Safety protection processing method and system for self-service terminal equipment

Abstract

The invention provides a self-service terminal equipment security protection processing method and system, which not only strengthens the identification of user identity information and the establishment of an access session, but also particularly emphasizes the limitation of an interface use range based on a verification result, and realizes the real-time monitoring and response of external storage medium connection activities on the basis; more importantly, once potential risks are found, a protection mode of the file system is started immediately, and unauthorized data writing behaviors are stopped in time; meanwhile, in combination with prevention measures, the system can deeply analyze all data reading attempts, potential risk data items are rapidly isolated, and detailed security log records are generated; in this way, the security and defense capability of the self-service terminal equipment are remarkably improved, and a more reliable service environment is provided for users.

Description

Technical Field

[0001] The present invention belongs to the technical field of self-service terminals, and in particular relates to a self-service terminal equipment security protection processing method and system. Background Art

[0002] In modern self-service terminal equipment (such as KW-1702, recharge machines, ATM machines, ticket machines or information inquiry terminals, etc.), security protection measures are an important part of ensuring the stable operation of the system and the privacy of user data. Existing technologies usually ensure the security of self-service terminals in the following ways: User authentication: Authenticate users using passwords, PIN codes, fingerprint recognition, or card reading to establish access sessions.

[0003] Permission control: Grant corresponding operation permissions based on the user's authentication results to limit the types of operations that the user can perform.

[0004] Interface management: Set strict interface usage rules to prevent unauthorized external devices from connecting to the self-service terminal.

[0005] Activity monitoring: Continuously monitor various activities of the self-service terminal, including but not limited to read and write operations of the file system, and insertion and removal of external storage media.

[0006] Logging: Keep detailed logs of activity to facilitate post-event review and analysis of potential security issues.

[0007] Although these methods have improved the security of self-service terminals to a certain extent, they often focus on a single level of security protection and lack a comprehensive and dynamically responsive security framework, which is particularly inadequate when facing new threats.

[0008] A major problem with existing technologies is that they fail to effectively integrate various security protection links into a coherent processing flow. Specifically, after detecting the connection of an external storage medium, although some protection mechanisms can be activated, there is a lag in preventing unauthorized data writing, and there is a lack of real-time analysis and prevention measures for subsequent data reading attempts. This segmented processing is prone to security vulnerabilities, allowing malware to bypass existing protection measures and endanger the security of the entire system. Summary of the invention

[0009] The purpose of the present invention is to provide a self-service terminal equipment security protection processing method and system, which significantly improves the security and defense capabilities of the self-service terminal equipment, provides users with a more reliable service environment, and solves the problems raised in the above background technology.

[0010] To achieve the above-mentioned purpose, the present invention proposes a self-service terminal device security protection processing method on the one hand, including: identifying user identity information and establishing an access session, and based on the access session, performing permission verification on the operation request; according to the verification result, limiting the interface usage scope, and monitoring the external storage medium connection activity within the determined usage scope; in response to the monitored connection activity, starting the file system protection mode, and according to the protection mode, preventing unauthorized data writing behavior; in combination with the prevention measures, analyzing all data reading attempts, isolating potential risk data items according to the analysis conclusions, and using the isolated data items to generate security log records.

[0011] Preferably, the identifying of user identity information and establishing an access session includes: receiving a unique identification code provided by the user and initiating an access session, generating a verification value based on the received unique identification code; using the generated verification value to compare with the user record stored in the device to confirm the match; if the comparison result matches, creating an access token for permission confirmation in subsequent interaction processes.

[0012] Preferably, the permission verification of the operation request based on the access session includes: receiving an access token and parsing the operation code contained therein; determining the permission level to be checked based on the parsed operation code; querying the permission configuration associated with the user to determine whether the permission level requirements are met; if the conditions are met, generating an authorization flag to indicate that the corresponding operation is allowed to be performed.

[0013] Preferably, the scope of interface use is limited based on the verification result, including: receiving an authorization mark and identifying the corresponding permission level; determining a list of resources allowed to be accessed based on the permission level; constructing an access control list to ensure that each entry corresponds to a specific resource path; updating the interface access restriction settings to ensure that interface calls are allowed only when the requested resource path exists in the access control list.

[0014] Preferably, the monitoring of external storage media connection activities within a determined scope of use includes: initiating interface access restriction setting monitoring to identify any external storage media attempting to connect; for each external storage medium identified, recording the timestamp of the connection event and generating a connection identifier; querying a pre-established whitelist to verify whether there is a match; if the verification result shows that there is no match, triggering an alarm signal and recording the connection event details in a security log.

