WO2024020828A1 - 显示终端、服务器以及信息安全发布系统 - Google Patents

显示终端、服务器以及信息安全发布系统 Download PDF

Info

Publication number
WO2024020828A1
WO2024020828A1 PCT/CN2022/108129 CN2022108129W WO2024020828A1 WO 2024020828 A1 WO2024020828 A1 WO 2024020828A1 CN 2022108129 W CN2022108129 W CN 2022108129W WO 2024020828 A1 WO2024020828 A1 WO 2024020828A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
file
unit
subunit
display terminal
Prior art date
Application number
PCT/CN2022/108129
Other languages
English (en)
French (fr)
Inventor
马希通
耿立华
夏友祥
Original Assignee
京东方科技集团股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 京东方科技集团股份有限公司 filed Critical 京东方科技集团股份有限公司
Priority to CN202280002396.6A priority Critical patent/CN117795902A/zh
Priority to PCT/CN2022/108129 priority patent/WO2024020828A1/zh
Publication of WO2024020828A1 publication Critical patent/WO2024020828A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Definitions

  • the present disclosure belongs to the field of information detection technology, and specifically relates to a display terminal, a server and an information security release system.
  • the present disclosure aims to solve at least one of the technical problems existing in the prior art, and provide a display terminal, a server and an information security release system that can effectively solve security issues in the information release process.
  • embodiments of the present disclosure provide a display terminal, which includes a monitoring module and a display module;
  • the monitoring module includes a file request unit, an identity authentication unit, and a content authentication unit;
  • the file request unit is configured to receive a device authentication result sent by the server, and when the device authentication result indicates that the display terminal has passed the authentication, send a file delivery request to the server;
  • the identity authentication unit is configured to receive the encrypted authentication file issued by the server according to the file issuance request, and authenticate the identity information of the encrypted authentication file;
  • the display module is configured to display the data content in the encrypted authentication file when the identity authentication is passed;
  • the content authentication unit is configured to determine whether the data content is correct according to the first image displayed by the display module.
  • the identity authentication unit includes a first decryption subunit, a first processing subunit and a character comparison subunit;
  • the first decryption subunit is configured to receive the encrypted authentication file, and use the pre-stored first encryption and decryption key to decrypt the encrypted authentication file to obtain a decrypted authentication file;
  • the decrypted authentication file includes The data content and first character information;
  • the first processing subunit is configured to process the data content through a preset algorithm to obtain second character information corresponding to the data content;
  • the character comparison subunit is configured to compare the first character information with the second character information, and determine whether the identity information of the encrypted authentication file can be authenticated based on the comparison result.
  • the display terminal further includes a first processing unit and an image sensor integrated on the display module;
  • the image sensor is configured to collect the sub-image displayed in the first preset area of the first image displayed by the display module
  • the first processing unit is configured to receive the data content sent by the identity authentication unit, and send the data content to the display module for display.
  • the content authentication unit includes a first receiving subunit and a content authentication subunit
  • the first receiving subunit is configured to receive the sub-image sent by the image sensor
  • the content authentication subunit is configured to verify the display information of the sub-image according to pre-stored verification information to determine whether the data content is correct.
  • the display terminal further includes a second processing unit
  • the second processing unit is configured to respond to a user authorization request initiated by the user storage device, determine to grant the user the first permission to start or close the display terminal, and send the pre-stored user ciphertext information to The server; and, when the password entered by the user matches the preset authorization password, determine to grant the user a second authority to operate the preset function of the display terminal;
  • the display module is further configured to display a password input window when the user storage device initiates a user authorization request; and, in response to the user's input operation, display the password input by the user.
  • the monitoring module further includes a charging unit, a battery and a communication unit;
  • the charging unit is configured to charge the battery
  • the battery is configured to power the image sensor, the file request unit, the identity authentication unit, the content authentication unit and the communication unit in the display terminal;
  • the communication unit is configured to communicate with the server.
  • the display terminal further includes a device authentication request unit
  • the device authentication request unit is configured to send a device authentication request to the server when the received device authentication information indicates that the display terminal authentication has failed; the device authentication request carries the Display the device secret information of the terminal.
  • embodiments of the present disclosure also provide a server, which includes a device authentication unit, a file encryption unit and a content monitoring unit;
  • the device authentication unit is configured to respond to a device authentication request sent by a display terminal, perform device authentication on the display terminal, obtain a device authentication result, and feed back the device authentication result to the display terminal;
  • the file encryption unit is configured to respond to the file delivery request sent by the display terminal, encrypt the target file to be delivered, and obtain an encrypted authentication file;
  • the content monitoring unit is configured to receive the authentication result of the data content sent by the display terminal and monitor whether the data content is correct.
  • the server further includes a device registration unit;
  • the device registration unit includes a second receiving subunit, a type selection subunit and a first encryption subunit;
  • the second receiving subunit is configured to receive the first device identification and device type of the terminal to be registered
  • the type selection subunit is configured to determine the device authentication type selected by the user
  • the first encryption subunit is configured to use the pre-stored second encryption and decryption key to encrypt the first device identification, the device type and the device authentication type to obtain device ciphertext information, and
  • the terminal to be registered serves as a registered display terminal, and sends the device ciphertext information to the registered display terminal for storage.
  • the device authentication unit includes a second decryption subunit and an identification comparison subunit
  • the second decryption subunit is configured to respond to the device authentication request sent by the display terminal, extract the device ciphertext information carried in the device authentication request, and use the second encryption and decryption key to encrypt the device. Decrypt the text information to obtain the second device identification of the display terminal;
  • the identification comparison subunit is configured to compare the second device identification with a pre-stored first device identification of a registered display terminal, obtain a device authentication result, and feed back the device authentication result to the Display terminal.
  • the file encryption unit includes a labeling subunit, a second processing subunit and a second encryption subunit; the device registration unit also includes a key generation subunit;
  • the key generation subunit is configured to generate a first encryption and decryption key according to the first device identification of the registered display terminal, and send the first encryption and decryption key to the registered display terminal.
  • the annotation subunit is configured to, in response to the file delivery request sent by the display terminal, replace the display information of the second image in the second preset area of each frame of the file to be delivered with the verification information, and Replace the completed pre-delivery file as the target file;
  • the second processing subunit is configured to process the target file through a preset algorithm to obtain the first character information corresponding to the target file;
  • the second encryption subunit is configured to use the pre-stored first encryption and decryption key to encrypt the first character information and the target file to generate an encrypted authentication file.
  • the server further includes a user registration unit; the user registration unit includes a third receiving subunit and a third encryption subunit;
  • the third receiving subunit is configured to receive the first authorization identification of the user to be registered; the first authorization identification includes the identification of the user storage device;
  • the third encryption subunit is configured to use a pre-stored third encryption and decryption key to encrypt the first authorization identification, obtain user ciphertext information, and send the user ciphertext information to the display Terminal for storage.
  • the server further includes a password generation unit;
  • the password generation unit includes a fourth receiving subunit, a third decryption subunit and a password sending subunit;
  • the fourth receiving subunit is configured to receive user ciphertext information sent by the display terminal;
  • the third decryption subunit is configured to use the third encryption and decryption key to decrypt the user ciphertext information to obtain a second authorization identification;
  • the password sending subunit is configured to match the second authorization identification with the registered first authorization identification, and send a preset authorization password to the user who has successfully matched.
  • embodiments of the present disclosure also provide an information security release system, which includes the above-mentioned display terminal and the above-mentioned server;
  • the display terminal includes a monitoring module and a display module;
  • the monitoring module It includes a file request unit, an identity authentication unit and a content authentication unit;
  • the server includes a device authentication unit, a file encryption unit and a content monitoring unit;
  • the device authentication unit is configured to perform device authentication on the display terminal in response to a device authentication request sent by the display terminal, obtain a device authentication result, and send the device authentication result information to the file requesting unit;
  • the file request unit is configured to receive the device authentication result sent by the device authentication unit, and when the device authentication result indicates that the display terminal has passed the authentication, send a file delivery request to the file encryption unit;
  • the file encryption unit is configured to, in response to the file delivery request sent by the file request unit, encrypt the pre-delivered target file to obtain an encrypted authentication file;
  • the identity authentication unit is configured to receive the encrypted authentication file issued by the file encryption unit according to the file issuance request, and authenticate the identity information of the encrypted authentication file;
  • the display module is configured to display the data content when the identity authentication is passed;
  • the content authentication unit is configured to determine whether the data content is correct based on the first image displayed by the display module;
  • the content monitoring unit is configured to receive the authentication result of the data content sent by the content authentication unit and monitor whether the data content is correct.
  • the file encryption unit includes a labeling subunit, a second processing subunit, and a second encryption subunit;
  • the identity authentication unit includes a first decryption subunit, a first processing subunit, and a character comparison subunit. unit;
  • the annotation subunit is configured to, in response to the file delivery request sent by the file request unit, replace the display information in the second preset area of each frame of the second image in the file to be delivered with verification information, and Use the replaced pre-delivery file as the target file;
  • the second processing subunit is configured to process the target file through a preset algorithm to obtain the first character information corresponding to the target file;
  • the second encryption subunit is configured to use the pre-stored first encryption and decryption key to encrypt the first character information and the target file to generate an encrypted authentication file;
  • the first decryption subunit is configured to receive the encrypted authentication file, and use the first encryption and decryption key to decrypt the encrypted authentication file to obtain a decrypted authentication file;
  • the decrypted authentication file includes the Describe the data content and first character information;
  • the first processing subunit is configured to process the data content through the preset algorithm to obtain second character information corresponding to the data content;
  • the character comparison subunit is configured to compare the first character information with the second character information, and determine whether the identity information of the data content can be authenticated based on the comparison result.
  • the information security release system further includes a user storage device; the user storage device is communicatively connected to the display terminal and is configured to initiate a user authorization request to the display terminal.
  • Figure 1 is a schematic structural diagram of a display terminal provided by an embodiment of the present disclosure
  • Figure 2 is a schematic structural diagram of a display terminal provided by an embodiment of the present disclosure
  • Figure 3 is a schematic diagram of a server provided by an embodiment of the present disclosure.
  • Figure 4 is a schematic structural diagram of a device registration unit provided by an implementation example of the present disclosure.
  • Figure 5 is a schematic structural diagram of a user registration unit provided by an implementation example of the present disclosure.
  • Figure 6 is a schematic diagram of the interaction between a server and a display terminal provided by an embodiment of the present disclosure
  • Figure 7 is a schematic flowchart of information interaction provided by an embodiment of the present disclosure.
  • a plurality or several mentioned in this disclosure means two or more.
  • “And/or” describes the relationship between associated objects, indicating that there can be three relationships. For example, A and/or B can mean: A alone exists, A and B exist simultaneously, and B alone exists. The character “/” generally indicates that the related objects are in an "or” relationship.
  • Figure 1 is a schematic structural diagram of a display terminal provided by an embodiment of the present disclosure.
  • the display terminal includes a monitoring module and a display module; wherein, the monitoring module includes an integrated microcontroller unit (Microcontroller Unit). File request unit, identity authentication unit and content authentication unit on MCU).
  • Microcontroller Unit integrated microcontroller unit
  • the process of realizing information security release in the embodiment of the present disclosure includes three authentication stages, namely, device authentication stage, identity authentication stage and content authentication stage, in which the display terminal uses the identity authentication unit to transmit files in the identity authentication stage. Authentication of identity information; in the content authentication stage, the content authentication unit is used to authenticate the content of the transferred file.
  • the file request unit of the display terminal is only used to send a file delivery request to the server when the device authentication result indicates that the display terminal has passed the authentication. Therefore, it can be ensured that the display terminal used to receive the transmitted file has passed the authentication.
  • Device certified display terminal is only used to send a file delivery request to the server when the device authentication result indicates that the display terminal has passed the authentication. Therefore, it can be ensured that the display terminal used to receive the transmitted file has passed the authentication.
  • the file request unit is configured to receive the device authentication result sent by the server, and when the device authentication result indicates that the terminal authentication has passed, send a file delivery request to the server.
  • the device authentication result is an authentication result indicating that the display terminal has performed device authentication on the server side.
  • Device authentication includes detecting the identity information of the display terminal. Specifically, it may be verifying the device identification (Identity Document, ID) of the display terminal and determining whether the display terminal is a registered display terminal.
  • the device authentication result may be information indicating that the identity authentication of the display terminal has passed, or it may be information indicating that the identity authentication of the display terminal has failed. If the device authentication result indicates that the identity authentication of the display terminal has passed, the file request unit will The server sends a file delivery request.
  • the identity authentication unit is configured to receive the encrypted authentication file issued by the server according to the file delivery request, and to authenticate the identity information of the data content in the encrypted authentication file.
  • the encrypted authentication file is an encrypted file, and a specific key needs to be used to decrypt the encrypted authentication file to obtain the data content and summary information; then, the identity information of the data content is authenticated based on the summary information.
  • this summary information is only used to represent the identity information of the data content that has not been tampered with; the identity information includes, for example, attribute information such as the name, size and file type (including pictures, videos, special effects, etc.) of the file corresponding to the data content. .
  • the summary information may specifically be a hash value obtained by hashing the data content that has not been tampered with; or it may be a coded value obtained by performing a specific encoding on the data content that has not been tampered with, etc.
  • the embodiment of the present disclosure can be based on the actual scenario. Make settings.
  • the identity information of the data content changes, that is, some attribute characteristics of the data content change, but the decrypted summary information still represents Identity information of data content that has not been tampered with.
  • the display module is configured to display the data content in the encrypted authentication file when the identity authentication is passed.
  • the content authentication unit is configured to determine whether the data content is correct according to the first image displayed by the display module. If the content authentication passes, it is determined that the actual display information corresponding to the data content has not been tampered with.
