A terminal security operation control method and device

Abstract

This application discloses a terminal security operation control method and apparatus. In this embodiment, when a terminal accesses a target component and the component parameters of the target component meet the terminal's preset conditions, the transmission circuit between the terminal and the target component is activated. While the transmission circuit is activated, the terminal's operating state is securely verified to obtain security verification information. The terminal's temporary communication credentials are updated at preset time intervals to obtain credential update information. When at least one of the security verification information and the credential update information matches preset abnormal information, the terminal's operating mode is switched to a restricted state. In this embodiment, the illegal modification of the terminal and the resulting malicious attacks can be effectively prevented, ensuring its reliable and secure operation in complex network environments.

Description

Technical Field

[0001] This application relates to the field of computers, specifically to a terminal security operation control method and apparatus. Background Technology

[0002] With the rapid development of IoT technology, smart terminal devices (such as electric bicycles, industrial sensors, and smart gateways) have been widely used in transportation, energy, and manufacturing. These terminals typically consist of multiple functional modules, including a main control unit, communication module, power management module (such as a removable battery), and positioning module. To facilitate maintenance or reduce costs, some modules are designed to be pluggable or replaceable.

[0003] However, in practical applications, users or third-party service providers often modify terminals using non-original, unauthorized replacement modules (such as third-party batteries or compatible communication modules). These unauthorized modules often lack strict security verification mechanisms and may have issues such as firmware tampering, hardware counterfeiting, or missing security chips. Once connected to the terminal system, they may not only cause abnormal terminal performance or shortened lifespan, but more seriously, they may become entry points for attacks.

[0004] In existing technologies, although some terminals perform basic parameter verification (such as model identification or voltage specifications) on core components during the startup phase, such verification usually relies on static information transmitted in plaintext, which is easily counterfeited or tampered with. Moreover, it is not linked with the terminal's secure operation mechanism, making it difficult to effectively prevent abnormal operation caused by unauthorized component access. Summary of the Invention

[0005] This application provides a terminal security operation control method and apparatus, which can effectively prevent the terminal from being illegally modified and the malicious attacks caused therefrom, and ensure its reliable and secure operation in complex network environments.

[0006] This application provides a terminal security operation control method, including:

[0007] When the terminal connects to the target component and the component parameters of the target component meet the preset conditions of the terminal, the transmission circuit between the terminal and the target component is activated.

[0008] With the transmission circuit on, the terminal's operating status is verified to obtain security verification information.

[0009] The temporary communication credentials of the terminal are updated at preset time intervals to obtain credential update information.

[0010] When at least one of the security verification information and credential update information matches a preset abnormal information, the terminal's operating mode is switched to a restricted state.

[0011] This application embodiment also provides a terminal security operation control device, including:

[0012] The circuit conduction unit is used to conduct the transmission circuit between the terminal and the target component when the terminal is connected to the target component and the component parameters of the target component meet the preset conditions of the terminal.

[0013] The security verification unit is used to perform security verification on the terminal's operating status when the transmission circuit is on, and obtain security verification information.

[0014] The credential update unit is used to update the temporary communication credentials of the terminal at preset time intervals to obtain credential update information.

[0015] The mode switching unit is used to switch the terminal's operating mode to a restricted state when at least one of the security verification information and the credential update information matches a preset abnormal information.

[0016] In some embodiments, when a terminal accesses a target component and the component parameters of the target component meet the terminal's preset conditions, activating the transmission circuit between the terminal and the target component includes:

[0017] When the terminal connects to the target component, the identity representation signal output by the identity recognition interface of the target component is detected through the component verification circuit of the terminal.

[0018] If the identity verification signal does not meet the terminal's preset conditions, communication with the target component is prohibited, and the transmission circuit between the terminal and the target component remains disconnected.

[0019] If the identity representation signal meets the terminal's preset conditions, it communicates with the target component to obtain the target component's component parameters;

[0020] When the component parameters of the target component meet the preset conditions of the terminal, the transmission circuit between the terminal and the target component is activated.

[0021] In some embodiments, a security verification is performed on the terminal's operating status to obtain security verification information, including:

[0022] Initiate an authentication handshake request to the server using a secure transport protocol;

[0023] The server receives the server identity credentials returned by the server based on the authentication handshake request, verifies the server identity credentials, and obtains the server authentication result.

[0024] If the server authentication result indicates that the server's identity is valid, then the terminal's identity credentials are sent to the server so that the server can verify the terminal's identity credentials and obtain the terminal authentication result.

[0025] Receive the terminal authentication result returned by the server;

[0026] When both the server authentication result and the terminal authentication result indicate that the identity is legitimate, an encrypted communication channel is established with the server, and the establishment information of the encrypted communication channel is obtained;

[0027] Security verification information is generated based on the establishment information of the encrypted communication channel.

[0028] In some embodiments, security verification information is generated based on the establishment information of the encrypted communication channel, including:

[0029] If the information indicates that the encrypted communication channel has been successfully established, then the first security verification information is generated, which indicates that the terminal is in normal operating condition.

[0030] If the established information indicates that the encrypted communication channel has not been successfully established, a second security verification message is generated, which indicates that the terminal is in an abnormal operating state.

[0031] In some embodiments, a security verification is performed on the terminal's operating status to obtain security verification information, including:

[0032] Get the information to be uploaded and the current timestamp, where the current timestamp is the terminal's current time;

[0033] Embed the current timestamp into the information to be uploaded to generate report data carrying the current timestamp;

[0034] The server sends reported data to the server so that the server can perform duplicate detection on the reported data based on the current timestamp and historical timestamp in the reported data and obtain the duplicate detection result. The historical timestamp is the timestamp of the terminal that was received in the historical time period.

[0035] Receive the duplicate detection results returned by the server;

[0036] Security verification information is generated based on the repeatability test results.

[0037] In some embodiments, security verification information is generated based on repeatability test results, including:

[0038] If the repeatability test result indicates that the current timestamp and the historical timestamp are not repeated, then the first security verification information is generated, which indicates that the terminal is in normal operating condition.

[0039] If the repeatability test result indicates that the current timestamp is repeated with a historical timestamp, a second security verification message is generated, which indicates that the terminal is in an abnormal operating state.

[0040] In some embodiments, a security verification is performed on the terminal's operating status to obtain security verification information, including:

[0041] When the terminal's network connection status is not satellite communication, it initiates an authentication handshake request to the server through a secure transmission protocol.

[0042] The server receives the server identity credentials returned by the server based on the authentication handshake request, verifies the server identity credentials, and obtains the server authentication result.

