Access control management method, system and device based on PKI security authentication and medium

Abstract

The application discloses a PKI security authentication-based access control management method, system and device and a medium, and comprises the following steps: a user terminal sends a first random number to an access control device; the access control device signs the first random number to obtain a first signature result, and returns the first signature result, a second random number and a first time stamp to the user terminal; the user terminal checks the first signature result and the first time stamp, and when the check is successful, obtains a first device certificate according to the first signature result, and determines a corresponding first user certificate according to the first device certificate; the user terminal signs the second random number and the first time stamp to obtain a second signature result, and sends the second signature result and a second device certificate to the access control device; and the access control device checks the second signature result and the second device certificate, and when the check is successful, calls an access control controller to open the access control. The application improves the security of the access control, and can be widely applied to the technical field of access control management.

Description

Technical Field

[0001] This invention relates to the field of access control management technology, and in particular to an access control management method, system, device and medium based on PKI security authentication. Background Technology

[0002] Unlike the rudimentary management of traditional access control systems, the construction of smart communities, smart parks, and smart construction sites requires more precise access control authentication, namely, knowing who is opening the door and whether they have the necessary permissions. Currently, two common approaches exist: one is network-based access control authentication, which has the advantage of not needing to issue and store a large number of user permissions—the access control system requests authentication from the platform each time a user tries to open the door; the disadvantage is that the system will completely fail if the network connection is lost. The other approach involves the platform pre-issuing user permissions to the access control devices. This approach has the advantage of remaining functional offline, but the disadvantage is the need to issue and manage a large number of user permissions. Furthermore, current authentication methods generally involve directly comparing user permission identifiers, but these identifiers can be leaked and forged; the technical barriers and costs for stealing and forging them are very low, posing significant security risks. Summary of the Invention

[0003] The purpose of this invention is to at least partially solve one of the technical problems existing in the prior art.

[0004] Therefore, one objective of this invention is to provide an access control management method based on PKI security authentication, which reduces equipment management costs and improves access control security while achieving offline access control authentication.

[0005] Another objective of this invention is to provide an access control management system based on PKI security authentication.

[0006] To achieve the above-mentioned technical objectives, the technical solutions adopted in the embodiments of the present invention include:

[0007] In a first aspect, embodiments of the present invention provide an access control management method based on PKI security authentication, comprising the following steps:

[0008] A near-field communication connection is established between the user terminal and the access control device, and a first random number is sent to the access control device.

[0009] The access control device uses the first device certificate and the first device private key to sign the first random number to obtain a first signature result, and then returns the first signature result, the second random number, and the first timestamp to the user terminal.

[0010] The user terminal verifies the first signature result and the first timestamp. When the verification is successful, the first device certificate is obtained by parsing the first signature result, and the device identifier of the access control device is determined based on the first device certificate. Then, the corresponding first user certificate is determined based on the device identifier.

[0011] The user terminal uses the first user certificate and the first user private key to sign the second random number and the first timestamp to obtain a second signature result, and then sends the second signature result and the second device certificate to the access control device.

[0012] The access control device verifies the second signature result and the second device certificate. If the verification is successful, the access control controller is invoked to open the access control.

[0013] Furthermore, in one embodiment of the present invention, the access control management method further includes the following steps:

[0014] The access control device generates a first PKI public-private key pair, which includes a first device public key and a first device private key. Based on the first device public key, a first certificate request is generated and sent to the system platform. The system platform then uses the first platform certificate and the first platform private key to issue the first device certificate, the second device certificate, the second device private key, and the user certificate revocation list. Finally, the system platform returns the first device certificate, the second device certificate, and the user certificate revocation list to the access control device.

[0015] A second PKI public-private key pair is generated through the user terminal. The second PKI public-private key pair includes a first user public key and a first user private key. A second certificate request is generated based on the first user public key and sent to the system platform. The system platform then uses the second device certificate and the second device private key to issue the first user certificate and returns the first platform certificate, the first user certificate, and the second device certificate to the user terminal.

[0016] Furthermore, in one embodiment of the present invention, the access control management method further includes the following steps:

[0017] The access control device uses the first device certificate and the first device private key to sign the second random number and the first timestamp to obtain a third signature result, and generates a fourth signature result based on the second signature result and the third signature result, and then sends the fourth signature result to the system platform;

[0018] The system platform verifies the fourth signature result. When the verification is successful, the first device certificate, the first user certificate, and the first timestamp are obtained by parsing the fourth signature result. Then, an access control event record is generated based on the first device certificate, the first user certificate, and the first timestamp.

[0019] Furthermore, in one embodiment of the present invention, the step of establishing a near-field communication connection with the access control device through the user terminal and sending a first random number to the access control device specifically includes:

[0020] The access control device uses near-field communication to send first broadcast data, the first broadcast data including a digest of the first platform certificate;

[0021] The user terminal scans the first broadcast data using near-field communication and establishes a near-field communication connection with the access control device based on the digest of the first platform certificate.

[0022] The first random number is sent to the access control device through the user terminal.

[0023] Furthermore, in one embodiment of the present invention, the step of verifying the first signature result and the first timestamp through the user terminal specifically includes:

[0024] The user terminal verifies whether the first signature result is signed by the first device certificate.

[0025] The user terminal verifies whether the first device certificate was issued by the first platform certificate.

