Deployment method and device for security authorization of POS machine, and storage medium

Abstract

The present application is suitable for the technical field of POS machines, and provides a deployment method and device for security authorization of a POS machine, and a storage medium. The deployment method for security authorization of a POS machine is applied to a server side, and comprises: acquiring a server serial number hash value, preset server information and preset terminal whitelist information; determining a first verification result of a server on the basis of the server serial number hash value and the preset server information; if the first verification result satisfies a first preset condition, determining a second verification result of the preset terminal whitelist information on the basis of the preset server information and the preset terminal whitelist information; if the second verification result satisfies a second preset condition, receiving a terminal serial number transmitted by a client; and if the terminal serial number and the preset terminal whitelist information satisfy a third preset condition, granting the client a security permission. According to the present application, an authorization system can only be deployed on the correct server, illegitimate authorization of the authorization system can be avoided, and the authorization security of the POS machine is improved.

Description

POS machine security authorization deployment method, device and storage medium

[0001] This application claims priority to the Chinese patent application filed with the China Patent Office on July 14, 2023, with application number 202310868972.1 and entitled “A POS Machine Security Authorization Deployment Method, Device and Storage Medium”, the entire contents of which are incorporated herein by reference. Technical Field

[0002] The present application belongs to the field of POS machine technology, and in particular relates to a POS machine security authorization deployment method, device and storage medium. Background Art

[0003] With the widespread use of POS machines and the increasing maturity of electronic consumer settlement, fierce market competition has also brought numerous financial risks. Customers must obtain security permissions through an authorization system before disassembling and repairing their POS machines, performing system configuration, or performing other security-related modifications. While the authorization system can be deployed independently on a server, some customers may deploy it arbitrarily or use it to authorize POS machines that are not authorized. This can lead to illegal authorization and compromise the security of POS machine authorization.

[0004] Summary of the Invention

[0005] The embodiments of the present application provide a method, device and storage medium for deploying secure authorization for POS machines, which can solve the problem in the prior art that some customers may arbitrarily deploy the authorization system, or authorize POS machines that are originally not authorized through the authorization system, resulting in illegal authorization of the authorization system and affecting the security of POS machine authorization.

[0006] A first aspect of an embodiment of the present application provides a POS terminal security authorization deployment method, which is applied to a server side and includes:

[0007] Obtain the server serial number hash value, preset server information, and preset terminal whitelist information;

[0008] Determine a first verification result of the server based on the server serial number hash value and preset server information;

[0009] If the first verification result meets the first preset condition, determining a second verification result of the preset terminal whitelist information based on the preset server information and the preset terminal whitelist information;

[0010] If the second verification result satisfies the second preset condition, receiving the terminal serial number transmitted by the client;

[0011] If the terminal serial number and the preset terminal whitelist information meet the third preset condition, the client security permission is granted.

[0012] In one embodiment, the preset server information includes first preset customer information, a hash value of a preset server serial number, and first signature information, where the first signature information is information signed by the first preset customer information and the hash value of the preset server serial number based on a private key;

[0013] Determining a first verification result of the server based on the server serial number hash value and preset server information includes:

[0014] Determine a first signature verification result based on the public key and the first signature information;

[0015] Determine a first comparison result of the server based on the server serial number hash value and the preset server serial number hash value;

[0016] Determining a first verification result of the server based on the first signature verification result and the first comparison result;

[0017] The first preset condition is that the first signature verification result passes and the first comparison result is that the server serial number hash value is the same as the preset server serial number hash value.

[0018] In one embodiment, after determining the first verification result of the server based on the first signature verification result and the first comparison result, the method further includes:

[0019] If the first verification result meets the first preset condition, the first preset customer information is stored in the server.

[0020] In one embodiment, the preset terminal whitelist information includes the second preset customer information, the preset terminal serial number list, and the second signature information, where the second signature information is information signed by the second preset customer information and the preset terminal serial number list based on the private key;

[0021] If the first verification result satisfies the first preset condition, determining a second verification result of the preset terminal whitelist information based on the preset server information and the preset terminal whitelist information includes:

[0022] If the first verification result meets the first preset condition, determine the second signature verification result based on the public key and the second signature information;

[0023] Determining a second comparison result of the customer information based on the first preset customer information and the second preset customer information;

[0024] Determining a second verification result of the preset terminal whitelist information based on the second signature verification result and the second comparison result;

[0025] The second preset condition is that the second signature verification result passes and the second comparison result is that the first preset customer information and the second preset customer information are the same.

[0026] In one embodiment, after determining the second verification result of the preset terminal whitelist information based on the second signature verification result and the second comparison result, the method further includes:

[0027] If the second verification result meets the second preset condition, the preset terminal serial number list is stored in the server.

