Touch IC operating mode loading method, PIN input method and input system

Abstract

This invention discloses a method for loading the working mode of a touch IC, a PIN input method, and an input system. This solution effectively avoids the security risks associated with data transmission between the touch IC and the secure CPU, especially the risk of plaintext key coordinate data related to the PIN being detected and stolen, thus effectively protecting PIN information and improving the security of financial POS systems. Simultaneously, this solution encrypts the touch coordinate data detected by the touch IC through software-level encryption, simplifying physical protection related to PIN input. Based on data encryption and decryption logic protection, this solution simplifies the physical design of POS products (i.e., by strengthening software-level protection, it reduces reliance on physical layers), lowering the overall cost of product security protection. Furthermore, software-level data encryption significantly enhances the POS's anti-interference capabilities, improving product reliability.

Description

Technical Field

[0001] This invention relates to POS device technology and the fields of financial data acquisition and interaction technology, and in particular to a method for loading the working mode of a touch IC, a PIN input method, and an input system. Background Technology

[0002] With the increasing popularity and application of touch technology, many financial POS devices now widely use touch screens to collect information such as PIN (user password) and electronic signature related to payment transactions. Among them, PIN is a very critical security information for users and needs to be protected. However, electronic signatures are usually not required to be protected because they are relatively low in importance.

[0003] The current standard design for PIN information security protection strategies involves the LCD screen displaying a simulated numeric keypad when a PIN is required. The touchscreen monitors the user's touch state and position, generating coordinate data that is then transmitted to a secure CPU. The secure CPU then parses the corresponding numeric keypad coordinates to obtain the PIN. However, according to the security requirements of financial POS applications, financial POS systems must possess certain hardware and software protection mechanisms, intrusion detection and response mechanisms, and be able to resist various physical attacks, including but not limited to drilling, laser attacks, chemical corrosion, and opening of covers. Attackers typically use methods such as blocking or bypassing security mechanisms to obtain PIN information.

[0004] In terms of hardware and software protection of PIN information, the conventional design methods are mainly as follows:

[0005] 1) Dual Protection Approach: The numeric keypad displayed on the LCD screen uses a randomized, scrambled arrangement, while a secure CPU provides intrusion detection and response mechanisms to physically protect the LCD and touchscreen signals. The advantage of this protection scheme is that it distributes the risk of security attacks across both the LCD and touchscreen signals; obtaining the PIN requires simultaneously attacking and successfully acquiring both signals. The disadvantages of this approach are: the randomized numeric keypad is inconvenient to operate and prone to input errors; the touchscreen transmits plaintext coordinate data to the secure CPU, making both LCD and touchscreen signals susceptible to attack and detection; and the physical security protection design is complex and easily affected by electrical interference, leading to false alarms and impacting product reliability.

[0006] 2) Protection only for the touchscreen and its signals: This solution uses a sequentially arranged numeric keypad on the LCD screen and employs an intrusion detection and response mechanism provided by the secure CPU to physically enhance the security of the touchscreen signals. The advantage of this protection scheme is that it facilitates PIN input. However, this method has drawbacks. The data transmitted between the touchscreen and the secure CPU is plaintext coordinate data, meaning the risk of security attacks is concentrated on the touchscreen's related signals. If any point on the transmission line, connectors, or other signal channels between the touchscreen and the secure CPU is attacked, PIN leakage will occur. Furthermore, this physical security protection design is more complex and costly, and is susceptible to electrical interference that can cause false alarms, affecting product reliability.

[0007] Some publicly available technical documents describe touchscreens, encrypted touch keyboards, and touchscreen information input methods. These methods involve introducing an encryption module and a shielding shell. The encryption module encrypts the position coordinate information obtained from the touchscreen controller before transmitting the encrypted user touch information to an external host. The shielding shell provides intrusion detection signals to protect the touch chip and encryption module from physical attacks such as drilling. However, this approach has several drawbacks: 1) It relies on a shielding shell for physical protection, which is costly and has low reliability; 2) It depends on a power source, allowing the shielding shell to be opened in the event of a power outage, short-circuiting the detection signal to bypass the protection mechanism and access the connection between the touch chip and encryption module, thus stealing plaintext coordinate information; 3) It requires an additional encryption module, increasing system cost and complexity. Furthermore, the security protection of this encryption module is not mentioned; if an illegal program is loaded into the encryption module, security cannot be guaranteed. Other documents propose secure password input systems and methods based on secure touchscreen control chips. These systems use a secure touchscreen control chip to encrypt the password input interface image before sending it to the display screen and to encrypt and save the touch information generated by the touchscreen. The password is automatically decrypted and sent when the system processor issues a password read command. The shortcomings of this solution include: 1) Plaintext transmission between the secure touchscreen control chip and the system processor necessitates additional protection for the connection lines; 2) The download and update of user programs for the secure touchscreen control chip lack legitimacy verification, allowing for the loading of unauthorized programs to steal passwords; 3) This solution avoids malicious program screenshot analysis by scrambling the password input interface image, which is unnecessary in practical financial POS systems. Financial POS security requirements stipulate that touchscreen password input should not display the keystrokes in reverse order to indicate valid keystrokes, nor should it display the entered keycode; only an asterisk (*) is allowed. These requirements prevent eavesdropping by external cameras or malicious program screenshots. Therefore, the secure touchscreen control chip does not need to be associated with the display screen, reducing system complexity.

