One-to-one authorization and access control method and system for information transmission terminal

Abstract

The present application relates to a one-to-one authorization and access control system and method for information transmission terminal, the system comprising: a device fingerprint management module, a license generation & signature module on the intranet side; a license receiving module, a license analysis and verification module, a system startup & permission control module and a device fingerprint acquisition module on the extranet side; and a one-way transmission link; the license generation & signature module generates a bound license file according to the device fingerprint; the device fingerprint acquisition module acquires the hardware information of the terminal device and calculates it to obtain a real-time device fingerprint every time the terminal device starts; the license analysis and verification module reads the license file and the real-time device fingerprint and performs a check; and the system startup & permission control module performs authorization and access control according to the check result. The present application solves the problem of traditional authorization relying on two-way network verification.

Description

Technical Field

[0001] This invention relates to the field of information security and terminal management technology, and in particular to a one-to-one authorization and access control method and system for information transmission terminals in cross-domain isolated environments or one-way transmission scenarios. Background Technology

[0002] In physically isolated systems that only transmit data in one direction and are "inside to outside," the terminal cannot perform online interactive verification with the central system because there is no network backhaul capability, and the traditional network account system cannot be used. Summary of the Invention

[0003] To address the above technical problems, this application proposes a one-to-one authorization and access control system for an information transmission terminal, comprising:

[0004] The internal network side includes a device fingerprint management module, a license generation & signing module, and a license distribution module; the external network side includes terminal devices, which include: a license receiving module, a license parsing and verification module, a system startup & access control module, and a device fingerprint acquisition module; and a unidirectional transmission link.

[0005] The device fingerprint management module is used to collect and manage the hardware information of terminal devices and calculate their device fingerprints;

[0006] The license generation & signing module is used to generate a bound license file based on the device fingerprint calculated by the device fingerprint management module. The license structure includes: FP, validity period, permission list, timestamp, random number and digital signature, wherein the digital signature is generated using the hardware information of the terminal device with a private key.

[0007] The license distribution module is used to map the license file into a video signal and send it to the one-way transmission link; the license file is transmitted to the terminal device on the external network side through the one-way transmission link;

[0008] The device fingerprint acquisition module is used to collect and calculate the hardware information of the terminal device each time the terminal device is started, so as to obtain the real-time device fingerprint of the terminal device.

[0009] The license receiving module is used to receive license files from a one-way transmission link;

[0010] The license parsing and verification module is used to read the license file and real-time device fingerprint from the license receiving module, and perform strong consistency verification, including: using the public key to verify the digital signature using the hardware information of the terminal device, confirming that the license was issued by a legitimate authorization center; comparing whether the device fingerprint recorded in the license is consistent with the real-time device fingerprint; checking whether the current time is within the validity period of the license; checking the random number to prevent replay; and determining whether the permissions meet the functional requirements of the current terminal device based on the license.

[0011] The system startup & access control module is used to perform authorization and access control based on the verification results.

[0012] According to some embodiments of the present invention, the intranet side further includes a terminal registration module, which is used to support the registration of hardware information of hardware devices, including supporting the import of hardware information of hardware devices into the terminal registration module in an import manner.

[0013] According to some embodiments of the present invention, the license includes functional permissions, content scope permissions, time limits, geographical area restrictions, and a device-level blacklist mechanism; hardware information includes, but is not limited to, MAC address, CPU serial number, motherboard serial number, and hard disk serial number; FP is generated by Hash operation, FP=Hash(MAC+CPU_ID+DISK_SN+BOARD_ID).

[0014] According to some embodiments of the present invention, performing authorization and access control based on the verification result includes: if any verification in the strong consistency verification fails, prohibiting the startup of the corresponding application on the terminal device, recording an error log and issuing an alarm; if the verification passes, starting the corresponding application on the terminal device normally, and performing fine-grained access control based on the permission scope field in the license.