  • the similarity between the pre-stored standard image and the first image can be used. If the similarity is higher, it is considered that the actual display information corresponding to the data content has not been tampered with, that is, the content authentication has passed; or, the third image can be detected. Whether there is a preset tag for an image. If the first image has a preset tag, it is considered that the actual display information corresponding to the data content has not been tampered with, that is, the content authentication has passed.
  • the display terminal provided by the embodiment of the present disclosure uses the file request unit to ensure that the display terminal used to receive the transmitted file is a display terminal that has passed device authentication, preventing some illegal display terminals from receiving files transmitted by the server; on the other hand,
  • the authentication of the identity information of the transferred file is realized through the identity authentication unit, which avoids the basic attribute characteristics of the transferred file being tampered with;
  • the content authentication of the transferred file is realized on the content authentication unit, which avoids the problem of the transmission file being displayed on the display module.
  • the actual displayed information has been tampered with. Therefore, the display terminal provided by the embodiment of the present disclosure can effectively solve the security problem in the information release process by monitoring multiple aspects during the information transmission process.
  • the identity authentication unit is used to authenticate the identity information of the transmitted file.
  • the identity authentication unit includes a first decryption subunit, a first processing subunit and a character comparison subunit.
  • the first decryption subunit is configured to receive the encrypted authentication file, and use the pre-stored first encryption and decryption key to decrypt the encrypted authentication file to obtain the decrypted authentication file.
  • the decrypted authentication file includes data content and first character information.
  • the first processing subunit is configured to process the data content through a preset algorithm to obtain second character information corresponding to the data content.
  • the character comparison subunit is configured to compare the first character information with the second character information, and determine whether the identity information of the data content can be authenticated based on the comparison result.
  • the first encryption and decryption key is generated by the server, and the encrypted authentication file is encrypted by the server using the first encryption and decryption key.
  • This disclosed embodiment adopts a symmetric encryption algorithm, such as Advanced Encryption Standard (AES) , the encryption key used is the decryption key, therefore, the server loads the generated first encryption and decryption key into the MCU for storage to provide the encryption authentication file for decryption in the decryption stage.
  • AES Advanced Encryption Standard
  • the first decryption subunit uses the pre-stored first encryption and decryption key to decrypt the encrypted authentication file and obtain the decrypted authentication file.
  • the decrypted authentication file includes data content and first character information.
  • the data content can be data information such as videos, pictures, animation special effects;
  • the first character information can be character information generated by the server using a preset algorithm to process the untampered data content, and then together with the untampered data content
  • the encrypted authentication file is obtained through encryption.
  • the data content is likely to be tampered with.
  • the first character information in the encrypted authentication file will not be tampered with. Therefore, the first character information is used for encryption authentication during the identity authentication stage.
  • the data content in the file is authenticated.
  • the first processing subunit is configured to process the data content through a preset algorithm to obtain the second character information corresponding to the data content, and the second character information is used for Identity information that characterizes the data content in an encrypted authentication file.
  • the character comparison subunit compares the first character information with the second character information to determine whether the first character information and the second character information are the same. If they are the same, it can be determined that the identity information authentication of the data content has passed; if they are not If the same, it can be determined that the identity information authentication of the data content failed.
  • the server performs SHA-256 calculation on the untampered data content and obtains the hash value S1, which is the first character information.
  • the first processing subunit performs SHA-256 calculation on the data content in the encrypted authentication file to obtain the hash value S2, which is the second character information;
  • the character comparison subunit compares the hash value S1 and hash value S2 , if the hash value S1 and the hash value S2 are the same, it is determined that the identity information authentication of the data content has passed; if the hash value S1 and the hash value S2 are different, it is determined that the identity information authentication of the data content has failed.
  • the display terminal also includes a system on chip (SOC) and an image sensor integrated on the display module.
  • SOC system on chip
  • a first processing unit and a second processing unit are integrated on the SOC.
  • the image sensor is configured to collect the sub-image displayed in the first preset area of the first image displayed by the display module; the first processing unit is configured to receive the data content sent by the identity authentication unit and send the data content to the display module for display.
  • the first preset area may be a preset fixed area on the display module.
  • the image sensor is attached to the surface of the display module and corresponds to the location of the first preset area.
  • the display module displays the screen of the terminal.
  • the content authentication unit is used to implement content authentication of the data content.
  • the content authentication unit includes a first receiving subunit and a content authentication subunit.
  • the first receiving sub-unit is configured to receive the sub-image sent by the image sensor;
  • the content authentication sub-unit is configured to verify the display information of the sub-image based on pre-stored verification information to determine whether the data content is correct.
  • the verification information can be a string or an image.
  • the verification information can be information configured by the user and stored in the MCU; or, the verification information can also be information generated by the server and loaded and stored in the MCU.
  • the sub-image contains preset information used to verify the display content of the display module, which is similar to a string or picture.
  • the content authentication subunit can use the similarity between the verification information and the display information to determine whether the data content displayed by the display module is correct. Taking the verification information as a picture as an example, the content authentication sub-unit compares and verifies the similarity between the picture and the sub-image. If the similarity is greater than or equal to the preset threshold, it is determined that the data content displayed by the display module is correct; if the similarity If it is less than the preset threshold, it is determined that the data content displayed by the display module is incorrect.
  • the present disclosure in order to improve the security of the information displayed on the display terminal, the present disclosure also needs to initiate user identity authentication to ensure that only authorized users have operating permissions on the display terminal and avoid the problem of tampering with the information displayed on the display terminal. .
  • the second processing unit is configured to, in response to a user authorization request initiated by the user storage device, determine to grant the user the first permission to start or close the display terminal; and, when the password entered by the user matches the preset authorization password, determine to grant the user Granting a second authority to operate the preset function of the display terminal; the display module is further configured to display a password input window when the user storage device initiates a user authorization request; and, in response to the user's input operation, display the password entered by the user.
  • the user storage device can be UKey.
  • UKey is a small storage device that is directly connected to the computer through the Universal Serial Bus interface (Universal Serial Bus, USB) and has a password verification function and is reliable and high-speed.
  • the first authority is the authority to start the display terminal or close the display terminal. Since the authority to start and shut down the display terminal is low, as long as the user initiates a user authorization request, the user can be granted the authority to turn on and off the display terminal.
  • the second authority is the authority set in advance for the user to be able to operate some functions of the display terminal.
  • the second permission may include display channel selection permission, content play/pause permission, volume adjustment permission, screen brightness adjustment permission, etc.
  • the second processing unit When the second processing unit detects that the user has inserted the UKey, it grants the first permission to the user corresponding to the UKey; at the same time, it controls the display module to display a password input window, which supports the user to input information.
  • the display module responds to the user's input operation and displays the password input window. The entered password is displayed.
  • FIG 2 is a schematic structural diagram of a display terminal provided by an embodiment of the present disclosure.
  • the monitoring module also includes a charging unit, a battery and a communication unit; the charging unit is configured to charge the battery; the battery It is configured to power the image sensor, MCU (i.e. file request unit, identity authentication unit and content authentication unit) and communication unit in the display terminal; the communication unit is configured to communicate with the server, specifically it can be wireless communication technology WiFi communication .
  • MCU i.e. file request unit, identity authentication unit and content authentication unit
  • the communication unit is configured to communicate with the server, specifically it can be wireless communication technology WiFi communication .
  • the monitoring module can be connected to the SOC inside the display terminal through a universal USB interface; the SOC charges the charging unit through SOC USB and communicates with the charging unit at the same time.
  • the monitoring module provided by the embodiment of the present disclosure adopts an independent power supply system and is connected to the display terminal through SOC USB. It can monitor the working status of the display terminal in real time, including identity authentication of data content, content authentication of data content, and abnormal shutdown, etc. Status can be widely used in unattended public display fields.
  • the display terminal further includes a device authentication request unit; the device authentication request unit is configured to send a device authentication request to the server when the received device authentication information indicates that the display terminal authentication has failed; the device authentication request carries The device secret information of the display terminal is displayed.
  • the display terminal receives the device authentication result issued by the server, and when the device authentication result indicates that the display terminal has passed the authentication, it uses the file request unit to send a file delivery request to the server.
  • the device authentication request unit is used to send a device authentication request to the server.
  • the device ciphertext information is pre-stored in the MCU, specifically generated by the server during the device authentication phase and loaded into the MCU.
  • the device secret information is used to represent the identity information of the display terminal.
  • FIG. 3 is a schematic diagram of a server provided by an embodiment of the present disclosure. As shown in Figure 3, the server includes a device authentication unit, a file encryption unit and a content monitoring unit.
  • the device authentication unit is configured to respond to the device authentication request sent by the display terminal, perform device authentication on the display terminal, obtain a device authentication result, and feed back the device authentication result to the display terminal.
  • the device authentication unit receives the device authentication request sent by the device authentication request unit of the display terminal.
  • the device authentication request carries the device ciphertext information of the display terminal, decrypts the device ciphertext information, and obtains the display Terminal identity information.
  • the pre-stored identity information of the registered display terminal is compared with the decrypted identity information of the current display terminal to obtain the device authentication result.
  • the device authentication result may be information indicating that the display terminal has passed the authentication, or it may be an indication that the display terminal has passed the authentication. Displays information about terminal authentication failure. Afterwards, the device authentication results are fed back to the display terminal.
  • the file encryption unit is configured to respond to a file delivery request sent by the display terminal, encrypt the target file to be delivered, and obtain an encrypted authentication file.
  • the content monitoring unit is configured to receive the authentication result of the data content sent by the display terminal and monitor whether the data content is correct.
  • the server uses the device authentication unit to perform identity authentication on the display terminal to receive the transmission file, which can ensure that the display terminal used to receive the transmission file is a display terminal that has passed device authentication, and avoids sending the transmission file to an illegal display displayed on the terminal.
  • the server encrypts the target files to be delivered, enabling confidential transmission of information.
  • the content monitoring unit can be used to realize real-time monitoring of the data content displayed by the display terminal.
  • Figure 4 is a schematic structural diagram of a device registration unit provided by an implementation example of the present disclosure.
  • the server also includes a device registration unit; the device registration unit includes a second receiving subunit, a type selection subunit and a third An encryption subunit.
  • the second receiving subunit is configured to receive the first device identification and device type of the terminal to be registered; the type selection subunit is configured to determine the device authentication type selected by the user; the first encryption subunit is configured to utilize the pre-stored third Use the second encryption and decryption key to encrypt the first device identification, device type and device authentication type to obtain device ciphertext information, use the terminal to be registered as a registered display terminal, and send the device ciphertext information to the registered display Terminal for storage.
  • the first device identification may be the device identification ID of the terminal to be registered, and the device identification ID may be the unique trusted identification of the MCU of the terminal to be registered.
  • the first device identification and device type information is provided to the user.
  • the device authentication type is the authentication type selected by the user, including one-machine-one-key, one-type-one-key, and unified key. Among them, one-machine-one-cipher generates the first encryption and decryption key for a single display terminal, one-type one encryption generates the first encryption and decryption key for a certain type of display terminal, and the unified key generates the first encryption and decryption key for all display terminals. Key generation, the embodiment of the present disclosure does not limit the authentication type.
  • the second encryption and decryption key can be a key randomly generated by the server.
  • the symmetric encryption algorithm AES is used to encrypt the first device identification, device type and device authentication type to obtain device ciphertext information.
  • the above-mentioned terminal to be registered is successfully registered.
  • the terminal to be registered is regarded as a registered display terminal, and the device ciphertext information is loaded into the MCU of the registered display terminal for storage, which will be used when the subsequent display terminal initiates a device authentication request. , carrying device ciphertext information as a condition for device authentication.
  • the device certification unit is used to perform device certification.
  • the device authentication unit includes a second decryption subunit and an identification comparison subunit.
  • the second decryption subunit is configured to respond to the device authentication request sent by the display terminal, extract the device ciphertext information carried in the device authentication request, and use the second encryption and decryption key to decrypt the device ciphertext information to obtain the display
  • the second device identification of the terminal is configured to compare the second device identification with the pre-stored first device identification of the registered display terminal, obtain the device authentication result, and feed the device authentication result back to the display terminal .
  • the second device identification is compared with the first device identification of each registered display terminal. If the first device identification and the second device identification are the same, the device authentication result indicates that the identity authentication of the display terminal is passed; if not If the first device identifier and the second device identifier are the same, the device authentication result indicates that the identity authentication of the terminal fails.
  • the device registration unit also includes a key generation subunit; the key generation subunit is configured to generate a first encryption and decryption key according to the first device identification of the registered display terminal, The first encryption and decryption key is sent to the registered display terminal for storage.
  • This disclosure takes the one-machine-one-key authentication type as an example.
  • the first encryption and decryption key generated during the device registration phase is used as the key for the subsequent system to authenticate the identity information of the data content.
  • the first device identification is the unique trusted identification of the secure MCU, and the MCU's unique trusted identification is not easy to crack, using the MCU's unique trusted identification of the monitoring module as the key for the subsequent system to authenticate the identity information of the data content can greatly Improve the security of identity authentication.
  • File encryption generates encrypted authentication files.
  • the file encryption unit includes a marking subunit, a second processing subunit, and a second encryption subunit; wherein the marking subunit is configured to respond to a file delivery request sent by the display terminal, and convert each frame in the file to be delivered
  • the display information of the second image in the second preset area is replaced with the pre-stored verification information, and the replaced pre-delivered file is used as the target file.
