CN116938471A - A POS machine security authorization deployment method, device and storage medium - Google Patents

Abstract

The application is applicable to the technical field of POS machines, and provides a POS machine security authorization deployment method, a POS machine security authorization deployment device and a storage medium, wherein the POS machine security authorization deployment method is applied to a server and comprises the following steps: obtaining a server serial number hash value, preset server information and preset terminal white list information; determining a first verification result of the server based on the server serial number hash value and preset server information; if the first verification result meets the first preset condition, determining a second verification result of the preset terminal white list information based on the preset server information and the preset terminal white list information; if the second verification result meets a second preset condition, receiving a terminal serial number transmitted by the client; and if the terminal serial number and the preset terminal white list information meet a third preset condition, granting the security authority to the client. The application can ensure that the authorization system can only be deployed on a correct server, can also avoid illegal authorization of the authorization system, and improves the authorization security of the POS machine.

Description

A POS machine security authorization deployment method, device and storage medium

Technical field

The present application belongs to the technical field of POS machines, and in particular relates to a POS machine security authorization deployment method, device and storage medium.

Background technique

At present, with the widespread use of POS machines, electronic social consumption settlement is becoming increasingly mature, and fierce market competition has also brought numerous financial risks. When the customer's POS machine is undergoing some disassembly and maintenance, system settings, and security-related changes, it must be granted security permissions through the authorization system before it can be operated. The authorization system can be independently deployed on the server by the customer, but some customers may deploy the authorization system at will, or use the authorization system to authorize POS machines that cannot be authorized originally, resulting in illegal authorization by the authorization system and affecting the security of POS machine authorization.

Contents of the invention

The embodiments of this application provide a POS machine security authorization deployment method, device and storage medium, which can solve the problem in the existing technology that some customers may deploy the authorization system at will, or authorize POS machines that are originally unable to authorize through the authorization system. , leading to illegal authorization by the authorization system and affecting the security of POS machine authorization.

The first aspect of the embodiment of this application provides a POS machine security authorization deployment method, which is applied to the server side and includes:

Obtain the server serial number hash value, preset server information and preset terminal whitelist information;

Determine the first verification result of the server based on the server serial number hash value and preset server information;

If the first verification result meets the first preset condition, determine the second verification result of the preset terminal whitelist information based on the preset server information and the preset terminal whitelist information;

If the second verification result meets the second preset condition, receive the terminal serial number sent by the client;

If the terminal serial number and the preset terminal whitelist information meet the third preset condition, the client is granted security permission.

In one embodiment, the preset server information includes first preset client information, a hash value of the preset server serial number, and first signature information. The first signature information is a pair of the first preset client information and the preset server information based on a private key. Suppose the server serial number hash value is used to sign the information respectively;

Based on the server serial number hash value and preset server information, determine the first verification result of the server, including:

Based on the public key and the first signature information, determine the first signature verification result;

Determine the first comparison result of the server based on the server serial number hash value and the preset server serial number hash value;

Based on the first signature verification result and the first comparison result, determine the first verification result of the server;

The first preset condition is that the first signature verification result is passed and the first comparison result is that the server serial number hash value is the same as the preset server serial number hash value.

In one embodiment, after determining the first verification result of the server based on the first signature verification result and the first comparison result, the method further includes:

If the first verification result satisfies the first preset condition, the first preset customer information is stored in the server.

In one embodiment, the preset terminal whitelist information includes second preset customer information, a preset terminal serial number list, and second signature information. The second signature information is a pair of the second preset customer information and the preset terminal information based on a private key. Assume that the terminal serial number list is signed separately;

If the first verification result satisfies the first preset condition, determine the second verification result of the preset terminal whitelist information based on the preset server information and the preset terminal whitelist information, including:

If the first verification result meets the first preset condition, determine the second signature verification result based on the public key and the second signature information;

Determine a second comparison result of the customer information based on the first preset customer information and the second preset customer information;

Based on the second signature verification result and the second comparison result, determine the second verification result of the preset terminal whitelist information;

The second preset condition is that the second signature verification result is passed and the second comparison result is that the first preset customer information and the second preset customer information are the same.

In one embodiment, after determining the second verification result of the preset terminal whitelist information based on the second signature verification result and the second comparison result, the method further includes:

If the second verification result satisfies the second preset condition, the preset terminal serial number list is stored in the server.

In one embodiment, if the terminal serial number and the preset terminal whitelist information meet the third preset condition, the client is granted security permissions, including:

Determine the third verification result of the terminal serial number based on the third comparison result of the terminal serial number and the preset terminal whitelist information;

If the third verification result meets the third preset condition, the client is granted security permission.