[0043] If the server authentication result indicates that the server's identity is valid, then the terminal's identity credentials are sent to the server so that the server can verify the terminal's identity credentials and obtain the terminal authentication result.

[0044] Receive the terminal authentication result returned by the server;

[0045] When both the server authentication result and the terminal authentication result indicate that the identity is legitimate, an encrypted communication channel is established with the server, and the establishment information of the encrypted communication channel is obtained;

[0046] Security verification information is generated based on the establishment information of the encrypted communication channel;

[0047] When the terminal's network connection status is satellite communication, obtain the information to be uploaded and the current timestamp, which is the terminal's current time;

[0048] Embed the current timestamp into the information to be uploaded to generate report data carrying the current timestamp;

[0049] The server sends reported data to the server so that the server can perform duplicate detection on the reported data based on the current timestamp and historical timestamp in the reported data and obtain the duplicate detection result. The historical timestamp is the timestamp of the terminal that was received in the historical time period.

[0050] Receive the duplicate detection results returned by the server;

[0051] Security verification information is generated based on the repeatability test results.

[0052] In some embodiments, the temporary communication credentials of the terminal are updated at preset time intervals to obtain credential update information, including:

[0053] At preset time intervals, a credential update request is sent to the server. The credential update request is used to request the update of the terminal's temporary communication credentials.

[0054] Receive the new temporary communication credential returned by the server based on the credential update request;

[0055] Based on the new temporary communication credential, the temporary communication credential is updated to obtain credential update information.

[0056] In some embodiments, it also includes:

[0057] Anomaly detection processing is performed on the current signal of the terminal to obtain current anomaly information;

[0058] Anomaly detection and processing are performed on the terminal's communication protocol to obtain protocol anomaly information;

[0059] Based on at least one of the current anomaly information and the protocol anomaly information, it is determined that the terminal is in an abnormal operating state.

[0060] Based on the abnormal operating status, switch the terminal's operating mode to a restricted state.

[0061] This application also provides an electronic device, including a processor and a memory, wherein the memory stores multiple instructions; the processor loads instructions from the memory to execute the steps in any of the terminal security operation control methods provided in this application.

[0062] This application also provides a computer-readable storage medium storing multiple instructions adapted for loading by a processor to execute steps in any of the terminal security operation control methods provided in this application.

[0063] This application also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of any of the terminal security operation control methods provided in this application.

[0064] In this embodiment, when a terminal accesses a target component and the component parameters of the target component meet the terminal's preset conditions, the transmission circuit between the terminal and the target component is activated. When the transmission circuit is activated, the terminal's operating status is verified to obtain security verification information. The terminal's temporary communication credentials are updated at preset time intervals to obtain credential update information. When at least one of the security verification information and the credential update information matches preset abnormal information, the terminal's operating mode is switched to a restricted state.

[0065] In this application, although the terminal is physically connected to the target component, the transmission circuit between the terminal and the target component is only activated when the component parameters of the target component meet the terminal's preset security conditions, thereby initially blocking unauthorized modification behavior at the hardware level. After the transmission circuit is activated, the terminal enters the operating state and further performs security verification on the terminal's operating state to obtain security verification information. It also dynamically updates the terminal's temporary communication credentials at preset time intervals to obtain credential update information. When at least one of the security verification information and credential update information matches preset abnormal information, the terminal's operating mode is switched to a restricted state to prevent the target component from bypassing access control by forging or circumventing component parameters, thus posing a security threat to the terminal's operation and continuously strengthening the terminal's operational security. Through a multi-stage collaborative protection mechanism, including hardware access control based on component parameters, security verification of the operating state, and periodic rotation of temporary communication credentials, it is possible to effectively prevent the terminal from being illegally modified and the malicious attacks arising therefrom, ensuring its reliable and secure operation in complex network environments. Attached Figure Description

[0066] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0067] Figure 1 This is a flowchart illustrating the terminal security operation control method provided in the embodiments of this application;

[0068] Figure 2 This is a schematic diagram of the terminal security operation control device provided in the embodiments of this application; Detailed Implementation

[0069] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0070] This application provides a terminal security operation control method and apparatus.

[0071] Specifically, the terminal security operation control device can be integrated into an electronic device, such as a terminal or server. The terminal can be a mobile phone, tablet, smart Bluetooth device, laptop, or personal computer (PC); the server can be a single server or a server cluster composed of multiple servers.

[0072] In some embodiments, the terminal security operation control device can also be integrated into multiple electronic devices. For example, the terminal security operation control device can be integrated into multiple servers, and the terminal security operation control method of this application can be implemented by multiple servers.

[0073] In some embodiments, the terminal can also be used as a server to implement some or all of the functions of a server.

[0074] In the embodiments of this application, the terms "module" or "unit" refer to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.

[0075] The following sections provide detailed descriptions of each example. It should be noted that the sequence numbers of the following embodiments are not intended to limit the preferred order of the embodiments.

[0076] In this embodiment, a terminal security operation control method is provided, such as... Figure 1 As shown, the specific process of this terminal security operation control method can be as follows:

[0077] 101. When the terminal connects to the target component and the component parameters of the target component meet the preset conditions of the terminal, the transmission circuit between the terminal and the target component is turned on.

[0078] A terminal is a device capable of connecting and communicating with external components or systems to perform specific functions or services. These devices typically possess data processing capabilities, input / output interfaces, and the ability to interconnect with other devices or networks. They can be mobile or fixed and are widely used in various fields such as personal consumer electronics, industrial automation, smart homes, and transportation. The core of a terminal lies in its ability to act as a node for information interaction, supporting interaction between users and devices or communication between devices.

[0079] A terminal specifically refers to devices designed to connect to specific external components (such as batteries and sensors) to enhance or complete their own functions. These terminals include not only basic hardware (such as processors and memory) but also mechanisms specifically designed to detect, identify, and be compatible with external components. For example, in the application scenario of electric bicycles, the terminal refers to the vehicle itself, which receives power by accepting and matching a suitable battery; while in smart meters or financial devices, the terminal involves devices that can securely and reliably interface with external modules (such as payment card readers and data recording units).

[0080] A target component refers to any external hardware module that can connect to a terminal device and provide it with additional functions or services. These components can be physical entities (such as batteries, sensors, etc.) or software-level interfaces (such as APIs, drivers, etc.). They interact with the terminal device through specific communication protocols or physical interfaces to achieve data exchange, functional expansion, or other purposes.

