A container data center computer room

Abstract

The present invention discloses a container data center computer room, which belongs to the field of data center technology and solves the problem that once the pseudo-random number generation algorithm is used to crack, the security of the container data center computer room is reduced. It includes a data center server arranged in a container, and the data center server includes a user management module, an extraction generation module, a ciphertext generation module, a ciphertext authentication module and an identity authentication module; the user management module is used to feedback a consent instruction after receiving two access requests, and obtain access rights after two authentications; the extraction generation module is used to extract environmental feature data inside and outside the container to generate a password; the ciphertext generation module is used to issue a secondary access request, and form a key pair and a ciphertext respectively, and share the public key to encrypt the ciphertext; the ciphertext authentication module is used to store a private key and issue a primary authentication instruction after verifying the ciphertext. The present invention can increase the difficulty of generating and interpreting the verification password and enhance the security of generating the verification password.

Description

Technical Field

[0001] The present invention relates to the technical field of data centers, and in particular to a container data center computer room. Background Art

[0002] A containerized data center is a data center facility that integrates IT equipment such as servers, network equipment, storage equipment, etc. in one or more standard containers. The computer room of a containerized data center is usually made of steel containers, which are equipped with fully functional data center elements such as servers, storage systems, network equipment, power supplies, cooling systems, and monitoring and management systems.

[0003] In the prior art, if it is necessary to access the data in the containerized data center, the management system of the containerized data center will effectively control the access behavior by setting up a firewall and setting access control policies and user authentication regulations inside the firewall to prevent unauthorized access to the data, systems, networks, and resources in the containerized data center from being used or read.

[0004] In response to these remote unauthorized access behaviors, container-type data center rooms can be protected by monitoring, firewalls, etc., but unauthorized access behaviors include physical access attacks. Physical access attacks refer to the behavior of attackers directly entering and operating the physical space of the target system or device to obtain unauthorized access rights or sensitive information. Physical access attacks may lead to the theft, destruction or tampering of equipment, systems or confidential information. This type of attack is different from remote hacker attacks because it requires the attacker to directly contact the target device or system.

[0005] Specific physical access attack behaviors include 1. Lock damage or bypassing. Attackers may use technical means or tools to bypass physical locks or destroy physical protection measures to enter the system; 2. Stealing physical devices. Attackers may directly steal physical devices including computers, mobile devices, and storage media to obtain sensitive information stored on them; 3. USB attacks. Attackers may attack by inserting malicious USB devices into the target system, such as by implanting malware or obtaining confidential information; 4. Including peeking or spying. Attackers may obtain information by peeping at the screen or keyboard input while observing others entering sensitive information at work. However, no matter which one, the attacker needs to enter the container data center room and directly contact physical devices including computers, mobile devices, and storage media.

[0006] In the prior art, a container-type data center computer room includes a container with an entrance and exit, and a container door opened and closed by a password lock. In most cases, the password lock is mainly used to resist physical access attacks on the container-type data center computer room. The current password locks are basically independently set, and the password verification, fingerprint recognition and other actions are realized by the single-chip microcomputer of the password lock itself. The calculation of the single-chip microcomputer itself is relatively simple, and the password is usually directly stored in the memory connected to it. It is relatively simple for attackers with some professional capabilities to directly crack the password lock to enter the container-type data center computer room. Therefore, its security is relatively low.

[0007] Therefore, there is also a method of connecting the password lock to the server of the container data center computer room. When people need to physically access the container data center computer room, they need to initiate an access request, just like remote access, and verify the identification code of the user terminal device after the server responds to the access request. The verification password is generated through a pseudo-random number and provided to the visitor for input verification. This symmetric encryption method can ensure the security of the container data center computer room to a certain extent and the verification is rapid. For example, the offline control method and password lock system of the password lock with application number CN202310813222.4 are taken as an example. However, since the pseudo-random number is a value calculated by a deterministic algorithm, when the calculation conditions are met, the pseudo-random number can be reproduced and is not truly random. Therefore, once the pseudo-random number generation algorithm is cracked, the security of the container data center computer room will be completely lost.

[0008] In order to solve the above problems, there is an urgent need for a container-type data center computer room that can increase the difficulty of generating and deciphering verification passwords and enhance the security of generating verification passwords.

[0009] Therefore, a container data center room is proposed to solve or alleviate the above problems. Summary of the invention

[0010] The purpose of the present invention is to solve the shortcomings existing in the prior art, and a container data center computer room is proposed. In order to improve the security level of the container data center computer room and increase the difficulty for potential attackers to decipher verification passwords, passwords are generated by extracting environmental features combined with pseudo-random numbers, and multi-dimensional security measures are taken to independently separate each module to enhance the overall security of the verification password generation mechanism, thereby effectively preventing unauthorized access and other potential security threats.