[0015] Preferably, the response to the monitored connection activity starts the protection mode of the file system, including: after receiving the connection event detail record, parsing the connection identifier therein; evaluating whether an alarm signal has been triggered, and executing subsequent operations if so; if confirmed, activating the read-write control mechanism and setting the file access status to read-only; restricting data write requests for all external storage media, and updating this status to the system configuration.

[0016] Preferably, the protection mode is used to prevent unauthorized data writing, including: receiving a file access request, parsing the operation type in the request, and extracting the associated connection identifier to determine whether the operation type is a write operation; if it is a write operation, querying the corresponding file access status to verify whether it is read-only; if the verification result shows that it is read-only, rejecting the write operation and returning a rejection message to the request source.

[0017] Preferably, the combined blocking measures analyze all data reading attempts, including: intercepting file access requests, identifying the operation type in the request, and confirming it as a read operation; for confirmed read operations, extracting the resource path associated with the request and generating a request identifier; querying the access control list to verify whether there is a match; if the verification result shows that there is no match, marking the read operation and recording it in the monitoring log.

[0018] Preferably, the method of isolating potential risk data items according to the analysis conclusions and generating security log records using the isolated data items includes: receiving a marked read operation and parsing the request identifier therein; determining the associated resource path and moving the file corresponding to the path to an isolation area; extracting the file's metadata, including but not limited to the file name, size and last modification time, and constructing a detailed information record; using the detailed information record, together with the original request identifier, to compile a security log entry and add it to a log library.

[0019] On the other hand, the present invention proposes a self-service terminal equipment security protection processing system, including: a user identity authentication and access session management module, which is used to identify user identity information and establish an access session, and based on the access session, perform permission verification on the operation request; an interface usage range control and external storage media monitoring module, which is used to limit the interface usage range according to the verification result, and monitor the external storage media connection activity within the determined usage range; a file system protection and unauthorized data write blocking module, which is used to respond to the monitored connection activity, start the file system protection mode, and block unauthorized data writing behavior based on the protection mode; a data read attempt analysis and risk isolation and log recording module, which is used to analyze all data read attempts in combination with blocking measures, isolate potential risk data items according to the analysis conclusions, and use the isolated data items to generate security log records.

[0020] Technical effects and advantages of the present invention: Compared with the prior art, the present invention provides a self-service terminal device security protection processing method and system, which has the following advantages: The present invention not only strengthens the identification of user identity information and the establishment of access sessions, but also places special emphasis on limiting the scope of interface use based on verification results, and on this basis realizes real-time monitoring and response to external storage media connection activities; more importantly, once a potential risk is discovered, the protection mode of the file system is immediately activated to promptly prevent unauthorized data writing; at the same time, combined with prevention measures, the system will conduct an in-depth analysis of all data reading attempts, quickly isolate potential risk data items, and generate detailed security log records; in this way, the present invention significantly improves the security and defense capabilities of self-service terminal equipment, and provides users with a more reliable service environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 A flowchart of the self-service terminal device security protection processing method of the present invention; Figure 2 It is a block diagram of the self-service terminal equipment security protection processing system of the present invention. DETAILED DESCRIPTION

[0022] The following will be combined with the accompanying drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. The specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0023] The present invention provides Figure 1 A self-service terminal device security protection method shown includes: Step 1: Identify user identity information and establish an access session; specifically include: Receive an identifier U from the user, where U represents a unique identification code provided by the user; by receiving the unique identification code (such as a smart card number, user name or biometric data) provided by the user, the system can preliminarily distinguish different user individuals.

[0024] Based on the received identifier U, the verification value V is obtained by calculating the formula V=H(U)+S, where H represents a hash operation and S is a fixed value preset by the system; this formula uses the hash function H to convert the identifier U provided by the user into a string of fixed length, and then adds the fixed value S preset by the system as a salt value to increase security. This approach not only enhances the confidentiality of the identifier, but also avoids the risk of directly storing sensitive information.

[0025] The obtained verification value V is compared with the corresponding user record R stored in the device to determine whether the two match, that is, to check whether the equation V==R holds; the verification value records R of all legitimate users are pre-stored in the device. When a new verification value V is generated, the system compares it with these records one by one to confirm the authenticity of the user's identity. In this way, the user's identity can be accurately verified to prevent unauthorized users from accessing the system.

[0026] According to the comparison result, if the equation is established, an access token T associated with the identifier U is created, which is used to confirm the permissions in the subsequent interaction process. Once the verification is passed, the system will generate a unique access token T, which is associated with the user identifier U and contains the user's permission information. The access token ensures that each operation can be traced back to a specific user, while providing the basis for permission management and ensuring the security and auditability of the system.

[0027] Example: Assume that the unique identification code provided by the user is U="user123", the system preset fixed value is S=98765, and the hash function H uses the SHA-256 algorithm.

[0028] The user provides his unique identification code U="user123".