[0008] In summary, improving the data transmission security between the touch IC and the security CPU in financial POS systems, while reducing the reliance of financial POS systems on physical hardware security protection, is a topic of positive practical significance. Summary of the Invention

[0009] In view of this, the purpose of this invention is to provide a reliable, flexible, low-cost, and highly secure method for loading the working mode of a touch IC, a PIN input method, and an input system.

[0010] To achieve the above-mentioned technical objectives, the technical solution adopted by this invention is as follows:

[0011] A method for loading a working mode of a touch IC, wherein the touch IC has a built-in memory and a serial interface, the method comprising:

[0012] When the touch IC is powered on or reset, it loads either a normal working mode or a safe working mode according to a preset method. When the touch IC is in the normal working mode, it can irreversibly switch to the safe working mode according to a preset method. When the touch IC is in the safe working mode, it will only continue to load the safe working mode after being restarted and powered on or reset.

[0013] When the touch IC is in normal working mode, the touch IC can update or download touch applications through the serial interface and / or debugging interface;

[0014] When the touch IC is in secure operating mode, the insecure download interface of the touch IC is closed, and the touch IC can only update or download touch applications through a preset secure boot program.

[0015] Regarding the loading of the touch IC working mode, as one possible implementation method, the memory described in this solution further includes: ROM memory, eFuse memory, or OTP memory;

[0016] The normal operating mode is loaded by the normal boot program built into the ROM;

[0017] In normal operating mode, the touch IC runs the touch application through a normal boot program or updates or downloads the touch application using a serial interface or debugging interface;

[0018] In normal operating mode, the touch IC loads a preset secure boot program and public key through a normal boot program. It then uses instructions to configure the eFuse memory or OTP memory, disabling the debug interface and all download interfaces defined as insecure. Simultaneously, it adjusts the CPU program startup address for power-on and reset of the touch IC to point to the entry point of the secure boot program, thus enabling the touch IC to enter secure operating mode. Furthermore, when the touch IC is restarted or reset, it continues to load the secure operating mode.

[0019] Regarding the loading of the touch IC operating mode, as another possible implementation, the memory described in this solution further includes: FLASH program memory, eFuse memory, or OTP memory;

[0020] The normal operating mode is loaded by a pre-installed normal startup program in the FLASH program memory;

[0021] In normal operating mode, the touch IC runs the touch application through a normal boot program or updates or downloads the touch application using a serial interface;

[0022] In normal operating mode, the touch IC loads a preset proxy program through a normal boot program, and then loads a secure boot program and public key through the proxy program, overwriting the normal boot program. It then uses instructions to configure the eFuse memory or OTP memory, shutting down the debug interface and all download interfaces defined as insecure, thus putting the touch IC into a secure operating mode. When the touch IC is restarted or reset, it will continue to load only the secure operating mode.

[0023] As a preferred implementation method, the touch IC in this solution verifies the integrity and legitimacy of running or updated touch applications through a digest algorithm, a signature algorithm, and a public key in a secure operating mode. Furthermore, when the touch IC is powered on and boots into the secure operating mode, it also performs a self-test to ensure that illegal programs cannot be downloaded or updated to the touch IC.

[0024] As a preferred implementation method, the digest algorithm of this scheme preferably includes SHA2, SHA3 or SM3; the signature algorithm includes SM2, ECC, ECSA, RSA or DSA.

[0025] Based on the above, the present invention also provides a PIN input method for a financial POS, which includes the touch IC working mode loading method described above. The financial POS further includes a secure CPU and a touch screen, and the secure CPU also has a built-in random number generator. The PIN input method includes:

[0026] In a secure environment, namely a secure and controlled financial POS production or maintenance site, the secure CPU performs secure initialization or secure reset. During this process:

[0027] 1) Secure the touch IC (i.e., switch the touch IC from normal working mode to secure working mode) and load the touch application;

[0028] 2) Loading the Encryption Key: A random number, referred to as Key_xy, is generated by the random number generator built into the secure CPU and used as the encryption and decryption key for the touch coordinate data. This key is written to the touch IC through the communication interface between the secure CPU and the touch IC. Within the touch IC, this key is stored in secure memory and cannot be read out; it is retained even after power failure. Within the secure CPU, this key is encrypted with the root key and stored in encrypted form in the secure CPU's non-volatile memory. It is only decrypted using the root key when needed and is cleared after use.

[0029] In the above method, the encryption and decryption keys for the touch coordinate data can only be generated and written to the touch IC in a secure environment. Because these keys are transmitted in plaintext, writing them to the touch IC in other insecure environments could potentially be detected and stolen. This method also prevents attackers from stealing the encryption and decryption keys by replacing the touch IC or touch module.

