CN113472749A - Method for preventing unauthorized self-service machine terminal from accessing B/S architecture system - Google Patents

Method for preventing unauthorized self-service machine terminal from accessing B/S architecture system Download PDF

Info

Publication number
CN113472749A
CN113472749A CN202110613682.3A CN202110613682A CN113472749A CN 113472749 A CN113472749 A CN 113472749A CN 202110613682 A CN202110613682 A CN 202110613682A CN 113472749 A CN113472749 A CN 113472749A
Authority
CN
China
Prior art keywords
self
authorization code
service
terminal
machine
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202110613682.3A
Other languages
Chinese (zh)
Inventor
彭荣
王青松
姚源龙
王为选
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Inspur Software Co Ltd
Original Assignee
Inspur Software Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Inspur Software Co Ltd filed Critical Inspur Software Co Ltd
Priority to CN202110613682.3A priority Critical patent/CN113472749A/en
Publication of CN113472749A publication Critical patent/CN113472749A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/10Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/08Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H04L9/3249Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures using RSA or related signature schemes, e.g. Rabin scheme
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00Network arrangements or protocols for supporting network services or applications
    • H04L67/01Protocols
    • H04L67/02Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Storage Device Security (AREA)

Abstract

The invention provides a method for preventing unauthorized self-service machine terminals from accessing a B/S architecture system, which belongs to the technical field of data security and comprises the following processes: 1) acquiring machine information of a self-service terminal; 2) registering and managing the self-service terminal; 3) generating an authorization code; 4) authorization code management; 5) an authorization code validity determination; 6) and the self-service terminal authorizes the use. The separation of encryption and decryption keys allows the authorization code to be secure against manipulation, forgery and tampering.