[0026] The user terminal verifies whether the time difference between the first timestamp and the current time is less than or equal to a preset first threshold.

[0027] When the first signature result is the first device certificate signing, the first device certificate is the first platform certificate issuing, and the time difference between the first timestamp and the current time is less than or equal to the first threshold, the verification is confirmed to be successful.

[0028] Furthermore, in one embodiment of the present invention, the step of verifying the second signature result and the second device certificate through the access control device specifically includes:

[0029] The access control device verifies whether the second signature result is signed by the first user certificate.

[0030] The access control device verifies whether the first user certificate is on the user certificate revocation list.

[0031] The access control device verifies whether the first user certificate was issued by the second device certificate.

[0032] The access control device verifies whether the certificate of the second device was issued by the certificate of the first platform.

[0033] When the second signature result is signed by the first user certificate, and the first user certificate is not in the user certificate revocation list, the first user certificate is issued by the second device certificate, and the second device certificate is issued by the first platform certificate, the verification is confirmed to be successful.

[0034] Furthermore, in one embodiment of the present invention, the access control management method further includes the following steps:

[0035] When the number of certificates in the user certificate revocation list exceeds a preset second threshold, or the number of users whose access control permissions need to be revoked in this operation exceeds a preset third threshold, the system platform uses the first platform certificate and the first platform private key to update the second device certificate and the second device private key, and sends the updated second device certificate to the access control device and the user terminal.

[0036] Secondly, embodiments of the present invention provide an access control management system based on PKI security authentication, including:

[0037] A communication connection establishment module is used to establish a near-field communication connection with the access control device through a user terminal and send a first random number to the access control device;

[0038] The first signature module is used to sign the first random number using the access control device with the first device certificate and the first device private key to obtain a first signature result, and return the first signature result, the second random number and the first timestamp to the user terminal.

[0039] The first verification module is used to verify the first signature result and the first timestamp through the user terminal. When the verification is successful, the first device certificate is obtained by parsing the first signature result, and the device identifier of the access control device is determined according to the first device certificate. Then, the corresponding first user certificate is determined according to the device identifier.

[0040] The second signature module is used to sign the second random number and the first timestamp using the first user certificate and the first user private key through the user terminal to obtain a second signature result, and send the second signature result and the second device certificate to the access control device.

[0041] The second verification module is used to verify the second signature result and the second device certificate through the access control device. When the verification is successful, the access control controller is invoked to open the access control.

[0042] Thirdly, embodiments of the present invention provide an access control management device based on PKI security authentication, comprising:

[0043] At least one processor;

[0044] At least one memory for storing at least one program;

[0045] When the at least one program is executed by the at least one processor, the at least one processor implements the above-described access control management method based on PKI security authentication.

[0046] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing a processor-executable program, which, when executed by a processor, is used to perform the aforementioned access control management method based on PKI security authentication.

[0047] The advantages and beneficial effects of the present invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention:

[0048] This invention utilizes PKI security authentication technology to achieve authentication between access control devices and user terminals. Only a small amount of authentication information needs to be sent to the access control device to accurately authenticate a large number of users. The entire authentication process is secure and reliable. At the same time, the access control device and user terminal do not require additional external equipment, reducing equipment management costs. When the access control device is offline, it can not only continue to authenticate users offline, but also securely update authentication information, thereby improving the security of the access control system. Attached Figure Description

[0049] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the embodiments of the present invention are described below. It should be understood that the drawings described below are only for the convenience of clearly describing some embodiments of the technical solutions of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0050] Figure 1 A flowchart illustrating the steps of an access control management method based on PKI security authentication, provided in this embodiment of the invention;

[0051] Figure 2 This is a data interaction diagram illustrating an access control management method based on PKI security authentication provided in an embodiment of the present invention.

[0052] Figure 3 A structural block diagram of an access control management system based on PKI security authentication provided in an embodiment of the present invention;

[0053] Figure 4 This is a structural block diagram of an access control management device based on PKI security authentication, provided for an embodiment of the present invention. Detailed Implementation

[0054] The embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention. The step numbers in the following embodiments are set only for ease of explanation, and there is no limitation on the order between the steps. The execution order of each step in the embodiments can be adaptively adjusted according to the understanding of those skilled in the art.

[0055] In the description of this invention, "multiple" means two or more. The use of "first" and "second" is for distinguishing technical features only and should not be construed as indicating or implying relative importance, or implicitly indicating the number of indicated technical features, or the order of the indicated technical features. Furthermore, unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art.

[0056] First, the principle of PKI security authentication in this embodiment of the invention will be explained.

[0057] The platform has a certificate RA X0 and its private key U0. Person A generates a private key U and a public key V1. Using the private key U, Person A digitally signs their name N with S0. N, S0, and V1 are then combined according to PKI technology standards to form a certificate request R, which is sent to the platform. The platform can technically verify whether S0 is signed with the private key corresponding to V1. If the verification is successful, and the platform verifies offline or through other methods that N indeed belongs to the requester, then it issues certificate X1 to Person A. Certificate X1 includes the identifier of the parent certificate X0, the subject name N, the certificate validity period, the usage of the enhanced key, the public key V1, and the signature S1. S1 is the platform's digital signature of other information in certificate X1 using its private key U0. When Person B needs to verify Person A's identity, they will randomly provide some information M. Person A can use their private key U to sign M to obtain S2. Person B can then technically use certificate X0 to verify the validity of M, S2, and certificate X1. If any data in M, S2, or X1 is modified, the verification will fail. Since others cannot obtain the U, they cannot impersonate A, thus enabling secure authentication.