[0028] In one embodiment, if the terminal serial number and the preset terminal whitelist information meet the third preset condition, granting the client security permission includes:

[0029] Determining a third verification result of the terminal serial number based on a third comparison result between the terminal serial number and the preset terminal whitelist information;

[0030] If the third verification result meets the third preset condition, the client is granted security permission.

[0031] In one embodiment, determining a third verification result of the terminal serial number based on a third comparison result between the terminal serial number and the preset terminal whitelist information includes:

[0032] Determining a third verification result of the terminal serial number based on a third comparison result between the terminal serial number and the preset terminal serial number list;

[0033] The third preset condition is that the terminal serial number is included in a preset terminal serial number list.

[0034] A second aspect of the embodiments of the present application provides a POS terminal security authorization deployment method, which is applied to a client, including:

[0035] Send the terminal serial number to the server;

[0036] If the terminal serial number and the preset terminal whitelist information meet the third preset condition, obtain the security permission granted by the server.

[0037] A third aspect of the present application provides a POS terminal security authorization deployment device, which is applied to a server side and includes:

[0038] An information acquisition module is used to obtain the server serial number hash value, preset server information, and preset terminal whitelist information;

[0039] A first verification module, configured to determine a first verification result of the server based on a hash value of the server serial number and preset server information;

[0040] A second verification module is configured to determine a second verification result of the preset terminal whitelist information based on the preset server information and the preset terminal whitelist information if the first verification result satisfies the first preset condition;

[0041] A sequence receiving module, configured to receive a terminal serial number transmitted by the client if the second verification result satisfies a second preset condition;

[0042] The third verification module is used to grant the client security authority if the terminal serial number and the preset terminal whitelist information meet a third preset condition.

[0043] In one embodiment, the first verification module includes:

[0044] A first signature verification unit, configured to determine a first signature verification result based on the public key and the first signature information;

[0045] A first comparison unit, configured to determine a first comparison result of the server based on a hash value of the server serial number and a preset hash value of the server serial number;

[0046] The first verification unit is configured to determine a first verification result of the server based on the first signature verification result and the first comparison result.

[0047] In one embodiment, the POS terminal security authorization deployment device further includes:

[0048] The first storage module is configured to store the first preset customer information in the server if the first verification result satisfies the first preset condition.

[0049] In one embodiment, the second verification module includes:

[0050] A second signature verification unit, configured to determine a second signature verification result based on the public key and the second signature information if the first verification result satisfies the first preset condition;

[0051] a second comparing unit, configured to determine a second comparison result of the customer information based on the first preset customer information and the second preset customer information;

[0052] The second verification unit is configured to determine a second verification result of the preset terminal whitelist information based on the second signature verification result and the second comparison result.

[0053] In one embodiment, the POS terminal security authorization deployment device further includes:

[0054] The second storage module is configured to store the preset terminal serial number list in the server if the second verification result satisfies a second preset condition.

[0055] In one embodiment, the third verification module includes:

[0056] a third comparing unit, configured to determine a third verification result of the terminal serial number based on a third comparison result between the terminal serial number and the preset terminal whitelist information;

[0057] The permission granting unit is used to grant the client security permission if the third verification result meets the third preset condition.

[0058] In one embodiment, the third comparison unit is specifically configured to determine a third verification result of the terminal serial number based on a third comparison result between the terminal serial number and a preset terminal serial number list.

[0059] A fourth aspect of an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the POS machine security authorization deployment method described in the first aspect is implemented.

[0060] The first aspect of the embodiment of the present application provides a method for deploying secure authorization for POS machines. When the authorization system is deployed on the client's server, the server's serial number hash value is obtained, and the server serial number hash value is verified based on preset server information. This method can verify whether the server deployed by the authorization system is the correct server, so that the authorization system can only be deployed on the correct server. If the server verification is successful, the terminal serial number of the POS machine connected to the authorization system by the client is verified based on the preset terminal whitelist information that has passed the verification. If the terminal serial number verification is successful, the POS machine security permission is granted, which can ensure that the authorization system only authorizes POS machines that can be authorized, thereby strictly controlling the security of POS machine authorization and preventing the authorization system from unauthorized authorization.

[0061] It can be understood that the beneficial effects of the second, third and fourth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] In order to more clearly illustrate the specific implementation methods of the present application or the technical solutions in the prior art, the following will briefly introduce the drawings required for use in the specific implementation methods or the description of the prior art. Obviously, the drawings described below are some implementation methods of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0063] FIG1 is a schematic diagram of a first flow chart of a method for deploying secure authorization on a POS terminal according to an embodiment of the present application;

[0064] FIG2 is a schematic diagram of a second flow chart of a method for deploying secure authorization on a POS terminal according to an embodiment of the present application;

[0065] FIG3 is a schematic diagram of a third flow chart of a POS terminal security authorization deployment method provided in an embodiment of the present application;

[0066] FIG4 is a schematic diagram of a fourth flow chart of a method for deploying secure authorization of a POS terminal according to an embodiment of the present application;

[0067] FIG5 is a schematic diagram of the structure of a POS terminal security authorization deployment device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0068] In the following description, specific details such as specific system structures and techniques are provided for purposes of illustration rather than limitation to facilitate a thorough understanding of the embodiments of the present application. However, it will be apparent to those skilled in the art that the present application may be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to avoid obscuring the description of the present application with unnecessary detail.