In one embodiment, the third verification result of the terminal serial number is determined based on the third comparison result of the terminal serial number and the preset terminal whitelist information, including:

Determine the third verification result of the terminal serial number based on the third comparison result of the terminal serial number and the preset terminal serial number list;

The third preset condition is that the terminal serial number is included in the preset terminal serial number list.

The second aspect of the embodiment of this application provides a POS machine security authorization deployment method, which is applied to the client and includes:

Send the terminal serial number to the server;

If the terminal serial number and the preset terminal whitelist information meet the third preset condition, the security permission granted by the server is obtained.

The third aspect of the embodiment of the present application provides a POS machine security authorization deployment device, which is applied to the server side and includes:

Information acquisition module, used to obtain server serial number hash value, preset server information and preset terminal whitelist information;

The first verification module is used to determine the first verification result of the server based on the hash value of the server serial number and the preset server information;

A second verification module, configured to determine the second verification result of the preset terminal whitelist information based on the preset server information and the preset terminal whitelist information if the first verification result satisfies the first preset condition;

A sequence receiving module, configured to receive the terminal serial number transmitted by the client if the second verification result meets the second preset condition;

The third verification module is used to grant the client security permission if the terminal serial number and the preset terminal whitelist information meet the third preset condition.

In one embodiment, the first verification module includes:

The first signature verification unit is used to determine the first signature verification result based on the public key and the first signature information;

The first comparison unit is used to determine the first comparison result of the server based on the server serial number hash value and the preset server serial number hash value;

The first verification unit is used to determine the first verification result of the server based on the first signature verification result and the first comparison result.

In one embodiment, the POS machine security authorization deployment device also includes:

The first storage module is used to store the first preset customer information to the server if the first verification result satisfies the first preset condition.

In one embodiment, the second verification module includes:

The second signature verification unit is used to determine the second signature verification result based on the public key and the second signature information if the first verification result meets the first preset condition;

a second comparison unit configured to determine a second comparison result of customer information based on the first preset customer information and the second preset customer information;

The second verification unit is configured to determine the second verification result of the preset terminal whitelist information based on the second signature verification result and the second comparison result.

In one embodiment, the POS machine security authorization deployment device also includes:

The second storage module is used to store the preset terminal serial number list to the server if the second verification result satisfies the second preset condition.

In one embodiment, the third verification module includes:

The third comparison unit is configured to determine the third verification result of the terminal serial number based on the third comparison result of the terminal serial number and the preset terminal whitelist information;

The permission granting unit is used to grant security permission to the client if the third verification result meets the third preset condition.

In one embodiment, the third comparison unit is specifically configured to determine the third verification result of the terminal serial number based on the third comparison result of the terminal serial number and the preset terminal serial number list.

A fourth aspect of the embodiments of the present application provides a computer-readable storage medium. The computer-readable storage medium stores a computer program. When the computer program is executed by a processor, the POS machine security authorization deployment method described in the first aspect is implemented.

The POS security authorization deployment method provided by the first aspect of the embodiment of the present application obtains the hash value of the serial number of the server when the authorization system is deployed on the client's server, and hashes the serial number of the server based on the preset server information. Value verification can verify whether the server deployed by the authorization system is the correct server, so that the authorization system can only be deployed on the correct server. If the server passes the verification, it will then verify the terminal serial number of the POS machine that the client accesses the authorization system based on the preset terminal whitelist information that passes the verification. If the terminal serial number passes the verification, the POS machine will be granted security permissions, which can ensure the authorization system. Only authorize POS machines that can be authorized, thereby strictly controlling the security of POS machine authorization and preventing illegal authorization by the authorization system.

It can be understood that the beneficial effects of the above-mentioned second aspect, third aspect and fourth aspect can be referred to the relevant description in the above-mentioned first aspect, and will not be described again here.

Description of the drawings

In order to more clearly explain the specific embodiments of the present application or the technical solutions in the prior art, the drawings needed to be used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings in the following description The drawings illustrate some embodiments of the present application. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without exerting creative efforts.

Figure 1 is a schematic flowchart of the first POS machine security authorization deployment method provided by the embodiment of the present application;

Figure 2 is a second flow schematic diagram of the POS machine security authorization deployment method provided by the embodiment of the present application;

Figure 3 is a third flow diagram of the POS machine security authorization deployment method provided by the embodiment of the present application;

Figure 4 is a schematic flow diagram of the fourth POS machine security authorization deployment method provided by the embodiment of the present application;

Figure 5 is a schematic structural diagram of a POS machine security authorization deployment device provided by an embodiment of the present application.