[0029] The system uses the SHA-256 algorithm to hash U and obtains the hash value H(U)="aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d" (for example only).

[0030] Add the hash value to the fixed value preset by the system: V="aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d"+98765. To simplify the description, we assume that this operation is a string concatenation performed directly on the hexadecimal representation of the hash value. In actual applications, there may be more complex processing methods.

[0031] The system queries the internal database to find a user record R that matches V. If a match is found, it proceeds to the next step; otherwise, access is denied.

[0032] If the match is successful, the system generates a new access token T, such as T="token_abc123", and sends it to the user for subsequent operation requests.

[0033] Through the above embodiments, it can be seen that the method effectively implements user identity authentication and establishes a secure access session, thereby ensuring the security and reliability of the self-service terminal device.

[0034] Step 2: Based on the session established in step 1, verify the permission of the operation request; specifically, it includes: Receive the access token T and parse the operation code C contained in it; by parsing the access token T, the system can extract the operation code C and clarify the specific type of operation the user wants to perform. This step ensures that each operation request can be accurately identified and processed.

[0035] According to the parsed operation code C, the permission level G to be checked is determined and calculated by the formula G=F(C), where F represents a mapping operation; this formula uses the mapping function F to convert the operation code C into a specific permission level G. The mapping function F can map different operation codes to corresponding permission levels according to predefined rules to ensure that each operation has clear permission requirements. Through the mapping operation, the permission level required for each operation can be dynamically determined, making permission management more flexible and accurate.

[0036] Combined with the determined permission level G, query the permission configuration P associated with the user to determine whether the condition G<=P is met; the user's permission configuration P is pre-stored in the system, which defines which levels of operations the user can perform. When the new permission level G is determined, the system compares it with the user's permission configuration P to confirm whether the user has sufficient permissions to perform the operation. In this way, the execution permissions of each operation can be strictly controlled to prevent users from performing operations beyond their permission range.

[0037] According to the judgment result, if the condition is met, an authorization mark A is generated, which is used to indicate that the corresponding operation is allowed to be performed. Once the permission verification is passed, the system will generate an authorization mark A, which is used to mark that the operation has been authorized. This mark can be used as proof of the legitimacy of the operation in the subsequent processing. The authorization mark ensures that each operation is strictly verified, ensuring the security of the system and the legitimacy of the operation. Example

[0038] Assume that the access token provided by the user is T="token_abc123", and the operation code obtained after parsing is C="view_balance" (view balance). The system preset mapping function F is shown in the following table: Operation Code Permission Level view_balance 1 transfer_funds 3 admin_tasks 5 Parsing access token T: The system receives the access token T="token_abc123" and parses the operation code C="view_balance" from it.

[0039] Calculate the permission level G: According to the mapping function F, the permission level corresponding to the operation code C="view_balance" is G=1.

[0040] Query permission configuration P: The system queries the permission configuration associated with the user and finds that the user's permission level is P=3.

[0041] Permission verification: Check the condition G<=P, that is, 1<=3, the condition is established.

[0042] Generate authorization flag A: Because the condition is met, the system generates authorization flag A="authorized_view_balance", allowing the user to perform the operation of viewing the balance.

[0043] Through the above embodiments, it can be seen that the method effectively implements the permission verification of the operation request, ensures that only authorized operations can be executed, and enhances the security and reliability of the self-service terminal device.

[0044] Step 3: Based on the verification results of step 2, limit the scope of interface use; by receiving authorization marks, identifying permission levels, determining the list of resources allowed to be accessed, and building an access control list (ACL), the user's operation scope can be accurately limited. Finally, update the interface access restriction settings to ensure that only resource paths that comply with the ACL regulations can be accessed. Specifically include: Receive the authorization mark A and identify the corresponding permission level G; by parsing the authorization mark A, the system can confirm that the user has been verified and obtain his permission level G. This step ensures that each operation request is processed based on valid authorization.

[0045] Based on the identified permission level G, the list of resources L that are allowed to be accessed is determined and obtained through the formula L=G(G), where G represents a mapping rule; this formula uses the mapping rule G to convert the permission level G into a specific resource list L. The mapping rule G can map different permission levels to corresponding resource sets according to the predefined permission configuration, ensuring that each permission level corresponds to a specific set of resources. Through the mapping rules, it is possible to dynamically determine which resources a user can access, making resource access management more flexible and accurate.

[0046] Using the determined resource list L, the access control list ACL is constructed to ensure that each entry corresponds to a specific resource path Path; after determining the resource list L, the system converts these resources into specific resource paths Path and constructs the access control list ACL. Each entry in the ACL represents an accessible resource path for subsequent access control. By constructing the ACL, the system can clearly specify which resource paths are accessible to users, enhancing the controllability and security of resource access.