[0069] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, integers, steps, operations, elements and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or collections thereof.

[0070] It will also be understood that the term "and / or" used in this specification and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0071] As used in this specification and the appended claims, the term "if" can be interpreted as "when" or "upon" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "upon determination" or "in response to determining" or "upon detection of [described condition or event]" or "in response to detecting [described condition or event]," depending on the context.

[0072] References to "one embodiment" or "some embodiments" in this specification mean that one or more embodiments of the present application include a particular feature, structure, or characteristic described in conjunction with that embodiment. Thus, phrases such as "in one embodiment," "in some embodiments," "in other embodiments," and "in other embodiments" appearing in various places in this specification do not necessarily refer to the same embodiment, but rather mean "one or more but not all embodiments," unless otherwise specifically emphasized. The terms "including," "comprising," "having," and variations thereof all mean "including but not limited to," unless otherwise specifically emphasized. "Multiple" means "two or more."

[0073] With the widespread use of POS machines and the increasing maturity of electronic consumer settlement, fierce market competition has also brought numerous financial risks. Customers must obtain security permissions through an authorization system before disassembling and repairing their POS machines, performing system configuration, or performing other security-related modifications. While the authorization system can be deployed independently on a server, some customers may deploy it arbitrarily or use it to authorize POS machines that are not authorized. This can lead to illegal authorization and compromise the security of POS machine authorization.

[0074] In response to the above problems, an embodiment of the present application provides a POS machine security authorization deployment method, which is applied to the server side. The method obtains a server serial number hash value, preset server information and preset terminal information, and determines a first verification result of the server based on the server serial number hash value and the preset server information. If the first verification result meets the first preset condition, the second verification result of the preset terminal information is determined based on the preset server information and the preset terminal information. If the second verification result meets the second preset condition, the terminal serial number transmitted by the client is received. If the terminal serial number and the preset terminal information meet the third preset condition, the client is granted security permissions. This allows the authorization system to be deployed only on the correct server, and ensures that the authorization system only authorizes POS machines that can be authorized, avoiding illegal authorization by the authorization system, and improving the security of POS machine authorization.

[0075] The following is an illustrative description of the POS terminal security authorization deployment method provided by this application in conjunction with specific embodiments.

[0076] As shown in FIG1 , the POS terminal security authorization deployment method provided in this embodiment is applied to the server side and includes:

[0077] S100: Obtain a server serial number hash value, preset server information, and preset terminal whitelist information.

[0078] In practice, when a customer's POS machine requires authorization for disassembly and repair, system configuration, or security-related modifications, the POS machine manufacturer first connects an encryption machine, also known as an authorization machine, to the customer's server, which can be a Windows-based server. The authorization system is then deployed on the customer's server. The customer then connects the POS machine to their terminal device, such as a computer, and uses the authorization tool on the terminal device to access the authorization system on the server via the internet. The authorization tool is a desktop tool that can be run by double-clicking the corresponding .exe file after unzipping it. The server and encryption machine constitute the server side, while the POS machine and terminal device constitute the client side.

[0079] In the application, to ensure that the authorization system is deployed on the correct server and that the authorization system is connected to a POS machine that can perform authorization, server verification and POS machine terminal serial number verification can be performed. When the authorization system is started, the server serial number hash value, preset server information, and preset terminal whitelist information are obtained. The server serial number hash value can be a hash value of the CPU serial number of the server deployed by the authorization system, the preset server information can be information about the server that the authorization system can deploy, that is, the correct server, and the preset terminal whitelist information can be information about the POS machines that the authorization system can authorize.

[0080] In the application, when deploying the authorization system, the above-mentioned preset server information and the above-mentioned preset terminal whitelist information can be deployed to the server in the form of files along with the authorization system, and specifically stored in a specified directory in the authorization system deployment file to facilitate subsequent verification of the server and terminal serial numbers.

[0081] S200: Determine a first verification result of the server based on a hash value of the server serial number and preset server information.

[0082] In an application, to ensure that the authorization system is deployed on the correct server, the server where the authorization system is deployed can be verified. Determining the first verification result of the server based on the server serial number hash value and the preset server information can be performed by verifying the server serial number hash value using the preset server information to determine the first verification result of the server.

[0083] In one embodiment, the preset server information includes first preset customer information, a preset server serial number hash value, and first signature information, and the first signature information is information obtained by signing the first preset customer information and the preset server serial number hash value based on a private key.

