WO2018165921A1

WO2018165921A1 - Pos machine password secure input method and device

Info

Publication number: WO2018165921A1
Application number: PCT/CN2017/076812
Authority: WO
Inventors: 宋孝亮
Original assignee: 深圳大趋智能科技有限公司
Priority date: 2017-03-15
Filing date: 2017-03-15
Publication date: 2018-09-20
Also published as: CN108521822A

Abstract

A POS machine password secure input method and device, the method comprising: when a POS machine operation processor-based POS machine operating system receives a password input command, switching an input signal of a touch screen to a secure chip (S1); obtaining password information of a touch screen input via the secure chip (S2); after a password input is complete, encrypting the password information and sending to the POS machine operation processor (S3). The method prevents the password information from being stolen, and increases POS machine usage security.

Description

Password security input method and device in POS machine

[0001] The present invention relates to the field of POS terminal technology, and in particular, to a password security input method and apparatus in a POS machine.

Background technique

[0002] With the increasing security level of the android system, the security of the android system is slowly accepted by the payment industry, and is used to express the full touch screen of the smart POS terminal, the full touch screen intelligent POS terminal is Intelligent POS terminal based on Internet and cloud computing, integrating secure payment, full acceptance, membership marketing, P0S

+ Various customized applications.

[0003] Due to the scalability of the android system and possible vulnerabilities, the cardholder is easily stolen during the password input process on the touch screen. If the bottom layer is rooted, it is easy to be screened, or the android system is easy to be implanted with a Trojan. Therefore, in order to prevent the password from being stolen during the cardholder password input process, the password input process needs to be protected.

technical problem

[0004] A primary object of the present invention is to provide a cryptographic security input method and apparatus in a POS machine, which aims to enhance the security of use of the POS machine.

Problem solution

Technical solution

[0005] The present invention provides a password security input method in a POS machine, wherein the POS machine is provided with a security chip and a POS machine operation processor, and the password security input method includes the following steps:

[0006] The operating system of the POS operating system based on the POS running processor receives the password input command 吋, and switches the input signal of the touch screen to the security chip;

[0007] acquiring password information input by the touch screen by using the security chip;

[0008] After the password input is completed, the password information is encrypted and sent to the POS machine running processor.

[0009] Further, the step of switching the input signal of the touch screen into the security chip includes:

[0010] controlling the touch screen to connect the signal data line of the POS machine operating processor to switch to the security Heart film.

[0011] Further, the step of switching the input signal of the touch screen to the security chip includes: [0012] controlling the display interface of the operating system end of the POS machine to switch to the password input display state.

[0013] Further, after the step of acquiring the password information input by the touch screen by the security chip, the method includes:

[0014] Sending an instruction without a plaintext PIN to the operating system end of the POS machine, and displaying the password in a password invisible manner on the display interface of the operating system end of the POS machine.

[0015] Further, after the password input is completed, the password information is encrypted and then sent to the POS machine, and the step of running the processor includes:

[0016] Clearing the plaintext password cache of the security chip to obtain password information.

[0017]

The present invention also provides a password security input device in a POS machine, wherein the POS machine is provided with a security chip and a POS machine running processor, and the password security input device includes:

[0019] a switching unit, configured to receive a password input command by the POS operating system running the processor based on the POS, and switch the input signal of the touch screen to the security chip;

[0020] an obtaining unit, configured to acquire, by using the security chip, password information input by the touch screen;

[0021] The processing unit is configured to encrypt the password information after the password input is completed, and then send the password information to the POS operation processor.

[0022] Further, the switching unit is specifically configured to:

[0023] controlling a signal data line connecting the touch screen to the POS machine to operate the processor to switch to the security chip.

[0024] Further, the switching unit is further configured to:

[0025] controlling a display interface of the operating system end of the POS machine to switch to a password input display state.

[0026] Further, the acquiring unit is further configured to:

[0027] Sending an instruction without a plaintext PIN to the operating system end of the POS machine, and displaying the password in a password invisible manner on the display interface of the operating system end of the POS machine.