[0081] Target components specifically refer to external devices designed to enhance the functionality of a terminal. For example, in the application scenario of electric bicycles, the target component might be a rechargeable battery; in the case of smart meters, it might be a data acquisition unit for recording electricity consumption; and for financial devices, the target component might be a card reader or an encryption module, etc.

[0082] Component parameters represent the performance indicators and technical specifications of a target component, describing its operating status, functional characteristics, and compatibility with other devices. These parameters include, but are not limited to, physical dimensions, electrical characteristics, and communication protocol versions. Component parameters specifically point to those important attributes that directly affect whether the target component can successfully interface with the terminal. For example, when considering a battery as a target component, key parameters include voltage range, maximum current output capability, and chemistry type; for a data acquisition unit, the focus is on sampling rate, accuracy, and communication interface standards.

[0083] Preset conditions refer to a set of rules or standards set by a terminal to ensure safe and effective access to target components. These conditions are formulated based on the terminal's design purpose, usage environment, and expected functions, aiming to ensure the stability and security of the entire system. It can be understood that preset conditions specifically refer to the standards or thresholds set by the terminal to identify and select appropriate external components. For example, an electric bicycle may only accept batteries that meet a specific voltage range; a smart meter may only allow certified data acquisition units to connect.

[0084] For example, when the terminal is an electric bicycle and the target component is a battery, the battery parameters and the controller in the electric bicycle need to match parameters such as voltage and encoding.

[0085] A transmission circuit is an electrical path responsible for transmitting signals, data, or energy between a terminal and a target component. It can be a simple wire connection or a complex integrated circuit system supporting different types of information exchange, such as power supply, control command transmission, and status feedback reception. In essence, a transmission circuit refers specifically to circuit structures designed to achieve efficient and reliable data or energy transmission between a terminal and external components. For example, in an electric bicycle, the transmission circuit is responsible for supplying power from the battery to the motor, while also monitoring the battery status and providing feedback to the control system.

[0086] In some embodiments, to prevent the target component from bypassing the detection of unauthorized modifications, when the terminal accesses the target component and the component parameters of the target component meet the preset conditions of the terminal, the transmission circuit between the terminal and the target component is activated, including:

[0087] When the terminal connects to the target component, the identity representation signal output by the identity recognition interface of the target component is detected through the component verification circuit of the terminal.

[0088] If the identity verification signal does not meet the terminal's preset conditions, communication with the target component is prohibited, and the transmission circuit between the terminal and the target component remains disconnected.

[0089] If the identity representation signal meets the terminal's preset conditions, it communicates with the target component to obtain the target component's component parameters;

[0090] When the component parameters of the target component meet the preset conditions of the terminal, the transmission circuit between the terminal and the target component is activated.

[0091] Among them, the component verification circuit refers to a circuit system used to verify whether an external component meets the access requirements of the terminal device. It typically includes a series of detection mechanisms and logic judgment units, which analyze the information provided by the external component to determine whether to allow it to establish a connection with the terminal.

[0092] An identity recognition interface is an interface provided by a target component to a terminal device, through which it can send information identifying itself to the terminal. This interface can be at the physical layer (such as pin configuration) or the protocol layer (such as data packets of a specific format). In essence, an identity recognition interface refers to a communication channel or port built into the target component, used to convey its unique identification information. This information is crucial for ensuring that only authorized target components can access the terminal. Specifically, the identity recognition interface may be a dedicated hardware interface on the target component or a software interface conforming to a standard protocol. It can generate and send a specific formatted identity representation signal to the terminal for verification by the component's authentication circuitry.

[0093] It is understandable that the identification interface may specifically be a dedicated connector such as DJ7061A-2.8-21, whose pin definitions include terminal type identification signals (such as electric bicycle battery type, industrial equipment voltage level), and power supply will be refused when there is a mismatch.

[0094] An identity representation signal is a set of information emitted by a target component to prove its authenticity and compatibility with other devices. Understandably, an identity representation signal includes specific data indicating the component's functional characteristics or technical specifications. For example, in an electric bicycle system, this could be the battery type; while in industrial equipment scenarios, it might be key parameters such as voltage level.

[0095] Identity representation signals can specifically manifest in the following forms:

[0096] Battery type in electric bicycles: The identification signal here can be an coded data string containing information such as battery model, capacity, and number of charging cycles. This information is transmitted to the electric bicycle's control system through the target component's identification interface to confirm battery compatibility and allow normal operation.

[0097] Voltage rating of industrial equipment: In this case, the identification signal may be a set of electrical signals or a data packet following a specific protocol, which clearly specifies important parameters such as the equipment's operating voltage range and rated power. This information is received by the main controller of the industrial equipment and used to assess compatibility with existing systems and determine whether to activate circuits for data exchange or power supply.

[0098] Preset conditions are a set of rules or standards that the terminal uses to determine whether to accept an access request from a target component. These conditions are set based on the terminal's functional requirements, security considerations, and compatibility requirements. Specifically, preset conditions refer to a set of verification criteria set by the terminal to prevent unauthorized target components from accessing the terminal. This set of criteria is not limited to confirming the identity of the target component, but also includes requirements for its various performance indicators and technical specifications.

[0099] Understandably, the preset conditions include, but are not limited to, the terminal's expected value of the identity representation signal of the access component, the specific range of component parameters (such as voltage level, power limit, etc.), and necessary security authentication marks. Only when all relevant information of the target component meets these preset conditions will the terminal activate the transmission circuit and allow a connection to be established.

[0100] In some embodiments, when the component parameters of the target component do not meet the preset conditions of the terminal, communication with the target component is prohibited, and the transmission circuit between the terminal and the target component is kept disconnected.

[0101] 102. With the transmission circuit on, perform a security check on the terminal's operating status to obtain security check information.

[0102] The operational status describes the state of a device or system at a specific point in its operating cycle, encompassing the efficiency of its function execution, its current operating mode, and its overall health. It provides crucial information about whether the device or system is operating as expected and reveals any potential problems or anomalies that may affect its performance and stability.

[0103] Safety verification refers to the process of verifying the operational status of a device or system to ensure that it conforms to preset safety standards and specifications. This process aims to detect any problems that may lead to safety hazards and take appropriate measures to resolve them.

[0104] Security verification information reflects whether the terminal device is operating normally. By analyzing security verification information, we can indirectly understand the terminal device's working status and its external interactions.

[0105] For example, security verification information can reflect that the terminal has not reported data normally, such as duplicate timestamps of reported data, or inability to establish encrypted communication with external parties.

