POS application security signature system and method based on cloud service

Abstract

The invention provides a POS application security signature system and method based on cloud service. The system architecture is clearly divided into a front-end service area and a high-security trusted area. The front-end service area is deployed in a special network management area which is logically isolated from the Internet and comprises a Web management background and a Web management background database; the high-security trusted area is a trusted environment, and an application signature server, an application signature server database and a hardware security module are deployed in the high-security trusted area. An application developer accesses the system through a controlled client environment. According to the method, responsibility separation of a submitter, a security officer and a key administrator is realized through role-based access control, hierarchical strong identity authentication is adopted, and a rigorous process is followed; a submitter verifies the hash of a file and then creates a task, the task data is synchronized to a high-security credible area after two security officers approve the task independently in sequence, and two key administrators execute dual control to start an HSM key to complete signature. The whole process operation is recorded in an auditing log which cannot be tampered. According to the invention, automation, high security and compliance of the cloud signature process are realized.

Description

Technical Field

[0001] This invention relates to the field of information processing technology, and in particular to secure signature technology for application software running on payment terminal (POS) devices. Specifically, it relates to a POS application signature system and method that is implemented through cloud services and conforms to the PCI series of security standards. Background Technology

[0002] Ensuring the integrity and trustworthiness of application software running on POS devices is crucial. Digital signatures are a key technology for verifying software integrity and authenticity. Currently, POS application signature solutions in the industry mainly suffer from the following two limitations: The first type is based on local key files. This scheme stores the signing private key as a file on a regular server. The private key is easily copied and leaked due to system vulnerabilities, malware, or mismanagement, resulting in low security and failing to meet the mandatory key management requirements of the PCI security standard.

[0003] The second type is the traditional solution based on a Hardware Security Module (HSM). While this solution offers high security by protecting the private key with dedicated hardware, it typically suffers from three major drawbacks: (1) High cost and complex operation and maintenance: Enterprises need to purchase physical HSM equipment and build a dedicated computer room environment that meets security standards. The initial investment and continuous operation and maintenance costs are extremely high, which poses a heavy burden on small and medium-sized application developers.

[0004] (2) Rigid process and control: The signature process mostly adopts a simple single-level approval mechanism, which relies on the manual operation of the system administrator. It lacks role-based, strict separation of responsibilities (such as submission, approval and key management are not separated) and mandatory multi-factor authentication, resulting in weak internal risk control.

[0005] (3) Limited audit and compliance capabilities: Operation logs are usually stored locally and recorded using basic databases or text files. There are problems such as logs being easily tampered with and difficult to retrieve, making it difficult to form an immutable chain of evidence that meets high-level compliance requirements.

[0006] Therefore, the market urgently needs a new cloud signature solution that can provide high security equivalent to local HSMs, while being economical, easy to use, and capable of strict process control and compliance auditing. Summary of the Invention

[0007] The technical problem this invention aims to solve is to overcome the shortcomings of existing technologies and provide a secure signature system and method for POS applications based on cloud services. This solution, through an innovative cloud-based layered security architecture and rigorous process design, achieves high security while significantly reducing costs and improving ease of use and compliance.

[0008] In a first aspect, the present invention provides a POS application secure signature system based on cloud services, including a service provider cloud platform and an application developer client environment; The service provider's cloud platform is logically divided into two core areas: Front-end service area: Deployed in a dedicated network management area that is logically isolated from the Internet, including the Web management backend and Web management backend database, used to provide a Web access interface, user session management and non-core business data caching; High-security trusted zone: a trusted environment internally deployed with: Application signature server is used to handle core business logic, access control, and signature scheduling; The application signature server database is used to persistently store the system's core data, signature task status, and audit logs; The hardware security module is used to generate and store all signing private keys and perform cryptographic operations; The application developer's client environment consists of a physically accessible, dedicated operating room and a dedicated computer configured inside, used to access the service provider's cloud platform through a secure network channel.

