Data Encryption Communication Method and System Applied to Intelligent Cash Registers

Abstract

The present invention relates to the field of encrypted communication technologies, and particularly to a data encryption communication method and system applied to an intelligent cash register. The method includes the following steps: collecting user touch data and device hardware fingerprints, and performing high-dimensional feature fusion encoding to obtain a combined identity credential; obtaining the original key negotiation protocol and transmission metadata of the peer server, and performing multi-logical path mapping and channel encryption configuration to obtain distributed ciphertext channel parameters; encrypting the distributed ciphertext channel parameters and the corresponding transmission metadata, and then performing block content packaging and node hash calculation to obtain an audit chain hash block; performing homomorphic encryption processing on the obtained real-time transaction data to obtain a homomorphic ciphertext to be transmitted; performing communication transmission anomaly detection on the information transmission data collected in real time, and triggering dynamic key renegotiation to improve the communication feedback ability. The present invention helps to improve the overall security and stability of data encryption communication between the cash register and the backend server.

Description

Technical Field

[0001] The present invention relates to the technical field of encrypted communication, and in particular to a data encryption communication method and system applied to an intelligent cash register. Background Art

[0002] In the intelligent cash register service, the cash register terminal not only needs to implement local commodity identification and payment functions, but also needs to perform real-time data communication with the backend server to synchronize sensitive data such as transaction information, inventory status, user identity, and payment vouchers. In this communication process, data encryption becomes an important technical means to ensure transaction security and user privacy. Traditional data encryption communication methods are mainly implemented based on symmetric encryption algorithms (such as AES) or asymmetric encryption algorithms (such as RSA). When applied in an intelligent cash register system, the initial authentication and data protection between the cash register terminal and the server are usually achieved through a static key distribution mechanism. However, in the actual deployment process, since intelligent cash registers are usually deployed in commercial places with dense crowds and complex networks, their communication environment faces high risks such as man-in-the-middle attacks, data hijacking, and signaling tampering. Traditional encryption mechanisms rely on static keys or long-term valid certificates and cannot effectively defend against data cracking problems caused by key leakage. Once the key is intercepted or copied, attackers can obtain cash register data for a long time, resulting in serious information leakage and financial risks. Secondly, in the terminal identity authentication link, traditional methods lack the joint verification of device uniqueness and dynamic behavior and are difficult to identify forged terminals or illegal access behaviors, resulting in the system being easily accessed by false devices. Summary of the Invention

[0003] Based on this, it is necessary for the present invention to provide a data encryption communication method and system applied to an intelligent cash register to solve at least one of the above technical problems.

[0004] To achieve the above object, a data encryption communication method applied to an intelligent cash register is applied to an intelligent cash register terminal, including a sensor module, a power module, a controller, and a communication transmission module electrically connected to the controller, wherein the sensor module and the power module are both electrically connected to the controller; the data encryption communication method applied to the intelligent cash register includes the following steps:

[0005] Step S1: Collect user touch data and device hardware fingerprints, and perform high-dimensional feature fusion coding on the device hardware fingerprints and the user touch data to obtain a joint identity credential;

[0006] Step S2: Obtain the original key negotiation protocol and transmission metadata of the peer server, perform dynamic key negotiation using the joint identity credential and the original key negotiation protocol of the peer server to obtain a session key set; perform multi-logical path mapping and channel encryption configuration based on the session key set to obtain distributed ciphertext channel parameters;

[0007] Step S3: Encrypt the distributed ciphertext channel parameters and the corresponding transmission metadata, and write them into a preset private blockchain node. Then perform block content packaging and node hash calculation to obtain an audit chain hash block;

[0008] Step S4: Perform homomorphic encryption processing on the obtained real-time transaction data based on the audit chain hash block and the session key set to obtain the homomorphic ciphertext to be transmitted, and load the homomorphic ciphertext to be transmitted into the cash register communication transmission module to perform information transmission;

[0009] Step S5: Perform communication transmission anomaly detection on the real-time collected information transmission data. When the anomaly detection result exceeds the preset key rotation trigger threshold set, trigger dynamic key renegotiation, and iteratively execute Step S2 to Step S5 until the anomaly detection result returns within the key rotation trigger threshold set.

[0010] Optionally, Step S1 is specifically as follows:

[0011] Step S11: Obtain touch trajectory data, click timing data, and pressure change data during the user's operation through the sensor module, so as to construct user touch data;

[0012] Step S12: Call the security hardware identification interface embedded in the cash register to read the hardware features of the device's motherboard number, power supply identification code, terminal fingerprint, MAC address, and startup boot code, and construct device hardware fingerprint data according to the preset hierarchical identification mapping rules;

[0013] Step S13: Perform heterogeneous feature joint encoding on the user touch data and the device hardware fingerprint data to obtain high-dimensional fusion encoding data;

[0014] Step S14: Perform variational regularization processing and noise feature suppression on the high-dimensional fusion encoding data, and calculate the credibility index of each fusion dimension. Write the fusion vectors with credibility greater than the set credible threshold of 0.82 into the preset voucher structure body to obtain the initial body of the joint identity voucher;

[0015] Step S15: Perform hash signature on the initial body of the joint identity voucher and append a timestamp, the corresponding preset terminal number, and a perturbation seed generated by a preset pseudo-random function to obtain the joint identity voucher.

[0016] Optionally, Step S13 is specifically as follows:

[0017] Step S131: Perform normalization processing on the user touch data and the device hardware fingerprint data respectively to obtain a touch feature tensor and a hardware feature tensor;

[0018] Step S132: Perform heterogeneous tensor dimension standardization transformation on the touch feature tensor and the hardware feature tensor to obtain a standardized touch feature tensor and a standardized hardware feature tensor;

[0019] Step S133: Perform feature alignment and interaction correlation analysis on the standardized touch feature tensor and the standardized hardware feature tensor, extract the interaction correlation mapping matrix, and perform a linear weighted fusion operation based on the interaction correlation mapping matrix to generate a preliminary fusion vector;

[0020] Step S134: Perform stability enhancement and normalization re-encoding on the preliminary fusion vector to obtain high-dimensional fusion encoded data.

[0021] Optionally, step S14 is specifically as follows:

[0022] Step S141: Perform feature distribution modeling on the high-dimensional fusion encoded data to generate distribution residual parameters;

[0023] Step S142: Filter and mask the dimensions in the high-dimensional fusion encoded data that are higher than the mean of the residual distribution variance according to the distribution residual parameters. At the same time, perform sliding window entropy analysis to identify the dimensions with short-term surges in the high-dimensional fusion encoded data, mark the dimensions with short-term surges as noise channels, and set the weights of the noise channels to 0, thereby obtaining a stable encoded vector;

[0024] Step S143: Calculate the credibility index of each fusion dimension in the stable encoded vector to obtain a credibility vector;

[0025] Step S144: Perform mapping screening on the corresponding positions of the credibility vector and the stable encoded vector, retain all dimensions with a credibility ≥ 0.82, and construct a credible fusion vector based on the retained dimensions;

[0026] Step S145: Fill the credible fusion vector into a predefined credential structure body to obtain an initial joint identity credential body.

[0027] Optionally, the dynamic key negotiation in step S2 is specifically as follows:

[0028] Receive the original key negotiation protocol fragment and transmission metadata from the peer server, extract the negotiation parameter field, and perform protocol content integrity verification in combination with the obtained current session timestamp to obtain a negotiation request structure body;

[0029] Extract the terminal number and perturbation seed based on the joint identity credential, and perform a two-way perturbation function calculation on the negotiation timestamp field in the negotiation request structure body to obtain a perturbation factor vector;

[0030] Concatenate the perturbation factor vector with the negotiation parameter field in the negotiation request structure body, and perform a hash calculation to obtain an initial key sequence;

[0031] Perform bit-by-bit sliding window splitting on the initial key sequence, and map the split key fragments into a preset data structure to obtain a key shard set;

[0032] Construct a triple for each key fragment in the key shard set with the negotiation timestamp and the terminal number, and perform an incremental numbering time series index mapping to obtain a session key set.

[0033] Optionally, the multi-logical path mapping and channel encryption configuration in step S2 are specifically as follows:

[0034] Extract the key pair set from the session key set, construct a path candidate topology graph according to the predefined path topology template, and map it to each hop path in the path candidate topology graph with the key pair as the weight parameter to generate a logical path candidate matrix;

[0035] Obtain the cash register communication data including the communication delay, node load, and hop count limit between the cash register terminal and the server;

[0036] Based on the logical path candidate matrix, perform path selection scoring in combination with the cash register communication data, and filter out the multi-logical path set with a score value ≥ 0.75;

[0037] Segment each path in the multi-logical path set, bind the key fragments of the session key set according to the transmission node pair between path segments, and generate a unique encryption index for each path segment to obtain a structured encryption channel mapping table;

[0038] According to the path segments and key pairs in the structured encryption channel mapping table, combined with the preset encryption configuration rule set, define the corresponding encryption configuration rules for each path segment to generate an encryption rule set, and register the encryption rule set in the encryption policy cache pool of the cash register terminal;

[0039] Bind and encapsulate the multi-logical path set, the structured encryption channel mapping table, and the encryption rule set, and attach the current session number, timestamp, and terminal number to generate distributed ciphertext channel parameters.

[0040] Optionally, step S3 is specifically as follows:

[0041] Step S31: Extract the multi-logical path set, the structured encryption channel mapping table, and the encryption rule set from the distributed ciphertext channel parameters, and construct an encrypted write object structure with transmission metadata attached;

[0042] Step S32: Select a symmetric encryption key from the session key set, and perform AES-GCM encryption processing on the encrypted write object structure to obtain ciphertext write data;

[0043] Step S33: Submit the ciphertext - written data to the private blockchain network connected to the terminal locally, select the write target node, record the current node number, block index, and timestamp, and construct the blockchain write meta - information;

[0044] Step S34: Perform content packaging on the ciphertext - written data and the blockchain write meta - information on the write target node to obtain the block content body;

[0045] Step S35: Perform Merkle tree digest construction and node - level hash calculation on the block content body to obtain the block hash value, and write it into the block header of the target node to generate the audit chain hash block.

[0046] Optionally, step S4 is specifically as follows:

[0047] Step S41: Obtain the real - time transaction data generated by the cashier terminal in the current transaction process, and perform normalization processing on each field in the real - time transaction data to obtain a structured transaction data set;

[0048] Step S42: Use the audit chain hash block and the session key set to perform joint index calculation on the structured transaction data set, and extract the public key parameter and session identifier from the calculation result to construct an encrypted context parameter set;

[0049] Step S43: Perform field - level encryption operations on each field in the structured transaction data set based on the encrypted context parameter set to generate an encrypted vector set;

[0050] Step S44: Package the encrypted vector set according to the communication format of the cashier terminal to construct a to - be - transmitted homomorphic ciphertext package;

[0051] Step S45: Call the communication transmission control program in the cashier terminal, load the to - be - transmitted homomorphic ciphertext package into the asynchronous transmission cache queue, and select the corresponding logical channel according to the structured encryption channel mapping table to perform the encrypted path sending operation.