[0058] Reference Figure 1 This invention provides an access control management method based on PKI security authentication, specifically including the following steps:

[0059] S103. Establish a near-field communication connection with the access control device through the user terminal, and send the first random number to the access control device;

[0060] S104. The access control device uses the first device certificate and the first device private key to sign the first random number to obtain the first signature result, and returns the first signature result, the second random number and the first timestamp to the user terminal.

[0061] S105. The user terminal verifies the first signature result and the first timestamp. When the verification is successful, the first device certificate is obtained by parsing the first signature result, and the device identifier of the access control device is determined based on the first device certificate. Then, the corresponding first user certificate is determined based on the device identifier.

[0062] S106. The user terminal uses the first user certificate and the first user private key to sign the second random number and the first timestamp to obtain the second signature result, and sends the second signature result and the second device certificate to the access control device.

[0063] S107. Verify the second signature result and the second device certificate through the access control device. If the verification is successful, call the access control controller to open the access control.

[0064] Reference Figure 1 As an optional implementation, the access control management method further includes the following steps:

[0065] S101. Generate a first PKI public-private key pair through the access control device. The first PKI public-private key pair includes a first device public key and a first device private key. Generate a first certificate request based on the first device public key and send it to the system platform. The system platform uses the first platform certificate and the first platform private key to issue a first device certificate, a second device certificate, a second device private key, and a user certificate revocation list. Then, return the first device certificate, the second device certificate, and the user certificate revocation list to the access control device.

[0066] S102. Generate a second PKI public-private key pair through the user terminal. The second PKI public-private key pair includes the first user public key and the first user private key. Generate a second certificate request based on the first user public key and send it to the system platform. The system platform then uses the second device certificate and the second device private key to issue the first user certificate and returns the first platform certificate, the first user certificate, and the second device certificate to the user terminal.

[0067] Specifically, the digital certificates mentioned in the embodiments of the present invention conform to PKCS#7: Cryptographic Message Syntax Version 1.5 (RFC2315) and the standards referenced therein, or the GMT 0015-2012 standard "Digital Certificate Format Based on SM2 Cryptographic Algorithm".

[0068] The system defines four enhanced key usage OIDs for digital certificates, including device identifier (1.3.6.1.5.5.7.3.2.13.1), user identifier (1.3.6.1.5.5.7.3.2.13.2), platform identifier (1.3.6.1.5.5.7.3.1.13.1), and access control permission identifier (1.3.6.1.5.5.7.3.1.13.2), and writes these OIDs into the ROM of the access control device.

[0069] like Figure 2 The diagram shown is a data interaction diagram of an access control management method based on PKI security authentication provided in an embodiment of the present invention. The system platform has a private key (i.e., the first platform private key) of the authentication root certificate or RA certificate (i.e., the first platform certificate, denoted as certificate A), which is used to issue device certificates, user certificates, and revocation lists.

[0070] Access control devices are factory-installed with a first platform certificate, whose enhanced key usage includes OID (1.3.6.1.5.5.7.3.1.13.1). In systems requiring a high level of security, access control devices must meet the national cryptographic standard GMT0008-2012 "Security Chip Cryptographic Testing Guidelines".

[0071] The access control device generates a PKI public / private key pair and uses the device information and public key to generate a first certificate request (CSR). The device information must include a globally unique device identifier. Device information may include the device name, serial number, MAC address, IMEI, ICCID, and location. The access control device submits the first certificate request to the access control system platform via a platform network link or near-field communication terminal.

[0072] The system platform uses certificate A and its private key to request the issuance of device certificate B (i.e., the first device certificate) for the first certificate. The enhanced key usage of certificate B must include the OID (1.3.6.1.5.5.7.3.2.13.1). The system can issue / update device certificate B for access control devices via a platform network link or a near-field communication terminal. When issuing or updating certificate B, the access control device needs to verify whether the public key of certificate B is equal to its own generated public key, and whether the signature was issued by certificate A.

[0073] For the issuance of Certificate B, the first request is signed using the newly generated private key, and the platform needs to manually verify the device information before issuing Certificate B. From the second request onwards, the request is signed using the private key corresponding to the existing Certificate B, and the platform does not need to manually verify it. It only needs to verify the successful signature to issue a new Certificate B.

[0074] The system can issue / update platform certificate A for access control devices via a platform network link or near-field communication terminal. When updating platform certificate A, the system must include the signature of the new certificate on the old certificate, and the access control device must check whether the signature is valid.

[0075] When the access control device requests certificate B for the first time, if manual verification passes, the system platform uses the device information to generate certificate B2 with a private key (i.e., the second device certificate and its corresponding private key). Certificate B2 is signed with the private key of certificate A, and the enhanced key usage for B2 is (1.3.6.1.5.5.7.3.1.13.2). The system may choose not to issue or update certificate B2 for the access control device, or it may issue / update certificate B2 for the access control device via the platform network link or near-field communication terminal.

