WO2017206698A1

WO2017206698A1 - Device management method and system based on active template library (atl), and financial self-service device

Info

Publication number: WO2017206698A1
Application number: PCT/CN2017/084062
Authority: WO
Inventors: 伍鹏辉; 熊飞; 陈明宇; 梁建明; 张雲瑞; 罗忠明
Original assignee: 广州广电运通金融电子股份有限公司
Priority date: 2016-05-30
Filing date: 2017-05-12
Publication date: 2017-12-07
Also published as: CN106097600A; CN106097600B

Abstract

A device management method and system based on an active template library (ATL), and a financial self-service device, for solving the problem that hardware device resources in existing ATM management systems cannot be shared. The method comprises: after receiving a communication connection request from an upper application for a hardware device, authorizing and verifying the upper application (A101); if the upper application passes the authorization and verification, establishing a communication connection between the upper application and a hardware device in order of priority, in the same single device management service process (A102); and in the same single device management service process, using an upper application with lower priority as a monitoring program, to monitor the communication between the current upper application with higher priority and the hardware device (A103). By means of the invention, two or more upper applications can share and access the same single hardware device by means of the same single device management service process, avoiding wasting device resources.

Description

ATL-based device management method, system and financial self-service device

This application claims priority to Chinese Patent Application No. 201610375226.9, entitled "ATL-based Equipment Management Method, System and Financial Self-Service Equipment", filed on May 30, 2016, the entire contents of which are hereby incorporated by reference. Combined in this application.

Technical field

The present invention relates to the field of financial self-service devices, and in particular, to an ATL (Active Template Library)-based device management method, system, and financial self-service device.

Background technique

The ATM, also known as ATM, is a highly sophisticated mechatronic device that uses a magnetic code card or smart card to implement self-service for financial transactions, replacing the work of bank counter personnel.

The existing ATM machine management system cannot realize resource sharing of hardware devices, and two or more upper layer applications cannot access the same hardware device at the same time. For example, the application APP1 opens the hardware device A, and the application APP2 can no longer open or access the hardware device A. After the application APP1 is disconnected from the device A, the application APP2 can access the hardware device A, thereby causing device resources. Waste, can not achieve resource sharing. In addition, the hardware devices are not uniformly managed, so that any application APP can freely access the hardware devices, which poses a security risk and may cause some malicious programs to access the hardware devices.

Summary of the invention

The embodiment of the invention provides an ATL-based device management method, system and financial self-service device, which can solve the problem that the existing ATM machine management system cannot realize hardware device resource sharing.

An ATL-based device management method provided by an embodiment of the present invention includes:

After receiving the communication connection request of the upper application and the hardware device, performing authorization verification on the upper application;

If the authorization verification is passed, the communication connection between the upper application and the hardware device is established in the same device management service process according to the priority order;

In the same device management service process, the lower-priority upper-layer application is used as a monitoring program to monitor communication between the current higher-priority upper-layer application and the hardware device.

Optionally, it also includes:

If the authorization verification fails, the communication connection request is rejected.

Optionally, the priority order is determined by a preset priority of an upper application.

Optionally, the method further includes: performing encryption processing on the upper layer application in advance, specifically:

Sending the public key in the key pair generated by the upper application to the device management service process;

Encrypting the file signature of the upper application by using a private key in the key pair to generate encrypted information.

Optionally, performing authorization verification on the upper layer application specifically includes:

Obtaining, from the device management service, a public key corresponding to the upper layer application;

Decrypting the encrypted information of the upper application by using the obtained public key to obtain a feature information code;

If the feature information code is compared with the file feature code of the upper application, if the verification is the same, the authorization verification is passed. If not, the authorization verification fails.

An ATL-based device management system provided by an embodiment of the present invention includes:

An application authorization module, configured to perform authorization verification on the upper application after receiving a communication connection request between the upper application and the hardware device;

a priority communication connection module, configured to establish, in the same device management service process, a communication connection between the upper application and the hardware device in the same device management service process if the authorization verification is passed;

The communication monitoring module is configured to monitor, in the same device management service process, a lower priority upper layer application as a monitoring program to monitor communication between the current higher priority upper layer application and the hardware device.

Optionally, it also includes:

The connection module is rejected for rejecting the communication connection request if the authorization verification fails.

Optionally, a pre-encryption module is further included, configured to perform encryption processing on the upper layer application in advance;

The pre-encryption module specifically includes:

a public key sending unit, configured to send a public key in a key pair generated by an upper layer application to a device management service process;

And an encryption unit, configured to encrypt the file feature code of the upper application by using a private key in the key pair to generate encrypted information.

