WO2025016143A1 - Deployment method and device for security authorization of pos machine, and storage medium - Google Patents

Abstract

The present application is suitable for the technical field of POS machines, and provides a deployment method and device for security authorization of a POS machine, and a storage medium. The deployment method for security authorization of a POS machine is applied to a server side, and comprises: acquiring a server serial number hash value, preset server information and preset terminal whitelist information; determining a first verification result of a server on the basis of the server serial number hash value and the preset server information; if the first verification result satisfies a first preset condition, determining a second verification result of the preset terminal whitelist information on the basis of the preset server information and the preset terminal whitelist information; if the second verification result satisfies a second preset condition, receiving a terminal serial number transmitted by a client; and if the terminal serial number and the preset terminal whitelist information satisfy a third preset condition, granting the client a security permission. According to the present application, an authorization system can only be deployed on the correct server, illegitimate authorization of the authorization system can be avoided, and the authorization security of the POS machine is improved.

Description

A method, device and storage medium for POS machine security authorization deployment

This application claims priority to a Chinese patent application filed with the China Patent Office on July 14, 2023, with application number 202310868972.1 and entitled “A method, device and storage medium for secure authorization deployment of a POS machine”, the entire contents of which are incorporated by reference in this application.

Technical Field

The present application belongs to the technical field of POS machines, and in particular, relates to a method, device and storage medium for secure authorization deployment of a POS machine.

Background Art

At present, with the widespread use of POS machines, the electronic settlement of social consumption is becoming increasingly mature, and the fierce market competition has also brought many financial risks. When customers' POS machines are disassembled for repair, system settings, and security changes, they must be granted security permissions through the authorization system before they can operate. The authorization system can be deployed independently on the server by the customer, but some customers may deploy the authorization system arbitrarily, or authorize POS machines that were originally not authorized through the authorization system, resulting in illegal authorization of the authorization system and affecting the security of POS machine authorization.

Summary of the invention

The embodiments of the present application provide a method, device and storage medium for deploying secure authorization of a POS machine, which can solve the problem in the prior art that some customers may arbitrarily deploy the authorization system, or authorize a POS machine that is originally not authorized through the authorization system, resulting in illegal authorization of the authorization system and affecting the security of POS machine authorization.

A first aspect of an embodiment of the present application provides a POS machine security authorization deployment method, which is applied to a server side and includes:

Obtain the server serial number hash value, preset server information, and preset terminal whitelist information;

Determine a first verification result of the server based on the server serial number hash value and preset server information;

If the first verification result satisfies the first preset condition, determining a second verification result of the preset terminal whitelist information based on the preset server information and the preset terminal whitelist information;

If the second verification result satisfies the second preset condition, receiving the terminal serial number transmitted by the client;

If the terminal serial number and the preset terminal whitelist information meet the third preset condition, the client security permission is granted.

In one embodiment, the preset server information includes first preset customer information, a preset server serial number hash value, and first signature information, and the first signature information is information signed by the first preset customer information and the preset server serial number hash value based on a private key;

Determining a first verification result of the server based on the server serial number hash value and preset server information includes:

Determine a first signature verification result based on the public key and the first signature information;

Determine a first comparison result of the server based on the server serial number hash value and the preset server serial number hash value;

Determine a first verification result of the server based on the first signature verification result and the first comparison result;

The first preset condition is that the first signature verification result passes and the first comparison result is that the server serial number hash value is the same as the preset server serial number hash value.

In one embodiment, based on the first verification result and the first comparison result, the server determines the first verification result. After the results, it also includes:

If the first verification result meets the first preset condition, the first preset customer information is stored in the server.

In one embodiment, the preset terminal whitelist information includes second preset customer information, a preset terminal serial number list, and second signature information, and the second signature information is information after the second preset customer information and the preset terminal serial number list are signed based on a private key;

If the first verification result satisfies the first preset condition, based on the preset server information and the preset terminal whitelist information, determining a second verification result of the preset terminal whitelist information includes:

If the first verification result meets the first preset condition, determine the second signature verification result based on the public key and the second signature information;

Determining a second comparison result of the customer information based on the first preset customer information and the second preset customer information;

Determine a second verification result of the preset terminal whitelist information based on the second signature verification result and the second comparison result;

The second preset condition is that the second signature verification result passes and the second comparison result is that the first preset customer information and the second preset customer information are the same.

