Method for preventing cracking control of water vending machine based on multi-source state verification

Abstract

The present application relates to a kind of based on multi-source state verification to realize the method for vending water machine anti-cracking control, comprising the following steps: establishing the reference data bound with the equipment identity identification of vending water machine, collection is used to represent the multi-source monitoring data of vending water machine physical state and operating state;Multi-source monitoring data is carried out time alignment and validity judgment, different data is attributed to unified event time axis;According to the duration of each abnormal event, repeat times and confidence determine single event level;When reaching lock machine level, send lock machine instruction, and abnormal evidence data is written into anti-rollback storage area according to increasing serial number.The vending water machine anti-cracking control system and its computer readable storage medium based on multi-source state verification to realize the method for vending water machine anti-cracking control, vending water machine, vending water machine of the present application, can identify equipment move, bypass water, illegal open cabinet, offline operation and illegal filter element reset, and reduce positioning drift, normal flushing and network fluctuation caused by false lock machine.

Description

Technical Field

[0001] This invention relates to the field of water purification equipment safety control, and more particularly to the field of Internet of Things (IoT) device management technology. Specifically, it refers to a method for anti-hacking control of water vending machines based on multi-source status verification, a water vending machine, an anti-hacking control system for water vending machines, and a computer-readable storage medium thereof. Background Technology

[0002] Community water vending machines, commercial water purification and vending equipment, and water purifiers with metering and payment functions are typically installed in fixed business locations. The equipment controls water dispensing based on user payments or account authorization, and an operating platform manages the equipment location, filter lifespan, water production status, water dispensing records, and maintenance processes. Internally, water vending machines typically contain raw water pipelines, filter components, a water storage unit, a booster pump, a dispensing valve, a flow meter, an electrical control board, and a communication module.

[0003] In actual operation, unauthorized personnel may move the equipment, open the cabinet door, connect the water outlet pipe, bypass the transaction control module, disconnect the communication between the equipment and the server, or directly reset the filter life without replacing the filter cartridge. The above operations will cause the water vending machine to deviate from the set installation conditions or maintenance rules, resulting in unmetered water dispensing, untraceable water quality, loss of control of equipment assets, and distortion of operational data.

[0004] Existing water vending machine anomaly control often relies on a single switch signal or a single backend command. For example, judging whether the equipment has been moved based solely on location coordinates is easily affected by satellite signal blockage, base station switching, and location drift; comparing the cumulative water production and transaction output without deducting normal flushing drainage and changes in water storage can easily lead to false alarms; detecting only the cabinet door opening status cannot distinguish between legitimate maintenance and unauthorized opening; and relying solely on server disconnection and machine locking will affect normal water dispensing during short-term fluctuations in the public network.

[0005] In addition, some devices allow filter cartridge reset to be performed via a local button. Simply pressing and holding the button or modifying control panel parameters can restore the filter cartridge's lifespan, making it difficult for the backend to determine whether the filter cartridge has actually been replaced. Some devices directly cut off the entire unit's power supply upon detecting an anomaly, failing to preserve on-site evidence and potentially disabling safety functions required for drainage, pressure relief, or maintenance. Furthermore, without a controlled recovery process after the anomaly is resolved, the system can be bypassed by repeatedly powering on, restoring factory settings, or rolling back metering data.

[0006] Therefore, a hacking prevention solution is needed that addresses the physical structure and operation of water vending machines, incorporating multiple mutually verifiable state variables into a unified judgment, providing early warnings in the early stages of anomalies, locking the machine when risks persist or are interconnected, and ensuring traceability of the handling process through evidence retention and authorized unlocking. Summary of the Invention

[0007] The purpose of this invention is to overcome the shortcomings of the prior art and provide a method, a water vending machine, a water vending machine anti-hacking control system, and a computer-readable storage medium thereof based on multi-source state verification, which is highly reliable, highly secure, and widely applicable.

[0008] To achieve the above objectives, the present invention provides a method for anti-hacking control of a water vending machine based on multi-source state verification, a water vending machine, an anti-hacking control system for a water vending machine, and a computer-readable storage medium thereof, as follows: The method for preventing hacking of water vending machines based on multi-source state verification is characterized by the following steps: (1) Establish reference data that is bound to the equipment identification of the water vending machine, wherein the reference data includes at least the installation location reference, maintenance authorization data and filter configuration data; (2) Collect multi-source monitoring data to characterize the physical and operational status of the water vending machine. The multi-source monitoring data includes positioning data, water production metering data, water intake metering data, cabinet door status data, heartbeat communication data, and filter life and reset data. (3) Perform time alignment and validity judgment on the multi-source monitoring data, classify different data into a unified event timeline, and generate location deviation event, water imbalance event, cabinet door abnormality event, communication abnormality event and filter maintenance abnormality event based on the valid multi-source monitoring data. (4) On the unified event timeline, the level of a single event is determined based on the duration, number of repetitions and confidence level of each abnormal event, and the risk weight is increased when at least two types of abnormal events exist simultaneously within a preset associated time window, so as to determine the risk level of the equipment. (5) When the risk level of the equipment reaches the warning level, output the warning information. When the pre-lock level is reached, restrict at least one of the single water intake, cumulative water intake, and number of transactions or require the server to confirm online. When the machine lock level is reached, send the machine lock command to the water outlet solenoid valve and the transaction water outlet control module to close the water outlet solenoid valve and prohibit new transaction water outlet. At the same time, write the abnormal evidence data corresponding to the machine lock command into the anti-rollback storage area in incrementing order. (6) After the abnormal conditions are eliminated, the recovery verification level is entered. The one-time authorization unlocking certificate bound to the device identity, abnormal event number, random number and validity period and the device self-test result are verified. The locked state is released only when the one-time authorization unlocking certificate is successfully verified and the device self-test result meets the recovery conditions.

[0009] Preferably, the validity determination of the multi-source monitoring data in step (3) specifically includes the following steps: Each monitoring data point is appended with a local timestamp and an incrementing sequence number, and then subjected to de-jittering and time alignment. The validity of the monitoring data is determined based on the operating mode of the water vending machine. The operating modes include at least standby mode, water production mode, transaction water dispensing mode, automatic flushing mode, water storage and replenishment mode, maintenance mode, and lock mode. Only data that matches the corresponding operating mode and meets the sensor's validity conditions are included in the unified event timeline and used to generate abnormal events.

[0010] Preferably, the generation of the position deviation event in step (3) specifically includes the following steps: Acquire at least one of the following: satellite positioning data, base station positioning data, wireless network positioning data, and geocoding data corresponding to the installation address; Determine the confidence level of the positioning data based on the positioning accuracy; Calculate the distance between the current location and the installation location reference; when the confidence level reaches the effective location threshold, and the distance exceeds the location deviation threshold and continues for a preset location confirmation time or reaches a preset number of times within multiple sampling periods, generate the location deviation event; The confidence level is a weighted result of the positioning accuracy sub-score, the positioning source consistency sub-score, and the continuous effective sampling ratio, and is divided into low confidence, medium confidence, and high confidence levels according to a first confidence threshold and a second confidence threshold. Low confidence positioning data is only used for reference, medium confidence positioning data must meet the duration or preset number of confirmation conditions, and high confidence positioning data is used to generate a position deviation event or increase the level of the position deviation event when the distance exceeds the position deviation threshold.

[0011] Preferably, the generation of the water imbalance event in step (3) specifically includes: accumulating the water production Qp, water intake Qd, flushing drainage Qf, and water storage change ΔVs within a sliding statistical time window; before generating the water imbalance event, the following steps are also included: The system identifies the water production start-up phase, filter flushing phase, water storage unit replenishment phase, meter calibration phase, and legal maintenance water discharge phase; it compensates for, separately measures, or removes the water volume from the sliding statistical time window for each phase; it only includes the corresponding water volume in the flushing drainage volume Qf when both the flushing valve drive signal and the corresponding flushing flow feedback are present; it determines the dynamic tolerance band based on the calibration error of the water production metering component and the water intake metering component; and it marks the water volume imbalance event as a high-confidence event when the transaction outlet valve does not receive an opening command but the water intake side detects a continuous flow, or when the water production pump runs continuously and there is no corresponding transaction record and the water storage volume does not increase.

[0012] Preferably, the generation of cabinet door abnormality events in step (3) specifically includes the following steps: Before unlocking the electromagnetic lock, the maintenance authorization certificate is verified, and an authorized maintenance time window with a start time and an end time is established after successful verification. When the cabinet door is detected to be opened without the establishment of the authorized maintenance time window, or when the cabinet door is not closed after the authorized maintenance time window ends and the door opening timeout threshold is reached, the cabinet door abnormal event is generated. The cabinet door status is detected by at least one of the following: door magnetic switch, Hall sensor, micro switch, and the bolt position sensor of the electromagnetic lock. When the cabinet door status, bolt status, and electromagnetic lock unlocking command are inconsistent, the cabinet door abnormal event is marked as a high-risk event. When the cabinet door status changes repeatedly within a preset debouncing time, the cabinet door status is confirmed by repeatedly sampling until consistent results are obtained.

[0013] Preferably, the heartbeat communication data is formed by heartbeat messages sent by the water vending machine to the server according to a preset period and response messages returned by the server; the heartbeat message carries at least a device identity identifier, an incrementing sequence number, a device time, an operation summary, and message authentication data; the server carries a random number or instruction digest corresponding to the current session in the response message; the water vending machine writes the random number or instruction digest into the authentication calculation of the next heartbeat message so that adjacent heartbeat messages form a continuous session; when the number of consecutive failures to receive a valid response message reaches the retry threshold, or the interval between valid response messages exceeds the heartbeat timeout threshold, the communication abnormality event is generated; The method further includes the following steps: After the communication anomaly event is generated, the system first enters an offline grace period. In the offline grace period, at least one of the following is restricted: single water intake, cumulative water intake, number of transactions, and offline duration. When the offline grace period is exhausted, or when at least one of the following events occurs simultaneously: communication anomaly event, location deviation event, cabinet door anomaly event, and water imbalance event, the system is determined to have reached the lock level.

[0014] Preferably, the generation of the filter element maintenance abnormality event in step (3) specifically includes the following steps: The remaining lifespan of the filter cartridge is determined based on at least two of the following: filter cartridge activation time, cumulative water production, raw water quality parameters, filtration pressure difference, and water production efficiency; a replacement prompt is output when the remaining lifespan of the filter cartridge reaches the warning condition; a maintenance reset period is established after the filter cartridge lifespan expires; if an effective reset is not completed within the maintenance reset period, a filter cartridge maintenance anomaly event is generated; a filter cartridge maintenance anomaly event is also generated when it is detected that the filter cartridge lifespan value has been reset but the identity of an unused new filter cartridge is not read, or the maintenance personnel certificate or one-time maintenance certificate is not verified. The effective reset specifically includes the following steps: Read the filter cartridge identification mark carried by the new filter cartridge; verify that the filter cartridge identification mark has not been recorded as used by the water vending machine or the server; verify the maintenance personnel certificate or the one-time maintenance certificate issued by the server; detect the flushing process and water production parameters after replacing the filter cartridge; after the filter cartridge identification mark, the maintenance certificate and the water production parameters are all verified, update the filter cartridge configuration data and the filter cartridge life benchmark.