[0030] When a PIN is required during a financial payment transaction:

[0031] S01. The secure CPU generates a set of random numbers through a random number generator, denoted as Rdata_add0, and then stores them in the memory of the secure CPU.

[0032] S02. The security CPU generates a state switching control instruction, which makes the coordinate data subsequently transmitted by the touch IC in encrypted form. At the same time, it also passes a random number Rdata_add0 to the touch IC.

[0033] S03. In safe working mode, the touch IC performs touch detection on the touch screen to obtain the user's touch state and position, and obtain touch coordinate data;

[0034] S04. The touch IC combines and encrypts the touch coordinate data and the random number Rdata_add0 using the encryption key Key_xy and the symmetric key encryption algorithm to form ciphertext, and then transmits it to the secure CPU.

[0035] S05. The secure CPU receives the ciphertext and then uses the decryption key Key_xy corresponding to the touch IC and the corresponding symmetric key decryption algorithm to perform decryption operation on the obtained ciphertext, and obtains a set of touch coordinate data and a set of random numbers Rdata_add1.

[0036] S06. The security CPU compares the random number Rdata_add1 obtained in S05 with the random number Rdata_add0 generated in S01. If they are the same, the touch IC is defined as a trusted object, and then proceeds to S07. If they are different, the touch IC is defined as an untrusted object, and the financial POS transaction ends.

[0037] S07. The security CPU parses the touch coordinate data obtained in S05 to obtain the corresponding input information, and then performs content judgment on the data information. When the input information points to the cancel instruction, it enters S08. When the input information points to the numeric keypad, it judges the PIN length. When the length meets the preset requirements, it enters S08. When the length does not meet the preset requirements, it jumps back to S03.

[0038] S08. The security CPU determines whether to cancel the input or obtain the PIN based on the digital information content judged in S07.

[0039] As a preferred implementation method, in S04 of this solution, the touch IC encrypts and transmits the acquired touch coordinate data to the secure CPU in real time.

[0040] Based on this, as a preferred implementation method, preferably, in S07 of this solution, when determining the PIN length of the input information,

[0041] When the PIN length corresponding to the input information is less than the preset length, the process jumps back to S03. The security CPU retains the PIN corresponding to the input information and merges it with the PIN obtained by parsing the ciphertext subsequently transmitted by the touch IC to determine the PIN length until the length meets the requirements or the process times out.

[0042] As a preferred implementation method, in S08 of this solution, when the PIN input is exited, the security CPU also generates a state switching control instruction so that the touch coordinate data subsequently transmitted by the touch IC is in plaintext form.

[0043] As a preferred implementation method, the symmetric key encryption algorithm used by the touch IC in this solution to combine and encrypt the touch coordinate data and the random number Rdata_add0 is AES, DES, 3DES or SM4.

[0044] In this invention, a touch IC is used to detect touch and generate touch coordinate data. It includes a serial communication interface connected to a secure CPU, including but not limited to IIC, SPI, and UART. The touch IC also integrates a CPU core, storage, and encryption / decryption modules. Specifically, the touch IC supports symmetric key encryption / decryption algorithms, including but not limited to AES, DES, 3DES, and SM4. It supports encrypting coordinate data using one of these algorithms to form ciphertext, which is then used to transmit the coordinate data. Furthermore, the touch IC supports key storage; the encryption / decryption key for the touch coordinate data can be written to and stored in the touch IC via control commands. This key cannot be read and is retained even after power loss. In this case, the touch IC supports secure boot and secure updates, and also supports digest algorithms and signature algorithms. Digest algorithms include but are not limited to SHA2, SHA3, and SM3, while signature algorithms include but are not limited to SM2, ECC, ECSA, RSA, and DSA. The touch IC uses one of the aforementioned digest and signature algorithms to verify the integrity and legitimacy of running and updated touch applications.

[0045] In this solution, the secure CPU is the core of the financial POS system, handling sensitive information related to secure payments, such as PINs, payment transaction keys, and account data. The secure CPU has a built-in encryption / decryption module supporting at least one symmetric key encryption / decryption algorithm, such as AES, DES, 3DES, or SM4, which is compatible with the encryption algorithms supported by the touch IC. The secure CPU also has a built-in random number generator. During secure initialization or reset, this generator produces the root key and encryption / decryption keys for the touch coordinate data. The root key is stored in the secure CPU's secure memory and self-destructs upon intrusion response. Other payment transaction keys and encryption / decryption keys are encrypted with the root key and stored in ciphertext in the secure CPU's non-volatile memory. The plaintext keys used for touch coordinate data encryption / decryption are only decrypted with the root key during use and are cleared afterward.

[0046] Based on the above, the present invention also provides a financial POS information input system, which is loaded with the aforementioned financial POS PIN input method, the system comprising:

[0047] The touch IC receives operating commands and loads a secure operating mode upon power-on or reset. In this secure operating mode, the touch IC is defined or marked as having a non-secure download interface and / or a disabled debugging interface. The touch IC can only update or download touch applications via a preset secure boot program. The touch IC also has a built-in memory, including ROM memory, FLASH program memory, eFuse memory, or OTP memory, which stores the secure boot program and touch applications required for the touch IC to load its operating mode.

