Security management system, method, device, equipment, medium and program product

Abstract

The embodiment of the invention discloses a security management system, method, device and equipment, a medium and a program product. The system comprises a POS terminal, a manufacturing execution system and a POS terminal management system, the manufacturing execution system stores production data; the production data comprises a serial number, a card identification code and a program version number; the POS terminal periodically uploads heartbeat data to the POS terminal management system in the use process; the heartbeat data comprises a current serial number, a card identification code and a program version number; the POS terminal management system obtains a serial number, a card identification code and a program version number of the managed POS terminal from the manufacturing execution system when the POS terminal leaves a factory, and stores the serial number, the card identification code and the program version number as management data; and after the POS terminal management system receives the heartbeat data uploaded by the POS terminal, the heartbeat data is matched with the management data, and safety management is carried out on the POS terminal according to a matching result.

Description

Technical Field

[0001] The embodiments of the present disclosure relate to the field of computer technology, and in particular to a security management system, method, apparatus, device, medium, and program product. Background Art

[0002] Since POS machines involve money transactions, their security is very important. At present, there are still occasional POS machine cutting behaviors in the market. Cutting the machine means erasing the original program, secret key and other machine information, writing new programs and filling new secret keys. Cutting the machine will lead to the loss of users of the original POS manufacturer, and will also provide opportunities for criminals, causing financial security problems for users.

[0003] The current method of POS anti-cutting machines is to control them through application signatures and machine TUSN serial numbers. The signature is equivalent to a secret key. Only through the signature can the application be installed on the machine with the TUSN serial number written in. The signature and TUSN serial number match and belong to the same payment company. If the application is not signed or is not from the same payment company as the TUSN serial number, it cannot be installed. This method is equivalent to encryption through software methods. There is a certain possibility of cracking. When the POS machine TUSN serial number and application are all erased and become a blank machine, the TUSN serial number and application of other companies can be written, resulting in the loss of machines and the risk of financial crimes.

[0004] Therefore, it is necessary to propose a technical solution to improve the security of POS machines, so as to avoid the TUSN serial number and application on the POS machine being completely erased, thereby causing the POS machine to be hacked. Summary of the invention

[0005] Embodiments of the present disclosure provide a security management system, method, apparatus, device, medium, and program product.

[0006] In a first aspect, a security management system is provided in an embodiment of the present disclosure, comprising: a POS terminal, a manufacturing execution system and a POS terminal management system; wherein:

[0007] The manufacturing execution system stores production data of the POS terminal during the production process; the production data includes a serial number of the POS terminal, a card identification code of an e-SIM card fixed to the POS terminal, and a program version number of an application installed in the POS terminal;

[0008] During use, the POS terminal periodically uploads heartbeat data to the POS terminal management system that manages the POS terminal; the heartbeat data includes the current serial number, card identification code and program version number of the POS terminal;

[0009] After the production of the POS terminal is completed, the POS terminal management system obtains the serial number, card identification code and program version number of the managed POS terminal when it leaves the factory from the manufacturing execution system, and stores them as management data; after receiving the heartbeat data uploaded by the POS terminal, the POS terminal management system matches the heartbeat data with the management data, and performs security management of the POS terminal based on the matching result.

[0010] Optionally, when the POS terminal leaves the factory, the manufacturing execution system uploads the serial number, card identification code and program version number in the production data of the POS terminal to the POS terminal management system that manages the POS terminal.

[0011] Optionally, if the heartbeat data does not match at least one of the card identification code and the program version number corresponding to the same serial number in the management data, the communication of the e-SIM card fixed on the POS terminal is terminated.

[0012] Optionally, the underlying firmware program of the POS terminal periodically reads the current serial number, card identification code and program version number of the POS terminal, carries the read serial number, card identification code and program version number in the heartbeat data, and uploads it to the POS terminal management system.

[0013] In a second aspect, the present disclosure provides a security management system, including: a POS terminal and a POS terminal management system; wherein:

[0014] The POS terminal uploads the factory serial number, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal to the POS terminal management system;

[0015] The POS terminal periodically uploads the current serial number, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal to the POS terminal management system;

[0016] The POS terminal management system receives and stores the serial number of the POS terminal when it leaves the factory, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal; the POS terminal management system receives the current serial number of the POS terminal, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal, which are uploaded periodically by the POS terminal; the POS terminal management system performs security management on the POS terminal by matching the serial number, card identification code, and program version number of the same POS terminal when it leaves the factory and at present.

[0017] Optionally, if at least one of the factory serial number and program version number corresponding to the same card identification code does not match the current serial number and program version number, the communication of the e-SIM card fixed on the POS terminal is terminated.

[0018] Optionally, the underlying firmware program of the POS terminal periodically reads the current serial number, card identification code and program version number of the POS terminal, carries the read serial number, card identification code and program version number in the heartbeat data, and uploads it to the POS terminal management system.

[0019] In a third aspect, an embodiment of the present disclosure provides a security management method, including:

[0020] The manufacturing execution system acquires and stores production data of the POS terminal during the production process; the production data includes a serial number of the POS terminal, a card identification code of an e-SIM card fixed to the POS terminal, and a program version number of an application installed on the POS terminal;

[0021] When the POS terminal leaves the factory, the manufacturing execution system uploads the serial number, card identification code and program version number in the production data to the POS terminal management system that manages the POS terminal;

[0022] After receiving the serial number, card identification code and program version number, the POS terminal management system stores them as management data of the POS terminal;

[0023] During use, the POS terminal periodically uploads heartbeat data to the POS terminal management system that manages the POS terminal; the heartbeat data includes the current serial number, card identification code and program version number of the POS terminal;

[0024] After receiving the heartbeat data uploaded by the POS terminal, the POS terminal management system matches the heartbeat data with the management data, and performs security management on the POS terminal according to the matching result.