[0052] Optionally, the dynamic key re - negotiation in step S5 is specifically as follows:

[0053] Perform communication quality monitoring on the information transmission data collected in real - time by the cashier terminal, and extract information transmission metrics including the re - transmission rate, delay jitter, and the number of channel integrity check failures;

[0054] Based on the set key rotation trigger threshold set including re - transmission rate > 12%, delay jitter > 30ms, and continuous 2 channel integrity check failures, perform anomaly judgment on the real - time information transmission metrics. If all the thresholds in the key rotation trigger threshold set are satisfied simultaneously, enter the key re - negotiation process; otherwise, maintain the original key session.

[0055] The key re-negotiation process includes:

[0056] Pack the current terminal number, the information transmission metric for triggering the key rotation threshold, and the current timestamp to obtain a key update request, and send the key update request to the peer server;

[0057] The cashier terminal uses the joint identity credential to perform binding authentication on the new perturbation seed generated by the pseudo-random function, the current key negotiation protocol fragment, and the current key fragment in the session key set returned by the peer server to obtain an updated negotiation key package;

[0058] Execute dynamic key negotiation in combination with the updated negotiation key package and the joint identity credential to generate an updated session key set;

[0059] Based on the updated session key set, reconstruct the multi-logical path set, the structured encryption channel mapping table, and the encryption rule set to form updated distributed ciphertext channel parameters;

[0060] Iteratively execute steps S3 to S5 using the updated distributed ciphertext channel parameters until the anomaly detection result returns within the key rotation trigger threshold set.

[0061] The present invention significantly improves the overall security and stability of data encrypted communication between the intelligent cash register and the backend server through multi-level and multi-dimensional security measures. First, when receiving and extracting the key negotiation protocol parameters and session timestamps, protocol content integrity verification is adopted to ensure that the communication data has not been tampered with or subject to replay attacks, maintaining the authenticity and validity of data transmission. The combination of federated identity credentials and two-way perturbation functions uses a linear perturbation superposition and time window hash perturbation mechanism to dynamically generate perturbation factors, effectively increasing the randomness and unpredictability of the key generation process and greatly reducing the risk of the key being reproduced or cracked by attackers. The initial key sequence is split into fixed 64-bit lengths, and after bit-level verification coding and start position marking, it is mapped into a structured key shard data structure, making key management more standardized and efficient, facilitating distributed storage and flexible invocation, while ensuring the integrity and verification reliability of key fragments. In the path selection process, by mapping the key pair as weights to each hop path of the path candidate topology graph and combining the real-time collected cash register communication data (including metrics such as communication delay, node load, and hop count limit), comprehensive scoring and screening are carried out to ensure that the selected path not only meets the performance requirements but also has strong security capabilities. The scoring threshold is set at 0.75 and above, which not only ensures the stability and reliability of the path but also avoids resource shortages of the path due to overly strict requirements. The selected path set is segmented, and mapping groups are generated by combining the transmission node pairs of the path segments with the corresponding key fragments. Then, based on the key fragment length and encryption index, the most suitable basic encryption configuration is selected from the preset encryption rule template, and the encryption parameters are further adjusted according to the communication characteristics of the path segments, realizing the personalization and dynamicization of the encryption strategy and enhancing the flexibility and pertinence of the encryption scheme. In the ciphertext writing stage, the encrypted data is submitted to the local private blockchain network, and the optimal writing target node is selected using the node comprehensive score (weight considering node load, network delay, and storage availability) to ensure the efficiency and data reliability of the writing operation. During the writing process, meta-information such as node numbers, block indexes, and timestamps is recorded in detail and stored in a structured manner, facilitating subsequent auditing and traceability and enhancing the security auditing capabilities of the system. Field-level encryption is performed on the transaction data, and by combining the blockchain hash value vector and the session key identifier vector, an encrypted context parameter set is constructed, enabling the encryption operation to not only ensure data privacy but also support the secure indexing and query of structured data, meeting the actual business requirements for flexible access to data. By constructing homomorphic ciphertext packets and scheduling them in the asynchronous transmission cache, and selecting the matching logical channel according to the structured channel mapping table, secure and efficient encrypted data transmission is achieved, avoiding communication bottlenecks and data loss. In the communication quality monitoring process, key metrics such as the retransmission rate, delay jitter, and the number of channel integrity verification failures are collected in real time. By setting key rotation trigger thresholds such as a retransmission rate greater than 12%, a delay jitter exceeding 30 milliseconds, and two consecutive integrity verification failures, accurate judgment of communication anomalies is realized.Once the threshold is triggered, the system automatically enters the key re-negotiation process, dynamically updates the key set and related encryption parameters, ensures the continuous security of encrypted communication, and avoids security risks caused by using the same key for a long time. This threshold setting takes into account both the system response speed and stability, ensuring that it is neither too frequent to cause resource waste nor leave security hidden dangers due to slow response. The overall solution has been carefully optimized in terms of parameter design and mechanism configuration to ensure highly secure, stable, and efficient encrypted communication of intelligent cashier data in complex and changing commercial environments.

[0062] Optionally, this specification also provides a data encryption communication system applied to an intelligent cash register for executing the data encryption communication method applied to the intelligent cash register. The data encryption communication system applied to the intelligent cash register includes:

[0063] An identity credential generation module, configured to collect user touch data and device hardware fingerprints, and perform high-dimensional feature fusion encoding on the device hardware fingerprints and user touch data to obtain a combined identity credential;

[0064] A key generation module, configured to obtain the original key negotiation protocol and transmission metadata of the peer server, perform dynamic key negotiation using the combined identity credential and the original key negotiation protocol of the peer server to obtain a session key set; perform multi-logical path mapping and channel encryption configuration based on the session key set to obtain distributed ciphertext channel parameters;

[0065] A blockchain writing module, configured to encrypt and write the distributed ciphertext channel parameters and the corresponding transmission metadata into a preset private blockchain node, and perform block content packaging and node hash calculation to obtain an audit chain hash block;

[0066] A homomorphic encryption module, configured to perform homomorphic encryption processing on the obtained real-time transaction data based on the audit chain hash block and the session key set to obtain a to-be-transmitted homomorphic ciphertext, and load the to-be-transmitted homomorphic ciphertext to the communication transmission module of the cash register to perform information transmission;

[0067] A transmission feedback module, configured to perform communication transmission anomaly detection on the real-time collected information transmission data. When the anomaly detection result exceeds a preset key rotation trigger threshold set, trigger dynamic key re-negotiation, and iteratively execute from the key generation module to the transmission feedback module until the anomaly detection result returns within the key rotation trigger threshold set.

[0068] The data encryption communication system applied to an intelligent cash register according to the present invention can implement any one of the data encryption communication methods applied to an intelligent cash register of the present invention, and is used as a medium for coordinating operations and signal transmission between various modules to complete the data encryption communication method applied to an intelligent cash register. The internal modules of the system cooperate with each other, thereby significantly improving the overall security and stability of data encryption communication between the intelligent cash register and the backend server. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Other features, objects, and advantages of the present invention will become more apparent by reading the detailed description of the non-limiting embodiments with reference to the following drawings:

[0070] Figure 1 It is a schematic flowchart of the steps of the data encryption communication method applied to an intelligent cash register according to the present invention;

[0071] Figure 2 It is a detailed schematic flowchart of step S1 in the present invention;

[0072] Figure 3 It is a detailed schematic flowchart of step S3 in the present invention;

[0073] The realization, functional features, and advantages of the object of the present invention will be further described in conjunction with the embodiments with reference to the drawings. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0074] The technical method of the present invention will be clearly and completely described below with reference to the drawings. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts fall within the scope of protection of the present invention.

[0075] In addition, the drawings are only schematic diagrams of the present invention and are not necessarily drawn to scale. The same reference numerals in the drawings represent the same or similar parts, and thus their repeated description will be omitted. Some of the block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. The functional entities can be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor methods and / or microcontroller methods.

[0076] It should be understood that although terms such as "first", "second", etc. may be used herein to describe various units, these units should not be limited by these terms. These terms are only used to distinguish one unit from another. For example, without departing from the scope of the exemplary embodiments, the first unit may be referred to as the second unit, and similarly, the second unit may be referred to as the first unit. The term "and / or" used herein includes any and all combinations of one or more of the listed associated items.

[0077] To achieve the above object, please refer to Figures 1 to 3 , the present invention provides a data encryption communication method applied to an intelligent cash register, and the method includes the following steps:

[0078] Step S1: Collect user touch data and device hardware fingerprints, and perform high-dimensional feature fusion encoding on the device hardware fingerprints and the user touch data to obtain a joint identity credential;

[0079] In this embodiment, the cash register terminal first collects the touch data generated by the user during the login phase through the embedded touch screen, including the pressing position coordinates (x, y), the pressing duration t, the sliding trajectory curves Δx / Δt and Δy / Δt, and the finger contact pressure p obtained by the pressure sensor. And synchronously extract the hardware fingerprint information from the device, including 12-dimensional hardware attribute data such as the CPU serial number, the motherboard manufacturing number, the MAC address, and the temperature-voltage curve characteristics, etc. Construct the above touch data into a vector matrix , and at the same time construct a device fingerprint matrix , and the two perform feature fusion encoding through a parallel neural structure, where the fusion layer uses a three-layer stacked multi-head attention network for dimension matching and redundant feature elimination, and the output is a 256-dimensional feature vector . Finally, encrypt and identify the high-dimensional vector as a joint identity credential, and save it in the temporary storage space of the cash register locally for use as the basis for subsequent communication identity identification.