Optionally, the application authorization module includes:

a public key obtaining unit, configured to acquire, from the device management service, a public key corresponding to the upper layer application;

a decryption unit, configured to decrypt the encrypted information of the upper application by using the obtained public key to obtain a feature information code;

The comparison unit is configured to compare the feature information code with the file feature code of the upper application, and if the same, the authorization verification is passed, and if not, the authorization verification fails.

A financial self-service device provided by an embodiment of the present invention includes the device management system described above.

It can be seen from the above technical solutions that the embodiments of the present invention have the following advantages:

In the embodiment of the present invention, after receiving the communication connection request of the upper layer application and the hardware device, the upper layer application is authorized to be authenticated; if the authorization verification is passed, the upper layer application is established in the same device management service process according to the priority order. a communication connection between the program and the hardware device; wherein, in the same device management service process, the upper-level application with lower priority is used as a monitoring program to monitor communication between the current upper-level application with higher priority and the hardware device . In the embodiment of the present invention, two or more upper-layer applications may establish a communication connection with the hardware device in the same device management service process according to the priority order, and communicate with the hardware device in the upper-layer application with higher priority. During the process, the upper-level application with lower priority can be monitored, so that two or more upper-layer applications share the same hardware device through the same device management service process, thereby avoiding waste of device resources. At the same time, the hardware devices are uniformly managed, and any application accessing the hardware devices requires authorization verification, which improves the security performance of the devices.

DRAWINGS

FIG. 1 is a flowchart of an embodiment of an ATL-based device management method according to an embodiment of the present invention;

2 is a flowchart of another embodiment of an ATL-based device management method according to an embodiment of the present invention;

3 is a schematic diagram of generating an encryption information of an ATL-based device management method according to an embodiment of the present invention;

4 is a schematic diagram of a decryption authorization process of an ATL-based device management method according to an embodiment of the present invention;

5 is a structural diagram of a system framework in an application scenario of an ATL-based device management method according to an embodiment of the present invention;

6 is a structural diagram of a system framework in another application scenario of an ATL-based device management method according to an embodiment of the present invention;

FIG. 7 is a structural diagram of an embodiment of an ATL-based device management system according to an embodiment of the present invention; FIG.

FIG. 8 is a structural diagram of another embodiment of an ATL-based device management system according to an embodiment of the present invention; FIG.

FIG. 9 is a flowchart of operation steps of a financial self-service device adopting an ATL-based device management method according to an embodiment of the present invention.

detailed description

The embodiments of the present invention provide an ATL-based device management method, system, and financial self-service device, which are used to solve the problem that the existing ATM machine management system cannot implement hardware device resource sharing.

In order to make the object, the features and the advantages of the present invention more obvious and easy to understand, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. The described embodiments are only a part of the embodiments of the invention, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

Referring to FIG. 1, an embodiment of an ATL-based device management method according to an embodiment of the present invention includes:

A101. After receiving the communication connection request of the upper application and the hardware device, performing authorization verification on the upper application;

A102. If the authorization verification is passed, the communication connection between the upper application and the hardware device is established in the same device management service process according to the priority order;

The priority order is determined by the preset priority of the upper application.

A103: In the same device management service process, the lower-priority upper-layer application is used as a monitoring program to monitor communication between the current higher-priority upper-layer application and the hardware device.

In this embodiment, after receiving the communication connection request of the upper application and the hardware device, performing authorization verification on the upper application; if the authorization verification is passed, managing the service on the same device The communication process of the upper layer application and the hardware device is established in the priority order; wherein, in the same device management service process, the upper layer application with lower priority is used as the monitoring program to monitor the current upper layer application with higher priority Communication between the program and the hardware device. In this embodiment, two or more upper-layer applications may establish a communication connection with the hardware device in the same device management service process according to the priority order, and the process of communicating with the hardware device in the upper-layer application with higher priority The upper-level application with lower priority can be monitored, so that two or more upper-layer applications share the same hardware device through the same device management service process, thereby avoiding waste of device resources.

For ease of understanding, an ATL-based device management method in the embodiment of the present invention is described in detail below. Referring to FIG. 2, another embodiment of an ATL-based device management method in the embodiment of the present invention includes:

After receiving the communication connection request of the upper application and the hardware device, the A201 obtains the public key corresponding to the upper application from the device management service;

First, after receiving the communication connection request of the upper layer application and the hardware device, the public key corresponding to the upper layer application may be obtained from the device management service.