[0028] Further, the device further includes:

[0029] The clearing unit is configured to clear the plaintext password cache that the security chip obtains the password information. Advantageous effects of the invention

Beneficial effect

[0030] The password security input method and apparatus in the POS machine provided by the present invention have the following beneficial effects: [0031] The password security input method and apparatus in the POS machine provided by the present invention, based on the POS machine running the processor After the POS machine operating system receives the password input command, the input signal of the touch screen is switched to the security chip; the password information input by the touch screen is obtained by the security chip; after the password input is completed, the password information is encrypted and sent to The POS machine runs the processor; after the user inputs the password, the security chip obtains the password information, prevents the password information from being stolen, and enhances the security of the POS machine.

Brief description of the drawing

DRAWINGS

1 is a schematic diagram showing the steps of a password security input method in a POS machine according to an embodiment of the present invention;

2 is a schematic diagram showing the steps of a password security input method in a POS machine according to another embodiment of the present invention;

3 is a schematic structural diagram of a password security input device in a POS machine according to an embodiment of the present invention;

4 is a schematic structural diagram of a password security input device in a POS machine according to another embodiment of the present invention.

[0036]

[0037] The objects, features, and advantages of the present invention will be further described in conjunction with the embodiments.

BEST MODE FOR CARRYING OUT THE INVENTION

The specific embodiments described herein are intended to be illustrative only and not to limit the invention.

[0039] The singular forms "a", "an", "the" It will be further understood that the phrase "comprising", used in the <RTI ID=0.0></RTI><RTIgt;</RTI> is intended to mean the presence of the features, integers, steps, operations, components, units, modules and/or components, but does not exclude the presence or addition of one or more Other characteristics, integers, steps, operations, components, units, modules, components, and/or groups thereof. It will be understood that when we refer to an element being "connected" or "coupled" to another element, it can be directly connected or coupled to the other element, or an intermediate element can be present. In addition, "connected" or "coupled" as used herein may include a wireless connection or a wireless coupling. Pick up. The phrase "and/or" used herein includes all or any of the elements and all combinations of one or more of the associated listed.

[0040] Those skilled in the art will appreciate that all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs, unless otherwise defined. It should also be understood that terms such as those defined in a general dictionary should be understood to have meaning consistent with the meaning in the context of the prior art, and will not be idealized or excessive unless specifically defined as here. The formal meaning is explained.

1 is a schematic diagram of steps of a password security input method in a POS machine according to an embodiment of the present invention.

[0042] In an embodiment of the present invention, a password security input method in a POS machine is provided. The POS machine is provided with a security chip and a POS machine running processor. The password security input method includes the following steps:

[0043] Step S1, the POS machine operating system based on the POS running processor receives the password input command, and switches the input signal of the touch screen to the security chip;

[0044] Step S2, acquiring, by using the security chip, password information input by the touch screen;

[0045] Step S3: After the password input is completed, the password information is encrypted and sent to the P0S machine running processor.

[0046] In this embodiment, the POS machine is a full touch screen payment terminal of an android (Android) system based on a linux kernel. In a normal state (non-password input state), an android surfaceflinger graphical interface is displayed on the touch screen. When the user uses the POS machine to make payment and enters the corresponding password input interface, the user touches the corresponding area on the screen to issue a password input command, and the POS machine switches all input signals of the touch screen to the security chip, that is, The POS machine running processor can not receive the password information input by the touch screen, and the Trojan program cannot steal the user's password information from the android system. The POS machine obtains the password information input by the touch screen through the above security chip, and the security chip and the Android system are independent of each other, and the Trojan horse program cannot enter the security chip to ensure the security of the password information. After the user enters the password, the security chip encrypts the password information and then sends it to the POS machine to run the processor. Finally, the password is verified on the android system. If the verification is passed, the payment is made. If the verification fails, the password is verified through the touch screen. .