Description

Method for preventing unauthorized self-service machine terminal from accessing B/S architecture system
Technical Field
The invention relates to the technical field of data security, in particular to a method for preventing unauthorized self-service machine terminals from accessing a B/S architecture system.
Background
With the increasing number of self-service terminals and the continuous abundance of service types, a plurality of potential safety hazards are exposed conveniently and quickly. For example, directly using an unauthorized client to access a self-service handling program, and increasing a self-service terminal without authorization of a department.
The existing system authorization limits illegal use by acquiring a machine code in advance and then generating an authorization code according to the machine code in a way of binding the authorization code with the machine code.
Disclosure of Invention
In order to solve the technical problem, the invention provides a method for preventing unauthorized self-service machine terminals from accessing a B/S architecture system.
The technical scheme of the invention is as follows:
a method for preventing unauthorized self-service machine terminal from accessing B/S architecture system,
the method mainly comprises the following steps:
1) and acquiring the information of the self-service terminal machine.
2) And (5) registering and managing the self-service terminal.
3) An authorization code is generated.
4) Authorization code management.
5) And (4) judging the validity of the authorization code.
6) And the self-service terminal authorizes the use.
Further, in the above-mentioned case,
and generating a hardware unique identification code of the self-service terminal equipment according to the client hardware information, automatically registering the terminal equipment by calling a background Web service interface, and authorizing and activating the self-service terminal by using an anti-counterfeiting and anti-tampering authorization code generated by an RSA encryption algorithm.
Further, in the above-mentioned case,
and acquiring the unique identification code of the machine according to the hardware information of the machine through the automatically installed self-service terminal ActiveX control. And the ActiveX control sends the machine identification code to the server side, the server side judges whether the self-service terminal is registered, if not, the self-service terminal is automatically registered, and the self-service machine information is stored in a server side database.
Further, in the above-mentioned case,
and automatically registering the terminal machine by calling a Web service interface of the server according to the unique hardware identification code.
The authorization code management system generates an anti-counterfeiting and anti-tampering authorization code by using an RSA encryption algorithm, and the self-service terminal inputs the authorization code for authorization and activation.
And (3) generation of an authorization code: the system operator may generate the client-generated authorization code and the key using the authorization code. The system randomly generates a sequence of 8-bit strings at a time. The system operator can add the service life, and the system assembles the random string sequence and the service life into a json string and then encrypts the json string by using the RSA asymmetric encryption private key.
And (3) authorization code management: the user (system operator) having the authorization code issuing authority uses the authorization code management system to generate the authorization code and manage the use condition of the authorization code. The 8-bit authorization code is then issued to the self-service terminal administrator. When the authorization code is generated, the authorization code can be generated in batches, and system operators can conveniently issue the authorization code in batches.
Authorization code validity determination: the lobby kiosk terminal administrator enters an authorization code for activation. The server receives the authorization code transmitted by the self-service terminal, finds out the corresponding ciphertext, decrypts the ciphertext corresponding to the authorization code by using the public key stored in the server, and compares whether the input authorization code is consistent with the decrypted ciphertext. If not, the authorization code may be tampered or forged. If the service life is consistent with the preset service life, judging whether the service life is within the service life, and if the service life is beyond the preset service life, prohibiting the self-service machine terminal from continuing to use.
The invention has the advantages that
The method adopts RSA asymmetric encryption, generates an authorization code in an authorization code management system, uses a private key for encryption, and verifies the authorization code after a service system uses a public key for decryption. The separation of encryption and decryption keys allows the authorization code to be secure against manipulation, forgery and tampering.
The method can generate the authorization codes in batches, and the authorization codes are issued to the self-service terminal administrator in advance, so that the administrator can conveniently activate the self-service terminal, and the opening efficiency is improved.
The system records each activated self-service terminal, can conveniently manage the authorized activation use state of each self-service terminal, and can log off the self-service terminal which is abandoned at any time.
The method allows the setting of the service life, and can facilitate the temporary activation and use of part of the clients. For example, the device is used during demonstration, and can be automatically stopped without manually recovering the activation code after the demonstration is finished.
Drawings
Fig. 1 is a schematic diagram of a self-service machine terminal activation process.
Detailed Description
In order to make the objects, technical solutions and advantages of the embodiments of the present invention clearer and more complete, the technical solutions in the embodiments of the present invention will be described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are some, but not all, embodiments of the present invention, and based on the embodiments of the present invention, all other embodiments obtained by a person of ordinary skill in the art without creative efforts belong to the scope of the present invention.
In order to solve the problem of unauthorized access to the self-service handling system, the invention adopts a method for preventing unauthorized self-service machine terminals from accessing the B/S architecture system to solve the safety problem and ensure the safety of government services and data.
The method mainly comprises the following steps:
1. and acquiring the information of the self-service terminal machine.
2. And (5) registering and managing the self-service terminal.
3. An authorization code is generated.
4. Authorization code management.
5. And (4) judging the validity of the authorization code.
6. And the self-service terminal authorizes the use.
And when the self-service terminal browser accesses the system for the first time, installing a browser plug-in.
The system searches the registration information according to the machine information, if the registration information is not registered, the machine information is stored and automatic registration is carried out.
The machine is registered for unauthorized use and an authorization code is entered as required. The system judges whether the authorization code is legal, and if so, the system grants the authorization code for the machine and activates the machine.
Wherein the content of the first and second substances,
1. acquiring machine information of the self-service terminal: and calculating the unique identification code of the machine by using the ActiveX control according to the hardware information such as the IP, the machine network card, the CPU, the hard disk number and the like.