It should be noted that the upper layer application may be encrypted in advance, including:

1. Send the public key A in the key pair generated by the upper application (including public key A and private key B) to the device management service process. To facilitate the management of the public key, the device management service process receives the upper application. Public key A, and manage public key A, can generate a public key list;

2. The file feature code K of the upper layer application is encrypted by using the private key B in the key pair to generate the encrypted information K1.

Specifically, for example, as shown in FIG. 3, in a specific application scenario, the encryption process is:

S101: loading an upper application app.exe;

S102: extracting a file feature code K from an upper application app.exe;

S103: The upper application generates a private key B;

S104: Encrypt the extracted file feature code K with the private key B;

S105: Obtain encrypted information K1 of the file feature code;

S106: The encrypted information K1 is saved as an encrypted information file app.key.

A202. Decrypt the encrypted information of the upper application by using the obtained public key to obtain a feature information code.

When receiving the communication connection request of the upper application and the hardware device, the public key corresponding to the upper application that initiated the request may be obtained from the public key list, and then the obtained public key may be used to the upper application. The encrypted information is decrypted to obtain a feature information code.

A203, comparing the feature information code and the file identifier of the upper application, if the same, then performing step A204, if not, executing step A206;

After obtaining the feature information code, the feature information code and the file feature code of the upper application may be compared. If they are the same, step A204 is performed. If not, step A206 is performed. It can be understood that steps A201 to A203 are decryption authorization verification processes for the upper layer application, and the process corresponds to the encryption process. In a specific application scenario, as shown in Figure 4, the decryption authorization process is:

S201: Loading an encrypted information file app.key;

S202: Acquire encrypted information K1;

S203: Calling the public key A generated by the upper application;

S204: decrypt the encrypted information K1 by using the public key A;

S205: obtaining the decrypted feature information code K2;

S206: loading the upper application app.exe;

S207: Extract the file feature code K of the upper application app.exe;

S208: Determine whether K2=K is established;

S209: If not, the device management service process does not authorize app.exe;

S210: If established, the device management service process authorizes app.exe.

A204. If the authorization verification is passed, the communication connection between the upper application and the hardware device is established in the same device management service process according to the priority order;

If the authorization verification is passed, the communication connection between the upper application and the hardware device may be established in the priority order of the same device management service process, and the priority order is determined by the preset priority of the upper application. It can be understood that the ATL-based device management method in this embodiment is mainly based on ATL to generate an out-of-process executable program type COM service program. The service can realize unified management of hardware device communication, and the upper layer application accesses the hardware device by obtaining authorization of the device management service process.

A205. In the same device management service process, use a lower-priority upper-layer application as a monitoring program to monitor communication between the current higher-priority upper-layer application and the hardware device;

The upper-layer application with lower priority can be used as a monitoring program to monitor communication between the upper-layer application with higher priority and the hardware device in the same device management service process.

A206. If the authorization verification fails, the communication connection request is rejected.

If the authorization verification fails, it can be considered that the upper layer application that initiated the request is invalid, and the communication connection request is rejected.

For ease of understanding, the ATL-based device management method of the present invention is described below through specific application scenarios. Referring to FIG. 5, in a specific application scenario, the relationship between the upper layer application, the device management service process, and the hardware device is as shown in FIG. 5, and the device management service process and each upper layer application (the upper layer application 201, the upper layer) Application 202, upper application 203, etc.) communication connection, and also serial port (such as serial port 205, serial port 206, serial port 207, etc.) or USB interface (such as serial port 205, serial port 206, serial port 207, etc.) connected with hardware devices (such as device 211, device 212, device 213, etc.) USB208, USB209, USB210, etc.), the working principle is as follows:

1. The upper layer application normally connects to the hardware device: the upper layer application 201 sends a request to the device management service process 204 to perform a communication connection with the device 211, and the device management service process 204 performs an audit on the upper layer application 201 through the authorization module. After the approval is passed, the permission is allowed. The upper application 201 communicates with the device 211;

2. Upper-layer application normal data sharing device: Both the upper-layer application 202 and the upper-layer application 203 send a request to the device management service process 204 to perform a communication connection with the device 212. The device management service process 204 reviews the upper layer application 202 and the upper layer application 203 through the authorization module. After the approval is passed, the upper layer application 202 and the upper layer application 203 are prioritized according to the preset priority, and the upper layer application 202 with high priority is prioritized. First, the communication between the upper-layer application 202 and the device 212 is monitored by the device management service process 204. The upper-layer application 203 is used as a monitoring program to monitor the communication between the upper-layer application 202 and the device 212. Both the upper layer application 202 and the upper layer application 203 can share the access device 212 through the device management service process 204;

3. The upper-layer application is unauthorized. The upper-layer application 200 sends a request to the device management service process 204 to perform a communication connection with the device 213. The device management service process 204 performs an authorization review on the upper-layer application 200 through the authorization module, and the audit result does not meet the requirements. The device management service process 204 blocks communication between the upper application 200 and the device 213.

