An intelligent access control management system and method based on digital certificate

Abstract

The present invention discloses an intelligent access control management method based on digital certificates. When a request for access control is identified, it is determined whether the user has access permission based on the request. When it is determined that the user has access permission, a first user private key of a key management center and a second user private key of a user terminal are compared to determine whether they are the same. If the first user private key and the second user private key are the same, a random number is generated based on the user certificate and user characteristic information. The random number is then used to replace the first user private key and the second user private key, respectively, and the random numbers are stored in the user terminal and the key management center, respectively. The present invention compares the user private key of the user terminal with the user private key of the backend key management center. If the two are the same, the user is allowed to pass through. At the same time, a new user private key is generated based on the user certificate and user characteristic information as the user's next access control password. Thus, one code per time can be achieved, thereby improving the security of access control management.

Description

Technical Field

[0001] The present invention relates to the field of access control technology, and in particular to an intelligent access control management system and method based on digital certificates. Background Art

[0002] With the development of modern network information technologies such as the Internet of Things (IoT) and Wireless Sensor Networks (WSN), smart access control systems are poised for rapid growth, characterized by their specialized, integrated, and low-cost features. As these systems become part of our lives, the potential for data security will inevitably become a requirement, driving security systems to become a key component of these systems. Existing smart access control systems suffer from a widespread inability to implement a one-time, one-code authentication mechanism and safeguard personal information. Therefore, a new smart access control system is needed to address the emerging demands for intelligent home automation. Summary of the Invention

[0003] The main purpose of the present invention is to provide an intelligent access control management system and method based on digital certificates to address the problems that existing intelligent access control systems cannot implement one-time one-code and cannot guarantee the security of personal information.

[0004] To achieve the above-mentioned objectives, the present invention provides an intelligent access control management method based on digital certificates, comprising: when identifying an access control application request, determining whether the user has access authority based on the access control application request; when determining that the user has access authority, comparing whether a first user private key of a key management center and a second user private key of a user terminal are the same; when the first user private key and the second user private key are the same, generating a random number based on a user certificate and user feature information; and using the random number to replace the first user private key and the second user private key respectively and storing them in the user terminal and the key management center respectively.

[0005] In the digital certificate-based intelligent access control management method provided by the present invention, before the step of determining whether the user has access authority based on the access control request when identifying the access control request, the method further includes:

[0006] The key management center generates an initial encrypted user private key and a user certificate for the user who applies for the user certificate based on the user information. The initial encrypted user private key is the second user private key of the user terminal when used for the first time.

[0007] In the digital certificate-based intelligent access control management method provided by the present invention, the steps of generating an initial encrypted user private key and a user certificate for a user applying for a user certificate based on user information by a key management center include:

[0008] Obtain signature public key and signature private key based on asymmetric encryption algorithm;

[0009] Use the signature public key to encrypt the user's private key and the user's certificate request information issued by the key management center to obtain the ciphertext private key and user certificate;

[0010] Use the signature private key to decrypt the ciphertext private key to obtain the user certificate and the initial encrypted user private key.

[0011] In the digital certificate-based intelligent access control management method provided by the present invention, when determining whether a user has access authority, a first user private key of a key management center and a second user private key of a user terminal are compared to determine whether they are the same. If the first user private key and the second user private key are the same, the step of generating a random number based on the user certificate and user characteristic information includes:

[0012] Decrypt the second user private key of the user terminal using the signature private key, the signature public key and the user public key;

[0013] Calculating a first hash value of a first user private key of a key management center and a second hash value of a second user private key of a user terminal; and

[0014] When the first hash value and the second hash value are the same, the random number is generated by using the SM3 single-item hash algorithm using the user certificate and the user access time.

[0015] In addition, to achieve the above-mentioned purpose, the present invention also provides an intelligent access control management system based on digital certificates, comprising:

[0016] An identity recognition module is used to determine whether the user has access authority based on a request for access control when the request is identified;

[0017] A password verification module is used to compare the first user private key of the key management center and the second user private key of the user terminal to see if they are the same when determining that the user has access authority;

[0018] The new password generation module is used to generate a random number based on the user certificate and user feature information when the first user private key and the second user private key are the same, and use the random number to replace the first user private key and the second user private key respectively.

