A kind of intelligent lock system and control method thereof

Abstract

The present invention relates to a control system of a smart lock and a control method thereof, wherein a smart lock control system comprises: a mobile device and a client device, the client device comprises: a handheld device and an authentication card or an interactive authentication card, the mobile device comprises: an unlocking verification and control module, a first battery, a communication module, a first transmission interface and an electric lock, and the authentication card comprises: a second battery, a second transmission interface and an encryption and decryption module. The present invention realizes the function of individually controlling whether unlocking is allowed in different time periods or scenes; there is no need to remember multiple passwords, which is convenient for users to operate; the convenience of operation is improved; and binary authentication is realized, which adds an additional verification link compared to simple mechanical key or password verification, thereby improving security.

Description

Technical Field

[0001] The present invention relates to the field of smart locks, and in particular to a smart lock system and a control method thereof. Background Art

[0002] The current smart lock system is mainly used for products with external power supply and network connection, such as doors or fixed safes. For mobile devices, due to various reasons such as lack of power supply or being moved to places where the network cannot be connected, conventional smart lock systems are generally not applicable to such devices. Therefore, for mobile devices, the locks used usually include the following types:

[0003] (1) Mechanical locks: Mechanical locks are difficult to manage. Problems such as key loss and illegal copying are difficult to eliminate, especially when multiple devices are locked separately. A large number of keys are difficult to carry and inconvenient to find, which will consume a lot of manpower costs. In addition, mechanical locks are difficult to achieve refined control. For example, in a certain period of time or scene, the key custodian should not be allowed to open the lock according to business requirements, but mechanical keys cannot meet such business requirements.

[0004] (2) Simple electronic locks, such as IC card / RFID card / password locks that are hung on the outside of mobile devices. These electronic locks generally have their own batteries. Although they replace mechanical keys, they still have the same problems as mechanical locks. For password locks, for example, when there are many devices to manage, if each device has a different password, it will be difficult for operators to remember multiple sets of passwords; if each device has the same password, there will be security risks, and it will be impossible to control the unlocking authority for each device.

[0005] (3) The RFID / wireless password lock installed inside the mobile device also has its own battery or external power supply.

[0006] If a built-in battery is used to drive the lock control circuit, the lock control circuit consumes a lot of power, so the battery needs to be frequently removed for charging and replacement. In addition, for some mobile devices, such as bank cash boxes, built-in large-capacity batteries may pose a safety hazard of fire or explosion. If an external power supply is used to drive the lock control circuit, the user may not be able to find a power source in certain places, resulting in an inability to unlock the lock. Even if a power source is found, it is still necessary to plug in the power when unlocking the lock, which is cumbersome.

[0007] At present, some built-in locks also use external mobile power supplies to reversely supply power via USB. However, since most locks have a high control power supply voltage, the 5V voltage of USB cannot meet the requirements in many cases.

[0008] In summary, the current technology has technical problems such as difficulty in fine management, inability to control unlocking permissions for individual devices, and safety hazards and inconvenience in charging of built-in batteries. Summary of the invention

[0009] The embodiments of the present invention aim to solve at least one of the technical problems in the related art to a certain extent. To this end, one object of the present invention is to provide a smart lock system and a control method thereof, which can individually control whether to allow unlocking in different time periods or scenarios, without setting multiple passwords, can realize binary authentication, and can use an authentication card to solve the authentication and power supply problems at the same time.

[0010] The technical solution adopted in the embodiment of the present invention is:

[0011] In a first aspect, an embodiment of the present invention provides a smart lock control system, including: a mobile device and a client device, the client device including: a handheld device and an authentication card or an interactive authentication card, the mobile device including: an unlocking verification and control module, a first battery, a communication module, a first transmission interface and an electric control lock, the authentication card including: a second battery, a second transmission interface and an encryption and decryption module;

[0012] The first battery is respectively connected to the unlocking verification and control module and the communication module to provide power;

[0013] The unlocking verification and control module and the electric control lock are respectively connected to the first transmission interface, the encryption and decryption module and the second battery are respectively connected to the second transmission interface, and the first transmission interface is connected to the second transmission interface;

[0014] The encryption and decryption module sends password verification data and authentication results to the unlocking verification and control module;

[0015] The second battery supplies power to the encryption and decryption module and the electric control lock respectively;

[0016] The communication module is connected to the handheld device and is used to receive user personal password verification data and service operation requests sent by the handheld device;

[0017] The unlocking verification and control module is connected to the smart lock and is used to send a control signal to the electric lock to execute the service according to the authentication result.

[0018] Furthermore, it also includes: a mobile device management server, the mobile device management server including: a key management module and / or a service management module;

[0019] The key management module is used to inject the system certificate public key into the mobile device;

[0020] The service management module is used to write the service status into the mobile device, determine the service status that allows unlocking and / or the user ID with unlocking authority.