[0047] In this embodiment, the security chip is a trusted platform module, and is a device capable of independently performing key generation, encryption and decryption, and has an independent processor and a storage unit, and can store key and feature data. , providing encryption and security authentication services. Encrypted with a security chip, the keys are stored in hardware, and the stolen data cannot be decrypted, thereby protecting business privacy and data security. The function of the security chip is equivalent to a "safe". The important password data is stored in the security chip. The security chip communicates with the POS operating system based on the POS machine running the processor through the SPI bus. According to the principle of the security chip. Since the password data can only be output, but cannot be input, the encryption and decryption operations are completed inside the security chip, and only the result is output to the upper layer, thereby avoiding the chance that the password is cracked.

[0048] In this embodiment, the security chip may also be a general processor that is different from the POS machine running the processor, that is, two processors are disposed in the POS machine, and one processor is used to run the POS operation. The system, the other processor is used for the password input, obtains the password information, and is encrypted and sent to the processor running the POS operating system, which is substantially the same as the above embodiment, and will not be described herein.

[0049] The password security input method in the POS machine provided in the embodiment of the present invention, the POS machine operating system based on the POS machine running processor receives the password input command, and switches the input signal of the touch screen to the security chip; The security chip obtains the password information input by the touch screen; after the password input is completed, the password information is encrypted and sent to the POS machine to run the processor; after the user inputs the password, the security chip obtains the password information to avoid the password information. Stealed, enhanced POS security.

[0050] Specifically, the step S1 of switching the input signal of the touch screen into the security chip is as follows:

And [0051] controlling a signal data line connecting the touch screen to the POS operation processor to switch to the security chip.

[0052] The touch screen is provided with a signal data line. Usually, one end of the signal data line is connected to the touch screen, and the other end is connected to the POS running processor, and the other end can also be connected to the security chip. In the normal state (non-password input state), the signal data line of the touch screen is connected to the POS machine running processor, and when the POS machine operating system receives the password input command, the signal data line of the control touch screen is switched and connected to the security chip. Therefore, the signal transmission between the touch screen and the running processor of the POS machine is cut off, and the data acquired by the touch screen is all transmitted to the security chip, and even if the operating system hits the Trojan, the password information input by the user touching the screen cannot be obtained, and the password is avoided. Information is stolen and POS security is enhanced.

[0053] Further, the step S1 of switching the input signal of the touch screen to the security chip includes: [0054] controlling the display interface of the operating system end of the POS machine to switch to the password input display state.

[0055] When the card user is required to input a password, enter the card user password input state, the signal data of the touch screen The line is connected to the security chip, and the security chip sends the control information to the linux kernel of the application POS operating system to switch to the password input display state, so that the display content of the original application is not destroyed.

[0056] Further, the step S2 of acquiring the password information input by the touch screen by the security chip includes:

[0057] Sending an instruction without a plaintext PIN to the operating system end of the POS machine, and displaying the password in a password invisible manner on the display interface of the operating system end of the POS machine. The security chip obtains the input data of the touch screen, analyzes which key the user presses, presses the key, and sends an instruction without the plaintext PIN to the Linux kernel of the operating system, and the linux kernel update password input "*" at the operating system end of the POS machine. No., the password is displayed invisible in the password.

[0058] In this embodiment, the password information input by the touch screen is obtained by the security chip, a text input keyboard is provided in a password input interface of the touch screen, and the user inputs the account information by pressing a corresponding character on the keyboard; After the password is 加密, the entered password is encrypted and displayed, for example, the password is displayed as a special character such as "*" to prevent the screen from stealing the password.

[0059] Preferably, the text input keyboard inputs a password corresponding to the payment account, and the input characters are randomly displayed in the text input keyboard, so that the order of each display is different. Generally, the input method input characters on the POS machine are sorted according to the input characters on the keyboard. In the embodiment, the input characters are randomly displayed in the text input keyboard, which means that the input characters on the keyboard are re-randomly randomized. Arranged and distributed in the text input keyboard, the order of each display is different, so that the password input by the user can be obtained according to the position where the user clicks the text input keyboard, thereby further ensuring the security of the password input by the user.

[0060] Further, referring to FIG. 2, in another embodiment, after the password input is completed, the password information is encrypted and then sent to the POS machine to run the processor, and the step S3 includes:

[0061] Step S4: Clear the plaintext password cache of the security chip to obtain the password information. After the card user password is entered, the plaintext password is encrypted by using the password encryption key inside the security chip, and the plaintext password cache of the password information is also cleared.