[0048] The touch screen is connected to the touch IC and is used to collect touch information. The collected touch information is transmitted to the touch IC for detection.

[0049] The secure CPU controls the data transmission format of the touch IC, enabling it to transmit the detected touch coordinate data in plaintext or ciphertext, and to parse and judge the information containing the touch coordinate data transmitted by the touch IC to obtain the required PIN.

[0050] Compared with existing technologies, the present invention, employing the above technical solution, has the following advantages: This solution effectively avoids the security risks associated with data transmission between the touch IC and the secure CPU, especially the risk of plaintext key coordinate data related to the PIN being detected and stolen, thus effectively protecting PIN information and improving the security of financial POS systems. Simultaneously, this solution encrypts the touch coordinate data detected by the touch IC through software-level encryption, simplifying physical protection related to PIN input. Based on data encryption and decryption logic protection, this solution simplifies the physical design of POS products (i.e., by strengthening software-level protection, it reduces reliance on physical layers), lowering the overall cost of product security protection. Furthermore, software-level data encryption significantly enhances the POS's anti-interference capabilities, improving product reliability. In addition, this solution uses a touch IC that supports secure boot and secure program updates, and employs encryption and decryption keys for trusted touch IC verification during PIN input, preventing attackers from obtaining PIN information by replacing the touch module or altering the touch IC's control program, thereby improving the security of financial POS systems. Therefore, this invention can systematically avoid the risk of attacks on the signal channels such as transmission lines and connectors between the touch screen and the secure CPU, perfectly solve the security problem of PIN input based on touch screen in financial POS, effectively improve product security, reduce overall product cost, and enhance product reliability. Attached Figure Description

[0051] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0052] Figure 1 This is a schematic diagram of some permissions or functions of the touch IC in normal working mode, safe working mode, and when downloading or updating touch applications in safe working mode in this solution.

[0053] Figure 2 This is a simplified diagram illustrating the connection between the touch IC, the touchscreen, and the security CPU in this solution.

[0054] Figure 3 This is a simplified flowchart of the PIN input method in this solution;

[0055] Figure 4 This is a simplified diagram illustrating how the secure CPU transmits the key to the touch IC in the PIN input method of this solution.

[0056] Figure 5 This is a simplified diagram illustrating how the secure CPU transmits switching instructions to the touch IC in the PIN input method of this solution.

[0057] Figure 6 This is a simplified diagram illustrating how the touch IC encrypts the touch coordinate data with a random number into ciphertext and then transmits it to the secure CPU in the PIN input method of this solution.

[0058] Figure 7 This is a simplified schematic diagram of the input system of this scheme. Detailed Implementation

[0059] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be particularly noted that the following embodiments are for illustrative purposes only and do not limit the scope of the invention. Similarly, the following embodiments are only some, not all, embodiments of the present invention, and all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0060] refer to Figure 1 As shown in this embodiment, a method for loading the working mode of a touch IC is provided. The touch IC has a built-in memory and a serial interface. The method for loading the working mode includes:

[0061] When the touch IC is powered on or reset, it loads either a normal working mode or a safe working mode according to a preset method. When the touch IC is in the normal working mode, it can irreversibly switch to the safe working mode according to a preset method. When the touch IC is in the safe working mode, it will only continue to load the safe working mode after being restarted or reset.

[0062] When the touch IC is in normal working mode, the touch IC can update or download touch applications through the serial interface and / or debugging interface;

[0063] When the touch IC is in secure operating mode, the insecure download interface and / or debugging interface of the touch IC are closed, and the touch IC can only update or download touch applications through a preset secure boot program.

[0064] Regarding the loading of the touch IC's operating mode, this embodiment includes the following two switching schemes for the touch IC to switch from normal operating mode to safe operating mode:

[0065] As one possible implementation method for switching a touch IC from a normal working mode to a secure working mode, the memory described in this solution includes: ROM memory, eFuse memory, or OTP memory.

[0066] The normal operating mode is loaded by a normal boot program built into the ROM. In normal operating mode, the touch IC runs the touch application through the normal boot program or updates or downloads the touch application using the serial interface or by calling the debug interface. That is, the normal boot program can download the user's touch application through the serial interface or debug interface; if the touch application already exists and does not need to be downloaded, it will run the touch application.

[0067] Furthermore, in normal operating mode, the touch IC loads a preset secure boot program and public key through a normal boot program. It then configures the eFuse memory or OTP memory using instructions, disabling the debug interface and all download interfaces defined as insecure. Simultaneously, it adjusts the CPU program startup address for power-on and reset of the touch IC to point to the entry point of the secure boot program, thus putting the touch IC into secure operating mode. When the financial POS is restarted or reset, the touch IC continues to load only the secure operating mode. That is, because the configuration of the eFuse memory or OTP memory is irreversible, once switched to secure mode, the touch IC cannot revert to normal mode.