  • the files to be delivered are files sent by the server to the display terminal in advance, that is, files requested to be displayed by the display terminal, including data information such as videos, pictures, animation special effects, etc.
  • the second preset area corresponds to the first preset area of the display module, that is, the sub-image of the second image in the second preset area can be displayed in the first preset area of the display module. Replace the display information of the second image in the second preset area with the verification information. Specifically, you can use marking to replace the display information of the second image in the second preset area with a string or picture.
  • the second processing subunit is configured to process the target file through a preset algorithm to obtain first character information corresponding to the target file.
  • the preset algorithm may be the SHA-256 algorithm
  • the second processing subunit performs SHA-256 calculation on the target file to obtain the hash value S1, which is the first character information.
  • the second encryption subunit is configured to use the pre-stored first encryption and decryption key to encrypt the first character information and the target file to generate an encrypted authentication file.
  • FIG. 5 is a schematic structural diagram of a user registration unit provided by an implementation example of the present disclosure.
  • the server also includes a user registration unit; the user registration unit includes a third receiving subunit and a third encryption subunit.
  • the third receiving subunit is configured to receive the first authorization identification of the user to be registered; the first authorization identification includes the identification of the user storage device.
  • the user storage device may be the UKey held by the user, and the UKey has a unique device identification.
  • the user is also required to provide identity information.
  • the user identity information can include information that represents the user's ID or mobile phone number that has been authorized in the platform.
  • the user identity information is associated and stored with the identification of the user's storage device for subsequent presets. Sending of authorization password.
  • the third encryption subunit is configured to use the pre-stored third encryption and decryption key to encrypt the first authorization identification, obtain the user ciphertext information, and send the user ciphertext information to the display terminal for storage.
  • the third encryption and decryption key can be a randomly generated key, for example, it can be the same as the first encryption and decryption key, so there is no need to generate it again, and the first encryption and decryption key stored in the device registration stage can be directly called; Of course, since the third encryption and decryption key is randomly generated, it can also be different from the first encryption and decryption key. When the first authorization identification needs to be encrypted, it can be randomly generated. This is not done in this disclosed embodiment. Specific limitations.
  • the pre-stored third encryption and decryption key Utilize the pre-stored third encryption and decryption key to encrypt the first authorization identification through the AES encryption algorithm to obtain the user ciphertext information, and send the user ciphertext information to the MCU of the display terminal for storage, for subsequent user initiation
  • the user ciphertext information is received for user identity authentication.
  • the server also includes a password generation unit; the password generation unit includes a fourth receiving subunit, a third decryption subunit and a password sending subunit.
  • the fourth receiving subunit is configured to receive the user ciphertext information sent by the display terminal.
  • the third decryption subunit is configured to use the third encryption and decryption key to decrypt the user ciphertext information to obtain the second authorization identification.
  • the third encryption and decryption key is used to encrypt the authorization identification to generate user ciphertext information.
  • the third encryption and decryption key is called again to decrypt the user ciphertext information to obtain the second authorization identification.
  • the second authorization identification is the device identification of the currently detected user storage device.
  • the password sending subunit is configured to match the second authorization identification with the registered first authorization identification, and send the preset authorization password to the user who has successfully matched. If the user is a registered user, there is a registered first authorization identification that is the same as the second authorization identification, that is, the second authorization identification matches the first authorization identification successfully, and the user identity information associated with the second authorization identification is obtained. , using user identity information to send a preset authorization password to the user. If the user is an unregistered user, the first authorization identification and the second authorization identification are not the same, and the user identity authentication fails.
  • embodiments of the present disclosure also provide an information security publishing system, which includes the above-mentioned display terminal and server.
  • Figure 6 is a schematic diagram of the interaction between the server and the display terminal provided by the embodiment of the present disclosure.
  • the display terminal includes a monitoring module and a display module;
  • the monitoring module includes a file request unit, an identity authentication unit and a content authentication unit;
  • the server includes a device Authentication unit, file encryption unit and content monitoring unit.
  • the device authentication unit is configured to respond to the device authentication request sent by the display terminal, perform device authentication on the display terminal, obtain the device authentication result, and send the device authentication result information to the file requesting unit.
  • the file request unit is configured to receive the device authentication result sent by the device authentication unit, and when the device authentication result indicates that the terminal authentication has passed, send a file delivery request to the file encryption unit.
  • the file encryption unit is configured to respond to the file delivery request sent by the file request unit, encrypt the pre-delivered target file, and obtain an encrypted authentication file.
  • the identity authentication unit is configured to receive the encrypted authentication file issued by the file encryption unit according to the file delivery request, and authenticate the identity information of the data content in the encrypted authentication file.
  • the display module is configured to display the data content when the identity authentication is passed.
  • the content authentication unit is configured to determine whether the data content is correct according to the first image displayed by the display module.
  • the content monitoring unit is configured to receive the authentication result of the data content sent by the content authentication unit and monitor whether the data content is
  • An information security publishing system through the interaction between the display terminal and the server, uses the device authentication unit to perform identity authentication on the display terminal to receive the transmission file during the device authentication phase, which can ensure that the display terminal for receiving the transmission file For display terminals that have passed device certification, transmission files are prevented from being sent to illegal display terminals for display; the file encryption unit encrypts the target files to be distributed, enabling confidential transmission of information.
  • the identity authentication stage the identity information of the transferred file is authenticated through the identity authentication unit, which avoids the basic attribute characteristics of the transferred file being tampered with; in the content authentication stage, the content of the transferred file is authenticated through the content authentication unit, which avoids the need to The actual display information on the display module has been tampered with; the content monitoring unit can be used to realize real-time monitoring of the data content displayed on the display terminal. Therefore, the information security release system provided by the embodiments of the present disclosure can effectively solve security problems in the information release process through multi-faceted authentication and monitoring during the information transmission process.
  • the server interacts with the display terminal to authenticate the transferred files.
  • the file encryption unit includes a labeling subunit, a second processing subunit, and a second encryption subunit;
  • the identity authentication unit includes a first decryption subunit, a first processing subunit, and a character comparison subunit.
  • the annotation sub-unit is configured to respond to the file delivery request sent by the file request unit, replace the display information of the second image in the second preset area of each frame of the file to be delivered with the pre-stored verification information, and Use the replaced pre-delivery file as the target file.
  • the second processing subunit is configured to process the target file through a preset algorithm to obtain first character information corresponding to the target file.
  • the second encryption subunit is configured to use the pre-stored first encryption and decryption key to encrypt the first character information and the target file to generate an encrypted authentication file.
  • the first decryption subunit is configured to receive the encrypted authentication file, and use the first encryption and decryption key to decrypt the encrypted authentication file to obtain the decrypted authentication file; the decrypted authentication file includes data content and first character information.
  • the first processing subunit is configured to process the data content through a preset algorithm to obtain second character information corresponding to the data content.
  • the character comparison subunit is configured to compare the first character information with the second character information, and determine whether the identity information of the data content can be authenticated based on the comparison result.
  • each of the above sub-units please refer to the embodiments of each sub-unit of the file encryption unit of the server in the second aspect, and the embodiments of each sub-unit of the identity authentication unit of the display terminal in the first aspect.
  • the repeated parts are in This will not be described again.
  • the server interacts with the display terminal to implement content authentication of transferred files.
  • the display terminal also includes a first processing unit and an image sensor integrated on the display module; the content authentication unit of the display terminal includes a first receiving subunit and a content authentication subunit.
  • the image sensor is configured to collect a sub-image of the first image displayed by the display module and displayed in the first preset area.
  • the first processing unit is configured to receive the data content sent by the identity authentication unit and send the data content to the display module for display.
  • the first receiving sub-unit is configured to receive the sub-image sent by the image sensor.
  • the content authentication subunit is configured to verify the display information of the sub-image according to the pre-stored verification information to determine whether the data content is correct.
  • the content monitoring unit is configured to receive the authentication result of the data content sent by the display terminal and monitor whether the data content is correct.
  • each unit, and each subunit please refer to the specific embodiments of each subunit in the image sensor, the first processing unit, and the content authentication unit of the display terminal in the first aspect, and the second aspect.
  • the content monitoring unit of the server in this aspect repeated parts will not be described again here.
  • the server interacts with the display terminal to implement device authentication.
  • the display terminal also includes a device authentication request unit; the device authentication unit of the server includes a second decryption subunit and an identification comparison subunit.
  • the device authentication request unit is configured to send a device authentication request to the server when the received device authentication information indicates that the display terminal authentication has failed; the device authentication request carries device ciphertext information of the display terminal.
  • the second decryption subunit is configured to respond to the device authentication request sent by the display terminal, extract the device ciphertext information carried in the device authentication request, and use the second encryption and decryption key to decrypt the device ciphertext information to obtain the device ciphertext information.
  • Second device identifier is configured to compare the second device identification with a pre-stored first device identification of a registered display terminal, obtain a device authentication result, and feed back the device authentication result to the display terminal.
  • the server interacts with the display terminal to implement user authentication.
  • the information security release system also includes a user storage device; the display terminal also includes a second processing unit; the server also includes a password generation unit; the password generation unit includes a fourth receiving subunit and a third decryption subunit. and password sending subunit.
  • the user storage device is communicatively connected with the display terminal and is configured to initiate a user authorization request to the display terminal.
  • the second processing unit is configured to respond to the user authorization request initiated by the user storage device, determine to grant the user the first permission to start or close the display terminal, and send the user ciphertext information to the server.
  • the display module is further configured to display a password input window when the user storage device initiates a user authorization request.
  • the fourth receiving subunit is configured to receive user ciphertext information sent by the display terminal.
  • the third decryption subunit is configured to use the third encryption and decryption key to decrypt the user ciphertext information to obtain the second authorization identification.
  • the password sending subunit is configured to match the second authorization identification with the registered first authorization identification, and send the preset authorization password to the user who has successfully matched.
  • the display module is further configured to display the password input by the user in response to the user's input operation.
  • the second processing unit is further configured to determine to grant the user a second authority to operate the preset function of the display terminal when the password entered by the user matches the preset authorization password.
  • FIG. 7 is a schematic flow chart of information interaction provided by the embodiment of the present disclosure, as shown in Fig. As shown in 7, it includes six stages, in which the server side includes the device registration stage and the user registration stage.
  • the server interacts with the display terminal to implement device identity authentication, identity authentication of transferred files, content authentication of transferred files, and user identity authentication.
  • the display terminal includes monitoring module, SOC and display module.
  • the device registration stage specifically, receive the first device identification and device type of the terminal to be registered; determine the device authentication type selected by the user; use the pre-stored second encryption and decryption key to compare the first device identification, device type and device type.
  • the authentication type is encrypted to obtain the device ciphertext information; the device ciphertext information is sent to the registered display terminal for storage.
  • the user registration stage specifically, receive the first authorization identification of the user to be registered; the first authorization identification includes user identity information and the identification of the user storage device; use the pre-stored third encryption and decryption key to perform the first authorization identification
  • the user ciphertext information is obtained, and the user ciphertext information is sent to the display terminal for storage.
  • the monitoring module sends a device authentication request to the server; the device authentication request carries the device ciphertext information of the display terminal.
  • the server receives the device ciphertext information and decrypts it using the second encryption and decryption key to obtain the second device identification of the display terminal.
  • the second device identification is compared with the pre-stored first device identification of the registered display terminal to obtain a device authentication result, and the device authentication result is fed back to the display terminal.
  • the monitoring module determines that the device authentication result indicates that the terminal authentication has passed, it sends a file delivery request to the server.
  • the server replaces the display information of each frame of the second image in the second preset area in the file to be delivered with the pre-stored verification information, and uses the replaced pre-delivery file as the target file; After that, the target file is processed through a preset algorithm to obtain the first character information corresponding to the target file; then, the first character information and the target file are encrypted using the pre-stored first encryption and decryption key to generate an encryption authentication document.
  • the monitoring module receives the encrypted authentication file, and uses the first encryption and decryption key to decrypt the encrypted authentication file to obtain the decrypted authentication file; the decrypted authentication file includes data content and first character information; then, the data content is processed through a preset algorithm Process to obtain the second character information corresponding to the data content; then, compare the first character information with the second character information, and determine whether the identity information of the data content can be authenticated based on the comparison result; after that, the identity authentication passes
  • the data content is sent to the SOC, and the SOC controls the display module to play the data content; then, the monitoring module receives the sub-image sent by the image sensor, and verifies the display information of the sub-image based on the pre-stored verification information to determine whether the data content is correct. , and sends the content authentication result of the data content to the server, so that the server can monitor the authentication result of the received data content.
  • the SOC detects the user storage device, determines that the user is granted the first authority to start or close the display terminal, and controls the monitoring module to send the user ciphertext information to the server; at the same time, the SOC controls the display module to display Password input window.
  • the server uses the third encryption and decryption key to decrypt the received user ciphertext information to obtain the second authorization identification; after that, it matches the second authorization identification with the registered first authorization identification and sends a message to the successfully matched user. Default authorization password.
  • the SOC receives the password entered by the user, and when the password entered by the user matches the preset authorization password, determines to grant the user the second authority to operate the preset function of the display terminal.