[0084] In the application, the above-mentioned preset server serial number hash value can be a hash value of the CPU serial number of the server that can be deployed by the authorization system after hashing. In order to prevent attackers from easily calculating relevant information, the server CPU serial number can be hashed. The above-mentioned first preset customer information can be the customer information of the server corresponding to the above-mentioned preset server serial number hash value, that is, the correct customer information that the authorization system can authorize. The above-mentioned first signature information can be the signature information obtained by signing the above-mentioned first preset customer information and the above-mentioned preset server serial number hash value using the private key of the POS machine manufacturer. The specific signing process is to first send the first preset customer information and the preset server serial number hash value to the terminal of the POS machine manufacturer. After the operator uses the private key in the encryption machine of the POS machine manufacturer to sign, the signature information is sent to the server for authorized deployment.

[0085] As shown in FIG2 , based on the server serial number hash value and the preset server information, determining the first verification result of the server includes:

[0086] S210: Determine a first signature verification result based on the public key and the first signature information.

[0087] In applications, to prevent the preset server information from being tampered with, the first signature information may be verified when the authorization system is activated. Determining the first signature verification result based on the public key and the first signature information may involve verifying the first signature information in the preset server information using the public key stored in the authorization system, thereby determining the first signature verification result. If the preset server information has been tampered with, the first signature verification result will fail. If the preset server information has not been tampered with, the first signature verification result will pass.

[0088] S220: Determine a first comparison result of the server based on the server serial number hash value and the preset server serial number hash value.

[0089] In the application, when the authorization system is started, in order to verify whether the server deployed by the authorization system is the correct server, after obtaining the above-mentioned server serial number hash value, the above-mentioned server serial number hash value can be verified through the above-mentioned preset server information. The above-mentioned determination of the first comparison result of the server based on the server serial number hash value and the preset server serial number hash value can be to compare the above-mentioned server serial number hash value with the above-mentioned preset server serial number hash value to determine the above-mentioned first comparison result. If the above-mentioned server serial number hash value and the above-mentioned preset server serial number hash value are the same, the above-mentioned first comparison result passes; if the above-mentioned server serial number hash value and the above-mentioned preset server serial number hash value are different, the above-mentioned first comparison result fails.

[0090] S230: Determine a first verification result of the server based on the first signature verification result and the first comparison result.

[0091] In the application, the first verification result of the server is determined based on the first signature verification result and the first comparison result. The first verification result of the server can be determined based on the first signature verification result of the first signature information and the first comparison result between the server serial number hash value and the preset server serial number hash value.

[0092] In one embodiment, the first preset condition is that both the first signature verification result and the first comparison result are passed, that is, the preset server information has not been tampered with, and the server serial number hash value is the same as the preset server serial number hash value.

[0093] In one embodiment, after determining the first verification result of the server based on the first signature verification result and the first comparison result, the method further includes: if the first verification result meets the first preset condition, storing the first preset customer information on the server.

[0094] In the application, if the first verification result satisfies the first preset condition, then the server deployed by the authorization system is the correct server and the server verification is successful. If the first verification result satisfies the first preset condition, the first preset client information is stored on the server. This may involve writing the first preset client information to a memory on the server after the server verification is successful, thereby configuring the server to indicate that the first preset client information is the correct client information.

[0095] S300: If the first verification result meets the first preset condition, determine a second verification result of the preset terminal whitelist information based on the preset server information and the preset terminal whitelist information.

[0096] In the application, if the first verification result satisfies the first preset condition, it indicates that the server deployed by the authorization system is the correct server. Once the server verification is successful, the terminal serial number of the POS machine connected to the authorization system can be verified. Before performing the terminal serial number verification, it is necessary to verify whether the preset terminal whitelist information is the correct customer's own preset terminal whitelist information. The second verification result of the preset terminal whitelist information determined based on the preset server information and the preset terminal whitelist information can be determined by verifying the preset terminal whitelist information with the first preset customer information in the preset server information, thereby determining the second verification result of the preset terminal whitelist information.

[0097] In one embodiment, the preset terminal whitelist information includes second preset customer information, a preset terminal serial number list and second signature information, and the second signature information is information obtained by signing the second preset customer information and the preset terminal serial number list based on a private key.

[0098] In the application, the above-mentioned preset terminal serial number list can be a list of terminal serial numbers of POS machines that can be authorized by the authorization system, and the above-mentioned second preset customer information can be the information of the customer of the POS machine corresponding to the above-mentioned preset terminal serial number list. The above-mentioned signing of the second preset customer information and the preset terminal serial number list based on the private key can be done by using the private key of the POS machine manufacturer to sign the hash value of the second preset customer information and the above-mentioned preset terminal serial number list. The specific signing process is to first send the second preset customer information and the preset terminal serial number list to the terminal of the POS machine manufacturer, and after the operator signs using the private key in the encryption machine of the POS machine manufacturer, send the signature information to the server for authorization deployment. The above-mentioned preset terminal whitelist information can be directly read into the server's memory when the authorization system is started to prevent other customers from maliciously tampering with the above-mentioned preset terminal whitelist information.