[0068] In secure operating mode, upon each power-on or reset, the touch IC first runs a secure boot procedure, skipping the normal boot procedure mentioned above. The debug interface and all non-secure download interfaces are unavailable. The touch IC can only download or update touch applications through this secure boot procedure.

[0069] As another possible implementation of the touch IC switching from normal working mode to safe working mode, the memory described in this solution further includes: FLASH program memory, eFuse memory, or OTP memory.

[0070] As an example, in this solution, during the production testing of the touch IC, a normal startup program can be loaded into the FLASH program memory of the touch IC through the production testing interface. After the production testing is completed, the production testing interface and other debugging interfaces can be closed by configuring the eFuse memory or OTP memory.

[0071] The normal operating mode is loaded by a pre-installed normal startup program in the FLASH program memory; that is, the touch IC first runs the above-mentioned normal startup program each time it is powered on or reset. This normal startup program can download the user's touch application through a serial interface; if downloading is not required, the touch application is run. In other words, in normal operating mode, the touch IC runs the touch application through the normal startup program or updates or downloads the touch application using the serial interface.

[0072] In addition, in normal operating mode, the touch IC loads a preset proxy program through the normal boot program (loads a download proxy program through the download interface provided by the normal boot program), and then loads the secure boot program and public key through the proxy program, overwriting the normal boot program. It uses instructions to configure the eFuse memory or OTP memory, and closes the debug interface and all serial interfaces and download interfaces defined as insecure, so that the touch IC enters the secure operating mode. When the touch IC is restarted or reset, the touch IC will only continue to load the secure operating mode.

[0073] After the touch IC switches to secure operating mode, it first runs a secure boot program (the above-mentioned normal boot program has been overridden and no longer exists) every time it is powered on or reset. The debug interface and all non-secure download interfaces are unavailable. At this time, the touch IC can only download or update the touch application through this secure boot program.

[0074] In this solution, the touch IC, in its secure operating mode, verifies the integrity and legitimacy of running or updated touch applications using a digest algorithm, a signature algorithm, and a public key. Furthermore, when the touch IC powers on and boots into secure operating mode, it performs a self-test to ensure that unauthorized programs cannot be downloaded or updated to the touch IC. This method prevents unauthorized programs from being downloaded and updated to the touch IC, thus ensuring the security of financial transactions in secure operating mode.

[0075] In terms of algorithm selection, as a preferred implementation method, the digest algorithm of this scheme preferably includes SHA2, SHA3 or SM3; the signature algorithm includes SM2, ECC, ECSA, RSA or DSA.

[0076] This implementation scheme, through the aforementioned working mode switching method, makes the touch IC more secure and reliable when interacting with the secure CPU. Simultaneously, the touch IC achieves secure boot and secure updates, allowing legitimate programs with signatures to be updated via the communication interface between the secure CPU and the touch IC, or remotely updated via the remote communication interface of the financial POS. Attackers cannot steal security information by downloading illegal programs to load Trojans or other malicious attacks.

[0077] Conventional financial POS systems use general-purpose touch ICs, which are the same as those used in smartphones and tablets. They monitor the user's touch state and position, generate coordinate data, and transmit it to the secure CPU in plaintext.

[0078] This solution, to achieve encrypted transmission and meet the security requirements of PIN input in financial POS systems, incorporates a CPU or DSP core, storage, and encryption / decryption modules in its touch IC. Its encryption key storage and encryption operations are implemented through a pre-defined touch application. This eliminates the need for dedicated circuitry, shortening the touch IC's development cycle and reducing costs, while also increasing application flexibility, thereby lowering both the touch IC's cost and the cost of the financial POS system. At the time of manufacture, this touch IC is a general-purpose IC with a CPU or DSP core, storage, and encryption / decryption modules, providing an interface for downloading and updating touch applications. In practical applications, different application manufacturers can design and load their own touch applications according to their needs; in this case, the touch IC's operating mode can be referred to as the normal operating mode. To meet the security requirements of PIN input in financial POS systems, a mechanism is needed to prevent the loading of illegal or malicious programs. This requires the touch IC to also support a secure operating mode. This solution uses a security process to switch to the secure operating mode, allowing touch IC users to choose between maintaining the normal operating mode or switching to the secure operating mode based on their specific application scenarios.

[0079] The security process described in this solution involves loading a secure boot program and public key through the touch IC's download interface while it is in normal mode, disabling the debug interface and all insecure download interfaces, and switching to secure mode. During touch IC design, various methods can be chosen, such as providing configuration eFuse memory, OTP memory, or Flash memory, or overwriting the normal boot program with a secure boot program.