[0047] According to the constructed access control list ACL, update the interface access restriction setting Limit to ensure that the interface call is allowed only when the requested resource path Path exists in the ACL. The system updates the interface access restriction setting Limit according to the ACL to ensure that each resource access request is checked to see if it exists in the ACL. If the requested resource path Path exists in the ACL, the interface call is allowed; otherwise, access is denied. In this way, the user's operation scope can be strictly limited, unauthorized resource access can be prevented, and the security and stability of the system can be ensured.

[0048] Example Assume that the authorization flag provided by the user is A="authorized_view_balance", and the permission level obtained after parsing is G=1. The system preset mapping rule G is shown in the following table: Permission Level Resources List 1 [" / user / balance"," / user / transactions"] 3 [" / user / balance"," / user / transactions"," / transfer / funds"] 5 [" / user / balance"," / user / transactions"," / transfer / funds"," / admin / tasks"] Receiving authorization mark A: The system receives the authorization mark A="authorized_view_balance", from which it parses the permission level G=1.

[0049] Calculate the resource list L: According to the mapping rule G, the resource list corresponding to the permission level G=1 is L=[" / user / balance"," / user / transactions"].

[0050] Build access control list ACL: The system builds access control list ACL based on resource list L, which contains two entries: [" / user / balance", " / user / transactions"].

[0051] Update interface access restriction settings Limit: The system updates the interface access restriction settings to ensure that interface calls are allowed only when the requested resource path exists in the ACL. For example, if a user tries to access / user / balance, it is allowed; but if he tries to access / transfer / funds, it is denied.

[0052] Through the above embodiments, it can be seen that the method effectively limits the scope of use of the user interface, ensures that users can only access resources permitted by their authority levels, and enhances the security and reliability of the self-service terminal device.

[0053] Step 4: Monitor external storage media connection activities within the scope determined in step 3; this step is intended to monitor and control the connection activities of external storage media (such as USB drives, SD cards, etc.) in real time to ensure that only authorized external devices can interact with the self-service terminal device. By enabling interface access restriction settings monitoring, recording connection events, generating connection identifiers and verifying whitelists, malware or other unauthorized devices can be effectively prevented from invading the system, thereby improving the security of the self-service terminal. Specifically, it includes: Start monitoring the interface access restriction setting Limit to identify any external storage media E that attempts to connect; by continuously monitoring the interface access restriction setting, the system can promptly detect any external storage media E that attempts to connect. This step ensures that all external device connections can be recorded and reviewed.

[0054] For each external storage medium E identified, the timestamp of the connection event is recorded, and a connection identifier ID=H(E,Timestamp) is generated, where H represents a hash operation; this formula uses the hash function H to combine the information of the external storage medium E with its connection timestamp Timestamp to generate a unique connection identifier ID. The hash operation ensures that even if two identical devices are connected at the same time, different identifiers will be generated, which enhances uniqueness and security.

[0055] Based on the generated connection identifier ID, the pre-established whitelist W is queried to verify whether there is a match, that is, to check whether ID∈W is established; the whitelist W is pre-established in the system, which contains the identifiers of external storage media that are allowed to connect. When a new connection identifier ID is generated, the system compares it with the whitelist to confirm whether the device is authorized. In this way, it is possible to strictly control which external devices can connect to the system and prevent unauthorized devices from accessing.

[0056] According to the verification result, if the condition is not met, the alarm signal Alert is triggered and the connection event details are recorded in the security log Log. Once it is found that the connection identifier ID is not in the whitelist W, the system will immediately trigger the alarm signal Alert and record the detailed connection event information (including timestamp, device information, etc.) in the security log Log. By triggering the alarm signal and recording the log, the system can not only respond to potential threats in the first time, but also provide important data support for subsequent security analysis and auditing.

[0057] Example Assume that the system preset whitelist W contains the following connection identifiers: Connection Identifier "id_001" "id_002" Start interface access restriction setting Limit monitoring: The system starts monitoring the connection activities of external storage media.

[0058] Identify external storage medium E: The system detects that an external storage medium E is inserted into the interface.

[0059] Record the timestamp of the connection event and generate a connection identifier ID: Assume that the current timestamp is Timestamp="2025-01-08T19:33:00Z", use the SHA-256 hash function H to generate a connection identifier ID=H("usb_device_1","2025-01-08T19:33:00Z"). To simplify the description, assume that the generated hash value is ID="id_003" (the actual hash value will be more complicated).

[0060] Query whitelist W: The system queries whitelist W and finds that ID="id_003" is not in the whitelist.

[0061] Trigger an alarm signal Alert and record the connection event details in the security log Log: The system triggers an alarm signal and records the connection event details (including timestamp, device information, etc.) in the security log Log.