[0021] Furthermore, the system certificate public key of the mobile device is generated and injected by a mobile device management server or key injection software.

[0022] Furthermore, the encryption and decryption module stores the user's personal identity certificate, personal password storage value and corresponding private key.

[0023] In a second aspect, an embodiment of the present invention provides a method for controlling a smart lock, comprising:

[0024] The client device obtains the user's personal password and business operation request, and generates password verification data and sends it to the mobile device;

[0025] The mobile device generates verification request data according to the password verification data and sends it to the client device;

[0026] The client device performs legality authentication on the verification request data in combination with the personal identity certificate, the personal password storage value and the private key, and generates an authentication result;

[0027] The mobile device uses the system certificate public key and the service authority in combination with the authentication result and the service operation request to perform the service.

[0028] Furthermore, the process of generating password verification data according to the user's personal password is specifically as follows:

[0029] Get the first random number;

[0030] If the personal password storage value in the encryption / decryption module is a hash value of the user's personal password, firstly generate a first hash value according to the user's personal password using a hash algorithm, and then generate a second hash value by combining a first random number and the first hash value using a hash algorithm;

[0031] If the personal password storage value in the encryption / decryption module is the user's personal password itself, the first random number and the user's personal password are combined to generate a second hash value;

[0032] The first random number, the second Hash value, and the business operation request are combined to generate the password verification data.

[0033] Further, the process of generating the verification request data includes: composite authentication or single card authentication;

[0034] The composite authentication is: generating a second random number, combining the second random number with the password verification data to generate the verification request data;

[0035] The single card authentication is:

[0036] A third random number is generated as the verification request data.

[0037] Furthermore, when the composite authentication is performed, the legality authentication is specifically:

[0038] If the personal password stored in the encryption / decryption module is the user's personal password hash value, the user's personal password is first hashed to obtain a first verification hash value, and then the first random number and the first verification hash value are combined to generate a second verification hash value; if the personal password stored in the encryption / decryption module is the user's personal password itself, the first random number and the user's personal password are hashed to obtain a second verification hash value;

[0039] Determine whether the second Hash value is consistent with the second verification Hash value, and obtain a first verification result;

[0040] Generate a second test result according to the first test result and the second random number;

[0041] Signing the second verification result using the private key to obtain a first signature value, and combining it with the personal identity certificate to obtain the authentication result;

[0042] When performing the single card authentication, the legitimacy authentication is specifically as follows:

[0043] The third random number is signed by using the private key to obtain a second signature value, which is combined with the personal identity certificate to obtain the authentication result.

[0044] Furthermore, when the composite authentication is performed, the service execution is specifically as follows:

[0045] Acquire a personal identity certificate and the first signature value according to the authentication result;

[0046] The personal identity certificate is verified using the public key of the system certificate. After the verification is passed, the personal public key and personal business authority are obtained from the personal identity certificate;

[0047] Decrypting the first signature value using the personal public key to obtain a verification result;

[0048] If the verification result is equal to the combination of the first verification result and the second random number, the first verification result is judged to be legal; otherwise, the service operation request is rejected;

[0049] When the first inspection result is legal, verify the value of the first inspection result, and determine whether to execute the business operation request in combination with the personal business authority;

[0050] When performing the single card authentication, the service execution is specifically as follows:

[0051] Acquire a personal identity certificate and the second signature value according to the authentication result;

[0052] The personal identity certificate is verified using the public key of the system certificate. After the verification is passed, the personal public key and personal business authority are obtained from the personal identity certificate;

[0053] The second signature value is decrypted using the personal public key to obtain a verification result, and whether to execute the business operation request is determined in combination with the personal business authority.

[0054] After the client device obtains the user's personal password, it also performs password verification on the personal password. If the password verification fails, it prompts that the password is wrong.

[0055] The beneficial effects of the present invention are:

[0056] In the embodiment of the present invention, before the mobile device enters the offline state, the system presets the business actions that the mobile device is allowed to execute in different states. In the subsequent offline operation process, the business operations are only allowed to be executed in the preset business states, thereby realizing the function of individually controlling whether unlocking is allowed in different time periods or scenarios; by presetting the states or users that allow unlocking operations to be executed before the mobile device enters the offline state to control the unlocking authority, the user only needs to use his own certificate and password to control different mobile devices, and there is no need to set different passwords for each device, and there is no need to remember multiple passwords, which is convenient for user operation; the two functions of power supply and offline identity authentication are realized at the same time through the authentication card, which not only solves the power supply problem of the lock, but also turns the power supply action into an unlocking action in the user experience, thereby improving the convenience of operation; by combining the two methods of user password and authentication card verification, two-factor authentication is realized, which adds an additional verification link compared to the single mechanical key or password verification, thereby improving security. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 This is a structural block diagram of a smart lock control system according to an embodiment of the present invention;