Detailed ways

In the following description, for the purpose of explanation rather than limitation, specific details such as specific system structures and technologies are provided to provide a thorough understanding of the embodiments of the present application. However, it will be apparent to those skilled in the art that the present application may be practiced in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, devices, circuits, and methods are omitted so as not to obscure the description of the application with unnecessary detail.

It will be understood that, when used in this specification and the appended claims, the term "comprising" indicates the presence of the described features, integers, steps, operations, elements and/or components but does not exclude one or more other The presence or addition of features, integers, steps, operations, elements, components and/or collections thereof.

It will also be understood that the term "and/or" as used in this specification and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

As used in this specification and the appended claims, the term "if" may be interpreted as "when" or "once" or "in response to determining" or "in response to detecting" depending on the context. ". Similarly, the phrase "if determined" or "if [the described condition or event] is detected" may be interpreted, depending on the context, to mean "once determined" or "in response to a determination" or "once the [described condition or event] is detected ]" or "in response to detection of [the described condition or event]".

Reference in this specification to "one embodiment" or "some embodiments" or the like means that a particular feature, structure or characteristic described in connection with the embodiment is included in one or more embodiments of the application. Therefore, the statements "in one of the embodiments", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. appearing in different places in this specification are not Reference is necessarily to the same embodiment, but rather to "one or more but not all embodiments" unless otherwise specifically emphasized. The terms “including,” “includes,” “having,” and variations thereof all mean “including but not limited to,” unless otherwise specifically emphasized. "Multiple" means "two or more".

At present, with the widespread use of POS machines, electronic social consumption settlement is becoming increasingly mature, and fierce market competition has also brought numerous financial risks. When the customer's POS machine is undergoing some disassembly and maintenance, system settings, and security-related changes, it must be granted security permissions through the authorization system before it can be operated. The authorization system can be independently deployed on the server by the customer, but some customers may deploy the authorization system at will, or use the authorization system to authorize POS machines that cannot be authorized originally, resulting in illegal authorization by the authorization system and affecting the security of POS machine authorization.

In response to the above problems, embodiments of the present application provide a POS machine security authorization deployment method, which is applied to the server side. This method obtains the server serial number hash value, preset server information and preset terminal information, based on the server serial number hash value. The Greek value and the preset server information determine the first verification result of the server. If the first verification result meets the first preset condition, the second verification result of the preset terminal information is determined based on the preset server information and the preset terminal information. If the first verification result satisfies the first preset condition, the second verification result of the preset terminal information is determined. The second verification result meets the second preset condition, and the terminal serial number transmitted by the client is received. If the terminal serial number and the preset terminal information meet the third preset condition, the client is granted security permissions, which enables the authorization system to be deployed only in the correct location. On the server, it can also ensure that the authorization system only authorizes POS machines that can be authorized, avoiding illegal authorization by the authorization system and improving the security of POS machine authorization.

The following is an exemplary description of the POS machine security authorization deployment method provided by this application in conjunction with specific embodiments.

As shown in Figure 1, the POS machine security authorization deployment method provided by this embodiment is applied to the server side and includes:

S100: Obtain the server serial number hash value, preset server information and preset terminal whitelist information.

In applications, when the customer's POS machine needs authorization for disassembly and maintenance, system settings, and security-related modification operations, the POS machine production company can first connect the encryption machine, also known as the authorization machine, to the customer's server so that When deploying the authorization system to the customer's server, the server may be a server based on a Windows environment. Then the customer connects the POS machine that needs authorization to his own terminal device such as a computer, and uses the authorization tool in the terminal device to access the authorization system in the above server through the Internet. The authorization tool is a desktop tool. After unzipping, double-click the corresponding exe file can be run. The server and encryption machine constitute the server side, and the POS machine and terminal equipment constitute the client side.

In the application, in order to ensure that the authorization system is deployed on the correct server and that the authorization system is connected to a POS machine that can be authorized, server verification and terminal serial number verification of the POS machine can be performed. When the authorization system is started, the server serial number hash value, preset server information and preset terminal whitelist information are obtained. The above server serial number hash value can be the CPU serial number of the server deployed by the authorization system for hash processing. After the hash value, the above-mentioned preset server information can be information about the server that the authorization system can deploy, that is, the correct server. The above-mentioned preset terminal whitelist information can be information about the POS machines that the authorization system can authorize.