In one embodiment, after determining the second verification result of the preset terminal whitelist information based on the second signature verification result and the second comparison result, the method further includes:

If the second verification result meets the second preset condition, the preset terminal serial number list is stored in the server.

In one embodiment, if the terminal serial number and the preset terminal whitelist information meet the third preset condition, granting the client security permission includes:

Determining a third verification result of the terminal serial number based on a third comparison result between the terminal serial number and the preset terminal whitelist information;

If the third verification result meets the third preset condition, the client is granted security authority.

In one embodiment, determining a third verification result of the terminal serial number based on a third comparison result between the terminal serial number and the preset terminal whitelist information includes:

Determining a third verification result of the terminal serial number based on a third comparison result between the terminal serial number and the preset terminal serial number list;

The third preset condition is that the terminal serial number is included in a preset terminal serial number list.

A second aspect of the embodiment of the present application provides a POS machine security authorization deployment method, which is applied to a client, including:

Send the terminal serial number to the server;

If the terminal serial number and the preset terminal whitelist information meet the third preset condition, the security authority granted by the server is obtained.

A third aspect of the embodiment of the present application provides a POS machine security authorization deployment device, which is applied to a server side, including:

An information acquisition module is used to obtain a server serial number hash value, preset server information, and preset terminal whitelist information;

A first verification module, used to determine a first verification result of the server based on a hash value of a server serial number and preset server information;

A second verification module, configured to determine a second verification result of the preset terminal whitelist information based on the preset server information and the preset terminal whitelist information if the first verification result satisfies the first preset condition;

A sequence receiving module, configured to receive a terminal sequence number transmitted by the client if the second verification result satisfies a second preset condition;

The third verification module is used to grant the client security authority if the terminal serial number and the preset terminal whitelist information meet the third preset condition.

In one embodiment, the first verification module includes:

A first signature verification unit, used to determine a first signature verification result based on the public key and the first signature information;

A first comparison unit, configured to determine a first comparison result of the server based on a hash value of the server serial number and a preset hash value of the server serial number;

The first verification unit is used to determine a first verification result of the server based on the first signature verification result and the first comparison result.

In one embodiment, the POS terminal security authorization deployment device further includes:

The first storage module is used to store the first preset customer information to the server side if the first verification result meets the first preset condition.

In one embodiment, the second verification module includes:

A second signature verification unit, configured to determine a second signature verification result based on the public key and the second signature information if the first verification result meets the first preset condition;

A second comparison unit, configured to determine a second comparison result of the customer information based on the first preset customer information and the second preset customer information;

The second verification unit is used to determine a second verification result of the preset terminal whitelist information based on the second signature verification result and the second comparison result.

In one embodiment, the POS terminal security authorization deployment device further includes:

The second storage module is used to store the preset terminal serial number list in the server side if the second verification result meets the second preset condition.

In one embodiment, the third verification module includes:

A third comparison unit, configured to determine a third verification result of the terminal serial number based on a third comparison result between the terminal serial number and the preset terminal whitelist information;

The permission granting unit is used to grant the client security permission if the third verification result meets the third preset condition.

In one of the embodiments, the third comparison unit is specifically configured to determine a third verification result of the terminal serial number based on a third comparison result between the terminal serial number and a preset terminal serial number list.

A fourth aspect of the embodiments of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the POS terminal security authorization deployment method described in the first aspect is implemented.

The first aspect of the embodiment of the present application provides a method for deploying secure authorization of a POS machine. When the authorization system is deployed on the client's server, the server serial number hash value is obtained, and the server serial number hash value is verified based on the preset server information. This can verify whether the server deployed by the authorization system is the correct server, so that the authorization system can only be deployed on the correct server. If the server verification is successful, the terminal serial number of the POS machine accessing the authorization system by the client is verified based on the preset terminal whitelist information that has passed the verification. If the terminal serial number verification is successful, the POS machine security authority is granted, which can ensure that the authorization system only authorizes the POS machine that can be authorized, thereby strictly controlling the security of the POS machine authorization and preventing the authorization system from illegally authorizing.

It can be understood that the beneficial effects of the second, third and fourth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the specific implementation methods of the present application or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

FIG1 is a schematic diagram of a first flow chart of a method for deploying secure authorization of a POS terminal provided in an embodiment of the present application;

FIG. 2 is a schematic diagram of a second flow chart of a POS terminal security authorization deployment method provided in an embodiment of the present application;

FIG3 is a schematic diagram of a third process flow of a POS terminal security authorization deployment method provided in an embodiment of the present application;

FIG4 is a schematic diagram of a fourth flow chart of a POS terminal security authorization deployment method provided in an embodiment of the present application;

FIG5 is a schematic diagram of the structure of a POS terminal security authorization deployment device provided in an embodiment of the present application.