[0025] Optionally, performing security management on the POS terminal according to the matching result includes:

[0026] If the heartbeat data does not match at least one of the card identification code and the program version number corresponding to the same serial number in the management data, the POS terminal management system terminates the communication of the e-SIM card fixed on the POS terminal.

[0027] Optionally, during use, the POS terminal periodically uploads heartbeat data to the POS terminal management system that manages the POS terminal, including:

[0028] The underlying firmware program of the POS terminal periodically reads the current serial number, card identification code and program version number of the POS terminal, carries the read serial number, card identification code and program version number in the heartbeat data, and uploads it to the POS terminal management system.

[0029] In a fourth aspect, an embodiment of the present disclosure provides a security management method, including:

[0030] The POS terminal uploads the factory serial number, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal to the POS terminal management system;

[0031] The POS terminal management system receives and stores the serial number of the POS terminal when it leaves the factory, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal;

[0032] The POS terminal periodically uploads the current serial number, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal to the POS terminal management system;

[0033] The POS terminal management system receives the current serial number of the POS terminal, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed in the POS terminal, which are periodically uploaded by the POS terminal;

[0034] The POS terminal management system performs security management on the POS terminal by matching the factory-exit and current serial numbers, card identification codes and program version numbers of the same POS terminal.

[0035] Optionally, the POS terminal management system performs security management on the POS terminal by matching the factory-exit and current serial numbers, card identification codes, and program version numbers of the same POS terminal, including:

[0036] If at least one of the factory serial number and the program version number corresponding to the same card identification code does not match the current serial number, the POS terminal management system terminates the communication of the e-SIM card fixed on the POS terminal.

[0037] Optionally, the POS terminal periodically uploads the current serial number, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal to the POS terminal management system, including:

[0038] The underlying firmware program of the POS terminal periodically reads the current serial number, card identification code and program version number of the POS terminal, carries the read serial number, card identification code and program version number in the heartbeat data, and uploads it to the POS terminal management system.

[0039] In a fifth aspect, an embodiment of the present disclosure provides a security management method, including:

[0040] Obtaining and storing the factory serial number of the POS terminal, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal;

[0041] Receiving the current serial number of the POS terminal, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal, which are periodically uploaded by the POS terminal;

[0042] By matching the factory serial number, card identification code and program version number of the same POS terminal with the current serial number, card identification code and program version number, the POS terminal is securely managed.

[0043] Optionally, the POS terminal is securely managed by matching the factory-issued and current serial numbers, card identification codes, and program version numbers of the same POS terminal, including:

[0044] If at least one of the factory serial number and the current program version number corresponding to the same card identification code does not match, the communication of the e-SIM card fixed on the POS terminal is terminated.

[0045] In a sixth aspect, an embodiment of the present disclosure provides a security management device, including:

[0046] an acquisition module configured to acquire and store a serial number of the POS terminal when it leaves the factory, a card identification code of the e-SIM card fixed on the POS terminal, and a program version number of an application installed on the POS terminal;

[0047] a receiving module configured to receive a current serial number of the POS terminal, a card identification code of an e-SIM card fixed on the POS terminal, and a program version number of an application installed on the POS terminal, which are periodically uploaded by the POS terminal;

[0048] The management module is configured to perform security management on the POS terminal by matching the serial number, card identification code and program version number of the same POS terminal at the time of leaving the factory and at present.

[0049] Optionally, the management module is implemented as:

[0050] If at least one of the factory serial number and program version number corresponding to the same card identification code does not match, the communication of the e-SIM card fixed on the POS terminal is terminated. In a possible design, the structure of the above-mentioned device includes a memory and a processor, the memory is used to store one or more computer instructions that support the above-mentioned device to execute the above-mentioned corresponding method, and the processor is configured to execute the computer instructions stored in the memory. The above-mentioned device may also include a communication interface for the above-mentioned device to communicate with other devices or communication networks.

[0051] In a seventh aspect, an embodiment of the present disclosure provides an electronic device, including a memory and a processor, wherein the memory is used to store one or more computer instructions that support any of the above-mentioned devices to execute the above-mentioned corresponding methods, and the processor is configured to execute the computer instructions stored in the memory. Any of the above-mentioned devices may also include a communication interface for communicating with other devices or communication networks.

[0052] In an eighth aspect, an embodiment of the present disclosure provides a computer-readable storage medium for storing computer instructions used by any of the above-mentioned devices, which includes computer instructions involved in executing any of the above-mentioned methods.

[0053] In a ninth aspect, an embodiment of the present disclosure provides a computer program product, which includes computer instructions, and when the computer instructions are executed by a processor, they are used to implement the steps of the method described in any of the above aspects.