[0062] In some embodiments, after the security chip obtains the password information, it does not send it to the POS machine to run the processor for verification, but performs password verification directly in the security chip, and then sends the verification result to the POS based verification. The machine runs the processor's POS operating system. [0063] In some other embodiments, if the payment is to support the use of fingerprint payment, the fingerprint data may be transmitted to the security chip after the fingerprint data is collected, and the fingerprint data of the fingerprint identifier is cut off. The POS machine runs the channel of the processor.

[0064] In order to further describe the password security input method in the POS machine in the embodiment of the present invention, a password security input device in the POS machine is further provided in the embodiment of the present invention.

[0065] Referring to FIG. 3, in the embodiment of the present invention, a password security input device in a POS machine is provided. The POS device is provided with a security chip and a POS machine running processor, and the password security input device includes: The switching unit 10 is configured to: after receiving the password input command by the POS operating system running the processor based on the POS machine, switching the input signal of the touch screen to the security chip;

[0067] The obtaining unit 20 is configured to acquire, by using the security chip, password information input by the touch screen;

[0068] The processing unit 30 is configured to encrypt the password information after the password input is completed, and then send the password information to the POS running processor.

[0069] In this embodiment, the POS running processor is a processor running by an operating system of the POS, that is, a central processing unit in which the POS device operates. The POS machine is a full touch screen payment terminal of the android kernel based android system. In the normal state (non-password input state), the android surface flinger graphical interface is displayed on the touch screen. When the user uses the POS machine to make payment and enters the corresponding password input interface, the user touches the corresponding area on the screen to issue a password input command, and the POS machine switches all input signals of the touch screen to the security chip, that is, The POS machine running processor can not receive the password information input by the touch screen, and the Trojan program cannot steal the user's password information from the android system. The POS machine obtains the password information input by the touch screen through the above security chip, and the security chip and the security system are independent of each other, and the Trojan horse program cannot enter the security chip to ensure the security of the password information. After the user enters the password, the security chip encrypts the password information and then sends it to the POS machine to run the processor. Finally, the password is verified on the android system. If the verification is passed, the payment is made. If the verification fails, the password is verified through the touch screen. .

[0070] In this embodiment, the security chip is a trusted platform module, and is a device capable of independently performing key generation, encryption and decryption, and has an independent processor and a storage unit internally, and can store key and feature data. , providing encryption and security authentication services. Encrypted with a security chip, the keys are stored in hardware, and the stolen data cannot be decrypted, thereby protecting business privacy and data security. The role of the security chip is quite In a "safe", important password data is stored in the security chip. The security chip communicates with the POS operating system based on the POS machine running the processor through the SPI bus. According to the principle of the security chip, the password data can only be output. , and can not be input, so the encryption and decryption operations are completed inside the security chip, and only the results are output to the upper layer, avoiding the chance that the password is cracked.

[0071] In this embodiment, the security chip may also be a general processor that is different from the POS machine running the processor, that is, two processors are disposed in the POS machine, and one processor is used to run the POS operation. The system, the other processor is used for the password input, obtains the password information, and is encrypted and sent to the processor running the POS operating system, which is substantially the same as the above embodiment, and will not be described herein.

[0072] The password security input device in the POS machine provided in the embodiment of the present invention, the POS machine operating system based on the POS machine running processor receives the password input command, and the switching unit 10 switches the input signal of the touch screen to the security chip. The obtaining unit 20 acquires the password information input by the touch screen through the security chip; after the password input is completed, the processing unit 30 encrypts the password information and sends the password information to the POS machine to run the processor; after the user inputs the password, The password information is obtained by the security chip to prevent the password information from being stolen and enhance the security of the POS machine.

[0073] Further, the switching unit 10 is specifically configured to:

[0074] controlling the touch screen to connect the signal data line of the POS machine running processor to switch to the security chip.

