WO2018033016A1

WO2018033016A1 - Method and system for authorizing conversion of terminal state

Info

Publication number: WO2018033016A1
Application number: PCT/CN2017/096834
Authority: WO
Inventors: 陈菲菲; 孟陆强
Original assignee: 福建联迪商用设备有限公司
Priority date: 2016-08-18
Filing date: 2017-08-10
Publication date: 2018-02-22
Also published as: CN106330877B; CN106330877A

Abstract

The present invention relates to the technical field of communications. Provided are a method and system for authorizing conversion of a terminal state. The method for authorizing conversion of a terminal state mainly comprises: a server obtains an authentication account, and determines whether the authentication account has a conversion authority; if yes, the server obtains terminal information and to-be-authenticated data from a terminal; the server encrypts, by using an authentication private key, the to-be-authenticated data so as to generate authentication data, and sends the authentication data to the terminal; and the terminal authenticates the authentication data, and converts a terminal state if the authentication is successful. An application developer can log in by using an authorized account and directly converts a terminal between a using state and a debugging state; the method and the system are simple and convenient, and greatly help the application developer in debugging.

Description

Method and system for authorizing conversion of terminal status

Technical field

The present invention relates to the field of communications technologies, and in particular, to a method and system for authorizing the transition of a terminal state.

Background technique

With the Internetization of the financial industry, the requirements for payment security in the financial payment field are getting higher and higher. In the prior art, in order to ensure the legitimacy of the program on the terminal device, the terminal needs to introduce a digital signature scheme, which is preset in the terminal. The root public key certificate can be downloaded to the terminal only by the program signed with the private key corresponding to the work public key certificate of the root public key certificate.

When the terminal is in normal use, the program downloaded to the terminal must be signed, which is greatly inconvenient for application developer debugging. In order to facilitate application developer debugging, the terminal has a debugging state, and the application can be downloaded to the terminal without signing.

Summary of the invention

To this end, it is necessary to provide a method for authorizing the transition of the terminal state, which is used to solve the switchover between the debug state and the use state of the terminal, and the terminal state can be modified by the authorized account.

In order to achieve the above object, the inventor provides a method for authorizing the conversion of the state of the terminal, and the technical solution is as follows:

A method for authorizing a transition of a terminal state, wherein the server obtains an authentication account, and the server determines whether the authentication account has a conversion authority; if yes, the server obtains terminal information and data to be authenticated from the terminal; The authentication data is encrypted by using the authentication private key to generate authentication data, and the server sends the authentication data to the terminal; the terminal authenticates the authentication data, and if the authentication passes, the terminal status is converted.

Further, the terminal state includes a usage state and a debug state, and the terminal does not save the application and the key in the usage state and the debug state; the terminal switches from the usage state to the debug state, and the terminal clears the key of the terminal in the usage state. The terminal switches from the debug state to the use state, and the terminal clears the application and the key of the terminal in the debug state.

Further, when the terminal determines that the terminal is in the debug state, the terminal pops up the prompt that the terminal is in the debug state.

Further, the prompt includes: displaying, by the terminal, a watermark or popping up an alert box every preset time interval.

Further, the terminal information is a terminal serial number, and the to-be-certified data is a combination of a terminal motherboard serial number and a random number.

The beneficial effects of the present invention are: when the program developer wants to debug the terminal or some applications, the program developer can log in with the authorized account, and directly realize the conversion between the use state and the debug state of the terminal. Simple and convenient, it greatly helps the application developer to debug, and the account needs to be converted before the server is authenticated. It is ensured that the operation of the terminal state transition is a legal action approved by the server, and after the program developer has finished debugging, the terminal can be returned to the use state in time, and the security of the terminal is also ensured.

In order to achieve the above object, the inventor also provides a system for authorizing the conversion of the state of the terminal, and the technical solution is as follows:

A system for authorizing a terminal status conversion, characterized in that an account authentication module is used for a server to obtain an authentication account, and the server determines whether the authentication account has a conversion authority, and if so, the server obtains terminal information and waits from the terminal. The authentication data is used by the server to encrypt the data to be authenticated by using the authentication private key to generate authentication data, the server sends the authentication data to the terminal, and the state conversion module is configured to perform the authentication data on the terminal. Authentication, if the authentication is passed, the terminal status is converted.

Further, the state transition module is further configured to: the terminal state includes a usage state and a debug state, the terminal does not save the application and the key in the usage state and the debug state; and the terminal switches from the usage state to the debugging The terminal clears the key of the terminal in the use state; the terminal switches from the debug state to the use state, and the terminal clears the application and the key of the terminal in the debug state.