[0099] As shown in FIG3 , if the first verification result satisfies the first preset condition, a second verification result of the preset terminal whitelist information is determined based on the preset server information and the preset terminal whitelist information, including:

[0100] S310: If the first verification result meets the first preset condition, determine the second signature verification result based on the public key and the second signature information.

[0101] In applications, to prevent tampering with the preset terminal whitelist information, the second signature information may be verified when the authorization system is activated. Determining the second signature result based on the public key and the second signature information may involve verifying the second signature information in the preset terminal whitelist information using the public key stored in the authorization system, thereby determining the second signature result. If the preset terminal whitelist information has been tampered with, the second signature verification result will fail. If the preset terminal whitelist information has not been tampered with, the second signature verification result will pass.

[0102] S320: Determine a second comparison result of the customer information based on the first preset customer information and the second preset customer information.

[0103] In an application, before performing terminal serial number verification, in order to verify whether the preset terminal whitelist information is the correct client's own preset terminal whitelist information, the second preset client information in the preset terminal whitelist information can be verified using the first preset client information in the preset server information. Determining the second comparison result of the client information based on the first preset client information and the second preset client information can be performed by comparing the first preset client information with the second preset client information to determine the second comparison result of the client information. If the first preset client information and the second preset client information are the same, the second comparison result passes; if the first preset client information and the second preset client information are different, the second comparison result fails.

[0104] S330: Determine a second verification result of the preset terminal whitelist information based on the second signature verification result and the second comparison result.

[0105] In the application, the second verification result of the preset terminal information is determined based on the second signature verification result and the second comparison result. The second verification result of the preset terminal whitelist information can be determined based on the second signature verification result of the second signature information and the second comparison result of the first preset customer information and the second preset customer information.

[0106] In one embodiment, the second preset condition is that both the second signature verification result and the second comparison result are passed, that is, the preset terminal whitelist information has not been tampered with, and the first preset customer information and the second preset customer information are the same.

[0107] In one embodiment, after determining the second verification result of the preset terminal whitelist information based on the second signature verification result and the second comparison result, the method further includes: if the second verification result meets the second preset condition, storing the preset terminal serial number list on the server side.

[0108] In the application, since the first preset customer information has been determined to be the correct customer's information, if the second verification result satisfies the second preset condition, it means that the preset terminal whitelist information is the correct customer's own preset terminal whitelist information, and the preset terminal whitelist information verification is successful. If the second verification result satisfies the second preset condition, the preset terminal serial number list is stored on the server side. This can be done by writing the preset terminal serial number list in the preset terminal whitelist information to the server's memory after the preset terminal whitelist information verification is successful, so as to facilitate subsequent terminal serial number verification. By verifying the preset terminal whitelist information, the customer can only use his own preset terminal serial number list for terminal serial number verification, preventing the customer from maliciously using other customers' preset terminal serial number lists.

[0109] S400: If the second verification result meets the second preset condition, receive the terminal serial number transmitted by the client.

[0110] In the application, if the second verification result meets the second preset condition, it means that the preset terminal whitelist information is the correct client's own preset terminal information, and the preset terminal whitelist information verification is passed. At this time, the preset terminal serial number list in the preset terminal whitelist information can be used to verify the terminal serial number of the POS machine that the client accesses the authorization system. The terminal serial number can be the SN (Serial Number) of the POS machine.

[0111] S500: If the terminal serial number and the preset terminal whitelist information meet the third preset condition, grant the client security permission.

[0112] In the application, in order to ensure that the authorization system only authorizes POS machines that can be authorized, the terminal serial number of the POS machine used by the client to access the authorization system can be verified through the above-mentioned preset terminal whitelist information, and it can be determined whether the above-mentioned terminal serial number and the above-mentioned preset terminal whitelist information meet the third preset condition. If so, the client is granted security permission to access the POS machine of the authorization system.

[0113] As shown in FIG4 , if the terminal serial number and the preset terminal whitelist information meet the third preset condition, the client security permission is granted, including:

[0114] S510: Determine a third verification result of the terminal serial number based on a third comparison result between the terminal serial number and the preset terminal whitelist information.

[0115] In the application, the third comparison result based on the terminal serial number and the preset terminal whitelist information is used to determine the third verification result of the terminal serial number. The terminal serial number of the POS machine of the client accessing the authorization system is compared with the above-mentioned preset terminal whitelist information to obtain the above-mentioned third comparison result, and the third verification result of the terminal serial number is determined based on the above-mentioned third comparison result.