[0106] In some embodiments, to prevent target components from bypassing detection of unauthorized modifications, a security verification is performed on the terminal's operating state to obtain security verification information, including:

[0107] Initiate an authentication handshake request to the server using a secure transport protocol;

[0108] The server receives the server identity credentials returned by the server based on the authentication handshake request, verifies the server identity credentials, and obtains the server authentication result.

[0109] If the server authentication result indicates that the server's identity is valid, then the terminal's identity credentials are sent to the server so that the server can verify the terminal's identity credentials and obtain the terminal authentication result.

[0110] Receive the terminal authentication result returned by the server;

[0111] When both the server authentication result and the terminal authentication result indicate that the identity is legitimate, an encrypted communication channel is established with the server, and the establishment information of the encrypted communication channel is obtained;

[0112] Security verification information is generated based on the establishment information of the encrypted communication channel.

[0113] Secure transport protocols are a set of rules and standards established to ensure data security in network communications. They primarily focus on the confidentiality, integrity, and reliability of data, achieving these goals through specific encryption algorithms, key management, and authentication mechanisms. In specific network application scenarios, these protocols aim to protect data exchange between clients and servers, ensuring that information is not eavesdropped on or tampered with by unauthorized third parties. Well-known examples include TLS (Transport Layer Security) and its predecessor SSL (Secure Sockets Layer), as well as DTLS (Datagram Transport Layer Security), specifically designed for UDP communication. These protocols provide users with an effective way to protect the security of their network activities by establishing secure communication channels.

[0114] A server is a type of computer system responsible for processing service requests from other terminals (clients) and providing services to these clients over a network. In the context of network security verification, a server refers to a remote computer system that receives and processes authentication requests from terminals, verifying the authenticity and legitimacy of the terminal's identity. For example, a web server deployed in an enterprise data center is specifically used to handle HTTPS requests, perform SSL / TLS certificate management, and user authentication functions.

[0115] An authentication handshake request is a method to initialize a two-way authentication process. In this process, the terminal sends a specific packet to the server to initiate a mutual verification process, which may include steps such as exchanging public key certificates and generating session keys.

[0116] Server credentials are digital documents used to prove the legitimacy of a server's identity.

[0117] The server authentication result is a conclusion drawn after verifying the server's identity credentials.

[0118] Terminal identity credentials are digital documents used to verify the authenticity of a terminal device's identity.

[0119] The terminal authentication result is the final judgment based on the evaluation of the terminal's identity credentials.

[0120] An encrypted communication channel is a method that uses specific encryption algorithms and techniques to ensure the protection of data transmitted between two or more endpoints. Its main purpose is to prevent data from being eavesdropped on, tampered with, or forged during transmission, thereby ensuring the confidentiality, integrity, and authenticity of information.

[0121] For example, in a specific implementation of DTLS, when a terminal wants to establish a secure connection with a server via DTLS, it first initiates an authentication handshake request. This process includes exchanging a list of supported encryption algorithms, random numbers, and other information so that both parties can negotiate a set of parameters for subsequent encryption and decryption. After receiving the handshake request from the terminal, the server returns server identity credentials, including its digital certificate. The terminal needs to verify these server identity credentials to confirm the server's legitimacy. This step involves checking the validity of the server identity credentials and whether they were issued by a trusted CA. Once the server's legitimacy is confirmed, the terminal sends its own identity credentials to the server for verification. This step helps ensure that both parties are trusted entities, thereby establishing a relationship of mutual trust. After the server and client have completed each other's authentication and reached a consensus on encryption algorithms and keys, they can begin using the negotiated keys to encrypt and decrypt transmitted data, formally establishing an encrypted communication channel.

[0122] Establishment information is a key indicator of the successful establishment of an encrypted communication channel, reflecting the status of the secure connection between the client and server. This means it not only confirms the successful construction of the encrypted communication channel but also provides specific details about how the channel was verified as secure, stable, and ready. When referring to "successful establishment," establishment information actually refers to a series of confirmation messages that prove both parties have successfully completed authentication and agreed on security parameters and protocol versions, thus ensuring that subsequent data exchange will be conducted in a confidential, complete, and trustworthy manner.

[0123] Security verification information reflects the terminal's operational status, indicating its health and working condition after the encrypted communication channel is established. For example, if the establishment information indicates a successful encrypted communication channel establishment, the security verification information suggests the terminal is operating normally. If the establishment information indicates the encrypted communication channel was not successfully established, the security verification information suggests the terminal is operating abnormally.

[0124] In some embodiments, in order to determine whether the terminal is operating normally, if the verification shows that the terminal is operating normally, security verification information is generated based on the establishment information of the encrypted communication channel, including:

[0125] If the information indicates that the encrypted communication channel has been successfully established, then the first security verification information is generated, which indicates that the terminal is in normal operating condition.

[0126] If the established information indicates that the encrypted communication channel has not been successfully established, a second security verification message is generated, which indicates that the terminal is in an abnormal operating state.

[0127] In some embodiments, to ensure that the terminal can detect unauthorized modifications of target components even in various network environments, a security verification is performed on the terminal's operating state to obtain security verification information, including:

[0128] Get the information to be uploaded and the current timestamp, where the current timestamp is the terminal's current time;

[0129] Embed the current timestamp into the information to be uploaded to generate report data carrying the current timestamp;

[0130] The server sends reported data to the server so that the server can perform duplicate detection on the reported data based on the current timestamp and historical timestamp in the reported data and obtain the duplicate detection result. The historical timestamp is the timestamp of the terminal that was received in the historical time period.

[0131] Receive the duplicate detection results returned by the server;

[0132] Security verification information is generated based on the repeatability test results.

[0133] The information to be uploaded refers to any data or content that needs to be transmitted from the terminal device to the server. This includes, but is not limited to, various digital data such as text, images, and audio files. In specific application scenarios, this type of information may cover user-created content (such as posts on social media platforms), data collected by sensors (such as ambient temperature recorded by IoT devices), system operation logs, etc. Specifically, in the context of electric bicycles, the information to be uploaded can be data on the vehicle's operating status (such as battery level, speed, mileage, and fault diagnosis information). In other words, in the application examples of electric vehicles, the information to be uploaded specifically refers to data elements that can reflect the current working status and performance indicators of the electric vehicle. This key data helps to monitor, manage, and maintain the efficient operation of the electric vehicle.

[0134] The current timestamp uses the terminal's current time as the timestamp.

[0135] Reported data consists of a data packet combining the information to be uploaded with relevant metadata (such as timestamps, location information, etc.), intended to be transmitted over the network to the server for further processing. In application scenarios with integrated security mechanisms, reported data not only contains the original information to be uploaded, but also embeds security elements for authentication and tamper prevention, such as cryptographic signatures or hash values.