[0015] According to some embodiments of the present invention, the unidirectional transmission link includes: an electro-optical conversion unidirectional optical transmitter for converting an electrical signal into an optical signal; a unidirectional optical fiber; and an opto-optical conversion unidirectional optical receiver for restoring the optical signal to an electrical signal; the license distribution module adopts an HDMI, DP, SDI or LVDS video interface transmitter.

[0016] This application also provides a one-to-one authorization and access control method for an information transmission terminal, which includes the following steps S1 to S6:

[0017] S1. Collect and manage the hardware information of each terminal device and calculate its device fingerprint;

[0018] S2. Generate a bound license file based on the device fingerprint. The license structure includes: FP, validity period, permission list, timestamp, random number and digital signature, wherein the digital signature is generated using the hardware information of the terminal device with a private key.

[0019] S3. Map the license file to a video signal and send the video signal to a one-way transmission link so that the video signal is transmitted to a terminal device on the external network through the one-way transmission link;

[0020] S4. Each time the terminal device is started, the hardware information of the terminal device is collected in real time and calculated to obtain the real-time device fingerprint of the terminal device;

[0021] S5. Read the license file and real-time device fingerprint from the one-way transmission link, and perform a strong consistency check. The strong consistency check includes: using the public key and the hardware information of the terminal device to verify the digital signature and confirm that the license was issued by a legitimate authorization center; comparing whether the device fingerprint recorded in the license is consistent with the real-time device fingerprint; checking whether the current time is within the validity period of the license; checking the random number to prevent replay; and determining whether the permissions meet the functional requirements of the current terminal device based on the license.

[0022] S6. Perform authorization and access control based on the verification results.

[0023] This application also provides a one-to-one authorization and access control method for information transmission terminals, the method comprising:

[0024] S11. Collect and manage the hardware information of each user terminal and calculate its device fingerprint;

[0025] S12. Generate a bound license file based on the device fingerprint. The license structure includes: FP, validity period, permission list, timestamp, random number and digital signature, wherein the digital signature is generated using the hardware information of the user terminal with a private key.

[0026] S13. The licenses of multiple user terminals are spliced ​​and encapsulated into an image frame. The splicing and encapsulation includes constructing an index table during encapsulation and placing it in the frame header of the image frame. The index table records the identity serial number of each user terminal and the starting offset and length of the terminal's license in the image frame. The frame body structure then arranges the license data of each user terminal in sequence.

[0027] S14. After multiple licenses are encapsulated and spliced, the license file is mapped to a video signal, and the video signal is sent to a one-way transmission link so that the video signal is transmitted to a terminal device on the external network through the one-way transmission link.

[0028] S15. When each user terminal starts up, the hardware information of the user terminal is collected in real time and calculated to obtain the real-time device fingerprint of the user terminal.

[0029] S16. Read the license file and real-time device fingerprint from the one-way transmission link, and perform a strong consistency check. The strong consistency check includes: using the public key and the hardware information of the user terminal to verify the digital signature and confirm that the license was issued by a legitimate authorization center; comparing whether the device fingerprint recorded in the license is consistent with the real-time device fingerprint; checking whether the current time is within the validity period of the license; checking the random number to prevent replay; and determining whether the permissions meet the current functional requirements of the user terminal based on the license.

[0030] S17. Perform authorization and access control based on the verification results.

[0031] According to some embodiments of the present invention, performing authorization and access control based on the verification result includes: if any of the above verifications fail, prohibiting the launch of the corresponding application on the corresponding user terminal, recording an error log, and issuing an alarm. If the verification passes, launching the corresponding application on the corresponding user terminal, and performing fine-grained access control based on the permissions in the license.

[0032] According to some embodiments of the present invention, the license file is directly carried by the pixel channel values ​​of the video frame and output to a one-way transmission link.

[0033] According to some embodiments of the present invention, the license includes:

[0034] Functional permissions, content scope permissions, time limits, geographical restrictions, and device-level blacklist mechanisms.

