Electronic lock device and encryption and authentication method thereof

Abstract

The invention relates to an electronic lock device and an encryption and authentication method thereof. The electronic lock device generates a random number as a first secret key when a user purchases a lock cylinder; the current time obtained by the atomic clock timing system is used as a dynamic parameter to generate a lock cylinder public and private key and a super manager public and private key, and the super manager authorizes to generate a public and private key of an authorized user; performing mathematical operation on the public key of any super administrator, the public key of the authorized user and the physical characteristic data of the corresponding authorized user to obtain password characteristic data and physical characteristic data, and calculating hash values respectively; and encrypting and storing the password feature data and the hash value thereof, and the physical feature data and the hash value thereof by using a first key, calculating the hash value of the encrypted array, encrypting the hash value by using the first key, and storing the encrypted hash value. According to all nodes of an application scene of the integrated electronic lock, the safety of each link controlled by the lock cylinder is ensured, and the application of electronic lock cylinder control and unlocking with a high safety level is realized.

Description

Technical Field

[0001] The invention belongs to the technical field of information security, and in particular relates to an electronic lock device and an encryption and authentication method thereof. Background Art

[0002] Traditional door lock cylinders or smart lock cylinders have one thing in common: they use mechanical keys to increase the strength of the lock cylinder by increasing the number of pins inside the lock cylinder. The current designs of A, B, and C lock cylinders on the market still cannot avoid the possibility of successful unlocking by experts.

[0003] With the development of electronic information technology, smart locks that unlock through IC card recognition have emerged. These smart locks do not have traditional mechanical lock cores. Although they also increase the use of keys, IC cards are easily illegally read and copied by card readers, and can be illegally authorized to unlock by counterfeiters, so their security is poor. There are also smart locks that use face and fingerprint image features to determine whether the lock can be unlocked. Although such smart locks greatly increase convenience during use, they also increase security risks, such as faces can be synthesized through AI, fingerprints can be extracted, key passwords can be combined and guessed, and feature recognition errors can occur.

[0004] There are more or less methods of using cryptographic technology to implement application scenarios in various public documents. However, these methods only describe the functions of data encryption and data signature anti-tampering, and do not provide specific methods for implementing secure, reliable, and data-free cryptographic technology in the important links of the entire data life cycle of product applications. The application of cryptographic technology is a comprehensive solution, which means that cryptographic technology must be used and applied scientifically. The impreciseness of a cryptographic technology solution will lead to the leakage of core data or keys due to vulnerabilities in the solution. Summary of the invention

[0005] A first object of the present invention is to provide an encryption method for an electronic lock device.

[0006] To achieve the above object, the present invention adopts the following technical solution:

[0007] An encryption method for an electronic lock device, the electronic lock device comprising an electronic lock core and a smart password key paired therewith, the smart password key having a security chip therein, the electronic lock core having a security chip and a processing chip therein, the encryption method comprising:

[0008] When a user purchases a lock core, a random number generator is used to generate a random number as a first key;

[0009] Using the buyer's identity information as the fixed first parameter, the current time obtained from the atomic clock timing system as the dynamic second parameter, and the seller's information as the fixed third parameter, the key management system device is used to generate the lock core public and private keys and m pairs of super administrator public and private keys, which are written into the lock core and the smart password keys of the m super administrators respectively; the super administrator authorizes n pairs of authorized users' public and private keys to be generated and written into the smart password keys of the n authorized users respectively; the lock core public key and the public keys of the m+n smart password keys are encrypted with the first key and stored in the security chip of the lock core;

[0010] Use the public key of any super administrator to perform mathematical operations with the public key of the authorized user and the physical feature data of the corresponding authorized user, obtain the password feature data and the physical feature data, and calculate the hash values ​​respectively; encrypt the password feature data and its hash value, the physical feature data and its hash value respectively using the first key, and obtain the array { }、{ } and store it in the security chip of the lock cylinder; }、{ }Calculate the hash value and get the hash array { },Will{ }The first key is used to encrypt and store the public key in the lock core's security chip; when the product is put into use, the public key of the lock core is encrypted with the public key of the authorized user and transmitted to the security chip of the smart password key corresponding to the authorized user.

[0011] As a preferred implementation, the security chip has a readable and writable common storage area, and a non-readable private storage area and a secure storage area. The common storage area stores public key data, the private storage area stores a first key, and other data is stored in the secure storage area.

[0012] As a preferred implementation, the electronic lock device pre-installs the manufacturer's public and private key pair in the lock core and the security chip of the smart password key before leaving the factory. After the user purchases the electronic lock device, the public and private key pair of the super administrator and the authorized user is used to replace the preset manufacturer's public and private key pair;

[0013] Preferably, the manufacturer's public-private key pair is generated based on the manufacturer's information, and the manufacturer's information-related parameters are used to generate the manufacturer's public-private key pair using a key management system device. Further, the manufacturer's information includes name, address, telephone number and / or time when the parameters are entered into the device.