[0136] Historical timestamps refer to the timestamps of various points in time that have been successfully uploaded to the server and recorded. They are stored on the server side and used to compare the timestamps in newly received reported data to perform duplicate checks or other time-based operations. In short, historical timestamps refer to the timestamps corresponding to all previously uploaded data points from this terminal, stored in the server's database.

[0137] The duplicate detection result is determined by comparing the current timestamp in the reported data with historical timestamps previously recorded by the server. In other words, this process involves checking whether the timestamps in newly received data items overlap or are identical to stored timestamps, thus determining whether the uploaded information has already been received and processed. If the current timestamp matches a timestamp in the historical record, the reported data is considered duplicate; otherwise, it is considered new and valid data. This mechanism helps prevent data duplication and ensures the efficiency and accuracy of the system.

[0138] Security verification information is a comprehensive indicator or report that evaluates the results of repeatability tests and reflects the terminal's operational status. For example, if the repeatability test results show that the current timestamp does not match the historical timestamp, the security verification information indicates that the terminal is in a normal operating state. If the repeatability test results show that the current timestamp matches the historical timestamp, the security verification information indicates that the terminal is in an abnormal operating state.

[0139] In some embodiments, in order to determine whether the terminal is operating normally, security verification information is generated based on the repeatability test results, including:

[0140] If the repeatability test result indicates that the current timestamp and the historical timestamp are not repeated, then the first security verification information is generated, which indicates that the terminal is in normal operating condition.

[0141] If the repeatability test result indicates that the current timestamp is repeated with a historical timestamp, a second security verification message is generated, which indicates that the terminal is in an abnormal operating state.

[0142] In some embodiments, to ensure that the terminal can operate normally in various network environments and to prevent target components from bypassing the detection of unauthorized modifications, a security verification is performed on the terminal's operating status to obtain security verification information, including:

[0143] When the terminal's network connection status is not satellite communication, it initiates an authentication handshake request to the server through a secure transmission protocol.

[0144] The server receives the server identity credentials returned by the server based on the authentication handshake request, verifies the server identity credentials, and obtains the server authentication result.

[0145] If the server authentication result indicates that the server's identity is valid, then the terminal's identity credentials are sent to the server so that the server can verify the terminal's identity credentials and obtain the terminal authentication result.

[0146] Receive the terminal authentication result returned by the server;

[0147] When both the server authentication result and the terminal authentication result indicate that the identity is legitimate, an encrypted communication channel is established with the server, and the establishment information of the encrypted communication channel is obtained;

[0148] Security verification information is generated based on the establishment information of the encrypted communication channel;

[0149] When the terminal's network connection status is satellite communication, obtain the information to be uploaded and the current timestamp, which is the terminal's current time;

[0150] Embed the current timestamp into the information to be uploaded to generate report data carrying the current timestamp;

[0151] The server sends reported data to the server so that the server can perform duplicate detection on the reported data based on the current timestamp and historical timestamp in the reported data and obtain the duplicate detection result. The historical timestamp is the timestamp of the terminal that was received in the historical time period.

[0152] Receive the duplicate detection results returned by the server;

[0153] Security verification information is generated based on the repeatability test results.

[0154] Network connection status refers to the established connection between a terminal and the network, reflecting whether the device can exchange data through a specific network medium. In a network environment, network connection status can be categorized into various types, including but not limited to wired connections, wireless connections (such as Wi-Fi and Bluetooth), cellular mobile communication, and satellite communication. Each type of connection status has its specific technical requirements and application scenarios.

[0155] Non-satellite communication refers to all communication methods that do not rely on artificial Earth satellites as relay stations. It encompasses various data exchange methods that are achieved directly or indirectly through ground facilities or infrastructure. These communication methods include, but are not limited to, cellular mobile communication (such as 2G, 3G, 4G, and 5G), Wi-Fi wireless networks, Bluetooth short-range communication, and wired broadband connections (such as fiber optic and DSL). Each method has its specific technical standards and application scenarios, suitable for different user needs and environmental conditions.

[0156] Satellite communication is a communication method that uses artificial Earth satellites as relay stations to forward or reflect radio waves between two or more ground stations. Understandably, when a terminal is in satellite communication (such as BeiDou satellite communication), it acquires the information to be uploaded and the current timestamp, then packages this information and sends it to the server via a satellite link for repeatability checks and verification.

[0157] Understandably, satellite communication bandwidth is extremely low (e.g., a BeiDou short message is only 120 bytes), making it unable to support the DTLS handshake process; therefore, a lightweight timestamp-based replay prevention mechanism is used. Cellular networks, on the other hand, have sufficient bandwidth to support full two-way authentication. This application dynamically adapts security strategies based on network type, ensuring security while also considering resource efficiency.

[0158] 103. Update the temporary communication credentials of the terminal according to the preset time interval to obtain credential update information.

[0159] The preset time interval is a pre-defined duration used to trigger a specific operation or process. These time intervals can be fixed (e.g., hourly, daily) or dynamically adjusted (based on system status, user behavior, etc.). They are widely used in various scenarios, such as data backup, certificate renewal, and session refresh, to ensure data security, service availability, and consistent user experience.

[0160] Temporary communication credentials are digital certificates valid for a certain period of time, used to verify the identity of a terminal device and authorize its access to network resources. They are part of network security strategies, primarily used to enhance authentication and encryption strength during communication. These credentials are typically generated by a server and distributed to the terminal, containing validity information and other necessary authentication data. Their main function is to allow the terminal to communicate securely for a limited time without exposing long-term keys. Applications of temporary communication credentials include, but are not limited to, online transactions, mobile application logins, and IoT device authentication.

[0161] It is understandable that "preset time interval" specifically refers to the time period set to periodically update temporary communication credentials in order to ensure secure communication between the terminal and the server. For example, this time interval may be set to automatically update temporary communication credentials every 12 hours, ensuring that even if temporary communication credentials are leaked, they will become invalid in time, reducing potential security risks.

[0162] The credential update information specifically refers to the result information of the temporary communication credential update process, such as the status code for success or failure, the reason for the error (if the update was unsuccessful), and the new credential details (if the update was successful).

[0163] In some embodiments, the temporary communication credentials of the terminal are updated at preset time intervals to obtain credential update information, including:

[0164] At preset time intervals, a credential update request is sent to the server. The credential update request is used to request the update of the terminal's temporary communication credentials.