DETAILED DESCRIPTION

In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and/or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and/or combinations thereof.

It should also be understood that the term “and/or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one of the embodiments", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways. "Multiple" means "two or more".

At present, with the widespread use of POS machines, the electronic settlement of social consumption is becoming increasingly mature, and the fierce market competition has also brought many financial risks. When customers' POS machines are disassembled for repair, system settings, and security changes, they must be granted security permissions through the authorization system before they can operate. The authorization system can be deployed independently on the server by the customer, but some customers may deploy the authorization system arbitrarily, or authorize POS machines that were originally not authorized through the authorization system, resulting in illegal authorization of the authorization system and affecting the security of POS machine authorization.

In response to the above problems, an embodiment of the present application provides a POS machine security authorization deployment method, which is applied to the server side. The method obtains a server serial number hash value, preset server information and preset terminal information, and determines a first verification result of the server based on the server serial number hash value and the preset server information. If the first verification result meets the first preset condition, a second verification result of the preset terminal information is determined based on the preset server information and the preset terminal information. If the second verification result meets the second preset condition, the terminal serial number transmitted by the client is received. If the terminal serial number and the preset terminal information meet the third preset condition, the client is granted security permissions. This allows the authorization system to be deployed only on the correct server, and ensures that the authorization system only authorizes POS machines that can be authorized, thereby avoiding illegal authorization of the authorization system and improving the security of POS machine authorization.

The POS terminal security authorization deployment method provided by the present application is exemplarily described below in conjunction with specific embodiments.

As shown in FIG1 , the POS machine security authorization deployment method provided in this embodiment is applied to the server side, and includes:

S100, obtaining a server serial number hash value, preset server information, and preset terminal whitelist information.

In the application, when the customer's POS machine needs authorization to disassemble and repair the machine, set up the system, and perform security-related modification operations, the POS machine manufacturer can first connect the encryption machine, also known as the authorization machine, to the customer's server to deploy the authorization system on the customer's server. The server can be a server based on the Windows environment. Then the customer connects the POS machine that needs authorization to his own terminal device, such as a computer, and uses the authorization tool in the terminal device to access the authorization system in the server through the Internet. The authorization tool is a desktop tool that can be run by double-clicking the corresponding exe file after decompression. The server and the encryption machine constitute the server side, and the POS machine and the terminal device constitute the client side.

In the application, in order to ensure that the authorization system is deployed on the correct server and that the authorization system is connected to a POS machine that can be authorized, server verification and POS terminal serial number verification can be performed. When the authorization system is started, the server serial number hash value, preset server information, and preset terminal whitelist information are obtained. The server serial number hash value can be a hash value of the CPU serial number of the server deployed by the authorization system after hash processing, the preset server information can be information about the server that can be deployed by the authorization system, that is, the correct server, and the preset terminal whitelist information can be information about the POS machine that can be authorized by the authorization system.

In the application, when deploying the authorization system, the above-mentioned preset server information and the above-mentioned preset terminal whitelist information can be deployed to the server in the form of files along with the authorization system, and specifically stored in a specified directory in the authorization system deployment file to facilitate subsequent verification of the server and terminal serial numbers.

S200: Determine a first verification result of the server based on a hash value of the server serial number and preset server information.

In the application, to ensure that the authorization system is deployed on the correct server, the server deployed by the authorization system can be verified. The first verification result of the server is determined based on the server serial number hash value and the preset server information, and the server serial number hash value is verified by the preset server information to determine the first verification result of the server.

In one of the embodiments, the preset server information includes first preset customer information, a preset server serial number hash value and first signature information, and the first signature information is information signed by the first preset customer information and the preset server serial number hash value based on a private key.

In the application, the above-mentioned preset server serial number hash value can be a hash value of the CPU serial number of the server that can be deployed by the authorization system after hash processing. In order to prevent attackers from easily calculating related information, the server CPU serial number can be hashed. The above-mentioned first preset customer information can be the customer information of the server corresponding to the above-mentioned preset server serial number hash value, that is, the correct customer information that the authorization system can authorize. The above-mentioned first signature information can be the signature information obtained by signing the above-mentioned first preset customer information and the above-mentioned preset server serial number hash value using the private key of the POS machine manufacturing company. The specific signing process is to first send the first preset customer information and the preset server serial number hash value to the terminal of the POS machine manufacturing company. After the operator uses the private key in the encryption machine of the POS machine manufacturing company to sign, the signature information is sent to the server for authorization deployment.