[0075] The touch screen is provided with a signal data line. Usually, one end of the signal data line is connected to the touch screen, and the other end is connected to the POS running processor, and the other end can also be connected to the security chip. In the normal state (non-password input state), the signal data line of the touch screen is connected to the POS machine running processor, and when the POS machine operating system receives the password input command, the signal data line of the control touch screen is switched and connected to the security chip. Therefore, the signal transmission between the touch screen and the running processor of the POS machine is cut off, and the data acquired by the touch screen is all transmitted to the security chip, and even if the operating system hits the Trojan, the password information input by the user touching the screen cannot be obtained, and the password is avoided. Information is stolen and POS security is enhanced.

[0076] Further, the switching unit 10 is further configured to:

[0077] controlling a display interface of the operating system end of the POS machine to switch to a password input display state.

[0078] When the card user is required to input a password, enter the card user password input state, the signal data line of the touch screen is connected to the security chip, and the control chip sends the control information to the application POS operating system through the security chip. The linux kernel switches to the password input display state, so that the display content of the original application is not destroyed.

[0079] Further, the obtaining unit 20 is further configured to:

[0080] Sending an instruction without a plaintext PIN to the operating system end of the POS machine, and displaying the password in a password invisible manner on the display interface of the operating system end of the POS machine. The security chip obtains the input data of the touch screen, analyzes which key the user presses, presses the key, and sends an instruction without the plaintext PIN to the Linux kernel of the operating system, and the linux kernel update password input "*" at the operating system end of the POS machine. No., the password is displayed invisible in the password.

[0081] In this embodiment, the password information input by the touch screen is obtained by the security chip, a text input keyboard is provided in a password input interface of the touch screen, and the user inputs the account information by pressing a corresponding character on the keyboard; After the password is 加密, the entered password is encrypted and displayed, for example, the password is displayed as a special character such as "*" to prevent the screen from stealing the password.

[0082] Preferably, the text input keyboard inputs a password corresponding to the payment account, and the input characters are randomly displayed in the text input keyboard, so that the order of each display is different. Generally, the input method input characters on the POS machine are sorted according to the input characters on the keyboard. In the embodiment, the input characters are randomly displayed in the text input keyboard, which means that the input characters on the keyboard are re-randomly randomized. Arranged and distributed in the text input keyboard, the order of each display is different, so that the password input by the user can be obtained according to the position where the user clicks the text input keyboard, thereby further ensuring the security of the password input by the user.

[0083] Further, referring to FIG. 4, in another embodiment, the apparatus further includes:

[0084] The clearing unit 40 is configured to clear the plaintext password cache that the security chip obtains the password information. After the card user enters the password, the password is encrypted inside the security chip using the password encryption key.

, Clear the clear text password cache for password information.

[0085] In some embodiments, after the security chip obtains the password information, it does not send it to the POS machine to run the processor for verification, but performs password verification directly in the security chip, and then sends the verification result to the POS-based authentication. The machine runs the processor's POS operating system.

[0086] In some other embodiments, if the payment is to support the use of fingerprint payment, the fingerprint data may be transmitted to the security chip after the fingerprint data is collected for payment, and the fingerprint data of the fingerprint identifier is cut off. The POS machine runs the channel of the processor. [0087] It will be apparent to those skilled in the art that, for the convenience and brevity of the description, the specific working process of the device and the unit described above may be referred to the corresponding process in the foregoing method embodiment, and details are not described herein again.

[0088] In summary, the password security input method and device in the POS machine provided in the embodiment of the present invention, the POS machine operating system based on the POS machine running processor receives the password input command, and the switching unit 10 will touch the screen. The input signal is switched to the security chip; the obtaining unit 20 acquires the password information input by the touch screen through the security chip; after the password input is completed, the processing unit 30 encrypts the password information and sends the password information to the POS machine for processing. After the user enters the password, the security chip obtains the password information, avoids the password information being stolen, and enhances the security of the POS machine.