[0011] In order to achieve the above object, the present invention adopts the following technical solutions:

[0012] A container data center computer room, comprising a data center server arranged in a container, wherein the data center server comprises a user management module, an extraction generation module, a ciphertext generation module, a ciphertext authentication module and an identity authentication module;

[0013] The user management module is used to respond to consent instructions after receiving two access requests and obtain access rights after two authentications;

[0014] The extraction and generation module is used to extract environmental feature data inside and outside the container to generate a password;

[0015] The ciphertext generation module is used to issue a secondary access request and form a key pair and ciphertext respectively, and share the public key to encrypt the ciphertext;

[0016] The ciphertext authentication module is used to store the private key and issue a first-level authentication instruction after verifying the ciphertext;

[0017] The identity authentication module is used to store identity information and form a secondary authentication instruction after identity authentication.

[0018] Preferably, the ciphertext generation module includes a mobile terminal and a virtual terminal, the mobile terminal is used to temporarily connect to the virtual terminal and the extraction generation module, and the virtual terminal is used to temporarily connect to the mobile terminal and then transfer the private key and password to the ciphertext authentication module.

[0019] Preferably, the issuing of the secondary access request, forming a key pair and a ciphertext respectively, and sharing the public key to encrypt the ciphertext comprises the following steps:

[0020] Responding to the secondary access request triggered by the mobile terminal and receiving a consent instruction;

[0021] Form a key pair and ciphertext respectively, and share the public key to encrypt the ciphertext;

[0022] Pass the private key and password to the ciphertext authentication module.

[0023] Preferably, the temporarily connecting the virtual end and the extraction generation module comprises the following steps:

[0024] Sending a secondary access request to the user management module;

[0025] If the user management module receives two access requests, it will feedback an approval instruction, and after receiving the feedback approval instruction, it will communicate and connect with the virtual end and the extraction generation module. If the user management module does not receive two access requests, it will not connect;

[0026] Receive the password from the extraction generation module and pass it to the virtual end;

[0027] Receive the public key from the virtual end;

[0028] The password and public key are combined to obtain the ciphertext, and after sharing, the connection with the virtual end and the extraction generation module is disconnected.

[0029] Preferably, the step of transferring the private key and password to the ciphertext authentication module after temporarily connecting to the mobile terminal comprises the following steps:

[0030] Receive mobile terminal signals and connect with them;

[0031] Regenerate the key pair and transfer the public key to the mobile terminal;

[0032] After receiving the password transmitted from the mobile terminal, disconnecting from the mobile terminal;

[0033] Pass the password and private key to the ciphertext authentication module.

[0034] Preferably, extracting environmental characteristic data inside and outside the container to generate a password comprises the following steps:

[0035] Real-time collection of temperature data at multiple locations inside the container and air humidity data outside the container;

[0036] Feature extraction is performed based on temperature data and air humidity data to obtain temperature feature vector and temperature feature vector and encode them respectively;

[0037] The code is used as a seed for pseudo-random number generation to generate a pseudo-random number sequence as a password.

[0038] Preferably, the storing of the private key and issuing of a first-level authentication instruction after verifying the ciphertext comprises the following steps:

[0039] One-time storage of private keys and passwords;

[0040] Receive the input ciphertext;

[0041] The ciphertext is parsed by the one-time stored private key and compared with the one-time stored password. If they are the same, a first-level authentication instruction is issued, and then the one-time stored private key and password are deleted. If they are not the same, the one-time stored private key and password are directly deleted.

[0042] Preferably, the storing of identity information and performing identity authentication to form a secondary authentication instruction comprises the following steps:

[0043] Enter real-time identity information;

[0044] Identify the real-time identity information and the stored identity information, and generate an identification result;

[0045] Generate secondary authentication instructions and identity authentication certificates based on the identification results;

[0046] Pass the secondary authentication instruction and identity authentication certificate to the user management module.

[0047] Preferably, the step of feeding back a consent instruction after accepting two access requests comprises the following steps:

[0048] Receive and record Level 1 access requests;

[0049] Receive and record Level 2 access requests;

[0050] After recording and comparing the two access requests, a consent instruction is fed back to the ciphertext generation module.