[0009] Furthermore, the system is configured for role-based access control, distinguishing at least the following roles: Submitter: Has the authority to create and submit signature task requests; Security officers: Two or more, with the authority to review and approve signature tasks; Key administrators: Two or more, existing only in a trusted environment, with permission to enable HSM signing keys; Each role has strictly separated permissions to achieve separation of responsibilities.

[0010] Furthermore, the system integrates a hierarchical strong authentication mechanism: For submitters, at least a multi-factor authentication method based on account passwords and one-time dynamic passwords should be used; For security officers and key administrators, a multi-factor authentication method based on digital certificates is used.

[0011] Furthermore, the hardware security module is configured to prevent the export of any of the signature private keys.

[0012] Secondly, the present invention provides a secure signature method for POS applications based on cloud services, which is based on the system described in the first aspect and includes the following steps: S1: When the submitter logs into the Web management backend of the service provider's cloud platform through the application developer's client environment, the application signing server in the high-security trusted zone authenticates the submitter's identity. After successful authentication, the Web management backend receives the application package to be signed and its basic information submitted by the submitter, and the application signing server calculates the hash value of the application package and displays it to the submitter for manual verification. S2: When the Web management backend receives the result of manual verification, it automatically triggers the preset two-person approval process, creates a signature task with the status of "pending approval", and notifies two security officers. If the manual verification fails, the process will terminate. S3: The Web management backend presents the "pending approval" signature tasks in the approval queue; and when two security officers log in to the Web management backend in turn, the system automatically authenticates the approval roles of the two security officers and performs double verification and approval operations on the basic information and hash value of the application package to be signed through the verification interface provided by the system. S4: After the dual-person approval process is completed and both approvals are approved, the Web management backend updates the status of the signing task to "pending signature", synchronizes the complete data of the signing task to the application signature server database deployed in the high-trust security zone, and automatically notifies the two key administrators to execute the dual control process. S5: When two key administrators jointly execute the dual control process in the high-security trusted zone, the signature key in the hardware security module is enabled; S6: The application signing server sends the hash value to the hardware security module, performs the signing operation using the signing key, and embeds the digital signature into the application package to be signed after the signing is completed, generating a signed application package, and updates the status of the signing task to "completed". S7: The Web management backend obtains the completion status of the signing task from the application signing server and provides the submitter with a way to download the signed application.

[0013] Furthermore, in step S3, the approval operations of the two security officers must be performed independently and sequentially; and when the approval operation result of any security officer is rejection, the Web management backend updates the status of the signature task to "rejected" and the process terminates immediately; the status of the signature task can only be changed from "pending approval" to "pending signature" if and only if the approval results of both security officers are approval.

[0014] Furthermore, the dual control process described in step S5 means that two key administrators must complete identity authentication separately and perform physical and / or logical operations sequentially or simultaneously in order to successfully enable the signature key in the hardware security module.

[0015] Furthermore, all operations within the method are recorded by the system in an immutable audit log in the database, including: User sessions, task lists, and interface operation logs are all stored in the Web management backend database; Core signature task data, approval results, key activation events, signature operation events, and global audit logs are stored in the application signature server database.

[0016] This invention transforms the traditional POS application signature process, which relies on expensive local hardware security modules (HSMs), into a service-oriented model by constructing a cloud-based layered signature platform based on a front-end service area and a high-security trusted area. This addresses the challenges faced by small and medium-sized application developers, such as high security hardware costs, complex deployment and maintenance, and difficulties in meeting compliance requirements. This solution offers the following advantages: (1) Balance between security and cost: By pooling HSM resources in the cloud, application developers can obtain high-level cryptographic computing capabilities in the form of services, avoiding the high costs of hardware procurement and compliance environment construction. (2) Defense-in-depth system: Through network isolation of “front-end service area / high security trusted area”, separation of duties of role-based access control, hierarchical strong authentication, and multiple control processes of “submitter verification - dual security officer approval - dual key administrator operation”, an end-to-end defense-in-depth security system is constructed. (3) Enhanced compliance and auditability: The entire process (including hash verification, approval, key activation, and signature) is recorded immutably in the database, forming a complete chain of evidence, which greatly simplifies the proof of compliance with standards such as PCI and the tracing of security incidents.