[0054] The technical solution provided by the embodiments of the present disclosure may have the following beneficial effects:

[0055] This embodiment proposes a security management system. During the production process of POS terminals, the system stores the serial number of the POS terminal, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal as part of the production data in the MES (manufacturing execution system). When the POS terminal leaves the factory, the MES system can upload the serial number of the POS terminal, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal to the POS terminal management system that manages the POS terminal. If the serial number or application on the POS terminal is cleared and other serial numbers or other applications are written, then the serial number and / or program version number in the heartbeat data uploaded each time is inconsistent with the serial number and / or program version number corresponding to the same card identification code stored in the POS terminal management system, and it can be determined that the POS terminal has a security problem.

[0056] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the embodiments of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Other features, purposes and advantages of the embodiments of the present disclosure will become more apparent through the following detailed description of non-limiting embodiments in conjunction with the accompanying drawings. In the accompanying drawings:

[0058] Figure 1 A structural block diagram of a security management system according to an embodiment of the present disclosure is shown.

[0059] Figure 2 A structural block diagram of a safety management system according to another embodiment of the present disclosure is shown.

[0060] Figure 3 A flowchart of a security management method according to an embodiment of the present disclosure is shown.

[0061] Figure 4 A flowchart of a security management method according to another embodiment of the present disclosure is shown.

[0062] Figure 5 A flowchart of a security management method according to yet another embodiment of the present disclosure is shown.

[0063] Figure 6 A structural block diagram of a security management device according to an embodiment of the present disclosure is shown.

[0064] Figure 7 It is a structural diagram of a computer system suitable for implementing a security management method according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0065] Hereinafter, exemplary embodiments of the present disclosure will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily implement them. In addition, for the sake of clarity, parts not related to the description of the exemplary embodiments are omitted in the accompanying drawings.

[0066] In the embodiments of the present disclosure, it should be understood that terms such as "including" or "having" are intended to indicate the existence of features, numbers, steps, behaviors, components, parts, or a combination thereof disclosed in this specification, and are not intended to exclude the possibility of one or more other features, numbers, steps, behaviors, components, parts, or a combination thereof existing or being added.

[0067] It should also be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present disclosure may be combined with each other. The embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0068] At present, most POS products on the market use e-SIM cards for communication. The e-SIM card is fixed on the mainboard and cannot be replaced without disassembling the machine. Disassembling the machine will trigger a security alarm and the POS machine cannot be used. It is precisely because the e-SIM card is placed on the mainboard inside the machine body and has high security. Therefore, by utilizing this feature, the present disclosure provides a technical solution to prevent machine cutting by using an e-SIM card. By using the hardware means of the e-SIM card, a POS machine security protection is added without increasing the cost.

[0069] When the POS machine is produced, the ICCID of the e-SIM card, the machine's TUSN serial number, and the program version number are uploaded to the MES system and bound to a one-to-one correspondence. The MES system exports data, and the POS terminal management system imports data. After leaving the factory, the underlying firmware program of the machine initiates the upload of the ICCID, TUSN serial number, and program version number to the POS terminal management system at intervals. When the uploaded data is inconsistent with the data stored in the POS terminal management system, the correspondence is broken, and the communication of the e-SIM card is immediately terminated. In this way, if there is an action of cutting the machine, writing a new program, or a new TUSN serial number, the POS will terminate the communication and cannot be used normally. The manufacturer's backend can also bind the one-to-one correspondence between the ICCID and the machine's TUSN serial number and program version number, which will not affect the after-sales maintenance process.

[0070] Figure 1 A structural block diagram of a security management system according to an embodiment of the present disclosure is shown as follows: Figure 1 As shown, the security management system includes: a POS terminal, a manufacturing execution system and a POS terminal management system; wherein,

[0071] The manufacturing execution system stores production data of the POS terminal during the production process; the production data includes a serial number of the POS terminal, a card identification code of an e-SIM card fixed to the POS terminal, and a program version number of an application installed in the POS terminal;

[0072] During use, the POS terminal periodically uploads heartbeat data to the POS terminal management system that manages the POS terminal; the heartbeat data includes the current serial number, card identification code and program version number of the POS terminal;

[0073] After the production of the POS terminal is completed, the POS terminal management system obtains the serial number, card identification code and program version number of the managed POS terminal when it leaves the factory from the manufacturing execution system, and stores them as management data; after receiving the heartbeat data uploaded by the POS terminal, the POS terminal management system matches the heartbeat data with the management data, and performs security management of the POS terminal based on the matching result.

[0074] As mentioned above, the current method of POS anti-cutting machines is to control them through application signatures and machine TUSN serial numbers. The signature is equivalent to a secret key. The application can only be installed on a machine with a written TUSN serial number through the signature. The signature and TUSN serial number match and belong to the same payment company. If the application is not signed or is not from the same payment company as the TUSN serial number, it cannot be installed. This method is equivalent to encryption through software methods. There is a certain possibility of cracking. When the POS machine TUSN serial number and application are all erased and become a blank machine, the TUSN serial number and application of other companies can be written, resulting in the loss of the machine and the risk of financial crime.

[0075] To this end, this embodiment proposes a security management system. During the production process of the POS terminal, the system stores the serial number of the POS terminal, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal as part of the production data in the MES (manufacturing execution system). When the POS terminal leaves the factory, the MES system can upload the serial number of the POS terminal, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal to the POS terminal management system that manages the POS terminal. The MES system is the system of the manufacturer of the POS terminal, and the POS terminal management system is the management system of the operator of the POS terminal. The MES system and the POS terminal management system are different systems and belong to different entities. The operator can customize POS terminals in batches from the manufacturer. When the manufacturer produces and ships the corresponding batch of POS terminals, the serial number of the batch of POS terminals, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal can be uploaded in batches to the POS terminal management system of the operator through the MES system.