[0076] When updating certificate A of the access control device, the old certificate A needs to be backed up for compatibility verification. That is, when certificate A is needed for signature verification, if the current certificate A fails to verify the signature, the previous version of certificate A can be used for signature verification.

[0077] After logging into the system, during system usage, one or more user terminal certificates C (i.e., the first user certificate) will be issued or updated on the user terminal in the following situations:

[0078] 1) After the user logs in;

[0079] 2) The user terminal needs to update its private key;

[0080] 3) The user has access permission to a certain access control device, but the corresponding certificate is not yet available locally;

[0081] 4) A user has access to a certain access control device, but the local certificate is about to expire;

[0082] 5) Force users or system platforms to synchronize certificates.

[0083] After successful registration, the access control user will receive or update user certificate C on their terminal. The issuance or update process is as follows:

[0084] 1) The user terminal generates a public-private key pair. If a public-private key pair already exists and is relatively new, it can be reused.

[0085] 2) Use the private key to sign and generate a certificate request, then send it to the system platform;

[0086] 3) After receiving the certificate request from the user terminal, the system platform performs authentication;

[0087] 4) After successful authentication, one or more user terminal certificates (C1, C2, etc.) are issued to the user terminal according to the user's one or more access control permissions.

[0088] Each user terminal certificate is issued using the private key of the access control device's corresponding B2 certificate, and is issued together with the user terminal certificate C and the access control certificate B2. The enhanced key usage of the user terminal certificate C must include OID (1.3.6.1.5.5.7.3.2.13.2). The validity period of the user certificate does not exceed the validity period of the user's access control permissions, and generally does not exceed one week.

[0089] The platform generates a unique identifier for each user terminal and binds it to the user, meaning that a specific user can be identified through the terminal identifier. Each certificate C includes the unique identifier for the user terminal.

[0090] If it is necessary to revoke a user's access control device privileges, certificate C is added to the revocation list. The system can issue / update the certificate C revocation list for access control devices via platform network link or near-field communication terminal.

[0091] Based on the certificates, keys, and other data obtained in the preceding steps, the process for users to open access control devices is as follows:

[0092] 1) The access control device uses near-field communication to continuously broadcast a set of data during operation, which includes a summary of certificate A.

[0093] 2) The user terminal uses near-field communication to scan broadcast data. If it finds a digest containing certificate A, it establishes a near-field communication connection and sends a random number R1 to the access control device.

[0094] 3) The access control device signs the random number R1 using a B certificate and its private key, and sends the signature result S1, along with the random number R2 and the current time T (i.e., the first timestamp), to the user terminal via a near-field communication link. S1 is based on the PKCS#7 standard and includes a B certificate.

[0095] 4) The user terminal verifies that S1 was indeed signed by certificate B, the enhanced key usage of certificate B is (1.3.6.1.5.5.7.3.2.13.1), and that certificate B was indeed issued by certificate A. If the verification fails, an error is reported and the process exits. If time T is too far removed from the user terminal's current time, an error is reported requesting the access control device or user terminal's time to be corrected and the process exits.

[0096] 5) The user terminal parses and uses the B certificate in signature S1 to obtain the device identifier. If the corresponding certificate C for this device identifier is not available locally, certificate C is obtained according to the certificate C issuance process described above. The user terminal uses certificate C and its private key to sign the random number S2 and the time T to obtain signature S2. S2 is based on the PKCS#7 standard and carries certificate C.

[0097] 6) The user terminal sends S2 and certificate B2 to the access control device via a near-field communication link.

[0098] 7) The access control device verifies signature S2, including the validity of the signature, the validity of certificate C, the absence of certificate C from the revocation list, the usage of the enhanced key for certificate C as (1.3.6.1.5.5.7.3.2.13.2), the requirement that certificate C was issued by certificate B2, the requirement that certificate B2 be valid, the usage of the enhanced key for certificate B2 as (1.3.6.1.5.5.7.3.1.13.2), and the requirement that certificate B2 was issued by certificate A. If verification fails, an error message is displayed and the process exits.

[0099] 8) If the verification is successful, the access control device calls the access control controller to open the access control.

[0100] Reference Figure 1 As an optional implementation, the access control management method further includes the following steps:

[0101] S108. The access control device uses the first device certificate and the first device private key to sign the second random number and the first timestamp to obtain the third signature result, and generates the fourth signature result based on the second signature result and the third signature result, and then sends the fourth signature result to the system platform.

[0102] S109. The fourth signature result is verified by the system platform. When the verification is successful, the first device certificate, the first user certificate and the first timestamp are obtained by parsing the fourth signature result. Then, an access control event record is generated based on the first device certificate, the first user certificate and the first timestamp.

[0103] Specifically, when the second signature result S2 is successfully verified, the access control device uses certificate B and its private key to sign the random number S2 and the time T to obtain signature S3. S3 is then merged with S2 to form a composite signature S4. The access control device can submit S4 to the system platform via a network link or near-field communication terminal as an access control entry / exit record. When there is no network link or near-field communication terminal, the access control device can cache several S4s and submit them when a network link or near-field communication terminal is available. After receiving S4, the system platform can determine the device identifier based on certificate B, the user terminal identifier based on certificate C, and the door opening time based on the timestamp T, thereby reconstructing the entire door opening event.

[0104] In addition, access control entry and exit records can be validated using S4. The validation includes the following points. If the validation fails, it means that the record is forged or the user's access is illegal.