[0165] Receive the new temporary communication credential returned by the server based on the credential update request;

[0166] Based on the new temporary communication credential, the temporary communication credential is updated to obtain credential update information.

[0167] A credential update request is a type of request initiated by a terminal device to a server, aiming to update its currently used temporary communication credentials. It is a crucial means of ensuring communication security, helping to ensure that only authorized users can access system resources. The credential update request contains necessary information, such as the terminal's identity and the currently used credential version, so that the server can identify the source of the request and verify its legitimacy. Furthermore, the request may be encrypted to prevent it from being stolen or tampered with during transmission.

[0168] New temporary communication credentials are a set of new authentication credentials generated by the server and returned to the terminal to replace old credentials that are about to expire or have become invalid. They are crucial for maintaining continuous and secure communication between the terminal and the server. New temporary communication credentials typically contain elements such as validity period information, signature algorithm, and key, ensuring that they are valid within a specified time frame and are not easily forged. The server generates these credentials according to established security policies and transmits them to the terminal through a secure channel.

[0169] 104. When at least one of the security verification information and credential update information matches the preset abnormal information, the terminal's operating mode is switched to restricted state.

[0170] Pre-defined anomaly information refers to a set of specific data or patterns pre-defined during the system design phase to identify potential security threats or abnormal operational behaviors. As part of the security strategy, it helps the system detect and respond to potential unauthorized access attempts or other abnormal situations. For example, pre-defined anomaly information may include, but is not limited to, the failure to establish an encrypted communication channel, or the duplication of the current timestamp of reported data with a historical timestamp in the server.

[0171] Operating mode is a specific way of working that is adopted based on user selection or automatic system judgment. Different operating modes provide different performance and service options, aiming to optimize user experience and meet the needs of various usage scenarios. For example, operating modes can be normal mode, energy-saving mode, sports mode, etc.

[0172] A restricted state is a working state that limits the normal functions of a terminal when it is in an abnormal operating condition. This state is usually designed to address potential security risks, equipment failures, or user-defined energy-saving requirements, thereby protecting the equipment from damage or extending its lifespan. For example, a terminal's restricted state could be an energy-saving mode, a security lockout mode, an emergency maintenance mode, etc.

[0173] In some embodiments, to continuously detect whether an abnormality occurs during terminal operation, the method further includes:

[0174] Anomaly detection processing is performed on the current signal of the terminal to obtain current anomaly information;

[0175] Anomaly detection and processing are performed on the terminal's communication protocol to obtain protocol anomaly information;

[0176] Based on at least one of the current anomaly information and the protocol anomaly information, it is determined that the terminal is in an abnormal operating state.

[0177] Based on the abnormal operating status, switch the terminal's operating mode to a restricted state.

[0178] This refers to the change in the amount of charge flowing through the circuit system.

[0179] Current anomaly information is a description of a detected current signal that deviates from its expected value or standard range.

[0180] A communication protocol defines a set of rules and formats for how different devices exchange information. It ensures that even devices from different manufacturers can understand and communicate with each other.

[0181] Protocol error information refers to any situation or error that does not conform to the protocol specifications when exchanging data using a communication protocol.

[0182] For example, when the terminal is an electric bicycle, if the motor drive current suddenly increases beyond the set safety threshold, the system will recognize this as a current anomaly and generate current anomaly information. Another possibility is that the Bluetooth connection between the electric bicycle's display screen and the main control unit frequently disconnects or data transmission is incomplete; this will be considered a protocol anomaly and generate protocol anomaly information.

[0183] For example, when the terminal is an electric bicycle, if the abnormal current information indicates that the motor current exceeds the rated value by 20%, it is determined that the electric bicycle's controller has been tampered with.

[0184] Alternatively, when the terminal is a financial terminal (such as an ATM or POS machine), if the target component (external device) fails hardware authentication (e.g., the identity verification signal does not meet the terminal's preset conditions, or the component parameters of the target component do not meet the terminal's preset conditions), the terminal's operating mode will be switched to a restricted state, such as locking the financial terminal system.

[0185] The safe operation control scheme provided in this application embodiment can be applied to various electric vehicles, financial terminals, industrial control equipment and other scenarios that require protection against illegal modification.

[0186] To better implement the above methods, this application also provides a terminal security operation control device, which can be integrated into an electronic device, such as a terminal or server. The terminal can be a mobile phone, tablet computer, smart Bluetooth device, laptop computer, or personal computer; the server can be a single server or a server cluster composed of multiple servers.

[0187] For example, in this embodiment, the method of this application embodiment will be described in detail by taking the terminal security operation control device specifically integrated into an electronic device as an example.

[0188] For example, such as Figure 2 As shown, the terminal security operation control device may include a circuit connection unit 201, a security verification unit 202, a credential update unit 203, and a mode switching unit 204, as follows:

[0189] (I) Circuit conduction unit 201.

[0190] The circuit activation unit 201 is used to activate the transmission circuit between the terminal and the target component when the terminal is connected to the target component and the component parameters of the target component meet the preset conditions of the terminal.

[0191] In some embodiments, when a terminal accesses a target component and the component parameters of the target component meet the terminal's preset conditions, activating the transmission circuit between the terminal and the target component includes:

[0192] When the terminal connects to the target component, the identity representation signal output by the identity recognition interface of the target component is detected through the component verification circuit of the terminal.

[0193] If the identity verification signal does not meet the terminal's preset conditions, communication with the target component is prohibited, and the transmission circuit between the terminal and the target component remains disconnected.

[0194] If the identity representation signal meets the terminal's preset conditions, it communicates with the target component to obtain the target component's component parameters;

[0195] When the component parameters of the target component meet the preset conditions of the terminal, the transmission circuit between the terminal and the target component is activated.

[0196] (ii) Security verification unit 202.

[0197] The security verification unit 202 is used to perform security verification on the operating status of the terminal when the transmission circuit is on, and obtain security verification information.

[0198] In some embodiments, a security verification is performed on the terminal's operating status to obtain security verification information, including:

[0199] Initiate an authentication handshake request to the server using a secure transport protocol;

[0200] The server receives the server identity credentials returned by the server based on the authentication handshake request, verifies the server identity credentials, and obtains the server authentication result.

[0201] If the server authentication result indicates that the server's identity is valid, then the terminal's identity credentials are sent to the server so that the server can verify the terminal's identity credentials and obtain the terminal authentication result.

[0202] Receive the terminal authentication result returned by the server;

[0203] When both the server authentication result and the terminal authentication result indicate that the identity is legitimate, an encrypted communication channel is established with the server, and the establishment information of the encrypted communication channel is obtained;

[0204] Security verification information is generated based on the establishment information of the encrypted communication channel.