[0017] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and in order to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0018] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0019] Figure 1 This is a schematic diagram of the overall framework of the system of the present invention; Figure 2 This is a flowchart of the method in Embodiment 1 of the present invention; Figure 3 This is a schematic diagram illustrating an example of the operation interface for a security officer on a web platform, as described in an embodiment of the present invention. Detailed Implementation

[0020] This application provides a secure signature system and method for POS applications based on cloud services. Through an innovative cloud-based layered security architecture and rigorous process design, it achieves high security while significantly reducing costs and improving ease of use and compliance.

[0021] The technical solution in this application embodiment follows the following general approach: By constructing a cloud platform logically divided into a front-end service area and a high-security trusted area, the traditional POS application signature process, which relies on expensive local hardware security modules (HSMs), is transformed into a service-oriented model. This addresses the problems faced by small and medium-sized application developers, such as high security hardware costs, complex deployment and maintenance, and difficulty in meeting compliance requirements. The core of this approach lies in the service provider operating a cloud platform integrating a web management backend, application signature server, database, and HSM, with strict separation of responsibilities and hierarchical strong identity authentication for three roles: submitter, security officer, and key administrator. Application developers access the platform through a controlled client environment. After the submitter verifies the file hash and initiates the task, it is independently approved by two security officers. The task data is then synchronized to the high-security trusted area, where two key administrators perform dual control to activate the HSM key and complete the signature. The entire process is immutably recorded in the audit log. This invention achieves a balance between security, cost, and convenience, enabling small and medium-sized application developers to easily obtain signature capabilities compliant with security standards such as PCI.

[0022] Example 1 like Figure 1 As shown, this embodiment provides a POS application secure signature system based on cloud services, including a service provider cloud platform and an application developer client environment; The service provider's cloud platform is logically divided into two core areas: Front-end service area: Deployed in a dedicated network management area that is logically isolated from the Internet, including the Web management backend and Web management backend database, used to provide a Web access interface, user session management and non-core business data caching.

[0023] High-security trusted zone: a trusted environment, deployed internally. Application signature server: Used to handle core business logic and access control such as user management, access control, task scheduling, and signature scheduling; Application Signature Server Database: Deployed with a high-availability architecture, this database persistently stores all core system data, complete signature task status streams (such as "Pending Approval," "Pending Signing," and "Completed"), approval records, key activation events, signature operation details, and global audit logs. As the system's "single trusted source," all critical business logic state changes and audit evidence are persistently recorded in this database, ensuring data integrity and traceability, and directly supporting the PCI and other standards' requirements for audit log integrity protection. Preferably or optionally, task data is also stored only in this database and is called and calculated by the application signature server, resulting in higher security.

[0024] Hardware Security Module (HSM): Physically and logically protected to FIPS 140-2 Level 3 or higher, all signing private keys are generated, stored and used to perform cryptographic operations within it, and are set to not be exported.

[0025] The application developer's client environment consists of a physically accessible, dedicated operating room and a dedicated computer configured inside, used to access the service provider's cloud platform through a secure network channel.

[0026] The system is configured for role-based access control, distinguishing at least the following roles and strictly isolating permissions: Submitter: Has the authority to create and submit signature task requests.

[0027] Security officers: Two or more, with the authority to review and approve signature tasks.

[0028] Key administrators: Two or more, existing only in the high-security trusted zone, with permission to enable HSM signing keys.

[0029] The system integrates a hierarchical strong authentication mechanism: For submitters, at least a multi-factor authentication method based on account password and one-time dynamic password should be used.

[0030] For security officers and key administrators, a multi-factor authentication method based on digital certificates is used.