[0062] Through the above embodiments, it can be seen that the method effectively realizes real-time monitoring and control of external storage media connection activities, ensures that only authorized devices can connect to the system, and enhances the security of self-service terminal devices.

[0063] Step 5: In response to the connection event detected in step 4, start the file system protection mode; this step is to ensure that when an unauthorized external storage media connection is detected, the file system protection mode is immediately started to prevent malware or other potential threats from writing data through external devices. By parsing the connection event details, evaluating the alarm signal, activating the read-write control mechanism and updating the system configuration, unauthorized data writing can be effectively prevented to ensure the security and data integrity of the self-service terminal equipment. Specifically including: After receiving the connection event details record log, the connection identifier ID is parsed; by parsing the connection identifier ID in the connection event details record log, the system can identify the specific connection event and provide a basis for subsequent processing. This step ensures that each connection event can be accurately tracked and processed.

[0064] Based on the parsed ID, it is evaluated whether the alarm signal Alert has been triggered. If so, the subsequent operation is performed; the system checks the alarm signal Alert associated with the connection identifier ID to confirm whether there is an unauthorized connection event. If an alarm signal is found, it means that the connection is abnormal and further measures need to be taken. By evaluating the alarm signal, the system can identify potential security threats at the first time and respond quickly to prevent the threat from expanding.

[0065] In the case of confirmation, the read-write control mechanism is activated and the file access state State is set to read-only, that is, State=ReadOnly(ID); this formula means setting the file access state State to read-only mode, and the specific implementation depends on the connection event identified by ID. Once in read-only mode, the system will block all write operations to ensure the security of the file system. By activating the read-write control mechanism and setting the file access state to read-only, the system can immediately block any unauthorized data writing behavior and protect the integrity and security of the file system.

[0066] According to the set file access state State, restrict all data write requests from external storage media E, and update this state to the system configuration Config. Once the file access state is set to read-only, the system will reject all data write requests from external storage media E and update this state to the system configuration Config. In this way, even if there are new write requests later, they will be automatically rejected. By updating the system configuration, the protection mode of the file system is ensured to remain valid until the entire system is restarted or restored, which enhances the persistence of security protection.

[0067] Example Assume that the system receives a connection event detail record Log, which contains a connection identifier ID="id_003", and an alarm signal Alert has been triggered.

[0068] Receive connection event detail record Log: The system receives the connection event detail record Log and parses the connection identifier ID="id_003".

[0069] Evaluate Alert: The system checks the Alert associated with ID="id_003" to confirm that an unauthorized connection event does exist.

[0070] Activate the read-write control mechanism and set the file access state to read-only: The system activates the read-write control mechanism and sets the file access state to read-only mode, that is, State=ReadOnly("id_003"). This means that all files are now in read-only state and cannot be written to.

[0071] Restrict data write requests and update system configuration Config: The system rejects all data write requests from external storage medium E and updates the file access status to the system configuration Config to ensure that the protection mode of the file system remains in effect.

[0072] Through the above embodiments, it can be seen that the method effectively implements the protection of the file system, ensures that when an unauthorized connection event is detected, any possible malicious writing behavior is immediately blocked, and the security and data integrity of the self-service terminal device are guaranteed.

[0073] Step 6: According to the protection mode of step 5, prevent unauthorized data writing; by receiving file access requests, parsing the operation type, determining whether it is a write operation, verifying the file access status and rejecting the write operation, it can prevent malware or other unauthorized external devices from tampering with the file system, thereby ensuring the security and data integrity of the self-service terminal device. Specifically include: Receive the file access request, parse the operation type Op in the request, and extract the associated connection identifier ID; by parsing the file access request, the system can identify the specific operation type (such as read, write, etc.) and the associated connection identifier ID. This step ensures that each file access request can be accurately processed and reviewed.

[0074] Based on the parsed operation type Op, determine whether it is a write operation Write, that is, check whether Op==Write is true; the system checks whether the operation type Op is a write operation Write. If the condition is true, it means that the user or device is trying to write data, and its legitimacy needs to be further verified. Through this judgment, the system can distinguish different operation types and ensure that only write operations will enter the subsequent permission verification process.

[0075] If the condition is met, the corresponding file access state State is queried according to the connection identifier ID to verify whether State is equal to read-only ReadOnly; once the operation type is confirmed to be a write operation, the system will query the current file access state State according to the connection identifier ID and verify whether it has been set to read-only mode ReadOnly. This step ensures that write operations are rejected only when the file system is in protection mode. By verifying the file access state, the system can ensure that any write operation will be rejected in protection mode, thereby protecting the security of the file system.

[0076] When the verification result shows that State is equal to ReadOnly, the write operation Write is rejected and a rejection message Message=Deny(Write,ID) is returned to the request source. If the file access status is indeed read-only mode, the system will reject the write operation and generate a rejection message Message to send to the request source. The rejection message contains the write operation Write and the connection identifier ID so that the requester can understand the specific reason. In this way, the system can not only reject unauthorized write operations in the first place, but also provide detailed rejection reasons to facilitate subsequent security audits and troubleshooting.