Abstract

本公开提供一种显示终端、服务器以及信息安全发布系统，属于信息检测技术领域，其中，显示终端包括监测模块和显示模块；监测模块包括文件请求单元、身份认证单元和内容认证单元；文件请求单元，被配置为接收服务器发送的设备认证结果，并在设备认证结果指示显示终端认证通过的情况下，向服务器发送文件下发请求；身份认证单元，被配置为接收服务器依据文件下发请求所下发的加密认证文件，并对加密认证文件中的数据内容的身份信息进行认证；显示模块，被配置为在身份认证通过的情况下，将加密认证文件中的数据内容进行显示；内容认证单元，被配置为根据显示模块所显示的第一图像判断数据内容是否正确。

Description

显示终端、服务器以及信息安全发布系统 技术领域
本公开属于信息检测技术领域，具体涉及一种显示终端、服务器以及信息安全发布系统。
背景技术
随着计算机技术的迅猛发展，通过互联网传递信息的形式越来越广泛，例如利用通讯工具发布视频、文件或信息到指定设备上等。然而，信息在传输过程中容易遭到不法人员的篡改，或者引入非法设备展示发布的信息等，这对信息发布的安全性造成威胁。
发明内容
本公开旨在至少解决现有技术中存在的技术问题之一，提供一种显示终端、服务器以及信息安全发布系统，能够有效解决信息发布过程中的安全问题。
第一方面，本公开实施例提供了一种显示终端，其包括监测模块和显示模块；所述监测模块包括文件请求单元、身份认证单元和内容认证单元；
所述文件请求单元，被配置为接收服务器发送的设备认证结果，并在所述设备认证结果指示所述显示终端认证通过的情况下，向所述服务器发送文件下发请求；
所述身份认证单元，被配置为接收所述服务器依据所述文件下发请求所下发的加密认证文件，并对所述加密认证文件的身份信息进行认证；
所述显示模块，被配置为在身份认证通过的情况下，将所述加密认证文件中的数据内容进行显示；
所述内容认证单元，被配置为根据所述显示模块所显示的第一图像判断所述数据内容是否正确。
在一些实施例中，所述身份认证单元包括第一解密子单元、第一处理子单元和字符比对子单元；
所述第一解密子单元，被配置为接收所述加密认证文件，并利用预先存储的第一加解密密钥对所述加密认证文件进行解密处理，得到解密认证文件；所述解密认证文件包括所述数据内容和第一字符信息；
所述第一处理子单元，被配置为对所述数据内容通过预设算法进行处理，得到所述数据内容对应的第二字符信息；
所述字符比对子单元，被配置为将所述第一字符信息与所述第二字符信息进行比对，并根据比对结果判断所述加密认证文件的身份信息是否能够认证通过。
在一些实施例中，所述显示终端还包括第一处理单元以及集成在所述显示模块上的图像传感器；
所述图像传感器，被配置为采集所述显示模块显示的第一图像在第一预设区域显示的子图像；
所述第一处理单元，被配置为接收所述身份认证单元发送的所述数据内容，并将所述数据内容发送至所述显示模块进行显示。
在一些实施例中，所述内容认证单元包括第一接收子单元和内容认证子单元；
所述第一接收子单元，被配置为接收所述图像传感器发送的所述子图像；
所述内容认证子单元，被配置为根据预先存储的校验信息对所述子图像的显示信息进行校验，判断所述数据内容是否正确。
在一些实施例中，所述显示终端还包括第二处理单元；
所述第二处理单元，被配置为响应于用户存储设备发起的用户授权请求，确定为所述用户授予启动或关闭所述显示终端的第一权限，并将预先存储的用户密文信息发送给服务器；以及，在用户输入的口令与预设授权口令匹配时，确定为所述用户授予操作所述显示终端的预设功能的第二权限；
所述显示模块，还被配置为在所述用户存储设备发起用户授权请求时， 显示口令输入窗口；以及，响应于用户的输入操作，显示用户输入的口令。
在一些实施例中，所述监测模块还包括充电单元、电池和通信单元；
所述充电单元，被配置为对所述电池进行充电；
所述电池，被配置为为所述显示终端中的图像传感器、所述文件请求单元、所述身份认证单元和所述内容认证单元和所述通信单元供电；
所述通信单元，被配置为与所述服务器进行通信。
在一些实施例中，所述显示终端还包括设备认证请求单元；
所述设备认证请求单元，被配置为在接收到的所述设备认证信息指示所述显示终端认证未通过的情况下，向所述服务器发送设备认证请求；所述设备认证请求中携带有所述显示终端的设备密文信息。
第二方面，本公开实施例还提供了一种服务器，其包括设备认证单元、文件加密单元和内容监测单元；
所述设备认证单元，被配置为响应于显示终端发送的设备认证请求，对所述显示终端进行设备认证，得到设备认证结果，并将所述设备认证结果反馈至所述显示终端；
所述文件加密单元，被配置为响应于所述显示终端发送的文件下发请求，对待下发的目标文件进行加密处理，得到加密认证文件；
所述内容监测单元，被配置为接收所述显示终端发送的数据内容的认证结果，监测所述数据内容是否正确。
在一些实施例中，所述服务器还包括设备注册单元；所述设备注册单元包括第二接收子单元、类型选择子单元和第一加密子单元；
所述第二接收子单元，被配置为接收到待注册终端的第一设备标识和设备类型；
所述类型选择子单元，被配置为确定用户选择的设备认证类型；
所述第一加密子单元，被配置为利用预先存储的第二加解密密钥，对所述第一设备标识、所述设备类型和所述设备认证类型进行加密，得到设备密 文信息，将所述待注册终端作为已注册的显示终端，并将所述设备密文信息发送至所述已注册的显示终端进行存储。
在一些实施例中，所述设备认证单元包括第二解密子单元和标识比对子单元；
所述第二解密子单元，被配置为响应于显示终端发送的设备认证请求，提取所述设备认证请求中携带的设备密文信息，并利用所述第二加解密密钥对所述设备密文信息进行解密，得到所述显示终端的第二设备标识；
所述标识对比子单元，被配置为将所述第二设备标识与预先存储的已注册的显示终端的第一设备标识进行对比，得到设备认证结果，并将所述设备认证结果反馈至所述显示终端。
在一些实施例中，所述文件加密单元包括标注子单元、第二处理子单元和第二加密子单元；所述设备注册单元还包括密钥生成子单元；
所述密钥生成子单元，被配置为根据所述已注册的显示终端的第一设备标识，生成第一加解密密钥，并将所述第一加解密密钥发送到所述已注册的显示终端进行存储；
所述标注子单元，被配置为响应于所述显示终端发送的文件下发请求，将待下发文件中每帧第二图像在第二预设区域的显示信息替换为校验信息，并将替换完成的预下发文件作为所述目标文件；
所述第二处理子单元，被配置为对所述目标文件通过预设算法进行处理，得到所述目标文件对应的第一字符信息；
所述第二加密子单元，被配置为利用预先存储的所述第一加解密密钥，对所述第一字符信息和所述目标文件进行加密处理，生成加密认证文件。
在一些实施例中，所述服务器还包括用户注册单元；所述用户注册单元包括第三接收子单元和第三加密子单元；
所述第三接收子单元，被配置为接收待注册用户的第一授权标识；所述第一授权标识包括用户存储设备的标识；
所述第三加密子单元，被配置为利用预先存储的第三加解密密钥，对所述第一授权标识进行加密处理，得到用户密文信息，并将用户密文信息发送至所述显示终端进行存储。
在一些实施例中，所述服务器还包括口令生成单元；所述口令生成单元包括第四接收子单元、第三解密子单元和口令发送子单元；
所述第四接收子单元，被配置为接收所述显示终端发送的用户密文信息；
所述第三解密子单元，被配置为利用所述第三加解密密钥对所述用户密文信息进行解密，得到第二授权标识；
所述口令发送子单元，被配置为将所述第二授权标识与已注册的所述第一授权标识进行匹配，并向匹配成功的用户发送预设授权口令。
第三方面，本公开实施例还提供了一种信息安全发布系统，其包括上述所述的显示终端、以及如上述所述的服务器；所述显示终端包括监测模块和显示模块；所述监测模块包括文件请求单元、身份认证单元和内容认证单元；所述服务器包括设备认证单元、文件加密单元和内容监测单元；
所述设备认证单元，被配置为响应于显示终端发送的设备认证请求，对所述显示终端进行设备认证，得到设备认证结果，并将所述设备认证结果息发送至所述文件请求单元；
所述文件请求单元，被配置为接收设备认证单元发送的设备认证结果，并在所述设备认证结果指示所述显示终端认证通过的情况下，向所述文件加密单元发送文件下发请求；
所述文件加密单元，被配置为响应于所述文件请求单元发送的文件下发请求，对预下发的目标文件进行加密处理，得到加密认证文件；
所述身份认证单元，被配置为接收所述文件加密单元依据所述文件下发请求所下发的加密认证文件，并对所述加密认证文件的身份信息进行认证；
所述显示模块，被配置为在身份认证通过的情况下，将所述数据内容进行显示；
所述内容认证单元，被配置为根据所述显示模块所显示的第一图像判断所述数据内容是否正确；
所述内容监测单元，被配置为接收所述内容认证单元发送的所述数据内容的认证结果，监测所述数据内容是否正确。
在一些实施例中，所述文件加密单元包括标注子单元、第二处理子单元和第二加密子单元；所述身份认证单元包括第一解密子单元、第一处理子单元和字符比对子单元；
所述标注子单元，被配置为响应于所述文件请求单元发送的文件下发请求，将待下发文件中每帧第二图像在第二预设区域的显示信息替换为校验信息，并将替换完成的预下发文件作为所述目标文件；
所述第二处理子单元，被配置为对所述目标文件通过预设算法进行处理，得到所述目标文件对应的第一字符信息；
所述第二加密子单元，被配置为利用预先存储的第一加解密密钥，对所述第一字符信息和所述目标文件进行加密处理，生成加密认证文件；
所述第一解密子单元，被配置为接收所述加密认证文件，并利用所述第一加解密密钥对所述加密认证文件进行解密处理，得到解密认证文件；所述解密认证文件包括所述数据内容和第一字符信息；
所述第一处理子单元，被配置为对所述数据内容通过所述预设算法进行处理，得到所述数据内容对应的第二字符信息；
所述字符比对子单元，被配置为将所述第一字符信息与所述第二字符信息进行比对，并根据比对结果判断所述数据内容的身份信息是否能够认证通过。
在一些实施例中，所述信息安全发布系统还包括用户存储设备；所述用户存储设备与所述显示终端通信连接，被配置为向所述显示终端发起用户授权请求。