[0019] The digital certificate-based intelligent access control management system provided by the present invention also includes an initial password generation module, which is used to generate an initial encrypted user private key and a user certificate for the user who applies for the user certificate based on user information. The initial encrypted user private key is the second user private key of the user terminal when used for the first time.

[0020] In the digital certificate-based intelligent access control management system provided by the present invention, the initial password generation module includes:

[0021] A signature acquisition unit, used to obtain a signature public key and a signature private key based on an asymmetric encryption algorithm;

[0022] The encryption unit is used to encrypt the signature public key and the user's certificate request information using the user's private key issued by the key management center to obtain the ciphertext private key and user certificate;

[0023] The first decryption unit is used to decrypt the ciphertext private key using the signature private key to obtain the user certificate and the initial encrypted user private key.

[0024] In the digital certificate-based intelligent access control management system provided by the present invention, the password verification module includes:

[0025] A second decryption unit is used to decrypt the second user private key of the user terminal using the signature private key, the signature public key and the user public key;

[0026] a calculation unit, configured to respectively calculate a first hash value of a first user private key of a key management center and a second hash value of a second user private key of a user terminal; and

[0027] The comparison unit is configured to compare the first Hash value and the second Hash value.

[0028] In the digital certificate-based intelligent access control management system improved by the present invention, the new password generation module generates the random number using the user certificate and the user access time through the SM3 single-term hash algorithm.

[0029] The present invention also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps of the intelligent access control management method based on digital certificates as described above are implemented.

[0030] The smart access control management system and method based on digital certificates provided by the present invention have the following beneficial effects: the smart access control management method based on digital certificates provided by the present invention, when used for the first time, allocates an initial encrypted user private key and user certificate to the user based on the user's certificate request information through the digital certificate, which serves as the user private key of the user end when the user uses it for the first time, thereby preventing the leakage of the user private key; when a user who already has a certificate applies for access control, after authority determination, the user private key of the user end and the user private key of the background key management center are compared, and the user is allowed to pass if the two are the same, and a new user private key is generated based on the user certificate and user feature information as the user's next access control password, thereby achieving one-time-one-code, thereby improving the security of access control management. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only embodiments of the present invention. Those skilled in the art can also derive other drawings based on the provided drawings without inventive work.

[0032] Figure 1 The figure shows a flow chart of an intelligent access control management method based on digital certificates provided by one embodiment of the present invention. DETAILED DESCRIPTION

[0033] To facilitate understanding of the present invention, the present invention will be described more fully below with reference to the accompanying drawings. The drawings illustrate exemplary embodiments of the present invention. However, the present invention may be implemented in many different forms and is not limited to the embodiments described herein. Rather, these embodiments are provided to provide a more thorough and comprehensive understanding of the present invention.

[0034] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in this specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0035] The general idea of ​​the present invention is: in response to the existing problems that one-time one-code cannot be achieved and the security of personal information cannot be guaranteed, the present invention provides an intelligent access control management method based on digital certificates. When used for the first time, the digital certificate is used to allocate an initial encrypted user private key and user certificate to the user based on the user's certificate request information, which serves as the user private key of the user end when the user uses it for the first time. In this way, the leakage of the user private key can be prevented. When a user with an existing certificate applies for access control, the user private key of the user end and the user private key of the background key management center are compared after the authority is determined. If the two are the same, the user is allowed to pass. At the same time, a new user private key is generated based on the user certificate and user feature information as the user's next access control password. In this way, one-time one-code can be achieved, the security of access control management is improved, and the stable, reliable and safe operation of the intelligent security access control system is guaranteed.

[0036] In order to better understand the above technical solution, the above technical solution will be described in detail below in conjunction with the drawings and specific implementation methods of the specification. It should be understood that the embodiments of the present invention and the specific features in the embodiments are detailed descriptions of the technical solution of the present application, rather than limitations on the technical solution of the present application. In the absence of conflict, the embodiments of the present invention and the technical features in the embodiments can be combined with each other.

[0037] Reference Figure 1 , Figure 1FIG. 1 is a flow chart of a digital certificate-based intelligent access control management method according to an embodiment of the present invention. Figure 1 As shown, the digital certificate-based intelligent access control management method provided by the present invention includes:

[0038] Step S0: The key management center generates an initial encrypted user private key and a user certificate for the user who applies for the user certificate based on the user information. The initial encrypted user private key is the second user private key of the user terminal when used for the first time.