When there are multiple USB hardware devices with the same hardware parameter information of the same model, the ATL-based device management method can implement the upper-layer application to access the specified USB device at the same time. Referring to FIG. 6, in a specific application scenario, the device is used. The management service process 304 is in communication with each upper-layer application (such as the upper layer application 301, the upper layer application 302, and the upper layer application 303), and is also connected to each of the same type of USB connected to the hardware device (such as the device 308, the device 309, and the device 310). The interface (such as USB port 305, USB port 306, USB port 307) is connected, and its working principle is as follows:

The upper layer application accesses the specified USB device: one device is connected with three identical hardware devices 308, 309, 310 of the same model with the same hardware parameter information, and the upper layer application 302 can access the same USB port 306 through the device management service process 304. Model USB device 309. Therefore, the upper layer application accesses the specified hardware device, and the upper layer application is prevented from randomly accessing the hardware device, resulting in uncertainty.

A plurality of upper-layer applications simultaneously access the specified same USB hardware device: one device is connected with three identical USB hardware devices 308, 309, and 310 of the same model with the same hardware parameter information, and the upper-layer application 301 can access the specified device through the standby management service process 304. The USB port device 307 is connected to the USB hardware device 310. At the same time, the upper layer application 303 can access the USB hardware device 308 connected to the designated USB port 305 through the standby management service process 304. Therefore, multiple upper-layer applications can access the same hardware device at the same time (the hardware parameters are the same, but the interfaces are different) to avoid waste of resources.

In a specific application scenario, as shown in FIG. 9, the operation steps of the financial self-service device adopting the ATL-based device management method are as follows:

A. When the industrial computer starts, the device management service process is automatically started;

B. When the device management service process starts, the device is automatically connected according to the communication configuration to prevent other services or applications from using the device port.

C. The device management service process waits for a connection request of the upper application driver device;

D. The upper application sends a request to connect the hardware device;

E. The device management service process searches for the connected device port in the device pool, and binds the device connection information.

F. After the upper layer application obtains the authorization verification, establish a communication channel with the hardware device, and the device management service process performs communication monitoring on the authorized communication channel, and generates a monitoring record;

G. Regardless of whether the upper application is authorized, return to step C and continue waiting after the request processing is completed.

The ATL-based device management system is described in detail above. The ATL-based device management system is described in detail below. Referring to FIG. 7, an ATL-based device management system in the embodiment of the present invention includes:

The application authorization module 701 is configured to perform authorization verification on the upper layer application after receiving the communication connection request of the upper layer application and the hardware device;

The priority communication connection module 702 is configured to establish, in the same device management service process, a communication connection between the upper application program and the hardware device in the same device management service process if the authorization verification is passed;

The communication monitoring module 703 is configured to monitor, in the same device management service process, a lower-priority upper-layer application as a monitoring program to monitor communication between the current higher-priority upper-layer application and the hardware device.

In this embodiment, two or more upper-layer applications may establish a communication connection with the hardware device in the same device management service process according to the priority order, and the process of communicating with the hardware device in the upper-layer application with higher priority The upper-level application with lower priority can be monitored, so that two or more upper-layer applications share the same hardware device through the same device management service process, thereby avoiding waste of device resources.

For ease of understanding, an ATL-based device management system in the embodiment of the present invention is described in detail below. Referring to FIG. 8, another embodiment of an ATL-based device management system in the embodiment of the present invention includes:

The application authorization module 801 is configured to perform authorization verification on the upper layer application after receiving the communication connection request of the upper layer application and the hardware device;

The priority communication connection module 802 is configured to establish, in the same device management service process, a communication connection between the upper layer application and the hardware device in the same device management service process, where the priority order is set by the upper layer application preset priority. Decide

The communication monitoring module 803 is configured to monitor, in the same device management service process, a lower-priority upper-layer application as a monitoring program to monitor communication between the current higher-priority upper-layer application and the hardware device.