[0051] Preferably, obtaining access rights after two authentications includes the following steps:

[0052] Receive and record first-level authentication instructions;

[0053] Receive and record secondary authentication instructions;

[0054] Receive and record proof of identity authentication;

[0055] Receive a unique authentication identifier in the identity authentication certificate;

[0056] Receive the authentication certificate in the identity authentication certificate;

[0057] Record and compare the two authentication instructions as mark one;

[0058] Record and compare the unique certification mark and the certification certificate as the second mark;

[0059] After accumulating Mark 1 and Mark 2, you will get access rights.

[0060] The present invention has the following beneficial effects:

[0061] The present invention strengthens the security of the data center computer room through two-factor authentication combined with physical and mobile access control. Visitors must verify their identity in front of the password lock and use a mobile device to initiate a request to obtain a one-time password generated based on the environmental feature vector. The public key of the key pair is used to encrypt the password for public sharing, and the private key is stored in the ciphertext authentication module for unlocking, ensuring that only authorized personnel can obtain access rights, thereby improving the physical and network security of the data center. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 It is a structural schematic diagram of the present invention;

[0063] Figure 2 It is a structural block diagram of the data center server in the present invention;

[0064] Figure 3 It is a schematic diagram of the structure of the password lock and the lock core slot in the present invention;

[0065] Figure 4 It is a structural schematic diagram of the damping mechanism in the present invention;

[0066] Figure 5 is a cross-sectional view of the damping mechanism of the present invention;

[0067] Figure 6 for Figure 5 The enlarged view of point A in the middle;

[0068] Figure 7 for Figure 5 The enlarged view of point B in the middle;

[0069] Figure 8 It is a schematic diagram of the structure of the damping member in the present invention;

[0070] Fig. 9 It is a schematic diagram of the structure of the damping blade, the sealing shell and the connecting shaft in the present invention;

[0071] Fig.10 It is a schematic diagram of the structure of the roller in the present invention.

[0072] 1. Container; 2. Container door; 3. Password lock; 4. Data center server; 5. User management module; 6. Ciphertext generation module; 61. Mobile terminal; 62. Virtual terminal; 7. Extraction generation module; 8. Ciphertext authentication module; 9. Identity authentication module; 10. Lock core; 11. Pressure plate; 12. Through hole; 13. Inner reinforcement rib; 14. Middle reinforcement rib; 15. Outer reinforcement rib; 16. Horizontal groove; 17. Threaded column; 18. Threaded hole; 19. Connecting shaft; 20. Sealing cover; 21. Sealing shell; 22. Slider; 23. Rotating shaft; 24. Damping blade; 25. Hub; 26. Perforation; 27. Elastic friction layer; 28. Vertical groove. DETAILED DESCRIPTION

[0073] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.

[0074] Embodiment 1:

[0075] A container 1 data center room, such as Figure 2 As shown, the method for accessing the computer room of the container 1 data center includes the following steps:

[0076] S1, triggering a first-level access request through the password lock 3. The actual operation method is as follows: the visitor directly touches the input interface of the password lock 3, the input interface inputs to the microprocessor, the microprocessor triggers a signal, and sends a first-level access request through the communication port;

[0077] S2, triggering a secondary access request via the mobile terminal 61;

[0078] S3, the user management module 5 receives two access requests, namely the primary access request and the secondary access request, and then feeds back an approval instruction;

[0079] S4, the extraction and generation module 7 extracts the environmental feature data inside and outside the container 1 to generate a password;

[0080] S5, the mobile terminal 61 temporarily connects to the virtual terminal 62 and the extraction generation module 7, the virtual terminal 62 forms a key pair, and after temporarily connecting to the mobile terminal 61, transmits the private key and password to the ciphertext authentication module 8;

[0081] S6, the ciphertext authentication module 8 stores the private key and verifies the ciphertext and then issues a first-level authentication instruction;

[0082] S7, the identity authentication module 9 stores the identity information and performs identity authentication to form a secondary authentication instruction;

[0083] S8, the user management module 5 obtains access rights after two authentications.

[0084] In the actual operation, S2 issues a secondary access request, forms a key pair and ciphertext respectively, and shares the public key to encrypt the ciphertext, including the following steps:

[0085] Responding to the secondary access request triggered by the mobile terminal 61 and receiving a consent instruction;

[0086] Form a key pair and ciphertext respectively, and share the public key to encrypt the ciphertext;

[0087] Send the private key and password to the ciphertext authentication module 8.

[0088] In the actual operation process, the S3 user management module 5 receives two access requests, namely the primary access request and the secondary access request, and then feeds back an approval instruction, including the following steps:

[0089] Receive and record Level 1 access requests;

[0090] Receive and record Level 2 access requests;

[0091] After recording and comparing the two access requests, an approval instruction is fed back to the ciphertext generation module 6.