In the application, when deploying the authorization system, the above-mentioned preset server information and the above-mentioned preset terminal whitelist information can be deployed to the server in the form of files following the authorization system, and specifically stored in a designated directory in the authorization system deployment file, so that The server and terminal serial numbers will be verified later.

S200. Determine the first verification result of the server based on the server serial number hash value and preset server information.

In the application, to ensure that the authorization system is deployed on the correct server, the server where the authorization system is deployed can be verified. Determining the first verification result of the server based on the hash value of the server serial number and the preset server information may include verifying the hash value of the server serial number through the preset server information, thereby determining the first verification result of the server.

In one embodiment, the preset server information includes first preset client information, a hash value of the preset server serial number, and first signature information. The first signature information is a pair of the first preset client information and the preset server information based on a private key. Let the server serial number hash value be used to sign the information respectively.

In the application, the above-mentioned preset server serial number hash value can be the hash value of the CPU serial number of the server that can be deployed by the authorized system. In order to prevent the attacker from easily deducing the relevant information, the server can be The CPU serial number is hashed. The above-mentioned first preset client information can be the client information of the server corresponding to the hash value of the above-mentioned preset server serial number, that is, the correct client information that the authorization system can authorize. The above-mentioned first signature information It can be the signature information obtained by using the private key of the POS machine production company to sign the above-mentioned first preset customer information and the above-mentioned preset server serial number hash value. The specific signing process is to first combine the first preset customer information and the preset server serial number hash value. The hash value of the server serial number is sent to the terminal of the POS machine production company. After the operator uses the private key in the encryption machine of the POS machine production company to sign, the signature information is sent to the server for authorization deployment.

As shown in Figure 2, based on the server serial number hash value and preset server information, the first verification result of the server is determined, including:

S210. Determine the first signature verification result based on the public key and the first signature information.

In an application, in order to prevent the above-mentioned preset server information from being tampered with, the above-mentioned first signature information can be verified when the authorization system is started. The above-mentioned determination of the first signature verification result based on the public key and the first signature information may be to call the public key stored in the authorization system to verify the first signature information in the above-mentioned preset server information, thereby determining the above-mentioned first signature verification result. If the above-mentioned preset server information is tampered with, the above-mentioned first signature verification result will fail. If the above-mentioned preset server information is not tampered with, the above-mentioned first signature verification result will pass.

S220. Determine the first comparison result of the server based on the server serial number hash value and the preset server serial number hash value.

In the application, when the authorization system is started, in order to verify whether the server deployed by the authorization system is the correct server, after obtaining the hash value of the above-mentioned server serial number, the above-mentioned server serial number can be hashed through the above-mentioned preset server information. The expected value is verified. Determining the first comparison result of the server based on the hash value of the server serial number and the hash value of the preset server serial number may be to compare the hash value of the server serial number with the hash value of the preset server serial number, thereby Determine the first comparison result above. If the hash value of the above-mentioned server serial number and the hash value of the above-mentioned preset server serial number are the same, then the above-mentioned first comparison result passes. If the hash value of the above-mentioned server serial number and the hash value of the above-mentioned preset server serial number are not the same, then The above first comparison result failed.

S230. Based on the first signature verification result and the first comparison result, determine the first verification result of the server.

In the application, the above-mentioned first verification result of the server is determined based on the first signature verification result and the first comparison result, which may be the first signature verification result based on the above-mentioned first signature information, and the above-mentioned server serial number hash value and the above-mentioned The first comparison result of the preset server serial number hash value determines the first verification result of the server.

In one embodiment, the first preset condition is that both the first verification result and the first comparison result pass, that is, the preset server information has not been tampered with, and the hash value of the server serial number and the preset Assume that the server serial number hash values are the same.

In one embodiment, after determining the first verification result of the server based on the first signature verification result and the first comparison result, the method further includes: if the first verification result satisfies the first preset condition, converting the first preset customer information to Stored to the server.

In the application, if the above-mentioned first verification result satisfies the above-mentioned first preset condition, it means that the server deployed by the authorization system is the correct server and the server verification passes. If the first verification result satisfies the first preset condition, the first preset client information is stored in the server. After the server passes the verification, the first preset client information is written into the memory of the server. Configured in the server, it indicates that the above-mentioned first preset customer information is the information of the correct customer.

S300. If the first verification result satisfies the first preset condition, determine the second verification result of the preset terminal whitelist information based on the preset server information and the preset terminal whitelist information.