[0080] Step S2: Obtain the original key negotiation protocol and transmission metadata of the peer server, perform dynamic key negotiation using the joint identity credential and the original key negotiation protocol of the peer server to obtain a session key set; perform multi-logical path mapping and channel encryption configuration based on the session key set to obtain distributed ciphertext channel parameters;

[0081] In this embodiment, after the cash register completes the generation of the joint identity credential, it actively requests to establish a secure communication channel with the peer server. The peer server returns two types of data: one is the original key negotiation protocol, which mainly includes the elliptic curve public key for key negotiation , the negotiation parameter seed , a total of 7 key key parameters such as the asymmetric key exchange method indicator code (such as ECDH or X25519); second, the transmission metadata, including the timestamp of this session , link priority label , the initial channel configuration table (including a total of 4 groups of channel parameters, each group containing fields such as path ID, maximum transmission rate, encrypted channel number, etc.) and the negotiated channel identification code, a total of 14 pieces of metadata information. First, based on the joint identity credential and the received negotiated parameter seed Perform a hash-based perturbation function calculation to generate a perturbation factor , and then use the server public key Perform elliptic curve key exchange, and combine the perturbation factor to calculate the negotiation result , and then split it into four groups of sub-session keys: . Each group corresponds to a logical path. After the key negotiation is completed, parse the channel configuration table attached to the transmission metadata, extract the hop count, disguise level and encrypted channel number of each path, and construct a multi-logical path structure matrix: ; then, use The corresponding mapped path information performs an identity-based symmetric encryption operation to generate the final encrypted path ciphertext parameter , and pack all the channel parameter sets and the negotiation number into a distributed ciphertext channel parameter, and store it in the encrypted configuration area as the basis path for subsequent communication data encryption.

[0082] Step S3: Encrypt the distributed ciphertext channel parameter and the corresponding transmission metadata and write them into a preset private blockchain node, and perform block content packaging and node hash calculation to obtain an audit chain hash block;

[0083] In this embodiment, after the generation of the distributed ciphertext channel parameter is completed, the cash register terminal performs local encapsulation on it. Specifically, the four groups of path ciphertext parameter sets obtained in the previous step and the negotiation session number , metadata timestamp , channel identification code and other information are combined into a complete channel encryption configuration record item and organized into the following data structure: ; then, the cash register terminal serializes the data structure, and uses the fifth-segment extended sub-key in the session key that is not used for path mapping Perform an asymmetric encryption signature to calculate the encryption result: ; next, As a piece of data written on the blockchain, it is written into the locally preset private blockchain network of the cash register. This private chain adopts a lightweight Byzantine consensus mechanism based on the SHA-256 hash. Each write needs to be signed and confirmed by the local consensus cluster (including 3 cash register terminals). Write it into the data area of the new block, and at the same time concatenate the block header information with the previous block hash to generate a new chained hash header: ; The formed complete block structure is as follows: ; Finally, add this block to the head of the local linked list, and cache As the audit chain hash block of the current session, it provides a traceable anchor point for subsequent communication encryption and audit verification.

[0084] Step S4: Perform homomorphic encryption processing on the obtained real-time transaction data based on the audit chain hash block and the session key set to obtain the homomorphic ciphertext to be transmitted, and load the homomorphic ciphertext to be transmitted into the communication transmission module of the cash register to execute information transmission;

[0085] In this embodiment, after the parameters on the security chain are configured, the cash register will obtain the real-time transaction data , including fields such as product number, price, user identification hash value, payment channel, etc., and perform encryption processing. First, according to the session key set obtained in step S2 and the current blockchain hash anchor ; this prefix is used for the initialization vector generation of homomorphic encryption. Then perform an encryption operation on the transaction data based on the Paillier homomorphic encryption mechanism. Taking the transaction amount field as an example, assume it is v = 123.45, and convert it to an integer representation v' = 12345. Generate the plaintext vector =[v', product ID, payment method code], and perform the following encryption on each element: ; where are the Paillier public key parameters for this round, is the random number perturbation term (derived from ), is the th transaction data, and generate the homomorphic ciphertext vector . Finally, the cash register loads this homomorphic ciphertext into the buffer to be sent of its communication control hardware, and at the same time attach the path ciphertext parameter pointer and the current block hash check value to jointly form an encrypted communication packet: ; Randomly select an encrypted channel through the multi-path mapping table established previously, with the shortest number of hops being the priority, and securely send the data to the peer server.

[0086] Step S5: Perform communication transmission anomaly detection on the real-time collected information transmission data. When the anomaly detection result exceeds the preset key rotation trigger threshold set, trigger dynamic key renegotiation, and iteratively execute Step S2 to Step S5 until the anomaly detection result returns within the key rotation trigger threshold set.

[0087] In this embodiment, during each transaction communication process of the intelligent cash register, the communication transmission status is continuously and real-time collected. The collected data includes the following fields: communication round-trip delay (in milliseconds), channel error flag (the value of 0 indicates normal, 1 indicates packet loss, 2 indicates timeout), communication interruption count value, and the key version identifier currently in use. These data are organized in chronological order into a data sliding window with a length of 20, and the cash register refreshes this window once per second. A set of key rotation trigger condition sets is preset to determine whether the current communication status is abnormal. This condition set includes: 5 consecutive communication errors, an average communication delay exceeding 400 milliseconds, or a channel packet loss rate exceeding 15% in the current time window. Once any one of the conditions is met, it is determined that the current communication status is abnormal, and the key rotation process is immediately triggered. When the key rotation is triggered, the cash register terminates the use of the current communication session key and starts the dynamic key renegotiation mechanism. This mechanism will re-request the latest original key negotiation protocol and transmission metadata from the peer server. After obtaining these two parts of information, combined with the previously generated joint identity credentials locally, a new set of session key sets is regenerated. These keys are then used to configure a new communication encryption path and channel policy. After the renegotiation is completed, the private chain writing and audit chain hash block construction processes are re-executed, and the latest collected transaction data is encrypted based on the new key set, and the communication transmission process is re-initiated. Throughout the process, each key rotation is accompanied by a full set of communication environment refreshes to ensure that the communication process can still achieve rapid recovery when encountering attacks, interruptions, or leakage risks. If the re-initiated communication does not trigger any abnormal conditions again within the next 3 sliding window cycles (i.e., 3 complete data sampling windows), it is considered that the current communication status is stable, and the current key version is automatically confirmed as the main version and enters the normal communication state; if the abnormal conditions still exist, the key renegotiation process is automatically repeated until the communication status returns to the set safe range.

[0088] Optionally, Step S1 is specifically:

[0089] Step S11: Obtain the touch trajectory data, click timing data, and pressure change data during the user operation through the sensor module, so as to construct user touch data;

[0090] In this embodiment, a capacitive touch sensor array and a pressure sensing unit are installed at the front end of the cash register. The sampling frequency is set to 120 Hz, and the fingertip trajectory coordinates (x, y), touch duration, touch interval, and vertical pressure intensity value of the user during the payment operation are captured in real time. To improve the spatial accuracy, each touch event is recorded as multiple frames of samples, and a single frame contains position information, pressure value, and event timestamp. The window sliding mechanism is adopted, and a touch trajectory sequence with a length of 60 and click rhythm information are extracted for each operation. The finally generated user touch data is organized into a matrix structure with a size of 60×5, and the column dimensions correspond to the horizontal coordinate of the position, vertical coordinate, click duration, click pressure value, and event interval time respectively. This data is used for subsequent joint processing with device information to ensure the uniqueness of the authentication behavior and device dependence.

[0091] Step S12: Invoke the security hardware identification interface embedded in the cash register, read the hardware features of the main board number, power identification code, terminal fingerprint, MAC address, and boot code of the device, and construct device hardware fingerprint data according to the preset hierarchical identification mapping rule;

[0092] In this embodiment, the security control chip (such as the ST33TPMF2 series) built into the cash register is configured to provide the ability to read the underlying hardware information. During the startup phase, the main board serial number (directly read by the main board controller), power identification code (read from the EEPROM in the power supply chip), terminal network MAC address, boot area check code, and terminal encryption fingerprint signed by the manufacturer are sequentially retrieved through the security interface. To construct a data structure that can be used for identity fusion, a five-layer nested mapping rule is used to encode and classify each field: the first-level identifier is "hardware category", the second-level is "field type", the third-level is "uniqueness verification value", the fourth-level is "associated risk level", and the fifth-level is "standardized coding value". Finally, the device fingerprint is constructed as an array of five-tuple structures with a total length of 40 units, and is structurally represented as a 40×5 matrix. Each row corresponds to the feature description of a field under the five-level mapping, and is used for fusion with user behavior data.

[0093] Step S13: Perform heterogeneous feature joint encoding on the user touch data and the device hardware fingerprint data to obtain high-dimensional fusion encoded data;

[0094] In this embodiment, there is a structural difference between the format of user touch data (60×5 matrix) and device hardware fingerprint data (40×5 matrix). First, the touch data matrix is subjected to three-dimensional transformation, expanded into a vector sequence by row dimension, and the data in each column is normalized to the interval of 0 to 1 according to the normalization rule. The device fingerprint data maintains the mapping-level structure and uses the label embedding form for unified vector expansion. Subsequently, a preset heterogeneous feature fusion framework is loaded. This framework contains two input sub-channels: on one side, the input is a touch vector with a length of 300, and on the other side, the input is a fingerprint vector with a length of 200. After the channel outputs, they respectively pass through 3-layer weight association layers, and after merging, a fusion coding vector with a length of 512 is formed. This fusion structure maintains the independence of each input domain, and at the same time extracts mutual information through the joint fully connected layer to enhance the coupling relationship between dimensions. The finally output high-dimensional coding data is in the form of a one-dimensional array with a length of 512, and this coding is used as the joint feature for subsequent confidence evaluation and identity generation.

[0095] Step S14: Perform variational regularization processing and noise feature suppression on the high-dimensional fusion coding data, calculate the credibility index of each fusion dimension, and write the fusion vectors with credibility greater than the set credible threshold of 0.82 into a preset voucher structure body to obtain the initial body of the joint identity voucher;

[0096] In this embodiment, to enhance the credibility of the generated joint coding in actual use, the 512-dimensional fusion vectors are sequentially subjected to regular transformation and noise elimination processing. First, standard variance screening is performed on each dimension to remove low-variability dimensions (below the 0.02 standard deviation threshold). Subsequently, among the remaining dimensions, a preset noise confidence matrix is used to score each feature, and the matrix dimension is 512×1, corresponding to the credibility weight of each dimension. The calculation result is compared with the set credible threshold of 0.82. Only when the credibility score of the current vector is greater than this threshold, the vector will be retained. The qualified fusion vectors will be written into a structure body named "initial body of joint voucher", which contains two fields: vector data (512-dimensional) and credible score (floating point number). To prevent boundary interference, boundary suppression operations are performed on the edge dimensions to ensure that the finally output vector has higher discriminative ability in the actual scenario. After this processing is completed, the vector is temporarily stored in the local storage cache and prepared for hash signature.

[0097] Step S15: Perform hash signature on the initial body of the joint identity voucher and append a timestamp, the corresponding preset terminal number, and a perturbation seed generated by a preset pseudo-random function to obtain the joint identity voucher.