[0077] Example Assume that the system receives a file access request including the operation type Op="write" and the connection identifier ID="id_003", and the file access state has been set to read-only mode.

[0078] Receiving a file access request: The system receives the file access request and parses the operation type Op="write" and the connection identifier ID="id_003".

[0079] Determine whether it is a write operation: The system checks whether the operation type Op is a write operation Write, that is, Op=="write". If the condition is met, it means that this is a write operation.

[0080] Query the file access state State: The system queries the current file access state State based on the connection identifier ID="id_003" and finds that State==ReadOnly.

[0081] Deny the write operation and return a denial message: Because the file access status is in read-only mode, the system denies the write operation and generates a denial message Message=Deny("write","id_003"), which is then sent to the request source.

[0082] Through the above embodiments, it can be seen that the method effectively prevents unauthorized data writing, ensures that when the file system is in protection mode, any write operation will be rejected, and enhances the security and data integrity of the self-service terminal device.

[0083] Step 7: Combined with the blocking measures in step 6, analyze all data reading attempts; by intercepting file access requests, identifying read operations, generating request identifiers, and querying access control lists (ACLs), unauthorized reading can be effectively prevented, while suspicious activities are recorded for subsequent audits. This step enhances the security of self-service terminal devices and the controllability of data access. Specifically, it includes: Intercept file access requests, identify the operation type Op in the request, and confirm it as a read operation Read; by intercepting file access requests, the system can identify the specific operation type (such as read, write, etc.) and pay special attention to the read operation Read. This step ensures that each read operation can be accurately identified and processed.

[0084] For the confirmed read operation Read, extract the resource path Path associated with the request and generate a request identifier RID=H(Path,Timestamp), where H represents a hash operation and Timestamp represents the current timestamp; this formula uses the hash function H to combine the resource path Path with the current timestamp Timestamp to generate a unique request identifier RID. The hash operation ensures that even if two identical resource paths are accessed at the same time, different identifiers will be generated, which enhances uniqueness and security. By generating a unique request identifier, the system can accurately track each read operation, providing a reliable basis for subsequent verification.

[0085] The generated request identifier RID is used to query the access control list ACL to verify whether there is a match, that is, to check whether RID∈ACL is established; the access control list ACL is pre-established in the system, which contains identifiers of resource paths that are allowed to be accessed. When a new request identifier RID is generated, the system compares it with the ACL to confirm whether the read operation has been authorized. In this way, it is possible to strictly control which read operations are allowed, prevent unauthorized resource access, and ensure the security and controllability of the system.

[0086] According to the verification result, if the condition is not met, the read operation Read is marked, the flag status Flag=Flagged(RID) is set, and it is recorded in the monitoring log MonitorLog. Once it is found that the request identifier RID is not in the ACL, the system will immediately mark the read operation Read and generate the flag status Flag. At the same time, detailed read operation information (including timestamp, resource path, etc.) will be recorded in the monitoring log MonitorLog.

[0087] Example Assume that the system receives a file access request, which includes the operation type Op="read" and the resource path Path=" / user / data / file.txt", and the current timestamp is Timestamp="2025-01-08T19:45:00Z".

[0088] Intercepting file access requests: The system receives a file access request, parses the operation type Op="read", and confirms that this is a read operation Read.

[0089] Extract the resource path Path and generate the request identifier RID: The system extracts the resource path Path=" / user / data / file.txt", uses the SHA-256 hash function H combined with the current timestamp Timestamp="2025-01-08T19:45:00Z", and generates the request identifier RID=H(" / user / data / file.txt","2025-01-08T19:45:00Z"). To simplify the description, assume that the generated hash value is RID="rid_001" (the actual hash value will be more complicated).

[0090] Query the access control list ACL: The system queries the access control list ACL and finds that RID="rid_001" is not in the ACL.

[0091] Mark the read operation Read and record it in the monitoring log MonitorLog: The system marks the read operation Read, sets the mark status Flag=Flagged("rid_001"), and records the detailed read operation information (including timestamp, resource path, etc.) in the monitoring log MonitorLog.

[0092] Through the above embodiments, it can be seen that the method effectively realizes the analysis and control of all data reading attempts, ensures that only authorized reading operations can be performed, and enhances the security of the self-service terminal equipment and the controllability of data access.