[0035] This invention enables strict one-device-one-certificate verification: the license is strongly bound to the hardware, preventing operation on other terminals even if the license is copied; it adapts to one-way and offline scenarios: no network handshake is required, perfectly solving the authorization update and verification problem in physically isolated environments. High security: combining digital signatures and strong startup verification effectively prevents terminal forgery and unauthorized access. Attached Figure Description

[0036] Figure 1 A block diagram of a one-to-one authorization and access control system for an information transmission terminal according to some embodiments of the present invention is shown.

[0037] Figure 2 This diagram illustrates an image frame structure containing a multi-terminal license according to some embodiments of the present invention.

[0038] Figure 3 A flowchart illustrating a one-to-one authorization and access control method for an information transmission terminal according to some embodiments of the present invention is shown.

[0039] Figure 4 A flowchart illustrating a one-to-one authorization and access control method for an information transmission terminal according to some embodiments of the present invention is shown. Detailed Implementation

[0040] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0041] Terminology Explanation

[0042] Device fingerprint (FP): A unique identifier (such as a hash identifier) ​​generated based on hardware information (such as MAC, CPU ID, hard drive serial number) that is not easy or difficult to forge on the terminal.

[0043] License: An encrypted data packet containing device fingerprint, permissions, and signature issued by the authorization center.

[0044] A unidirectional transmission link (or channel) refers to a physical channel that supports only unidirectional data flow. According to some embodiments of the present invention, this unidirectional transmission link may include: an electro-optical conversion unidirectional optical transmitter for converting electrical signals into optical signals; a unidirectional optical fiber; and an opto-optical conversion unidirectional optical receiver for converting optical signals back into electrical signals. This structure ensures unidirectionality at the physical layer. In this application, the electro-optical conversion unidirectional optical transmitter can convert electrical signals into optical signals, but cannot convert optical signals back into electrical signals; the opto-optical conversion unidirectional optical receiver can convert optical signals into electrical signals, but cannot convert electrical signals back into optical signals. Depending on the actual situation, there may be a video cable (such as an HDMI cable) or other connection line before the electro-optical conversion unidirectional optical transmitter to connect the transmitter to the preceding component (such as a video transmission module) that transmits electrical signals to it. Therefore, the unidirectional transmission link of the present invention also includes some necessary connection lines. The unidirectional transmission link can also be any link that can realize physically unidirectional signal transmission, including but not limited to unidirectional serial cables.

[0045] like Figure 1As shown, according to some embodiments of the present invention, the one-to-one authorization and access control system of the information transmission terminal mainly includes an intranet-side (authorization center) device fingerprint management module 110, a license generation & signature module 120, and a license distribution module 130; an extranet-side (extranet / isolation zone) terminal device, the terminal device including: a license receiving module 150, a license parsing and verification module 160, a system startup & permission control module 170, and a device fingerprint acquisition module 180; and a unidirectional transmission link 140.

[0046] According to some embodiments of the present invention, the intranet side may further include a terminal registration module 100, which is used to support the registration of hardware information of hardware devices, including supporting the import of hardware information of hardware devices into the terminal registration module. According to some embodiments of the present invention, in the absence of a terminal registration module, the hardware information of hardware devices may also be directly imported into the device fingerprint management module 110 by means of import.

[0047] The device fingerprint management module 110 is used to collect and manage the hardware information of the terminal device and calculate its device fingerprint. The hardware information includes MAC address, CPU serial number, motherboard serial number, hard disk serial number, TPM chip ID (if any), etc. The device fingerprint management module 110 generates FP through Hash operation, FP=Hash(MAC+CPU_ID+DISK_SN+BOARD_ID).

[0048] The license generation and signing module 120 generates a bound license file based on the device fingerprint calculated by the device fingerprint management module 110. The license structure includes: FP (Prefix), validity period, permission list (e.g., playback, update), timestamp, nonce, and digital signature. The digital signature is generated using a private key and the hardware information of the terminal device. The digital signature ensures that the license cannot be forged or tampered with.