[0105] 1) Time T is within the validity period of the user's access control device's permissions;

[0106] 2) The validity of S2's signature;

[0107] 3) T is within the validity period of certificate C;

[0108] 4) Certificate C must be issued by Certificate B2;

[0109] 5) T is within the validity period of certificate B2;

[0110] 6) Certificate B2 must have been issued by Certificate A;

[0111] 7) The signature validity of S3, and the validity of certificate B;

[0112] 8) Certificate B must have been issued by Certificate A;

[0113] 9) The enhanced key usage of all the certificates mentioned above conforms to their usage.

[0114] As a further optional implementation, step S103, which involves establishing a near-field communication connection between the user terminal and the access control device and sending a first random number to the access control device, specifically includes:

[0115] S1031. Send first broadcast data via near-field communication through the access control device, the first broadcast data including a digest of the first platform certificate;

[0116] S1032. Scan the first broadcast data using near-field communication through the user terminal, and establish a near-field communication connection with the access control device based on the digest of the first platform certificate;

[0117] S1033. Send the first random number to the access control device through the user terminal.

[0118] As a further optional implementation, the step of verifying the first signature result and the first timestamp through a user terminal specifically includes:

[0119] A1. Verify through the user terminal whether the first signature result is signed by the first device certificate;

[0120] A2. Verify through the user terminal whether the certificate of the first device was issued by the certificate of the first platform;

[0121] A3. Verify through the user terminal whether the time difference between the first timestamp and the current time is less than or equal to a preset first threshold.

[0122] A4. When the first signature result is signed by the first device certificate, the first device certificate is issued by the first platform certificate, and the time difference between the first timestamp and the current time is less than or equal to the first threshold, the verification is confirmed to be successful.

[0123] As a further optional method, the step of verifying the second signature result and the second device certificate through the access control device specifically includes:

[0124] B1. Verify whether the second signature result is signed by the first user's certificate through the access control device;

[0125] B2. Verify whether the first user certificate is on the user certificate revocation list through the access control device;

[0126] B3. Verify whether the first user certificate was issued by the second device certificate through the access control equipment;

[0127] B4. Verify whether the certificate of the second device was issued by the first platform through the access control device;

[0128] B5. If the second signature result is signed by the first user certificate, and the first user certificate is not in the user certificate revocation list, the first user certificate is issued by the second device certificate, and the second device certificate is issued by the first platform certificate, then the verification is successful.

[0129] As an optional implementation, the access control management method further includes the following steps:

[0130] When the number of certificates in the user certificate revocation list exceeds the preset second threshold, or the number of users whose access control permissions need to be revoked in this operation exceeds the preset third threshold, the system platform uses the first platform certificate and the first platform private key to update the second device certificate and the second device private key, and sends the updated second device certificate to the access control device and the user terminal.

[0131] Specifically, certificate B2 and its private key will be regenerated in the following situations:

[0132] 1) The length of the revocation list exceeds a certain threshold, generally 100 items;

[0133] 2) The number of users whose access permissions need to be revoked in a single operation exceeds a certain threshold, which is generally 30.

[0134] In addition, updating certificate B2 requires backing up the old certificate for verification; updating certificate B2 also requires placing the old certificate on the revocation list and sending it to the access control device via network connection or near-field communication.

[0135] The method steps of the embodiments of the present invention have been described above. The overall process of the present invention will be further described below with reference to a specific embodiment.

[0136] (1) The platform owns certificate A and its private key Ua, and can update certificate A and its private key Ua if certificate A expires or is threatened. Certificate A can be issued by a higher-level RA certificate or a root certificate.

[0137] (2) Access control G goes online, generates a private key Ug and a public key Vg, and generates a certificate request based on Vg and sends it to the platform. The platform first verifies from a technical perspective that the request data has not been tampered with, and then, after authenticating the validity of the request entity, issues a certificate Bg, including Vg, to access control G using A and Ua. At the same time, the platform generates a private key U2g and a public key V2g, and issues a certificate B2g using A and Ua.

[0138] (3) User J registers with the platform and the platform administrator grants J access control G. Then, user J can generate a private key Uj and a public key Vj on his terminal. He generates a certificate request based on Vj and sends it to the platform. The platform uses U2g and B2g to issue a certificate Cj to user J's terminal based on the certificate request.

[0139] (4) Access control G repeatedly broadcasts the MD5 digest of certificate A, 16 bytes, via near-field communication, such as Bluetooth BLE protocol.

[0140] (5) When user J needs to open access control G, he starts the door opening process on his terminal. The terminal scans the surrounding broadcast data through the Bluetooth BLE protocol. When the MD5 digest of certificate A is found, a Bluetooth link is established with the broadcast source, i.e. access control G, and a random number R1 is sent to G through the link.

[0141] (6) After the access control G establishes a Bluetooth connection with the terminal, it waits for the random number R1. After obtaining it, it signs R1 using Ug, packages the signature S1 and certificate Bg into a signature S1 according to the PKCS standard, adds the random number R2 and the current time T, and sends it to the user terminal J.

[0142] (7) After receiving S1, user terminal J uses certificate A to digitally sign it and verify certificate Bg. If the verification fails, the connection is closed and an error is reported. If the verification is successful, Uj is used to digitally sign R2 and T, the signature result is packaged with certificate Cj according to the PKCS standard as S2, and certificate B2g is added and sent back to access control G.