In the application, if the above-mentioned first verification result satisfies the above-mentioned first preset condition, it means that the server deployed by the authorization system is the correct server and the server has passed the verification. Then the terminal serial number of the POS machine connected to the authorization system can be verified. verify. Before verifying the terminal serial number, it is necessary to verify whether the above preset terminal whitelist information is the correct customer's own preset terminal whitelist information. The second verification result for determining the preset terminal whitelist information based on the preset server information and the preset terminal whitelist information may be to verify the preset terminal whitelist through the first preset client information in the preset server information. The information is verified to determine the second verification result of the above-mentioned preset terminal whitelist information.

In one embodiment, the preset terminal whitelist information includes second preset customer information, a preset terminal serial number list, and second signature information. The second signature information is a pair of the second preset customer information and the preset terminal information based on a private key. Assume that the terminal serial number list is the signed information respectively.

In an application, the above-mentioned preset terminal serial number list may be a list of terminal serial numbers of POS machines that can be authorized by the authorization system, and the above-mentioned second preset customer information may be a list of POS machines corresponding to the above-mentioned preset terminal serial number list. Customer information. The above-mentioned signing of the second preset customer information and the preset terminal serial number list based on the private key may be done by using the private key of the POS machine production company to haw the second preset customer information and the preset terminal serial number list. The processed hash values are signed separately. The specific signing process is to first send the second preset customer information and the preset terminal serial number list to the terminal of the POS machine production company, and wait for the operator to use the encryption machine of the POS machine production company. After signing with the private key, the signature information is sent to the server for authorization deployment. The above-mentioned preset terminal whitelist information can be directly read into the memory of the server when the authorization system is started, preventing other customers from maliciously tampering with the above-mentioned preset terminal whitelist information.

As shown in Figure 3, if the first verification result meets the first preset condition, the second verification result of the preset terminal whitelist information is determined based on the preset server information and the preset terminal whitelist information, including:

S310. If the first verification result meets the first preset condition, determine the second signature verification result based on the public key and the second signature information.

In an application, in order to prevent the above-mentioned preset terminal whitelist information from being tampered with, the above-mentioned second signature information can be verified when the authorization system is started. Determining the second signature verification result based on the public key and the second signature information may involve calling the public key stored in the authorization system to verify the second signature information in the preset terminal whitelist information, thereby determining the second signature verification result. Verification results. If the above-mentioned preset terminal whitelist information is tampered with, the above-mentioned second signature verification result will fail. If the above-mentioned preset terminal whitelist information has not been tampered with, the above-mentioned second signature verification result will pass.

S320. Based on the first preset customer information and the second preset customer information, determine the second comparison result of the customer information.

In the application, before performing terminal serial number verification, in order to verify whether the above-mentioned preset terminal whitelist information is the correct customer's own preset terminal whitelist information, the first preset customer information in the above-mentioned preset server information can be used to verify The second preset customer information in the above preset terminal whitelist information is verified. The above-mentioned second comparison result of determining the customer information based on the first preset customer information and the second preset customer information may be to compare the above-mentioned first preset customer information and the above-mentioned second preset customer information to determine the customer information. The second comparison result. If the first preset customer information and the second preset customer information are the same, the second comparison result is passed. If the first preset customer information and the second preset customer information are not the same, the second comparison result is passed. The result is not passed.

S330. Based on the second signature verification result and the second comparison result, determine the second verification result of the preset terminal whitelist information.

In an application, the above-mentioned second verification result for determining the preset terminal information based on the second signature verification result and the second comparison result may be the second signature verification result based on the above-mentioned second signature information, and the above-mentioned first preset customer The second comparison result between the information and the above-mentioned second preset customer information determines the second verification result of the preset terminal whitelist information.

In one embodiment, the above-mentioned second preset condition is that the above-mentioned second signature verification result and the above-mentioned second comparison result both pass, that is, the above-mentioned preset terminal whitelist information has not been tampered with, and the above-mentioned first preset customer information and The above second preset customer information is the same.

In one embodiment, after determining the second verification result of the preset terminal whitelist information based on the second signature verification result and the second comparison result, the method further includes: if the second verification result satisfies the second preset condition, the preset terminal whitelist information is determined. Assume that the terminal serial number list is stored in the server.

In the application, since the above-mentioned first preset customer information has been determined to be the information of the correct customer, if the above-mentioned second verification result satisfies the above-mentioned second preset condition, it means that the above-mentioned preset terminal whitelist information is the correct customer himself. The preset terminal whitelist information of the above preset terminal whitelist information is verified and passed. If the second verification result satisfies the second preset condition, storing the preset terminal serial number list on the server side may include, after the preset terminal whitelist information is verified, passing the preset terminal whitelist information. The terminal serial number list is written into the server's memory for subsequent verification of the terminal serial number. By verifying the preset terminal whitelist information, customers can only use their own preset terminal serial number list for terminal serial number verification, preventing customers from maliciously using other customers' preset terminal serial number lists.