[0116] In one embodiment, the third verification result of the terminal serial number is determined based on the third comparison result between the terminal serial number and the preset terminal whitelist information, including: determining the third verification result of the terminal serial number based on the third comparison result between the terminal serial number and the preset terminal serial number list; the third preset condition is that the terminal serial number is included in the preset terminal serial number list.

[0117] In the application, the third comparison result based on the terminal serial number and the preset terminal serial number list is used to determine the third verification result of the terminal serial number. The terminal serial number of the POS machine for the client to access the authorization system can be compared with the preset terminal serial number list in the above-mentioned preset terminal whitelist information to obtain the above-mentioned third comparison result, and the third verification result of the terminal serial number is determined based on the above-mentioned third comparison result.

[0118] S520: If the third verification result meets the third preset condition, grant the client security permission.

[0119] In the application, if the third verification result satisfies the third preset condition, it indicates that the terminal serial number of the POS machine accessed by the client to the authorization system is included in the preset terminal serial number list, the POS machine accessed by the client to the authorization system is a POS machine that can be authorized, and the authorization system can grant security permissions to the POS machine. If the terminal serial number and the preset terminal whitelist information do not meet the third preset condition, it indicates that the terminal serial number of the POS machine accessed by the client to the authorization system is not included in the preset terminal serial number list, the POS machine accessed by the client to the authorization system is a POS machine that cannot be authorized, and the authorization system does not grant security permissions to the POS machine.

[0120] Specifically, in the POS authorization usage scenario, the authorization system can be a web system running on a Windows server. The administrator can deploy the authorization system on the customer's server and operate the authorization system through a browser. When the customer's POS machine needs to be authorized for security permissions, the customer can connect the POS machine to his or her own terminal device, such as a computer, and then use the authorization tool in the terminal device to access the authorization system through the Internet. When the authorization system is deployed on the customer's server, by obtaining the server's serial number hash value and verifying the server serial number hash value based on the preset server information, it can verify whether the server deployed by the authorization system is the correct server, so that the authorization system can only be deployed on the correct server. If the server verification passes, the terminal serial number of the customer's POS machine connected to the authorization system is verified based on the preset terminal whitelist information that has passed the verification. If the terminal serial number verification passes, the POS machine is granted security permissions, which can ensure that the authorization system only authorizes POS machines that can be authorized, thereby strictly controlling the security of POS machine authorization and preventing illegal authorization by the authorization system.

[0121] An embodiment of the present application also provides a POS machine security authorization deployment method, which is applied to a client, including: sending a terminal serial number to a server; if the terminal serial number and preset terminal whitelist information meet a third preset condition, obtaining security permissions granted by the server.

[0122] It should be noted that the above-mentioned POS machine security authorization deployment method applied to the client is based on the same concept as the above-mentioned POS machine security authorization deployment method applied to the server. Its specific functions and technical effects can be found in the embodiment of the above-mentioned POS machine security authorization deployment method applied to the server, and will not be repeated here.

[0123] The following is an exemplary description of the POS terminal security authorization deployment device provided in this application with reference to the accompanying drawings.

[0124] Corresponding to the POS machine security authorization deployment method described in the above embodiment, as shown in FIG5 , this embodiment provides a POS machine security authorization deployment device, which is applied to a server side. The POS machine security authorization deployment device 500 includes:

[0125] Information acquisition module 510, used to obtain the server serial number hash value, preset server information and preset terminal whitelist information;

[0126] A first verification module 520, configured to determine a first verification result of the server based on a hash value of the server serial number and preset server information;

[0127] The second verification module 530 is configured to determine a second verification result of the preset terminal whitelist information based on the preset server information and the preset terminal whitelist information if the first verification result satisfies the first preset condition;

[0128] The sequence receiving module 540 is configured to receive the terminal serial number transmitted by the client if the second verification result satisfies the second preset condition;

[0129] The third verification module 550 is configured to grant security authority to the client if the terminal serial number and the preset terminal whitelist information meet a third preset condition.

[0130] In one embodiment, the first verification module includes:

[0131] A first signature verification unit, configured to determine a first signature verification result based on the public key and the first signature information;

[0132] A first comparison unit, configured to determine a first comparison result of the server based on a hash value of the server serial number and a preset hash value of the server serial number;

[0133] The first verification unit is configured to determine a first verification result of the server based on the first signature verification result and the first comparison result.

[0134] In one embodiment, the POS terminal security authorization deployment device further includes:

[0135] The first storage module is configured to store the first preset customer information in the server if the first verification result satisfies the first preset condition.