As shown in FIG2 , based on the server serial number hash value and the preset server information, determining the first verification result of the server includes:

S210: Determine a first signature verification result based on the public key and the first signature information.

In the application, in order to prevent the above-mentioned preset server information from being tampered with, the above-mentioned first signature information can be verified when the authorization system is started. The above-mentioned determination of the first signature verification result based on the public key and the first signature information can be to call the public key stored in the authorization system to verify the first signature information in the above-mentioned preset server information, thereby determining the above-mentioned first signature verification result. If the above-mentioned preset server information is tampered with, the above-mentioned first signature verification result will fail. If the above-mentioned preset server information is not tampered with, the above-mentioned first signature verification result will pass.

S220: Determine a first comparison result of the server based on the server serial number hash value and a preset server serial number hash value.

In the application, when the authorization system is started, in order to verify whether the server deployed by the authorization system is the correct server, after obtaining the server serial number hash value, the server serial number hash value can be verified through the preset server information. The first comparison result of the server is determined based on the server serial number hash value and the preset server serial number hash value, which can be determined by comparing the server serial number hash value with the preset server serial number hash value. If the server serial number hash value is the same as the preset server serial number hash value, the first comparison result is passed. If the server serial number hash value is not the same as the preset server serial number hash value, the first comparison result is not passed.

S230: Determine a first verification result of the server based on the first signature verification result and the first comparison result.

In the application, the first verification result of the server is determined based on the first verification result and the first comparison result, which can be based on the first verification result of the first signature information, the hash value of the server serial number and the pre- A first verification result of the server is determined by a first comparison result of the hash value of the server serial number.

In one of the embodiments, the first preset condition is that both the first signature verification result and the first comparison result are passed, that is, the preset server information has not been tampered with, and the server serial number hash value is the same as the preset server serial number hash value.

In one of the embodiments, after determining the first verification result of the server based on the first signature verification result and the first comparison result, the method further includes: if the first verification result meets the first preset condition, storing the first preset customer information on the server.

In the application, if the first verification result satisfies the first preset condition, it means that the server deployed by the authorization system is the correct server and the server verification is passed. If the first verification result satisfies the first preset condition, the first preset customer information is stored on the server side, which can be after the server verification is passed, the first preset customer information is written into the memory of the server, so as to be configured in the server, indicating that the first preset customer information is the correct customer information.

S300: If the first verification result meets the first preset condition, determine a second verification result of the preset terminal whitelist information based on the preset server information and the preset terminal whitelist information.

In the application, if the above-mentioned first verification result meets the above-mentioned first preset condition, it means that the server deployed by the authorization system is the correct server. If the server verification is passed, the terminal serial number of the POS machine connected to the authorization system can be verified again. Before performing the terminal serial number verification, it is necessary to verify whether the above-mentioned preset terminal whitelist information is the correct customer's own preset terminal whitelist information. The above-mentioned second verification result of determining the preset terminal whitelist information based on the preset server information and the preset terminal whitelist information can be to verify the above-mentioned preset terminal whitelist information through the first preset customer information in the above-mentioned preset server information, thereby determining the second verification result of the above-mentioned preset terminal whitelist information.

In one embodiment, the preset terminal whitelist information includes second preset customer information, a preset terminal serial number list and second signature information, and the second signature information is information after the second preset customer information and the preset terminal serial number list are signed based on a private key.

In the application, the above-mentioned preset terminal serial number list can be a list of terminal serial numbers of POS machines that can be authorized by the authorization system, and the above-mentioned second preset customer information can be the information of the customer of the POS machine corresponding to the above-mentioned preset terminal serial number list. The above-mentioned signing of the second preset customer information and the preset terminal serial number list based on the private key can be signed by using the private key of the POS machine manufacturer to sign the hash value of the above-mentioned second preset customer information and the above-mentioned preset terminal serial number list after hash processing. The specific signing process is to first send the second preset customer information and the preset terminal serial number list to the terminal of the POS machine manufacturer, and after the operator signs with the private key in the encryption machine of the POS machine manufacturer, send the signature information to the server for authorization deployment. The above-mentioned preset terminal whitelist information can be directly read into the memory of the server when the authorization system is started to prevent other customers from maliciously tampering with the above-mentioned preset terminal whitelist information.