DRAWINGS

1 is a flowchart of a method for authorizing conversion of a terminal state according to the present invention;

2 is a block diagram of a system for authorizing a state transition of a terminal according to the present invention.

Description of the reference signs:

20, system,

201, server,

202, terminal,

2010, account authentication module,

2011, information encryption module,

2020, state conversion module.

detailed description

The detailed description of the technical content, structural features, and the objects and effects of the technical solutions will be described in detail below with reference to the specific embodiments and the accompanying drawings.

Referring to FIG. 1 , in this embodiment, a state transition tool is used to change the state of the terminal. The state transition tool includes: a server interaction module and a terminal interaction module, where the terminal interaction module is used on the terminal, and is mainly used to obtain information from the terminal. And sending information to the terminal, wherein the server interaction module is on the server, and is mainly used to obtain information from the server and send information to the server.

Specific steps are as follows:

Step S101: Log in using the account password; first, the terminal device and the server are to be networked. Secondly, in this embodiment, a specific APP is installed on the terminal device. In the APP login interface, the application developer needs to input the account password to log in to the system; Password login system, the server will make permission judgment on the account password to ensure the legality of the account.

In other embodiments, the specific URL can also be directly input through the browser, and the application developer is required to input the account password to log in to the system;

The server stores all valid account passwords, as well as the permissions corresponding to those accounts.

Therefore, in step S102, the server determines whether the account has the authority to switch the terminal state. The specific steps are as follows: the application developer inputs the account password, and the server obtains the account password input by the application developer, and determines whether the account password is stored in the server. If it is stored in the server, the application developer successfully logs in to the system, and the server further obtains the authority of the account to determine whether the account has permission to switch the terminal status. The authority to authenticate the account and password through the server ensures the legality of subsequent state transitions.

If there is a permission to switch the terminal status, proceed to step S103: the server obtains the terminal information and the data to be authenticated from the terminal; if the server determines that the account has the right to switch the terminal status, the terminal interaction module acquires the terminal information and the to-be-authenticated from the terminal. Data, the terminal information refers to a terminal serial number, and the data to be authenticated is a serial number of the motherboard and a random number, wherein the serial number of the motherboard of each terminal is unique. In this embodiment, the random number is a random number of 16 bytes. In other embodiments, the random number can be other The number of letters or characters can be used. The server interaction module sends the data to the server. The uniqueness of the data to be authenticated is ensured by using a combination of the motherboard serial number and the random number having the uniquely identified terminal.

In step S104, the server authenticates the terminal information and generates authentication data. After the terminal obtains the terminal information, the server determines the legality of the terminal information, and after determining that it is legal, the server uses the authentication private key to authenticate. The data is encrypted, the authentication data is generated, and the authentication data is sent to the server interaction module. By using the private key to encrypt the authentication data, it is ensured that the generated authentication data is not intercepted by other illegal persons in the process of data transmission, and it is impersonated as a legitimate server to deceive the terminal and cause security problems.

In this embodiment, because the security requirements are relatively high, because the public key used by each terminal is different, when the server judges the terminal information, it not only judges its legitimacy, but also according to The terminal information encrypts the authentication data using a private key corresponding to the terminal.

In some other embodiments, the public key used by each terminal is the same for convenience and versatility, so the server only needs to judge the legitimacy of the terminal information, and the server uses the universal private key. Encrypt the authentication data.

In step S105, the server sends the generated authentication data to the terminal, and the terminal interaction module sends the authentication data to the terminal.

Step S106: The terminal authenticates the authentication data. The authentication on the side refers to the terminal obtaining the plaintext by decrypting the received authentication data, and comparing the plaintext with the data to be authenticated by the terminal. If the same, the server passes the same. The authentication of the terminal is approved by the terminal, and the account recognized by the server can be converted to the state of the terminal. The specific authentication step is as follows: the terminal decrypts the authentication data by using the public key, because the server uses the private key corresponding to the terminal to encrypt the authentication data, so the terminal can decrypt successfully, and after decryption succeeds, determine whether the decrypted data is successful. It is the data to be authenticated of the terminal. If yes, the authentication is passed.

After the authentication is passed, in step S107, the terminal can be switched to the state; the terminal interaction module sends the state to be converted to the terminal, and the terminal switches to the corresponding state. Send through the terminal interaction module The state of the change is given to the terminal, the whole process is transparent to the application developer, and the conversion process is automatically completed, which greatly improves the state transition speed and facilitates the application developer. In this embodiment, in order to ensure security, after the terminal transitions from the debug state to the use state, the application and the key on the device are all cleared; similarly, the terminal is dense from the use state to the debug state. The keys will also be cleared completely.