[0058] Figure 2 is another structural block diagram of the control system of the smart lock according to an embodiment of the present invention;

[0059] Figure 3 This is a flow chart of a control method of a smart lock according to a fourth embodiment of the present invention;

[0060] Figure 4 This is a flow chart of a control method for a smart lock provided in Embodiment 5 of the present invention;

[0061] Figure 5 This is a flow chart of a control method for a smart lock provided by Embodiment 6 of the present invention;

[0062] Figure 6 This is a flow chart of a control method for a smart lock provided by Embodiment 7 of the present invention;

[0063] Figure 7 This is a flow chart of a control method for a smart lock provided by Embodiment 8 of the present invention;

[0064] Reference numerals

[0065] 10. Mobile device management server; 20. Mobile device; 30. Client; 11. Key management; 12. Business management module; 21. Unlocking inspection and control circuit; 22. Electric lock; 23. First battery; 24. First transmission interface; 25. Communication module; 250. Wireless communication module; 31. Second battery; 32. Second transmission interface; 33. Encryption and decryption module; 34. Handheld device; 35. User interaction module. DETAILED DESCRIPTION

[0066] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application may be combined with each other.

[0067] In order to facilitate accurate understanding of the embodiments of the present invention, the key terms involved in the embodiments of the present invention are now defined:

[0068] HASH hash value: Hash, generally translated as "hash", also directly transliterated as "hash", is to transform an input of any length into an output of fixed length through a hash algorithm, and the output is the hash value. This conversion is a compression mapping, that is, the space of hash values ​​is usually much smaller than the space of inputs, and different inputs may hash to the same output, so it is impossible to determine the unique input value from the hash value. Simply put, it is a function that compresses a message of any length into a message digest of a fixed length.

[0069] Example 1

[0070] Embodiment 1 provides a smart lock system of a smart lock control method, see Figure 1 , the smart lock system includes:

[0071] The mobile device 20 and the client device 30, the client device 30 is a handheld device 34 and an authentication card, the mobile device includes: an unlocking verification and control module 21, a first battery 23, a communication module 25, a first transmission interface 24 and a smart lock 22, and the authentication card includes: a second battery 31, a second transmission interface 32 and an encryption and decryption module 33;

[0072] In a specific implementation, the first battery 23 is connected to the unlocking verification and control module 21 and the communication module 25 respectively and supplies power to provide the power required for the mobile device 20 to operate.

[0073] When the client device 30 is a handheld device 34 and an authentication card, the wireless communication module 250 is connected to the handheld device 34 to receive the user's personal password and business operation request sent by the handheld device 34; the handheld device 34 is used to run and operate the APP, and send the user's personal password and business operation request.

[0074] When the client device 30 is an interactive authentication card, the wireless communication module 250 is used to communicate with the system background.

[0075] The encryption and decryption module 33 and the second battery 31 are connected to the second transmission interface 32 respectively, the second transmission interface 32 is connected to the communication module, and the communication module 25 is connected to the unlocking verification and control module 21 for sending password verification data and authentication results;

[0076] The second battery 31 supplies power to the encryption and decryption module and the electric lock respectively, so as to realize the high current power supply function of the authentication card to the mobile device 20 .

[0077] In a specific implementation, the encryption and decryption module 33 stores the operator's personal identity certificate, personal password storage value and corresponding private key, wherein the personal password storage value and the personal private key cannot be read externally, while the personal identity certificate can be read externally, wherein the personal password storage value can be the personal password itself or a hash value of the personal password.

[0078] The contents of the operator's personal identity certificate stored in the encryption and decryption module 33 usually include information such as the user ID personal identity certificate public key, permitted business actions, and certificate validity period, and can be signed using the system certificate private key.

[0079] The unlocking verification and control module 21 is connected to the smart lock and is used to send a control signal to the smart lock 22 for business execution according to the authentication result.

[0080] In this embodiment, the communication module 25 includes: a wireless communication module 250 and a first transmission interface 14, the wireless communication module is connected to the handheld device 34, the first transmission interface 14 is connected to the second transmission interface 32, and the first transmission interface 14 is connected to the unlocking verification and control module 21.

[0081] In this embodiment, the system certificate public key of the mobile device is generated and injected by the mobile device management server. The device management server 10 includes a key management module 11 and a service management module 12, wherein the key management module 11 is used to inject the system certificate public key into the mobile device 20; the service management module 12 is used to write the service status, determine the service status that allows unlocking and / or the user ID with unlocking authority;

[0082] In this embodiment, the client 30 may be a handheld device 34 and an authentication card or an interactive authentication card. In this embodiment, the interactive authentication card actually replaces the handheld device 34 with a user interaction module, and integrates the user interaction module and the authentication card on one card to form an interactive authentication card.