附图说明
图1为本公开实施例提供的一种显示终端的结构示意图；
图2为本公开实施例提供的显示终端的具体结构示意图；
图3为本公开实施例提供的一种服务器的示意图；
图4为本公开实施示例提供的设备注册单元的结构示意图；
图5为本公开实施示例提供的用户注册单元的结构示意图；
图6为本公开实施例提供的服务器与显示终端交互的示意图；
图7为本公开实施例提供的信息交互的流程示意图。
具体实施方式
为使本公开实施例的目的、技术方案和优点更加清楚，下面将结合本公开实施例中附图，对本公开实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本公开一部分实施例，而不是全部的实施例。通常在此处附图中描述和示出的本公开实施例的组件可以以各种不同的配置来布置和设计。因此，以下对在附图中提供的本公开的实施例的详细描述并非旨在限制要求保护的本公开的范围，而是仅仅表示本公开的选定实施例。基于本公开的实施例，本领域技术人员在没有做出创造性劳动的前提下所获得的所有其他实施例，都属于本公开保护的范围。
除非另外定义，本公开使用的技术术语或者科学术语应当为本公开所属领域内具有一般技能的人士所理解的通常意义。本公开中使用的“第一”、“第二”以及类似的词语并不表示任何顺序、数量或者重要性，而只是用来区分不同的组成部分。同样，“一个”、“一”或者“该”等类似词语也不表示数量限制，而是表示存在至少一个。“包括”或者“包含”等类似的词语意指出现该词前面的元件或者物件涵盖出现在该词后面列举的元件或者物件及其等同，而不排除其他元件或者物件。“连接”或者“相连”等类似的词语并非限定于物理的或者机械的连接，而是可以包括电性的连接，不管是直接的还是间接的。“上”、“下”、“左”、“右”等仅用于表示相对位置关系，当被描述对象的绝对位置改变后，则该相对位置关系也可能相应地改变。
在本公开中提及的“多个或者若干个”是指两个或两个以上。“和/或”， 描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。字符“/”一般表示前后关联对象是一种“或”的关系。
第一方面，图1为本公开实施例提供的一种显示终端的结构示意图，如图1所示，显示终端包括监测模块和显示模块；其中，监测模块包括集成在微控制单元(Microcontroller Unit，MCU)上的文件请求单元、身份认证单元和内容认证单元。
相关技术中存在多种技术漏洞，导致信息传输过程存在安全隐患，例如包括文件被篡改，假冒显示终端的身份信息等。针对上述相关技术的问题，本公开实施例实现信息安全发布的过程包括三个认证阶段，即设备认证阶段、身份认证阶段和内容认证阶段，其中显示终端在身份认证阶段利用身份认证单元实现传输文件的身份信息的认证；在内容认证阶段利用内容认证单元实现传输文件的内容的认证。需要说明的是，显示终端的文件请求单元仅用于在设备认证结果指示显示终端认证通过的情况下，向服务器发送文件下发请求，因此，能够确保用于接收传输文件的显示终端为已经通过设备认证的显示终端。
下面对显示终端实现信息安全发布的具体实现方式进行详细说明：
文件请求单元被配置为接收服务器发送的设备认证结果，并在设备认证结果指示显示终端认证通过的情况下，向服务器发送文件下发请求。这里，设备认证结果是指示显示终端在服务器侧已经进行设备认证后的认证结果。设备认证包括对显示终端的身份信息进行检测，具体可以是验证显示终端的设备标识(Identity Document，ID)，判断该显示终端是否为已注册的显示终端。设备认证结果可能是指示显示终端的身份认证通过的信息，或者也可能是指示显示终端的身份认证失败的信息，而在设备认证结果指示显示终端的身份认证通过的情况下，文件请求单元将向服务器发送文件下发请求。
身份认证单元被配置为接收服务器依据文件下发请求所下发的加密认证文件，并对加密认证文件中的数据内容的身份信息进行认证。加密认证文 件是加密后的文件，需要利用特定的密钥对加密认证文件进行解密，得到数据内容和摘要信息；之后，根据摘要信息对数据内容的身份信息进行认证。
需要说明的是，该摘要信息仅用于表征未被篡改的数据内容的身份信息；身份信息例如包括数据内容对应的文件的名称、大小和文件类型(包括图片、视频、特效等)等属性信息。摘要信息具体可以是对未被篡改的数据内容进行哈希运算得到的哈希值；又或者是对未被篡改的数据内容进行特定编码，得到的编码值等，本公开实施例可以根据实际场景进行设定。
以数据内容为视频为例，若视频属性信息被篡改(视频画面未被篡改)，则数据内容的身份信息发生改变，也即数据内容的一些属性特征发生改变，但是解密得到的摘要信息仍表征未被篡改的数据内容的身份信息。
显示模块被配置为在身份认证通过的情况下，将加密认证文件中的数据内容进行显示。
内容认证单元被配置为根据显示模块所显示的第一图像判断数据内容是否正确。若内容认证通过，则确定数据内容对应的实际显示信息未被篡改。
判断数据内容是否正确。在一些示例中，可以根据预先存储的标准图像与第一图像之间的相似度，相似度较高则认为数据内容对应的实际显示信息未被篡改，也即内容认证通过；或者，可以检测第一图像是否存在预设标签，若第一图像存在预设标签则认为数据内容对应的实际显示信息未被篡改，也即内容认证通过。
本公开实施例提供的显示终端，一方面，利用文件请求单元能够确保用于接收传输文件的显示终端为已经通过设备认证的显示终端，避免了一些非法显示终端接收到服务器传输的文件；另一方面，通过身份认证单元实现传输文件的身份信息的认证，避免了传输文件的基本属性特征被篡改；另一方面，通过内容认证单元实现传输文件的内容的认证，避免了传输文件在显示模块的实际显示信息被篡改。因此，本公开实施例提供的显示终端通过对信息传输过程中的多方面监测，能够有效解决信息发布过程中的安全问题。
在一些示例中，在身份认证阶段，利用身份认证单元实现传输文件的身 份信息的认证，具体地，身份认证单元包括第一解密子单元、第一处理子单元和字符比对子单元。其中，第一解密子单元被配置为接收加密认证文件，并利用预先存储的第一加解密密钥对加密认证文件进行解密处理，得到解密认证文件。解密认证文件包括数据内容和第一字符信息。第一处理子单元被配置为对数据内容通过预设算法进行处理，得到数据内容对应的第二字符信息。字符比对子单元被配置为将第一字符信息与第二字符信息进行比对，并根据比对结果判断数据内容的身份信息是否能够认证通过。
这里，第一加解密密钥是由服务器生成的，加密认证文件是服务器利用第一加解密密钥加密得到的，本公开实施例采用对称加密算法，例如高级加密标准(Advanced Encryption Standard，AES)，所用加密密钥即为解密密钥，因此，服务器将生成的第一加解密密钥加载到MCU中存储，以提供加密认证文件在解密阶段进行解密。基于此，在身份认证阶段，第一解密子单元利用预先存储的第一加解密密钥，对加密认证文件进行解密处理，能够得到解密认证文件。
解密认证文件包括数据内容和第一字符信息。其中，数据内容可以为视频、图片、动画特效等数据信息；第一字符信息可以是服务器对未被篡改的数据内容利用预设算法进行处理生成的字符信息，之后与未被篡改的数据内容一起加密得到加密认证文件，但是加密认证文件在传输过程中，数据内容很可能被篡改，加密认证文件中的第一字符信息不会被篡改，因此，在身份认证阶段利用第一字符信息对加密认证文件中的数据内容进行身份认证。
由于加密认证文件中的数据内容有被篡改的风险，因此，第一处理子单元被配置为对数据内容通过预设算法进行处理，得到数据内容对应的第二字符信息，第二字符信息用于表征加密认证文件中的数据内容的身份信息。之后，字符比对子单元将第一字符信息与第二字符信息进行比对，判断第一字符信息和第二字符信息是否相同，若相同，则可以确定数据内容的身份信息认证通过；若不相同，则可以确定数据内容的身份信息认证失败。
以预设算法为SHA-256算法为例，服务器对未被篡改的数据内容进行SHA-256计算，得到哈希值S1，也即第一字符信息。第一处理子单元对加 密认证文件中的数据内容进行SHA-256计算，得到哈希值S2，也即第二字符信息；字符比对子单元将哈希值S1和哈希值S2进行比对，若哈希值S1与哈希值S2相同，则确定数据内容的身份信息认证通过；若哈希值S1与哈希值S2不同，则确定数据内容的身份信息认证失败。
如图1所示，显示终端还包括系统级芯片(System on Chip，SOC)以及集成在显示模块上的图像传感器。在SOC上集成有第一处理单元和第二处理单元。
在一些示例中，图像传感器被配置为采集显示模块显示的第一图像在第一预设区域显示的子图像；第一处理单元被配置为接收身份认证单元发送的数据内容，并将数据内容发送至显示模块进行显示。
这里，第一预设区域可以是预先设置的位于显示模块上的固定区域。图像传感器贴服在显示模块表面，且与对应第一预设区域所在位置。显示模块为显示终端的屏幕。
在一些示例中，在内容认证阶段，利用内容认证单元实现数据内容的内容认证，具体地，内容认证单元包括第一接收子单元和内容认证子单元。其中，第一接收子单元被配置为接收图像传感器发送的子图像；内容认证子单元被配置为根据预先存储的校验信息对子图像的显示信息进行校验，判断数据内容是否正确。
这里，校验信息可以是字符串或图片。具体地，校验信息可以是用户配置的信息，并存储在MCU中；或者，校验信息也可以是服务器生成的信息，加载在MCU中存储的。子图像中包含预先设置的用于验证显示模块显示内容的信息，其与字符串或图片相似。内容认证子单元可以利用校验信息与显示信息之间的相似度，判断显示模块显示的数据内容是否正确。以校验信息为图片为例，内容认证子单元对比校验图片与子图像之间的相似度，若相似度大于或等于预设阈值，则确定显示模块所显示的数据内容正确；若相似度小于预设阈值，确定显示模块所显示的数据内容错误。
在一些示例中，本公开为了提高显示终端显示信息的安全性，还需要发 起用户身份认证，以确保仅有授权用户具有对显示终端的操作权限，避免了显示终端所显示的信息被篡改的问题。