[0076] After the operator distributes the POS terminal to the user, for security reasons, the POS terminal will periodically upload heartbeat data to the POS terminal management system, and the heartbeat data carries the serial number, card identification code and program version number of the POS terminal. It should be noted that the POS terminal is welded with an e-SIM card, and the card identification code ICCID of the e-SIM card on different POS terminals is different. The e-SIM card is welded on the motherboard of the POS terminal and cannot be replaced without disassembling the machine. Disassembling the machine will trigger a security alarm and the POS terminal cannot be used. Therefore, the card identification code of the e-SIM card fixed on the POS terminal will not change whether it is shipped from the factory or during use.

[0077] If the serial number or application on the POS terminal is cleared and other serial numbers or other applications are written, the serial number and / or program version number in the heartbeat data uploaded each time will not match the serial number and / or program version number corresponding to the same card identification code stored in the POS terminal management system, then it can be determined that the POS terminal has a security issue.

[0078] In some embodiments, when the POS terminal leaves the factory, the manufacturing execution system uploads the serial number, card identification code and program version number in the production data of the POS terminal to the POS terminal management system that manages the POS terminal.

[0079] In some embodiments, if the heartbeat data does not match at least one of the card identification code and the program version number corresponding to the same serial number in the management data, the communication of the e-SIM card fixed on the POS terminal is terminated.

[0080] The communication traffic of the e-SIM card can be controlled by the POS terminal management system. That is to say, when the POS terminal uses the e-SIM card for communication, it needs to obtain the traffic through the POS terminal management system. If the POS terminal management system determines that there is a security problem with the POS terminal, it can terminate the communication of the e-SIM card by not allowing the e-SIM card to obtain traffic, thereby making the POS terminal unable to be used anymore.

[0081] In some embodiments, the underlying firmware program of the POS terminal periodically reads the current serial number, card identification code and program version number of the POS terminal, carries the read serial number, card identification code and program version number in the heartbeat data, and uploads it to the POS terminal management system.

[0082] In this embodiment, the POS terminal can be installed with an underlying firmware program when it leaves the factory. The underlying firmware program can be started after the POS terminal is turned on, and heartbeat data can be uploaded periodically. The purpose of uploading heartbeat data is to inform the POS terminal management system whether the POS terminal is currently in use. For security reasons, the underlying firmware program can read the serial number written on the POS terminal, the card identification code of the e-SIM card, and the program version number of the application, and then carry it in the heartbeat data and report it to the POS terminal management system. In this way, the POS terminal management system can promptly discover unsafe problems such as the POS terminal being cut off.

[0083] Figure 2 A structural block diagram of a security management system according to another embodiment of the present disclosure is shown as follows: Figure 2 As shown, the security management system includes: a POS terminal and a POS terminal management system; wherein,

[0084] The POS terminal uploads the factory serial number, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal to the POS terminal management system;

[0085] The POS terminal periodically uploads the current serial number, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal to the POS terminal management system;

[0086] The POS terminal management system receives and stores the serial number of the POS terminal when it leaves the factory, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal; the POS terminal management system receives the current serial number of the POS terminal, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal, which are uploaded periodically by the POS terminal; the POS terminal management system performs security management on the POS terminal by matching the serial number, card identification code, and program version number of the same POS terminal when it leaves the factory and at present.

[0087] In this embodiment, when the POS terminal leaves the factory, the POS terminal manufacturer or the operator of the POS terminal can obtain the serial number of the POS terminal, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal from the POS terminal, and upload them to the POS terminal management system. The POS terminal management system can be the management system of the operator of the POS terminal. Of course, it can be understood that if the POS terminal management system is uploaded by the operator, the operator can upload the serial number written on the POS terminal when leaving the factory, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal to the POS terminal management system before distributing the POS terminal to the user.

[0088] After the operator distributes the POS terminal to the user, for security reasons, the POS terminal will periodically upload heartbeat data to the POS terminal management system, and the heartbeat data carries the serial number, card identification code and program version number of the POS terminal. It should be noted that the POS terminal is welded with an e-SIM card, and the card identification code of the e-SIM card on different POS terminals is different. The e-SIM card is welded on the motherboard of the POS terminal and cannot be replaced without disassembling the machine. Disassembling the machine will trigger a security alarm and the POS terminal cannot be used. Therefore, the card identification code of the e-SIM card fixed on the POS terminal will not change whether it is shipped from the factory or during use.

[0089] If the serial number or application on the POS terminal is cleared and other serial numbers or other applications are written, the serial number and / or program version number in the heartbeat data uploaded each time will not match the serial number and / or program version number corresponding to the same card identification code stored in the POS terminal management system, then it can be determined that the POS terminal has a security issue.

[0090] In some embodiments, if at least one of the factory serial number and program version number corresponding to the same card identification code does not match the current serial number and program version number, the communication of the e-SIM card fixed on the POS terminal is terminated.

[0091] The communication traffic of the e-SIM card can be controlled by the POS terminal management system. That is to say, when the POS terminal uses the e-SIM card for communication, it needs to obtain the traffic through the POS terminal management system. If the POS terminal management system determines that there is a security problem with the POS terminal, it can terminate the communication of the e-SIM card by not allowing the e-SIM card to obtain traffic, thereby making the POS terminal unable to be used anymore.