[0080] Based on the above, this implementation scheme also provides a PIN input method for a financial POS, which includes the touch IC working mode loading method described above, refer to... Figure 2 As shown, the financial POS also includes a secure CPU and a touchscreen. The secure CPU has a built-in random number generator. After power-on, the touchscreen IC loads a secure operating mode. (Refer to...) Figure 3 As shown, the PIN input method includes:

[0081] S01. The secure CPU generates a set of random numbers using a random number generator, denoted as Rdata_add0, and then stores it in the secure CPU's memory (see reference). Figure 4 (as shown); where the random number serves as scrambling data for the ciphertext of the touch coordinate data, and also as authentication data for the subsequent touch IC;

[0082] S02. The secure CPU generates a state switching control instruction, causing the coordinate data subsequently transmitted by the touch IC to be in encrypted form. Simultaneously, it passes a random number Rdata_add0 to the touch IC (see reference). Figure 5 (as shown);

[0083] S03. In safe working mode, the touch IC performs touch detection on the touch screen to obtain user input data and touch coordinate data;

[0084] S04. The touch IC combines and encrypts the touch coordinate data and the random number Rdata_add0 using the encryption key Key_xy and a symmetric key encryption algorithm to form ciphertext, which is then transmitted to the secure CPU (see reference). Figure 6 (as shown);

[0085] S05. The secure CPU receives the ciphertext and then uses the decryption key Key_xy corresponding to the touch IC and the corresponding symmetric key decryption algorithm to perform decryption operations on the ciphertext, obtaining a set of touch coordinate data and a set of random numbers Rdata_add1.

[0086] S06. The security CPU compares the random number Rdata_add1 obtained in S05 with the random number Rdata_add0 generated in S01. If they are the same, the touch IC is defined as a trusted object, and then proceeds to S07. If they are different, the touch IC is defined as an untrusted object, and the financial POS transaction ends. When the touch IC is defined as an untrusted object, it indicates that there is a security risk, its encryption key is incorrect, and the touch IC may have been replaced, thus posing a risk to the device in financial transactions. In practice, when the touch IC is defined as an untrusted object, the financial POS is stopped from making payment transactions, and the merchant must return the financial POS for repair, security testing, and security reset.

[0087] S07. The security CPU parses the touch coordinate data obtained in S05 to obtain the corresponding input information, and then performs content judgment on the data information. When the input information points to the cancel instruction, it enters S08. When the input information points to the numeric keypad, it judges the PIN length. When the length meets the preset requirements, it enters S08. When the length does not meet the preset requirements, it jumps back to S03.

[0088] S08. The security CPU determines whether to cancel the input or obtain the PIN based on the digital information content judged in S07.

[0089] As a preferred implementation method, in S04 of this solution, the touch IC encrypts and transmits the acquired touch coordinate data to the secure CPU in real time.

[0090] In this scheme S04, the symmetric key encryption algorithm used by the touch IC to combine and encrypt the touch coordinate data and the random number Rdata_add0 is AES, DES, 3DES or SM4.

[0091] In this scheme, when combining coordinate data and random numbers in S04, a symmetric-key encryption algorithm is used for encryption. A key characteristic of this algorithm is that, given a key, if the plaintext data is the same, the resulting ciphertext will also be the same. When the number of plaintext samples is small, the number of ciphertext samples obtained is also small. The capacitive touchscreens used in financial POS systems are divided into a limited number of blocks in the horizontal and vertical directions. Therefore, the number of coordinate data samples generated by touch during PIN input is limited, generally ranging from hundreds to thousands. Attackers can collect ciphertext data and construct a lookup table to perform a lookup attack. However, in this invention, scrambling data Rdata_add0 is added during the coordinate data encryption process of the touch IC. Each time a PIN is input, Rdata_add0 is regenerated by a secure CPU random number generator. If Rdata_add0 is 6 bytes, the number of plaintext samples increases by a factor of 2 to the power of 48, and the size of the corresponding ciphertext increases by a factor of 2 to the power of 48. This increase in the size of the ciphertext makes a lookup table attack impossible.

[0092] Based on this, as a preferred implementation method, preferably, in S07 of this solution, when determining the PIN length of the input information,

[0093] When the PIN length corresponding to the input information is less than the preset length, the process jumps back to S03. The security CPU retains the PIN corresponding to the input information and merges it with the PIN obtained by parsing the ciphertext subsequently transmitted by the touch IC to determine the PIN length until the length meets the requirements or the process times out.

[0094] As a preferred implementation method, in S08 of this solution, when the PIN input is exited, the security CPU also generates a state switching control instruction to make the touch coordinate data subsequently transmitted by the touch IC in plaintext form; that is, in the above PIN input method, when the user does not need to input a PIN, the security CPU and the touch IC transmit the touch coordinate data in plaintext, which does not affect the response speed and performance of touch screen input such as electronic signatures.

[0095] This solution adds randomly generated random numbers as scrambling data to the touch coordinate encryption / decryption process in the aforementioned PIN input method for financial POS systems, thereby increasing the amount of ciphertext. Because the actual number of touch points on a touchscreen is small, attackers can perform lookup attacks by collecting ciphertext data and constructing a list of touch points and ciphertext mappings. However, this solution, with the addition of scrambling data, significantly increases the amount of ciphertext, making lookup attacks impossible. Simultaneously, the secure CPU's inspection of the decrypted scrambling data also enables the secure CPU to verify the trustworthiness of the touch IC.