第二处理单元被配置为响应于用户存储设备发起的用户授权请求，确定为用户授予启动或关闭显示终端的第一权限；以及，在用户输入的口令与预设授权口令匹配时，确定为用户授予操作显示终端的预设功能的第二权限；显示模块还被配置为在用户存储设备发起用户授权请求时，显示口令输入窗口；以及，响应于用户的输入操作，显示用户输入的口令。
这里，用户存储设备可以为UKey，UKey是一种通过通用串行总线接口(Universal Serial Bus，USB)直接与计算机相连、具有密码验证功能、可靠高速的小型存储设备。第一权限为启动显示终端或关闭显示终端的权限。由于启动和关闭显示终端的权限较低，因此，只要用户发起用户授权请求，即可被授予显示终端开关机的权限。第二权限为预先为用户设置的能够操作显示终端的部分功能的权限。例如，第二权限可以包括显示通道选择权限、内容播放/暂停权限、音量调整权限、屏幕亮度调整权限等。
第二处理单元在检测到用户插入UKey，则为UKey对应的用户授予第一权限；同时控制显示模块显示口令输入窗口，该口令输入窗口支持用户输入信息，显示模块响应用户的输入操作，将用户输入的口令进行显示。
在一些示例中，图2为本公开实施例提供的显示终端的具体结构示意图，如图2所示，监测模块还包括充电单元、电池和通信单元；充电单元被配置为对电池进行充电；电池被配置为为显示终端中的图像传感器、MCU(也即文件请求单元、身份认证单元和内容认证单元)和通信单元供电；通信单元被配置为与服务器进行通信，具体可以为无线通信技术WiFi通信。
监测模块可以通过通用USB接口与显示终端内部的SOC连接；SOC通过SOC USB为充电单元进行充电，同时与充电单元进行通信。
这里，本公开实施例提供的监测模块采用独立的供电系统，通过SOC USB与显示终端连接，可以实时监控显示终端的工作状态，包括数据内容的身份认证、数据内容的内容认证、以及异常关机等状态，可以广泛被应用在 无人值守的公共显示领域。
在一些示例中，显示终端还包括设备认证请求单元；设备认证请求单元被配置为在接收到的设备认证信息指示显示终端认证未通过的情况下，向服务器发送设备认证请求；设备认证请求中携带有显示终端的设备密文信息。
显示终端接收到服务器下发的设备认证结果，在设备认证结果指示显示终端认证通过的情况下，利用文件请求单元向服务器发送文件下发请求。在设备认证信息指示显示终端认证未通过的情况下，利用设备认证请求单元向服务器发送设备认证请求。
设备密文信息是预先存储在MCU中的，具体是基于服务器在设备认证阶段生成并加载到MCU中的。设备密文信息用于表征显示终端的身份信息。
第二方面，基于同一发明构思，本公开实施例还提供了一种服务器，其能够与上述显示终端实现信息交互。图3为本公开实施例提供的一种服务器的示意图，如图3所示，服务器包括设备认证单元、文件加密单元和内容监测单元。
设备认证单元被配置为响应于显示终端发送的设备认证请求，对显示终端进行设备认证，得到设备认证结果，并将设备认证结果反馈至显示终端。
具体地，在设备认证阶段，设备认证单元接收到显示终端的设备认证请求单元发送的设备认证请求，设备认证请求中携带有显示终端的设备密文信息，对设备密文信息进行解密，得到显示终端的身份信息。之后，利用预先存储的已注册的显示终端的身份信息与解密得到的当前显示终端的身份信息进行对比，得到设备认证结果，设备认证结果可能是指示显示终端认证通过的信息，或者也可能是指示显示终端认证失败的信息。之后，将设备认证结果反馈至显示终端。
文件加密单元被配置为响应于显示终端发送的文件下发请求，对待下发的目标文件进行加密处理，得到加密认证文件。
内容监测单元被配置为接收显示终端发送的数据内容的认证结果，监测数据内容是否正确。
本公开实施例提供的服务器，利用设备认证单元对待接收传输文件的显示终端进行身份认证，能够确保用于接收传输文件的显示终端为已经通过设备认证的显示终端，避免了传输文件发送到非法显示终端上显示。另外，服务器对待下发的目标文件进行加密处理，能够实现信息的保密传输。另外，利用内容监测单元能够实现对显示终端所显示的数据内容的实时监测。
在一些示例中，图4为本公开实施示例提供的设备注册单元的结构示意图，如图4所示，服务器还包括设备注册单元；设备注册单元包括第二接收子单元、类型选择子单元和第一加密子单元。
第二接收子单元被配置为接收到待注册终端的第一设备标识和设备类型；类型选择子单元被配置为确定用户选择的设备认证类型；第一加密子单元被配置为利用预先存储的第二加解密密钥，对第一设备标识、设备类型和设备认证类型进行加密，得到设备密文信息，将待注册终端作为已注册的显示终端，并将设备密文信息发送至已注册的显示终端进行存储。
第一设备标识可以为待注册终端的设备标识ID，该设备标识ID可以是待注册终端的MCU的唯一可信标识。第一设备标识和设备类型为用户提供的信息。设备认证类型为用户选择的认证类型，包括一机一密、一型一密和统一密钥等。其中，一机一密针对单一显示终端进行第一加解密密钥生成，一型一密针对某一类型显示终端进行第一加解密密钥生成，统一密钥针对所有显示终端进行第一加解密密钥生成，本公开实施例不对认证类型进行限定。
这里，第二加解密密钥可以为服务器随机生成的密钥，利用对称加密算法AES，对第一设备标识、设备类型和设备认证类型进行加密处理，得到设备密文信息。此时上述待注册终端注册成功，将待注册终端作为已注册的显示终端，并将设备密文信息加载到该已注册的显示终端的MCU内部进行存储，用于后续显示终端发起设备认证请求时，携带设备密文信息作为设备认证的条件。
在一些示例中，在设备认证阶段，设备认证单元用于进行设备认证。具 体地，设备认证单元包括第二解密子单元和标识比对子单元。其中，第二解密子单元被配置为响应于显示终端发送的设备认证请求，提取设备认证请求中携带的设备密文信息，并利用第二加解密密钥对设备密文信息进行解密，得到显示终端的第二设备标识；标识对比子单元被配置为将第二设备标识与预先存储的已注册的显示终端的第一设备标识进行对比，得到设备认证结果，并将设备认证结果反馈至显示终端。
具体地，第二设备标识与已注册的各个显示终端的第一设备标识分别进行对比，若存在第一设备标识与第二设备标识相同，则设备认证结果指示显示终端的身份认证通过；若不存在第一设备标识与第二设备标识相同，则设备认证结果指示显示终端的身份认证失败。
在一些示例中，如图4所示，设备注册单元还包括密钥生成子单元；密钥生成子单元被配置为根据已注册的显示终端的第一设备标识，生成第一加解密密钥，并将第一加解密密钥发送到已注册的显示终端进行存储。
本公开以一机一密的认证类型为例进行说明，设备注册阶段中将生成的第一加解密密钥作为后续系统对数据内容的身份信息认证的密钥。
由于第一设备标识为安全MCU唯一可信标识，且MCU唯一可信标识不容易被破解，因此利用监测模块的MCU唯一可信标识作为后续系统对数据内容的身份信息认证的密钥，能够大大提高身份认证的安全性。
文件加密生成加密认证文件。具体地，文件加密单元包括标注子单元、第二处理子单元和第二加密子单元；其中，标注子单元被配置为响应于显示终端发送的文件下发请求，将待下发文件中每帧第二图像在第二预设区域的显示信息替换为预先存储的校验信息，并将替换完成的预下发文件作为目标文件。这里，待下发文件为服务器预向显示终端发送的文件，也即显示终端请求显示的文件，包括视频、图片、动画特效等数据信息。第二预设区域与显示模块的第一预设区域对应，也即第二图像在第二预设区域的子图像能够显示在显示模块的第一预设区域。将第二图像在第二预设区域的显示信息替换为校验信息，具体地，可以利用打标的方式，将第二图像在第二预设区域 的显示信息替换为字符串或图片。第二处理子单元被配置为对目标文件通过预设算法进行处理，得到目标文件对应的第一字符信息。这里，预设算法可以为SHA-256算法，第二处理子单元对目标文件进行SHA-256计算，得到哈希值S1，也即第一字符信息。第二加密子单元被配置为利用预先存储的第一加解密密钥，对第一字符信息和目标文件进行加密处理，生成加密认证文件。
在一些示例中，为了满足仅特定用户能够合法操作已注册的显示终端，本公开实施例还需要对用户的身份信息进行注册。图5为本公开实施示例提供的用户注册单元的结构示意图，如图5所示，服务器还包括用户注册单元；用户注册单元包括第三接收子单元和第三加密子单元。其中，第三接收子单元被配置为接收待注册用户的第一授权标识；第一授权标识包括用户存储设备的标识。这里，用户存储设备可以为用户手持的UKey，UKey具有唯一的设备标识。另外，还需要用户提供身份信息，用户身份信息可以包括表征用户的ID或手机号码等在平台中已授权的信息，并将用户身份信息与用户存储设备的标识进行关联存储，用于后续预设授权口令的发送。第三加密子单元被配置为利用预先存储的第三加解密密钥，对第一授权标识进行加密处理，得到用户密文信息，并将用户密文信息发送至显示终端进行存储。这里，第三加解密秘钥可以为随机生成的密钥，例如可以与第一加解秘钥相同，则不需要再生成，直接调用设备注册阶段中存储的第一加解密密钥即可；当然，由于是第三加解密密钥是随机生成，因此也可以与第一加解密密钥不同，在需要对第一授权标识进行加密时，随机生成即可，对此本公开实施例不进行具体限定。利用预先存储的第三加解密密钥，通过AES加密算法对第一授权标识进行加密，得到用户密文信息，并将用户密文信息发送至显示终端的MCU中进行存储，用于后续用户发起用户授权请求时，接收用户密文信息进行用户身份认证。
在一些示例中，本公开为了避免显示终端所显示的信息被不法人员篡改，本公开还需要对用户的身份进行认证，以确保仅有授权用户具有对显示终端的操作权限。在用户身份认证阶段，服务器还包括口令生成单元；口令 生成单元包括第四接收子单元、第三解密子单元和口令发送子单元。其中，第四接收子单元被配置为接收显示终端发送的用户密文信息。第三解密子单元被配置为利用第三加解密密钥对用户密文信息进行解密，得到第二授权标识。具体地，由于本公开利用对称加密算法，因此，在利用第三加解密密钥对授权标识进行加密生成用户密文信息。这里，再次调用第三加解密秘钥对用户密文信息进行解密，得到第二授权标识。第二授权标识为当前检测到的用户存储设备的设备标识。口令发送子单元被配置为将第二授权标识与已注册的第一授权标识进行匹配，并向匹配成功的用户发送预设授权口令。若该用户为已注册的用户，则存在已注册的第一授权标识与第二授权标识相同，也即第二授权标识与第一授权标识匹配成功，获取与第二授权标识关联的用户身份信息，利用用户身份信息，向该用户发送预设授权口令。若该用户为未注册用户，则不存在第一授权标识与第二授权标识相同，则用户身份认证失败。