[0092] In the actual operation process, S4 extraction generation module 7 extracts the environmental characteristic data inside and outside the container 1 to generate a password, including the following steps:

[0093] Real-time collection of temperature data at multiple locations inside the container 1 and air humidity data outside the container 1;

[0094] Feature extraction is performed based on temperature data and air humidity data to obtain temperature feature vector and temperature feature vector and encode them respectively;

[0095] The code is used as a seed for pseudo-random number generation to generate a pseudo-random number sequence as a password.

[0096] In the actual operation process, S5 mobile terminal 61 temporarily connects virtual terminal 62 and extraction generation module 7, virtual terminal 62 forms a key pair, and after temporarily connecting to mobile terminal 61, transmits the private key and password to ciphertext authentication module 8, including the following steps:

[0097] Sending a secondary access request to the user management module 5;

[0098] If the user management module 5 receives two access requests, it will feedback an approval instruction, and after receiving the feedback approval instruction, it will communicate and connect with the virtual terminal 62 and the extraction generation module 7. If the user management module 5 does not receive two access requests, it will not connect;

[0099] Receive the password from the extraction generation module 7 and pass it to the virtual terminal 62;

[0100] receiving a public key from the virtual terminal 62;

[0101] The password and the public key are combined to obtain the ciphertext, and after sharing, the connection with the virtual terminal 62 and the extraction generation module 7 is disconnected;

[0102] Receive the signal from the mobile terminal 61 and connect with it;

[0103] Regenerate a key pair and transfer the public key to the mobile terminal 61;

[0104] After receiving the password transmitted from the mobile terminal 61, disconnecting from the mobile terminal 61;

[0105] Pass the password and private key to the ciphertext authentication module 8.

[0106] In the actual operation process, S6 ciphertext authentication module 8 stores the private key and verifies the ciphertext and then issues a first-level authentication instruction, including the following steps:

[0107] One-time storage of private keys and passwords;

[0108] Receive the input ciphertext;

[0109] The ciphertext is parsed by the one-time stored private key and compared with the one-time stored password. If they are the same, a first-level authentication instruction is issued, and then the one-time stored private key and password are deleted. If they are not the same, the one-time stored private key and password are directly deleted.

[0110] In the actual operation process, the S7 identity authentication module 9 stores the identity information and forms a secondary authentication instruction after identity authentication, including the following steps:

[0111] Enter real-time identity information;

[0112] Identify the real-time identity information and the stored identity information, and generate an identification result;

[0113] Generate secondary authentication instructions and identity authentication certificates based on the identification results;

[0114] The secondary authentication instruction and the identity authentication certificate are transmitted to the user management module 5.

[0115] In the actual operation process, the S8 user management module 5 obtains access rights after two authentications, including the following steps:

[0116] Receive and record first-level authentication instructions;

[0117] Receive and record secondary authentication instructions;

[0118] Receive and record proof of identity authentication;

[0119] Receive a unique authentication identifier in the identity authentication certificate;

[0120] Receive the authentication certificate in the identity authentication certificate;

[0121] Record and compare the two authentication instructions as mark one;

[0122] Record and compare the unique certification mark and the certification certificate as the second mark;

[0123] After accumulating Mark 1 and Mark 2, you will get access rights.