[0205] In some embodiments, security verification information is generated based on the establishment information of the encrypted communication channel, including:

[0206] If the information indicates that the encrypted communication channel has been successfully established, then the first security verification information is generated, which indicates that the terminal is in normal operating condition.

[0207] If the established information indicates that the encrypted communication channel has not been successfully established, a second security verification message is generated, which indicates that the terminal is in an abnormal operating state.

[0208] In some embodiments, a security verification is performed on the terminal's operating status to obtain security verification information, including:

[0209] Get the information to be uploaded and the current timestamp, where the current timestamp is the terminal's current time;

[0210] Embed the current timestamp into the information to be uploaded to generate report data carrying the current timestamp;

[0211] The server sends reported data to the server so that the server can perform duplicate detection on the reported data based on the current timestamp and historical timestamp in the reported data and obtain the duplicate detection result. The historical timestamp is the timestamp of the terminal that was received in the historical time period.

[0212] Receive the duplicate detection results returned by the server;

[0213] Security verification information is generated based on the repeatability test results.

[0214] In some embodiments, security verification information is generated based on repeatability test results, including:

[0215] If the repeatability test result indicates that the current timestamp and the historical timestamp are not repeated, then the first security verification information is generated, which indicates that the terminal is in normal operating condition.

[0216] If the repeatability test result indicates that the current timestamp is repeated with a historical timestamp, a second security verification message is generated, which indicates that the terminal is in an abnormal operating state.

[0217] In some embodiments, a security verification is performed on the terminal's operating status to obtain security verification information, including:

[0218] When the terminal's network connection status is not satellite communication, it initiates an authentication handshake request to the server through a secure transmission protocol.

[0219] The server receives the server identity credentials returned by the server based on the authentication handshake request, verifies the server identity credentials, and obtains the server authentication result.

[0220] If the server authentication result indicates that the server's identity is valid, then the terminal's identity credentials are sent to the server so that the server can verify the terminal's identity credentials and obtain the terminal authentication result.

[0221] Receive the terminal authentication result returned by the server;

[0222] When both the server authentication result and the terminal authentication result indicate that the identity is legitimate, an encrypted communication channel is established with the server, and the establishment information of the encrypted communication channel is obtained;

[0223] Security verification information is generated based on the establishment information of the encrypted communication channel;

[0224] When the terminal's network connection status is satellite communication, obtain the information to be uploaded and the current timestamp, which is the terminal's current time;

[0225] Embed the current timestamp into the information to be uploaded to generate report data carrying the current timestamp;

[0226] The server sends reported data to the server so that the server can perform duplicate detection on the reported data based on the current timestamp and historical timestamp in the reported data and obtain the duplicate detection result. The historical timestamp is the timestamp of the terminal that was received in the historical time period.

[0227] Receive the duplicate detection results returned by the server;

[0228] Security verification information is generated based on the repeatability test results.

[0229] (III) Voucher Update Unit 203.

[0230] The credential update unit 203 is used to update the temporary communication credentials of the terminal according to a preset time interval to obtain credential update information.

[0231] In some embodiments, the temporary communication credentials of the terminal are updated at preset time intervals to obtain credential update information, including:

[0232] At preset time intervals, a credential update request is sent to the server. The credential update request is used to request the update of the terminal's temporary communication credentials.

[0233] Receive the new temporary communication credential returned by the server based on the credential update request;

[0234] Based on the new temporary communication credential, the temporary communication credential is updated to obtain credential update information.

[0235] (iv) Mode switching unit 204.

[0236] The mode switching unit 204 is used to switch the terminal's operating mode to a restricted state when at least one of the security verification information and the credential update information matches a preset abnormal information.

[0237] In some embodiments, it also includes:

[0238] Anomaly detection processing is performed on the current signal of the terminal to obtain current anomaly information;

[0239] Anomaly detection and processing are performed on the terminal's communication protocol to obtain protocol anomaly information;

[0240] Based on at least one of the current anomaly information and the protocol anomaly information, it is determined that the terminal is in an abnormal operating state.

[0241] Based on the abnormal operating status, switch the terminal's operating mode to a restricted state.

[0242] In practice, each of the above units can be implemented as an independent entity or can be arbitrarily combined to be implemented as the same or several entities. For the specific implementation of each of the above units, please refer to the previous method embodiments, which will not be repeated here.

[0243] As can be seen from the above, the terminal security operation control device of this embodiment consists of a circuit conduction unit that conducts the transmission circuit between the terminal and the target component when the terminal is connected to the target component and the component parameters of the target component meet the preset conditions of the terminal; a security verification unit that performs security verification on the terminal's operating status when the transmission circuit is conducted, and obtains security verification information; a credential update unit that updates the terminal's temporary communication credential at preset time intervals, and obtains credential update information; and a mode switching unit that switches the terminal's operating mode to a restricted state when at least one of the security verification information and the credential update information matches preset abnormal information.

[0244] Therefore, the embodiments of this application can effectively prevent the terminal from being illegally modified and the malicious attacks caused therefrom, and ensure its reliable and secure operation in complex network environments.

[0245] This application also provides an electronic device, which can be a terminal, a server, or other similar device. The terminal can be a mobile phone, tablet computer, smart Bluetooth device, laptop computer, personal computer, etc.; the server can be a single server or a server cluster composed of multiple servers, etc.

[0246] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be performed by instructions, or by instructions controlling related hardware. These instructions can be stored in a computer-readable storage medium and loaded and executed by a processor.

[0247] Therefore, embodiments of this application provide a computer-readable storage medium storing a plurality of instructions that can be loaded by a processor to execute the steps in any of the terminal security operation control methods provided in embodiments of this application.

[0248] The storage medium may include: read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0249] According to one aspect of this application, a computer program product or computer program is provided, comprising a computer program / instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer program / instructions from the computer-readable storage medium and executes the computer program / instructions, causing the electronic device to perform the method provided in the terminal security operation control aspect of the above embodiments.

[0250] Since the instructions stored in the storage medium can execute the steps of any of the terminal security operation control methods provided in the embodiments of this application, the beneficial effects that any of the terminal security operation control methods provided in the embodiments of this application can achieve can be realized. For details, please refer to the previous embodiments, which will not be repeated here.