In some embodiments, when the terminal transitions from the usage state to the debug state, security is ensured in order to prevent the user from entering a personal PIN on it. The interface of the debug state is obviously different from the state of use. In the debug state, a warning box or a watermark pops up every few seconds to prompt the user that the terminal is in the debug state, so that the user does not input the personal PIN on the terminal.

Referring to FIG. 2, in some embodiments, a scheme for authorizing a system for converting a terminal state is as follows:

The system includes 20: a server 201 and a terminal 202, the server 201 includes an account authentication module 2010 and an information encryption module 2011, and the terminal 202 includes a state conversion module 2020, wherein

Account Authentication Module 2010:

It is used by the application developer to install a specific APP on the terminal device. In the APP login interface, the application developer uses the account password to log in to the system, and logs in to the system through the account password. The server will determine the account password and ensure the account. legality.

The server stores all legal account passwords, and also includes the rights corresponding to the accounts. The application developer inputs the account password, and the server obtains the account password input by the application developer, and determines whether the account password is stored in the server. Stored in the server, the application developer successfully logs in to the system, and the server further obtains the authority of the account to determine whether the account has permission to switch the terminal status. The subsequent authentication is ensured by the server's authority authentication of the account password. The legality of the conversion. If yes, the terminal interaction module obtains the terminal information and the data to be authenticated from the terminal, where the terminal information refers to the terminal serial number, and the data to be authenticated is the serial number of the motherboard and the random number, wherein the serial number of the motherboard of each terminal is unique. In this embodiment, the random number is a 16-byte random number. In other embodiments, the random number may be a letter or a character of other digits.

The server interaction module sends the data to the server. The uniqueness of the data to be authenticated is ensured by using a combination of the motherboard serial number and the random number having the uniquely identified terminal.

Information Encryption Module 2011:

The server authenticates the terminal information and generates authentication data. After the server obtains the terminal information, it determines the legality of the terminal information, and determines that it is legal. The server then uses the authentication private key to encrypt the authentication data. The data is authenticated and the authentication data is sent to the server interaction module. By using the private key to encrypt the authentication data, it is ensured that the generated authentication data is not intercepted by other illegal persons in the process of data transmission, and it is impersonated as a legitimate server to deceive the terminal and cause security problems.

The server sends the generated authentication data to the terminal; the terminal interaction module sends the authentication data to the terminal.

State transition module 2020:

It is used by the terminal to authenticate the authentication data. The authentication on the side refers to the terminal decrypting the received authentication data to obtain the plaintext. If the plaintext is the same as the data to be authenticated, the server passes the terminal. The authentication of the terminal is approved by the terminal, and the account recognized by the server can be converted to the state of the terminal. The specific certification is as follows: the terminal uses public key pair authentication The data is decrypted, because the server uses the private key corresponding to the terminal to encrypt the authentication data, so the terminal can decrypt successfully. After the decryption succeeds, it is determined whether the decrypted data is the data to be authenticated of the terminal, and if so, Then the certification is passed. After the authentication is passed, the terminal can be switched to the terminal; the terminal interaction module sends the state to be converted to the terminal, and the terminal switches to the corresponding state. Through the terminal interaction module to send the state to be converted to the terminal, the whole process is transparent to the application developer, and the conversion process is automatically completed, which greatly improves the state conversion speed and facilitates the application developer. In this embodiment, in order to ensure security, after the terminal transitions from the debug state to the use state, the application and the key on the device are all cleared; similarly, the terminal is dense from the use state to the debug state. The keys will also be cleared completely.

It should be noted that, in this context, relational terms such as first and second are used merely to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply such entities or operations. There is any such actual relationship or order between them. Furthermore, the terms "comprises" or "comprising" or "comprising" or any other variations are intended to encompass a non-exclusive inclusion, such that a process, method, article, or terminal device that includes a plurality of elements includes not only those elements but also Other elements that are included, or include elements inherent to such a process, method, article, or terminal device. An element defined by the phrase "including" or "comprising" does not exclude the presence of additional elements in the process, method, article or terminal device including the element. In addition, in this document, “greater than”, “less than”, “exceeded”, etc. are understood as not including the number; “above”, “below”, “inside”, etc. are understood to include the number.