[0039] Specifically, in one embodiment of the present invention, for the currently commonly used offline access control system, when a user uses it for the first time, he needs to apply for a user certificate and an initial encrypted user private key. When the certificate is issued, the key management center first uses the user information (such as work ID, department, etc.) to generate an initial encrypted user private key and a corresponding user public key for the employee applying for the certificate through the RSA algorithm. The user public key information is stored in the employee's user certificate, and the user private key information needs to be decrypted by the ciphertext private key using the user signature private key in the certificate registration subsystem. Therefore, step S0 includes:

[0040] Step S01: Obtain a signature public key and a signature private key based on an asymmetric encryption algorithm;

[0041] Specifically, in one embodiment of the present invention, the access control key distribution process is initiated by the user terminal of the certificate registration subsystem. When the user terminal performs operations such as applying for a certificate, downloading a certificate, restoring a certificate, and updating a certificate, the user request information and the signature public key are first uploaded to the certificate issuance subsystem CA system. Then the certificate issuance subsystem uploads the key request information and the signature public key to the key management center. The key management center processes these requests and starts the key distribution.

[0042] Step S02: Use the user private key issued by the key management center to encrypt the signature public key and the user's certificate request information to obtain the ciphertext private key and user certificate.

[0043] Specifically, in one embodiment of the present invention, the signature public key and signature private key are used to protect the user's private key. That is, when user A applies for a certificate, the user's private key generated by the key management center is first encrypted using user A's signature public key. After being transmitted to user A through the certificate issuance subsystem and the certificate registration subsystem, A can decrypt it using his or her signature private key to obtain his or her own user private key. Without user A's signature private key, decryption is impossible, thereby preventing the leakage of the user's private key. The user's public key and user's private key are used to protect encrypted documents. For example, a document encrypted using user A's public key can only be decrypted using user A's private key, thereby protecting the encrypted document. Therefore, after encrypting the user's private key using the signature public key, a ciphertext private key can be generated. The user certificate is generated by the certificate issuance subsystem based on the user's public key, basic user information, and other information. Please refer to the general digital certificate generation process.

[0044] Step S03: Decrypt the ciphertext private key using the signature private key to obtain the user certificate and the initial encrypted user private key.

[0045] Specifically, in one embodiment of the present invention, the user certificate stores the user public key and other information related to the user identity, and the initial encrypted user private key is used as the user private key of the user terminal when the user subsequently uses the access control for the first time.

[0046] Furthermore, in one embodiment of the present invention, it is too costly to use asymmetric encryption for all encrypted communications. Therefore, asymmetric encryption is generally used for key information (identity ID, private key, etc.), and symmetric encryption SM1 and SM4 algorithms can be used for other information (such as public key information).

[0047] Step S1: When a request for access control is identified, determining whether the user has access authority based on the request;

[0048] Specifically, in one embodiment of the present invention, when a user applies for access control with a smart terminal, the system obtains employee information (such as employee ID, department, etc.), matches the employee information in the user certificate with the backend database, and determines whether the user has permission to enter. The smart terminal is installed with relevant APPs and the employee's digital certificate, including but not limited to smartphones, smart watches and other related devices.

[0049] Step S2: When it is determined that the user has access authority, the first user private key of the key management center and the second user private key of the user terminal are compared to see whether they are the same. If the first user private key and the second user private key are the same, a random number is generated based on the user certificate and user feature information;

[0050] Specifically, in one embodiment of the present invention, if the user information in the user certificate matches the data in the backend employee database, the user private key stored in the key management center is compared with the user private key stored in the user's app to see if they are the same. During the first use, the user private key issued by the key management center is compared with the initial encrypted user private key generated when the certificate was issued to the employee.

[0051] Furthermore, in one embodiment of the present invention, the identity of two user private keys is determined by comparing their hash values. A hash function is applied to both user private keys. If the hash values ​​are identical, this proves that the two private keys are identical, confirming the employee's identity. Prior to calculating the hash value, the user private key must be decrypted using the signature private key, signature public key, and user public key.