[0124] When physical access is required, the present invention first needs to initiate a first-level access request to the user management module 5 through the password lock 3, and then initiate a second-level access request to the user management module 5 through the mobile terminal 61. In order to ensure the security of the visitor when performing the access operation, a more stringent access control measure is set. This not only requires the presence of a visitor at the entrance with the password lock 3 to perform the necessary identity authentication, but also requires the visitor to carry a designated mobile terminal 61. The use of the mobile terminal 61 brings additional protection for the access security of the data center computer room, which significantly improves the security requirements, and also acts as a part of the two-factor authentication, greatly improving the security. This rigorous approach can effectively avoid those criminals who attempt to attack or crack the data center computer room, and block the possibility of easily achieving the purpose of destruction.In addition, the present invention organically combines the control strategies of physical access and remote access, so as to ensure that the security factor is correspondingly improved in any access mode. Specifically, when the visitor reaches the password lock 3 and attempts physical access, in addition to verifying his identity, the paired mobile terminal 61 will also be used to verify whether the visitor has the ability to initiate an access request. This practice strengthens protection and brings security to a new level. Ensuring the security of access is to ensure that the protection of the data center computer room is not breached, thereby protecting core assets such as data and information from any form of threat. Through these comprehensive security measures, the protection capability of the data center computer room is continuously enhanced. After receiving and recording two access requests, the user management module 5 feeds back a consent instruction to the mobile terminal 61. After the mobile terminal 61 responds to the consent instruction, it temporarily connects the virtual terminal 62 and the extraction generation module 7, obtains the environmental feature vector obtained by the extraction generation module 7 after extracting the internal and external environment of the container 1 to combine with the password generated by the pseudo-random number, and the virtual terminal 62 will run to generate a key pair separately. The public key in the key pair will be passed to the mobile terminal 61, and the private key in the key pair will be passed to the ciphertext authentication module 8. The password will be combined with the public key at the mobile terminal 61 to form a ciphertext and be shared publicly. At the same time, the password will be transmitted to the virtual terminal 62 through the mobile terminal 61, and the password will be transmitted to the ciphertext authentication module 8 through the virtual terminal 62. At the same time, the private key in the key pair is transmitted to the ciphertext authentication module 8 for storage. This series of measures ensures that when a visitor attempts to enter the data center room, the password obtained by the visitor is a unique credential. This is because the password is generated after the mobile terminal 61 they carry is briefly connected to the extraction generation module 7, and the extraction generation module 7 uses a series of environmental features for collection to extract the factors required for password generation, ensuring the high randomness and uniqueness of the password, so that attempts to copy or crack it will be extremely difficult. At the same time, the mobile terminal 61 undertakes the important task of connecting the extraction generation module 7 and the virtual terminal 62, which not only improves the overall security connectivity of the data center room, but also puts forward clear physical carrying requirements for visitors: if the mobile terminal 61 is not carried, the visitor cannot successfully obtain the password generated by the extraction generation module 7, and cannot effectively transmit the password to the virtual terminal 62 for correctness verification.Such a security verification mechanism design further strengthens the access threshold of the data center room, ensuring that only authorized personnel who have been strictly reviewed and authenticated can enter, and preventing unauthorized personnel from physically approaching the password lock 3. However, due to the lack of key mobile terminal 61 connection, they are unable to unlock the password lock 3, thereby successfully preventing their intrusion. This strategy greatly reduces the possibility of unauthorized access, effectively ensures the security of the data center room, strengthens the protection measures, and greatly improves the safety factor of visitors. By continuously iterating and optimizing these connections and security verification procedures, the data center room becomes a real security fortress. In the actual process of physical access, the visitor only needs to manually input the ciphertext through the password lock 3, so that the ciphertext is transmitted to the ciphertext authentication module 8 through the password lock 3. After receiving the ciphertext, the ciphertext authentication module 8 unlocks it through the private key stored inside. After unlocking, the ciphertext authentication module 8 will issue a first-level authentication instruction, and then the visitor will enter his own identity information to verify his identity. If it meets the requirements, a second-level authentication instruction can be generated, and an identity authentication certificate will also be generated to give to the user management module 5, so that the user management module 5 can grant its access rights according to the corresponding identity authentication certificate. When a visitor visits the computer room of the container 1 data center, he or she can perform multiple verifications before obtaining access rights. In the process of ensuring the security of the computer room of the container 1 data center, the mobile terminal 61 plays a vital role. It not only realizes the real-time connection between the visitor and the computer room of the data center, but also becomes an important medium in this way. It greatly improves the access standards for entering the computer room of the container 1 data center. With the intervention of the mobile terminal 61 and its interaction with the computer room of the data center, the security of the entire access process is greatly enhanced, so that it becomes extremely difficult for unauthorized visitors to crack the access rights through technical means. In addition, the existence of the mobile terminal 61 ensures the integrity and confidentiality of the internal information data of the computer room of the container 1 data center, and prevents potential information leakage risks. Any access attempt that has not been strictly verified will be directly rejected due to the lack of effective authentication of the mobile terminal 61, which greatly reduces the possibility of internal data being stolen or tampered with. Through these measures, not only the threshold of physical access is strengthened, but also a strong network security defense line is provided for the computer room of the container 1 data center, which fundamentally curbs unsafe factors, ensures the safe operation of the data center, and provides more stringent protection for maintaining user data.

[0125] Embodiment 2:

[0126] A container 1 data center room, such as Figure 1 and 3As shown, it includes a container 1, a door 2 hinged at the opening of the container 1, a password lock 3 and a lock core 10 slot arranged on the door 2 for controlling the opening and closing thereof, the password lock 3 includes an electronic lock body, an input interface for a keyboard, a display, a microprocessor, a card reader, and a communication interface, the communication interface provides a remote connection function, such as Bluetooth, ZigBee, etc., the card reader is used to read biometric information such as smart cards, fingerprints, irises, faces, etc., and the electronic lock body is coupled to the microprocessor.