[0143] (8) Access control G uses certificate A in combination with R2 and T to verify S2 and its Cj and B2g. If the verification is successful, the access control is opened and Ug is used to digitally sign the random numbers R2 and T, which are then appended to S2 to form S4 and submitted to the platform.

[0144] (9) If the platform administrator wants to revoke J's access permission to G, the platform will add Cj to the revocation list, issue a U2g signature and send it to access control G. The next time J wants to open the door, the previous verification of Cj by access control G will fail.

[0145] (10) If the platform administrator wants to revoke the access permissions of many users at G, in addition to adding these users' certificates to the revocation list, they can also directly revoke the existing certificate B2g, add it to the revocation list and send it to access control G, and reissue a new B2g. In this way, the revoked users will fail to verify B2g in step eight. Users with access permissions at access control G can connect to the platform to update their terminal's Cj, so that authentication in step eight can pass.

[0146] (11) After obtaining the S4, the platform can parse out various elements of the entry and exit records, such as people, time, and devices. Furthermore, if there is a denial, such as a user denying that they passed through a certain access control at a certain time, the platform can verify the validity of all digital signatures and related certificates in the S4, thereby verifying the authenticity of the entry and exit record.

[0147] It is understood that the embodiments of the present invention utilize PKI security authentication technology to achieve authentication between access control devices and user terminals. Only a small amount of authentication information needs to be sent to the access control device to accurately authenticate a large number of users. The entire authentication process is secure and reliable. At the same time, the access control device and user terminal do not require additional external equipment, reducing equipment management costs. When the access control device is offline, it can not only continue to authenticate users offline, but also securely update the authentication information, thereby improving the security of the access control.

[0148] In existing offline authentication schemes for access control systems, the platform pre-issues user permissions to the access control device. The access control device needs to manage a large number of user permissions, and the platform also needs to repeatedly synchronize user permission data with the access control device. Therefore, it has the following drawbacks:

[0149] 1) The platform needs to constantly operate the access control equipment, which places a heavy burden on the platform;

[0150] 2) Access control equipment requires constant updates to user permissions, placing a significant burden on the equipment itself. This is especially true when permissions change frequently, potentially leading to untimely updates.

[0151] 3) Frequent exchange of permission data between the platform and access control equipment brings various security risks;

[0152] 4) Access control equipment requires storing a large amount of access control data, increasing costs;

[0153] 5) Access control devices need to search and match from a large amount of permission data when authenticating users, which is inefficient.

[0154] This invention does not require issuing a large number of user permissions, can be used offline with access control devices, and employs a highly secure authentication method. User permission identifiers are protected by digital signatures, making them impossible to forge and eliminating concerns about leakage. Furthermore, this authentication method is based on a PKI algorithm, enabling precise control of permissions and ensuring sufficient security for pre-authentication and secure log auditing afterward.

[0155] Compared with the prior art, the main advantages of the embodiments of the present invention are:

[0156] 1) Access control devices do not need to be online all the time. They only need to be online occasionally to update key information and report entry and exit records, so the network requirements are very low.

[0157] 2) Access control equipment does not need to manage a large number of user permissions, which greatly reduces equipment costs.

[0158] 3) The platform does not need to synchronize all user permission data with the access control equipment, which greatly reduces the burden on the platform and access control equipment, and eliminates security risks such as data leakage.

[0159] 4) For areas where access control permissions change frequently, such as construction sites with a large number of temporary workers, it is safe and efficient, and does not require frequent operation of the access control device's permission list.

[0160] 5) No need to clear permissions in the access control device when they expire.

[0161] 6) Due to the development of integrated circuit technology and the emergence of ECC algorithm, the platform, access control equipment and user terminal have the advantages of low cost and fast operation when performing PKI calculations. Compared with the existing access control equipment that operates on a large amount of user permission data on non-random read and write storage, it improves the efficiency of authentication and access control management.

[0162] Furthermore, this invention achieves authentication security through PKI technology, providing tamper-proof, non-repudiable, and traceable authentication. User terminal permission certificates C are issued using certificate B2, instead of certificate A, significantly reducing the frequency of certificate A usage and effectively protecting the security of the top-level certificate A. Each access control device has an independent certificate B2, preventing users from using the permissions of one access control device to open another. By issuing digital certificates with extremely short validity periods, control over access control permission changes is achieved. Under relatively stable permission conditions, the validity of the B2 certificate can be set to one month; under frequent permission changes, the validity of the B2 certificate can be shortened to one week. When a large number of user permissions need to be revoked, a large revocation order is not required. The system includes a list of revocation certificates (C) for access control. Existing B2 certificates are revoked directly, and new B2 certificates are issued. Each access control device has an independent certificate (B). Before user authentication, the access control device needs to sign a random number R1 using the private key of certificate B. The user terminal verifies the access control device's identity by verifying this signature and certificate B before authentication, preventing malicious attacks by third-party devices impersonating access control devices. Access control permissions are revoked through a revocation list of certificates (C). A digest of certificate A is broadcast via a near-field communication protocol to discover access control devices. The user terminal uses certificate C and its private key to sign a random number and a time (T), effectively verifying the user's validity and the authenticity of the time. The security level for specific scenarios can be improved by increasing the certificate key length in the system. The cryptographic technologies used in this invention comply with national cryptographic standards and can apply for commercial cryptographic product qualifications. Furthermore, certificate issuance and management can be entirely based on a third-party CA or a Remote Access Registry (RA), independent of the application platform, thereby achieving security auditing of the application platform's access control information.