第三方面，基于同一发明构思，本公开实施例还提供了一种信息安全发布系统，其包括上述的显示终端和服务器。图6为本公开实施例提供的服务器与显示终端交互的示意图，如图6所示，显示终端包括监测模块和显示模块；监测模块包括文件请求单元、身份认证单元和内容认证单元；服务器包括设备认证单元、文件加密单元和内容监测单元。
设备认证单元被配置为响应于显示终端发送的设备认证请求，对显示终端进行设备认证，得到设备认证结果，并将设备认证结果息发送至文件请求单元。文件请求单元被配置为接收设备认证单元发送的设备认证结果，并在设备认证结果指示显示终端认证通过的情况下，向文件加密单元发送文件下发请求。文件加密单元被配置为响应于文件请求单元发送的文件下发请求，对预下发的目标文件进行加密处理，得到加密认证文件。身份认证单元被配置为接收文件加密单元依据文件下发请求所下发的加密认证文件，并对加密认证文件中的数据内容的身份信息进行认证。显示模块被配置为在身份认证通过的情况下，将数据内容进行显示。内容认证单元被配置为根据显示模块所显示的第一图像判断数据内容是否正确。内容监测单元被配置为接收内容 认证单元发送的数据内容的认证结果，监测数据内容是否正确。
上述各个单元的具体实施过程可以参见上述第一方面中显示终端的各个单元的实施例，以及第二方面中服务器的各个单元的实施例，重复部分在此不再赘述。
本公开实施例提供的一种信息安全发布系统，通过显示终端与服务器的交互，在设备认证阶段利用设备认证单元对待接收传输文件的显示终端进行身份认证，能够确保用于接收传输文件的显示终端为已经通过设备认证的显示终端，避免了传输文件发送到非法显示终端上显示；文件加密单元对待下发的目标文件进行加密处理，能够实现信息的保密传输。在身份认证阶段，通过身份认证单元实现传输文件的身份信息的认证，避免了传输文件的基本属性特征被篡改；在内容认证阶段，通过内容认证单元实现传输文件的内容的认证，避免了传输文件在显示模块的实际显示信息被篡改；利用内容监测单元能够实现对显示终端所显示的数据内容的实时监测。因此，本公开实施例提供的一种信息安全发布系统通过对信息传输过程中的多方面认证和监测，能够有效解决信息发布过程中的安全问题。
在一些示例中，服务器与显示终端交互，实现传输文件的身份认证。具体地，文件加密单元包括标注子单元、第二处理子单元和第二加密子单元；身份认证单元包括第一解密子单元、第一处理子单元和字符比对子单元。其中，标注子单元被配置为响应于文件请求单元发送的文件下发请求，将待下发文件中每帧第二图像在第二预设区域的显示信息替换为预先存储的校验信息，并将替换完成的预下发文件作为目标文件。第二处理子单元被配置为对目标文件通过预设算法进行处理，得到目标文件对应的第一字符信息。第二加密子单元被配置为利用预先存储的第一加解密密钥，对第一字符信息和目标文件进行加密处理，生成加密认证文件。第一解密子单元被配置为接收加密认证文件，并利用第一加解密密钥对加密认证文件进行解密处理，得到解密认证文件；解密认证文件包括数据内容和第一字符信息。第一处理子单元被配置为对数据内容通过预设算法进行处理，得到数据内容对应的第二字符信息。字符比对子单元被配置为将第一字符信息与第二字符信息进行比 对，并根据比对结果判断数据内容的身份信息是否能够认证通过。
上述各个子单元的具体实施过程可以参见上述第二方面中服务器的文件加密单元的各个子单元的实施例，以及第一方面中显示终端的身份认证单元的各个子单元的实施例，重复部分在此不再赘述。
在一些示例中，服务器与显示终端交互，实现传输文件的内容认证。具体地，显示终端还包括第一处理单元以及集成在显示模块上的图像传感器；显示终端的内容认证单元包括第一接收子单元和内容认证子单元。其中，图像传感器被配置为采集显示模块显示的第一图像在第一预设区域显示的子图像。第一处理单元被配置为接收身份认证单元发送的数据内容，并将数据内容发送至显示模块进行显示。第一接收子单元被配置为接收图像传感器发送的子图像。内容认证子单元被配置为根据预先存储的校验信息对子图像的显示信息进行校验，判断数据内容是否正确。内容监测单元被配置为接收显示终端发送的数据内容的认证结果，监测数据内容是否正确。
上述图像传感器、各个单元、以及各个子单元的具体实施过程可以参见上述第一方面中显示终端的图像传感器、第一处理单元、以及内容认证单元中的各个子单元的具体实施例，以及第二方面中服务器的内容监测单元的具体实施例，重复部分在此不再赘述。
在一些示例中，服务器与显示终端交互，实现设备身份认证。具体地，显示终端还包括设备认证请求单元；服务器的设备认证单元包括第二解密子单元和标识比对子单元。其中，设备认证请求单元被配置为在接收到的设备认证信息指示显示终端认证未通过的情况下，向服务器发送设备认证请求；设备认证请求中携带有显示终端的设备密文信息。第二解密子单元被配置为响应于显示终端发送的设备认证请求，提取设备认证请求中携带的设备密文信息，并利用第二加解密密钥对设备密文信息进行解密，得到显示终端的第二设备标识。标识对比子单元被配置为将第二设备标识与预先存储的已注册的显示终端的第一设备标识进行对比，得到设备认证结果，并将设备认证结果反馈至显示终端。
上述各个子单元的具体实施过程可以参见上述第一方面中显示终端的设备认证请求单元的具体实施例，以及第二方面中服务器的设备认证单元的各个子单元的具体实施例，重复部分在此不再赘述。
在一些示例中，服务器与显示终端交互，实现用户身份认证。具体地，如图6所示，信息安全发布系统还包括用户存储设备；显示终端还包括第二处理单元；服务器还包括口令生成单元；口令生成单元包括第四接收子单元、第三解密子单元和口令发送子单元。其中，用户存储设备与显示终端通信连接，被配置为向显示终端发起用户授权请求。第二处理单元被配置为响应于用户存储设备发起的用户授权请求，确定为用户授予启动或关闭显示终端的第一权限，并将用户密文信息发送给服务器。显示模块还被配置为在用户存储设备发起用户授权请求时，显示口令输入窗口。第四接收子单元被配置为接收显示终端发送的用户密文信息。第三解密子单元被配置为利用第三加解密密钥对用户密文信息进行解密，得到第二授权标识。口令发送子单元被配置为将第二授权标识与已注册的第一授权标识进行匹配，并向匹配成功的用户发送预设授权口令。显示模块还被配置为响应于用户的输入操作，显示用户输入的口令。第二处理单元还被配置为在用户输入的口令与预设授权口令匹配时，确定为用户授予操作显示终端的预设功能的第二权限。
第四方面，基于同一发明构思，本公开实施例还提供了一种信息安全发布方法，其执行主体为上述信息安全发布系统，图7为本公开实施例提供的信息交互的流程示意图，如图7所示，包括六个阶段，其中，服务器侧包括设备注册阶段和用户注册阶段。服务器与显示终端交互实现设备身份认证、传输文件的身份认证、传输文件的内容认证、以及用户身份认证。显示终端包括监测模块、SOC和显示模块。
针对设备注册阶段，具体地，接收待注册终端的第一设备标识和设备类型；确定用户选择的设备认证类型；利用预先存储的第二加解密密钥，对第一设备标识、设备类型和设备认证类型进行加密，得到设备密文信息；将设备密文信息发送至已注册的显示终端进行存储。
针对用户注册阶段，具体地，接收待注册用户的第一授权标识；第一授 权标识包括用户身份信息和用户存储设备的标识；利用预先存储的第三加解密密钥，对第一授权标识进行加密处理，得到用户密文信息，并将用户密文信息发送至显示终端进行存储。
针对设备身份认证阶段、传输文件的身份认证、以及传输文件的内容认证，具体地，监测模块向服务器发送设备认证请求；设备认证请求中携带有显示终端的设备密文信息。服务器接收设备密文信息，并利用第二加解密密钥对其进行解密，得到显示终端的第二设备标识。将第二设备标识与预先存储的已注册的显示终端的第一设备标识进行对比，得到设备认证结果，并将设备认证结果反馈至显示终端。监测模块在判断设备认证结果指示显示终端认证通过的情况下，向服务器发送文件下发请求。服务器响应于文件下发请求，将待下发文件中每帧第二图像在第二预设区域的显示信息替换为预先存储的校验信息，并将替换完成的预下发文件作为目标文件；之后，对目标文件通过预设算法进行处理，得到目标文件对应的第一字符信息；之后，利用预先存储的第一加解密密钥，对第一字符信息和目标文件进行加密处理，生成加密认证文件。监测模块接收加密认证文件，并利用第一加解密密钥对加密认证文件进行解密处理，得到解密认证文件；解密认证文件包括数据内容和第一字符信息；之后，对数据内容通过预设算法进行处理，得到数据内容对应的第二字符信息；之后，将第一字符信息与第二字符信息进行比对，并根据比对结果判断数据内容的身份信息是否能够认证通过；之后，将身份认证通过的数据内容发送至SOC，SOC控制显示模块播放数据内容；之后，监测模块接收图像传感器发送的子图像，并根据预先存储的校验信息对子图像的显示信息进行校验，判断数据内容是否正确，并将数据内容的内容认证结果发送至服务器，以使服务器对接收到的数据内容的认证结果进行监测。
针对用户身份认证阶段，具体地，SOC检测到用户存储设备，确定为用户授予启动或关闭显示终端的第一权限，并控制监测模块将用户密文信息发送给服务器；同时，SOC控制显示模块显示口令输入窗口。服务器利用第三加解密密钥对接收到的用户密文信息进行解密，得到第二授权标识；之后，将第二授权标识与已注册的第一授权标识进行匹配，并向匹配成功的用户发 送预设授权口令。之后，SOC接受到用户输入的口令，并在用户输入的口令与预设授权口令匹配时，确定为用户授予操作显示终端的预设功能的第二权限。
可以理解的是，以上实施方式仅仅是为了说明本公开的原理而采用的示例性实施方式，然而本公开并不局限于此。对于本领域内的普通技术人员而言，在不脱离本公开的精神和实质的情况下，可以做出各种变型和改进，这些变型和改进也视为本公开的保护范围。