[0031] Example 2 Based on the same inventive concept, this application also provides a method corresponding to the system in Embodiment 1, such as... Figure 2 As shown, the method in this embodiment is based on the system described in Embodiment 1 and includes the following steps: S1: When the submitter logs into the Web management backend of the service provider's cloud platform through the application developer's client environment, the application signing server in the high-security trusted zone authenticates the submitter's identity. After successful authentication, the Web management backend receives the application package to be signed and its basic information submitted by the submitter, and the application signing server calculates the hash value of the application package and displays it to the submitter for manual verification. S2: When the Web management backend receives the result of manual verification, it automatically triggers the preset two-person approval process, creates a signature task with the status of "pending approval", and notifies two security officers. If the manual verification fails, the process will terminate. S3: The Web management backend presents the "pending approval" signature tasks in the approval queue; and when two security officers log in to the Web management backend in turn, the system automatically authenticates the approval roles of the two security officers and performs double verification and approval operations on the basic information and hash value of the application package to be signed through the verification interface provided by the system. S4: After the dual-person approval process is completed and both approvals are approved, the Web management backend updates the status of the signing task to "pending signature", synchronizes the complete data of the signing task to the application signature server database deployed in the high-trust security zone, and automatically notifies the two key administrators to execute the dual control process. S5: When two key administrators jointly execute the dual control process in the high-security trusted zone, the signature key in the hardware security module is enabled; S6: The application signing server sends the hash value to the hardware security module, performs the signing operation using the signing key, and embeds the digital signature into the application package to be signed after the signing is completed, generating a signed application package, and updates the status of the signing task to "completed". S7: The Web management backend obtains the completion status of the signing task from the application signing server and provides the submitter with a way to download the signed application.

[0032] Furthermore, in step S3, the approval operations of the two security officers must be performed independently and sequentially; and when the approval operation result of any security officer is rejection, the Web management backend updates the status of the signature task to "rejected" and the process terminates immediately; the status of the signature task can only be changed from "pending approval" to "pending signature" if and only if the approval results of both security officers are approval.

[0033] The dual control process described in step S5 means that two key administrators must complete identity authentication separately and perform physical and / or logical operations sequentially or simultaneously in order to successfully enable the signature key in the hardware security module.

[0034] All operations within the method are recorded by the system in an immutable audit log in the database, including: User sessions, task lists, and interface operation logs are all stored in the Web management backend database; Core signature task data, approval results, key activation events, signature operation events, and global audit logs are stored in the application signature server database.

[0035] This invention transforms the traditional POS application signature process, which relies on expensive local hardware security modules (HSMs), into a service-oriented model by constructing a cloud-based layered signature platform based on a front-end service area and a high-security trusted area. This addresses the challenges faced by small and medium-sized application developers, such as high security hardware costs, complex deployment and maintenance, and difficulties in meeting compliance requirements. This solution offers the following advantages: (1) Balance between security and cost: By pooling HSM resources in the cloud, application developers can obtain high-level cryptographic computing capabilities in the form of services, avoiding the high costs of hardware procurement and compliance environment construction. (2) Defense-in-depth system: Through network isolation of “front-end service area / high security trusted area”, separation of duties of role-based access control, hierarchical strong authentication, and multiple control processes of “submitter verification - dual security officer approval - dual key administrator operation”, an end-to-end defense-in-depth security system is constructed. (3) Enhanced compliance and auditability: The entire process (including hash verification, approval, key activation, and signature) is recorded immutably in the database, forming a complete chain of evidence, which greatly simplifies the proof of compliance with standards such as PCI and the tracing of security incidents.