[0014] As a preferred implementation, the super administrator authorizes the generation of n pairs of public and private keys for authorized users in the following manner: using the super administrator's public key as the first fixed parameter, the current time obtained from the atomic clock timing system as the dynamic second parameter, and the vendor information as the fixed third parameter, and utilizing a key management system device to generate n pairs of public and private keys for authorized users.

[0015] As a preferred embodiment, the method further comprises: Sign with the lock core public key respectively. The signature array and the hash value corresponding to the signature array are exported and saved in other storage areas in the lock core or stored in a removable storage medium as a disaster recovery backup or for restoring the highest authority.

[0016] As a preferred embodiment, the method further comprises: Sign with the lock core public key respectively, and store the obtained signature array in the lock core password chip for storage;

[0017] When the product is put into use, the { }、{ }Using hash arrays{ } to perform hash value verification, and at the same time }, { } to verify the signature. If the verification is correct, the encrypted data { } After decrypting with the first key and taking out the public key of the authorized user, the public key of the lock core is encrypted with the public key of the authorized user and transmitted to the security chip of the smart password key corresponding to the authorized user through the transmission method of the digital envelope. Preferably, after taking out the public key of the authorized user, the hash value of the public key of the authorized user is verified and used after the verification is correct.

[0018] As a preferred implementation, if the public keys of different super administrators are used to perform mathematical operations with the public keys of authorized users and the physical feature data of the corresponding authorized users, a record table is constructed in the lock core to record the authorized users and the corresponding super administrator public keys for signature verification during authentication.

[0019] A second object of the present invention is to provide an authentication method for the above-mentioned electronic lock device, comprising:

[0020] The authorized user sends an unlock request, unlocks the encrypted lock core public key with the authorized user's private key, obtains the lock core public key, and uses the lock core public key to convert the authorized user's public key d usri The encrypted data is sent to the security chip of the lock core;

[0021] After the lock core security chip receives the unlocking request, it decrypts the data sent by the authorized user with the lock core private key, and then uses the saved authorized user encryption public key and hash value to verify the decrypted data. After the signature verification is passed, the feature data corresponding to the authorized user is extracted from the lock core security chip. }、{ } and hash value data { }, and decrypt with the first key;

[0022] The decrypted { }、{ } and hash it with the hash value { }Compare, if correct, then d usri Add the corresponding authorized administrator's public key to calculate the hash value and save it in d usri 'Compare, if the comparison is correct, the security chip of the lock core generates a random number α, and α and its hash value are used with the public key d usri The smart password key is encrypted and sent to the authorized user;

[0023] The authorized user uses his private key to decrypt and obtain the random number α and its hash value, and performs a hash value verification on α. ​​After the verification passes, the random number α is used to encrypt the hash value, and it is signed with the lock core public key and sent to the lock core security chip;

[0024] The lock core security chip uses the private key and α decryption to perform hash value verification on the data sent by the authorized user. If the comparison is correct, it means that the user is a legitimate authorized user. The user's password feature data and physical feature data are collected and compared. If the comparison is consistent, the verification is passed.

[0025] As a preferred implementation, if any link fails to pass the authentication, the lock core security chip triggers the alarm module to issue a warning, and triggers the video acquisition device to extract data on the continuous physical characteristics of the surrounding environment, and sends an illegal unlocking prompt and the extracted physical characteristic data information to the authorized user's terminal.

[0026] A third object of the present invention is to provide an electronic lock device constructed based on the above encryption method.

[0027] The present invention has the following beneficial effects:

[0028] (1) The electronic lock device of the present invention uses a cryptographic algorithm to implement lock core control, without the need for a mechanical lock core, thereby reducing the possibility of illegal mechanical unlocking to zero.

[0029] (2) The present invention obtains accurate time through the atomic clock timing system as a dynamic parameter for generating the lock cylinder and the smart password key. Because the time obtained from the timing system is incremental and changes at any time, it is used as a dynamic parameter for generating the key to make it unique at that time point, and also makes the key result different, thereby avoiding the situation where the parameters are consistent due to artificial setting of time.

[0030] (3) The present invention uses cryptographic algorithms and discrete mathematics knowledge to control and use data generation, change, data flow, data security control, etc. at each node according to the comprehensive application scenario. Without losing convenience, it ensures the security of each link of the lock core control and realizes the application of high-security level electronic lock core control and unlocking. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 This is a flowchart of the administrator's public and private key generation process.

[0032] Figure 2 It is a schematic diagram of the electronic lock verification process. DETAILED DESCRIPTION

[0033] The technical solution of the present invention is further described below in conjunction with the accompanying drawings and specific implementation methods.

[0034] Some of the terms involved in the embodiments are explained as follows:

[0035] The key management system refers to a mature key management system equipment product that has passed the national cryptographic product testing and certification. It is used to create and manage keys. It has functions such as disassembly and self-destruction. After purchase, the user runs it independently and closed (no networking is allowed). Existing mature products can be used.

[0036] The atomic clock timing system refers to the group of atomic clocks established by the National Time Service Center to provide standard timing points.