As shown in FIG3 , if the first verification result satisfies the first preset condition, based on the preset server information and the preset terminal whitelist information, determining the second verification result of the preset terminal whitelist information includes:

S310: If the first verification result meets the first preset condition, determine the second signature verification result based on the public key and the second signature information.

In the application, in order to prevent the above-mentioned preset terminal whitelist information from being tampered with, the above-mentioned second signature information can be verified when the authorization system is started. The above-mentioned determination of the second signature verification result based on the public key and the second signature information can be to call the public key stored in the authorization system to verify the second signature information in the above-mentioned preset terminal whitelist information, thereby determining the above-mentioned second signature verification result. If the above-mentioned preset terminal whitelist information is tampered with, the above-mentioned second signature verification result will fail. If the above-mentioned preset terminal whitelist information has not been tampered with, the above-mentioned second signature verification result will pass.

S320: Determine a second comparison result of the customer information based on the first preset customer information and the second preset customer information.

In the application, before performing terminal serial number verification, in order to verify whether the above-mentioned preset terminal whitelist information is the correct client's own preset terminal whitelist information, the first preset client in the above-mentioned preset server information can be used. The information verifies the second preset customer information in the preset terminal whitelist information. The second comparison result of the customer information is determined based on the first preset customer information and the second preset customer information, and the second comparison result of the customer information is determined by comparing the first preset customer information with the second preset customer information. If the first preset customer information and the second preset customer information are the same, the second comparison result passes; if the first preset customer information and the second preset customer information are different, the second comparison result fails.

S330: Determine a second verification result of the preset terminal whitelist information based on the second signature verification result and the second comparison result.

In the application, the second verification result of the preset terminal information is determined based on the second signature verification result and the second comparison result. The second verification result of the preset terminal whitelist information is determined based on the second signature verification result of the second signature information and the second comparison result of the first preset customer information and the second preset customer information.

In one embodiment, the second preset condition is that both the second signature verification result and the second comparison result are passed, that is, the preset terminal whitelist information has not been tampered with, and the first preset customer information is the same as the second preset customer information.

In one of the embodiments, after determining the second verification result of the preset terminal whitelist information based on the second signature verification result and the second comparison result, it also includes: if the second verification result meets the second preset condition, storing the preset terminal serial number list to the server.

In the application, since the above-mentioned first preset customer information has been determined to be the information of the correct customer, if the above-mentioned second verification result meets the above-mentioned second preset condition, it means that the above-mentioned preset terminal whitelist information is also the preset terminal whitelist information of the correct customer, and the above-mentioned preset terminal whitelist information is verified. If the above-mentioned second verification result meets the second preset condition, the preset terminal serial number list is stored on the server side. It can be that after the preset terminal whitelist information is verified, the preset terminal serial number list in the above-mentioned preset terminal whitelist information is written into the memory of the server, so as to perform the subsequent verification of the terminal serial number. By verifying the preset terminal whitelist information, the customer can only use his own preset terminal serial number list for terminal serial number verification, avoiding the customer from maliciously using the preset terminal serial number list of other customers.

S400: If the second verification result satisfies the second preset condition, receive the terminal serial number transmitted by the client.

In the application, if the second verification result meets the second preset condition, it means that the preset terminal whitelist information is the correct preset terminal information of the client, and the preset terminal whitelist information is verified. At this time, the preset terminal serial number list in the preset terminal whitelist information can be used to verify the terminal serial number of the POS machine that the client accesses the authorization system. The terminal serial number can be the SN (Serial Number) of the POS machine.

S500: If the terminal serial number and the preset terminal whitelist information meet the third preset condition, grant the client security authority.

In the application, in order to make the authorization system authorize only the POS machines that can be authorized, the terminal serial number of the POS machine of the client accessing the authorization system can be verified through the above-mentioned preset terminal whitelist information, and it can be determined whether the above-mentioned terminal serial number and the above-mentioned preset terminal whitelist information meet the third preset condition. If so, the client is granted the security authority to access the POS machine of the authorization system.

As shown in FIG. 4 , if the terminal serial number and the preset terminal whitelist information meet the third preset condition, granting the client security permission includes:

S510: Determine a third verification result of the terminal serial number based on a third comparison result between the terminal serial number and the preset terminal whitelist information.

In the application, the third verification result of the terminal serial number is determined based on the third comparison result between the terminal serial number and the preset terminal whitelist information. The terminal serial number of the POS machine of the client accessing the authorization system is compared with the preset terminal whitelist information to obtain the third comparison result, and the third verification result of the terminal serial number is determined based on the third comparison result.