[0098] In this embodiment, after receiving the initial body of the joint identity credential, first extract its 512-dimensional vector field, and load the locally preset hash structure (using the SHA-384 structure with an output length of 96 bytes). After performing hash mapping on the fusion vector, append the current timestamp (in milliseconds, UTC standard) to the end of the hash result. At the same time, extract the current device number from the terminal startup information, and generate a perturbation seed (with a length of 16 bytes, initialized with a state value of 2357 based on the pseudo-random number generator PRNG) from the preset random seeder. Finally, the credential data structure is encapsulated into a joint identity credential, and the fields include: hash digest, timestamp, terminal number, and perturbation seed. This structure is finally submitted to the cash register communication initialization process to be used for identifying the identity of the request initiator and supporting the subsequent communication encryption process. This credential is automatically refreshed every 15 minutes and allows the forced update mechanism to be triggered in an abnormal state to ensure the stability and tamper resistance of the identity authentication chain.

[0099] Optionally, step S13 is specifically as follows:

[0100] Step S131: Normalize the user touch data and the device hardware fingerprint data respectively to obtain a touch feature tensor and a hardware feature tensor;

[0101] In this embodiment, the collected user touch data and device hardware fingerprint data are normalized respectively. The touch data is usually stored in the form of a 60×5 matrix, and each row contains the horizontal and vertical coordinates of the touch, the pressure value, the duration, and the time interval. The hardware fingerprint data is organized in a 40×5 matrix, covering five-layer mapping information such as the motherboard number and the MAC address. The normalization process linearly scales each data dimension to between 0 and 1, using the maximum-minimum standard method to ensure the unity of the data amplitude and facilitate subsequent fusion. This normalization operation ensures that the touch feature tensor and the hardware feature tensor respectively maintain the shapes of (60, 5) and (40, 5), and all elements are within the range of 0 to 1, effectively eliminating the influence brought by the difference in data dimensions.

[0102] Step S132: Perform heterogeneous tensor dimension standardization transformation on the touch feature tensor and the hardware feature tensor to obtain a standardized touch feature tensor and a standardized hardware feature tensor;

[0103] In this embodiment, a dimensionality standardization transformation is performed on the normalized touch feature tensor and the hardware feature tensor. According to the pre-designed tensor mapping rule, the touch tensor is adjusted to a three-dimensional tensor of a unified dimension through time step expansion and spatial compression techniques, specifically transformed into the format of (60, 5, 1), and a new channel dimension is added for feature separation. The hardware feature tensor is adjusted to the form of (40, 5, 1) through dimension expansion and padding, corresponding to the touch tensor structure while maintaining the hierarchical mapping structure. The pre-designed tensor mapping rule can be: the original touch data is a two-dimensional matrix (time step × feature dimension), and through adding a channel dimension, time interpolation, or spatial compression, it is converted into a three-dimensional tensor (time step × feature dimension × number of channels). The hardware fingerprint data is filled and dimension-expanded according to the hierarchical structure to ensure that the final tensor shape is consistent with the touch data. This rule clarifies the corresponding positions and arrangement methods of each data element in the new tensor, ensuring the structural integrity and feature correspondence of the data, and providing a basis for subsequent feature alignment and fusion. Subsequently, a batch normalization operation is performed on the dimensions of the two tensors, and the mean and variance are calculated based on each feature channel respectively to eliminate the internal covariate shift, ensuring a stable distribution of the tensors within the same feature scale, which is beneficial to subsequent feature alignment.

[0104] Step S133: Perform feature alignment and interaction correlation analysis on the standardized touch feature tensor and the standardized hardware feature tensor, extract the interaction correlation mapping matrix, and perform a linear weighted fusion operation according to the interaction correlation mapping matrix to generate a preliminary fusion vector;

[0105] In this embodiment, the standardized touch feature tensor and the hardware feature tensor are subjected to feature alignment and correlation analysis. Through element-wise multiplication and matrix product operations, an interaction correlation mapping matrix of size (60×40) is generated, describing the degree of mutual influence between different time and hardware hierarchical features. This mapping matrix reflects the coupling relationship between user behavior and device hardware attributes, and the numerical range is controlled between 0 and 1 for comparison. Based on this matrix, through the linear weighted method, the corresponding feature weights of the touch tensor and the hardware tensor are superimposed, and the length of the weight vector is set to 60, which is the feature importance score derived from the user touch time step. Finally, a preliminary fusion vector of length 256 is synthesized, and this vector contains multi-dimensional and multi-level fusion information, reflecting the comprehensive identity characteristics of touch and hardware features.

[0106] Step S134: Perform stability enhancement and normalization re-encoding on the preliminary fusion vector to obtain high-dimensional fusion encoded data.

[0107] In this embodiment, enhancement processing and normalization re-encoding are performed on the preliminary fusion vector. First, the fusion vector is smoothed by a weighted moving average method with a window size of 5 to suppress the influence of data fluctuations. Then, the fusion vector is re-encoded into the range of 0 to 1 through a normalization mapping function to ensure that all feature values are on the same scale. It also includes a confidence interval check based on statistical distribution to eliminate significantly abnormal numerical deviations. The finally output high-dimensional fusion code is a one-dimensional vector with a length of 256, which not only contains the integrated identity feature information after fusion but also has been optimized for stability, making it suitable for subsequent storage and identity verification, and ensuring high robustness and recognition in different usage environments.

[0108] Optionally, step S14 is specifically as follows:

[0109] Step S141: Model the feature distribution of the high-dimensional fusion encoded data to generate distribution residual parameters;

[0110] In this embodiment, for the feature distribution of the high-dimensional fusion encoded data, first, statistical analysis is performed on the numerical distribution of each dimension of the fusion vector to establish a probability density model for each dimension, and then the residual parameters of the overall vector are calculated. Here, the residual parameters are represented in matrix form, including the deviation values of the values of each dimension from the corresponding average value, and the matrix size is the same as the dimension of the fusion vector. Using this residual matrix, it is possible to accurately reflect which dimensions of the data deviate from the normal distribution range, facilitating subsequent filtering and screening. During operation, a sliding window length of 50 is selected, and the residual mean within each window is calculated to capture the local change trend, ensuring that dynamic features can be effectively captured.

[0111] Step S142: Filter and mask the dimensions in the high-dimensional fusion encoded data that are higher than the mean of the residual distribution variance according to the distribution residual parameters. At the same time, perform sliding window entropy analysis to identify the dimensions that suddenly increase in the high-dimensional fusion encoded data, mark the dimensions with sudden increases as noise channels, and set the weights of the noise channels to 0, thereby obtaining a stable encoded vector;

[0112] In this embodiment, based on the residual parameters, masking processing is performed on the dimensions that are higher than the average value of the variances of all residual dimensions. Specifically, first calculate the overall variance mean of all dimension residuals, and then for each residual value, if it is greater than this variance mean, set the value of this dimension in the corresponding fusion vector to zero, which serves to filter out abnormal data. At the same time, within a time window with a length of 30, perform entropy value analysis on each dimension of the fusion vector to detect the dimensions that suddenly increase during this time period. If the entropy value of a certain dimension exceeds 1.5 times the historical mean, mark this dimension as a noise channel and set the weight of this dimension to zero, so as to ignore this channel in subsequent processing and ensure the stability and anti-interference ability of the encoded data.

[0113] Step S143: Calculate the credibility index of each fusion dimension in the stable coding vector to obtain a credibility vector;

[0114] In this embodiment, for the fusion vector after filtering processing, calculate the credibility index of each dimension. The credibility calculation is based on the data collected in the most recent 1000 times. Count the proportion of the number of times that this dimension is non-zero and the residual is lower than the threshold, and give higher weight to the most recent data to ensure that the credibility index can reflect the current reliability of this dimension. Finally, each dimension corresponds to a credibility value between 0 and 1, forming a credibility array with the same length as the fusion vector.

[0115] Step S144: Perform mapping screening on the corresponding positions of the credibility vector and the stable coding vector, retain all dimensions with credibility ≥ 0.82, and construct a credible fusion vector based on the retained dimensions;

[0116] In this embodiment, according to the credibility array, screen the fusion vector. The specific screening rule is to retain all dimensions with credibility values greater than or equal to 0.82, retain the values of these dimensions in the corresponding fusion vector, and directly discard the remaining dimensions. In this way, a new credible fusion vector is generated, and its number of dimensions is less than or equal to the original vector, and the typical number is about 350. This operation ensures that the final fusion vector only contains features with high credibility, effectively improving the security and accuracy of the credential.

[0117] Step S145: Fill the credible fusion vector into a predefined credential structure to obtain an initial joint identity credential.

[0118] In this embodiment, store the screened credible fusion vector into a predefined credential structure. The structure design includes multiple fields: a floating-point array stores the fusion vector data, an integer field records the number of valid dimensions, a 64-bit integer stores the timestamp, a string type field stores the terminal device number, and there is also a checksum field for verifying data integrity. The size of the credential structure is dynamically adjusted according to the dimension of the fusion vector, and the typical size is the length of the credible fusion vector multiplied by 4 bytes (each floating point number occupies 4 bytes). The structure supports subsequent appending of timestamps and digital signatures to ensure the integrity and anti-tampering of data during storage and transmission.

[0119] Optionally, the dynamic key negotiation in step S2 is specifically as follows:

[0120] Receive the original key negotiation protocol fragment and transmission metadata from the peer server, extract the negotiation parameter field, and perform protocol content integrity verification in combination with the obtained current session timestamp to obtain a negotiation request structure;

[0121] In this embodiment, two types of data are received from the peer server: one is the original key negotiation protocol fragment, and the other is independent transmission metadata. First, these two parts of data are parsed separately to extract the key fields, especially the negotiation parameter fields, which contain information such as the random number, encryption algorithm identifier, and negotiation version number necessary during the negotiation process. Subsequently, in combination with the current session timestamp obtained locally, the timestamp is associated with the negotiation protocol content for integrity verification to ensure that the protocol fragment has not been tampered with during transmission. During the verification process, a data integrity verification mechanism is adopted, and the verification result is encapsulated into a data structure called the negotiation request structure, which stores fields in the form of key-value pairs for convenient subsequent invocation and transmission.