[0015] Preferably, the equipment risk levels include normal level, early warning level, pre-lock level, machine lock level, and recovery verification level; when a single low-confidence abnormal event is established, the system switches from normal level to early warning level; when the same abnormal event continues for more than the corresponding confirmation time, the same abnormal event repeats to the corresponding number of times within a preset statistical period, at least two types of abnormal events exist simultaneously within the associated time window, or a single abnormal event with a high-risk indicator is established, the system switches from early warning level to pre-lock level, or from early warning level or pre-lock level to machine lock level; different entry thresholds and exit thresholds are set between each level, and the exit threshold of the same level is lower than the corresponding entry threshold; The single abnormal event with a high-risk identifier includes at least one of the following: unauthorized opening of the cabinet and abnormal latch status, hardware detection signal of metering path being bypassed, failure of device key verification, and rollback of abnormal evidence storage.

[0016] Preferably, step (4) further includes the following steps: The single event risk score Si of the i-th type of abnormal event is calculated and determined by weighting the baseline risk coefficient Wi of the i-th type of abnormal event with the normalized duration, the normalized repetition frequency, and the confidence level ci; when at least two types of abnormal events are valid simultaneously within the associated time window, the equipment risk score is calculated and corrected with the corresponding associated increment.

[0017] Preferably, the calculation of the single-event risk score Si in step (4) is specifically as follows: The risk score Si for a single event is calculated using the following formula: Si=Wi×[α×min (ti / Ti, 1) + β×min (ni / Ni, 1) + γ×ci]; Where ti and ni are the duration of the abnormal event and the number of repetitions within the preset statistical period, respectively; Ti and Ni are the corresponding reference values ​​for duration and number of repetitions, respectively; ci is the confidence level ranging from 0 to 1; Wi is the baseline risk coefficient; and α, β and γ are non-negative weights and α + β + γ = 1.

[0018] Preferably, the calculation of the equipment risk score in step (4) is specifically as follows: Calculate the equipment risk score using the following formula: S=min[Smax, maxi(Si)+Σi<j(λij×Aij)]; Where maxi(Si) is the maximum risk score of a single event among all categories, Σi<j represents the summation of all event combinations that satisfy the condition i<j, Aij=1 when the i-th type of abnormal event and the j-th type of abnormal event are simultaneously valid within the associated time window, otherwise Aij=0, λij is the corresponding associated increment; the equipment risk score S is compared with the early warning threshold P1, the pre-lock threshold P2 and the machine lock threshold P3 in sequence, where P1<P2<P3, and Smax is the upper limit of the risk score.

[0019] Preferably, the abnormal evidence data includes at least four of the following: abnormality type, device identification, occurrence time, original monitoring value, judgment threshold, device operating mode, cabinet door status, communication sequence number, and executed control action; the abnormal evidence data is written to the anti-rollback storage area in chronological order and forms integrity verification data through message authentication code or digital signature; after communication is restored, the abnormal evidence data that was not uploaded is re-transmitted according to the incrementing sequence number, and the server detects missing, duplicate, or rolled-back sequence numbers; the abnormal evidence data in the anti-rollback storage area is not deleted due to factory reset; The anti-rollback storage area is a logical storage area located in the protected non-volatile memory of the secure storage unit. It consists of a monotonic counter, a record number, a previous record summary, and current record integrity verification data. Only authorized append writes are allowed, and unauthorized overwriting is not permitted. The sequence number of the newly written record must not be less than the sealed monotonic counter value. The protected non-volatile memory is at least one of the following: internal non-volatile memory of the secure chip, controller flash memory with read / write protection, or external secure memory.

[0020] Preferably, if the communication anomaly event and the location deviation event occur simultaneously within the associated time window, it is determined that the device has been moved and the network is actively disconnected, and the risk level of the device is increased; when the cabinet door anomaly event and the water imbalance event occur simultaneously within the associated time window, it is determined that there is bypass water intake and the risk level of the device is increased; when it is detected that the filter life value has been reset but no new filter identification is read, it is determined that there is an unauthorized filter reset and the risk level of the device is increased.

[0021] Preferably, the recovery conditions before the unlocking state are specifically as follows: The device self-test includes at least one of the following conditions corresponding to the type of abnormal event: the position returns to the allowable position range, the water volume difference returns to the recovery threshold, the cabinet door is closed and the latch is in place, the heartbeat communication is restored, and the filter element is effectively reset; the device self-test includes performing self-tests on at least one of the flow meter, valve, pump, water storage unit level, and communication link; after verification, a short-term trial run is performed. During the trial run, the outlet solenoid valve remains under control. After the water production, water intake, pressure, and water quality meet the recovery conditions, the device returns to the normal level. If the trial run fails, the device returns to the lock level and the reason for the failure is recorded.

[0022] The main features of this water vending machine are as follows: It includes a water purification component, a water dispensing component, a water storage unit, a controller, a positioning component, a water metering component, a water dispensing metering component, a cabinet door detection component, an electromagnetic lock, a communication component, a filter cartridge identification component, and a lock-operating component. The water metering component is located between the pure water outlet of the water purification component and the water storage unit, or at the inlet of the water storage unit. The water dispensing metering component is located on the water dispensing channel controlled by the transaction water dispensing control module. The cabinet door detection component outputs the cabinet door status to the controller, and the electromagnetic lock outputs latch position feedback to the controller. The controller is connected to the positioning component, water metering component, water dispensing metering component, cabinet door detection component, electromagnetic lock, communication component, filter cartridge identification component, and lock-operating component, and is configured to execute the aforementioned method for anti-hacking control of the water vending machine based on multi-source status verification. The water production metering component and the water intake metering component form two physically separate metering paths located upstream of the water storage unit and on the controlled water outlet channel, respectively. The cabinet door status output by the cabinet door detection component and the latch position feedback output by the electromagnetic lock form two independent anti-tamper detection channels. The lock actuator component is electrically connected to at least the water outlet solenoid valve and the transaction water outlet control module. The controller locally performs correlation verification on the data of the two metering paths and the status of the two anti-tamper detection channels, and drives the lock actuator component to cut off the controlled water outlet channel when the lock level is reached, so as to form a hardware closed loop of physical status acquisition, risk judgment and controlled lock. The controller includes a secure storage unit, a trusted timing unit, and a risk determination unit. The secure storage unit stores device keys, installation location references, cumulative flow values, filter identification, and abnormal evidence data. The trusted timing unit maintains event sequence and time window counting when communication with the server is interrupted. The risk determination unit generates abnormal events locally, determines the device risk level, and drives the locking execution component. The secure storage unit includes a protected non-volatile memory and a rollback-proof storage area disposed therein. The rollback-proof storage area maintains the sequential integrity of the abnormal evidence data through a monotonic counter and the previous record summary. The secure storage unit, the trusted timing unit, the cabinet door detection component, and the communication component are connected to a power supply branch that maintains power supply in the locked state. The water metering component includes two flow sensors connected in series with different measurement principles; the cabinet door detection component includes at least one of a door magnetic switch, a Hall sensor, a micro switch, and a latch position sensor; the positioning component is integrated into the communication component, or is an external satellite positioning module, or uses an authorized wireless access point fingerprint, Bluetooth beacon, base station information, or wired network node identifier to assist in positioning; the water production volume measured by the water production metering component and the water intake volume measured by the water intake metering component are obtained through a pulse flow meter, an ultrasonic flow meter, a weighing sensor, the liquid level change of the water storage unit, or a pump displacement model; The locking mechanism includes at least one of a water outlet solenoid valve, a water inlet solenoid valve, a booster pump drive circuit, and a transaction water dispensing control module. When executing the locking command, the authorized and ongoing single water dispensing is first terminated or the water dispensing is terminated according to the safety stop conditions. Then, the water outlet solenoid valve is closed and new transaction water dispensing is prohibited, while retaining the safety functions required for pressure relief, drainage, fire-fighting water supply, or authorized maintenance. After executing the locking command, the water vending machine's controller, communication components, cabinet door detection components, and safety storage unit remain powered to continue performing status monitoring, anomaly reporting, and anomaly evidence data storage. Different risk types correspond to different locking ranges: position deviation events correspond to prohibiting transaction water dispensing; filter cartridge maintenance anomalies correspond to prohibiting water production and dispensing; and communication anomalies correspond to limiting offline water dispensing quotas.

[0023] The main feature of this anti-hacking control system for water vending machines is that the system includes a server and at least one of the aforementioned water vending machines. The server is used to store installation location references and maintenance authorization data bound to the device identity, receive heartbeat messages and abnormal evidence data from the water vending machine, send response messages, risk handling instructions or one-time authorization unlocking certificates to the water vending machine, and generate a server-side communication abnormality event when a valid heartbeat message is not received on time. The server is also used to receive heartbeat summaries, transaction records and abnormal evidence data during the network outage according to an incremental sequence number after communication is restored, and to perform consistency verification on the cumulative water production value, cumulative water intake value, filter cartridge identification and equipment time before and after the network outage; The server generates the one-time authorization unlocking credential only after confirming that the recovery conditions corresponding to the abnormal event type are met. The one-time authorization unlocking credential includes the range of locks that can be unlocked, a random number, the issuance time, the validity period, and a one-time use mark. It is signed by the server's private key or generated as a message authentication code using a key shared by the server and the water vending machine. The server also maintains the issuance and usage status of the random number to reject credentials that are reused.

[0024] The computer-readable storage medium is characterized in that it stores a computer program that can be executed by a processor to implement the various steps of the above-described method for preventing hacking of water vending machines based on multi-source state verification.

[0025] The present invention employs a method, a water vending machine, a water vending machine anti-hacking control system based on multi-source state verification, and a computer-readable storage medium thereof. This method can identify equipment relocation, bypass water intake, unauthorized cabinet opening, offline operation, and improper filter cartridge reset, and reduces false locking caused by positioning drift, normal flushing, and network fluctuations. The water vending machine of this invention forms a closed-loop anti-hacking system on the equipment side through mutually separated water production and metering paths, independent cabinet door status and latch position feedback channels, and a controlled locking execution path. Attached Figure Description

[0026] Figure 1 This is a schematic diagram of the overall structure of the anti-hacking control system for water vending machines of the present invention.

[0027] Figure 2 This is a flowchart illustrating the overall process of the method for preventing hacking of water vending machines based on multi-source state verification according to the present invention.

[0028] Figure 3 This is a schematic diagram of the location verification process for the method of preventing hacking of water vending machines based on multi-source state verification according to the present invention.

[0029] Figure 4 This is a schematic diagram of the water balance determination based on a sliding time window in the method for preventing hacking of water vending machines based on multi-source state verification according to the present invention.

[0030] Figure 5 This is a schematic diagram of the cabinet door and electromagnetic lock linkage monitoring process of the method for preventing hacking of water vending machines based on multi-source state verification according to the present invention.

[0031] Figure 6 This is a schematic diagram of the heartbeat message verification and offline processing process of the method for preventing hacking of water vending machines based on multi-source state verification according to the present invention.

[0032] Figure 7This is a schematic diagram of the filter life management and authorized reset process of the method for preventing hacking of water vending machines based on multi-source state verification according to the present invention.

[0033] Figure 8 This is a schematic diagram illustrating the risk-level locking and recovery state transition of the method for preventing hacking of water vending machines based on multi-source state verification according to the present invention.