In one embodiment, the third verification result of the terminal serial number is determined based on the third comparison result of the terminal serial number and the preset terminal whitelist information, including: The third verification result of the terminal serial number is determined by comparing the results; the third preset condition is that the terminal serial number is included in the preset terminal serial number list.

In the application, the third verification result of the terminal serial number is determined based on the third comparison result between the terminal serial number and the preset terminal serial number list. The terminal serial number of the POS machine for client access to the authorization system is compared with the preset terminal serial number list in the preset terminal whitelist information to obtain the third comparison result, and the third verification result of the terminal serial number is determined based on the third comparison result.

S520: If the third verification result meets the third preset condition, grant the client security authority.

In the application, if the third verification result satisfies the third preset condition, it means that the terminal serial number of the POS machine accessed by the client to the authorization system is included in the preset terminal serial number list, the POS machine accessed by the client to the authorization system is a POS machine that can be authorized, and the authorization system can authorize the POS machine security permissions. If the terminal serial number and the preset terminal whitelist information do not meet the third preset condition, it means that the terminal serial number of the POS machine accessed by the client to the authorization system is not included in the preset terminal serial number list, the POS machine accessed by the client to the authorization system is a POS machine that cannot be authorized, and the authorization system does not grant the POS machine security permissions.

Specifically, in the POS authorization usage scenario, the authorization system can be a web system running on a Windows server. The administrator can deploy the authorization system on the customer's server and operate the authorization system through a browser. When the customer's POS machine needs to be authorized for security permissions, the customer can connect the POS machine to his terminal device, such as a computer, and then use the authorization tool in the terminal device to access the authorization system through the Internet. When the authorization system is deployed on the customer's server, by obtaining the server's serial number hash value and verifying the server serial number hash value based on the preset server information, it can be verified whether the server deployed by the authorization system is the correct server, so that the authorization system can only be deployed on the correct server. If the server verification passes, the terminal serial number of the customer's POS machine accessing the authorization system is verified based on the preset terminal whitelist information that has passed the verification. If the terminal serial number verification passes, the POS machine security permissions are granted, which can ensure that the authorization system only authorizes POS machines that can be authorized, thereby strictly controlling the security of POS machine authorization and preventing the authorization system from illegally authorizing.

The embodiment of the present application also provides a POS machine security authorization deployment method, which is applied to the client, including: sending the terminal serial number to the server; if the terminal serial number and the preset terminal whitelist information meet the third preset condition, obtaining the security authority granted by the server.

It should be noted that the above-mentioned POS machine security authorization deployment method applied to the client is based on the same concept as the above-mentioned POS machine security authorization deployment method applied to the server. Its specific functions and technical effects can be found in the embodiment of the above-mentioned POS machine security authorization deployment method applied to the server, and will not be repeated here.

The following is an exemplary description of the POS terminal security authorization deployment device provided in this application in conjunction with the accompanying drawings.

Corresponding to the POS machine security authorization deployment method described in the above embodiment, as shown in FIG5 , this embodiment provides a POS machine security authorization deployment device, which is applied to the server side. The POS machine security authorization deployment device 500 includes:

The information acquisition module 510 is used to obtain the server serial number hash value, preset server information and preset terminal whitelist information;

A first verification module 520, configured to determine a first verification result of the server based on a hash value of the server serial number and preset server information;

The second verification module 530 is used to determine a second verification result of the preset terminal whitelist information based on the preset server information and the preset terminal whitelist information if the first verification result meets the first preset condition;

The sequence receiving module 540 is used to receive the terminal sequence number transmitted by the client if the second verification result meets the second preset condition;

The third verification module 550 is used to grant the client security authority if the terminal serial number and the preset terminal whitelist information meet the third preset condition.

In one embodiment, the first verification module includes:

A first signature verification unit, used to determine a first signature verification result based on the public key and the first signature information;

A first comparison unit, configured to determine a first comparison result of the server based on a hash value of the server serial number and a preset hash value of the server serial number;

The first verification unit is used to determine a first verification result of the server based on the first signature verification result and the first comparison result.

In one embodiment, the POS terminal security authorization deployment device further includes:

The first storage module is used to store the first preset customer information to the server side if the first verification result meets the first preset condition.