2. Registering and managing the self-service machine terminal: when the self-service handling system is opened, the ActiveX control can be automatically installed. And the ActiveX control sends the machine identification code to the server side, the server side judges whether the self-service terminal is registered, if not, the self-service terminal is automatically registered, and the self-service machine information is stored in a server side database.
3. And (3) generation of an authorization code: the system operator may generate the client-generated authorization code and the key using the authorization code. The system randomly generates a sequence of 8-bit strings at a time. The system operator can add the service life, and the system assembles the random string sequence and the service life into a json string and then encrypts the json string by using the RSA asymmetric encryption private key.
Figure RE-GDA0003202839280000041
4. And (3) authorization code management: the user (system operator) having the authorization code issuing authority uses the authorization code management system to generate the authorization code and manage the use condition of the authorization code. The 8-bit authorization code is then issued to the self-service terminal administrator. When the authorization code is generated, the authorization code can be generated in batches, and system operators can conveniently issue the authorization code in batches.
5. Authorization code validity determination: the lobby kiosk terminal administrator enters an authorization code for activation. The server receives the authorization code transmitted by the self-service terminal, finds out the corresponding ciphertext, decrypts the ciphertext corresponding to the authorization code by using the public key stored in the server, and compares whether the input authorization code is consistent with the decrypted ciphertext. If not, the authorization code may be tampered or forged. If the service life is consistent with the preset service life, judging whether the service life is within the service life, and if the service life is beyond the preset service life, prohibiting the self-service machine terminal from continuing to use.
6. The self-service terminal authorizes use: if the decryption is consistent with the authorization code input by the terminal and is within the allowed service life, the self-service terminal is authorized and activated.
The self-service machine terminal activation flow chart is shown in figure 1.
Firstly, when a self-service terminal browser accesses the system for the first time, the browser plug-in is automatically installed. And calculating the unique identification code of the machine by using the browser plug-in according to the hardware information such as IP, a machine network card, a CPU, a hard disk number and the like.
The system searches the registration information according to the unique identification code information of the machine, and if the unique identification code information of the machine is not registered, the information of the machine is stored and automatically registered.
When the machine has been registered, authorized activation information for the machine is detected. If authorized, the logging system is allowed to continue further use.
When the machine is registered for unauthorized use, an authorization code is required to be entered. The system judges whether the authorization code is legal, and if so, the system grants the authorization code for the machine and activates the machine. The authorization code has uniqueness, forgery prevention, and tamper prevention property, and if illegal or tampered, access is denied.
Note:
1) ActiveX can be developed by languages such as C #, VB and C + +. ActiveX was developed in C + + and can use either ATL or MFC. The ATL ActiveX output file is small and suitable for network transmission, but the development complexity is slightly large; while the MFC ActiveX output file is slightly larger (with the necessary MFC dll attached), but easy to handle. Foreground 24-hour self-service terminal equipment is based on a Windows operating system, all adopts IE browser kernels, and supports ActiveX controls. The MFC development is adopted in consideration of the fact that the number of self-service terminals is not large, the network condition is good, and the ActiveX control is installed at one time.
2) And the background server side needs to expose APIs (application programming interfaces) used by the foreground self-service terminal, such as self-service terminal registration, activation, service life limitation, forbidding and the like, outwards. Web services are a platform-independent, low-coupling, self-contained, programmable Web-based application that can be described, published, discovered, coordinated, and configured using the open XML (a subset of the standard universal markup language) standard for developing distributed, interoperable applications. The Web service exposes an API interface which can be called by Web to the outside, and the interoperability is realized by Web. AXIS is an open-source Web Service running engine, which is essentially a SOAP engine that provides a basic framework for creating SOAP operations on server sides, clients, and gateways. The background server is developed by using Java language and is deployed on a Linux operating system. Since the background server side is deployed in the government internal network, only http service of some ports is opened. In consideration of the cross-platform, cross-language and cross-network backgrounds, the server side issues Web Service services by adopting an AXIS Web Service framework, and provides an API (application program interface) for the foreground self-Service machine terminal.
3) The ActiveX control acquires information such as a client IP (Internet protocol), a machine network card, a CPU (Central processing Unit), a hard disk number and the like, forms a string of unique machine identification codes after combination and encryption, and then calls a background webservice service to upload the machine identification codes to a server side. The server side transmits a parameter machine identification code through the front end, and searches machine registration activation information. If the client is not registered, the client automatically registers and prompts the front end that the machine is not activated and an authorization code is input. If the client does not input the authorization code for activation, the client automatically exits the main body registration system and is not allowed to continue processing. And if the client is activated, returning the activation success, and allowing the self-service machine terminal to perform the following business operation.
4) The RSA public key cryptosystem is a system that uses different encryption and decryption keys. In the public key cryptosystem, an encryption key (i.e., a public key) PK is public information, and a decryption key (i.e., a secret key) SK needs to be kept secret. The self-service machine terminal authorization code is encrypted by using an RSA encryption mode, the private key is stored by an administrator, and the public key is deployed at a background server side. And encrypting the character string combined by the random character string sequence and the service life by using an RSA private key, then distributing the encrypted character string to each self-service handling hall, inputting an authorization code at a self-service machine terminal needing to be activated by hall workers, receiving the authorization code by a server end, decrypting by using a public key, verifying the service life, and allowing activation and normal use if the authorization code is within the service life.
The above description is only a preferred embodiment of the present invention, and is only used to illustrate the technical solutions of the present invention, and not to limit the protection scope of the present invention. Any modification, equivalent replacement, or improvement made within the spirit and principle of the present invention shall fall within the protection scope of the present invention.