[0136] In one embodiment, the second verification module includes:

[0137] A second signature verification unit, configured to determine a second signature verification result based on the public key and the second signature information if the first verification result satisfies the first preset condition;

[0138] a second comparing unit, configured to determine a second comparison result of the customer information based on the first preset customer information and the second preset customer information;

[0139] The second verification unit is configured to determine a second verification result of the preset terminal whitelist information based on the second signature verification result and the second comparison result.

[0140] In one embodiment, the POS terminal security authorization deployment device further includes:

[0141] The second storage module is configured to store the preset terminal serial number list in the server if the second verification result satisfies a second preset condition.

[0142] In one embodiment, the third verification module includes:

[0143] a third comparing unit, configured to determine a third verification result of the terminal serial number based on a third comparison result between the terminal serial number and the preset terminal whitelist information;

[0144] The permission granting unit is used to grant the client security permission if the third verification result meets the third preset condition.

[0145] In one embodiment, the third comparison unit is specifically configured to determine a third verification result of the terminal serial number based on a third comparison result between the terminal serial number and a preset terminal serial number list.

[0146] It should be noted that the information interaction, execution process, etc. between the above-mentioned modules / units are based on the same concept as the method embodiment of this application. Their specific functions and technical effects can be found in the method embodiment section and will not be repeated here.

[0147] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated into one processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0148] An embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments can be implemented.

[0149] The present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor, it can implement the steps of the above-mentioned various method embodiments. The computer program includes computer program code, which can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may at least include: any entity or device that can carry the computer program code to a terminal device, a recording medium, a computer memory, a read-only memory (ROM, Read-Only

[0150] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant description of other embodiments.

[0151] Those skilled in the art will appreciate that the devices and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0152] In the embodiments provided herein, it should be understood that the disclosed devices and methods may be implemented in other ways. For example, the device embodiments described above are merely illustrative. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interface, or the devices may be indirectly coupled or communicated in some manner, whether electrical, mechanical, or other.

[0153] The above-described embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present application, and should all be included in the scope of protection of the present application.

Claims

1. A method for deploying secure authorization of a POS terminal, wherein: Applied to the server side, including: Obtain the server serial number hash value, preset server information, and preset terminal whitelist information; Determine a first verification result of the server based on the server serial number hash value and the preset server information; If the first verification result satisfies a first preset condition, determining a second verification result of the preset terminal whitelist information based on the preset server information and the preset terminal whitelist information; If the second verification result satisfies the second preset condition, receiving the terminal serial number transmitted by the client; If the terminal serial number and the preset terminal whitelist information meet a third preset condition, the client security authority is granted.

2. The POS machine security authorization deployment method according to claim 1, wherein: The preset server information includes first preset customer information, a preset server serial number hash value, and first signature information, wherein the first signature information is information signed by the first preset customer information and the preset server serial number hash value based on a private key; The determining a first verification result of the server based on the server serial number hash value and the preset server information includes: Determine a first signature verification result based on the public key and the first signature information; Determine a first comparison result of the server based on the server serial number hash value and the preset server serial number hash value; Determining a first verification result of the server based on the first signature verification result and the first comparison result; The first preset condition is that the first signature verification result passes and the first comparison result is that the server serial number hash value is the same as the preset server serial number hash value.

3. The POS machine security authorization deployment method as claimed in claim 2, wherein: After determining the first verification result of the server based on the first signature verification result and the first comparison result, the method further includes: If the first verification result meets the first preset condition, the first preset customer information is stored in the server.

4. The POS machine security authorization deployment method as claimed in claim 2, wherein: The preset terminal whitelist information includes second preset customer information, a preset terminal serial number list, and second signature information, where the second signature information is information signed by the second preset customer information and the preset terminal serial number list based on a private key; if the first verification result satisfies the first preset condition, determining the second verification result of the preset terminal whitelist information based on the preset server information and the preset terminal whitelist information includes: If the first verification result meets the first preset condition, determine the second signature verification result based on the public key and the second signature information; Determining a second comparison result of the customer information based on the first preset customer information and the second preset customer information; Determining a second verification result of the preset terminal whitelist information based on the second signature verification result and the second comparison result; The second preset condition is that the second signature verification result passes and the second comparison result is that the first preset customer information and the second preset customer information are the same.

5. The POS machine security authorization deployment method according to claim 4, wherein: After determining the second verification result of the preset terminal whitelist information based on the second signature verification result and the second comparison result, the method further includes: If the second verification result meets the second preset condition, the preset terminal serial number list is stored in the server.

6. The POS machine security authorization deployment method as claimed in claim 4, wherein: If the terminal serial number and the preset terminal whitelist information meet the third preset condition, granting the client security authority includes: Based on a third comparison result between the terminal serial number and the preset terminal whitelist information, a third verification result of the terminal serial number is determined; if the third verification result meets the third preset condition, the client security authority is granted.