[0049] Example structure of license file format:

[0050] {

[0051] "fp_hash": "xxxxxx",

[0052] "expire": "2026-12-01",

[0053] "permissions": ["play","update","push"],

[0054] "timestamp": 1711234567,

[0055] "nonce": 93240234,

[0056] "signature": "RSA / ECC / SM2 digital signature"

[0057] }

[0058] According to some embodiments of the present invention, the license may include:

[0059] Function permissions: Whether to allow video playback, whether to allow receiving push notifications

[0060] Content scope permissions: Which channels / regions' content can be played.

[0061] Time limit: Authorization by day / month / year

[0062] Geographic region restrictions: Which geographic regions are the users only eligible for?

[0063] Device-level blacklist mechanism: Which devices are blacklisted and whose corresponding applications should be closed.

[0064] The license issuance module 130 is used to map the license file into a video signal and send it to a one-way transmission link; the license file is transmitted to the terminal device on the external network through the one-way transmission link 140.

[0065] According to some embodiments of the present invention, the license distribution module 130 may employ a video interface transmitter such as HDMI, DP, SDI, or LVDS. According to some embodiments of the present invention, this module directly carries the license file using the pixel channel values ​​(RGB or YCbCr) of the video frame and outputs it to the unidirectional transmission link 140. This mapping method can greatly increase the data transmission bandwidth on the video line.

[0066] The terminal equipment on the external network side includes a license receiving module 150, a license parsing and verification module 160, a system startup & access control module 170, and a device fingerprint collection module 180.

[0067] Each time the terminal device is started, the device fingerprint acquisition module 180 collects the hardware information of the terminal device and calculates it to obtain the device fingerprint of the terminal device (for the sake of distinction, this FP is referred to as the real-time device fingerprint).

[0068] The license receiving module 150 is used to receive license files from a one-way transmission link.

[0069] The license parsing and verification module 160 is used to read the license file and real-time device fingerprint from the license receiving module 150, and perform the following strong consistency checks:

[0070] 1. Use the public key to verify the digital signature using the hardware information of the terminal device, and confirm that the license was issued by a legitimate authorization center;

[0071] 2. Compare the device fingerprint recorded in the license with the real-time device fingerprint to ensure "one device, one license" and prevent the license from being copied and used on other devices;

[0072] 3. Check if the current time is within the license's validity period;

[0073] 4. Check the random number to prevent replay;

[0074] 5. Determine whether the permissions based on the license meet the functional requirements of the current terminal device.

[0075] The system startup & access control module 170 is used to perform authorization and access control based on the verification results. If any of the above verifications fails, the corresponding application on the terminal device is prohibited from starting, an error log is recorded, and an alarm is triggered. If the verification passes, the corresponding application on the terminal device is started, and fine-grained access control is performed based on the permissions in the license (such as whether specific channels or function switches are allowed).

[0076] According to some embodiments of the present invention, when a large number of user terminals (hereinafter referred to as user terminals to distinguish them from the aforementioned terminal devices) on the external network require access control, if the license issuance module (such as an HDMI transmitter) sends a video frame to each user terminal one by one through a unidirectional transmission link (such as an HDMI cable, an electro-optical conversion unidirectional optical transmitter connected to the HDMI cable, a unidirectional optical fiber, and an opto-optical conversion unidirectional optical receiver), and each frame contains a license file, then a large number of transmission operations must be performed, resulting in huge header overhead. Therefore, this application further proposes that the license generation & signing module 120 is also used to splice and encapsulate the licenses of multiple user terminals into one image frame.

[0077] According to some embodiments of the present invention, the license generation and signing module 120 constructs an index table during encapsulation and places it in the frame header of the image frame. The index table records the identity serial number (such as MAC address, CPUID, TPM chip ID) of each user terminal, as well as the starting offset and length of the user terminal's license in the image frame. The frame body structure then sequentially and closely arranges the license data of each user terminal.