[0122] Extract the terminal number and perturbation seed based on the joint identity credential, and perform a two-way perturbation function calculation on the negotiation timestamp field in the negotiation request structure to obtain the perturbation factor vector;

[0123] In this embodiment, based on the previously generated joint identity credential, two pieces of information, namely the terminal number and the perturbation seed, are extracted from it. Using these two pieces of information, a two-way perturbation function calculation is performed on the negotiation timestamp field in the negotiation request structure. The specific two-way perturbation function calculation is as follows: First, perform a linear perturbation superposition process on the timestamp data. Specifically, the perturbation seed extracted from the joint identity credential is used as the linear perturbation factor and weighted and superimposed with the original value of the timestamp field. The weighting coefficients can be set in a ratio of 0.6 to 0.4 to ensure that the perturbation process retains the basic information of the timestamp while introducing the random component of the perturbation seed, thereby obtaining a preliminary perturbed time series. The implementation form is to represent the timestamp as a one-dimensional vector T, the perturbation seed as a vector S of the same length, and calculate the linear combination vector L = 0.6×T + 0.4×S, where L is the linear perturbation result. After the linear perturbation superposition, it enters the time window hash perturbation stage. In this stage, a sliding window mechanism is adopted to divide the linear perturbation result L into several consecutive sub-windows with a fixed length of 16. Apply a hash function mapping to the data segment within each sub-window. The hash function selects a customized simplified variant based on SHA-256 compression and outputs a fixed-length 32-byte hash value. Subsequently, the hash results corresponding to each sub-window are re-stitched in chronological order into a perturbation vector to ensure that the mapping of temporal locality and dynamic characteristics is not destroyed. The stitched perturbation vector is a one-dimensional real number array with a length equal to the number of windows multiplied by the hash value length, and a common length is 128 dimensions. Finally, the output perturbation factor vector of the two-way perturbation function combines the linear transformation of the timestamp and the window-level hash perturbation.

[0124] Concatenate the perturbation factor vector with the negotiation parameter field in the negotiation request structure and perform a hash calculation to obtain the initial key sequence;

[0125] In this embodiment, the perturbation factor vector is concatenated with the negotiation parameter field in the negotiation request structure to form a new data sequence. After concatenation, the data is processed by a hash processing module to generate an initial key sequence, which is a byte stream of a fixed length, usually 256 bytes, and is structured as a byte array for subsequent splitting and mapping operations. The hash processing uses a multi-round compression and expansion mechanism to ensure the randomness and uniform distribution of the key sequence and prevent the risk of key leakage.

[0126] Perform bit-trailing sliding window splitting on the initial key sequence and map the split key fragments into a preset data structure to obtain a key shard set;

[0127] In this embodiment, a continuous bit-sliding window splitting operation is performed on the initial key sequence. The window size can be set to 64 bits, and the sliding step is 16 bits. Through this splitting method, multiple overlapping key fragments are intercepted from the initial sequence, and each fragment is a 64-bit bit block. The split key fragments are sequentially mapped to a pre-designed key data structure, which uses a hybrid form of an array and a linked list to support fast indexing and dynamic insertion, ensuring the ordered storage and flexible management of the key fragments, and forming a key shard set.

[0128] Construct a triple with each key fragment in the key shard set, the negotiation timestamp, and the terminal number, and perform an incremental numbering time series index mapping to obtain a session key set.

[0129] In this embodiment, based on the key shard set, each key fragment is combined with the corresponding negotiation timestamp and terminal number to form a triple. Each triple contains the specific data of the key fragment, the generation time, and the device identification information. Incremental numbers are assigned to these triples in chronological order to form a time series index mapping table. The table structure is a two-dimensional matrix, where the rows represent the key fragment numbers, and the columns sequentially store the key fragment data, the timestamp, and the terminal number. This mapping table serves as the carrier of the final session key set for subsequent communication encryption and decryption operations, realizing dynamic key management and secure transmission.

[0130] Especially importantly, the bit-trailing sliding window splitting is specifically:

[0131] Flatten the initial key sequence into a group of continuous bit strings in binary encoding to obtain a key flattened sequence;

[0132] In this embodiment, the key data is flattened into a group of continuous bit strings in binary encoding. This process converts each byte in the original key sequence into 8 bits, and all bytes are arranged in order to form a one-dimensional binary vector. Assuming the length of the initial key sequence is N bytes, the flattened key sequence is a binary array of length 8N, in the form of , where each It is 0 or 1. The flattening operation ensures the continuity and bit-level operability of the key data, facilitating the extraction of subsequent fixed-length segments.

[0133] Successively intercept 64-bit fixed-length bit segments from the flattened key sequence to obtain consecutive key fragments;

[0134] In this embodiment, fixed-length bit segments are successively intercepted from the flattened key sequence, and the length of each segment is set to 64 bits. The interception process starts from the starting position of the key sequence and is continuously divided in units of 64 bits. If the length of the flattened sequence is not divisible by 64, the last segment can be padded with zeros or discarded according to the actual length. Each 64-bit key fragment constitutes an independent subsequence, and its format is .

[0135] Perform bit-level parity encoding on each consecutive key fragment, convert the key fragment that has completed parity check into a hexadecimal string, and attach the corresponding starting position label to each key fragment to obtain the split key fragments;

[0136] In this embodiment, for each 64-bit consecutive key fragment, perform a bit-level parity encoding operation, which mainly includes adding redundant parity bits to detect bit errors. The parity encoding adopts the Hamming code parity check scheme, adding additional parity bits so that each 64-bit data has 7 bits of redundant parity check, forming a 71-bit parity fragment. After the parity check is completed, the parity fragment is converted into the corresponding hexadecimal string format for easy storage and transmission. At the same time, to ensure the positioning and sequential management of the key fragments, an additional starting position label is attached to each parity-checked key fragment. This label is the starting bit index of the fragment in the flattened sequence, in the format of a decimal integer, ensuring the unique identification of the split key fragments in the sequence.

[0137] Summarize all the split key fragments in the order of the starting position and map them into a preset data structure to obtain the key shard set.

[0138] In this embodiment, all the split and parity-checked key fragments are summarized and sorted in the order of the starting position labels and mapped into a preset data structure. This data structure adopts the form of an ordered dictionary (Ordered Dictionary), where the key is the starting position label and the value is the corresponding hexadecimal string of the parity-checked key fragment. This mapping ensures fast indexing and sequential access. The generated key shard set has a clear sequential structure, facilitating subsequent key recovery and management, and each key fragment is accompanied by complete parity information to ensure data integrity.

[0139] Optionally, the multi-logical path mapping and channel encryption configuration in step S2 are specifically as follows:

[0140] Extract a set of key pairs from the session key set, construct a path candidate topology graph according to a predefined path topology template, and map the key pairs to each hop path in the path candidate topology graph as weight parameters to generate a logical path candidate matrix;

[0141] In this embodiment, traverse the key triples stored in the session key set, and select each pair of keys as the encryption basis for the communication link. These key pairs are given a preliminary security strength score according to indicators such as their generation time, key length, and key entropy; subsequently, a path candidate topology graph is constructed according to a predefined path topology template. This template is in the form of an adjacency matrix, representing the reachability relationship between the nodes of the cash register terminal and the server. Each element in the matrix corresponds to the number of path hops and the connection weight. The key pairs are mapped to the edges of each hop path in this topology graph as weight parameters to form a weight matrix, called the logical path candidate matrix, which is a two-dimensional square matrix. The value of the matrix element represents the key weight strength of this path hop, used to reflect the security and effectiveness of the path.

[0142] Obtain the cash register communication data including the communication delay, node load, and hop count limit between the cash register terminal and the server;

[0143] In this embodiment, obtain the communication-related data between the cash register terminal and the server, including the communication delay (in milliseconds) between nodes (corresponding to the nodes of the path candidate topology graph), the current load of each node (represented by the CPU utilization percentage), and the set path hop count limit (such as a maximum of no more than 6 hops). These data are stored in the form of a multi-dimensional tensor, and the shape is, for example, N, N, 3, corresponding to the delay, load, and hop count limit information between node pairs.

[0144] Based on the logical path candidate matrix, perform path selection scoring in combination with the cash register communication data, and filter out a multi-logical path set with a score value ≥ 0.75;

[0145] In this embodiment, based on the above logical path candidate matrix and the communication data of the cash register, path selection scoring is performed. The specific process is to extract the corresponding key weight value, as well as the communication delay, node load, and hop count information of each hop in the path for each hop in the path. The key weight reflects the strength of the hop path in terms of encryption security (security strength score), and its value range is generally between 0 and 1. The larger the value, the higher the encryption strength. The communication delay is in milliseconds and directly affects the response speed of the path. The node load is expressed as a percentage of CPU or memory usage. The higher the load, the more limited the processing capacity of the node, which will cause a transmission bottleneck. The hop count limit is used to constrain the path length and avoid excessive delay and resource consumption caused by too long a path. Secondly, the above indicators are uniformly normalized. The communication delay and node load are respectively normalized using the maximum-minimum normalization method, mapping them to the range of 0 to 1. For the hop count limit, according to the preset maximum allowed hop count, the ratio of the actual hop count of the path is calculated, and the more hops, the lower the score. The key weight does not need to be normalized because it is already a weight coefficient in the range of 0 to 1. The normalized indicators are weighted and summed according to the weight coefficients. The weight configuration is: the key weight accounts for 0.5, the communication delay accounts for 0.3, the node load accounts for 0.15, and the hop count limit accounts for 0.05. The calculation formula is roughly: path score = (key weight × 0.5) + ((1 - delay normalization value) × 0.3) + ((1 - load normalization value) × 0.15) + ((1 - hop ratio) × 0.05). Among them, (1 - delay normalization value) and (1 - load normalization value) represent the design that the lower the delay and load, the higher the score. The score values of all hop segments in the path are cumulatively averaged to obtain the overall score of the path. When calculating, after summing the weight of each hop and the corresponding index score, divide by the number of hops to ensure that the score result is within the range of 0 to 1. According to the set threshold of 0.75, paths are screened, and only paths with a score not lower than 0.75 can enter the multi-logical path set.

[0146] Each path in the multi-logical path set is segmented. Based on the transmission node pairs between path segments, the key fragments of the session key set are bound, and a unique encryption index is generated for each path segment, thereby obtaining a structured encryption channel mapping table;

[0147] In this embodiment, each path in the selected multi-logical path set is subjected to segmentation processing. The path segmentation is based on adjacent node pairs in the communication link, and the link segments are sequentially extracted. Each path segment is bound to the corresponding key fragment in the session key set to ensure the secure isolation of data transmission between segments. In addition, a unique encryption index is generated for each path segment. This index is encoded using a 64-bit unsigned integer to ensure the unique identification of the corresponding key binding relationship in the entire path mapping. All path segments and their encryption indexes are stored in a table structure, called a structured encryption channel mapping table, which is convenient for the precise management of keys and paths.

[0148] According to the path segments and key pairs in the structured encryption channel mapping table, combined with the preset encryption configuration rule set, define the corresponding encryption configuration rules for each path segment, generate an encryption rule set, and register the encryption rule set into the encryption policy cache pool of the cash register terminal;

[0149] In this embodiment, based on the path segments and corresponding key pairs in the structured encryption channel mapping table, the encryption rules are defined in combination with the preset encryption configuration rule set. The encryption rules include specific parameters such as the encryption algorithm type (such as AES-256, ChaCha20), encryption mode (such as GCM, CBC), key usage frequency, and reuse period. Each path segment is assigned a specific encryption rule to adapt to its communication environment and security requirements. The rule set is saved in the form of a dictionary, with the key being the unique index of the path segment and the value being the set of encryption configuration parameters. The generated encryption rule set is registered into the encryption policy cache pool of the cash register terminal to achieve real-time encryption policy scheduling.