Those skilled in the art will appreciate that the various embodiments described above can be provided as a method, apparatus, or computer program product. These embodiments may employ an entirely hardware embodiment, an entirely software embodiment, or a junction. In the form of an embodiment of the software and hardware aspects. All or part of the steps involved in the foregoing embodiments may be completed by a program instructing related hardware, and the program may be stored in a storage medium readable by a computer device for executing the method embodiments of the foregoing embodiments. All or part of the steps described. The computer device includes but is not limited to: a personal computer, a server, a general purpose computer, a special purpose computer, a network device, an embedded device, a programmable device, a smart mobile terminal, a smart home device, a wearable smart device, a vehicle smart device, and the like; The storage medium includes, but is not limited to, a RAM, a ROM, a magnetic disk, a magnetic tape, an optical disk, a flash memory, a USB flash drive, a mobile hard disk, a memory card, a memory stick, a network server storage, a network cloud storage, and the like.

The above embodiments are described with reference to flowcharts and/or block diagrams of methods, apparatus (systems), and computer program products according to the embodiments. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a computer device to produce a machine such that instructions executed by a processor of the computer device are generated for implementing one or more blocks or processes in a flow or flow diagram and/or block diagram of the flowchart The device for the function specified in the box.

The computer program instructions can also be stored in a computer device readable memory that can direct the computer device to operate in a particular manner, such that instructions stored in the computer device readable memory produce an article of manufacture comprising the instruction device, the instruction device being implemented in the process Figure One or more processes and/or block diagrams of the functions specified in a block or blocks.

These computer program instructions can also be loaded onto a computer device such that a series of operational steps are performed on the computer device to produce computer-implemented processing, such that instructions executed on the computer device are provided for implementing one or more processes in the flowchart And/or block diagram of the steps of a function specified in a box or blocks.

Although the above embodiments have been described, those skilled in the art can make other changes and modifications to these embodiments once they have learned the basic inventive concept, so the above is only the implementation of the present invention. For example, it is not intended to limit the scope of patent protection of the present invention. The equivalent structure or equivalent flow of the invention in the specification and the drawings is directly or indirectly applied to other related technical fields, and is included in the scope of the patent protection of the present invention.

Claims

A method for authorizing conversion of a terminal state, characterized by comprising the steps of:

The server obtains the authentication account, and the server determines whether the authentication account has a conversion authority;

If yes, the server obtains terminal information and data to be authenticated from the terminal;

The server uses the authentication private key to encrypt the to-be-authenticated data to generate authentication data, and the server sends the authentication data to the terminal.

The terminal authenticates the authentication data, and if the authentication passes, the terminal status is converted.
A method for authorizing conversion of a terminal state according to claim 1, wherein

The terminal status includes a usage state and a debug state, and the terminal does not save the application and the key in the usage state and the debug state;

The terminal switches from the use state to the debug state, and the terminal clears the key of the terminal in the use state;

The terminal switches from the debug state to the use state, and the terminal clears the application and the key of the terminal in the debug state.
The method for authorizing the transition of a terminal state according to claim 2, further comprising the steps of:

When the terminal determines that it is in the debug state, the terminal pops up the prompt that the terminal is in the debug state.
A method for authorizing conversion of a terminal state according to claim 3, characterized in that

The prompt includes: displaying, by the terminal, a watermark or popping up an alert box every preset time interval.
A method for authorizing conversion of a terminal state according to claim 1, wherein

The terminal information is a terminal serial number, and the to-be-certified data is a combination of a terminal motherboard serial number and a random number.
A system for authorizing a transition of a terminal state, characterized in that

The server includes a server and a terminal, and the server includes an account authentication module and an information encryption module, where the terminal includes a state transition module;

An account authentication module, configured to obtain an authentication account by the server, and the server determines whether the authentication account has a conversion authority, and if yes, the server obtains terminal information and data to be authenticated from the terminal;

An information encryption module, configured to: the server uses the authentication private key to encrypt the data to be authenticated to generate authentication data, and the server sends the authentication data to the terminal;

The state conversion module is configured to perform authentication on the authentication data by the terminal, and if the authentication passes, convert the state of the terminal.
A system for authorizing a terminal state transition according to claim 6, wherein

State transition module, also used to:

The terminal status includes a usage state and a debug state, and the terminal does not save the application and the key in the usage state and the debug state;

The terminal switches from the use state to the debug state, and the terminal clears the key of the terminal in the use state;

The terminal switches from the debug state to the use state, and the terminal clears the application and the key of the terminal in the debug state.
A system for authorizing a terminal state transition according to claim 7, wherein

When the terminal determines that it is in the debug state, the terminal pops up the prompt that the terminal is in the debug state.
A system for authorizing a terminal state transition according to claim 8, wherein

The prompt includes: displaying, by the terminal, a watermark or popping up an alert box every preset time interval.
A system for authorizing a terminal state transition according to claim 6, wherein

The terminal information is a terminal serial number, and the to-be-certified data is a combination of a terminal motherboard serial number and a random number.