[0078] After encapsulating an image frame, the license generation and signing module 120 either sends it to the license issuance module or sends the encapsulated image frame at predetermined time intervals. Depending on the license usage and update cycle of the actual user terminal, the module can choose to send the image frame immediately after encapsulation or send it periodically by setting a reasonable time interval.

[0079] Figure 2 A schematic diagram of an image frame structure containing multiple terminal licenses is shown according to some embodiments of the present invention. As shown, multiple license data located by an index table are arranged closely after the frame header.

[0080] The license issuance module 130 connects to the license generation and signing module 120 and is used to map the encapsulated license package or license file (including single license packages or multi-license aggregate packages) into a video signal. This module can use video interface transmitters such as HDMI, DP, SDI, or LVDS. According to some embodiments of the present invention, this module directly carries the license file using the pixel channel values ​​(RGB or YCbCr) of the video frame and outputs it to the unidirectional transmission link 140. This mapping method can greatly increase the data transmission bandwidth on the video line.

[0081] Correspondingly, the device fingerprint acquisition module 180 will collect the hardware information of all user terminals and calculate it to obtain the device fingerprint (or real-time device fingerprint) of all user terminals.

[0082] The license receiving module 150 is used to receive a license file (in the form of video frames) containing multiple licenses from a unidirectional transmission link. Here, the license file can be stored as needed to be read by the license parsing and verification module 160 when each user terminal starts up.

[0083] The license parsing and verification module 160 reads the license file from the license receiving module 150 and the real-time device fingerprints of each user terminal, and performs the following strong consistency verification on each user terminal. The parsing process of the license parsing and verification module 160 includes decapsulating the original encapsulation, and re-extracting the identity serial number and license of each user terminal according to the index table.

[0084] Strong consistency checks include:

[0085] 1. Use the public key and the hardware information of the terminal to verify the digital signature and confirm that the license was issued by a legitimate authorization center;

[0086] 2. Compare the device fingerprint recorded in the license with the device fingerprint of the user terminal obtained by the device fingerprint acquisition module 180 to ensure "one device, one license" and prevent the license from being copied to other devices for use;

[0087] 3. Check if the current time is within the license's validity period;

[0088] 4. Check the random number to prevent replay;

[0089] 5. Determine whether the permissions meet the current functional requirements based on the license.

[0090] The system startup & access control module 170 is used to perform authorization and access control based on the verification results. If any of the above verifications fails, the corresponding application on the corresponding terminal is prohibited from starting, an error log is recorded, and an alarm is triggered. If the verification passes, the corresponding application on the corresponding terminal is started, and fine-grained access control is performed based on the permissions in the license (such as whether specific channels are allowed to be played, function switches, etc.).

[0091] In the process described above, each module in the terminal device provides services to each user terminal.

[0092] This invention also proposes a one-to-one authorization and access control method for information transmission terminals. For example... Figure 3 As shown, the method includes the following steps S1 to S6:

[0093] S1. Collect and manage the hardware information of each terminal device and calculate its device fingerprint. The hardware information includes, but is not limited to, MAC address, CPU serial number, motherboard serial number, hard disk serial number, TPM chip ID (if any), etc., and generates FP through Hash operation (FP=Hash(MAC+CPU_ID+DISK_SN+BOARD_ID)).

[0094] S2. Generate a bound license file based on the device fingerprint. The license structure includes: FP, validity period, permission list, timestamp, random number, and digital signature, wherein the digital signature is generated using the hardware information of the terminal device with a private key.

[0095] Digital signatures ensure that licenses cannot be forged or tampered with.

[0096] The permission list is, for example, a list of actions under permission control such as playback and update.

[0097] According to some embodiments of the present invention, the license may include:

[0098] Function permissions: Whether to allow video playback, whether to allow receiving push notifications

[0099] Content scope permissions: Which channels / regions' content can be played.