[0092] In some embodiments, the underlying firmware program of the POS terminal periodically reads the current serial number, card identification code and program version number of the POS terminal, carries the read serial number, card identification code and program version number in the heartbeat data, and uploads it to the POS terminal management system.

[0093] In this embodiment, the POS terminal can be installed with an underlying firmware program when it leaves the factory. The underlying firmware program can be started after the POS terminal is turned on, and heartbeat data can be uploaded periodically. The purpose of uploading heartbeat data is to inform the POS terminal management system whether the POS terminal is currently in use. For security reasons, the underlying firmware program can read the serial number written on the POS terminal, the card identification code of the e-SIM card, and the program version number of the application, and then carry it in the heartbeat data and report it to the POS terminal management system. In this way, the POS terminal management system can promptly discover unsafe problems such as the POS terminal being cut off.

[0094] Figure 3 A flowchart of a security management method according to an embodiment of the present disclosure is shown. Figure 3 As shown, the safety management method comprises the following steps:

[0095] In step S301, the manufacturing execution system acquires and stores production data of the POS terminal in the production process; the production data includes the serial number of the POS terminal, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal;

[0096] In step S302, when the POS terminal leaves the factory, the manufacturing execution system uploads the serial number, card identification code and program version number in the production data to the POS terminal management system that manages the POS terminal;

[0097] In step S303, after receiving the serial number, card identification code and program version number, the POS terminal management system stores them as management data of the POS terminal;

[0098] In step S304, the POS terminal periodically uploads heartbeat data to the POS terminal management system that manages the POS terminal during use; the heartbeat data includes the current serial number, card identification code and program version number of the POS terminal;

[0099] In step S305, after receiving the heartbeat data uploaded by the POS terminal, the POS terminal management system matches the heartbeat data with the management data, and performs security management on the POS terminal according to the matching result.

[0100] As mentioned above, the current method of POS anti-cutting machines is to control them through application signatures and machine TUSN serial numbers. The signature is equivalent to a secret key. The application can only be installed on a machine with a written TUSN serial number through the signature. The signature and TUSN serial number match and belong to the same payment company, that is, the same operator. If the application is not signed or is not from the same payment company as the TUSN serial number, it cannot be installed. This method is equivalent to encryption through software methods. There is a certain possibility of cracking. When the TUSN serial number and application of the POS machine are all erased and it becomes a blank machine, the TUSN serial number and application of other companies can be written, resulting in the loss of the machine and the risk of financial crime.

[0101] To this end, this embodiment proposes a security management method. In the production process of the POS terminal, the method stores the serial number of the POS terminal, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal as part of the production data to the MES (manufacturing execution system). When the POS terminal leaves the factory, the MES system can upload the serial number of the POS terminal, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal to the POS terminal management system that manages the POS terminal. The MES system is the system of the manufacturer of the POS terminal, and the POS terminal management system is the management system of the operator of the POS terminal. The MES system and the POS terminal management system are different systems and belong to different entities. The operator can customize POS terminals in batches from the manufacturer. When the manufacturer produces and ships the corresponding batch of POS terminals, the serial number of the batch of POS terminals, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal can be uploaded in batches to the POS terminal management system of the operator through the MES system.

[0102] After the operator distributes the POS terminal to the user, for security reasons, the POS terminal will periodically upload heartbeat data to the POS terminal management system, and the heartbeat data carries the serial number, card identification code and program version number of the POS terminal. It should be noted that the POS terminal is welded with an e-SIM card, and the card identification code of the e-SIM card on different POS terminals is different. The e-SIM card is welded on the motherboard of the POS terminal and cannot be replaced without disassembling the machine. Disassembling the machine will trigger a security alarm and the POS terminal cannot be used. Therefore, the card identification code of the e-SIM card fixed on the POS terminal will not change whether it is shipped from the factory or during use.

[0103] If the serial number or application on the POS terminal is cleared and other serial numbers or other applications are written, the serial number and / or program version number in the heartbeat data uploaded each time will not match the serial number and / or program version number corresponding to the same card identification code stored in the POS terminal management system, then it can be determined that the POS terminal has a security issue.

[0104] In some embodiments, the performing security management on the POS terminal according to the matching result includes:

[0105] If the heartbeat data does not match at least one of the card identification code and the program version number corresponding to the same serial number in the management data, the POS terminal management system terminates the communication of the e-SIM card fixed on the POS terminal.

[0106] The communication traffic of the e-SIM card can be controlled by the POS terminal management system. That is to say, when the POS terminal uses the e-SIM card for communication, it needs to obtain the traffic through the POS terminal management system. If the POS terminal management system determines that there is a security problem with the POS terminal, it can terminate the communication of the e-SIM card by not allowing the e-SIM card to obtain traffic, thereby making the POS terminal unable to be used anymore.

[0107] In some embodiments, during use, the POS terminal periodically uploads heartbeat data to the POS terminal management system that manages the POS terminal, including:

[0108] The underlying firmware program of the POS terminal periodically reads the current serial number, card identification code and program version number of the POS terminal, carries the read serial number, card identification code and program version number in the heartbeat data, and uploads it to the POS terminal management system.