[0251] The above provides a detailed description of a terminal security operation control method and device provided in the embodiments of this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A terminal security operation control method, characterized in that, include: When the terminal accesses the target component, the identity representation signal output by the identity recognition interface of the target component is detected through the component verification circuit of the terminal; If the identity representation signal does not meet the preset conditions of the terminal, then communication with the target component is prohibited, and the transmission circuit between the terminal and the target component remains disconnected. If the identity representation signal meets the preset conditions of the terminal, then it communicates with the target component to obtain the component parameters of the target component; When the component parameters of the target component meet the preset conditions of the terminal, the transmission circuit between the terminal and the target component is turned on. With the transmission circuit active, a security check is performed on the terminal's operating status to obtain security check information, including: Obtain the information to be uploaded and the current timestamp, wherein the current timestamp is the current time of the terminal; The current timestamp is embedded into the information to be uploaded to generate reporting data carrying the current timestamp; The reported data is sent to the server so that the server performs a duplicate detection on the reported data based on the current timestamp and historical timestamp in the reported data, and obtains a duplicate detection result. The historical timestamp is the timestamp of the terminal uploaded the data during a historical time period. Receive the repeatability detection result returned by the server; If the repeatability detection result indicates that the current timestamp and the historical timestamp are not repeated, then first security verification information is generated, and the first security verification information indicates that the terminal is in normal operating condition; If the repeatability detection result indicates that the current timestamp is repeated with the historical timestamp, then a second security verification information is generated, which indicates that the terminal is in an abnormal operating state. The temporary communication credentials of the terminal are updated at preset time intervals to obtain credential update information. When at least one of the security verification information and the credential update information matches a preset abnormality information, the terminal's operating mode is switched to a restricted state.

2. The terminal security operation control method as described in claim 1, characterized in that, The security verification of the terminal's operating status to obtain security verification information includes: Initiate an authentication handshake request to the server using a secure transport protocol; Receive the server identity credentials returned by the server based on the authentication handshake request, verify the server identity credentials, and obtain the server authentication result; If the server authentication result indicates that the server identity is legitimate, then the terminal identity credential is sent to the server so that the server can verify the terminal identity credential and obtain the terminal authentication result. Receive the terminal authentication result returned by the server; When both the server authentication result and the terminal authentication result indicate that the identity is legitimate, an encrypted communication channel is established with the server, and the establishment information of the encrypted communication channel is obtained; Security verification information is generated based on the establishment information of the encrypted communication channel.

3. The terminal security operation control method as described in claim 2, characterized in that, The step of generating security verification information based on the establishment information of the encrypted communication channel includes: If the establishment information reflects that the encrypted communication channel has been successfully established, then first security verification information is generated, and the first security verification information indicates that the terminal is in normal operating condition; If the establishment information indicates that the encrypted communication channel has not been successfully established, a second security verification information is generated, which indicates that the terminal is in an abnormal operating state.

4. The terminal security operation control method as described in claim 1, characterized in that, The security verification of the terminal's operating status to obtain security verification information includes: When the terminal's network connection status is not satellite communication, it initiates an authentication handshake request to the server through a secure transmission protocol. Receive the server identity credentials returned by the server based on the authentication handshake request, verify the server identity credentials, and obtain the server authentication result; If the server authentication result indicates that the server identity is legitimate, then the terminal identity credential is sent to the server so that the server can verify the terminal identity credential and obtain the terminal authentication result. Receive the terminal authentication result returned by the server; When both the server authentication result and the terminal authentication result indicate that the identity is legitimate, an encrypted communication channel is established with the server, and the establishment information of the encrypted communication channel is obtained; Security verification information is generated based on the establishment information of the encrypted communication channel; When the terminal's network connection status is satellite communication, the information to be uploaded and the current timestamp are obtained, where the current timestamp is the current time of the terminal; The current timestamp is embedded into the information to be uploaded to generate reporting data carrying the current timestamp; The reported data is sent to the server so that the server performs a duplicate detection on the reported data based on the current timestamp and historical timestamp in the reported data, and obtains a duplicate detection result. The historical timestamp is the timestamp of the terminal uploaded the data during a historical time period. Receive the repeatability detection result returned by the server; Security verification information is generated based on the repeatability test results.

5. The terminal security operation control method as described in claim 1, characterized in that, The step of updating the temporary communication credentials of the terminal at preset time intervals to obtain credential update information includes: At preset time intervals, a credential update request is sent to the server. The credential update request is used to request the update of the temporary communication credentials of the terminal. Receive the new temporary communication credential returned by the server based on the credential update request; Based on the new temporary communication credential, the temporary communication credential is updated to obtain credential update information.

6. The terminal security operation control method as described in claim 1, characterized in that, Also includes: The current signal of the terminal is subjected to anomaly detection processing to obtain current anomaly information; Anomaly detection processing is performed on the communication protocol of the terminal to obtain protocol anomaly information; Based on at least one of the current anomaly information and the protocol anomaly information, it is determined that the terminal is in an abnormal operating state. Based on the abnormal operating state, the terminal's operating mode is switched to a restricted state.

7. A terminal safety operation control device, characterized in that, include: The circuit conduction unit is used to detect the identity representation signal output by the identity recognition interface of the target component through the component verification circuit of the terminal when the terminal connects to the target component. If the identity representation signal does not meet the preset conditions of the terminal, then communication with the target component is prohibited, and the transmission circuit between the terminal and the target component remains disconnected. If the identity representation signal meets the preset conditions of the terminal, then it communicates with the target component to obtain the component parameters of the target component; When the component parameters of the target component meet the preset conditions of the terminal, the transmission circuit between the terminal and the target component is turned on. A security verification unit is used to perform security verification on the operating state of the terminal when the transmission circuit is on, and obtain security verification information, including: Obtain the information to be uploaded and the current timestamp, wherein the current timestamp is the current time of the terminal; The current timestamp is embedded into the information to be uploaded to generate reporting data carrying the current timestamp; The reported data is sent to the server so that the server performs a duplicate detection on the reported data based on the current timestamp and historical timestamp in the reported data, and obtains a duplicate detection result. The historical timestamp is the timestamp of the terminal uploaded the data during a historical time period. Receive the repeatability detection result returned by the server; If the repeatability detection result indicates that the current timestamp and the historical timestamp are not repeated, then first security verification information is generated, and the first security verification information indicates that the terminal is in normal operating condition; If the repeatability detection result indicates that the current timestamp is repeated with the historical timestamp, then a second security verification information is generated, which indicates that the terminal is in an abnormal operating state. The credential update unit is used to update the temporary communication credentials of the terminal at preset time intervals to obtain credential update information. The mode switching unit is used to switch the operating mode of the terminal to a restricted state when at least one of the security verification information and the credential update information matches a preset abnormal information.

Images