[0100] Time limit: Authorization by day / month / year

[0101] Geographic region restrictions: Which geographic regions are the users only eligible for?

[0102] Device-level blacklist mechanism: Which devices are blacklisted and whose corresponding applications should be closed.

[0103] S3. Map the license file to a video signal and send the video signal to a one-way transmission link so that the video signal can be transmitted to a terminal device on the external network via the one-way transmission link.

[0104] According to some embodiments of the present invention, the license file is directly carried by the pixel channel values ​​(RGB or YCbCr) of the video frame and output to the unidirectional transmission link 140. This mapping method can greatly increase the data transmission bandwidth on the video line.

[0105] S4. Each time the terminal device is started, the hardware information of the terminal device is collected in real time and calculated to obtain the real-time device fingerprint of the terminal device.

[0106] S5. Read the license file and real-time device fingerprint from the unidirectional transmission link, and perform a strong consistency check, wherein the strong consistency check includes:

[0107] 1. Use the public key to verify the digital signature using the hardware information of the terminal device, and confirm that the license was issued by a legitimate authorization center;

[0108] 2. Compare the device fingerprint recorded in the license with the real-time device fingerprint to ensure "one device, one license" and prevent the license from being copied and used on other devices;

[0109] 3. Check if the current time is within the license's validity period;

[0110] 4. Check the random number to prevent replay;

[0111] 5. Determine whether the permissions based on the license meet the current functional requirements of the terminal device.

[0112] S6. Perform authorization and access control based on the verification results. If any of the above verifications fails, prohibit the corresponding application on the terminal device from starting, record the error log, and issue an alarm. If the verification passes, start the corresponding application on the terminal device and perform fine-grained access control based on the permissions in the license (such as whether specific channels or function switches are allowed).

[0113] Furthermore, the content described above regarding each figure also applies here, and for the sake of simplicity, it will not be repeated.

[0114] When a large number of terminals on the external network require access control, if the license issuance module (such as an HDMI transmitter) authorizes each terminal individually via a unidirectional transmission link (such as an HDMI cable, a unidirectional optical transmitter connected to the HDMI cable, a unidirectional optical fiber, and a unidirectional optical receiver connected to the photoelectric converter), sending one video frame at a time, with each frame containing a license file, then a large number of transmission operations must be performed, resulting in significant overhead. Therefore, this application further proposes a one-to-one authorization and access control method for an information transmission terminal according to some embodiments of the present invention, the method comprising:

[0115] S11. Collect and manage the hardware information of each user terminal and calculate its device fingerprint.

[0116] S12. Generate a bound license file based on the device fingerprint. The license structure includes: FP, validity period, permission list, timestamp, random number and digital signature, wherein the digital signature is generated using the hardware information of the user terminal with a private key.

[0117] S13. The licenses of multiple user terminals are spliced ​​and encapsulated into an image frame. The splicing and encapsulation includes constructing an index table during encapsulation and placing it in the frame header of the image frame. The index table records the identity serial number of each user terminal and the starting offset and length of the terminal's license in the image frame. The frame body structure then arranges the license data of each user terminal in sequence.

[0118] S14. After multiple licenses are encapsulated and spliced, the license file is mapped to a video signal, and the video signal is sent to a one-way transmission link so that the video signal is transmitted to a terminal device on the external network through the one-way transmission link.

[0119] S15. When each user terminal starts up, the hardware information of the user terminal is collected in real time and calculated to obtain the real-time device fingerprint of the user terminal.

[0120] S16. Read the license file and real-time device fingerprint from the unidirectional transmission link, and perform strong consistency verification.

[0121] This step involves decapsulating the original encapsulation and re-extracting the identity serial number and license of each user terminal based on the index table.