[0109] In this embodiment, the POS terminal can be installed with an underlying firmware program when it leaves the factory. The underlying firmware program can be started after the POS terminal is turned on, and heartbeat data can be uploaded periodically. The purpose of uploading heartbeat data is to inform the POS terminal management system whether the POS terminal is currently in use. For security reasons, the underlying firmware program can read the serial number written on the POS terminal, the card identification code of the e-SIM card, and the program version number of the application, and then carry it in the heartbeat data and report it to the POS terminal management system. In this way, the POS terminal management system can promptly discover unsafe problems such as the POS terminal being cut off.

[0110] Figure 4 A flowchart of a security management method according to another embodiment of the present disclosure is shown. Figure 4 As shown, the safety management method comprises the following steps:

[0111] In step S401, the POS terminal uploads the factory serial number, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal to the POS terminal management system;

[0112] In step S402, the POS terminal management system receives and stores the serial number of the POS terminal when it leaves the factory, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal;

[0113] In step S403, the POS terminal periodically uploads the current serial number, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal to the POS terminal management system;

[0114] In step S404, the POS terminal management system receives the current serial number of the POS terminal, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed in the POS terminal, which are periodically uploaded by the POS terminal;

[0115] In step S405, the POS terminal management system performs security management on the POS terminal by matching the factory-issued and current serial numbers, card identification codes, and program version numbers of the same POS terminal.

[0116] In this embodiment, when the POS terminal leaves the factory, the POS terminal manufacturer or the operator of the POS terminal can obtain the serial number of the POS terminal, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal from the POS terminal, and upload them to the POS terminal management system. The POS terminal management system can be the management system of the operator of the POS terminal. Of course, it can be understood that if the POS terminal management system is uploaded by the operator, the operator can upload the serial number written on the POS terminal when leaving the factory, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal to the POS terminal management system before distributing the POS terminal to the user.

[0117] After the operator distributes the POS terminal to the user, for security reasons, the POS terminal will periodically upload heartbeat data to the POS terminal management system, and the heartbeat data carries the serial number, card identification code and program version number of the POS terminal. It should be noted that the POS terminal is welded with an e-SIM card, and the card identification code of the e-SIM card on different POS terminals is different. The e-SIM card is welded on the motherboard of the POS terminal and cannot be replaced without disassembling the machine. Disassembling the machine will trigger a security alarm and the POS terminal cannot be used. Therefore, the card identification code of the e-SIM card fixed on the POS terminal will not change whether it is shipped from the factory or during use.

[0118] If the serial number or application on the POS terminal is cleared and other serial numbers or other applications are written, the serial number and / or program version number in the heartbeat data uploaded each time will not match the serial number and / or program version number corresponding to the same card identification code stored in the POS terminal management system, then it can be determined that the POS terminal has a security issue.

[0119] In some embodiments, the POS terminal management system performs security management on the POS terminal by matching the factory-exit and current serial numbers, card identification codes, and program version numbers of the same POS terminal, including:

[0120] If at least one of the factory serial number and the program version number corresponding to the same card identification code does not match the current serial number, the POS terminal management system terminates the communication of the e-SIM card fixed on the POS terminal.

[0121] The communication traffic of the e-SIM card can be controlled by the POS terminal management system. That is to say, when the POS terminal uses the e-SIM card for communication, it needs to obtain the traffic through the POS terminal management system. If the POS terminal management system determines that there is a security problem with the POS terminal, it can terminate the communication of the e-SIM card by not allowing the e-SIM card to obtain traffic, thereby making the POS terminal unable to be used anymore.

[0122] In some embodiments, the POS terminal periodically uploads the current serial number, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal to the POS terminal management system, including:

[0123] The underlying firmware program of the POS terminal periodically reads the current serial number, card identification code and program version number of the POS terminal, carries the read serial number, card identification code and program version number in the heartbeat data, and uploads it to the POS terminal management system.

[0124] In this embodiment, the POS terminal can be installed with an underlying firmware program when it leaves the factory. The underlying firmware program can be started after the POS terminal is turned on, and heartbeat data can be uploaded periodically. The purpose of uploading heartbeat data is to inform the POS terminal management system whether the POS terminal is currently in use. For security reasons, the underlying firmware program can read the serial number written on the POS terminal, the card identification code of the e-SIM card, and the program version number of the application, and then carry it in the heartbeat data and report it to the POS terminal management system. In this way, the POS terminal management system can promptly discover unsafe problems such as the POS terminal being cut off.

[0125] Figure 5 A flowchart of a safety management method according to another embodiment of the present disclosure is shown. Figure 5 As shown, the safety management method comprises the following steps:

[0126] In step S501, the serial number of the POS terminal when it leaves the factory, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal are obtained and stored;

[0127] In step S502, receiving the current serial number of the POS terminal, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal, which are periodically uploaded by the POS terminal;

[0128] In step S503, the POS terminal is securely managed by matching the factory serial number, card identification code and program version number of the same POS terminal with the current serial number, card identification code and program version number.

[0129] In this embodiment, the security management method can be executed on the POS terminal management system. When the POS terminal leaves the factory, the POS terminal manufacturer or the operator of the POS terminal can obtain the serial number of the POS terminal, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal from the POS terminal, and upload them to the POS terminal management system. The POS terminal management system can be the management system of the operator of the POS terminal. Of course, it can be understood that if the POS terminal management system is uploaded by the operator, the operator can upload the factory serial number written on the POS terminal, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal to the POS terminal management system before distributing the POS terminal to the user.