[0093] Step 8: Isolate potential risk data items according to the analysis conclusions, and use the isolated data items to generate security log records; by receiving the tag status, parsing the request identifier, isolating the file and extracting the metadata, it can effectively prevent the spread of malware or other threats, and provide detailed information support for subsequent security audits. This step enhances the security and data protection capabilities of self-service terminal devices. Specifically include: Receive the data read operation Read with the flag status Flag and parse the request identifier RID therein; by receiving the data read operation Read with the flag status Flag, the system can identify the operation that has been marked as a potential risk and parse its request identifier RID. This step ensures that each marked read operation can be accurately tracked and processed.

[0094] Based on the parsed RID, the associated resource path Path is determined, and the file File corresponding to the path is moved to the isolation zone IsolationZone, that is, IsolationZone=Isolate(Path) is executed; this formula indicates that the associated resource path Path is determined according to the request identifier RID, and the file File corresponding to the path is moved to the isolation zone IsolationZone. The isolation operation ensures that potential risk files will not affect the normal operation of the system.

[0095] For the isolated file File, extract its metadata Meta, including but not limited to the file name, size, and last modification time, and construct a detailed information record Info=Extract(Meta,File); This formula means extracting its metadata Meta (such as file name, size, and last modification time) from the isolated file File, and constructing a detailed record Info. The extracted metadata provides important information about the file, which is convenient for subsequent analysis and auditing.

[0096] The constructed detailed information record Info is combined with the original request identifier RID to compile a security log entry Entry, and add it to the log library Log, that is, Log=Log(Entry,RID). This formula means that the detailed information record Info is combined with the original request identifier RID to compile a security log entry Entry, and add it to the log library Log. The log record provides a complete event traceability, which is convenient for subsequent review and audit.

[0097] Example Assume that the system receives a data read operation Read with a flag status Flag="flagged", which includes a request identifier RID="rid_001", and the associated resource path is Path=" / user / data / file.txt".

[0098] Receiving the data read operation Read with the flag status Flag: The system receives the data read operation Read with the flag status Flag="flagged", and parses the request identifier RID="rid_001".

[0099] Determine the resource path Path and move the file File to the isolation zone IsolationZone: The system determines the associated resource path Path=" / user / data / file.txt" based on the request identifier RID="rid_001", and moves the file File corresponding to the path to the isolation zone IsolationZone, that is, execute IsolationZone=Isolate(" / user / data / file.txt") . Assume that the file is successfully moved to the isolation zone IsolationZone=" / isolated / rid_001_file.txt".

[0100] Extract the metadata Meta of the file File and construct the detailed information record Info: The system extracts the metadata Meta (such as file name file.txt, size 10KB, last modified time 2025-01-08T19:45:00Z) from the isolated file File=" / isolated / rid_001_file.txt" and constructs the detailed information record Info={"filename":"file.txt","size":"10KB","last_modified":"2025-01-08T19:45:00Z"}.

[0101] Compile the security log entry Entry and add it to the log library Log: The system uses the detailed information record Info and the original request identifier RID to compile the security log entry Entry={"info":{"filename":"file.txt","size":"10KB","last_modified":"2025-01-08T19:45:00Z"},"request_id":"rid_001"}, and add it to the log library Log, that is, execute Log=Log(Entry,"rid_001").

[0102] Through the above embodiments, it can be seen that the method effectively implements the isolation of potential risk data items and generates detailed security log records, thereby ensuring the security and data protection capabilities of the self-service terminal device.

[0103] On the other hand, the present invention provides a self-service terminal equipment security protection processing system, such as Figure 2 As shown, including: A user identity authentication and access session management module is used to identify user identity information and establish an access session, and perform permission verification on operation requests based on the access session; The interface usage range control and external storage media monitoring module is used to limit the interface usage range according to the verification result and monitor the external storage media connection activities within the determined usage range; A file system protection and unauthorized data writing prevention module, used to respond to the monitored connection activity, start the file system protection mode, and prevent unauthorized data writing according to the protection mode; The data reading attempt analysis, risk isolation and log recording module is used to analyze all data reading attempts in combination with prevention measures, isolate potential risk data items according to the analysis conclusions, and generate security log records using the isolated data items.

[0104] In addition, the above-mentioned user identity authentication and access session management module, interface usage range control and external storage media monitoring module, file system protection and unauthorized data write prevention module, and data read attempt analysis and risk isolation and logging module are also used to execute other steps of the above-mentioned self-service terminal device security protection processing method when executed, which are not described one by one here.

[0105] In summary, the present invention not only strengthens the identification of user identity information and the establishment of access sessions, but also places special emphasis on limiting the scope of interface use based on verification results, and on this basis realizes real-time monitoring and response to external storage media connection activities; more importantly, once a potential risk is discovered, the protection mode of the file system is immediately activated to prevent unauthorized data writing in a timely manner; At the same time, combined with prevention measures, the system will conduct an in-depth analysis of all data reading attempts, quickly isolate potential risk data items, and generate detailed security log records; in this way, the present invention significantly improves the security and defense capabilities of self-service terminal equipment, and provides users with a more reliable service environment.