[0127] A groove is provided on the container 1 for the lock cylinder 10 slot body to be embedded, and the lock cylinder 10 slot body is detachably connected therein. There is a slot in the lock cylinder 10 slot body, and the slot is divided into an entrance section and a limit section by a shrinking assembly. The inner peripheral wall of the slot is provided with a plurality of slide grooves along its radial direction. The shrinking assembly includes an insert block slidably connected in the slide groove, and a spring is fixedly connected between the insert block and the bottom of the slide groove. A guide slope arranged toward the entrance section is provided at one end of the insert block away from the spring, and when the spring is in a natural state, the insert block extends out of the slide groove. A damping mechanism is slidably connected between the entrance end and the limit section, and an insert groove cooperating with the insert block is provided on the outer peripheral wall of the damping mechanism. The limit section is used to accommodate the damping mechanism, and when the damping mechanism is filled in the limit section, the damping mechanism blocks the insert block from leaving the slide groove. The inner wall of the entrance section is fixedly connected to the limit block, and the limit block blocks the displacement process of the damping mechanism.

[0128] like Figure 4-7 As shown, the damping mechanism includes a pressure plate 11 with a through hole 12, and a damping component arranged on the inner wall of the through hole 12. The through hole 12 is for the lock core 10 of the electronic lock body to pass through. The inner wall of the through hole 12 is provided with a vertical groove 28 that penetrates vertically. The two side walls of the vertical groove 28 are provided with horizontal grooves 16 in the horizontal direction. The damping component includes a slider 22 slidably connected between the horizontal grooves 16 on both sides, a damping member fixedly connected between the sliders 22 on both sides, and a roller rotatably arranged by the damping member. The slider 22 is positioned at any position of the horizontal groove 16. Threaded holes 18 are provided at both ends of the horizontal groove 16. Threaded columns 17 are threadedly connected to the threaded holes 18, and the slider 22 is located between the threaded columns 17 on both sides.

[0129] like Figure 8 and 9 As shown, the damping member includes a sealing shell 21 fixedly connected to a slider 22, a sealing cover 20 sealed and rotatably connected to the sealing shell 21, a rotating shaft 23 coaxially fixedly connected to the sealing cover 20 and located in the sealing shell 21, and a damping leaf 24 fixedly connected to the outer peripheral wall of the rotating shaft 23 and fitted to the inner peripheral wall of the sealing shell 21. The length of the damping leaf 24 is less than the length of the rotating shaft 23. Damping fluid is filled between the sealing shell 21 and the sealing sleeve, and a connecting shaft 19 is fixedly connected between the sealing covers 20 on both sides. The roller is eccentrically fixedly connected to the connecting shaft 19, and the outer ring of the roller is elastic along its radial direction.

[0130] At the same time, the outer circle of the top surface of the pressure plate 11 is fixedly connected to a circle of outer reinforcing ribs 15, the top surface of the pressure plate 11 is fixedly connected to inner reinforcing ribs 13 arranged around the through hole 12, and the top surface of the pressure plate 11 is also fixedly connected to a plurality of middle reinforcing ribs 14 fixedly connected to the inner reinforcing ribs 13 and the outer reinforcing ribs 15.

[0131] like Fig.10 As shown, the distances from the central axis of the connecting shaft 19 to the edge of its cross section are different, and the roller includes a hub 25 and an elastic friction layer 27 fixedly connected to its outer ring. A through hole 26 is eccentrically opened on the hub 25, and the connecting shaft 19 is set through the through hole 26.

[0132] When the combination lock 3 is closing the door 2, the microprocessor in the combination lock 3 will control the lock core 10 of the electronic lock body to extend into the lock core 10 slot. The lock core 10 first passes through the limit block and then contacts the pressure plate 11. At this time, the lock core 10 will pass through the through hole 12 and contact the damping member therein. Since the damping member will prevent the lock core 10 from passing through the through hole 12, under the current situation, the lock core 10 will push the pressure plate 11 to move together until the lock core 10 pushes the pressure plate 11 into the limit section. When the pressure plate 11 passes through the shrinking component, under the guiding action of the guide ramp, the pressure plate 11 exerts a squeezing force on the embedded block along the direction of the slide groove, so that the embedded block is immersed in the slide groove, compressing the spring, and when the pressure plate 11 is completely filled in the limit section, the pressure plate 11 can no longer move further.