In one embodiment, the second verification module includes:

A second signature verification unit, configured to determine a second signature verification result based on the public key and the second signature information if the first verification result meets the first preset condition;

A second comparison unit, configured to determine a second comparison result of the customer information based on the first preset customer information and the second preset customer information;

The second verification unit is used to determine a second verification result of the preset terminal whitelist information based on the second signature verification result and the second comparison result.

In one embodiment, the POS terminal security authorization deployment device further includes:

The second storage module is used to store the preset terminal serial number list in the server side if the second verification result meets the second preset condition.

In one embodiment, the third verification module includes:

A third comparison unit, configured to determine a third verification result of the terminal serial number based on a third comparison result between the terminal serial number and the preset terminal whitelist information;

The permission granting unit is used to grant the client security permission if the third verification result meets the third preset condition.

In one of the embodiments, the third comparison unit is specifically configured to determine a third verification result of the terminal serial number based on a third comparison result between the terminal serial number and a preset terminal serial number list.

It should be noted that the information interaction, execution process, etc. between the above-mentioned modules/units are based on the same concept as the method embodiment of the present application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

The embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments can be implemented.

The present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by a processor, it can implement the steps of each of the above-mentioned method embodiments. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may at least include: any entity or device that can carry the computer program code to a terminal device, a recording medium, a computer memory, a read-only memory (ROM, Read-Only

In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

Those of ordinary skill in the art will appreciate that the devices and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interface, indirect coupling or communication connection of devices, which can be electrical, mechanical or other forms.

The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims (17)