[0083] Example 2

[0084] See also Figure 2 In this embodiment, the difference from Embodiment 1 is that the client device 30 is an interactive authentication card. The interactive authentication card actually replaces the handheld device 34 with a user interaction module, and integrates the user interaction module and the authentication card on one card to form an interactive authentication card. The interactive authentication card can simultaneously realize the authentication of the mobile device 30 and the high current power supply function.

[0085] Example 3

[0086] Embodiment 3 also provides a smart lock system, the difference being that only a key management 11 module is included in the mobile device management server 10 .

[0087] Example 4

[0088] See also Figure 3 Embodiment 4 provides a method for controlling a smart lock, and the method for controlling a smart lock comprises the following steps:

[0089] S1: The client device 30 obtains the user's personal password and business operation request, and generates password verification data and sends it to the mobile device 20;

[0090] In an optional method, when an operator needs to perform authorization operations such as unlocking or switching service status in an offline state, he first inserts his authentication card into the mobile device 20 through the first transmission interface 24 of the mobile device 20, and enters his personal password on the client device 30 and sends a service operation request.

[0091] In this embodiment, the client device 30 may be a handheld device 34 and an authentication card or an interactive authentication card. The interactive authentication card here actually replaces the handheld device 34 with a user interaction module 35, and integrates the user interaction module 35 and the authentication card on one card to form an interactive authentication card.

[0092] When the client is a handheld device 34 and an authentication card, the user enters the personal password on the handheld device 34. When the client device 30 is an interactive authentication card, the user can directly enter the personal password on the interactive authentication card.

[0093] In this embodiment, the service operation request sent by the user through the client device 30 includes but is not limited to: unlocking action and switching to a certain service state action.

[0094] In a specific implementation, the process of generating password verification data according to the user's personal password is specifically as follows:

[0095] S11: The handheld device 34 obtains a first random number R1 from the mobile device 20 in a wireless manner;

[0096] S12: The handheld device 34 generates a second hash value H2 using a hash algorithm according to the user's personal password combined with the first random number R1;

[0097] Among them, there are two situations:

[0098] If the personal password storage value in the encryption / decryption module is a hash value of the user's personal password, firstly generate a first hash value according to the user's personal password using a hash algorithm, and then generate a second hash value by combining a first random number and the first hash value using a hash algorithm;

[0099] If the personal password storage value in the encryption / decryption module is the user's personal password itself, the first random number and the user's personal password are combined to generate a second hash value.

[0100] S13: The handheld device 34 combines the second hash value H2 and the service operation request to generate password verification data J1, and sends the password verification data J1 to the mobile device 20 wirelessly.

[0101] S2: The mobile device 20 generates verification request data according to the password verification data J1 and sends it to the encryption and decryption module 33 in the client device 30;

[0102] In a specific implementation, the process of generating verification request data can be divided into composite authentication or single card authentication according to different types of client devices;

[0103] When the client device 30 is a handheld device 34 and an authentication card, composite authentication is used to generate verification request data. The process of composite authentication is as follows:

[0104] S21: After the mobile device 20 obtains the password verification data J1 from step S1, it generates a second random number R2;

[0105] S22: Combine the second random number R2 with the password verification data J1 to generate verification request data; and send the verification request data to the authentication card via the first transmission interface 14 of the mobile device 20.

[0106] When the client device 30 is an interactive authentication card, a single card authentication method is used to generate verification request data. The process of single card authentication is as follows:

[0107] S21 ′: Generate a third random number R3 as verification request data.

[0108] S3: The client device 30 performs a legitimacy authentication on the verification request data by combining the personal identity certificate, the personal password storage value and the private key, and generates an authentication result;

[0109] In this step, according to different types of client devices 30, the legitimacy authentication is performed accordingly, and the way of generating the authentication result is also different;

[0110] In a specific implementation, when the client device 30 is a handheld device 34 and an authentication card (composite authentication), the legitimacy authentication process is:

[0111] S31: Perform a hash operation on the first random number R1 and the personal password storage value H' to obtain a second verification hash value H2';

[0112] If the personal password stored in the encryption / decryption module is a hash value of the user's personal password, the user's personal password is first hashed to obtain a first verification hash value, and then the first random number and the first verification hash value are combined to generate a second verification hash value;

[0113] If the personal password storage value in the encryption / decryption module is the user's personal password itself, a hash operation is performed on the first random number and the user's personal password to obtain a second verification hash value;

[0114] S32: Determine whether the second hash value H2 is consistent with the second verification hash value H2′, and obtain a first verification result C1;

[0115] S33: Generate a second test result C2 according to the first test result C1 and the second random number R2;

[0116] S34: Use the private key to sign the second verification result C2 to obtain the first signature value S1, and combine it with the personal identity certificate to obtain the authentication result; the authentication result is returned to the mobile device 20 through the second transmission interface 32.