[0133] At this time, the elastic friction layer 27 ensures that the outer ring of the roller is in full contact with the lock core 10, and there is a large friction force between the two. When the lock core 10 moves, the lock core 10 can have rolling friction with the outer peripheral wall of the roller, so that the roller drives the connecting shaft 19 to rotate.

[0134] When one group of rollers is separated from the outer peripheral wall of the lock core 10, another group of rollers can be in contact with the lock core 10, so that the lock core 10 can always be kept in contact with the rollers, and during the displacement process, the connecting shaft 19 rotates, and the connecting shaft 19 drives the sealing cover 20 to rotate, and the sealing cover 20 drives the rotating shaft 23, and the damping leaf 24 is driven by the rotating shaft 23 to rotate in the sealing shell 21 filled with damping fluid. However, during this rotation process, the damping leaf 24 is damped by the damping fluid, so that the rotation of the connecting shaft 19 is more difficult, and there will be a large hindering force, thereby causing rolling resistance between the rollers and the lock core 10 to hinder the lock core 10, and the lock core 10 will also resist this force when displacing, so that the reaction force acts on the pressure plate 11 through the damping structure, so that the pressure plate 11 can conflict with the bottom of the groove of the limiting section, and exert a reaction force until the lock core 10 is completely embedded in the through hole 12.

[0135] Then, the lock core 10 is displaced in the reverse direction for a certain distance under the control of the electronic lock body, so that the embedded groove can correspond to the slide groove, and the embedded block in the slide groove can be ejected from the slide groove under the action of the spring and embedded in the embedded groove, so that when the combination lock 3 is connected to the lock core 10 groove body, it can not only hinder the rotation of the box door 2 in the reverse direction, but also hinder the reverse withdrawal direction of the lock core 10. If the electronic lock body cannot control the lock core 10 to leave the lock core 10 groove body in a correct way, unlocking will not be achieved.

[0136] And when people need to adjust the position of the roller according to the size of the lock core 10, they only need to rotate the threaded column 17 and adjust the positions of the two threaded columns 17 in the threaded holes 18 to adjust the position of the slider 22 in the horizontal groove 16, so that the slider 22 drives the position of the damping member to be adjusted, and then adjusts the position of the roller.

[0137] In addition, if Figure 1 As shown, the data center computer room of the container 1 also includes a data center server 4 arranged in the container 1, and the data center server 4 includes a user management module 5, an extraction generation module 7, a ciphertext generation module 6, a ciphertext authentication module 8 and an identity authentication module 9;

[0138] The user management module 5 is used to respond with a consent instruction after receiving two access requests and obtain access rights after two authentications;

[0139] The extraction and generation module 7 is used to extract environmental feature data inside and outside the container 1 to generate a password;

[0140] The ciphertext generation module 6 is used to issue a secondary access request and form a key pair and ciphertext respectively, and encrypt the ciphertext with a shared public key;

[0141] The ciphertext generation module 6 includes a mobile terminal 61 and a virtual terminal 62. The mobile terminal 61 is used to temporarily connect the virtual terminal 62 and the extraction generation module 7. The virtual terminal 62 is used to temporarily connect to the mobile terminal 61 and then transfer the private key and password to the ciphertext authentication module 8. The mobile terminal 61 can be an app installed in a mobile phone or a device similar to a mobile phone but unable to connect to mobile data. The device includes a housing, a display fixedly connected to the housing, a processor located in the housing and connected to the display, and a communication terminal located in the housing and connected to the processor, such as Bluetooth, ZigBee, etc.

[0142] The ciphertext authentication module 8 is used to store the private key and issue a first-level authentication instruction after verifying the ciphertext;

[0143] The identity authentication module 9 is used to store identity information and form a secondary authentication instruction after performing identity authentication.

[0144] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0145] The present invention is described with reference to the flowcharts and / or block diagrams of the method, terminal device (system), and computer program product according to the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0146] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0147] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0148] In addition, it should be noted that the shapes and names of the parts and components of the specific embodiments described in this specification may be different. Any equivalent or simple changes made based on the structure, features and principles described in the patent concept of the present invention are included in the protection scope of the patent of the present invention. The technicians in the technical field of the present invention can make various modifications or supplements to the specific embodiments described or replace them in a similar manner, as long as they do not deviate from the structure of the present invention or exceed the scope defined by the claims, they should all fall within the protection scope of the present invention.