[0150] Bind and encapsulate the multi-logical path set, the structured encryption channel mapping table, and the encryption rule set, and append the current session number, timestamp, and terminal number to generate distributed ciphertext channel parameters.

[0151] In this embodiment, the multi-logical path set, the structured encryption channel mapping table, and the encryption rule set are associated and encapsulated. The encapsulated data structure includes fields: multi-logical path list, mapping table index, and encryption rule parameters, and at the same time append the current session number (identified in UUID format), timestamp (accurate to milliseconds), and terminal number (in string form). The encapsulated data structure is called distributed ciphertext channel parameters, which are used to establish and maintain the secure communication channel of the cash register terminal, ensuring the security and efficiency of data transmission in a multi-path multi-key environment.

[0152] Especially importantly, the specific definition of the corresponding encryption configuration rules is as follows:

[0153] Extract the transmission node pairs and corresponding key fragments of each path segment in the structured encryption channel mapping table, and construct a path segment-key fragment mapping group;

[0154] In this embodiment, the transmission node pairs and corresponding key fragments of each path segment in the structured encryption channel mapping table are extracted to form a path segment-key fragment mapping group. The specific operation is to traverse all path segment information in the mapping table. Each path segment consists of a start node and an end node. According to the key index stored in the mapping table, the key fragment bound to this path segment is found. The key fragment is saved in the shard data structure of the session key set in the form of a hexadecimal string with a unique position label to ensure the uniqueness and integrity of the mapping. This mapping group is organized in the form of an ordered pair to ensure a one-to-one correspondence between the path segment and the key fragment, providing the basic data for subsequent encryption configuration.

[0155] Select a basic encryption template that matches the key type from a preset encryption configuration rule set according to the length of the key segment bound to each path segment and the encryption index identifier.

[0156] In this embodiment, according to the length of the key segment bound to each path segment and the encryption index identifier, a basic encryption template that exactly matches the key type is selected from a preset encryption configuration rule set. The encryption configuration rule set is a predefined template library that includes various encryption methods, key lengths, encryption modes, and key update strategies. By matching and filtering the key type (such as symmetric key or asymmetric key) and key length information, it is ensured that the selected basic template can be compatible with the current key segment, achieving optimal encryption performance and security protection.

[0157] Adapt and adjust the encryption parameters in the basic encryption template to the communication characteristics of the path segment to generate a dedicated encryption configuration for the path segment.

[0158] In this embodiment, the encryption parameters in the selected basic encryption template are adapted and adjusted to the communication characteristics of the path segment. The communication characteristics include the network bandwidth, latency, packet loss rate, and node load conditions of the path segment, all of which are stored in the form of quantitative indicators. The adjustment process ensures that the encryption process adapts to the actual communication environment by adjusting the encryption block size, encryption frequency, and retransmission strategy parameters, taking into account both encryption strength and communication efficiency. The adjusted parameters form a dedicated encryption configuration for the path segment, reflecting a customized design for specific network conditions.

[0159] Bind the corresponding path segment identifier and encryption index to the dedicated encryption configuration for each path segment, and perform standardized encapsulation to obtain an encryption rule set.

[0160] In this embodiment, the unique path segment identifier and encryption index are bound to the dedicated encryption configuration for each path segment to achieve precise positioning and management of the encryption rules. Subsequently, all path segment encryption configurations are standardized and encapsulated, and the format includes fields such as path identifier, key index, encryption algorithm identifier, key length, and encryption parameter set, forming a unified encryption rule data structure. Finally, all encapsulated rule sets constitute a complete encryption rule set, providing standardized and extensible encryption instruction support for the encryption policy cache pool of the cash register terminal.

[0161] Optionally, step S3 is specifically as follows:

[0162] Step S31: Extract the multi-logical path set, structured encryption channel mapping table, and encryption rule set from the distributed ciphertext channel parameters, and construct an encryption write object structure with transmission metadata attached.

[0163] In this embodiment, key data is extracted from the received distributed ciphertext channel parameters, including a multi-logical path set, a structured encrypted channel mapping table, and an encryption rule set. The multi-logical path set stores each communication path in a set form, and each path is represented as an ordered list of node sequences. The structured encrypted channel mapping table is a mapping dictionary, where the keys are path segment identifiers and the values are hexadecimal strings of corresponding key fragments. The encryption rule set is represented by a predefined structure array, and each structure contains fields such as a path segment identifier, an encryption algorithm type, a key index, and encryption parameters. Subsequently, the above three parts of data, together with the transmission metadata (including the current session number, timestamp, and terminal number), are combined and encapsulated into an encrypted write object structure. This structure is stored in JSON format, and the fields include "paths", "mappingTable", "encryptionRules", and "metadata", ensuring compatibility and flexibility for subsequent processing.

[0164] Step S32: Select a symmetric encryption key from the session key set and perform AES-GCM encryption processing on the encrypted write object structure to obtain ciphertext write data;

[0165] In this embodiment, a key for symmetric encryption is selected from the session key set. This key is a 256-bit binary sequence and meets the AES-GCM encryption requirements. Using this key, an encryption operation is performed on the encrypted write object structure constructed in step S31. The encryption process includes the generation of an initialization vector (IV), the length of which is fixed at 12 bytes and is jointly determined by the timestamp and a pseudorandom number generator. The serialized JSON data of the encrypted write object structure is encrypted to generate an encrypted data packet containing ciphertext, an authentication tag, and the IV. The encryption result is output in binary form and then encoded as a Base64 string format for subsequent blockchain write operations and network transmissions.

[0166] Step S33: Submit the ciphertext write data to the private blockchain network connected locally to the terminal, select the write target node and record the current node number, block index, and timestamp, and construct blockchain write meta-information;

[0167] In this embodiment, the obtained ciphertext-written data is submitted to the private blockchain network locally connected to the terminal. According to the pre-configured node list, the best writing target node is selected, and the selection criteria are based on the comprehensive scores of node load, network latency, and available storage space. Specifically, the node load reflects the node's processing capacity and the current task pressure, and its weight is usually set to 40% to ensure that the writing node will not experience performance degradation due to overload; the network latency represents the data transmission delay, and its weight is set to 35% to ensure fast data writing and synchronization; the available storage space reflects the node's capacity for storing new blocks, and its weight is set to 25% to ensure that the node has sufficient resources to complete the writing operation. The comprehensive scoring formula is: Comprehensive score = 0.4 × Node load score + 0.35 × Network latency score + 0.25 × Storage space score; then the writing node is selected through the sorting of the node comprehensive scores. When submitting, the current node number (unique identifier string), the new block index (integer increment value), and the writing timestamp (accurate to milliseconds) are recorded as the blockchain writing meta-information. The meta-information is saved in the form of a structure, and the fields include "nodeID", "blockIndex", and "timestamp", which are associated with the ciphertext-written data to ensure the traceability and integrity of the blockchain storage.

[0168] Step S34: On the writing target node, perform a content packaging operation on the ciphertext-written data and the blockchain writing meta-information to obtain the block content body;

[0169] In this embodiment, the selected writing target node packages the ciphertext-written data and the blockchain writing meta-information. The content body adopts a binary stream format, serializes and merges the ciphertext data and the meta-information, and inserts a delimiter field with a fixed length for parsing and identification. The content body structure is divided into three parts: the data header (including the meta-information), the data body (ciphertext-written data), and the checksum area. This structure design takes into account both storage efficiency and data integrity, facilitating subsequent processing and verification by blockchain nodes. After packaging, the data body is written into the temporary buffer area of the target node, preparing for subsequent hash digest operations.

[0170] Step S35: Perform Merkle tree digest construction and node-level hash calculation on the block content body to obtain the block hash value, and write it into the block header of the target node to generate the audit chain hash block.

[0171] In this embodiment, the node performs Merkle tree digest construction on the block content body. Specifically, the content body is divided into a sequence of data blocks of a fixed size (such as 1 KB), and each data block is hashed to generate leaf node hashes. The intermediate nodes of the Merkle tree are recursively constructed by combining the hashes in pairs, and finally the root hash value is obtained. Subsequently, this root hash value is written as the block hash into the header information of the target node block. The block header structure includes fields such as version number, parent block hash, Merkle root hash, timestamp, and difficulty value. This operation ensures the immutability and integrity of the block content, forming an audit chain hash block to support subsequent blockchain audit and verification processes.

[0172] Optionally, step S4 is specifically as follows:

[0173] Step S41: Obtain the real-time transaction data generated by the cashier terminal in the current transaction process, and perform normalization processing on each field in the real-time transaction data to obtain a structured transaction data set;

[0174] In this embodiment, detailed information is obtained from the transaction process data collected in real time from the cashier terminal. The real-time transaction data includes multi-dimensional fields such as transaction amount, product number, payment method, timestamp, and user terminal number. When performing normalization processing on each field, a linear scaling method is used to map the numerical values of each field to the interval [0, 1] to ensure the numerical stability of subsequent processing. The normalization process is dynamically updated based on the maximum and minimum values of the fields, and the timestamp field is converted into a standard time series value to generate a structured transaction data set. This data set is stored in the form of a two-dimensional array, with each row corresponding to a transaction and each column corresponding to the normalized numerical value of the field, in the format of a floating-point matrix, which is convenient for subsequent calculation and processing.

[0175] Step S42: Perform a joint index calculation on the structured transaction data set using the audit chain hash block and the session key set, and extract the public key parameter and the session identifier from the calculation result to construct a set of encrypted context parameters;

[0176] In this embodiment, the previously generated audit chain hash block and the current session key set are jointly used as the indexing benchmark to perform joint indexing calculation on the structured transaction data set. The specific operation is to match the unique session identifier of each transaction record in the transaction data matrix with the corresponding session ID in the session key identifier vector one by one to establish a one-to-one correspondence. Then, the transaction record row with a successful match is associated and bound with the hash value at the same index position in the corresponding blockchain hash value vector to construct a triple data structure, which includes three elements: transaction record, session identifier, and blockchain hash value. The set of triples is stored in tabular form, where each row contains the normalized field vector (such as an array of floating-point numbers) corresponding to a transaction, the corresponding string-type session ID, and a fixed-length hash byte array. Subsequently, according to this triple structure, a set of encrypted context parameters is generated, and this set is encapsulated into a composite data structure that includes: 1) a subset of the transaction data matrix, 2) a session identifier mapping table, and 3) a blockchain hash value mapping table. This set includes a public key parameter matrix and a session identifier vector. The public key parameter matrix is a multi-dimensional floating-point array representing the key space mapping related to the encryption algorithm; the session identifier vector is an array of strings marking the unique IDs of different transaction sessions. Through this mapping, it ensures the session dependence and integrity verification basis of the encryption operation.