[0034] Figure label: 100 Water Vending Machine 110 Controller 111 Risk Assessment Unit 112 secure storage units 113 Reliable Timing Unit 120 Communication Components 130 Positioning Component 140 Water Metering Components 150 Water Metering Components 160 Cabinet Door Detection Components 161 Electromagnetic Lock 170 Filter Cartridge Identification Component 180 Locking Execution Component 181 Water outlet solenoid valve 182 Booster Pump Drive Circuit 183 Transaction Outflow Control Module 190 server Detailed Implementation

[0035] To more clearly describe the technical content of the present invention, the following description is provided in conjunction with specific embodiments. This invention discloses a method for preventing hacking of water vending machines based on multi-source state verification. The controller collects data on location, water production and dispensing volume, cabinet door status, server heartbeat, filter lifespan, and reset status. Within a valid time window, it generates events such as location deviation, water imbalance, cabinet door malfunction, communication anomaly, and filter maintenance anomaly. The risk level is determined based on the event duration, repetition frequency, confidence level, and correlation. An early warning is issued first, and when the machine locking conditions are met, the water outlet valve, water production actuator, or transaction water dispensing module is controlled to enter a restricted state. Evidence of the machine locking is saved and reported, and the machine is only unlocked after the anomaly is cleared, the device self-test is completed, and the authorization certificate is verified.

[0036] The present invention provides a method for preventing hacking of water vending machines based on multi-source state verification, comprising the following steps: Establish benchmark data that is linked to the device identification of the water vending machine. The benchmark data shall include at least the installation location benchmark, maintenance authorization data, and filter configuration data. Collect multi-source monitoring data to characterize the physical and operational status of the water vending machine. The multi-source monitoring data includes location data, water production and metering data, water intake and metering data, cabinet door status data, heartbeat communication data, and filter life and reset data. The multi-source monitoring data is time-aligned and validity is judged. Different data are grouped into a unified event timeline, and based on the valid multi-source monitoring data, location deviation events, water imbalance events, cabinet door abnormality events, communication abnormality events, and filter cartridge maintenance abnormality events are generated respectively. On the unified event timeline, the level of a single event is determined based on the duration, repetition frequency, and confidence level of each abnormal event. When at least two types of abnormal events exist simultaneously within a preset associated time window, the risk weight is increased to determine the equipment risk level. The equipment risk level includes at least a normal level, a warning level, a pre-lock level, a machine lock level, and a recovery verification level. The single event risk score Si for the i-th type of abnormal event is determined by the weighted sum of the baseline risk coefficient Wi of that type of event, the duration normalization, the repetition normalization, and the confidence level ci. When at least two types of abnormal events are valid simultaneously within the associated time window, the equipment risk score is corrected by the corresponding associated increment.

[0037] When the device risk level reaches the warning level, an early warning message is output. When the pre-lock level is reached, at least one of the following is restricted: single water intake, cumulative water intake, and number of transactions, or online server confirmation is required. When the machine lock level is reached, a machine lock command is sent to the water outlet solenoid valve and the transaction water outlet control module to close the water outlet solenoid valve and prohibit new transaction water outlets. At the same time, abnormal evidence data corresponding to the machine lock command is written to the anti-rollback storage area in an incremental sequence. After the abnormal conditions are eliminated, the system enters the recovery verification level, which verifies the one-time authorization unlock credential bound to the device identity, abnormal event number, random number and validity period, as well as the device self-test result. The device is unlocked only when the one-time authorization unlock credential is successfully verified and the device self-test result meets the recovery conditions.

[0038] The one-time authorization unlocking credential is generated by the server after confirming that the recovery conditions corresponding to this anomaly are met. It includes at least the device identification, anomaly event number, the range of devices that can be unlocked, a random number, issuance time, and validity period, and is digitally signed by the server or has an attached message authentication code. The controller also verifies the binding relationship between the credential and the current device and the current anomaly event, the range of devices that can be unlocked, the validity period, and that the random number has not been used. After successful verification, the random number is recorded as used.

[0039] The generation of the location deviation event includes: acquiring at least one of satellite positioning data, base station positioning data, wireless network positioning data, and geocoding data corresponding to the installation address; determining the confidence level of the current positioning data based on the positioning accuracy; calculating the distance between the current positioning location and the installation location reference; and generating the location deviation event when the confidence level reaches the effective positioning threshold, and the distance exceeds the location deviation threshold and continues for a preset positioning confirmation time or reaches a preset number of times within multiple sampling periods.

[0040] The confidence level is a weighted result of the positioning accuracy sub-score, the positioning source consistency sub-score, and the continuous effective sampling ratio, and is divided into low confidence, medium confidence, and high confidence levels according to a first confidence threshold and a second confidence threshold. Low confidence positioning data is only used for reference, medium confidence positioning data must meet the duration or preset number of confirmation conditions, and high confidence positioning data is used to generate a position deviation event or increase the level of the position deviation event when the distance exceeds the position deviation threshold.

[0041] The generation of the water imbalance event includes: within a sliding statistical time window, the water production volume Qp is accumulated by the water production metering component, the authorized water intake volume Qd is accumulated by the water intake metering component installed on the water outlet channel controlled by the transaction water outlet control module, the flushing drainage volume Qf is determined based on the flushing valve drive signal and flushing flow feedback, and the water storage change ΔVs is determined based on the water level, weight, pressure, or inlet / outlet water integral difference of the water storage unit; the water volume difference E is determined according to the following relationship: E = Qp - Qd - Qf - ΔVs; The water imbalance ratio R is determined according to R = E / max(Qp, Qmin), where Qmin is the minimum reference water production. When E is greater than the difference threshold Eth and R is greater than the ratio threshold Rth, and this condition is met for K consecutive sliding statistical time windows, the water imbalance event is generated.

[0042] Before generating the water imbalance event, the process also includes: identifying the water production start-up stage, filter flushing stage, water storage unit replenishment stage, meter calibration stage, and legal maintenance water discharge stage; compensating for, separately metering, or removing the water volume from the sliding statistical time window for each stage; including the corresponding water volume in the flushing drainage volume Qf only when the flushing valve drive signal and the corresponding flushing flow feedback are present simultaneously; and determining the dynamic tolerance band based on the calibration error of the water production metering component and the water intake metering component.

[0043] The generation of the cabinet door abnormal event includes: verifying the maintenance authorization certificate before the electromagnetic lock unlocks, and establishing an authorized maintenance time window with a start time and an end time after successful verification; generating the cabinet door abnormal event when it is detected that the cabinet door is opened without establishing the authorized maintenance time window, or when the cabinet door is still not closed after the authorized maintenance time window ends and reaches the door opening timeout threshold; the cabinet door status is detected by at least one of a door magnetic switch, a Hall sensor, a micro switch, and a bolt position sensor of the electromagnetic lock. When the cabinet door status, bolt status, and electromagnetic lock unlocking command are inconsistent, the cabinet door abnormal event is marked as a high-risk event.

[0044] The heartbeat communication data is formed by the heartbeat messages sent by the water vending machine to the server according to a preset period and the response messages returned by the server. The heartbeat message carries at least the device identification, incrementing sequence number, device time, operation summary, and message authentication data. The server carries a random number or instruction digest corresponding to the current session in the response message. The water vending machine writes the random number or instruction digest into the authentication calculation of the next heartbeat message so that adjacent heartbeat messages form a continuous session. When the number of consecutive failures to receive a valid response message reaches the retry threshold, or the interval between valid response messages exceeds the heartbeat timeout threshold, the communication abnormality event is generated.

[0045] After the communication anomaly event is generated, the system first enters an offline grace period. In the offline grace period, at least one of the following is restricted: single water intake, cumulative water intake, number of transactions, and offline duration. When the offline grace period is exhausted or when at least one of the following events occurs simultaneously: communication anomaly event, location deviation event, cabinet door anomaly event, and water imbalance event, the system is determined to have reached the lock level.

[0046] The generation of the filter cartridge maintenance anomaly event includes: determining the remaining lifespan of the filter cartridge based on at least two of the following: filter cartridge activation time, cumulative water production, raw water quality parameters, filtration pressure difference, and water production efficiency; outputting a replacement prompt when the remaining lifespan of the filter cartridge reaches the warning condition; establishing a maintenance reset period after the filter cartridge lifespan expires; and generating the filter cartridge maintenance anomaly event if an effective reset is not completed within the maintenance reset period. The filter cartridge maintenance anomaly event is also generated when it is detected that the filter cartridge lifespan value has been reset but no unused new filter cartridge identification is read, or when maintenance personnel credentials or one-time maintenance credentials are not verified.

[0047] The effective reset includes: reading the filter cartridge identification carried by the new filter cartridge; verifying that the filter cartridge identification has not been recorded as used by the water vending machine or the server; verifying the maintenance personnel certificate or the one-time maintenance certificate issued by the server; detecting the flushing process and water production parameters after replacing the filter cartridge; and updating the filter cartridge configuration data and filter cartridge life benchmark after the filter cartridge identification, the maintenance certificate and the water production parameters have all been verified.

[0048] The equipment risk levels include normal level, early warning level, pre-lock level, machine lock level, and recovery verification level. When a single low-confidence abnormal event is established, the equipment will switch from the normal level to the early warning level. When the same abnormal event continues for more than the corresponding confirmation time, the same abnormal event is repeated a certain number of times within a preset statistical period, at least two types of abnormal events exist simultaneously within the associated time window, or a single abnormal event with a high-risk indicator is established, the equipment will switch from the early warning level to the pre-lock level or from the pre-lock level to the machine lock level. Different entry and exit thresholds are set between each level.

[0049] For the i-th type of abnormal event, the risk score of a single event is calculated according to Si = Wi × [α × min(ti / Ti, 1) + β × min(ni / Ni, 1) + γ × ci]; where ti and ni are the duration and the number of repetitions within the preset statistical period of the abnormal event, respectively; Ti and Ni are the corresponding reference values ​​for duration and number of repetitions, respectively; ci is the confidence level between 0 and 1; Wi is the baseline risk coefficient; and α, β and γ are non-negative weights and α + β + γ = 1. The equipment risk score is calculated according to S = min[Smax, maxi(Si) + Σi<j(λij×Aij)], where Smax is the upper limit of the risk score. When the i-th type of abnormal event and the j-th type of abnormal event are both valid within the associated time window, Aij = 1, otherwise Aij = 0, and λij is the corresponding associated increment. The equipment risk score S is compared with the warning threshold P1, the pre-lock threshold P2 and the machine lock threshold P3 in sequence, and P1 < P2 < P3. The exit threshold of each level is lower than the corresponding entry threshold.

[0050] The locking mechanism includes at least one of the following: a water outlet solenoid valve, a water inlet solenoid valve, a booster pump drive circuit, and a transaction water outlet control module. When executing the locking command, it first terminates an authorized and ongoing single water withdrawal or terminates the water withdrawal according to safety stop conditions. Then, it closes the water outlet solenoid valve and prohibits new transaction water withdrawals, while retaining the safety functions required for pressure relief, drainage, fire-fighting water supply, or authorized maintenance. After executing the locking command, the controller, communication components, cabinet door detection components, and security storage unit remain powered to continue performing status monitoring, anomaly reporting, and anomaly evidence data storage.

[0051] The abnormal evidence data includes at least four of the following: abnormality type, device identification, occurrence time, original monitoring value, judgment threshold, device operating mode, cabinet door status, communication sequence number, and executed control action. The abnormal evidence data is written to the anti-rollback storage area in chronological order and forms integrity verification data through a message authentication code or digital signature. After communication is restored, the missing abnormal evidence data is re-transmitted according to the incrementing sequence number, and the server detects missing, duplicate, or rolled-back sequence numbers. The abnormal evidence data in the anti-rollback storage area is not deleted by a factory reset.