S400. If the second verification result meets the second preset condition, receive the terminal serial number sent by the client.

In the application, if the above-mentioned second verification result satisfies the above-mentioned second preset condition, it means that the above-mentioned preset terminal whitelist information is the correct customer's own preset terminal information, and the above-mentioned preset terminal whitelist information passes the verification. At this time, you can Use the preset terminal serial number list in the above preset terminal whitelist information to verify the terminal serial number of the POS machine where the client accesses the authorization system. The above terminal serial number may be the SN (Serial Number) number of the POS machine.

S500. If the terminal serial number and the preset terminal whitelist information meet the third preset condition, grant the client security permission.

In the application, in order for the authorization system to authorize only POS machines that can be authorized, the terminal serial number of the POS machine that the client accesses the authorization system can be verified through the above-mentioned preset terminal whitelist information, and the above-mentioned terminal serial number can be determined. Whether the above-mentioned preset terminal whitelist information satisfies the third preset condition, and if so, the client is granted POS machine security permission to access the authorization system.

As shown in Figure 4, if the terminal serial number and the preset terminal whitelist information meet the third preset condition, the client is granted security permissions, including:

S510. Based on the third comparison result of the terminal serial number and the preset terminal whitelist information, determine the third verification result of the terminal serial number.

In the application, the above-mentioned third verification result for determining the terminal serial number based on the third comparison result of the terminal serial number and the preset terminal whitelist information may be the terminal serial number of the POS machine that the client accesses the authorization system and the above-mentioned The preset terminal whitelist information is compared to obtain the above third comparison result, and the third verification result of the terminal serial number is determined based on the above third comparison result.

In one embodiment, the above-mentioned third verification result of determining the terminal serial number based on the third comparison result of the terminal serial number and the preset terminal whitelist information includes: a third verification result based on the terminal serial number and the preset terminal serial number list. Compare the results to determine the third verification result of the terminal serial number; the third preset condition is that the terminal serial number is included in the preset terminal serial number list.

In the application, the above-mentioned third verification result for determining the terminal serial number based on the third comparison result of the terminal serial number and the preset terminal serial number list may be the terminal serial number of the POS machine that the client accesses the authorization system and the above-mentioned The preset terminal serial number list in the preset terminal whitelist information is compared to obtain the above third comparison result, and the third verification result of the terminal serial number is determined based on the above third comparison result.

S520. If the third verification result meets the third preset condition, grant the client security permission.

In the application, if the above-mentioned third verification result meets the above-mentioned third preset condition, it means that the terminal serial number of the POS machine of the client accessing the authorization system is included in the above-mentioned preset terminal serial number list, and the client accesses the authorization system. The POS machine is a POS machine that can be authorized, and the authorization system can authorize the security permissions of the POS machine. If the above-mentioned terminal serial number and the above-mentioned preset terminal whitelist information do not meet the third preset condition, it means that the terminal serial number of the POS machine of the client accessing the authorization system is not included in the above-mentioned preset terminal serial number list, and the client POS machines connected to the authorization system are POS machines that cannot be authorized, and the authorization system does not grant security permissions to POS machines.

Specifically, in the POS authorization usage scenario, the authorization system can be a web system running on a Windows server. The administrator can deploy the authorization system to the customer's server and operate the authorization system through the browser. When the customer's POS machine needs to be authorized for security permissions, the customer can connect the POS machine to his own terminal device such as a computer, and then use the authorization tool in the terminal device to access the authorization system through the Internet. When the authorization system is deployed on the customer's server, it can verify whether the server deployed by the authorization system is the correct server by obtaining the server's serial number hash value and verifying the server serial number hash value based on the preset server information. This allows the authorization system to be deployed only on the correct server. If the server passes the verification, it will then verify the terminal serial number of the POS machine that the customer accesses the authorization system based on the preset terminal whitelist information that passes the verification. If the terminal serial number passes the verification, the POS machine will be granted security permissions, which can ensure that the authorization system only Authorize POS machines that can be authorized to strictly control the security of POS machine authorization and prevent illegal authorization by the authorization system.

The embodiment of the present application also provides a POS machine security authorization deployment method, which is applied to the client, including: sending the terminal serial number to the server; if the terminal serial number and the preset terminal whitelist information meet the third preset condition, obtain Security permissions granted by the server.