In a specific embodiment, the device management system may further include:

The connection connection module 804 is configured to reject the communication connection request if the authorization verification fails.

In a specific embodiment, the device management system may further include a pre-encryption module 805, configured to perform encryption processing on the upper layer application in advance;

The pre-encryption module 805 specifically includes:

a public key sending unit 8051, configured to send a public key in a key pair generated by an upper layer application to a device management service process;

The encryption unit 8052 is configured to encrypt the file feature code of the upper application by using a private key in the key pair to generate encrypted information.

In a specific embodiment, the application authorization module 801 can include:

The public key obtaining unit 8011 is configured to obtain, from the device management service, a public key corresponding to the upper layer application;

The decrypting unit 8012 is configured to decrypt the encrypted information of the upper layer application by using the obtained public key to obtain a feature information code.

The comparing unit 8013 is configured to compare the feature information code with the file feature code of the upper application, and if the same, the authorization verification passes, and if not, the authorization verification fails.

The present invention also discloses a financial self-service device, which includes any of the ATL-based device management systems described in the foregoing embodiments. Therefore, the financial self-service device includes, but is not limited to, the technical features and technical effects of the device management system.

A person skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the system, the device and the unit described above can refer to the corresponding process in the foregoing method embodiment, and details are not described herein again.

In the several embodiments provided by the present application, it should be understood that the disclosed system, apparatus, and method may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention, which is essential or contributes to the prior art, or all or part of the technical solution, may be embodied in the form of a software product stored in a storage medium. A number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

The above embodiments are only used to illustrate the technical solutions of the present invention, and are not limited thereto; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art It should be understood that the technical solutions described in the foregoing embodiments may be modified, or some of the technical features may be equivalently replaced; and the modifications or substitutions do not deviate from the technical solutions of the embodiments of the present invention. The spirit and scope of the programme.

Claims

An ATL-based device management method, comprising:

After receiving the communication connection request of the upper application and the hardware device, performing authorization verification on the upper application;

If the authorization verification is passed, the communication connection between the upper application and the hardware device is established in the same device management service process according to the priority order;

In the same device management service process, the lower-priority upper-layer application is used as a monitoring program to monitor communication between the current higher-priority upper-layer application and the hardware device.
The device management method according to claim 1, further comprising:

If the authorization verification fails, the communication connection request is rejected.
The device management method according to claim 1 or 2, wherein the priority order is determined by a preset priority of an upper layer application.
The device management method according to claim 1 or 2, further comprising: performing encryption processing on the upper layer application in advance, specifically comprising:

Sending the public key in the key pair generated by the upper application to the device management service process;

Encrypting the file signature of the upper application by using a private key in the key pair to generate encrypted information.
The device management method according to claim 4, wherein the performing the authorization verification on the upper layer application comprises:

Obtaining, from the device management service process, a public key corresponding to the upper application;

Decrypting the encrypted information of the upper application by using the obtained public key to obtain a feature information code;

If the feature information code is compared with the file feature code of the upper application, if the verification is the same, the authorization verification is passed. If not, the authorization verification fails.
An ATL-based device management system, comprising:

An application authorization module, configured to perform authorization verification on the upper application after receiving a communication connection request between the upper application and the hardware device;

a priority communication connection module, configured to establish, in the same device management service process, a communication connection between the upper application and the hardware device in the same device management service process if the authorization verification is passed;

The communication monitoring module is configured to monitor, in the same device management service process, a lower priority upper layer application as a monitoring program to monitor communication between the current higher priority upper layer application and the hardware device.
The device management system according to claim 6, further comprising:

The connection module is rejected for rejecting the communication connection request if the authorization verification fails.
The device management system according to claim 6 or 7, further comprising a pre-encryption module, configured to perform an encryption process on the upper layer application in advance;

The pre-encryption module specifically includes:

a public key sending unit, configured to send a public key in a key pair generated by an upper layer application to a device management service process;

And an encryption unit, configured to encrypt the file feature code of the upper application by using a private key in the key pair to generate encrypted information.
The device management system according to claim 8, wherein the application authorization module comprises:

a public key obtaining unit, configured to acquire a public key corresponding to the upper layer application from the device management service process;

a decryption unit, configured to decrypt the encrypted information of the upper application by using the obtained public key to obtain a feature information code;

The comparison unit is configured to compare the feature information code with the file feature code of the upper application, and if the same, the authorization verification is passed, and if not, the authorization verification fails.
A financial self-service device, comprising the device management system according to any one of claims 6 to 9.