Claims (8)

1. A method for preventing unauthorized self-service machine terminal from accessing B/S architecture system is characterized in that,
the process is as follows:
1) acquiring machine information of a self-service terminal;
2) registering and managing the self-service terminal;
3) generating an authorization code;
4) authorization code management;
5) an authorization code validity determination;
6) and the self-service terminal authorizes the use.
2. The method of claim 1,
and generating a hardware unique identification code of the self-service terminal equipment according to the client hardware information, automatically registering the terminal equipment by calling a background Web service interface, and authorizing and activating the self-service terminal by using an anti-counterfeiting and anti-tampering authorization code generated by an RSA encryption algorithm.
3. The method of claim 2,
and acquiring the unique identification code of the machine according to the hardware information of the machine through the automatically installed self-service terminal ActiveX control.
4. The method of claim 3,
and the ActiveX control sends the machine identification code to the server side, the server side judges whether the self-service terminal is registered, if not, the self-service terminal is automatically registered, and the self-service machine information is stored in a server side database.
5. The method of claim 4,
and automatically registering the terminal machine by calling a Web service interface of the server according to the unique hardware identification code.
6. The method of claim 1,
the authorization code management system generates an anti-counterfeiting and anti-tampering authorization code by using an RSA encryption algorithm, and the self-service terminal inputs the authorization code for authorization and activation.
7. The method of claim 5,
the server receives the authorization code transmitted by the self-service terminal, finds out a corresponding ciphertext, decrypts the ciphertext corresponding to the authorization code by using a public key stored in the server, and compares whether the input authorization code is consistent with the decrypted ciphertext;
if the authorization code is inconsistent with the authorization code, the authorization code may be tampered or forged;
if the service life is consistent with the preset service life, judging whether the service life is within the service life, and if the service life is beyond the preset service life, prohibiting the self-service machine terminal from continuing to use.
8. The method of claim 7,
the self-service terminal authorizes use: if the decryption is consistent with the authorization code input by the terminal and is within the allowed service life, the self-service terminal is authorized and activated.
CN202110613682.3A 2021-06-02 2021-06-02 Method for preventing unauthorized self-service machine terminal from accessing B/S architecture system Pending CN113472749A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202110613682.3A CN113472749A (en) 2021-06-02 2021-06-02 Method for preventing unauthorized self-service machine terminal from accessing B/S architecture system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202110613682.3A CN113472749A (en) 2021-06-02 2021-06-02 Method for preventing unauthorized self-service machine terminal from accessing B/S architecture system

Publications (1)

Publication Number Publication Date
CN113472749A true CN113472749A (en) 2021-10-01

Family

ID=77872053

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202110613682.3A Pending CN113472749A (en) 2021-06-02 2021-06-02 Method for preventing unauthorized self-service machine terminal from accessing B/S architecture system

Country Status (1)

Country Link
CN (1) CN113472749A (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116070178A (en) * 2023-04-06 2023-05-05 恒银金融科技股份有限公司 Software authorization method and system based on mobile terminal code scanning

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2013059866A1 (en) * 2011-10-25 2013-05-02 Misolutions Pty Ltd Remote device authentication system and method
CN108616482A (en) * 2016-12-09 2018-10-02 青岛璐琪信息科技有限公司 A kind of storage system access authorization methods based on communication network
CN111478909A (en) * 2020-04-09 2020-07-31 浪潮软件科技有限公司 Access processing method, server access method, server and self-service terminal

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2013059866A1 (en) * 2011-10-25 2013-05-02 Misolutions Pty Ltd Remote device authentication system and method
CN108616482A (en) * 2016-12-09 2018-10-02 青岛璐琪信息科技有限公司 A kind of storage system access authorization methods based on communication network
CN111478909A (en) * 2020-04-09 2020-07-31 浪潮软件科技有限公司 Access processing method, server access method, server and self-service terminal

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116070178A (en) * 2023-04-06 2023-05-05 恒银金融科技股份有限公司 Software authorization method and system based on mobile terminal code scanning

Similar Documents

Publication Publication Date Title
US11470054B2 (en) Key rotation techniques
US6389535B1 (en) Cryptographic protection of core data secrets
CN105103119B (en) Data security service system
US6931549B1 (en) Method and apparatus for secure data storage and retrieval
CN105103488B (en) By the policy Enforcement of associated data
EP2755162B1 (en) Identity controlled data center
CN105122265B (en) Data safety service system
WO2001003367A1 (en) Method for generating secure symmetric encryption and decryption
WO2021139338A1 (en) Data access permission verification method and apparatus, computer device, and storage medium
CA2503271A1 (en) A method and system for recovering password protected private data via a communication network without exposing the private data
US20050039018A1 (en) Device for digital signature of an electronic document
EP1678683B1 (en) A lock system and a method of configuring a lock system.
US10679183B2 (en) Method and system for distributing and tracking information
CN112989320B (en) User state management system and method for password equipment
CN113472749A (en) Method for preventing unauthorized self-service machine terminal from accessing B/S architecture system
US8281407B2 (en) In-line decryption device for securely printing documents
US10594494B2 (en) Multiple authorization modules for secure production and verification
JP3877388B2 (en) Information provision system
JPH1165443A (en) Management element system for individual authentication information
JP2003518283A (en) Hardware token self-registration process
KR20020083551A (en) Development and Operation Method of Multiagent Based Multipass User Authentication Systems
JP4282272B2 (en) Privacy protection type multiple authority confirmation system, privacy protection type multiple authority confirmation method, and program thereof
KR100276690B1 (en) Authentication Method for Secure Object-Based Distributed Processing Systems
KR20010076025A (en) A method for transmitting a encrypted file in the computer network for only selected-client's usage
CN117201029A (en) Http communication tamper-proof method and system based on domestic CPU and OS

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
RJ01 Rejection of invention patent application after publication

Application publication date: 20211001

RJ01 Rejection of invention patent application after publication