[0149] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A container data center room, characterized in that: It comprises a data center server (4) arranged in a container (1), the data center server (4) comprising a password lock (3), a user management module (5), an extraction generation module (7), a ciphertext generation module (6), a ciphertext authentication module (8) and an identity authentication module (9); A password lock (3) triggers a first-level access request through the password lock (3), and the visitor directly contacts the input interface of the password lock (3), and the input interface inputs to the microprocessor, and the microprocessor triggers a signal, and issues a first-level access request through the communication port; the ciphertext generation module (6) is used to issue a second-level access request, and respectively form a key pair and a ciphertext, and share the public key to encrypt the ciphertext; the user management module (5) is used to receive the first-level access request and the second-level access request and then feedback the consent instruction, and obtain the access right after two authentications; the ciphertext authentication module (8) is used to store the private key and issue the first-level authentication instruction after verifying the ciphertext; the identity authentication module (9) is used to store the identity information and form the second-level authentication instruction after identity authentication; the extraction generation module (7) is used to extract the environmental feature data inside and outside the container to generate a password; The method of extracting environmental characteristic data inside and outside the container to generate a password comprises the following steps: collecting temperature data at multiple locations inside the container (1) and air humidity data outside the container (1) in real time; extracting characteristics based on the temperature data and air humidity data to obtain a temperature characteristic vector and a humidity characteristic vector and encoding them respectively; using the codes as seeds for pseudo-random number generation to generate a pseudo-random number sequence as a password; The ciphertext generation module (6) comprises a mobile terminal (61) and a virtual terminal (62), wherein the mobile terminal (61) is used to temporarily connect to the virtual terminal (62) and the extraction generation module (7), and the virtual terminal (62) is used to temporarily connect to the mobile terminal (61) and then transmit the private key and password to the ciphertext authentication module (8); The temporary connection between the virtual terminal (62) and the extraction generation module (7) comprises the following steps: sending a secondary access request to the user management module (5); if the user management module (5) receives two access requests, it will feedback an approval instruction, and after receiving the feedback approval instruction, it will communicate with the virtual terminal (62) and the extraction generation module (7); if the user management module (5) does not receive two access requests, it will not connect; receive a password from the extraction generation module (7) and pass it to the virtual terminal (62); receive a public key from the virtual terminal (62); combine the password and the public key to obtain a ciphertext, and disconnect the connection with the virtual terminal (62) and the extraction generation module (7) after sharing; The issuing of the secondary access request, and forming a key pair and a ciphertext respectively, and sharing the public key encrypted ciphertext, comprises the following steps: responding to the secondary access request triggered by the mobile terminal (61), and receiving a consent instruction; forming a key pair and a ciphertext respectively, and sharing the public key encrypted ciphertext with the visitor on the mobile terminal; and transmitting the private key and the password to the ciphertext authentication module (8); The method of temporarily connecting to the mobile terminal (61) and then transferring the private key and the password to the ciphertext authentication module (8) comprises the following steps: receiving a signal from the mobile terminal (61) and connecting to it; regenerating a key pair and transferring the public key to the mobile terminal (61); disconnecting from the mobile terminal (61) after receiving the password transferred from the mobile terminal (61); and transferring the password and the private key to the ciphertext authentication module (8).

2. A container data center computer room according to claim 1, characterized in that: The step of storing the private key and verifying the ciphertext and issuing a first-level authentication instruction comprises the following steps: One-time storage of private keys and passwords; Receiving the ciphertext entered by the visitor through the password lock (3); The ciphertext is parsed by the one-time stored private key and compared with the one-time stored password. If they are the same, a first-level authentication instruction is issued, and then the one-time stored private key and password are deleted. If they are not the same, the one-time stored private key and password are directly deleted.

3. The container data center computer room according to claim 1, characterized in that: The storing of identity information and performing identity authentication to form a secondary authentication instruction includes the following steps: Enter real-time identity information; Identify the real-time identity information and the stored identity information, and generate an identification result; Generate secondary authentication instructions and identity authentication certificates based on the identification results; The secondary authentication instruction and the identity authentication certificate are transmitted to the user management module (5).

4. The container data center computer room according to claim 1, characterized in that: The step of receiving the primary access request and the secondary access request and then feeding back the consent instruction comprises the following steps: Receive and record Level 1 access requests; Receive and record Level 2 access requests; After recording and comparing the two access requests, a consent instruction is fed back to the ciphertext generation module (6).

5. The container data center computer room according to claim 1, characterized in that: Obtaining access rights after two authentications includes the following steps: Receive and record first-level authentication instructions; Receive and record secondary authentication instructions; Receive and record proof of identity authentication; Receive a unique authentication identifier in the identity authentication certificate; Receive the authentication certificate in the identity authentication certificate; Record and compare the two authentication instructions as mark one; Record and compare the unique certification mark and the certification certificate as the second mark; After accumulating Mark 1 and Mark 2, you will get access rights.

Images