[0036] While specific embodiments of the present invention have been described above, those skilled in the art should understand that the specific embodiments described are merely illustrative and not intended to limit the scope of the present invention. Equivalent modifications and variations made by those skilled in the art in accordance with the spirit of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A secure signature system for POS applications based on cloud services, characterized in that: This includes the service provider's cloud platform and the application developer's client environment; The service provider's cloud platform is logically divided into: Front-end service area: Deployed in a dedicated network management area that is logically isolated from the Internet, including the Web management backend and Web management backend database, used to provide a Web access interface, user session management and non-core business data caching; High-security trusted zone: a trusted environment, deployed internally. Application signature server is used to handle core business logic, access control, and signature scheduling; The application signature server database is used to persistently store the system's core data, signature task status, and audit logs; The hardware security module is used to generate and store all signing private keys and perform cryptographic operations; The application developer's client environment consists of a physically accessible, dedicated operating room and a dedicated computer configured inside, used to access the service provider's cloud platform through a secure network channel.

2. The system according to claim 1, characterized in that: The system is configured for role-based access control, distinguishing at least the following roles: Submitter: Has the authority to create and submit signature task requests; Security officers: Two or more, with the authority to review and approve signature tasks; Key administrators: Two or more, existing only in a trusted environment, with permission to enable HSM signing keys; Each role has strictly separated permissions to achieve separation of responsibilities.

3. The system according to claim 2, characterized in that: The system integrates a hierarchical strong authentication mechanism: For submitters, at least a multi-factor authentication method based on account passwords and one-time dynamic passwords should be used; For security officers and key administrators, a multi-factor authentication method based on digital certificates is used.

4. The system according to claim 1, characterized in that: The hardware security module is configured to prevent the export of any of the signature private keys.

5. A secure signature method for POS applications based on cloud services, characterized in that: Based on the system as described in any one of claims 1-4, the system includes the following steps: S1: When the submitter logs into the Web management backend of the service provider's cloud platform through the application developer's client environment, the application signing server in the high-security trusted zone authenticates the submitter's identity. After successful authentication, the Web management backend receives the application package to be signed and its basic information submitted by the submitter, and the application signing server calculates the hash value of the application package and displays it to the submitter for manual verification. S2: When the Web management backend receives the result of manual verification, it automatically triggers the preset two-person approval process, creates a signature task with the status of "pending approval", and notifies two security officers. If the manual verification fails, the process will terminate. S3: The Web management backend presents the "pending approval" signature tasks in the approval queue; and when two security officers log in to the Web management backend in turn, the system automatically authenticates the approval roles of the two security officers and performs dual review and approval operations on the basic information and hash value of the application package to be signed through the verification interface provided by the system. S4: After the dual-person approval process is completed and both approvals are approved, the Web management backend updates the status of the signing task to "pending signature", synchronizes the complete data of the signing task to the application signature server database deployed in the high-trust security zone, and automatically notifies the two key administrators to execute the dual control process. S5: When two key administrators jointly execute the dual control process in the high-security trusted zone, the signature key in the hardware security module is enabled; S6: The application signing server sends the hash value to the hardware security module, performs the signing operation using the signing key, and embeds the digital signature into the application package to be signed after signing, generating a signed application package, and updates the status of the signing task to "completed". S7: The Web management backend obtains the completion status of the signing task from the application signing server and provides the submitter with a way to download the signed application.

6. The method according to claim 5, characterized in that: In step S3, the approval operations of the two security officers must be performed independently and sequentially; and when the approval operation result of any security officer is rejection, the Web management backend will update the status of the signature task to "rejected" and the process will terminate immediately; the status of the signature task can be changed from "pending approval" to "pending signature" only when the approval results of both security officers are both approval.

7. The method according to claim 5, characterized in that: The dual control process described in step S5 means that two key administrators must complete identity authentication separately and perform physical and / or logical operations sequentially or simultaneously in order to successfully enable the signature key in the hardware security module.

8. The method according to claim 5, characterized in that: All operations within the method are recorded by the system in an immutable audit log in the database, including: User sessions, task lists, and interface operation logs are all stored in the Web management backend database; Core signature task data, approval results, key activation events, signature operation events, and global audit logs are stored in the application signature server database.

Images