[0122] The strong consistency check includes:

[0123] 1. Use the public key and the hardware information of the terminal to verify the digital signature and confirm that the license was issued by a legitimate authorization center;

[0124] 2. Compare the device fingerprint recorded in the license with the real-time device fingerprint to ensure "one device, one license" and prevent the license from being copied and used on other devices;

[0125] 3. Check if the current time is within the license's validity period;

[0126] 4. Check the random number to prevent replay;

[0127] 5. Determine whether the permissions based on the license meet the current functional requirements of the terminal device.

[0128] S17. Perform authorization and access control based on the verification results. If any of the above verifications fails, prohibit the launch of the corresponding application on the corresponding terminal, record the error log, and issue an alarm. If the verification passes, launch the corresponding application on the corresponding terminal and perform fine-grained access control based on the permissions in the license (such as whether specific channels or function switches are allowed).

[0129] Furthermore, the content described above regarding each figure also applies here, and for the sake of simplicity, it will not be repeated.

[0130] The one-to-one authorization and access control method and system for information transmission terminals provided by this invention have the following significant advantages compared with the prior art:

[0131] 1. Strict one-machine-one-certificate: The license is strongly bound to the hardware, and even if it is copied, it cannot run on other terminals.

[0132] 2. Adaptable to one-way and offline scenarios: No network handshake is required, perfectly solving the problem of authorization update and verification in physically isolated environments.

[0133] 3. High security: Combining digital signatures with strong startup verification effectively prevents forged terminals and unauthorized access.

[0134] It should be noted that, for ease of understanding, this application has broken down each step in the method and each module in the system in detail. However, those skilled in the art will understand that, depending on the actual implementation needs, each step and module can be further broken down or reorganized, and these are all within the scope of the present invention.

Claims

1. A one-to-one authorization and access control system for information transmission terminals, comprising: The internal network side includes a device fingerprint management module, a license generation & signing module, and a license distribution module; The terminal equipment on the external network side includes: a license receiving module, a license parsing and verification module, a system startup & access control module, and a device fingerprint collection module; and a unidirectional transmission link; The device fingerprint management module is used to collect and manage the hardware information of terminal devices and calculate their device fingerprints; The license generation & signing module is used to generate a bound license file based on the device fingerprint. The license structure includes: device fingerprint FP, validity period, permission list, timestamp, random number and digital signature, wherein the digital signature is generated using the hardware information of the terminal device with a private key. The license distribution module is used to map license files into video signals and send them to a one-way transmission link; The device fingerprint acquisition module is used to collect and calculate the hardware information of the terminal device each time the terminal device is started, so as to obtain the real-time device fingerprint of the terminal device. The license receiving module is used to receive license files from a one-way transmission link; The license parsing and verification module is used to read the license file and the real-time device fingerprint, and perform strong consistency verification. This includes: using the public key to verify the digital signature using the hardware information of the terminal device, confirming that the license was issued by a legitimate authorization center; comparing the device fingerprint recorded in the license with the real-time device fingerprint; checking whether the current time is within the validity period of the license; checking the random number to prevent replay; and determining whether the permissions meet the functional requirements of the current terminal device based on the license. The system startup & access control module is used to perform authorization and access control based on the verification results.

2. The system according to claim 1, wherein, The intranet side also includes a terminal registration module, which supports the registration of hardware information of hardware devices, including the ability to import hardware information of hardware devices into the terminal registration module.

3. The system according to claim 1 or 2, wherein, The license includes functional permissions, content scope permissions, time limits, geographical restrictions, and a device-level blacklist mechanism; hardware information includes, but is not limited to, MAC address, CPU serial number, motherboard serial number, and hard drive serial number; device fingerprint FP is generated through Hash operation, device fingerprint FP = Hash(MAC + CPU_ID + DISK_SN + BOARD_ID).

4. The system according to claim 3, wherein, The authorization and access control based on the verification results include: if any verification in the strong consistency verification fails, the corresponding application on the terminal device is prohibited from starting, an error log is recorded and an alarm is triggered; if the verification passes, the corresponding application on the terminal device is started normally, and fine-grained access control is performed based on the permission scope field in the license.