[0117] In a specific implementation, when the client device 30 is an interactive authentication card (single card authentication), the process of the legitimacy authentication is:

[0118] The third random number R3 is signed with the private key to obtain a second signature value S2, which is combined with the personal identity certificate to obtain an authentication result, which is also returned to the mobile device 20 through the second transmission interface 32.

[0119] S4: The mobile device 20 uses the system certificate public key and the service authority in combination with the authentication result and the service operation request to perform the service.

[0120] According to different types of client devices 30, the process of performing service execution in combination with the authentication result and the service operation request is also different;

[0121] In a specific implementation, when the client device 30 is a handheld device 34 and an authentication card, the legitimacy authentication process is as follows:

[0122] S41: Obtaining a personal identity certificate and a first signature value S1 according to the authentication result;

[0123] S42: Use the system certificate public key to verify the personal identity certificate. After the verification is passed, obtain the personal public key and personal business authority from the personal identity certificate;

[0124] S43: Decrypt the first signature value S1 using the personal public key to obtain the verification result C2';

[0125] If the test result C2' is equal to the combination of the first test result C1 and the second random number R2, the first test result C1 is judged to be legal, otherwise the service operation request is rejected;

[0126] When the first inspection result C1 is legal, the value of the first inspection result C1 is verified, and whether to execute the business operation request is determined in combination with the personal business authority;

[0127] In a specific implementation, when the client device 30 is an interactive authentication card, the process of the legitimacy authentication is:

[0128] S41': Obtain the personal identity certificate and the second signature value S2 according to the authentication result;

[0129] S42': Use the system certificate public key to verify the personal identity certificate. After the verification is passed, obtain the personal public key and personal business authority from the personal identity certificate;

[0130] S43': Use the personal public key to decrypt the second signature value S2 to obtain a verification result, and determine whether to execute the business operation request in combination with the personal business authority.

[0131] In this embodiment, after the client device 30 obtains the user's personal password, it also includes performing a password verification on the personal password. If the password verification fails, it prompts that the password is wrong.

[0132] In this embodiment, before step S1, a pre-step S01 is further included: injecting the system certificate public key into the mobile device 20, which is usually performed when the mobile device 20 leaves the factory. The operation of injecting the certificate public key can also be performed by using a separate key injection software to inject the unlocking certificate.

[0133] In this embodiment, before step S1, a pre-step S02 is also included: writing the service status into the mobile device 20, determining the service status that allows unlocking and / or the user ID with unlocking authority. This step is usually performed when preparing to transport the mobile device 20 out of the system signal coverage.

[0134] Example 5

[0135] See also Figure 4 This embodiment provides a control method for performing authentication only by means of an authentication card when the client device 30 is a handheld device 34 combined with an authentication card, which includes the following steps:

[0136] Pre-step S01: injecting the system certificate public key into the mobile device 20, this step is usually performed when the mobile device 20 leaves the factory.

[0137] Pre-step S02: writing the service status into the mobile device 20, determining the service status that allows unlocking and / or the user ID with unlocking authority, this step is usually performed when preparing to transport the mobile device 20 out of the system signal coverage.

[0138] S1: The handheld device 34 obtains a service operation request;

[0139] S2: The mobile device 20 verifies the legitimacy of the authentication card. If the authentication card is legitimate, the service request is executed. If the authentication card is not legitimate, the service request is rejected.

[0140] In a specific implementation, verifying the legitimacy of the authentication card includes the following steps:

[0141] (1) The mobile device 20 calculates the HASH value H1 from the content of the authentication card certificate, and then uses the system public key to decrypt the signature of the certificate to obtain H2. If H1 = H2, it proves that the certificate is issued by the system;

[0142] (2) Generate a random number A and send it to the authentication card, requiring the authentication card to encrypt the random number with its private key;

[0143] (3) Use the public key in the authentication card certificate to decrypt the random number A'. If A' = A, the certificate is legal.

[0144] Example 6

[0145] See also Figure 5This embodiment provides a method for authenticating the client 30 in combination with a personal password when the client 30 is a handheld device 34 combined with an authentication card, which includes the following steps:

[0146] Pre-step S01: injecting the system certificate public key into the mobile device 20, this step is usually performed when the mobile device 20 leaves the factory.

[0147] Pre-step S02: writing the service status into the mobile device 20, determining the service status that allows unlocking and / or the user ID with unlocking authority, this step is usually performed when preparing to transport the mobile device 20 out of the system signal coverage.