[0177] Step S43: Perform field-level encryption operations on each field in the structured transaction data set based on the set of encrypted context parameters to generate a set of encrypted vectors;

[0178] In this embodiment, based on the set of encrypted context parameters, each field in the structured transaction data set is encrypted. Each field corresponds to an encrypted vector, and the vector length is the same as the encryption key length. In the encryption operation, the field value is mapped and transformed using the context parameters, and combined with the field characteristics and the key space to achieve multi-dimensional encrypted expression. The finally output set of encrypted vectors is a three-dimensional floating-point matrix with a size of "number of transactions × number of fields × vector dimension", such as 100 transactions, 5 fields, and 256-dimensional encrypted vectors. This matrix form facilitates data storage and the management of subsequent decryption operations.

[0179] Step S44: Pack the set of encrypted vectors according to the communication format of the cash register terminal to construct a homomorphic ciphertext packet to be transmitted;

[0180] In this embodiment, the above encryption vector set is data-packed according to the communication protocol format of the cash register terminal. The communication format adopts the TLV (Type-Length-Value) encoding structure to classify and identify each encrypted vector data, marking the field type, the length of the encryption vector, and the actual encrypted data content. The packing process includes multi-level encapsulation, supports batch transmission of multiple transactions, and attaches a communication frame header and a check code to ensure the integrity and correctness of data transmission. The generated homomorphic ciphertext packet is a binary data stream and can be directly sent through the terminal communication interface.

[0181] Step S45: Invoke the communication transmission control program in the cash register terminal, load the homomorphic ciphertext packet to be transmitted into the asynchronous transmission buffer queue, select the corresponding logical channel according to the structured encryption channel mapping table, and perform the encrypted path sending operation.

[0182] In this embodiment, the communication transmission control program built into the cash register terminal loads the homomorphic ciphertext packet to be transmitted into the asynchronous transmission buffer queue, supports multi-threaded concurrent processing, and avoids transmission blocking. The program selects the best logical channel according to the structured encryption channel mapping table. The logical channel corresponds to a preset combination of network paths and encryption parameters to ensure secure data transmission. The encrypted path sending operation includes segmented data packet transmission, retransmission management, and flow control mechanism to improve transmission reliability and real-time performance. Each transmission is accompanied by a session number and a timestamp to ensure communication status tracking and exception recovery.

[0183] Optionally, the dynamic key renegotiation in step S5 is specifically as follows:

[0184] Perform communication quality monitoring on the information transmission data collected in real time by the cash register terminal, and extract information transmission metrics including the retransmission rate, delay jitter, and the number of times of channel integrity check failure;

[0185] Based on the set key rotation trigger threshold set including a retransmission rate > 12%, a delay jitter > 30 ms, and two consecutive channel integrity check failures, perform anomaly judgment on the real-time information transmission metrics. If all the thresholds in the key rotation trigger threshold set are satisfied simultaneously, enter the key renegotiation process; otherwise, maintain the original key session.

[0186] In this embodiment, for the communication data collected in real time by the cash register terminal, communication quality monitoring is first performed. For the packet transmission situation within each time window, key indicators such as the retransmission rate, delay jitter, and the number of channel integrity check failures are extracted. The retransmission rate is expressed as the ratio of the number of retransmitted packets to the total number of transmitted packets within the time window, and the threshold is set to exceed 12%. The delay jitter is calculated by the variation range of the delay of consecutive packets, and if it exceeds 30 milliseconds, it is regarded as abnormal. The channel integrity check failure count is accumulated based on the continuously detected error codes, and an alarm is triggered when there are more than two consecutive failures. All indicators are uniformly stored in the communication monitoring matrix, where the rows of the matrix are time series windows and the columns are indicator values, facilitating real-time analysis and threshold comparison. Then, the real-time collected communication indicators are compared item by item with the preset key rotation trigger threshold set. When the retransmission rate, delay jitter, and the number of consecutive integrity check failures all meet the threshold conditions, the key renegotiation process is triggered. If any one of the indicators does not meet the standard, the existing session key remains unchanged to ensure communication stability and performance.

[0187] The key renegotiation process includes:

[0188] Pack the current terminal number, the information transmission indicator that triggers the key rotation threshold, and the current timestamp to obtain a key update request, and send the key update request to the peer server;

[0189] The cash register terminal uses the joint identity credential to perform binding authentication on the new perturbation seed generated by the pseudo-random function returned by the peer server, the current key negotiation protocol fragment, and the current key fragment in the session key set to obtain an updated negotiation key packet;

[0190] In this embodiment, a key re-negotiation process is triggered in the communication abnormal state. First, after the cash register terminal completes the abnormal determination based on preset abnormal judgment conditions (including but not limited to a retransmission rate exceeding 12%, a delay jitter exceeding 30 ms, and two consecutive channel integrity check failures), it structures and encapsulates the current terminal number (such as the 32-bit hexadecimal unique identifier "C2D8A9F0"), the communication abnormal metrics collected at the time of triggering (such as the actual retransmission rate being 15.6%, the delay jitter being 43 ms, and the check failure count being 2), and the high-precision session timestamp (such as "20250527113547231") to form a key update request structure. The format of this structure is fixed, including fields: "terminalID", "errorMetrics", and "timestamp", and it is transmitted to the peer server through the existing encrypted channel to ensure the anti-eavesdropping and anti-tampering of the request data during transmission. After receiving the key update request, the server generates a new set of negotiation elements, including a new perturbation seed (such as a 64-byte binary string generated based on the pseudo-random function PRF(seed, input), using the communication abnormal metrics as the input perturbation factor to improve unpredictability), a current key negotiation protocol fragment (such as including a 64-byte random number, elliptic curve Diffie-Hellman negotiation parameters P and G, server signature authentication data, and a response timestamp), and a current session key fragment (such as the 3rd 256-bit sub-key selected from the currently used session key set, with the number KeyID = 3, dedicated to the encryption task of the logical path L1 and the structured field F7). After receiving the set of data returned by the server, the cash register terminal calls its local combined identity credentials (such as an identity key set generated based on the terminal device fingerprint, manufacturer private key signature, and the bound identity hash at startup initialization) to perform binding authentication on the above three elements. The binding authentication process includes: performing a hash consistency check on the current key fragment returned by the server and the local current session key fragment; verifying whether the timestamp in the current key negotiation protocol fragment deviates from the local system time by less than 500 ms; and verifying whether the authentication information matches the local device identity key set. If all verifications pass, it is encapsulated into an updated negotiation key packet, and this key packet is marked as having passed the identity consistency and data integrity verification.

[0191] Execute dynamic key negotiation by combining the updated negotiation key packet and the combined identity credentials to generate an updated session key set;

[0192] In this embodiment, the cash register terminal inputs the updated negotiation key packet and the combined identity credentials into the dynamic key negotiation framework of step S2, and generates a new session key set through a multi-stage key update process. The new key set is stored in the form of a high-dimensional matrix, where each row corresponds to a set of session key fragments, and each column represents different key characteristic parameters to ensure efficient key update and management.

[0193] Reconstruct the multi-logical path set, structured encryption channel mapping table, and encryption rule set based on the updated session key set to form updated distributed ciphertext channel parameters;

[0194] In this embodiment, after the session key set is updated, the multi-logical path set, structured encryption channel mapping table, and encryption rule set are reconstructed based on the new key set to form a new distributed ciphertext channel parameter data structure, that is, the process of multi-logical path mapping and channel encryption configuration in step S2 is re-executed. This data structure integrates the path topology matrix, key mapping table, and encryption policy matrix to achieve dynamic adjustment of path encryption configuration.

[0195] Iteratively execute steps S3 to S5 using the updated distributed ciphertext channel parameters until the anomaly detection result returns within the key rotation trigger threshold set.

[0196] In this embodiment, using the updated distributed ciphertext channel parameters, automatically iteratively execute steps such as communication path selection, encryption configuration, and ciphertext transmission control until the communication quality indicators all return within the key rotation trigger threshold to ensure the continuous, safe, and stable operation of the system.

[0197] Optionally, this specification also provides a data encryption communication system applied to an intelligent cash register for executing the data encryption communication method applied to the intelligent cash register. The data encryption communication system applied to the intelligent cash register includes:

[0198] An identity credential generation module for collecting user touch data and device hardware fingerprints, and performing high-dimensional feature fusion encoding on the device hardware fingerprints and user touch data to obtain a combined identity credential;

[0199] A key generation module for obtaining the original key negotiation protocol and transmission metadata of the peer server, performing dynamic key negotiation using the combined identity credential and the original key negotiation protocol of the peer server to obtain a session key set; performing multi-logical path mapping and channel encryption configuration based on the session key set to obtain distributed ciphertext channel parameters;

[0200] A blockchain writing module for encrypting and writing the distributed ciphertext channel parameters and the corresponding transmission metadata into a preset private blockchain node, and performing block content packaging and node hash calculation to obtain an audit chain hash block;

[0201] A homomorphic encryption module for performing homomorphic encryption processing on the obtained real-time transaction data based on the audit chain hash block and the session key set to obtain a to-be-transmitted homomorphic ciphertext, and loading the to-be-transmitted homomorphic ciphertext to the cash register communication transmission module to execute information transmission;

[0202] A transmission feedback module is used to detect communication transmission anomalies in the information transmission data collected in real time. When the anomaly detection result exceeds a preset key rotation trigger threshold set, it triggers dynamic key renegotiation and iteratively executes from the key generation module to the transmission feedback module until the anomaly detection result returns within the key rotation trigger threshold set.

[0203] Therefore, from any perspective, the embodiments should be regarded as exemplary and non-limiting. The scope of the present invention is defined by the appended claims rather than the above description. Therefore, all changes falling within the meaning and scope of the equivalent elements of the application document are intended to be encompassed within the present invention.

[0204] The above description is only a specific implementation manner of the present invention, enabling those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be obvious to those skilled in the art. The general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to these embodiments shown herein, but rather to the broadest scope consistent with the principles and novel features invented herein.