[0096] As an example, in this embodiment, the touch IC is used to realize touch detection and generate touch coordinate data. It includes a serial communication interface connected to a secure CPU. The serial communication interface includes, but is not limited to, IIC, SPI, and UART. At the same time, the touch IC also has a built-in CPU core, storage, and encryption / decryption module. Specifically, the touch IC can perform the following functions: It supports symmetric key encryption and decryption algorithms, including but not limited to AES, DES, 3DES, and SM4. It supports encrypting coordinate data using one of these algorithms to form ciphertext, which is then used to transmit the coordinate data. Additionally, the touch IC supports key storage; the encryption and decryption keys for touch coordinate data can be written to and stored in the touch IC via control commands. These keys are not allowed to be read and are retained even after power loss. In this case, the touch IC supports secure boot and secure updates, and also supports hash algorithms and signature algorithms. Hash algorithms include but are not limited to SHA2, SHA3, and SM3, while signature algorithms include but are not limited to SM2, ECC, ECSA, RSA, and DSA. The touch IC uses one of the aforementioned hash algorithms and signature algorithms to verify the integrity and legitimacy of running and updated touch applications.

[0097] As an example, in this solution, the secure CPU is the security core of the financial POS, used to process sensitive information related to secure payments, such as PINs, payment transaction keys, and account data. The secure CPU has a built-in encryption / decryption module that supports at least one symmetric key encryption / decryption algorithm, such as AES, DES, 3DES, or SM4, which is compatible with the encryption algorithms supported by the touch IC. The secure CPU also has a built-in random number generator. During secure initialization or reset, this generator produces the root key and encryption / decryption keys for the touch coordinate data. The root key is stored in the secure CPU's secure memory and self-destructs upon intrusion response. Other payment transaction keys and encryption / decryption keys are encrypted with the root key and stored in ciphertext in the secure CPU's non-volatile memory. The plaintext keys used for encrypting and decrypting the touch coordinate data are only decrypted with the root key during use and are cleared afterward.

[0098] Combination Figure 7As shown, based on the above, this embodiment also provides a financial POS information input system, which is loaded with the aforementioned financial POS PIN input method. The system includes:

[0099] The touch IC receives operating commands and loads a secure operating mode upon power-on or reset. In this secure operating mode, the non-secure download and / or debugging interfaces of the touch IC are disabled, and the touch IC can only update or download touch applications via a preset secure boot program. The touch IC also has a built-in memory, including ROM memory, FLASH program memory, eFuse memory, or OTP memory, used to store the normal boot program and / or secure boot program required for loading the operating mode, as well as the touch application.

[0100] The touch screen is connected to the touch IC and is used to collect touch information. The collected touch information is transmitted to the touch IC for detection.

[0101] The secure CPU controls the data transmission format of the touch IC, enabling it to transmit the detected touch coordinate data in plaintext or ciphertext, and to parse and judge the information containing the touch coordinate data transmitted by the touch IC to obtain the required PIN.

[0102] When the aforementioned financial POS information input system is actually applied in a financial POS, it may also be equipped with other components to maintain the operation of its other additional functions, such as button components or other electronic components, etc. These are all existing technologies and will not be elaborated here.

[0103] As an extended example, in this solution, the system may also include a display screen and an application CPU, wherein the application CPU can communicate with the security CPU and the touch IC, and the display screen can communicate with the application CPU.

[0104] The above description is only a part of the embodiments of the present invention and does not limit the scope of protection of the present invention. Any equivalent device or equivalent process transformation made based on the content of the present invention specification and drawings, or direct or indirect application in other related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A PIN input method for a financial POS, comprising a touch IC operating mode loading method, wherein the touch IC has a built-in memory and a serial interface, and the touch IC operating mode loading method comprises: When the touch IC is powered on or reset, it loads either a normal working mode or a safe working mode according to a preset method. When the touch IC is in the normal working mode, it can irreversibly switch to the safe working mode according to a preset method. When the touch IC is in the safe working mode, it will only continue to load the safe working mode after being restarted and powered on or reset. When the touch IC is in normal working mode, the touch IC can update or download touch applications through the serial interface and / or debugging interface; When the touch IC is in secure operating mode, the insecure download interface and / or debugging interface of the touch IC are closed, and the touch IC can only update or download touch applications through a preset secure boot program; The financial POS is characterized by comprising a secure CPU, a touch IC, and a touchscreen. The secure CPU has a built-in random number generator. After the financial POS is powered on, the touch IC loads a secure operating mode. The PIN input method includes: S01. The secure CPU generates a set of random numbers through a random number generator, denoted as Rdata_add0, and then stores them in the memory of the secure CPU. S02. The security CPU generates a state switching control instruction, which makes the coordinate data subsequently transmitted by the touch IC in encrypted form. At the same time, it also passes a random number Rdata_add0 to the touch IC. S03. In safe working mode, the touch IC performs touch detection on the touch screen to obtain the user's touch state and position, and obtain touch coordinate data; S04. The touch IC combines and encrypts the touch coordinate data and the random number Rdata_add0 using the encryption key Key_xy and the symmetric key encryption algorithm to form ciphertext, and then transmits it to the secure CPU. S05. The secure CPU receives the ciphertext and then uses the decryption key Key_xy corresponding to the touch IC and the corresponding symmetric key decryption algorithm to perform decryption operation on the obtained ciphertext, and obtains a set of touch coordinate data and a set of random numbers Rdata_add1. S06. The security CPU compares the random number Rdata_add1 obtained in S05 with the random number Rdata_add0 generated in S01. If they are the same, the touch IC is defined as a trusted object, and then proceeds to S07. If they are different, the touch IC is defined as an untrusted object, and the financial POS transaction ends. S07. The security CPU parses the touch coordinate data obtained in S05 to obtain the corresponding input information, and then performs content judgment on the data information. When the input information points to the cancel instruction, it enters S08. When the input information points to the numeric keypad, it judges the PIN length. When the length meets the preset requirements, it enters S08. When the length does not meet the preset requirements, it jumps back to S03. S08. The security CPU determines whether to cancel the input or obtain the PIN based on the digital information content judged in S07.