[0052] Furthermore, in one embodiment of the present invention, after confirming that the employee's identity allows access, a new user key is generated through the SM3 single-item hash algorithm using the information in the user certificate and the user access time. By regenerating the user key, the one-time-one-key principle can be implemented, that is, the access control password is different each time, even for the same employee, thereby improving the security of the access control system. Among them, the user access time refers to the time when the user's mobile phone is close to the access control system and applies to the issuing server, at least accurate to the second, for example, 13:54:50 on July 29, 2022, this time can be recorded as 20220729135450. Therefore, step S2 includes:

[0053] Step S21: Decrypt the second user private key of the user terminal using the signature private key, the signature public key and the user public key;

[0054] Step S22, respectively calculating a first hash value of the first user private key of the key management center and a second hash value of the second user private key of the user terminal; and

[0055] Step S23: When the first hash value and the second hash value are the same, generate the random number using the SM3 single-item hash algorithm using the user certificate and the user access time.

[0056] Step S3: Use random numbers to replace the first user private key and the second user private key respectively.

[0057] Specifically, in one embodiment of the present invention, the generated new user key is stored in the user terminal and the background key management center respectively, for identification and comparison when the user visits next time.

[0058] The improved digital certificate-based smart access control management method of this invention uses a digital certificate to automatically decrypt and detect the initial key during the identification and authentication process. If the password matches, the system automatically generates a random string based on the user's characteristics as the new initial key. Simultaneously, the background also records and stores the newly generated random string, effectively changing the access control password to the newly generated random string. The next time the access control is used, the newly generated random string will be used as the password. This ensures a one-time, one-code system, improving the security of smart access control.

[0059] Accordingly, the present invention further provides an intelligent access control management system based on digital certificates, comprising:

[0060] An initial password generation module is configured to generate an initial encrypted user private key and a user certificate for a user applying for a user certificate based on user information. The initial encrypted user private key is a second user private key of the user terminal when used for the first time. Further, the initial password generation module includes a signature acquisition unit configured to obtain a signature public key and a signature private key based on an asymmetric encryption algorithm, an encryption unit configured to encrypt the signature public key and the user's certificate request information using a user private key issued by a key management center to obtain a ciphertext private key and a user certificate, and a first decryption unit configured to decrypt the ciphertext private key using the signature private key to obtain the user certificate and the initial encrypted user private key.

[0061] An identity recognition module is used to determine whether the user has access authority based on a request for access control when the request is identified;

[0062] a password verification module for comparing, when determining that a user has access authority, a first user private key of the key management center and a second user private key of the user terminal to determine whether they are identical; further, the password verification module includes a second decryption unit for decrypting the second user private key of the user terminal using the signature private key, the signature public key, and the user public key; a calculation unit for respectively calculating a first hash value of the first user private key of the key management center and a second hash value of the second user private key of the user terminal; and a comparison unit for comparing the first hash value and the second hash value;

[0063] A new password generation module is used to generate a random number based on the user certificate and user feature information when the first user private key and the second user private key are the same, and use the random number to replace the first user private key and the second user private key respectively; further, the new password generation module uses the user certificate and user access time to generate the random number through the SM3 single-item hash algorithm.

[0064] An embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps can be implemented:

[0065] When a request for access control is identified, whether the user has access authority is determined based on the request for access control; when it is determined that the user has access authority, a comparison is made between a first user private key of the key management center and a second user private key of the user terminal to determine whether they are the same; when the first user private key and the second user private key are the same, a random number is generated based on the user certificate and user feature information; and the random numbers are used to replace the first user private key and the second user private key, respectively, and are stored in the user terminal and the key management center, respectively.

[0066] The computer-readable storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM)> a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0067] In the description provided herein, numerous specific details are described. However, it is understood that embodiments of the present invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of this description.

[0068] Similarly, it should be understood that in order to streamline the present disclosure and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the invention, various features of the invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Accordingly, the claims following the detailed description are hereby expressly incorporated into this detailed description, with each claim standing on its own as a separate embodiment of the invention.

[0069] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition may be divided into multiple submodules or subunits or subcomponents. All features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed herein may be combined in any combination, except that at least some of such features and / or processes or units are mutually exclusive. Unless expressly stated otherwise, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0070] Furthermore, those skilled in the art will appreciate that although some embodiments herein include certain features included in other embodiments but not other features, combinations of features from different embodiments are intended to be within the scope of the present invention and to form different embodiments. For example, in the claims below, any of the claimed embodiments may be used in any combination.