[0148] S1: The client device 30 obtains the user's personal password and business operation request, generates password verification data and sends it to the mobile device 20; when the operator needs to perform authorization operations such as unlocking or switching business status in an offline state, he first inserts his authentication card into the mobile device 20 through the first transmission interface 24 of the mobile device 20, and at the same time enters the personal password in the client handheld device 34 and sends the business operation request.

[0149] In a specific implementation, the process of generating password verification data according to the user's personal password is specifically as follows:

[0150] S11: The handheld device 34 generates a first hash value H1 according to the user's personal password using a hash algorithm;

[0151] S12: The handheld device 34 obtains the first random number R1 from the mobile device 20, and generates a second hash value H2 by using a hash algorithm in combination with the first hash value H1;

[0152] S13: The handheld device 34 combines the second hash value H2 and the service operation request to generate password verification data J1, and sends the password verification data J1 to the mobile device 20 wirelessly.

[0153] S2: The mobile device 20 generates verification request data according to the password verification data J1 and sends it to the client device 30;

[0154] In a specific embodiment, when the client device is a handheld device 34 and an authentication card, the process of generating the verification request data is a composite authentication, and the composite authentication process is:

[0155] S21: After the mobile device 20 obtains the password verification data J1 from step S1, it generates a second random number R2;

[0156] S22: Combine the second random number R2 with the password verification data J1 to generate verification request data; and send the verification request data to the authentication card via the first transmission interface 14 of the mobile device 20.

[0157] S3: The client device 30 performs a legitimacy authentication on the verification request data by combining the personal identity certificate, the personal password storage value and the private key, and generates an authentication result;

[0158] In a specific implementation, when the client device is a handheld device 34 and an authentication card, the process of the legitimacy authentication is:

[0159] S31: Perform a hash operation on the first random number and the user password hash value H' in the personal ID card to obtain a second verification hash value H2';

[0160] S32: Determine whether the second hash value H2 is consistent with the second verification hash value H2′, and obtain a first verification result C1;

[0161] S33: Generate a second test result C2 according to the first test result C1 and the second random number R2;

[0162] S34: Use the private key to sign the second verification result C2 to obtain the first signature value S1, and combine it with the personal identity certificate and the personal password storage value to obtain the authentication result; the authentication result is returned to the mobile device 20 through the second transmission interface 32.

[0163] S4: The mobile device 20 uses the system certificate public key and the service authority in combination with the authentication result and the service operation request to perform the service.

[0164] In a specific implementation, when the client device 30 is a handheld device 34 and an authentication card, the legitimacy authentication process is as follows:

[0165] S41: Obtaining a personal identity certificate and a first signature value S1 according to the authentication result;

[0166] S42: Use the system certificate public key to verify the personal identity certificate. After the verification is passed, obtain the personal public key and personal business authority from the personal identity certificate;

[0167] S43: Decrypt the first signature value S1 using the personal public key to obtain the verification result C2';

[0168] If the test result C2' is equal to the combination of the first test result C1 and the second random number R2, the first test result C1 is judged to be legal, otherwise the service operation request is rejected;

[0169] When the first inspection result C1 is legal, the value of the first inspection result C1 is verified, and whether to execute the business operation request is determined in combination with the personal business authority;

[0170] Example 7

[0171] See also Figure 6This embodiment provides a control method for authenticating the client 30 only when the client 30 is an interactive authentication card, which includes the following steps:

[0172] See also Figure 2 This embodiment provides a control method for performing authentication only by means of an authentication card when the client device 30 is a handheld device 34 combined with an authentication card, which includes the following steps:

[0173] Pre-step S01: injecting the system certificate public key into the mobile device 20, this step is usually performed when the mobile device 20 leaves the factory.

[0174] Pre-step S02: writing the service status into the mobile device 20, determining the service status that allows unlocking and / or the user ID with unlocking authority, this step is usually performed when preparing to transport the mobile device 20 out of the system signal coverage.

[0175] S1: Interactive authentication card obtains business operation request;

[0176] S2: The mobile device 20 verifies the legitimacy of the interactive authentication card. If the authentication card is legitimate, the service request is executed. If the authentication card is not legitimate, the service request is rejected.

[0177] In a specific implementation, verifying the legitimacy of the authentication card includes the following steps:

[0178] (1) The mobile device 20 calculates the HASH value H1 from the content of the authentication card certificate, and then uses the system public key to decrypt the signature of the certificate to obtain H2. If H1 = H2, it proves that the certificate is issued by the system;

[0179] (2) Generate a random number A and send it to the authentication card, requiring the authentication card to encrypt the random number with its private key;

[0180] (3) Use the public key in the authentication card certificate to decrypt the random number A'. If A' = A, the certificate is legal.

