypt the MAC key and the message encryption key to obtain the MAC key plaintext and the message key plaintext; The application system obtains the MAC key plaintext and the message key plaintext from the hardware encryption and decryption module The application system uses the MAC key plaintext and the message key plaintext to decrypt the request message and verify the message MAC; When the verification message MAC succeeds, the hardware encryption and decryption module uses the PIN key to decrypt the account password ciphertext to obtain the account password; After the application system performs an operation using the account password, a response message is fed back to the application client.

7. A software-hardware combined secure communication system for self-service equipment, characterized in that: include: Self-service equipment and application server, the self-service equipment has an application client and a password keyboard; A communication connection is established between the self-service device and the application server for executing the software-hardware combined secure communication method for a self-service device according to any one of claims 1 to 6.

Images