[0052] The anti-rollback storage area is a logical storage area located in the protected non-volatile memory of the secure storage unit. It consists of a monotonic counter, a record sequence number, a previous record summary, and current record integrity verification data. Only authorized append writes are allowed, and unauthorized overwriting is prohibited. The sequence number of the newly written record must not be less than the sealed monotonic count value. The protected non-volatile memory is at least one of the following: internal non-volatile memory of the secure chip, controller flash memory with read / write protection, or external secure memory.

[0053] A water vending machine includes a water purification component, a water dispensing component, a water storage unit, a controller, a positioning component, a water production metering component, a water dispensing metering component, a cabinet door detection component, an electromagnetic lock, a communication component, a filter cartridge identification component, and a lock-operating component. The water production metering component is disposed between the pure water outlet of the water purification component and the water storage unit, or at the inlet of the water storage unit. The water dispensing metering component is disposed on the water dispensing channel controlled by a transaction water dispensing control module. The cabinet door detection component outputs the cabinet door status to the controller, and the electromagnetic lock outputs latch position feedback to the controller. The controller is connected to the positioning component, the water production metering component, the water dispensing metering component, the cabinet door detection component, the electromagnetic lock, the communication component, the filter cartridge identification component, and the lock-operating component, and is configured to execute the water vending machine anti-hacking control method.

[0054] The water production metering component and the water intake metering component form two physically separate metering paths located upstream of the water storage unit and on the controlled water outlet channel, respectively. The cabinet door status output by the cabinet door detection component and the latch position feedback output by the electromagnetic lock form two independent anti-tamper detection channels. The lock actuator is electrically connected to at least the water outlet solenoid valve and the transaction water outlet control module. The controller locally performs correlation verification on the data of the two metering paths and the status of the two anti-tamper detection channels, and drives the lock actuator to cut off the controlled water outlet channel when the lock level is reached, so as to form a hardware closed loop of physical status acquisition, risk judgment and controlled lock.

[0055] The controller includes a secure storage unit, a trusted timing unit, and a risk determination unit. The secure storage unit stores device keys, installation location references, cumulative flow values, filter identification, and abnormal evidence data. The trusted timing unit maintains event sequence and time window counts when communication with the server is interrupted. The risk determination unit generates abnormal events locally, determines the device risk level, and drives the locking execution component.

[0056] The secure storage unit includes a protected non-volatile memory and a rollback-proof storage area therein, wherein the rollback-proof storage area maintains the sequential integrity of the abnormal evidence data through a monotonic counter and a previous record summary; the secure storage unit, the trusted timing unit, the cabinet door detection component, and the communication component are connected to a power supply branch that maintains power supply in the locked state.

[0057] A hacking prevention control system for water vending machines includes a server and at least one water vending machine. The server stores installation location references and maintenance authorization data bound to the device's identification identifier, receives heartbeat messages and abnormal evidence data from the water vending machine, sends response messages, risk handling instructions, or one-time authorization unlocking credentials to the water vending machine, and generates a server-side communication anomaly event when a valid heartbeat message is not received within the specified time. The server is also used to receive heartbeat summaries, transaction records, and abnormal evidence data from the network outage period in an incremental sequence after communication is restored, and to perform consistency verification on the cumulative water production value, cumulative water consumption value, filter cartridge identification identifier, and device time before and after the network outage.

[0058] The server generates the one-time authorization unlocking credential only after confirming that the recovery conditions corresponding to the abnormal event type are met. The one-time authorization unlocking credential includes the range of locks that can be unlocked, a random number, the issuance time, the validity period, and a one-time use mark. It is signed by the server's private key or generated as a message authentication code using a key shared by the server and the water vending machine. The server also maintains the issuance and usage status of the random number to reject credentials that are reused.

[0059] The purpose of this invention is to provide a method for preventing hacking of water vending machines based on multi-source status verification. This addresses the problems of incomplete identification of equipment relocation, bypass water intake, unauthorized cabinet opening, offline operation, and improper filter reset in existing technologies; susceptibility to misinterpretation of single detection signals; and lack of safety constraints during locking and unlocking processes. This invention also provides a water vending machine adapted to the above control method. Through the structural coordination of dual metering channels, dual anti-tamper detection channels, and a controlled locking execution channel, the multi-source verification results can directly affect the equipment's water circuit and the water dispensing path.

[0060] To achieve the above objectives, this invention provides a method for preventing hacking of water vending machines. During the installation and commissioning phase, the water vending machine establishes reference data bound to its device identity identifier. The device identity identifier can be a controller serial number, communication module identifier, security chip certificate, public key digest, or a combination of the above identifiers. The reference data includes at least the installation location reference, allowed location range, filter configuration, meter configuration, and maintenance authorization rules, and is stored separately by the water vending machine and the server.

[0061] The water vending machine includes a water production metering component and a water dispensing metering component respectively installed on the pure water outlet side of the water purification component and the water outlet channel controlled by the transaction, a cabinet door detection component and an electromagnetic lock respectively outputting feedback on the cabinet door status and the latch position, and a lock execution component driven by the controller; the above components constitute mutually independent data acquisition channels and control channels that directly act on the water circuit.

[0062] The water vending machine collects multi-source monitoring data during operation. This multi-source monitoring data includes: positioning coordinates, positioning accuracy, and positioning source output by the positioning component; water production flow rate and cumulative water production output by the water production metering component; transaction water discharge flow rate and cumulative water dispensing output by the water dispensing metering component; door and latch status output by the cabinet door detection component and electromagnetic lock; heartbeat transmission, response, and retry status generated by the communication component; and filter cartridge activation time, cumulative processed water volume, filter cartridge identification, and reset records.

[0063] The controller appends a local timestamp and an incrementing sequence number to the monitoring data, and performs validity checks, de-jittering, time alignment, and operation mode marking. Operation modes include at least standby, water production, water trading, automatic flushing, water storage and replenishment, maintenance, and lockout. Only data matching the corresponding operation mode and meeting the sensor's validity conditions is considered for anomaly detection, preventing normal flushing, water replenishment upon startup, and legitimate maintenance from being identified as malicious activity.

[0064] The controller generates location deviation events, water imbalance events, cabinet door abnormality events, communication abnormality events, and filter cartridge maintenance abnormality events based on valid monitoring data. Each abnormal event can be configured with a warning threshold, a lock-up threshold, a confirmation time, a recovery threshold, and a associated time window. The warning threshold differs from the lock-up threshold, and a hysteresis is set between the entry and exit thresholds to reduce repeated switching of risk levels around the thresholds. The judgment results of the five types of abnormal events are categorized into a unified event timeline; when at least two types of abnormal events exist simultaneously within a preset associated time window, the risk weight of the corresponding events is increased to form a control chain that mutually corroborates multiple source states.

[0065] Specifically, the risk score of the i-th type of abnormal event can be expressed as Si = Wi × [α × min(ti / Ti, 1) + β × min(ni / Ni, 1) + γ × ci]. Where Wi represents the baseline risk coefficient of the i-th type of abnormal event, ti / Ti and ni / Ni represent the normalized duration and repetition count after upper limit truncation, respectively, and ci represents the confidence level determined by data validity and multi-source consistency. α, β, and γ are all not less than 0 and α + β + γ = 1. The equipment risk score can be expressed as S = min[Smax, maxi(Si) + Σi < j (λij × Aij)]; Aij is 1 when the i-th and j-th type of abnormal events are simultaneously valid within the associated time window, otherwise it is 0, λij is the associated increment of the event combination, and Smax is the upper limit of the score. By configuring three incremental thresholds P1, P2, and P3, the warning, pre-lock, and machine lock levels are determined respectively; the exit threshold for the same level is set lower than the entry threshold. Wi, Ti, Ni, λij, and threshold values ​​for each level are configured based on the equipment's waterway structure, metering accuracy, installation environment, and operational risk strategy, and are then issued after being signed by the server.

[0066] For location verification, the installation location reference can be obtained from the installation address registered by the installer in the server via geocoding, or it can be calculated by continuously collecting multiple valid positioning points from the water vending machine under authorized installation status. The reference data simultaneously stores the allowable radius, positioning source, positioning accuracy, and reference generation time. The controller or server only calculates the position deviation when the positioning accuracy meets the valid requirements for the current operation.

[0067] Let d be the ground distance between the valid positioning point and the installation location reference, and let D be the allowable position deviation threshold. d can be calculated using the spherical distance formula based on latitude and longitude. If d > D, but only a single positioning attempt is successful, record the event to be confirmed. If d > D for a duration exceeding Tloc, or is successful at least Mloc times out of Nloc valid samples, generate a position deviation event. When positioning accuracy is low, D can be increased or the confidence level of the event can be decreased. The confidence level can be increased when at least two results from satellite positioning, base station positioning, and wireless network positioning corroborate each other.

[0068] The location confidence score cloc can be expressed as cloc = η1 × qacc + η2 × qsrc + η3 × qcont, where qacc is the location accuracy sub-score obtained by normalizing the location accuracy radius to 0 to 1 according to the allowable accuracy range, qsrc is the location source consistency sub-score obtained based on whether the location difference between different location sources falls within the consistency tolerance range, and qcont is the ratio of the number of consecutive valid location samples to the total number of samples within the statistical period. η1, η2, and η3 are all not less than 0 and η1 + η2 + η3 = 1. Assuming 0 < C1 < C2 < 1, cloc < C1 represents low confidence, C1 ≤ cloc < C2 represents medium confidence, and cloc ≥ C2 represents high confidence. Low confidence results are only used for record keeping, medium confidence results are confirmed by duration or repetition count, and high confidence results still need to be met together with the condition d > D to generate a location deviation event.

[0069] In this invention, confidence level is a higher-level concept governing the credibility of anomaly events, used to evaluate the reliability of monitoring data and anomaly determination results. Location confidence level (cloc) is the specific parameter of this higher-level concept in location deviation events, specifically reflecting the reliability of the current location data. Therefore, in location deviation events, the event confidence level (ci) in the risk calculation formula is taken as the location confidence level (cloc); for other events such as water imbalance and cabinet door anomalies, ci adopts the confidence level parameter of the corresponding event.

[0070] For water volume verification, the water production volume Qp is accumulated by the water production metering component, and the water intake volume Qd authorized by the transaction is accumulated by the water intake metering component on the water intake channel controlled by the transaction water intake control module. The automatic flushing drainage volume Qf is determined based on the flushing valve drive signal and flushing flow feedback, and the water storage change ΔVs is determined based on the liquid level, weight, pressure, or inlet / outlet water integral difference of the water storage unit. The above data are included in the same sliding statistical time window W, and the water volume difference E is calculated. E = Qp - Qd - Qf - ΔVs.

[0071] When the water vending machine also discharges water for sampling, producing concentrated water, or performing maintenance, metering components can be installed separately, or the water volume can be compensated according to the corresponding operating mode and calibration coefficient. For water vending machines using reverse osmosis filtration components, Qp is preferably the net water volume entering the pure water storage unit or the pure water outlet main pipe; the reverse osmosis concentrated water volume is not included in Qp. ΔVs can be determined by changes in the liquid level, weight, pressure, or the integral difference between the inlet and outlet water in the storage unit.

[0072] The controller calculates the water imbalance ratio R = E / max(Qp, Qmin), where Qmin is the minimum reference water volume to prevent proportional amplification during low-flow stages. A water imbalance event is generated when E is greater than the difference threshold Eth and R is greater than the proportional threshold Rth, and this condition is met within K consecutive sliding statistical time windows. This dual-threshold determination can identify bypass water intake where the water production is significantly greater than the legal water intake, while also filtering out deviations caused by meter resolution and small amounts of residual water in the pipeline.