[0106] Finally, it should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A self-service terminal device security protection processing method, characterized in that: include: Identify user identity information and establish an access session, and perform permission verification on the operation request based on the access session; According to the result of the verification, the use scope of the interface is limited, and within the determined use scope, the connection activity of the external storage medium is monitored; in response to the monitored connection activity, the protection mode of the file system is started, and according to the protection mode, unauthorized data writing behavior is prevented; Combined with the prevention measures, all data reading attempts are analyzed, and according to the analysis conclusions, potential risk data items are isolated, and security log records are generated using the isolated data items.

2. The self-service terminal equipment security protection processing method according to claim 1 is characterized in that: The identifying of user identity information and establishing an access session includes: receiving a unique identification code provided by the user, initiating an access session, generating a verification value based on the received unique identification code; using the generated verification value to compare with the user record stored in the device to confirm the match; if the comparison result matches, creating an access token for permission confirmation in subsequent interaction processes.

3. The self-service terminal equipment security protection processing method according to claim 2 is characterized in that: The authorization verification of the operation request based on the access session includes: receiving the access token and parsing the operation code contained therein; determining the permission level to be checked according to the parsed operation code; querying the permission configuration associated with the user to determine whether the permission level requirement is met; if the condition is met, generating an authorization flag to indicate that the corresponding operation is allowed to be executed.

4. The self-service terminal equipment security protection processing method according to claim 3 is characterized in that: The method of limiting the scope of interface use according to the verification result includes: receiving an authorization mark and identifying the corresponding permission level; determining a list of resources allowed to be accessed according to the permission level; constructing an access control list to ensure that each entry corresponds to a specific resource path; and updating the interface access restriction setting to ensure that the interface call is allowed only when the requested resource path exists in the access control list.

5. The self-service terminal equipment security protection processing method according to claim 4 is characterized in that: The monitoring of external storage media connection activities within the determined scope of use includes: starting interface access restriction setting monitoring to identify any external storage media attempting to connect; for each external storage media identified, recording the timestamp of the connection event and generating a connection identifier; querying a pre-established whitelist to verify whether there is a match; if the verification result shows that there is no match, triggering an alarm signal and recording the connection event details in a security log.

6. The self-service terminal equipment security protection processing method according to claim 5 is characterized in that: The response to the monitored connection activity starts the protection mode of the file system, including: after receiving the connection event detail record, parsing the connection identifier therein; evaluating whether an alarm signal has been triggered, and if so, executing subsequent operations; if confirmed, activating the read-write control mechanism and setting the file access status to read-only; restricting data write requests for all external storage media, and updating this status to the system configuration.

7. The self-service terminal equipment security protection processing method according to claim 6, characterized in that: The method of preventing unauthorized data writing based on the protection mode includes: receiving a file access request, parsing the operation type in the request, extracting the associated connection identifier, and determining whether the operation type is a write operation; if it is a write operation, querying the corresponding file access status and verifying whether it is read-only; if the verification result shows that it is read-only, rejecting the write operation and returning a rejection message to the request source.

8. The self-service terminal equipment security protection processing method according to claim 7 is characterized in that: The combined blocking measures analyze all data reading attempts, including: intercepting file access requests, identifying the operation type in the request, and confirming it as a read operation; for confirmed read operations, extracting the resource path associated with the request and generating a request identifier; querying the access control list to verify whether there is a match; if the verification result shows that there is no match, marking the read operation and recording it in the monitoring log.

9. The self-service terminal equipment security protection processing method according to claim 8, characterized in that: The method of isolating potential risk data items according to the analysis conclusions and generating security log records using the isolated data items includes: receiving a marked read operation and parsing the request identifier therein; determining the associated resource path and moving the file corresponding to the path to the isolation area; extracting the metadata of the file, including but not limited to the file name, size and last modification time, and constructing a detailed information record; using the detailed information record, together with the original request identifier, to compile a security log entry and add it to the log library.

10. A self-service terminal equipment security protection processing system for implementing the method according to any one of claims 1 to 9, characterized in that: include: A user identity authentication and access session management module is used to identify user identity information and establish an access session, and perform permission verification on operation requests based on the access session; The interface usage range control and external storage media monitoring module is used to limit the interface usage range according to the verification result and monitor the external storage media connection activities within the determined usage range; A file system protection and unauthorized data writing prevention module, used to respond to the monitored connection activity, start the file system protection mode, and prevent unauthorized data writing according to the protection mode; The data reading attempt analysis, risk isolation and log recording module is used to analyze all data reading attempts in combination with prevention measures, isolate potential risk data items according to the analysis conclusions, and generate security log records using the isolated data items.

Images