A method for deploying secure authorization of a POS machine, which is applied to a server and includes: Obtain the server serial number hash value, preset server information, and preset terminal whitelist information; Determine a first verification result of the server based on the server serial number hash value and the preset server information; If the first verification result satisfies a first preset condition, determining a second verification result of the preset terminal whitelist information based on the preset server information and the preset terminal whitelist information; If the second verification result satisfies the second preset condition, receiving the terminal serial number transmitted by the client; If the terminal serial number and the preset terminal whitelist information meet a third preset condition, the client security authority is granted. The POS machine security authorization deployment method according to claim 1, wherein the preset server information includes first preset customer information, a preset server serial number hash value and first signature information, and the first signature information is information signed by the first preset customer information and the preset server serial number hash value based on a private key; The determining a first verification result of the server based on the server serial number hash value and the preset server information includes: Determine a first signature verification result based on the public key and the first signature information; Determine a first comparison result of the server based on the server serial number hash value and the preset server serial number hash value; Determining a first verification result of the server based on the first signature verification result and the first comparison result; The first preset condition is that the first signature verification result passes and the first comparison result is that the server serial number hash value is the same as the preset server serial number hash value. The POS machine security authorization deployment method according to claim 2, wherein after determining the first verification result of the server based on the first signature verification result and the first comparison result, the method further comprises: If the first verification result meets the first preset condition, the first preset customer information is stored in the server. The POS machine security authorization deployment method according to claim 2, wherein the preset terminal whitelist information includes second preset customer information, a preset terminal serial number list and second signature information, and the second signature information is information after the second preset customer information and the preset terminal serial number list are signed respectively based on a private key; if the first verification result satisfies the first preset condition, based on the preset server information and the preset terminal whitelist information, determining the second verification result of the preset terminal whitelist information comprises: If the first verification result meets the first preset condition, determine the second signature verification result based on the public key and the second signature information; Determining a second comparison result of the customer information based on the first preset customer information and the second preset customer information; Determining a second verification result of the preset terminal whitelist information based on the second signature verification result and the second comparison result; The second preset condition is that the second signature verification result passes and the second comparison result is that the first preset customer information and the second preset customer information are the same. The POS machine security authorization deployment method according to claim 4, wherein after determining the second verification result of the preset terminal whitelist information based on the second signature verification result and the second comparison result, it also includes: If the second verification result meets the second preset condition, the preset terminal serial number list is stored in the server. The POS machine security authorization deployment method according to claim 4, wherein if the terminal serial number and the preset terminal whitelist information meet a third preset condition, granting the client security authority comprises: Based on a third comparison result between the terminal serial number and the preset terminal whitelist information, a third verification result of the terminal serial number is determined; if the third verification result meets the third preset condition, the client security authority is granted. The POS machine security authorization deployment method according to claim 6, wherein the determining the third verification result of the terminal serial number based on the third comparison result of the terminal serial number and the preset terminal whitelist information comprises: Determining a third verification result of the terminal serial number based on a third comparison result between the terminal serial number and the preset terminal serial number list; The third preset condition is that the terminal serial number is included in the preset terminal serial number list. A method for deploying secure authorization of a POS machine, which is applied to a client and includes: Send the terminal serial number to the server; If the terminal serial number and the preset terminal whitelist information meet the third preset condition, the security authority granted by the server is obtained. A POS machine security authorization deployment device, which is applied to a server side and includes: An information acquisition module is used to obtain a server serial number hash value, preset server information, and preset terminal whitelist information; A first verification module, used to determine a first verification result of the server based on the server serial number hash value and the preset server information; A second verification module, configured to determine a second verification result of the preset terminal whitelist information based on the preset server information and the preset terminal whitelist information if the first verification result satisfies a first preset condition; A sequence receiving module, configured to receive a terminal sequence number transmitted by the client if the second verification result satisfies a second preset condition; The third verification module is used to grant the client security authority if the terminal serial number and the preset terminal whitelist information meet a third preset condition. A computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the computer program implements: Obtain the server serial number hash value, preset server information, and preset terminal whitelist information; Determine a first verification result of the server based on the server serial number hash value and the preset server information; If the first verification result satisfies a first preset condition, determining a second verification result of the preset terminal whitelist information based on the preset server information and the preset terminal whitelist information; If the second verification result satisfies the second preset condition, receiving the terminal serial number transmitted by the client; If the terminal serial number and the preset terminal whitelist information meet a third preset condition, the client security authority is granted. A server, comprising a memory and a processor, wherein the memory is used to store a computer program, and the processor is used to execute the computer program to implement: Obtain the server serial number hash value, preset server information, and preset terminal whitelist information; Determine a first verification result of the server based on the server serial number hash value and the preset server information; If the first verification result satisfies a first preset condition, determining a second verification result of the preset terminal whitelist information based on the preset server information and the preset terminal whitelist information; If the second verification result satisfies the second preset condition, receiving the terminal serial number transmitted by the client; If the terminal serial number and the preset terminal whitelist information meet a third preset condition, the client security authority is granted. The server according to claim 11, wherein the preset server information includes first preset customer information, a preset server serial number hash value, and first signature information, and the first signature information is information signed by the first preset customer information and the preset server serial number hash value based on a private key; The determining a first verification result of the server based on the server serial number hash value and the preset server information includes: Determine a first signature verification result based on the public key and the first signature information; Determine a first comparison result of the server based on the server serial number hash value and the preset server serial number hash value; Determining a first verification result of the server based on the first signature verification result and the first comparison result; The first preset condition is that the first signature verification result passes and the first comparison result is that the server serial number hash value is the same as the preset server serial number hash value. The server according to claim 12, wherein after determining the first verification result of the server based on the first signature verification result and the first comparison result, the processor is used to execute the computer program to further implement: If the first verification result meets the first preset condition, the first preset customer information is stored in the server. The server according to claim 12, wherein the preset terminal whitelist information includes second preset customer information, a preset terminal serial number list, and second signature information, and the second signature information is information after the second preset customer information and the preset terminal serial number list are signed based on a private key; if the first verification result satisfies the first preset condition, determining the second verification result of the preset terminal whitelist information based on the preset server information and the preset terminal whitelist information, comprises: If the first verification result meets the first preset condition, determine the second signature verification result based on the public key and the second signature information; Determining a second comparison result of the customer information based on the first preset customer information and the second preset customer information; Based on the second signature verification result and the second comparison result, determining the second Verify the results; The second preset condition is that the second signature verification result passes and the second comparison result is that the first preset customer information and the second preset customer information are the same. The server according to claim 14, wherein after determining the second verification result of the preset terminal whitelist information based on the second signature verification result and the second comparison result, the processor is used to execute the computer program to further implement: If the second verification result meets the second preset condition, the preset terminal serial number list is stored in the server. The server according to claim 14, wherein if the terminal serial number and the preset terminal whitelist information meet a third preset condition, granting the client security permission comprises: Based on a third comparison result between the terminal serial number and the preset terminal whitelist information, a third verification result of the terminal serial number is determined; if the third verification result meets the third preset condition, the client security authority is granted. The server according to claim 16, wherein the determining the third verification result of the terminal serial number based on the third comparison result between the terminal serial number and the preset terminal whitelist information comprises: Determining a third verification result of the terminal serial number based on a third comparison result between the terminal serial number and the preset terminal serial number list; The third preset condition is that the terminal serial number is included in the preset terminal serial number list.