[0130] After the operator distributes the POS terminal to the user, for security reasons, the POS terminal will periodically upload heartbeat data to the POS terminal management system, and the heartbeat data carries the serial number, card identification code and program version number of the POS terminal. It should be noted that the POS terminal is welded with an e-SIM card, and the card identification code of the e-SIM card on different POS terminals is different. The e-SIM card is welded on the motherboard of the POS terminal and cannot be replaced without disassembling the machine. Disassembling the machine will trigger a security alarm and the POS terminal cannot be used. Therefore, the card identification code of the e-SIM card fixed on the POS terminal will not change whether it is shipped from the factory or during use.

[0131] If the serial number or application on the POS terminal is cleared and other serial numbers or other applications are written, the serial number and / or program version number in the heartbeat data uploaded each time will not match the serial number and / or program version number corresponding to the same card identification code stored in the POS terminal management system, then it can be determined that the POS terminal has a security issue.

[0132] In some embodiments, the POS terminal is securely managed by matching the factory serial number, card identification code and program version number of the same POS terminal with the current serial number, card identification code and program version number, including:

[0133] If at least one of the factory serial number and the current program version number corresponding to the same card identification code does not match, the communication of the e-SIM card fixed on the POS terminal is terminated.

[0134] The communication traffic of the e-SIM card can be controlled by the POS terminal management system. That is to say, when the POS terminal uses the e-SIM card for communication, it needs to obtain the traffic through the POS terminal management system. If the POS terminal management system determines that there is a security problem with the POS terminal, it can terminate the communication of the e-SIM card by not allowing the e-SIM card to obtain traffic, thereby making the POS terminal unable to be used anymore.

[0135] The following are embodiments of the apparatus of the present disclosure, which can be used to execute embodiments of the method of the present disclosure.

[0136] Figure 6 FIG. 1 is a block diagram showing a security management device according to an embodiment of the present disclosure. The device can be implemented as part or all of an electronic device through software, hardware, or a combination of both. Figure 6 As shown, the security management device includes:

[0137] The acquisition module 601 is configured to acquire and store the serial number of the POS terminal when it leaves the factory, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal;

[0138] The receiving module 602 is configured to receive the current serial number of the POS terminal, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal, which are uploaded periodically by the POS terminal;

[0139] The management module 603 is configured to perform security management on the POS terminal by matching the factory-issued and current serial numbers, card identification codes and program version numbers of the same POS terminal.

[0140] In this embodiment, the security management device may be located in the POS terminal management system. When the POS terminal leaves the factory, the POS terminal manufacturer or the operator of the POS terminal may obtain the serial number of the POS terminal, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal from the POS terminal, and upload them to the POS terminal management system. The POS terminal management system may be the management system of the operator of the POS terminal. Of course, it is understandable that if the POS terminal management system is uploaded by the operator, the operator may upload the factory serial number written on the POS terminal, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal to the POS terminal management system before distributing the POS terminal to the user.

[0141] After the operator distributes the POS terminal to the user, for security reasons, the POS terminal will periodically upload heartbeat data to the POS terminal management system, and the heartbeat data carries the serial number, card identification code and program version number of the POS terminal. It should be noted that the POS terminal is welded with an e-SIM card, and the card identification code of the e-SIM card on different POS terminals is different. The e-SIM card is welded on the motherboard of the POS terminal and cannot be replaced without disassembling the machine. Disassembling the machine will trigger a security alarm and the POS terminal cannot be used. Therefore, the card identification code of the e-SIM card fixed on the POS terminal will not change whether it is shipped from the factory or during use.

[0142] If the serial number or application on the POS terminal is cleared and other serial numbers or other applications are written, the serial number and / or program version number in the heartbeat data uploaded each time will not match the serial number and / or program version number corresponding to the same card identification code stored in the POS terminal management system, then it can be determined that the POS terminal has a security issue.

[0143] In some embodiments, the management module is implemented as:

[0144] If at least one of the factory serial number and the current program version number corresponding to the same card identification code does not match, the communication of the e-SIM card fixed on the POS terminal is terminated.

[0145] The communication traffic of the e-SIM card can be controlled by the POS terminal management system. That is to say, when the POS terminal uses the e-SIM card for communication, it needs to obtain the traffic through the POS terminal management system. If the POS terminal management system determines that there is a security problem with the POS terminal, it can terminate the communication of the e-SIM card by not allowing the e-SIM card to obtain traffic, thereby making the POS terminal unable to be used anymore.

[0146] The present disclosure also discloses an electronic device, which includes a memory and a processor; wherein:

[0147] The memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement any of the above method steps.

[0148] Figure 7 It is a structural diagram of a computer system suitable for implementing a security management method according to an embodiment of the present disclosure.

[0149] like Figure 7As shown, the computer system 700 includes a processing unit 701, which can perform various processes in the above-mentioned embodiments according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage part 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the computer system 700 are also stored. The processing unit 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0150] The following components are connected to the I / O interface 705: an input section 706 including a keyboard, a mouse, etc.; an output section 707 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, a modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 710 as needed, so that a computer program read therefrom is installed into the storage section 708 as needed. Among them, the processing unit 701 can be implemented as a processing unit such as a CPU, a GPU, a TPU, an FPGA, an NPU, etc.

[0151] In particular, according to an embodiment of the present disclosure, the method described above can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program tangibly contained on a readable medium thereof, and the computer program includes a program code for executing the data transmission method. In such an embodiment, the computer program can be downloaded and installed from a network through the communication part 709, and / or installed from a removable medium 711.