5. The system according to claim 1, wherein, The unidirectional transmission link includes: an electro-optical conversion unidirectional optical transmitter for converting electrical signals into optical signals; a unidirectional optical fiber; and an opto-optical conversion unidirectional optical receiver for converting optical signals back into electrical signals; and a license distribution module using an HDMI, DP, SDI, or LVDS video interface transmitter.

6. A one-to-one authorization and access control method for information transmission terminals, characterized in that, Including steps S1 to S6: S1. Collect and manage the hardware information of each terminal device and calculate its device fingerprint; S2. Generate a bound license file based on the device fingerprint. The license structure includes: device fingerprint FP, validity period, permission list, timestamp, random number and digital signature, wherein the digital signature is generated using the hardware information of the terminal device with a private key. S3. Map the license file to a video signal and send the video signal to a one-way transmission link so that the video signal is transmitted to a terminal device on the external network through the one-way transmission link; S4. Each time the terminal device is started, the hardware information of the terminal device is collected in real time and calculated to obtain the real-time device fingerprint of the terminal device; S5. Read the license file and real-time device fingerprint from the one-way transmission link, and perform a strong consistency check. The strong consistency check includes: using the public key and the hardware information of the terminal device to verify the digital signature and confirm that the license was issued by a legitimate authorization center; comparing whether the device fingerprint recorded in the license is consistent with the real-time device fingerprint; checking whether the current time is within the validity period of the license; checking the random number to prevent replay; and determining whether the permissions meet the functional requirements of the current terminal device based on the license. S6. Perform authorization and access control based on the verification results.

7. A one-to-one authorization and access control method for information transmission terminals, characterized in that, The method includes steps S11 to S17: S11. Collect and manage the hardware information of each user terminal and calculate its device fingerprint; S12. Generate a bound license file based on the device fingerprint. The license structure includes: device fingerprint FP, validity period, permission list, timestamp, random number and digital signature, wherein the digital signature is generated using the hardware information of the user terminal with a private key. S13. The licenses of multiple user terminals are spliced ​​and encapsulated into an image frame. The splicing and encapsulation includes constructing an index table during encapsulation and placing it in the frame header of the image frame. The index table records the identity serial number of each user terminal and the starting offset and length of the terminal's license in the image frame. The frame body structure then arranges the license data of each user terminal in sequence. S14. After multiple licenses are encapsulated and spliced, the license file is mapped to a video signal, and the video signal is sent to a one-way transmission link so that the video signal is transmitted to the terminal device on the external network through the one-way transmission link. S15. When each user terminal starts up, the hardware information of the user terminal is collected in real time and calculated to obtain the real-time device fingerprint of the user terminal. S16. Read the license file and real-time device fingerprint from the one-way transmission link, and perform a strong consistency check. The strong consistency check includes: using the public key and the hardware information of the user terminal to verify the digital signature and confirm that the license was issued by a legitimate authorization center; comparing whether the device fingerprint recorded in the license is consistent with the real-time device fingerprint; checking whether the current time is within the validity period of the license; checking the random number to prevent replay; and determining whether the permissions meet the current functional requirements of the user terminal based on the license. S17. Perform authorization and access control based on the verification results.

8. The method according to claim 7, wherein, The authorization and access control based on the verification results include: if any verification in the strong consistency verification fails, the corresponding application on the corresponding terminal is prohibited from starting, an error log is recorded and an alarm is triggered; if the verification passes, the corresponding application on the corresponding terminal is started, and fine-grained access control is performed according to the permissions in the license.

9. The method according to claim 6 or 7, wherein, The license file is directly carried using the pixel channel values ​​of the video frame and then output to the one-way transmission link.

10. The method according to claim 6 or 7, wherein, The license contains: Functional permissions, content scope permissions, time limits, geographical restrictions, and device-level blacklist mechanisms.

Images