Claims

1. A data encryption communication method applied to an intelligent cash register, characterized in that, Applied to an intelligent cash register terminal, which includes a sensor module, a power supply module, a controller, and a communication transmission module electrically connected to the controller. The sensor module and the power supply module are both electrically connected to the controller. The data encryption communication method for the intelligent cash register includes the following steps: Step S1: Collect user touch data and device hardware fingerprints, and perform high-dimensional feature fusion encoding on the device hardware fingerprints and user touch data to obtain a joint identity credential. Step S2: Obtain the original key negotiation protocol and transmission metadata of the peer server, perform dynamic key negotiation using the joint identity credential and the original key negotiation protocol of the peer server to obtain a session key set; perform multi-logical path mapping and channel encryption configuration based on the session key set to obtain distributed ciphertext channel parameters. Step S3: Encrypt the distributed ciphertext channel parameters and the corresponding transmission metadata and write them into a preset private blockchain node, and perform block content packaging and node hash calculation to obtain an audit chain hash block. Step S4: Perform homomorphic encryption processing on the obtained real-time transaction data based on the audit chain hash block and the session key set to obtain a homomorphic ciphertext to be transmitted, and load the homomorphic ciphertext to be transmitted into the communication transmission module of the cash register to perform information transmission. Step S5: Perform communication transmission anomaly detection on the real-time collected information transmission data. When the anomaly detection result exceeds the preset key rotation trigger threshold set, trigger dynamic key renegotiation, and iteratively execute steps S2 to S5 until the anomaly detection result returns within the key rotation trigger threshold set.

2. The data encryption communication method applied to the intelligent cash register according to claim 1, wherein Step S1 is specifically as follows: Step S11: Obtain touch trajectory data, click timing data, and pressure change data during the user's operation through the sensor module, so as to construct user touch data. Step S12: Call the security hardware identification interface embedded in the cash register, read the hardware features of the device's motherboard number, power supply identification code, terminal fingerprint, MAC address, and startup boot code, and construct device hardware fingerprint data according to the preset hierarchical identification mapping rules. Step S13: Perform heterogeneous feature joint encoding on the user touch data and the device hardware fingerprint data to obtain high-dimensional fusion encoded data. Step S14: Perform variational regularization processing and noise feature suppression on the high-dimensional fusion encoded data, calculate the credibility index of each fusion dimension, and write the fusion vectors with credibility greater than the set credible threshold of 0.82 into a preset credential structure to obtain an initial joint identity credential. Step S15: Perform hash signature on the initial joint identity credential and append a time stamp, the corresponding preset terminal number, and a perturbation seed generated by a preset pseudo-random function to obtain the joint identity credential.

3. The data encryption communication method applied to the intelligent cash register according to claim 2, wherein, Step S13 is specifically as follows: Step S131: Normalize the user touch data and the device hardware fingerprint data respectively to obtain a touch feature tensor and a hardware feature tensor. Step S132: Perform heterogeneous tensor dimension standardization transformation on the touch feature tensor and the hardware feature tensor to obtain a standardized touch feature tensor and a standardized hardware feature tensor. Step S133: Perform feature alignment and interaction correlation analysis on the standardized touch feature tensor and the standardized hardware feature tensor, extract the interaction correlation mapping matrix, and perform a linear weighted fusion operation based on the interaction correlation mapping matrix to generate a preliminary fusion vector; Step S134: Perform stability enhancement and normalization re-encoding on the preliminary fusion vector to obtain high-dimensional fusion encoded data.

4. The data encryption communication method applied to an intelligent cash register according to claim 2, wherein, Step S14 is specifically as follows: Step S141: Perform feature distribution modeling on the high-dimensional fusion encoded data to generate distribution residual parameters; Step S142: Filter and mask the dimensions in the high-dimensional fusion encoded data that are higher than the mean of the residual distribution variance according to the distribution residual parameters, and at the same time perform sliding window entropy analysis to identify the dimensions with short-term surges in the high-dimensional fusion encoded data, mark the dimensions with short-term surges as noise channels, and set the weights of the noise channels to 0, so as to obtain a stable encoded vector; Step S143: Calculate the credibility index of each fusion dimension in the stable encoded vector to obtain a credibility vector; Step S144: Perform mapping screening on the corresponding positions of the credibility vector and the stable encoded vector, retain all dimensions with a credibility ≥ 0.82, and construct a credible fusion vector based on the retained dimensions; Step S145: Fill the credible fusion vector into a predefined credential structure to obtain an initial joint identity credential.

5. The data encryption communication method applied to the intelligent cash register according to claim 1, characterized in that, The dynamic key negotiation in Step S2 is specifically as follows: Receive the original key negotiation protocol fragment and transmission metadata from the peer server, extract the negotiation parameter field, and perform protocol content integrity verification in combination with the obtained current session timestamp to obtain a negotiation request structure; Extract the terminal number and perturbation seed based on the joint identity credential, and perform a two-way perturbation function calculation on the negotiation timestamp field in the negotiation request structure to obtain a perturbation factor vector; Concatenate the perturbation factor vector with the negotiation parameter field in the negotiation request structure and perform a hash calculation to obtain an initial key sequence; Perform bit-by-bit sliding window splitting on the initial key sequence, and map the split key fragments into a preset data structure to obtain a key shard set; Construct a triple for each key fragment in the key shard set with the negotiation timestamp and the terminal number, and perform an incremental numbering time sequence index mapping to obtain a session key set.

6. The data encryption communication method applied to the intelligent cash register according to claim 1, characterized in that, The multi-logical path mapping and channel encryption configuration in Step S2 are specifically as follows: Extract the key pair set from the session key set, construct a path candidate topology graph according to the predefined path topology template, and map it to each hop path in the path candidate topology graph with the key pair as the weight parameter to generate a logical path candidate matrix; Obtain the cash register communication data including the communication delay, node load, and hop count limit between the cash register terminal and the server; Based on the logical path candidate matrix, perform path selection scoring in combination with the cash register communication data, and filter out a multi-logical path set with a score value ≥ 0.75; Segment each path in the multi-logical path set, bind the key fragments of the session key set according to the transmission node pairs between the path segments, and generate a unique encryption index for each path segment to obtain a structured encryption channel mapping table; According to the path segments and key pairs in the structured encryption channel mapping table, combined with the preset encryption configuration rule set, define the corresponding encryption configuration rules for each path segment, generate an encryption rule set, and register the encryption rule set in the encryption policy cache pool of the cash register terminal; Bind and encapsulate the multi-logical path set, structured encryption channel mapping table, and encryption rule set, and append the current session number, timestamp, and terminal number to generate distributed ciphertext channel parameters.

7. The data encryption communication method applied to the intelligent cash register according to claim 1, wherein Step S3 is specifically as follows: Step S31: Extract the multi-logical path set, structured encryption channel mapping table, and encryption rule set from the distributed ciphertext channel parameters, and construct an encrypted write object structure with transmission metadata attached; Step S32: Select a symmetric encryption key from the session key set and perform AES-GCM encryption processing on the encrypted write object structure to obtain ciphertext write data; Step S33: Submit the ciphertext write data to the private blockchain network connected locally to the terminal, select the write target node and record the current node number, block index, and timestamp to construct blockchain write meta-information; Step S34: Perform content packaging on the ciphertext write data and blockchain write meta-information on the write target node to obtain a block content body; Step S35: Perform Merkle tree digest construction and node-level hash calculation on the block content body to obtain a block hash value, and write it into the block header of the target node to generate an audit chain hash block.

8. The data encryption communication method applied to an intelligent cash register according to claim 1, characterized in that, Step S4 is specifically as follows: Step S41: Obtain the real-time transaction data generated by the cash register terminal in the current transaction process, and perform normalization processing on each field in the real-time transaction data to obtain a structured transaction data set; Step S42: Use the audit chain hash block and session key set to perform a joint index calculation on the structured transaction data set, and extract the public key parameter and session identifier from the calculation result to construct an encryption context parameter set; Step S43: Perform field-level encryption operations on each field in the structured transaction data set based on the encryption context parameter set to generate an encryption vector set; Step S44: Package the encryption vector set according to the communication format of the cash register terminal to construct a to-be-transmitted homomorphic ciphertext package; Step S45: Call the communication transmission control program in the cash register terminal, load the to-be-transmitted homomorphic ciphertext package into the asynchronous transmission cache queue, and select the corresponding logical channel according to the structured encryption channel mapping table to perform an encrypted path sending operation.

9. The data encryption communication method applied to the intelligent cash register according to claim 1, wherein, The dynamic key renegotiation in Step S5 is specifically as follows: Perform communication quality monitoring on the information transmission data collected in real time by the cash register terminal, and extract information transmission metrics including retransmission rate, delay jitter, and number of channel integrity check failures; Based on the set key rotation trigger threshold set including retransmission rate > 12%, delay jitter > 30ms, and continuous 2 channel integrity check failures, perform anomaly judgment on the real-time information transmission metrics. If all the thresholds in the key rotation trigger threshold set are satisfied simultaneously, enter the key renegotiation process; otherwise, maintain the original key session; The key renegotiation process includes: Pack the current terminal number, the information transmission metrics for triggering the key rotation threshold, and the current timestamp to obtain a key update request, and send the key update request to the peer server; The cash register terminal uses the combined identity credential to perform binding authentication on the new perturbation seed generated by the pseudo-random function returned by the peer server, the current key negotiation protocol fragment, and the current key fragment in the session key set to obtain an updated negotiation key package; Perform dynamic key negotiation by combining the updated negotiation key package and the combined identity credential to generate an updated session key set; Based on the updated session key set, reconstruct the multi-logical path set, the structured encryption channel mapping table, and the encryption rule set to form updated distributed ciphertext channel parameters; Use the updated distributed ciphertext channel parameters to iteratively execute steps S3 to S5 until the anomaly detection result returns within the key rotation trigger threshold set; 10. A data encryption communication system applied to an intelligent cash register, characterized in that, For implementing the data encryption communication method applied to an intelligent cash register as described in claim 1, the data encryption communication system applied to an intelligent cash register includes: An identity credential generation module, configured to collect user touch data and device hardware fingerprints, and perform high-dimensional feature fusion encoding on the device hardware fingerprints and the user touch data to obtain a combined identity credential; A key generation module, configured to obtain the original key negotiation protocol and transmission metadata of the peer server, perform dynamic key negotiation using the combined identity credential and the original key negotiation protocol of the peer server to obtain a session key set; perform multi-logical path mapping and channel encryption configuration based on the session key set to obtain distributed ciphertext channel parameters; A blockchain writing module, configured to encrypt the distributed ciphertext channel parameters and the corresponding transmission metadata and write them into a preset private blockchain node, and perform block content packaging and node hash calculation to obtain an audit chain hash block; A homomorphic encryption module, configured to perform homomorphic encryption processing on the obtained real-time transaction data based on the audit chain hash block and the session key set to obtain a to-be-transmitted homomorphic ciphertext, and load the to-be-transmitted homomorphic ciphertext to the cash register communication transmission module to perform information transmission; A transmission feedback module, configured to perform communication transmission anomaly detection on the real-time collected information transmission data. When the anomaly detection result exceeds the preset key rotation trigger threshold set, trigger dynamic key renegotiation, and iteratively execute from the key generation module to the transmission feedback module until the anomaly detection result returns within the key rotation trigger threshold set.

Images