[0181] Example 8

[0182] See also Figure 7 This embodiment provides a control method for authenticating the client 30 in combination with personal password verification when the client 30 is an interactive authentication card, which includes the following steps:

[0183] Pre-step S01: injecting the system certificate public key into the mobile device 20, this step is usually performed when the mobile device 20 leaves the factory.

[0184] Pre-step S02: writing the service status into the mobile device 20, determining the service status that allows unlocking and / or the user ID with unlocking authority, this step is usually performed when preparing to transport the mobile device 20 out of the system signal coverage.

[0185] S1: The client device 30 obtains the user's personal password and business operation request, and generates password verification data and sends it to the mobile device 20; when the operator needs to perform authorization operations such as unlocking or switching business status in an offline state, first insert the interactive authentication card into the mobile device 20 through the first transmission interface 24 of the mobile device 20, and at the same time enter the personal password on the interactive authentication card and send the business operation request.

[0186] In a specific implementation, the process of generating password verification data according to the user's personal password is specifically as follows:

[0187] S11: The handheld device 34 generates a first hash value H1 according to the user's personal password using a hash algorithm;

[0188] S12: The handheld device 34 obtains the first random number R1 from the mobile device 20, and generates a second hash value H2 by using a hash algorithm in combination with the first hash value H1;

[0189] S13: The handheld device 34 combines the first random number R1, the second hash value H2, and the service operation request to generate the password verification data J1, and sends it to the mobile device 20 wirelessly.

[0190] S2: The mobile device 20 generates verification request data according to the password verification data J1 and sends it to the client device 30;

[0191] In a specific embodiment, when the client device is an interactive authentication card, the process of generating the verification request data is a password, and the process of the single card authentication is:

[0192] S21 ′: Generate a third random number R3 as verification request data.

[0193] S3: The client device 30 performs a legitimacy authentication on the verification request data by combining the personal identity certificate, the personal password storage value and the private key, and generates an authentication result;

[0194] In a specific implementation, when the client device is an interactive authentication card, the process of the legitimacy authentication is:

[0195] The third random number R3 is signed with the private key to obtain a second signature value S2, which is combined with the personal identity certificate to obtain an authentication result, which is also returned to the mobile device 20 through the second transmission interface 32.

[0196] S4: The mobile device 20 uses the system certificate public key and the service authority in combination with the authentication result and the service operation request to perform the service.

[0197] In a specific implementation, when the client device 30 is an interactive authentication card, the process of the legitimacy authentication is:

[0198] S41': Obtain the personal identity certificate and the second signature value S2 according to the authentication result;

[0199] S42': Use the system certificate public key to verify the personal identity certificate. After the verification is passed, obtain the personal public key and personal business authority from the personal identity certificate;

[0200] S43': Use the personal public key to decrypt the second signature value S2 to obtain a verification result, and determine whether to execute the business operation request in combination with the personal business authority.

[0201] In this embodiment, after the client device 30 obtains the user's personal password, it also includes performing a password verification on the personal password. If the password verification fails, it prompts that the password is wrong.

[0202] Example 9

[0203] In Embodiments 4 to 8, the operation of injecting the key in step S01 may also be performed by a separate key injection software to inject the unlocking certificate.

[0204] In the embodiment of the present invention, before the mobile device enters the offline state, the system presets the business actions that the mobile device is allowed to execute in different states. In the subsequent offline operation process, the business operations are only allowed to be executed in the preset business states, thereby realizing the function of individually controlling whether unlocking is allowed in different time periods or scenarios; by presetting the states or users that allow unlocking operations to be executed before the mobile device enters the offline state to control the unlocking authority, the user only needs to use his own certificate and password to control different mobile devices, and there is no need to set different passwords for each device, and there is no need to remember multiple passwords, which is convenient for user operation; the two functions of power supply and offline identity authentication are realized at the same time through the authentication card, which not only solves the power supply problem of the lock, but also turns the power supply action into an unlocking action in the user experience, thereby improving the convenience of operation; by combining the two methods of user password and authentication card verification, two-factor authentication is realized, which adds an additional verification link compared to simple mechanical key or password verification, thereby improving security.

[0205] The above is a specific description of the preferred implementation of the present invention, but the invention is not limited to the embodiments. Those skilled in the art can make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of this application.