[0073] Water imbalance determination can be further cross-validated by combining pump running time, water level drop, outlet valve drive status, and transaction records. For example, if the water intake side detects continuous flow when the outlet valve does not receive an opening command, or if the water pump runs continuously but the server has no corresponding transaction record and the water storage volume does not increase, the water imbalance event can be marked as a high-confidence event.

[0074] For cabinet door verification, the cabinet door is equipped with a magnetic door switch, Hall sensor, micro switch, latch position sensor, or a combination of the above sensors, and the electromagnetic lock is driven by the controller. Before legitimate maintenance, maintenance personnel initiate unlocking using a near-field card, mobile terminal, dynamic password, or a one-time maintenance certificate issued by the server. After successful certificate verification, the controller activates the electromagnetic lock and establishes an authorized maintenance time window.

[0075] The authorized maintenance time window includes at least the start time, the allowed duration, and a maintenance task identifier. Within this time window, the controller still records cabinet door opening and closing, filter element removal and installation, flow rate changes, and the power-on status of the control board. A cabinet door abnormality event is generated if the cabinet door is opened without an authorized maintenance time window, the latch leaves the locked position without an unlock command, or the cabinet door fails to close after the authorized maintenance time window ends, reaching the door open timeout threshold. When the cabinet door status changes repeatedly within a preset debouncing time, continuous sampling is used for confirmation to eliminate contact jitter caused by vibration.

[0076] For communication verification, the water vending machine sends a heartbeat message to the server according to the heartbeat cycle Th. The heartbeat message includes at least several items from the following: device identification, incrementing sequence number, device time, risk level, cumulative water production, cumulative water dispensing, cabinet door status, filter status, and message authentication data. The message authentication data can be generated using a message authentication code based on a shared key or a digital signature based on the device's private key to prevent the heartbeat message from being forged or replayed.

[0077] After verifying the heartbeat message, the server returns a response message. This response message carries at least one of the following: the heartbeat sequence number, server time, random number, digest of the instruction to be executed, and server authentication data. The vending machine incorporates the random number or instruction digest from the response message into the authentication calculation of the next heartbeat message, ensuring a continuous session between adjacent heartbeat messages. The vending machine verifies whether the response message matches the current session. If the response times out, it retryes at preset intervals; if consecutive failures reach the required number of retries or the effective response interval exceeds the heartbeat timeout threshold, a communication anomaly event is generated. If the server does not receive a valid heartbeat within the server-side timeout period, it also generates a corresponding event and notifies the operations personnel.

[0078] To avoid immediate water outages due to short-term fluctuations in the public network, the water vending machine can enter an offline grace period when a communication anomaly occurs alone. In this offline grace period, the controller limits the single water dispensing volume, cumulative water dispensing volume, number of transactions, or offline duration according to locally stored authorization rules. Once the offline limit is exhausted, the machine enters a pre-lock or locked state. If any of the following events—communication anomaly, location deviation, cabinet door malfunction, or water imbalance—occurs simultaneously within the associated time window, the offline grace period can be skipped or shortened.

[0079] For filter cartridge maintenance verification, the controller determines the remaining lifespan of the filter cartridge based on at least two of the following: filter cartridge activation time, cumulative water production, total dissolved solids (TDS) of the raw water, pressure difference between upstream and downstream of the filter assembly, water production efficiency, or effluent water quality. When the remaining lifespan of the filter cartridge reaches the warning condition, a replacement prompt is sent to the machine and the server; after the filter cartridge lifespan expires, a maintenance reset period is established.

[0080] Filter cartridge reset is not completed directly by a single button. After maintenance personnel replace the filter cartridge, the controller reads the new filter cartridge's RFID tag, near-field communication tag, QR code, serial number storage chip, or other filter cartridge identification, and verifies that this identification has not been recorded as used; it also verifies the maintenance personnel's credentials or one-time maintenance certificate. The controller performs flushing and water production self-tests, updating the filter cartridge life reference after the flow rate, differential pressure, or water quality meets the corresponding conditions. If the above effective reset is not completed within the maintenance reset period, a filter cartridge maintenance anomaly event is generated. If the filter cartridge life value has been reset, but the controller does not read the identification of the unused new filter cartridge, or any of the maintenance certificate, flushing process, or water production parameters fails verification, the reset is judged as an invalid reset and a filter cartridge maintenance anomaly event is generated.

[0081] Risk assessment employs a hierarchical state machine. Equipment risk levels include at least normal, warning, pre-lock, locked, and recovery verification. A single low-confidence anomaly typically triggers a warning; the equipment enters a pre-lock or locked state when the same anomaly persists beyond the confirmation time, repeats a set number of times within a statistical period, two or more anomalies coexist within a related time window, or a high-risk single event is established. A high-risk single event can be unauthorized cabinet opening with an abnormal latch status, a hardware detection signal indicating that the metering path has been bypassed, equipment key verification failure, or rollback of abnormal evidence storage. The risk assessment unit continuously operates on five types of events: location deviation, water imbalance, cabinet door anomaly, communication anomaly, and filter maintenance anomaly, and performs the aforementioned associated judgments according to a unified event timeline.

[0082] When the equipment enters the warning state, the controller outputs warning information through the local display, audio-visual components, operating platform, or maintenance terminal, and increases the sampling frequency of relevant data. When entering the pre-lock state, it can limit the amount of water drawn at one time, prohibit new large transactions, or require online confirmation from the server. If the risk conditions have not disappeared within the pre-lock confirmation time, the controller sends a lock command.

[0083] The lockout execution components may include an outlet solenoid valve, an inlet solenoid valve, a booster pump drive circuit, a transaction water discharge control module, and a power distribution module. When locking the machine, it is preferable to close the outlet solenoid valve and prohibit new transaction water discharge; the decision to stop the booster pump and close the inlet valve depends on the equipment's water circuit structure. Authorized and ongoing water extraction can be stopped after reaching a single safe water volume, or the outlet valve can be immediately closed according to the water hammer control curve upon confirmation of a high-risk event.

[0084] Locking the machine does not equate to cutting off all power. The controller, communication components, cabinet door detection components, leak detection components, and secure storage unit remain powered to continue monitoring, reporting, and preserving evidence; functions required for pressure relief, drainage, fire-fighting water supply, or authorized maintenance can be retained. Different locking limits can be set for different risk types; for example, prohibiting water flow when the location is off-center, prohibiting water production and extraction when the filter cartridge expires, and limiting offline limits in case of communication abnormalities.

[0085] Each warning, pre-lock, locking, and unlocking generates abnormal evidence data. This abnormal evidence data includes the abnormality type, occurrence time, original monitoring value, judgment threshold, location reliability, operating mode, cabinet door and latch status, heartbeat sequence number, filter element identification summary, executed control actions, and results. The evidence data is written to the anti-rollback storage area in an incrementing sequence number, and a message authentication code or digital signature is generated. After communication is restored, any unuploaded data is re-uploaded according to the sequence number, and the server uses this to detect missing or duplicate records. Abnormal evidence data and its incrementing sequence number must not be cleared by restoring factory settings; if the server detects missing, duplicate, or rolled-back sequence numbers, it will use data integrity anomalies as a condition to prevent automatic unlocking.

[0086] The anti-rollback storage area is not a newly added independent mechanical structure, but rather a logically controlled area within the secure storage unit; its storage medium can be the non-volatile memory inside the secure chip, a protected flash memory partition of the controller, or an external secure memory. Each record, in addition to an incrementing sequence number, also stores a summary of the previous record, enabling multiple records to form a summary chain, which is then sealed with a message authentication code or digital signature; write operations only allow appending, and normal configuration resets only clear resettable configurations, without erasing the monotonic count value, record summary chain, or used credential random number.

[0087] Before unlocking the device, the risk assessment enters the recovery verification state. The controller confirms the recovery conditions corresponding to this anomaly, such as the position returning to the allowable range, the water volume difference returning to the recovery threshold, the cabinet door closing and the latch in place, the heartbeat recovering, and the filter cartridge effectively reset. Subsequently, it performs self-tests on at least one of the following: flow meter, valve, pump, water level, and communication link. The server generates a one-time authorization unlock credential based on the anomaly event, bound to the device identity, event number, random number, and validity period. After verifying the credential and self-test results, the controller unlocks the device and retains the unlock record.

[0088] One-time authorization unlock credentials are issued by the server only after verifying the recovery conditions and the range of devices to be unlocked. The credential payload also includes the issuance time, a one-time use flag, and an optional policy version number, and is signed by the server's private key or calculated using a message authentication code via a shared key between the server and the device. The controller sequentially verifies the signature or message authentication code, device identity binding, abnormal event binding, unlock range, validity period, and unused random number status; unlocking is rejected if any of these conditions are not met. After successful use of the credential, the random number and execution result are written to the anti-rollback storage area and reported to the server in subsequent heartbeats.

[0089] For locations lacking continuous public network connectivity, authorized maintenance terminals can generate offline unlocking credentials. These credentials are signed with the operator's private key and specify the device identity, executable actions, validity period, and number of uses. The controller performs limited unlocking when the trusted timing unit is functioning normally and the credential is unused; after communication is restored, the credential and execution result are retransmitted to the server.

[0090] In specific embodiments of the present invention, the following examples are provided: Example 1: System Structure and Basic Data Establishment like Figure 1As shown, the water vending machine 100 includes a controller 110, a communication component 120, a positioning component 130, a water metering component 140, a water dispensing metering component 150, a cabinet door detection component 160, an electromagnetic lock 161, a filter cartridge identification component 170, and a lock execution component 180. The controller 110 includes a risk assessment unit 111, a secure storage unit 112, and a reliable timing unit 113. The communication component 120 is connected to the server 190 via a mobile communication network, a wired network, or a wireless local area network.

[0091] The lock-up execution component 180 is electrically connected to at least the outlet solenoid valve 181 and the transaction outlet control module 183, and may be further connected to the inlet valve or the booster pump drive circuit 182. The secure storage unit 112, the reliable timing unit 113, the cabinet door detection component 160, and the communication component 120 are powered by a power branch that remains powered during the lock-up state, thereby continuing to perform status monitoring, time window counting, evidence preservation, and communication reporting even after the controlled outlet passage is cut off.

[0092] A water metering component 140 is installed between the pure water outlet of the water purification unit and the water storage unit to measure the actual amount of sellable water produced by the equipment. A water dispensing metering component 150 is installed on the water outlet channel controlled by the transaction water dispensing control module 183 to measure the amount of water dispensed and delivered to the user. In another configuration, the water metering component 140 can be installed at the inlet of the water storage unit, and the water dispensing metering component 150 can consist of two flow sensors connected in series with different measurement principles, so as to detect sensor removal or pulse spoofing through metering difference detection.

[0093] Therefore, the water metering component 140 measures the amount of sellable water entering the water storage unit, while the water metering component 150 measures the output amount authorized by the transaction and delivered by the controlled water outlet channel. Both are independent of each other in terms of water path location and metering object. The cabinet door status signal of the cabinet door detection component 160 and the latch position feedback of the electromagnetic lock 161 are connected to the controller 110 via independent input terminals. When either channel is short-circuited, disconnected, or the states of the two channels contradict each other, the risk judgment unit 111 can generate an anti-tampering anomaly without relying on a single door magnetic signal.