[0071] The various component embodiments of the present invention can be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It will be appreciated by those skilled in the art that a microprocessor or digital signal processor (DSP) can be used in practice to implement some or all of the functions of some or all of the components in accordance with the embodiments of the present invention. The present invention can also be implemented as a device or apparatus program (e.g., a computer program and a computer program product) for executing a portion or all of the methods described herein. Such a program implementing the present invention can be stored on a computer-readable medium, or can have the form of one or more signals. Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0072] It should be noted that the above embodiments illustrate rather than limit the invention, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between brackets should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising several different elements and by means of appropriately programmed computers. In a unit claim enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third etc. does not indicate any order. These words may be interpreted as names.

Claims

1. An intelligent access control management method based on digital certificates, characterized in that: The following steps are involved: The key management center generates an initial encryption user private key and a user certificate for the user who applies for the user certificate based on the user information. The initial encryption user private key is the second user private key of the user terminal when it is used for the first time. When a request for access control is identified, determining whether the user has access authority based on the request; When determining whether the user has access authority, the first user private key of the key management center and the second user private key of the user terminal are compared to see if they are the same. If the first user private key and the second user private key are the same, a random number is generated based on the user certificate and user feature information; as well as Using random numbers to replace the first user private key and the second user private key respectively and storing them in the user terminal and the key management center respectively; The steps for the key management center to generate an initial encryption user private key and a user certificate for a user applying for a user certificate based on user information include: Obtain signature public key and signature private key based on asymmetric encryption algorithm; Use the signature public key to encrypt the user's private key and the user's certificate request information issued by the key management center to obtain the ciphertext private key and user certificate; Use the signature private key to decrypt the ciphertext private key to obtain the user certificate and the initial encrypted user private key.

2. The digital certificate-based intelligent access control management method according to claim 1, characterized in that: When determining whether the user has access authority, the first user private key of the key management center and the second user private key of the user terminal are compared to see whether they are the same. If the first user private key and the second user private key are the same, the step of generating a random number based on the user certificate and the user feature information includes: Decrypt the second user private key of the user terminal using the signature private key, the signature public key and the user public key; Calculating a first hash value of a first user private key of a key management center and a second hash value of a second user private key of a user terminal; and When the first hash value and the second hash value are the same, the random number is generated by using the SM3 single-item hash algorithm using the user certificate and the user access time.

3. An intelligent access control management system based on digital certificates, characterized in that: include: The initial password generation module is used to generate an initial encrypted user private key and a user certificate for the user who applies for the user certificate according to the user information. The initial encrypted user private key is the second user private key of the user terminal when it is used for the first time; An identity recognition module is used to determine whether the user has access authority based on a request for access control when the request is identified; A password verification module is used to compare the first user private key of the key management center and the second user private key of the user terminal to see if they are the same when determining that the user has access authority; A new password generation module is used to generate a random number based on the user certificate and user feature information when the first user private key and the second user private key are the same, and use the random number to replace the first user private key and the second user private key respectively; The initial password generation module includes: A signature acquisition unit, used to obtain a signature public key and a signature private key based on an asymmetric encryption algorithm; The encryption unit is used to encrypt the signature public key and the user's certificate request information using the user's private key issued by the key management center to obtain the ciphertext private key and user certificate; The first decryption unit is used to decrypt the ciphertext private key using the signature private key to obtain the user certificate and the initial encrypted user private key.

4. The digital certificate-based intelligent access control management system as claimed in claim 3, characterized in that: The password verification module includes: A second decryption unit is used to decrypt the second user private key of the user terminal using the signature private key, the signature public key and the user public key; a calculation unit, configured to respectively calculate a first hash value of a first user private key of a key management center and a second hash value of a second user private key of a user terminal; and The comparison unit is configured to compare the first Hash value and the second Hash value.

5. The digital certificate-based intelligent access control management system according to claim 3, characterized in that: The new password generation module generates the random number using the user certificate and user access time through the SM3 single-way hash algorithm.

6. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the digital certificate-based intelligent access control management method according to any one of claims 1 to 2 are implemented.

Images