[0163] Reference Figure 3 This invention provides an access control management system based on PKI security authentication, comprising:

[0164] The communication connection establishment module is used to establish a near-field communication connection with the access control device through the user terminal and send a first random number to the access control device;

[0165] The first signature module is used to sign the first random number using the first device certificate and the first device private key through the access control device to obtain the first signature result, and return the first signature result, the second random number and the first timestamp to the user terminal.

[0166] The first verification module is used to verify the first signature result and the first timestamp through the user terminal. When the verification is successful, the first device certificate is obtained by parsing the first signature result, and the device identifier of the access control device is determined based on the first device certificate. Then, the corresponding first user certificate is determined based on the device identifier.

[0167] The second signature module is used to sign the second random number and the first timestamp through the user terminal using the first user certificate and the first user private key to obtain the second signature result, and send the second signature result and the second device certificate to the access control device.

[0168] The second verification module is used to verify the second signature result and the second device certificate through the access control device. When the verification is successful, the access control controller is invoked to open the access control.

[0169] The content of the above method embodiments is applicable to this system embodiment. The specific functions implemented in this system embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0170] Reference Figure 4 This invention provides an access control management device based on PKI security authentication, comprising:

[0171] At least one processor;

[0172] At least one memory for storing at least one program;

[0173] When the above-mentioned at least one program is executed by the above-mentioned at least one processor, the above-mentioned at least one processor implements the above-mentioned access control management method based on PKI security authentication.

[0174] The content of the above method embodiments is applicable to the device embodiments. The specific functions implemented by the device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0175] This invention also provides a computer-readable storage medium storing a processor-executable program, which, when executed by a processor, performs the aforementioned access control management method based on PKI security authentication.

[0176] This invention provides a computer-readable storage medium that can execute a PKI-based security authentication access control management method provided in the method embodiments of this invention. It can execute any combination of the implementation steps of the method embodiments and has the corresponding functions and beneficial effects of the method.

[0177] This invention also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, causing the computer device to perform... Figure 1 The method shown.

[0178] In some alternative embodiments, the functions / operations mentioned in the block diagrams may not occur in the order shown in the operation diagrams. For example, depending on the functions / operations involved, two consecutively shown blocks may actually be executed substantially simultaneously, or the aforementioned blocks may sometimes be executed in reverse order. Furthermore, the embodiments presented and described in the flowcharts of this invention are provided by way of example to provide a more comprehensive understanding of the technology. The disclosed methods are not limited to the operations and logic flows presented herein. Alternative embodiments are contemplated in which the order of various operations is changed and sub-operations described as part of a larger operation are executed independently.

[0179] Furthermore, although the invention has been described in the context of functional modules, it should be understood that, unless otherwise stated, one or more of the aforementioned functions and / or features may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the invention. Rather, given the properties, functions, and internal relationships of the various functional modules in the apparatus disclosed herein, the actual implementation of the module will be understood within the scope of conventional skill of an engineer. Therefore, those skilled in the art can implement the invention as set forth in the claims using ordinary techniques without excessive experimentation. It is also understood that the specific concepts disclosed are merely illustrative and not intended to limit the scope of the invention, which is determined by the full scope of the appended claims and their equivalents.

[0180] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0181] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0182] More specific examples of computer-readable media (a non-exhaustive list) include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which the aforementioned program can be printed, because the aforementioned program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or, if necessary, processing in other suitable ways, and then stored in computer memory.

[0183] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0184] In the foregoing description of this specification, references to terms such as "one embodiment," "another embodiment," or "some embodiments" indicate that a specific feature, structure, material, or characteristic described in connection with an embodiment or example is included in at least one embodiment or example of the present invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0185] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

[0186] The above is a detailed description of the preferred embodiments of the present invention. However, the present invention is not limited to the above embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention. All such equivalent modifications or substitutions are included within the scope defined by the claims of this application.

Claims

1. An access control management method based on PKI security authentication, characterized in that, Includes the following steps: A near-field communication connection is established between the user terminal and the access control device, and a first random number is sent to the access control device. The access control device uses the first device certificate and the first device private key to sign the first random number to obtain a first signature result, and then returns the first signature result, the second random number, and the first timestamp to the user terminal. The user terminal verifies the first signature result and the first timestamp. When the verification is successful, the first device certificate is obtained by parsing the first signature result, and the device identifier of the access control device is determined based on the first device certificate. Then, the corresponding first user certificate is determined based on the device identifier. The user terminal uses the first user certificate and the first user private key to sign the second random number and the first timestamp to obtain a second signature result, and then sends the second signature result and the second device certificate to the access control device. The access control device verifies the second signature result and the second device certificate. If the verification is successful, the access control controller is invoked to open the access control. Before establishing a near-field communication connection with the access control device via the user terminal and sending a first random number to the access control device, the method further includes: The access control device generates a first PKI public-private key pair, which includes a first device public key and a first device private key. Based on the first device public key, a first certificate request is generated and sent to the system platform. The system platform then uses the first platform certificate and the first platform private key to issue the first device certificate, the second device certificate, the second device private key, and the user certificate revocation list. Finally, the system platform returns the first device certificate, the second device certificate, and the user certificate revocation list to the access control device. A second PKI public-private key pair is generated through the user terminal. The second PKI public-private key pair includes a first user public key and a first user private key. A second certificate request is generated based on the first user public key and sent to the system platform. The system platform then uses the second device certificate and the second device private key to issue the first user certificate and returns the first platform certificate, the first user certificate, and the second device certificate to the user terminal.