[0094] Installers scan the device's identification identifier and obtain the installation address using a maintenance terminal. Server 190 converts the installation address into latitude and longitude coordinates and performs median processing on the continuously collected valid location points to form the installation location reference P0. The permissible location range can be set as a circular area centered on P0, or it can be a polygonal area formed by multiple coordinate points, depending on the installation environment. The installation record includes the device identification identifier, P0, permissible range, on-site network characteristics, installation time, and a summary of the installer's credentials.

[0095] During initial installation, the water metering unit 140 and the water intake metering unit 150 are calibrated. The controller 110 stores the flow meter's pulse volume, permissible error, zero-flow noise, and minimum measurable flow rate. For equipment with a water storage tank, a correspondence between liquid level and storage volume is also established. The filter cartridge identification unit 170 reads the identification marks of each filter cartridge and stores the filter cartridge model, rated time, rated water treatment capacity, and first-use time.

[0096] The aforementioned baseline data is signed by server 190 and then sent to secure storage unit 112. Risk assessment unit 111 verifies the integrity of the baseline data each time it is powered on. When the baseline data verification fails, the cumulative traffic value is less than the sealed value, or the time displayed by trusted timing unit 113 rolls back, a data integrity exception event is generated, and the event cannot be cleared by restoring factory settings.

[0097] The rollback-proof storage area in the secure storage unit 112 is implemented using logical partitions, and is configured with at least a non-rollback monotonic counter, an append write record area, and a key protection area. During each write operation, the risk assessment unit 111 first reads the sealed monotonic counter value, uses a new sequence number greater than that counter value along with the previous record digest to generate the current record, then calculates the message authentication code or digital signature and atomically commits it. If, after a power outage and restart, the new sequence number is found to be less than the sealed value, the digest chain is broken, or the integrity verification fails, a data integrity anomaly event is generated.

[0098] Example 2: Multi-source event determination and graded locking like Figure 2 As shown, the controller 110 acquires multi-source monitoring data at a fixed sampling period, and performs validity judgment after attaching a unified timestamp to the data. The sampling period can vary depending on the data type; for example, a shorter period is used for cabinet door status, while a longer period is used for positioning and heartbeat. The risk judgment unit 111 categorizes different data into a unified event timeline.

[0099] Location verification, such as Figure 3 As shown. The positioning component 130 acquires positioning results at preset intervals. If the positioning accuracy radius is greater than the effective accuracy threshold, the result is only used as a reference and not directly used for locking the device. If multiple consecutive valid positioning results are outside the allowed position range, a position warning is first output and the positioning sampling frequency is increased; a position deviation event is generated after the deviation continues for more than the positioning confirmation time. If a power interruption followed by power-on, a significant change in the base station fingerprint, or an abnormal cabinet door is detected simultaneously, the position event can be directly upgraded to high confidence.

[0100] In a non-restrictive configuration, the first confidence threshold C1 can be set to 0.4, and the second confidence threshold C2 can be set to 0.7; the specific thresholds are configured according to the indoor and outdoor environment, the accuracy of the positioning module, and the number of available positioning sources. When two independent positioning sources corroborate each other within the consistency tolerance range, and the proportion of consecutive valid samples reaches the set value, the location result can be classified as high confidence; when the positioning sources conflict, the accuracy radius is too large, or the valid samples are discontinuous, the confidence level is reduced.

[0101] Water balance determination as follows Figure 4 As shown in the diagram. Using a non-limiting example, the risk assessment unit 111 establishes a 24-hour sliding time window, updating statistical results every 10 minutes; it converts pure water production, legal water intake, automatic flushing volume, and changes in stored water to the same volume unit. If the equipment's daily water production is 500 liters, legal water intake is 300 liters, automatic flushing and sampling drainage total 20 liters, and stored water increases by 10 liters, then E is 170 liters, and R is 34%. If the equipment is set to Eth = 50 liters and Rth = 15%, and three consecutive statistical results exceed the thresholds, a water imbalance event is generated. The above values ​​are for illustrative purposes only; actual thresholds are configured based on equipment throughput, stored water volume, metering accuracy, and operating mode.

[0102] When in automatic filter flushing mode, the flushing valve drive signal and flushing flow rate jointly confirm Qf; only when the valve is open and the corresponding flow rate is detected is it counted as a valid flush. If a flushing command is forged without corresponding valve position feedback, or if the bypass water intake is masked by flushing mode for an extended period, the risk assessment unit 111 will generate a water volume anomaly based on the upper limit of the flushing ratio and the duration of the anomaly.

[0103] Cabinet door monitoring, such as Figure 5 As shown. Under normal conditions, electromagnetic lock 161 is in the locked position. After server 190 verifies the maintenance work order and personnel identity, it sends a one-time maintenance certificate to water vending machine 100. After controller 110 verifies the certificate, it drives electromagnetic lock 161 and establishes an authorized maintenance time window of, for example, 30 minutes. If the cabinet door is opened for more than the first time limit, a local prompt is made and a warning is sent to the server; if it is not closed after the second time limit, it enters pre-locking. If the door magnet shows open without an unlocking command, and the bolt still shows locked or there is a positional contradiction, it is determined that there is a possibility of prying, sensor bypass, or circuit damage, and a high-risk cabinet door abnormality event is generated.

[0104] Heartbeat verification Figure 6As shown. The water vending machine 100 sends an authenticated heartbeat message every Th. The server 190 returns a response message containing the current sequence number and a random number. The controller 110 writes the random number into the authentication calculation for the next heartbeat, creating a continuous session between adjacent messages. After three consecutive timeouts, a communication warning is output, and the machine enters an offline grace period. The offline grace period, for example, allows authorized water dispensing but limits subsequent cumulative water dispensing. If communication is not restored after the grace period, the machine is locked. The actual number of retries, grace period, and offline limit are set by the operator based on network conditions.

[0105] Filter management such as Figure 7 As shown. When the remaining lifespan of the filter cartridge is below the warning threshold, the local display and server 190 prompt for maintenance; the maintenance reset period begins to be calculated when the remaining lifespan is zero. After authorized opening of the cabinet, maintenance personnel remove the old filter cartridge and install the new one. The filter cartridge identification component 170 reads the new identifier, and the server 190 confirms that the identifier has not been used in other devices. The controller 110 performs the prescribed flushing volume and detects the water production flow rate, filtration pressure differential, or effluent water quality; the lifespan is reset only after all conditions are met. If the maintenance reset period expires and an effective reset is not completed, or if the old filter cartridge identifier is reused, a filter cartridge maintenance abnormality event is generated.

[0106] like Figure 8 As shown, the risk assessment unit 111 drives state transitions based on event level. In the normal state, it transitions to an early warning state when a single low-confidence event occurs; it returns to the normal state when the event disappears and the exit threshold is met. In the pre-lock state, it transitions to a pre-lock state when the event is continuous, recurring, or associated with another type of event. In the pre-lock state, the sampling frequency is increased and online confirmation is requested from the server; after the locking conditions are met, it transitions to the locking state.

[0107] Examples of correlation determination include: if a device experiences a communication anomaly first, and then its location deviates within the associated time window, it indicates that the device may have been moved and intentionally disconnected from the network; another example is if the difference between the water production and legal water intake rapidly increases after the cabinet door is opened without authorization, indicating the possible existence of a bypass pipeline; yet another example is if the cabinet door opens after the filter cartridge expires, but the identity of the new filter cartridge is not read, and subsequently the filter cartridge lifespan value is reset, indicating a possible unauthorized reset. These correlated events can use a higher risk weight than single events.

[0108] When controller 110 enters the locked state, the water supply control module 183 rejects new water intake authorization, the water supply solenoid valve 181 closes, and the booster pump drive circuit 182 stops the booster pump according to the water storage pressure and pipeline status. The valve can be closed in stages to reduce water hammer. Controller 110 maintains communication, cabinet door status monitoring, and leak detection functions, and periodically reports the reason for the locked state and its current status.

[0109] Example 3: Local Protection under Network Disconnection Conditions When the public network connection between the device and server 190 is interrupted, the trusted timing unit 113 continues to maintain the heartbeat timeout, maintenance time window, and filter cartridge reset period. The secure storage unit 112 stores the most recently confirmed offline policy from the server, which includes allowed offline time, allowed number of offline transactions, allowed cumulative offline water consumption, and prohibited offline maintenance operations.

[0110] Even in offline grace mode, the device still generates events based on local location, water volume, cabinet door status, and filter cartridge status. If only communication is abnormal and other statuses are normal, limited service is provided within the limit. If unauthorized cabinet opening, location deviation, or high-confidence water volume imbalance occurs simultaneously, the device is locked locally without waiting for server instructions. This prevents attackers from blocking the communication link to prevent the server from issuing locking commands.

[0111] After communication is restored, the water vending machine 100 first completes two-way authentication, and then retransmits the heartbeat summary, transaction records, and abnormal evidence from the period of network outage according to the incrementing sequence number. The server 190 compares the cumulative water production value, cumulative water dispensing value, filter cartridge identity, and trusted time before and after the network outage. If it finds that the cumulative value has rolled back, the sequence number is broken, or the same filter cartridge identifier is duplicated, the machine will not be automatically unlocked.

[0112] Example 4: Maintenance, Reset, and Unlocking Maintenance work orders are generated by server 190 and are bound to device identity, maintenance item, maintenance personnel, allowed start time, and allowed duration. Maintenance credentials can only perform the actions listed in the work order. For example, a credential that only allows filter replacement cannot modify the installation location reference or flow meter calibration parameters; a credential for reinstalling the equipment can update the location reference during the installation confirmation step, but the original reference and change record must be retained.

[0113] After the cabinet door is closed, controller 110 checks the consistency of the door magnetic state and the latch state, confirming that the electromagnetic lock 161 is re-locked; then it checks the flow meter connection, valve feedback, filter element identification, and control board tamper input. If the door is not locked by the end of the maintenance time window, it first prompts the maintenance terminal, and then enters the warning or lock state depending on the degree of timeout.

[0114] When the lock is released, server 190 issues recovery conditions based on the type of anomaly. For example, if the lock is due to a position deviation, the device is required to return to the allowed position range and obtain multiple valid positioning results consecutively; if the lock is due to a water imbalance, the pipeline and flow meter must be checked and quantitative water discharge calibration must be completed; if the lock is due to a cabinet door anomaly, the cabinet door must be closed, the latch must be in place, and maintenance records must be closed-loop; if the lock is due to a communication anomaly, two-way authentication and offline data retransmission must be completed; if the lock is due to a filter cartridge maintenance anomaly, new filter cartridge verification and water production self-test must be completed.

[0115] Once the above conditions are met, server 190 generates a one-time authorization unlock credential. The unlock credential includes the device identifier, abnormal event number, allowed unlock range, validity period, and a random number, and is signed by the server. Controller 110 verifies the signature, validity period, and event number, and performs a short-term trial run. During the trial run, the outlet solenoid valve 181 remains under control. Once the water production, intake, pressure, and water quality meet the recovery conditions, the device returns to normal operation; if the trial run fails, it returns to the locked state and records the reason for the failure.

[0116] Server 190 records the issuance, validity, and usage status of the credential random number; controller 110 maintains a set of used random numbers or a corresponding monotonic usage count in protected storage. A credential becomes invalid after being successfully used once. If it is submitted repeatedly, expires, the device identity does not match, the exception event number does not match, the requested unlocking scope exceeds the credential's allowed range, or the signature and message authentication code verification fails, controller 110 refuses to execute and generates evidence of credential anomalies. For offline unlocking credentials, the device identity, action scope, validity period, and number of uses are also limited, and the credentials are signed with the operator's private key.