[0152] The embodiment of the present disclosure also discloses a computer program product, which includes a computer program / instruction, and when the computer program / instruction is executed by a processor, any of the above method steps is implemented.

[0153] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the road map or block diagram can represent a part of a module, program segment or code, and the part of the module, program segment or code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a different order from the order marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0154] The units or modules involved in the embodiments described in the present disclosure may be implemented by software or hardware. The units or modules described may also be set in a processor, and the names of these units or modules do not constitute limitations on the units or modules themselves in some cases.

[0155] As another aspect, the embodiments of the present disclosure further provide a computer-readable storage medium, which may be a computer-readable storage medium included in the device described in the above-mentioned embodiment; or a computer-readable storage medium that exists independently and is not assembled into the device. The computer-readable storage medium stores one or more programs, and the programs are used by one or more processors to execute the methods described in the embodiments of the present disclosure.

[0156] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the inventive concept. For example, the above features are replaced with (but not limited to) technical features with similar functions disclosed in the embodiments of the present disclosure.

Claims

1. A safety management system, comprising: POS terminals, manufacturing execution systems and POS terminal management systems; among them, The manufacturing execution system stores production data of the POS terminal during the production process; the production data includes a serial number of the POS terminal, a card identification code of an e-SIM card fixed to the POS terminal, and a program version number of an application installed in the POS terminal; During use, the POS terminal periodically uploads heartbeat data to the POS terminal management system that manages the POS terminal; the heartbeat data includes the current serial number, card identification code and program version number of the POS terminal; After the production of the POS terminal is completed, the POS terminal management system obtains the serial number, card identification code and program version number of the managed POS terminal when it leaves the factory from the manufacturing execution system, and stores them as management data; after receiving the heartbeat data uploaded by the POS terminal, the POS terminal management system matches the heartbeat data with the management data, and performs security management of the POS terminal based on the matching result.

2. The system according to claim 1, wherein: When the POS terminal leaves the factory, the manufacturing execution system uploads the serial number, card identification code and program version number in the production data of the POS terminal to the POS terminal management system that manages the POS terminal.

3. A safety management system, comprising: POS terminal and POS terminal management system; among which, The POS terminal uploads the factory serial number, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal to the POS terminal management system; The POS terminal periodically uploads the current serial number, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal to the POS terminal management system; The POS terminal management system receives and stores the serial number of the POS terminal when it leaves the factory, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal; the POS terminal management system receives the current serial number of the POS terminal, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal, which are uploaded periodically by the POS terminal; the POS terminal management system performs security management on the POS terminal by matching the serial number, card identification code, and program version number of the same POS terminal when it leaves the factory and at present.

4. A safety management method, comprising: The manufacturing execution system acquires and stores the production data of the POS terminals during the production process; The production data includes the serial number of the POS terminal, the card identification code of the e-SIM card fixed to the POS terminal, and the program version number of the application installed in the POS terminal; When the POS terminal leaves the factory, the manufacturing execution system uploads the serial number, card identification code and program version number in the production data to the POS terminal management system that manages the POS terminal; After receiving the serial number, card identification code and program version number, the POS terminal management system stores them as management data of the POS terminal; During use, the POS terminal periodically uploads heartbeat data to the POS terminal management system that manages the POS terminal; the heartbeat data includes the current serial number, card identification code and program version number of the POS terminal; After receiving the heartbeat data uploaded by the POS terminal, the POS terminal management system matches the heartbeat data with the management data, and performs security management on the POS terminal according to the matching result.

5. A safety management method, comprising: The POS terminal uploads the factory serial number, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal to the POS terminal management system; The POS terminal management system receives and stores the serial number of the POS terminal when it leaves the factory, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal; The POS terminal periodically uploads the current serial number, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal to the POS terminal management system; The POS terminal management system receives the current serial number of the POS terminal, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed in the POS terminal, which are periodically uploaded by the POS terminal; The POS terminal management system performs security management on the POS terminal by matching the factory-exit and current serial numbers, card identification codes and program version numbers of the same POS terminal.

6. A safety management method, comprising: Obtaining and storing the factory serial number of the POS terminal, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal; Receiving the current serial number of the POS terminal, the card identification code of the e-SIM card fixed on the POS terminal, and the program version number of the application installed on the POS terminal, which are periodically uploaded by the POS terminal; By matching the factory serial number, card identification code and program version number of the same POS terminal with the current serial number, card identification code and program version number, the POS terminal is securely managed.

7. A security management device, comprising: an acquisition module configured to acquire and store a serial number of the POS terminal when it leaves the factory, a card identification code of the e-SIM card fixed on the POS terminal, and a program version number of an application installed on the POS terminal; a receiving module configured to receive a current serial number of the POS terminal, a card identification code of an e-SIM card fixed on the POS terminal, and a program version number of an application installed on the POS terminal, which are periodically uploaded by the POS terminal; The management module is configured to perform security management on the POS terminal by matching the serial number, card identification code and program version number of the same POS terminal at the time of leaving the factory and at present.

8. An electronic device comprising a memory and a processor; wherein: The memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the steps of the method of claim 7.

9. A computer-readable storage medium having computer instructions stored thereon, wherein: When the computer instructions are executed by a processor, the steps of the method according to claim 7 are implemented.

10. A computer program product comprising a computer program / instructions, which implement the steps of the method according to claim 7 when executed by a processor.

Images