It should be noted that the above-mentioned POS machine security authorization deployment method applied to the client is based on the same concept as the above-mentioned POS machine security authorization deployment method applied to the server side. For details of its specific functions and technical effects, please refer to the above-mentioned application. The server-side POS machine security authorization deployment method embodiment part will not be described again here.

The following is an exemplary description of the POS machine security authorization deployment device provided by this application in conjunction with the accompanying drawings.

Corresponding to the POS machine security authorization deployment method described in the above embodiment, as shown in Figure 5, this embodiment provides a POS machine security authorization deployment device, which is applied to the server side. The POS machine security authorization deployment device 500 includes :

The information acquisition module 510 is used to obtain the server serial number hash value, preset server information and preset terminal whitelist information;

The first verification module 520 is used to determine the first verification result of the server based on the server serial number hash value and preset server information;

The second verification module 530 is configured to determine the second verification result of the preset terminal whitelist information based on the preset server information and the preset terminal whitelist information if the first verification result satisfies the first preset condition;

The sequence receiving module 540 is configured to receive the terminal serial number transmitted by the client if the second verification result meets the second preset condition;

The third verification module 550 is used to grant security permission to the client if the terminal serial number and the preset terminal whitelist information meet the third preset condition.

In one embodiment, the first verification module includes:

The first signature verification unit is used to determine the first signature verification result based on the public key and the first signature information;

The first comparison unit is used to determine the first comparison result of the server based on the server serial number hash value and the preset server serial number hash value;

The first verification unit is used to determine the first verification result of the server based on the first signature verification result and the first comparison result.

In one embodiment, the POS machine security authorization deployment device also includes:

The first storage module is used to store the first preset customer information to the server if the first verification result satisfies the first preset condition.

In one embodiment, the second verification module includes:

The second signature verification unit is used to determine the second signature verification result based on the public key and the second signature information if the first verification result meets the first preset condition;

a second comparison unit configured to determine a second comparison result of customer information based on the first preset customer information and the second preset customer information;

The second verification unit is configured to determine the second verification result of the preset terminal whitelist information based on the second signature verification result and the second comparison result.

In one embodiment, the POS machine security authorization deployment device also includes:

The second storage module is used to store the preset terminal serial number list to the server if the second verification result satisfies the second preset condition.

In one embodiment, the third verification module includes:

The third comparison unit is configured to determine the third verification result of the terminal serial number based on the third comparison result of the terminal serial number and the preset terminal whitelist information;

The permission granting unit is used to grant security permission to the client if the third verification result meets the third preset condition.

In one embodiment, the third comparison unit is specifically configured to determine the third verification result of the terminal serial number based on the third comparison result of the terminal serial number and the preset terminal serial number list.

It should be noted that the information interaction, execution process, etc. between the above-mentioned modules/units are based on the same concept as the method embodiments of this application, and their specific functions and technical effects can be found in the method embodiments section. No further details will be given.

Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above functional units and modules is used as an example. In actual applications, the above functions can be allocated to different functional units and modules according to needs. Module completion means dividing the internal structure of the device into different functional units or modules to complete all or part of the functions described above. Each functional unit and module in the embodiment can be integrated into one processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be hardware-based. It can also be implemented in the form of software functional units. In addition, the specific names of each functional unit and module are only for the convenience of distinguishing each other and are not used to limit the scope of protection of the present application. For the specific working processes of the units and modules in the above system, please refer to the corresponding processes in the foregoing method embodiments, and will not be described again here.

Embodiments of the present application also provide a computer-readable storage medium. The computer-readable storage medium stores a computer program. When the computer program is executed by a processor, the steps in each of the above method embodiments can be implemented.

This application implements all or part of the processes in the above embodiment method, which can be completed by instructing relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When executed by the processor, the computer program can Implement the steps of each of the above method embodiments. Wherein, the computer program includes computer program code, which may be in the form of source code, object code, executable file or some intermediate form. The computer-readable medium may at least include: any entity or device capable of carrying computer program code to a terminal device, a recording medium, a computer memory, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), electrical carrier signals, telecommunications signals, and software distribution media. For example, U disk, mobile hard disk, magnetic disk or CD, etc.

In the above embodiments, each embodiment is described with its own emphasis. For parts that are not detailed or documented in a certain embodiment, please refer to the relevant descriptions of other embodiments.

Those of ordinary skill in the art will appreciate that the devices and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each specific application, but such implementations should not be considered beyond the scope of this application.