[0117] Example 5: Scope of Application and Alternative Methods The water vending machines in this invention are not limited to community coin-operated or QR code-operated water vending machines, but also include commercial water purifiers, direct drinking water stations, school drinking water equipment, and self-service water replenishment equipment with functions such as water metering, account authorization, remote operation, or filter life management. Transaction authorization can come from QR code payment, RFID cards, account balance, tiered water allocation, or other legal water dispensing instructions.

[0118] The positioning component 130 can be integrated into the communication component 120, or an external satellite positioning module can be used. For indoor devices, authorized wireless access point fingerprints, Bluetooth beacons, base station information, or wired network node identifiers can be used to assist in positioning. The location reference can be composed of coordinates, address codes, and on-site network characteristics.

[0119] Water production and intake can be obtained through pulse flow meters, ultrasonic flow meters, weighing sensors, changes in water storage level, or pump displacement models. For equipment where the flushing drainage volume cannot be directly measured, Qf can be estimated based on the flushing valve opening time and the calibrated flushing flow rate, but an upper limit should be set for the estimation and it should be calibrated regularly.

[0120] The electromagnetic lock 161 can be a power-off locking type, a power-on locking type, or a lock with a mechanical emergency opening mechanism. Regardless of the type of lock used, the controller 110 records the unlocking command, bolt feedback, and cabinet door status. When the emergency opening mechanism is activated, it may constitute a high-risk event on its own, but it should not impede personnel safety or legally required emergency operations.

[0121] Risk levels can be implemented using state machines, rule tables, or risk scores. When using risk scores, each abnormal event is weighted according to its confidence level, duration, and correlation. Different risk score ranges correspond to early warning, pre-lock, and machine lockout, respectively. The calculation method used does not affect the basic technical concept of multi-source state verification, tiered handling, and authorized recovery.

[0122] The present invention has at least the following beneficial effects: First, by unifying equipment location, water intake and expenditure, cabinet door status, communication heartbeat, and filter maintenance status into a single risk status machine, it can cover various circumvention methods such as equipment relocation, bypass water intake, unauthorized cabinet opening, offline operation, and false filter reset; different events can corroborate each other, improving the reliability of identification.

[0123] Second, water volume verification incorporates flushing water volume, water storage changes, operating modes, and metering tolerances; positioning verification incorporates accuracy and duration; and communication anomalies are set with retry and offline grace periods. These features can reduce false alarms and machine lockouts caused by normal flushing, water storage replenishment, positioning drift, and short-term network fluctuations.

[0124] Third, the unlocking record of the electromagnetic lock is linked with the cabinet door opening and closing time window, filter element identity, and maintenance certificate, so that legitimate maintenance and illegal cabinet opening can be distinguished; filter element reset requires the new filter element identity, maintenance authorization, and operation self-test to be satisfied together, which is difficult to bypass by a single button or parameter modification.

[0125] Fourth, the lock adopts a graded and controlled approach, retaining monitoring, communication, pressure relief, and evidence storage functions; recovery requires anomaly elimination, self-test passing, and successful verification of a one-time authorization certificate, which can avoid bypassing the lock by simply cutting off power, restoring factory settings, or rolling back data.

[0126] Fifth, the separation of the water metering path and the authorized water intake metering path on the water path, the independent acquisition of cabinet door status and latch feedback, and the direct control of the controlled water outlet channel by the lock execution component enable the water vending machine to form a closed-loop structure consisting of physical quantity acquisition, local correlation determination, execution feedback, and evidence sealing. This structure can continue to complete local protection when communication is interrupted and improve the ability to identify metering bypass, door prying, and control line tampering.

[0127] For the specific implementation scheme of this embodiment, please refer to the relevant descriptions in the above embodiments, which will not be repeated here.

[0128] It is understood that the same or similar parts in the above embodiments can be referred to each other, and the contents not described in detail in some embodiments can be referred to the same or similar contents in other embodiments.

[0129] It should be noted that in the description of this invention, the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance. Furthermore, in the description of this invention, unless otherwise stated, "a plurality of" means at least two.

[0130] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as will be understood by those skilled in the art to which embodiments of the invention pertain.

[0131] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution device. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0132] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The corresponding program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiments.

[0133] Furthermore, the functional units in the various embodiments of the present invention can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0134] The storage media mentioned above can be read-only memory, disk, or optical disk, etc.

[0135] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0136] The present invention employs a method, a water vending machine, a water vending machine anti-hacking control system based on multi-source state verification, and a computer-readable storage medium thereof. This method can identify equipment relocation, bypass water intake, unauthorized cabinet opening, offline operation, and improper filter cartridge reset, and reduces false locking caused by positioning drift, normal flushing, and network fluctuations. The water vending machine of this invention forms a closed-loop anti-hacking system on the equipment side through mutually separated water production and metering paths, independent cabinet door status and latch position feedback channels, and a controlled locking execution path.

[0137] In this specification, the invention has been described with reference to specific embodiments thereof. However, it will be apparent that various modifications and variations can be made without departing from the spirit and scope of the invention. Therefore, the specification and drawings should be considered illustrative rather than restrictive.

Claims

1. A method for preventing hacking of water vending machines based on multi-source state verification, characterized in that, The method includes the following steps: (1) Establish reference data that is bound to the equipment identification of the water vending machine, wherein the reference data includes at least the installation location reference, maintenance authorization data and filter configuration data; (2) Collect multi-source monitoring data to characterize the physical and operational status of the water vending machine. The multi-source monitoring data includes positioning data, water production metering data, water intake metering data, cabinet door status data, heartbeat communication data, and filter life and reset data. (3) Perform time alignment and validity judgment on the multi-source monitoring data, classify different data into a unified event timeline, and generate location deviation event, water imbalance event, cabinet door abnormality event, communication abnormality event and filter maintenance abnormality event based on the valid multi-source monitoring data. (4) On the unified event timeline, the level of a single event is determined based on the duration, number of repetitions and confidence level of each abnormal event, and the risk weight is increased when at least two types of abnormal events exist simultaneously within a preset associated time window, so as to determine the risk level of the equipment. (5) When the risk level of the equipment reaches the warning level, output the warning information. When the pre-lock level is reached, restrict at least one of the single water intake, cumulative water intake, and number of transactions or require the server to confirm online. When the machine lock level is reached, send the machine lock command to the water outlet solenoid valve and the transaction water outlet control module to close the water outlet solenoid valve and prohibit new transaction water outlet. At the same time, write the abnormal evidence data corresponding to the machine lock command into the anti-rollback storage area in incrementing order. (6) After the abnormal conditions are eliminated, the recovery verification level is entered. The one-time authorization unlocking certificate bound to the device identity, abnormal event number, random number and validity period and the device self-test result are verified. The locked state is released only when the one-time authorization unlocking certificate is successfully verified and the device self-test result meets the recovery conditions.

2. The method for preventing hacking of water vending machines based on multi-source state verification according to claim 1, characterized in that, The validity assessment of the multi-source monitoring data in step (3) includes the following steps: Each monitoring data point is appended with a local timestamp and an incrementing sequence number, and then subjected to de-jittering and time alignment. The validity of the monitoring data is determined based on the operating mode of the water vending machine. The operating modes include at least standby mode, water production mode, transaction water dispensing mode, automatic flushing mode, water storage and replenishment mode, maintenance mode, and lock mode. Only data that matches the corresponding operating mode and meets the sensor's validity conditions are included in the unified event timeline and used to generate abnormal events.

3. The method for preventing hacking of water vending machines based on multi-source state verification according to claim 1, characterized in that, The generation of the position deviation event in step (3) specifically includes the following steps: Acquire at least one of the following: satellite positioning data, base station positioning data, wireless network positioning data, and geocoding data corresponding to the installation address; Determine the confidence level of the positioning data based on the positioning accuracy; Calculate the distance between the current location and the installation location reference; when the confidence level reaches the effective location threshold, and the distance exceeds the location deviation threshold and continues for a preset location confirmation time or reaches a preset number of times within multiple sampling periods, generate the location deviation event; The confidence level is a weighted result of the positioning accuracy sub-score, the positioning source consistency sub-score, and the continuous effective sampling ratio, and is divided into low confidence, medium confidence, and high confidence levels according to a first confidence threshold and a second confidence threshold. Low confidence positioning data is only used for reference, medium confidence positioning data must meet the duration or preset number of confirmation conditions, and high confidence positioning data is used to generate a position deviation event or increase the level of the position deviation event when the distance exceeds the position deviation threshold.

4. The method for preventing hacking of water vending machines based on multi-source state verification according to claim 1, characterized in that, The generation of water imbalance events in step (3) specifically includes: accumulating water production Qp, water intake Qd, flushing drainage Qf, and water storage change ΔVs within a sliding statistical time window; identifying the water production start-up stage, filter flushing stage, water storage unit replenishment stage, meter calibration stage, and legal maintenance drainage stage before generating the water imbalance event; compensating for, separately metering, or removing the water volume from the sliding statistical time window for the corresponding stage; including the corresponding water volume in the flushing drainage Qf only when the flushing valve drive signal and the corresponding flushing flow feedback are present simultaneously; determining the dynamic tolerance band based on the calibration error of the water production metering component and the water intake metering component; and marking the water imbalance event as a high-confidence event when the transaction outlet valve does not receive an opening command but the water intake side detects a continuous flow, or when the water production pump continues to run and there is no corresponding transaction record and the water storage volume does not increase.

5. The method for preventing hacking of water vending machines based on multi-source state verification according to claim 1, characterized in that, The generation of cabinet door abnormality events in step (3) specifically includes the following steps: Before unlocking the electromagnetic lock, the maintenance authorization certificate is verified, and an authorized maintenance time window with a start time and an end time is established after successful verification. When the cabinet door is detected to be opened without the establishment of the authorized maintenance time window, or when the cabinet door is not closed after the authorized maintenance time window ends and the door opening timeout threshold is reached, the cabinet door abnormal event is generated. The cabinet door status is detected by at least one of the following: door magnetic switch, Hall sensor, micro switch, and the bolt position sensor of the electromagnetic lock. When the cabinet door status, bolt status, and electromagnetic lock unlocking command are inconsistent, the cabinet door abnormal event is marked as a high-risk event. When the cabinet door status changes repeatedly within a preset debouncing time, the cabinet door status is confirmed by repeatedly sampling until consistent results are obtained.

6. The method for preventing hacking of water vending machines based on multi-source state verification according to claim 1, characterized in that, The heartbeat communication data is formed by the heartbeat messages sent by the water vending machine to the server according to a preset period and the response messages returned by the server; the heartbeat messages carry at least the device identification, incrementing sequence number, device time, operation summary and message authentication data; The server carries a random number or instruction digest corresponding to the current session in the response message; the water vending machine writes the random number or instruction digest into the authentication calculation of the next heartbeat message so that adjacent heartbeat messages form a continuous session; The communication anomaly event is generated when the number of consecutive unreceived valid response messages reaches the retry threshold, or when the interval between valid response messages exceeds the heartbeat timeout threshold. The method further includes the following steps: After the communication anomaly event is generated, the system first enters an offline grace period. In the offline grace period, at least one of the following is restricted: single water intake, cumulative water intake, number of transactions, and offline duration. When the offline grace period is exhausted, or when at least one of the following events occurs simultaneously: communication anomaly event, location deviation event, cabinet door anomaly event, and water imbalance event, the system is determined to have reached the lock level.