7. The POS machine security authorization deployment method according to claim 6, wherein: The determining, based on a third comparison result between the terminal serial number and the preset terminal whitelist information, a third verification result of the terminal serial number includes: Determining a third verification result of the terminal serial number based on a third comparison result between the terminal serial number and the preset terminal serial number list; The third preset condition is that the terminal serial number is included in the preset terminal serial number list.

8. A method for deploying secure authorization of a POS machine, wherein: Applied to the client, including: Send the terminal serial number to the server; If the terminal serial number and the preset terminal whitelist information meet the third preset condition, the security authority granted by the server is obtained.

9. A POS machine security authorization deployment device, wherein: Applied to the server side, including: An information acquisition module is used to obtain a server serial number hash value, preset server information, and preset terminal whitelist information; A first verification module, used to determine a first verification result of the server based on the server serial number hash value and the preset server information; A second verification module, configured to determine a second verification result of the preset terminal whitelist information based on the preset server information and the preset terminal whitelist information if the first verification result satisfies a first preset condition; A sequence receiving module, configured to receive a terminal sequence number transmitted by the client if the second verification result satisfies a second preset condition; The third verification module is used to grant the client security authority if the terminal serial number and the preset terminal whitelist information meet a third preset condition.

10. A computer-readable storage medium storing a computer program, wherein: When the computer program is executed by a processor, it realizes: Obtain the server serial number hash value, preset server information, and preset terminal whitelist information; Determine a first verification result of the server based on the server serial number hash value and the preset server information; If the first verification result satisfies a first preset condition, determining a second verification result of the preset terminal whitelist information based on the preset server information and the preset terminal whitelist information; If the second verification result satisfies the second preset condition, receiving the terminal serial number transmitted by the client; If the terminal serial number and the preset terminal whitelist information meet a third preset condition, the client security authority is granted.

11. A server, comprising a memory and a processor, wherein: The memory is used to store a computer program, and the processor is used to execute the computer program to implement: Obtain the server serial number hash value, preset server information, and preset terminal whitelist information; Determine a first verification result of the server based on the server serial number hash value and the preset server information; If the first verification result satisfies a first preset condition, determining a second verification result of the preset terminal whitelist information based on the preset server information and the preset terminal whitelist information; If the second verification result satisfies the second preset condition, receiving the terminal serial number transmitted by the client; If the terminal serial number and the preset terminal whitelist information meet a third preset condition, the client security authority is granted.

12. The server according to claim 11, wherein: The preset server information includes first preset customer information, a preset server serial number hash value, and first signature information, wherein the first signature information is information signed by the first preset customer information and the preset server serial number hash value based on a private key; The determining a first verification result of the server based on the server serial number hash value and the preset server information includes: Determine a first signature verification result based on the public key and the first signature information; Determine a first comparison result of the server based on the server serial number hash value and the preset server serial number hash value; Determining a first verification result of the server based on the first signature verification result and the first comparison result; The first preset condition is that the first signature verification result passes and the first comparison result is that the server serial number hash value is the same as the preset server serial number hash value.

13. The server according to claim 12, wherein: After determining the first verification result of the server based on the first signature verification result and the first comparison result, the processor is configured to execute the computer program to further implement: If the first verification result meets the first preset condition, the first preset customer information is stored in the server.

14. The server according to claim 12, wherein: The preset terminal whitelist information includes second preset customer information, a preset terminal serial number list, and second signature information, where the second signature information is information signed by the second preset customer information and the preset terminal serial number list based on a private key; if the first verification result satisfies the first preset condition, determining the second verification result of the preset terminal whitelist information based on the preset server information and the preset terminal whitelist information includes: If the first verification result meets the first preset condition, determine the second signature verification result based on the public key and the second signature information; Determining a second comparison result of the customer information based on the first preset customer information and the second preset customer information; Based on the second signature verification result and the second comparison result, determining the second Verify the results; The second preset condition is that the second signature verification result passes and the second comparison result is that the first preset customer information and the second preset customer information are the same.

15. The server according to claim 14, wherein: After determining the second verification result of the preset terminal whitelist information based on the second signature verification result and the second comparison result, the processor is configured to execute the computer program to further implement: If the second verification result meets the second preset condition, the preset terminal serial number list is stored in the server.

16. The server according to claim 14, wherein: If the terminal serial number and the preset terminal whitelist information meet the third preset condition, granting the client security authority includes: Based on a third comparison result between the terminal serial number and the preset terminal whitelist information, a third verification result of the terminal serial number is determined; if the third verification result meets the third preset condition, the client security authority is granted.

17. The server according to claim 16, wherein: The determining, based on a third comparison result between the terminal serial number and the preset terminal whitelist information, a third verification result of the terminal serial number includes: Determining a third verification result of the terminal serial number based on a third comparison result between the terminal serial number and the preset terminal serial number list; The third preset condition is that the terminal serial number is included in the preset terminal serial number list.

Images