2. The access control management method based on PKI security authentication according to claim 1, characterized in that, The access control management method also includes the following steps: The access control device uses the first device certificate and the first device private key to sign the second random number and the first timestamp to obtain a third signature result, and generates a fourth signature result based on the second signature result and the third signature result, and then sends the fourth signature result to the system platform; The system platform verifies the fourth signature result. When the verification is successful, the first device certificate, the first user certificate, and the first timestamp are obtained by parsing the fourth signature result. Then, an access control event record is generated based on the first device certificate, the first user certificate, and the first timestamp.

3. The access control management method based on PKI security authentication according to claim 1, characterized in that, The step of establishing a near-field communication connection with the access control device through the user terminal and sending a first random number to the access control device specifically includes: The access control device uses near-field communication to send first broadcast data, the first broadcast data including a digest of the first platform certificate; The user terminal scans the first broadcast data using near-field communication and establishes a near-field communication connection with the access control device based on the digest of the first platform certificate. The first random number is sent to the access control device through the user terminal.

4. The access control management method based on PKI security authentication according to claim 1, characterized in that, The step of verifying the first signature result and the first timestamp through the user terminal specifically includes: The user terminal verifies whether the first signature result is signed by the first device certificate. The user terminal verifies whether the first device certificate was issued by the first platform certificate. The user terminal verifies whether the time difference between the first timestamp and the current time is less than or equal to a preset first threshold. When the first signature result is the first device certificate signing, the first device certificate is the first platform certificate issuing, and the time difference between the first timestamp and the current time is less than or equal to the first threshold, the verification is confirmed to be successful.

5. The access control management method based on PKI security authentication according to claim 1, characterized in that, The step of verifying the second signature result and the second device certificate through the access control device specifically includes: The access control device verifies whether the second signature result is signed by the first user certificate. The access control device verifies whether the first user certificate is on the user certificate revocation list. The access control device verifies whether the first user certificate was issued by the second device certificate. The access control device verifies whether the certificate of the second device was issued by the certificate of the first platform. When the second signature result is signed by the first user certificate, and the first user certificate is not in the user certificate revocation list, the first user certificate is issued by the second device certificate, and the second device certificate is issued by the first platform certificate, the verification is confirmed to be successful.

6. The access control management method based on PKI security authentication according to claim 1, characterized in that, The access control management method also includes the following steps: When the number of certificates in the user certificate revocation list exceeds a preset second threshold, or the number of users whose access control permissions need to be revoked in this operation exceeds a preset third threshold, the system platform uses the first platform certificate and the first platform private key to update the second device certificate and the second device private key, and sends the updated second device certificate to the access control device and the user terminal.

7. An access control management system based on PKI security authentication, characterized in that, include: A communication connection establishment module is used to establish a near-field communication connection with the access control device through a user terminal and send a first random number to the access control device; The first signature module is used to sign the first random number using the access control device with the first device certificate and the first device private key to obtain a first signature result, and return the first signature result, the second random number and the first timestamp to the user terminal. The first verification module is used to verify the first signature result and the first timestamp through the user terminal. When the verification is successful, the first device certificate is obtained by parsing the first signature result, and the device identifier of the access control device is determined according to the first device certificate. Then, the corresponding first user certificate is determined according to the device identifier. The second signature module is used to sign the second random number and the first timestamp using the first user certificate and the first user private key through the user terminal to obtain a second signature result, and send the second signature result and the second device certificate to the access control device. The second verification module is used to verify the second signature result and the second device certificate through the access control device. When the verification is successful, the access control controller is invoked to open the access control. The first platform interaction module is used to generate a first PKI public-private key pair through the access control device. The first PKI public-private key pair includes a first device public key and a first device private key. The module generates a first certificate request based on the first device public key and sends it to the system platform. The system platform then uses the first platform certificate and the first platform private key to issue the first device certificate, the second device certificate, the second device private key, and the user certificate revocation list. Finally, the system platform returns the first device certificate, the second device certificate, and the user certificate revocation list to the access control device. The second platform interaction module is used to generate a second PKI public-private key pair through the user terminal. The second PKI public-private key pair includes a first user public key and a first user private key. The module generates a second certificate request based on the first user public key and sends it to the system platform, so that the system platform issues the first user certificate using the second device certificate and the second device private key, and returns the first platform certificate, the first user certificate, and the second device certificate to the user terminal.

8. An access control management device based on PKI security authentication, characterized in that, include: At least one processor; At least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements an access control management method based on PKI security authentication as described in any one of claims 1 to 6.

9. A computer-readable storage medium storing a processor-executable program, characterized in that, The processor-executable program, when executed by the processor, is used to perform an access control management method based on PKI security authentication as described in any one of claims 1 to 6.

Images