[0089] Those skilled in the art will appreciate that the present invention includes apparatus related to performing one or more of the operations described herein. These devices may be specially designed and manufactured for the required purposes, or may also include known devices in a general purpose computer. These devices have computer programs stored therein that are selectively activated or reconfigured. Such computer programs may be stored in a device (eg, computer) readable medium or in any type of medium suitable for storing electronic instructions and respectively coupled to a bus, including but not limited to any Types of disks (including floppy disks, hard disks, CDs, CD-ROMs, and magneto-optical disks), ROM (Read-Only Memory, read-only memory), RAM (Random Access Memory), EPROM (Erasable)

Programmable Read-Only

Memory, EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory, magnetic card or light card. That is, a readable medium includes any medium that is stored or transmitted by a device (e.g., a computer) in a readable form.

[0090] Those skilled in the art will appreciate that each block of the block diagrams and/or block diagrams and/or flow diagrams can be implemented with computer program instructions, and/or in the block diagrams and/or block diagrams and/or flow diagrams. The combination of boxes. Those skilled in the art will appreciate that these computer program instructions can be implemented by a general purpose computer, a professional computer, or a processor of other programmable data processing methods, such that the processor is executed by a computer or other programmable data processing method. The block diagrams and/or block diagrams of the invention and/or the schemes specified in the blocks or blocks of the flow diagram are invented. Those skilled in the art can understand that the various operations, methods, and steps, measures, and solutions in the present invention may be alternated, changed, combined, or deleted. Further, other operations, methods, and steps in the various operations, methods, and processes that have been discussed in the present invention may be alternated, changed, rearranged, decomposed, combined, or deleted. Further, the steps, measures, and solutions in the various operations, methods, and processes in the prior art may be alternated, changed, rearranged, decomposed, combined, or deleted.

[0092]

The above description is only a preferred embodiment of the present invention, and is not intended to limit the scope of the invention, and the equivalent structure or equivalent process transformations made by the description of the invention and the drawings are used directly or indirectly. Other related technical fields are equally included in the scope of patent protection of the present invention.

Claims

Claim

A password security input method in a POS machine, wherein the POS machine is provided with a security chip and a POS machine operation processor, and the password security input method comprises the following steps:

The P0S machine operating system based on the P0S machine running processor receives the password input command 吋, and switches the input signal of the touch screen to the security chip;

Obtaining password information input by the touch screen by using the security chip;

After the password input is completed, the password information is encrypted and sent to the POS running processor.

The cryptographic security input method in a POS machine according to claim 1, wherein the step of switching an input signal of the touch screen into the security chip comprises:

A signal data line controlling the touch screen to connect to the POS machine operating processor is switched to be connected to the security chip.

The password security input method in the POS machine according to claim 1, wherein the step of switching the input signal of the touch screen to the security chip comprises: controlling the display interface of the operating system of the POS machine to switch to the password Enter the display status. The cryptographic security input method in the POS machine according to claim 3, wherein the step of acquiring the password information input by the touch screen by the security chip comprises:

Sending an instruction without a plain text PIN to the operating system of the POS machine, and displaying the password in a password invisible manner on the display interface of the operating system side of the POS machine.

The cryptographic security input method in a POS machine according to any one of claims 1 to 4, wherein after the password input is completed, the password information is encrypted and then sent to the

The steps of the POS machine running the processor include:

Clearing the plaintext password cache of the security chip to obtain password information.

A password security input device in a POS machine, wherein the POS machine is provided with a security chip and a POS machine running processor, and the password security input device comprises: a switching unit, configured to run a processor based on the POS machine POS machine operating system receives the password The input command 切换 is used to switch the input signal of the touch screen to the security chip; the obtaining unit is configured to acquire the password information input by the touch screen by using the security chip; and the processing unit is configured to encrypt the password information after the password input is completed Then sent to the POS machine to run the processor.

[Claim 7] The cryptographic security input device in the POS machine according to claim 6, wherein the switching unit is specifically configured to:

[Claim 8] The cryptographic security input device in the POS machine according to claim 6, wherein the switching unit is further configured to:

Controlling the display interface of the operating system end of the POS machine to switch to the password input display state.

[Claim 9] The cryptographic security input device in the POS machine according to claim 8, wherein the acquiring unit is further configured to:

[Claim 10] The cryptographic security input device in the POS machine according to any one of claims 6-9, wherein the device further comprises:

The clearing unit is configured to clear the plaintext password cache that the security chip obtains the password information.