2. The PIN input method for a financial POS as described in claim 1, characterized in that, The memory of the touch IC includes: ROM memory, eFuse memory, or OTP memory; The normal operating mode is loaded by the normal boot program built into the ROM; In normal operating mode, the touch IC runs the touch application through a normal boot program or updates or downloads the touch application using a serial interface or debugging interface; In normal operating mode, the touch IC loads a preset secure boot program and public key through a normal boot program. It then uses instructions to configure the eFuse memory or OTP memory, disabling the debug interface and all download interfaces defined as insecure. Simultaneously, it adjusts the CPU program startup address for power-on and reset of the touch IC to point to the entry point of the secure boot program, thus enabling the touch IC to enter secure operating mode. Furthermore, when the touch IC is restarted or reset, it continues to load the secure operating mode.

3. The PIN input method for a financial POS as described in claim 1, characterized in that, The memory of the touch IC includes: FLASH program memory, eFuse memory, or OTP memory; The normal operating mode is loaded by a pre-installed normal startup program in the FLASH program memory; In normal operating mode, the touch IC runs the touch application through a normal boot program or updates or downloads the touch application using a serial interface; In normal operating mode, the touch IC loads a preset proxy program through a normal boot program, and then loads a secure boot program and public key through the proxy program, overwriting the normal boot program. It then uses instructions to configure the eFuse memory or OTP memory, shutting down the debug interface and all download interfaces defined as insecure, thus putting the touch IC into a secure operating mode. When the touch IC is restarted or reset, it will continue to load only the secure operating mode.

4. The PIN input method for a financial POS as described in any one of claims 1 to 3, characterized in that, In secure operating mode, the touch IC verifies the integrity and legitimacy of running or updated touch applications using a digest algorithm, a signature algorithm, and a public key. Furthermore, when the touch IC powers on and boots into secure operating mode, it also performs a self-test to ensure that unauthorized programs cannot be downloaded or updated to the touch IC.

5. The PIN input method for a financial POS as described in claim 4, characterized in that, The digest algorithm includes SHA2, SHA3, or SM3; the signature algorithm includes SM2, ECC, ECSA, RSA, or DSA.

6. The PIN input method for a financial POS as described in claim 1, characterized in that, In S04, the touch IC encrypts and transmits the touch coordinate data it has acquired to the secure CPU in real time. In S07, when determining the PIN length of the input information... When the PIN length corresponding to the input information is less than the preset length, the process jumps back to S03. The security CPU retains the PIN corresponding to the input information and merges it with the PIN obtained by parsing the ciphertext subsequently transmitted by the touch IC to determine the PIN length until the length meets the requirements or the process times out.

7. The PIN input method for a financial POS as described in claim 1, characterized in that, In S08, when the PIN input is exited, the security CPU also generates a state switching control instruction, which causes the touch coordinate data subsequently transmitted by the touch IC to be in plaintext form.

8. The PIN input method for a financial POS as described in claim 1, characterized in that, The touch IC uses AES, DES, 3DES, or SM4 as the symmetric key encryption algorithm to combine and encrypt the touch coordinate data and the random number Rdata_add0.

9. A financial POS information input system, characterized in that, It is loaded with the PIN input method of a financial POS according to any one of claims 1 to 8, the system comprising: The touch IC receives operating commands and loads a secure operating mode upon power-on or reset. In this secure operating mode, the insecure download interface and / or debugging interface are disabled, and the touch IC can only update or download touch applications via a preset secure boot program. The touch IC also has a built-in memory, including ROM memory, FLASH program memory, eFuse memory, or OTP memory, which stores the secure boot program and touch applications required for the touch IC to load its operating mode. The touch screen is connected to the touch IC and is used to collect touch information. The collected touch information is transmitted to the touch IC for detection. The secure CPU controls the data transmission format of the touch IC, enabling it to transmit the detected touch coordinate data in plaintext or ciphertext, and to parse and judge the information containing the touch coordinate data transmitted by the touch IC to obtain the required PIN.

Images