7. The method for preventing hacking of water vending machines based on multi-source state verification according to claim 1, characterized in that, The step (3) mentioned above generates a filter element maintenance abnormal event, specifically including the following steps: The remaining lifespan of the filter cartridge is determined based on at least two of the following: filter cartridge activation time, cumulative water production, raw water quality parameters, filtration pressure difference, and water production efficiency; a replacement prompt is output when the remaining lifespan of the filter cartridge reaches the warning condition; a maintenance reset period is established after the filter cartridge lifespan expires; if an effective reset is not completed within the maintenance reset period, a filter cartridge maintenance anomaly event is generated; a filter cartridge maintenance anomaly event is also generated when it is detected that the filter cartridge lifespan value has been reset but the identity of an unused new filter cartridge is not read, or the maintenance personnel certificate or one-time maintenance certificate is not verified. The effective reset specifically includes the following steps: Read the filter cartridge identification mark carried by the new filter cartridge; verify that the filter cartridge identification mark has not been recorded as used by the water vending machine or the server; verify the maintenance personnel certificate or the one-time maintenance certificate issued by the server; detect the flushing process and water production parameters after replacing the filter cartridge; after the filter cartridge identification mark, the maintenance certificate and the water production parameters are all verified, update the filter cartridge configuration data and the filter cartridge life benchmark.

8. The method for preventing hacking of water vending machines based on multi-source state verification according to claim 1, characterized in that, The equipment risk levels include normal level, early warning level, pre-lock level, machine lock level, and recovery verification level. When a single low-confidence abnormal event is established, the system switches from the normal level to the early warning level. When the same abnormal event continues for more than the corresponding confirmation time, the same abnormal event repeats to the corresponding number of times within a preset statistical period, at least two types of abnormal events exist simultaneously within the associated time window, or a single abnormal event with a high-risk indicator is established, the system switches from the early warning level to the pre-lock level, or from the early warning level or the pre-lock level to the machine lock level. Different entry and exit thresholds are set between each level, and the exit threshold of the same level is lower than the corresponding entry threshold. The single abnormal event with a high-risk identifier includes at least one of the following: unauthorized opening of the cabinet and abnormal latch status, hardware detection signal of metering path being bypassed, failure of device key verification, and rollback of abnormal evidence storage.

9. The method for preventing hacking of water vending machines based on multi-source state verification according to claim 1, characterized in that, Step (4) further includes the following steps: The single event risk score Si of the i-th type of abnormal event is calculated and determined by weighting the baseline risk coefficient Wi of the i-th type of abnormal event with the normalized duration, the normalized repetition frequency, and the confidence level ci; when at least two types of abnormal events are valid simultaneously within the associated time window, the equipment risk score is calculated and corrected with the corresponding associated increment.

10. The method for preventing hacking of water vending machines based on multi-source state verification according to claim 9, characterized in that, The calculation of the single event risk score Si in step (4) is specifically as follows: The risk score Si for a single event is calculated using the following formula: Si=Wi×[α×min (ti / Ti, 1) + β×min (ni / Ni, 1) + γ×ci]; Where ti and ni are the duration of the abnormal event and the number of repetitions within the preset statistical period, respectively; Ti and Ni are the corresponding reference values ​​for duration and number of repetitions, respectively; ci is the confidence level ranging from 0 to 1; Wi is the baseline risk coefficient; and α, β and γ are non-negative weights and α + β + γ = 1.

11. The method for anti-hacking control of water vending machines based on multi-source state verification according to claim 9, characterized in that, The calculation of the equipment risk score in step (4) is specifically as follows: Calculate the equipment risk score using the following formula: S=min[Smax, maxi(Si)+Σi<j(λij×Aij)] Where maxi(Si) is the maximum risk score of a single event among all categories, Σi<j represents the summation of all event combinations that satisfy the condition i<j, Aij=1 when the i-th type of abnormal event and the j-th type of abnormal event are simultaneously valid within the associated time window, otherwise Aij=0, λij is the corresponding associated increment; the equipment risk score S is compared with the early warning threshold P1, the pre-lock threshold P2 and the machine lock threshold P3 in sequence, where P1<P2<P3, and Smax is the upper limit of the risk score.

12. The method for preventing hacking of water vending machines based on multi-source state verification according to claim 1, characterized in that, The abnormal evidence data includes at least four of the following: abnormality type, device identification, occurrence time, original monitoring value, judgment threshold, device operating mode, cabinet door status, communication sequence number, and executed control action. The abnormal evidence data is written to the anti-rollback storage area in chronological order and forms integrity verification data through a message authentication code or digital signature. After communication is restored, the missing abnormal evidence data is re-transmitted according to the incrementing sequence number, and the server detects missing, duplicate, or rolled-back sequence numbers. The abnormal evidence data in the anti-rollback storage area is not deleted by restoring factory settings. The anti-rollback storage area is a logical storage area located in the protected non-volatile memory of the secure storage unit. It consists of a monotonic counter, a record number, a previous record summary, and current record integrity verification data. Only authorized append writes are allowed, and unauthorized overwriting is not permitted. The sequence number of the newly written record must not be less than the sealed monotonic counter value. The protected non-volatile memory is at least one of the following: internal non-volatile memory of the secure chip, controller flash memory with read / write protection, or external secure memory.

13. The method for preventing hacking of water vending machines based on multi-source state verification according to claim 1, characterized in that, If the aforementioned communication anomaly event and location deviation event occur simultaneously within the associated time window, it is determined that the device has been moved, the network is actively disconnected, and the risk level of the device is increased; when the cabinet door anomaly event and water imbalance event occur simultaneously within the associated time window, it is determined that there is bypass water intake and the risk level of the device is increased; when it is detected that the filter life value has been reset but no new filter identification is read, it is determined that there is an unauthorized filter reset and the risk level of the device is increased.

14. The method for preventing hacking of water vending machines based on multi-source state verification according to claim 1, characterized in that, The specific conditions for restoring the machine before unlocking are as follows: The device self-test includes at least one of the following conditions corresponding to the type of abnormal event: the position returns to the allowable position range, the water volume difference returns to the recovery threshold, the cabinet door is closed and the latch is in place, the heartbeat communication is restored, and the filter element is effectively reset; the device self-test includes performing self-tests on at least one of the flow meter, valve, pump, water storage unit level, and communication link; after verification, a short-term trial run is performed. During the trial run, the outlet solenoid valve remains under control. After the water production, water intake, pressure, and water quality meet the recovery conditions, the device returns to the normal level. If the trial run fails, the device returns to the lock level and the reason for the failure is recorded.

15. A water vending machine, characterized in that, The water vending machine includes a water purification component, a water dispensing component, a water storage unit, a controller, a positioning component, a water production and metering component, a water dispensing and metering component, a cabinet door detection component, an electromagnetic lock, a communication component, a filter cartridge identification component, and a lock-operating component. The water production and metering component is located between the pure water outlet of the water purification component and the water storage unit, or at the inlet of the water storage unit. The water dispensing and metering component is located on the water dispensing channel controlled by the transaction water dispensing control module. The cabinet door detection component outputs the cabinet door status to the controller, and the electromagnetic lock outputs feedback on the latch position to the controller. The controller is connected to the positioning component, water production and metering component, water dispensing and metering component, cabinet door detection component, electromagnetic lock, communication component, filter cartridge identification component, and lock-operating component, and is configured to execute the method for anti-hacking control of the water vending machine based on multi-source status verification as described in any one of claims 1 to 11. The water production metering component and the water intake metering component form two physically separate metering paths located upstream of the water storage unit and on the controlled water outlet channel, respectively. The cabinet door status output by the cabinet door detection component and the latch position feedback output by the electromagnetic lock form two independent anti-tamper detection channels. The lock actuator component is electrically connected to at least the water outlet solenoid valve and the transaction water outlet control module. The controller locally performs correlation verification on the data of the two metering paths and the status of the two anti-tamper detection channels, and drives the lock actuator component to cut off the controlled water outlet channel when the lock level is reached, so as to form a hardware closed loop of physical status acquisition, risk judgment and controlled lock. The controller includes a secure storage unit, a trusted timing unit, and a risk assessment unit; The secure storage unit is used to store device keys, installation location references, cumulative flow values, filter element identification, and abnormal evidence data. The trusted timing unit is used to maintain event sequence and time window count when communication with the server is interrupted; the risk determination unit is used to generate abnormal events locally, determine the device risk level, and drive the lock execution component. The secure storage unit includes a protected non-volatile memory and a rollback-proof storage area disposed therein. The rollback-proof storage area maintains the sequential integrity of the abnormal evidence data through a monotonic counter and the previous record summary. The secure storage unit, the trusted timing unit, the cabinet door detection component, and the communication component are connected to a power supply branch that maintains power supply in the locked state. The water metering component includes two flow sensors connected in series with different measurement principles; the cabinet door detection component includes at least one of a door magnetic switch, a Hall sensor, a micro switch, and a latch position sensor; the positioning component is integrated into the communication component, or is an external satellite positioning module, or uses an authorized wireless access point fingerprint, Bluetooth beacon, base station information, or wired network node identifier to assist in positioning; the water production volume measured by the water production metering component and the water intake volume measured by the water intake metering component are obtained through a pulse flow meter, an ultrasonic flow meter, a weighing sensor, the liquid level change of the water storage unit, or a pump displacement model; The locking mechanism includes at least one of a water outlet solenoid valve, a water inlet solenoid valve, a booster pump drive circuit, and a transaction water dispensing control module. When executing the locking command, the authorized and ongoing single water dispensing is first terminated or the water dispensing is terminated according to the safety stop conditions. Then, the water outlet solenoid valve is closed and new transaction water dispensing is prohibited, while retaining the safety functions required for pressure relief, drainage, fire-fighting water supply, or authorized maintenance. After executing the locking command, the water vending machine's controller, communication components, cabinet door detection components, and safety storage unit remain powered to continue performing status monitoring, anomaly reporting, and anomaly evidence data storage. Different risk types correspond to different locking ranges: position deviation events correspond to prohibiting transaction water dispensing; filter cartridge maintenance anomalies correspond to prohibiting water production and dispensing; and communication anomalies correspond to limiting offline water dispensing quotas.

16. A hacking prevention control system for a water vending machine, characterized in that, The system includes a server and at least one water vending machine as described in claim 15; The server is used to store installation location references and maintenance authorization data bound to the device identity, receive heartbeat messages and abnormal evidence data from the water vending machine, send response messages, risk handling instructions or one-time authorization unlocking certificates to the water vending machine, and generate a server-side communication abnormality event when a valid heartbeat message is not received on time. The server is also used to receive heartbeat summaries, transaction records and abnormal evidence data during the network outage according to an incremental sequence number after communication is restored, and to perform consistency verification on the cumulative water production value, cumulative water intake value, filter cartridge identification and equipment time before and after the network outage; The server generates the one-time authorization unlocking credential only after confirming that the recovery conditions corresponding to the abnormal event type are met. The one-time authorization unlocking credential includes the range of locks that can be unlocked, a random number, the issuance time, the validity period, and a one-time use mark. It is signed by the server's private key or generated as a message authentication code using a key shared by the server and the water vending machine. The server also maintains the issuance and usage status of the random number to reject credentials that are reused.

17. A computer-readable storage medium, characterized in that, It stores a computer program that can be executed by a processor to implement the steps of the method for preventing hacking of water vending machines based on multi-source state verification as described in any one of claims 1 to 14.

Images