Claims (16)

  1. 一种显示终端，其包括监测模块和显示模块；所述监测模块包括文件请求单元、身份认证单元和内容认证单元；
    所述文件请求单元，被配置为接收服务器发送的设备认证结果，并在所述设备认证结果指示所述显示终端认证通过的情况下，向所述服务器发送文件下发请求；
    所述身份认证单元，被配置为接收所述服务器依据所述文件下发请求所下发的加密认证文件，并对所述加密认证文件中的数据内容的身份信息进行认证；
    所述显示模块，被配置为在身份认证通过的情况下，将所述数据内容进行显示；
    所述内容认证单元，被配置为根据所述显示模块所显示的第一图像判断所述数据内容是否正确。
  2. 根据权利要求1所述的显示终端，其中，所述身份认证单元包括第一解密子单元、第一处理子单元和字符比对子单元；
    所述第一解密子单元，被配置为接收所述加密认证文件，并利用预先存储的第一加解密密钥对所述加密认证文件进行解密处理，得到解密认证文件；所述解密认证文件包括所述数据内容和第一字符信息；
    所述第一处理子单元，被配置为对所述数据内容通过预设算法进行处理，得到所述数据内容对应的第二字符信息；
    所述字符比对子单元，被配置为将所述第一字符信息与所述第二字符信息进行比对，并根据比对结果判断所述数据内容的身份信息是否能够认证通过。
  3. 根据权利要求1所述的显示终端，其中，所述显示终端还包括第一处理单元以及集成在所述显示模块上的图像传感器；
    所述图像传感器，被配置为采集所述显示模块显示的第一图像在第一预设区域显示的子图像；
    所述第一处理单元，被配置为接收所述身份认证单元发送的所述数据内容，并将所述数据内容发送至所述显示模块进行显示。
  4. 根据权利要求3所述的显示终端，其中，所述内容认证单元包括第一接收子单元和内容认证子单元；
    所述第一接收子单元，被配置为接收所述图像传感器发送的所述子图像；
    所述内容认证子单元，被配置为根据预先存储的校验信息对所述子图像的显示信息进行校验，判断所述数据内容是否正确。
  5. 根据权利要求1所述的显示终端，其中，所述显示终端还包括第二处理单元；
    所述第二处理单元，被配置为响应于用户存储设备发起的用户授权请求，确定为所述用户授予启动或关闭所述显示终端的第一权限，并将预先存储的用户密文信息发送给服务器；以及，在用户输入的口令与预设授权口令匹配时，确定为所述用户授予操作所述显示终端的预设功能的第二权限；
    所述显示模块，还被配置为在所述用户存储设备发起用户授权请求时，显示口令输入窗口；以及，响应于用户的输入操作，显示用户输入的口令。
  6. 根据权利要求1～5中任一项所述的显示终端，其中，所述监测模块还包括充电单元、电池和通信单元；
    所述充电单元，被配置为对所述电池进行充电；
    所述电池，被配置为为所述显示终端中的图像传感器、所述文件请求单元、所述身份认证单元和所述内容认证单元和所述通信单元供电；
    所述通信单元，被配置为与所述服务器进行通信。
  7. 根据权利要求1所述的显示终端，其中，所述显示终端还包括设备认证请求单元；
    所述设备认证请求单元，被配置为在接收到的所述设备认证信息指示所述显示终端认证未通过的情况下，向所述服务器发送设备认证请求；所述设 备认证请求中携带有所述显示终端的设备密文信息。
  8. 一种服务器，其包括设备认证单元、文件加密单元和内容监测单元；
    所述设备认证单元，被配置为响应于显示终端发送的设备认证请求，对所述显示终端进行设备认证，得到设备认证结果，并将所述设备认证结果反馈至所述显示终端；
    所述文件加密单元，被配置为响应于所述显示终端发送的文件下发请求，对待下发的目标文件进行加密处理，得到加密认证文件；
    所述内容监测单元，被配置为接收所述显示终端发送的数据内容的认证结果，监测所述数据内容是否正确。
  9. 根据权利要求8所述的服务器，其中，所述服务器还包括设备注册单元；所述设备注册单元包括第二接收子单元、类型选择子单元和第一加密子单元；
    所述第二接收子单元，被配置为接收到待注册终端的第一设备标识和设备类型；
    所述类型选择子单元，被配置为确定用户选择的设备认证类型；
    所述第一加密子单元，被配置为利用预先存储的第二加解密密钥，对所述第一设备标识、所述设备类型和所述设备认证类型进行加密，得到设备密文信息，将所述待注册终端作为已注册的显示终端，并将所述设备密文信息发送至所述已注册的显示终端进行存储。
  10. 根据权利要求9所述的服务器，其中，所述设备认证单元包括第二解密子单元和标识比对子单元；
    所述第二解密子单元，被配置为响应于显示终端发送的设备认证请求，提取所述设备认证请求中携带的设备密文信息，并利用所述第二加解密密钥对所述设备密文信息进行解密，得到所述显示终端的第二设备标识；
    所述标识对比子单元，被配置为将所述第二设备标识与预先存储的已注册的显示终端的第一设备标识进行对比，得到设备认证结果，并将所述设备 认证结果反馈至所述显示终端。
  11. 根据权利要求9所述的服务器，其中，所述文件加密单元包括标注子单元、第二处理子单元和第二加密子单元；所述设备注册单元还包括密钥生成子单元；
    所述密钥生成子单元，被配置为根据所述已注册的显示终端的第一设备标识，生成第一加解密密钥，并将所述第一加解密密钥发送到所述已注册的显示终端进行存储；
    所述标注子单元，被配置为响应于所述显示终端发送的文件下发请求，将待下发文件中每帧第二图像在第二预设区域的显示信息替换为预先存储的校验信息，并将替换完成的预下发文件作为所述目标文件；
    所述第二处理子单元，被配置为对所述目标文件通过预设算法进行处理，得到所述目标文件对应的第一字符信息；
    所述第二加密子单元，被配置为利用预先存储的所述第一加解密密钥，对所述第一字符信息和所述目标文件进行加密处理，生成加密认证文件。
  12. 根据权利要求8所述的服务器，其中，所述服务器还包括用户注册单元；所述用户注册单元包括第三接收子单元和第三加密子单元；
    所述第三接收子单元，被配置为接收待注册用户的第一授权标识；所述第一授权标识包括用户存储设备的标识；
    所述第三加密子单元，被配置为利用预先存储的第三加解密密钥，对所述第一授权标识进行加密处理，得到用户密文信息，并将用户密文信息发送至所述显示终端进行存储。
  13. 根据权利要求12所述的服务器，其中，所述服务器还包括口令生成单元；所述口令生成单元包括第四接收子单元、第三解密子单元和口令发送子单元；
    所述第四接收子单元，被配置为接收所述显示终端发送的用户密文信息；
    所述第三解密子单元，被配置为利用所述第三加解密密钥对所述用户密文信息进行解密，得到第二授权标识；
    所述口令发送子单元，被配置为将所述第二授权标识与已注册的所述第一授权标识进行匹配，并向匹配成功的用户发送预设授权口令。
  14. 一种信息安全发布系统，其包括如权利要求1～7中任一项所述的显示终端、以及如权利要求8～12中任一项所述的服务器；所述显示终端包括监测模块和显示模块；所述监测模块包括文件请求单元、身份认证单元和内容认证单元；所述服务器包括设备认证单元、文件加密单元和内容监测单元；
    所述设备认证单元，被配置为响应于显示终端发送的设备认证请求，对所述显示终端进行设备认证，得到设备认证结果，并将所述设备认证结果息发送至所述文件请求单元；
    所述文件请求单元，被配置为接收设备认证单元发送的设备认证结果，并在所述设备认证结果指示所述显示终端认证通过的情况下，向所述文件加密单元发送文件下发请求；
    所述文件加密单元，被配置为响应于所述文件请求单元发送的文件下发请求，对预下发的目标文件进行加密处理，得到加密认证文件；
    所述身份认证单元，被配置为接收所述文件加密单元依据所述文件下发请求所下发的加密认证文件，并对所述加密认证文件中的数据内容的身份信息进行认证；
    所述显示模块，被配置为在身份认证通过的情况下，将所述数据内容进行显示；
    所述内容认证单元，被配置为根据所述显示模块所显示的第一图像判断所述数据内容是否正确；
    所述内容监测单元，被配置为接收所述内容认证单元发送的所述数据内容的认证结果，监测所述数据内容是否正确。
  15. 根据权利要求14所述的信息安全发布系统，其中，所述文件加密单元包括标注子单元、第二处理子单元和第二加密子单元；所述身份认证单 元包括第一解密子单元、第一处理子单元和字符比对子单元；
    所述标注子单元，被配置为响应于所述文件请求单元发送的文件下发请求，将待下发文件中每帧第二图像在第二预设区域的显示信息替换为预先存储的校验信息，并将替换完成的预下发文件作为所述目标文件；
    所述第二处理子单元，被配置为对所述目标文件通过预设算法进行处理，得到所述目标文件对应的第一字符信息；
    所述第二加密子单元，被配置为利用预先存储的第一加解密密钥，对所述第一字符信息和所述目标文件进行加密处理，生成加密认证文件；
    所述第一解密子单元，被配置为接收所述加密认证文件，并利用所述第一加解密密钥对所述加密认证文件进行解密处理，得到解密认证文件；所述解密认证文件包括所述数据内容和第一字符信息；
    所述第一处理子单元，被配置为对所述数据内容通过所述预设算法进行处理，得到所述数据内容对应的第二字符信息；
    所述字符比对子单元，被配置为将所述第一字符信息与所述第二字符信息进行比对，并根据比对结果判断所述数据内容的身份信息是否能够认证通过。
  16. 根据权利要求14所述的信息安全发布系统，其中，所述信息安全发布系统还包括用户存储设备；所述用户存储设备与所述显示终端通信连接，被配置为向所述显示终端发起用户授权请求。
PCT/CN2022/108129 2022-07-27 2022-07-27 显示终端、服务器以及信息安全发布系统 WO2024020828A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN202280002396.6A CN117795902A (zh) 2022-07-27 2022-07-27 显示终端、服务器以及信息安全发布系统
PCT/CN2022/108129 WO2024020828A1 (zh) 2022-07-27 2022-07-27 显示终端、服务器以及信息安全发布系统

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2022/108129 WO2024020828A1 (zh) 2022-07-27 2022-07-27 显示终端、服务器以及信息安全发布系统

Publications (1)

Publication Number Publication Date
WO2024020828A1 true WO2024020828A1 (zh) 2024-02-01

Family

ID=89704793

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/108129 WO2024020828A1 (zh) 2022-07-27 2022-07-27 显示终端、服务器以及信息安全发布系统

Country Status (2)

Country Link
CN (1) CN117795902A (zh)
WO (1) WO2024020828A1 (zh)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2008061178A (ja) * 2006-09-04 2008-03-13 Media Stick Kk 認証サーバ、事業者サーバ及び電子商取引方法
CN107636662A (zh) * 2015-02-13 2018-01-26 优替控股有限公司 网络内容认证
CN110896400A (zh) * 2019-12-03 2020-03-20 厦门一通灵信息科技有限公司 一种数据防泄密访问系统
JP2021150704A (ja) * 2020-03-17 2021-09-27 株式会社大和総研 電子認定証受渡システムおよびプログラム
CN113641981A (zh) * 2020-05-11 2021-11-12 华为技术有限公司 一种认证方法及电子设备

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2008061178A (ja) * 2006-09-04 2008-03-13 Media Stick Kk 認証サーバ、事業者サーバ及び電子商取引方法
CN107636662A (zh) * 2015-02-13 2018-01-26 优替控股有限公司 网络内容认证
CN110896400A (zh) * 2019-12-03 2020-03-20 厦门一通灵信息科技有限公司 一种数据防泄密访问系统
JP2021150704A (ja) * 2020-03-17 2021-09-27 株式会社大和総研 電子認定証受渡システムおよびプログラム
CN113641981A (zh) * 2020-05-11 2021-11-12 华为技术有限公司 一种认证方法及电子设备

Also Published As

Publication number Publication date
CN117795902A (zh) 2024-03-29

Similar Documents

Publication Publication Date Title
KR102328725B1 (ko) 하나의 장치를 이용하여 다른 장치를 언로크하는 방법
US10606997B2 (en) Remote identity authentication method and system and remote account opening method and system
US11469885B2 (en) Remote grant of access to locked data storage device
US20180219688A1 (en) Information Transmission Method and Mobile Device
WO2015058596A1 (zh) 动态口令生成方法和系统、交易请求的处理方法和系统
WO2014161442A1 (zh) 电子签名令牌响应操作请求的方法及系统及电子签名令牌
TWI424321B (zh) 雲端儲存系統及方法
CN103685323A (zh) 一种基于智能云电视网关的智能家居安全组网实现方法
US9280650B2 (en) Authenticate a fingerprint image
US11831752B2 (en) Initializing a data storage device with a manager device
WO2014026462A1 (zh) 一种数字权益管理方法
WO2018228061A1 (zh) 数据传输方法、装置及系统
TW201608408A (zh) Usb儲存裝置之無線認證系統及方法
WO2023207975A1 (zh) 数据传输方法、装置和电子设备
WO2021141619A1 (en) Recovery key for unlocking a data storage device
US20210216653A1 (en) Multi-role unlocking of a data storage device
US20230289456A1 (en) Certificates in data storage devices
US20230291548A1 (en) Authorization requests from a data storage device to multiple manager devices
US20230289089A1 (en) Multiple authorization requests from a data storage device
US20140025946A1 (en) Audio-security storage apparatus and method for managing certificate using the same
US20210218558A1 (en) Enrolment of pre-authorized device
WO2024020828A1 (zh) 显示终端、服务器以及信息安全发布系统
CN113904830B (zh) 一种spa认证的方法、装置、电子设备和可读存储介质
US20230195912A1 (en) Secure data content access system and method
US20230291579A1 (en) Cryptographic keys for authorization requests from a data storage device

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22952292

Country of ref document: EP

Kind code of ref document: A1