Claims

1. A smart lock control system, characterized in that: include: A mobile device, a client device and a mobile device management server, wherein the client device comprises: a handheld device and an authentication card or an interactive authentication card, the mobile device comprises: an unlocking verification and control module, a first battery, a communication module, a first transmission interface and an electric lock, the authentication card comprises: a second battery, a second transmission interface and an encryption and decryption module, the encryption and decryption module stores a user's personal identity certificate, and the mobile device management server comprises a service management module; The service management module is used to write the service status to the mobile device, determine the service status that allows unlocking and / or the user ID with unlocking authority; The first battery is respectively connected to the unlocking verification and control module and the communication module to provide power; The unlocking verification and control module and the electric control lock are respectively connected to the first transmission interface, the encryption and decryption module and the second battery are respectively connected to the second transmission interface, and the first transmission interface is connected to the second transmission interface; The second battery supplies power to the encryption and decryption module and the electric control lock respectively; The handheld device is used to obtain the user's personal password and business operation request, and generate password verification data; The communication module is connected to the handheld device and is used to receive the password verification data sent by the handheld device; The unlocking verification and control module is used to generate verification request data according to the password verification data; The encryption and decryption module is used to receive the verification request data, and generate an authentication result according to the verification request data and the personal identity certificate, and send it to the unlocking verification and control module; The unlocking verification and control module is also connected to the electric lock, and is used to send a control signal to the electric lock to execute the service according to the authentication result.

2. The smart lock control system according to claim 1, characterized in that: Also includes: The mobile device management server also includes: a key management module; The key management module is used to inject the system certificate public key into the mobile device.

3. The smart lock control system according to claim 1, characterized in that: The system certificate public key of the mobile device is generated and injected by the mobile device management server or key injection software.

4. The smart lock control system according to claim 1, characterized in that: The encryption and decryption module also stores the user's personal password storage value and the corresponding private key.

5. A method for controlling a smart lock, applied to the smart lock control system according to any one of claims 1 to 4, characterized in that: include: The client device obtains the user's personal password and business operation request, and generates the password verification data and sends it to the mobile device; The mobile device generates verification request data according to the password verification data and sends it to the client device; The client device performs legality authentication on the verification request data in combination with the personal identity certificate, the personal password storage value and the private key, and generates an authentication result; The mobile device uses the system certificate public key and the service authority in combination with the authentication result and the service operation request to perform the service.

6. A control method for a smart lock according to claim 5, characterized in that: The specific process of generating password verification data according to the user's personal password is as follows: Get the first random number; If the personal password storage value in the encryption / decryption module is a hash value of the user's personal password, firstly generate a first hash value according to the user's personal password using a hash algorithm, and then generate a second hash value by combining a first random number and the first hash value using a hash algorithm; If the personal password storage value in the encryption / decryption module is the user's personal password itself, the first random number and the user's personal password are combined to generate a second hash value; The second hash value and the business operation request are combined to generate the password verification data.

7. A method for controlling a smart lock according to claim 6, characterized in that: The process of generating the verification request data includes: composite authentication or single card authentication; The composite authentication is: generating a second random number, combining the second random number with the password verification data to generate the verification request data; The single card authentication is: A third random number is generated as the verification request data.

8. A method for controlling a smart lock according to claim 7, characterized in that: When the composite authentication is performed, the legality authentication is specifically: Performing a hash operation on the first random number and the personal password storage value to obtain a second verification hash value; Determine whether the second Hash value is consistent with the second verification Hash value, and obtain a first verification result; Generate a second test result according to the first test result and the second random number; Signing the second verification result using the private key to obtain a first signature value, and combining it with the personal identity certificate to obtain the authentication result; When performing the single card authentication, the legitimacy authentication is specifically as follows: The third random number is signed by using the private key to obtain a second signature value, which is combined with the personal identity certificate to obtain the authentication result.

9. A method for controlling a smart lock according to claim 8, characterized in that: When the composite authentication is performed, the service execution is specifically as follows: Acquire a personal identity certificate and the first signature value according to the authentication result; Use the public key of the system certificate to verify the personal identity certificate. After the verification is passed, obtain the personal public key and personal business authority from the personal identity certificate; Decrypting the first signature value using the personal public key to obtain a verification result; If the verification result is equal to the combination of the first verification result and the second random number, the first verification result is judged to be legal; otherwise, the service operation request is rejected; When the first inspection result is legal, verify the value of the first inspection result, and determine whether to execute the business operation request in combination with the personal business authority; When performing the single card authentication, the service execution is specifically as follows: Acquire a personal identity certificate and the second signature value according to the authentication result; Use the public key of the system certificate to verify the personal identity certificate. After the verification is passed, obtain the personal public key and personal business authority from the personal identity certificate; The second signature value is decrypted using the personal public key to obtain a verification result, and whether to execute the business operation request is determined in combination with the personal business authority.

10. A method for controlling a smart lock according to any one of claims 5 to 9, characterized in that: After the client device obtains the user's personal password, it also includes performing password verification on the personal password according to the personal password storage value. If the password verification fails, it prompts that the password is wrong.

Images