In the embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only illustrative. On the other hand, the coupling or direct coupling or communication connection between the devices shown or discussed may be through some interfaces, and the indirect coupling or communication connection of the device may be electrical. sexual, mechanical or other form.

The above-described embodiments are only used to illustrate the technical solutions of the present application, but not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still implement the above-mentioned implementations. The technical solutions described in the examples are modified, or some of the technical features are equivalently replaced; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions in the embodiments of this application, and should be included in within the protection scope of this application.

Claims (10)

1. The POS machine safety authorization deployment method is characterized by being applied to a server side and comprising the following steps:

obtaining a server serial number hash value, preset server information and preset terminal white list information;

determining a first verification result of the server based on the server serial number hash value and the preset server information;

if the first verification result meets a first preset condition, determining a second verification result of the preset terminal white list information based on the preset server information and the preset terminal white list information;

if the second verification result meets a second preset condition, receiving a terminal serial number transmitted by the client;

And if the terminal serial number and the preset terminal white list information meet a third preset condition, granting the security authority to the client.

2. The POS machine security authorization deployment method of claim 1, wherein the preset server information includes first preset client information, a preset server serial number hash value, and first signature information, the first signature information being information obtained by respectively signing the first preset client information and the preset server serial number hash value based on a private key;

the determining a first verification result of the server based on the server serial number hash value and the preset server information includes:

determining a first signature verification result based on the public key and the first signature information;

determining a first comparison result of the server based on the server serial number hash value and the preset server serial number hash value;

determining a first verification result of the server based on the first verification result and the first comparison result;

the first preset condition is that the first signature verification result passes, and the first comparison result is that the server serial number hash value is the same as the preset server serial number hash value.

3. The authorization verification method according to claim 2, wherein after determining the first verification result of the server based on the first verification result and the first comparison result, further comprising:

and if the first verification result meets the first preset condition, storing the first preset client information to the server side.

4. The POS machine security authorization deployment method according to claim 2, wherein the preset terminal whitelist information includes second preset client information, a preset terminal serial number list, and second signature information, the second signature information being information obtained by respectively signing the second preset client information and the preset terminal serial number list based on a private key;

if the first verification result meets a first preset condition, determining a second verification result of the preset terminal whitelist information based on the preset server information and the preset terminal whitelist information, including:

if the first verification result meets a first preset condition, determining a second signature verification result based on a public key and the second signature information;

determining a second comparison result of the client information based on the first preset client information and the second preset client information;

Determining a second verification result of the preset terminal white list information based on the second signature verification result and the second comparison result;

the second preset condition is that the second signature verification result passes and the second comparison result is that the first preset client information and the second preset client information are the same.

5. The authorization verification method according to claim 4, wherein after determining the second verification result of the preset terminal whitelist information based on the second verification result and the second comparison result, further comprising:

and if the second verification result meets the second preset condition, storing the preset terminal serial number list to the server side.

6. The POS security authorization deployment method of claim 4, wherein granting the client security rights if the terminal serial number and the preset terminal whitelist information satisfy a third preset condition comprises:

determining a third verification result of the terminal serial number based on a third comparison result of the terminal serial number and the preset terminal white list information;

and if the third verification result meets the third preset condition, granting the client security authority.

7. The POS security authorization deployment method of claim 6, wherein determining a third verification result of the terminal serial number based on a third comparison result of the terminal serial number and the preset terminal whitelist information comprises:

determining a third verification result of the terminal serial number based on a third comparison result of the terminal serial number and the preset terminal serial number list;

the third preset condition is that the terminal serial number is contained in the preset terminal serial number list.

8. The POS machine safety authorization deployment method is characterized by being applied to a client and comprising the following steps:

transmitting the terminal serial number to a server side;

and if the terminal serial number and the preset terminal white list information meet a third preset condition, acquiring the security authority granted by the server side.

9. The POS machine safety authorization deployment device is characterized by being applied to a server side and comprising:

the information acquisition module is used for acquiring a server serial number hash value, preset server information and preset terminal white list information;

the first verification module is used for determining a first verification result of the server based on the server serial number hash value and the preset server information;

The second verification module is used for determining a second verification result of the preset terminal white list information based on the preset server information and the preset terminal white list information if the first verification result meets a first preset condition;

the sequence receiving module is used for receiving the terminal serial number transmitted by the client if the second verification result meets a second preset condition;

and the third verification module is used for granting the client security authority if the terminal serial number and the preset terminal white list information meet a third preset condition.

10. A computer readable storage medium storing a computer program, wherein the computer program when executed by a processor implements the POS security authorization deployment method of any one of claims 1 to 7.