[0037] A security chip refers to a cryptographic security chip that has been tested and certified by the state. It has an independent processor and storage unit inside. The storage unit is divided into a private storage area, a secure storage area, and a common storage area. The private storage area and the secure storage area cannot be read out, but can only be written in. The common storage area can be read and written. In the embodiment, the public key is written into the common storage area of ​​the cryptographic security chip for storage, and the random number The data is written to the private storage area, and other data (including private keys) is written to the secure storage area.

[0038] Example 1

[0039] This embodiment provides a specific electronic lock device construction process.

[0040] The electronic lock device shown in this embodiment includes an electronic lock core and a smart password key paired with it. The electronic lock core contains a security chip and a processing chip (microprocessor, i.e., the CPU / main control chip of the lock core). There are m+n smart password keys, m super administrator keys, and the remaining n keys are owned by n authorized users. The m super administrator keys are 1 purchaser (super administrator with the highest authority) key and m-1 spare keys. Each spare super administrator can encrypt the authorized user's feature data once with their own public key and save it.

[0041] The encryption method of the electronic lock device includes the following steps:

[0042] 1) Initialization of the device before leaving the factory.

[0043] Before leaving the factory, the manufacturer presets a public-private key pair for the password security chip of the lock core and the password security chips of the m+n smart password keys. The preset public-private key pair is generated based on the manufacturer's information, which can be the name, address, telephone number, current time (the time when the production parameters are entered into the password management system device), etc. The manufacturer information is used as the production parameters of the factory key, and the production parameters are sent to the key management system device for calculation to generate the manufacturer's public-private key pair, which is written into the security chip of the lock core and the security chip of the smart password key, and the public key of the smart password key is written into the security chip of the lock core.

[0044] 2) The virtual legal identity of the electronic lock user (including m super administrators and n authorized users) is determined, and the key pair preset by the manufacturer and the key pair generated when the buyer actually purchases the lock are replaced.

[0045] The lock core buyer is the legal owner of the item, and we can call him the "super administrator" of the lock core. When the lock core buyer purchases the lock core, his personal identity authentication information (such as ID number or mobile phone number) is used as one of the basic fixed parameters for generating the key, and the current date and time T entered into the parameter (to the key management system device) is obtained from the timing system and used as the dynamic second parameter, combined with the seller information (such as the seller's name) as the third parameter, and the key management system device calculates the lock core's public and private key pair and m pairs of public and private key pairs (d usrj ,W usrj ),like Figure 1 The buyer's time for the m smart password keys is S' Usrj , j is the serial number of the smart password key, j∈[1,m−1], calculate U usrj =[S' usrj ]G, where G is a finite field of elliptic curves. ID number or mobile phone number is ID usr , the manufacturer (or distributor) name is P usr，, send these parameters to the key management system device for calculation, generate 1+m pairs of random data as the corresponding public-private key pairs, write the public-private key pairs of the lock core into the password security chip of the lock core (the public key is symmetrically encrypted with β and saved), write the public-private key pairs of m super administrators into the super administrator's smart password key, replace the preset public-private key pairs of the manufacturer, and symmetrically encrypt the public key of the super administrator's smart password key with β (i.e. , Enc() is a symmetric encryption algorithm), and calculates the hash value of the encrypted data (i.e. ), the encrypted public key and hash value Any super administrator can authorize n users, so the administrator public key is uniformly referred to as d in the following text. usr If multiple super administrators have authorized different users, a record table can be built in the lock core to record the authorized users and the public keys of the super administrators who authorized them for subsequent signature verification.

[0046] In addition, a random number is generated by a random number generator when purchasing As the top-level key, it serves as the symmetric encryption key for the lock cylinder's data protection.

[0047] The public and private key pair of this "super administrator" is authorized to generate n sets of public and private key pairs and write them into the n smart password keys, completing the replacement of the public and private key pairs preset by the factory. The public and private key pair of the super administrator is the public and private key pair with the highest control authority over the lock core and n smart password keys in future use.

[0048] Secondly, since the time for generating each pair of public and private keys cannot be completely consistent, even if the personal identity authentication information and seller information are consistent, the time released by the atomic clock timing system cannot be modified. Therefore, each pair of public and private keys generated is different.

[0049] By performing mathematical operations on the digital features of the purchaser (personal identity authentication information, seller and T), the virtual identity of the legal owner of the association between the "lock" and the "key" is established. Due to the characteristics of discrete mathematics, the above digital features can be calculated under certain circumstances and these parameters can be deduced, thereby ensuring that the purchaser is the owner of the highest management authority over the lock core.

[0050] After the super administrator (purchaser) is confirmed and authorized and generates the super administrator's public-private key pair, any super administrator (or different super administrators can be authorized) can generate the remaining n authorized users' public-private key pairs in the same way as above ( Figure 1The only difference is that the digital features (personal identity authentication information) of the purchaser are replaced with the public key of the super administrator as its digital features, which are input into the key management system as an important parameter to participate in the calculation and generate the public-private key pairs of n authorized users (d usri ,W usri ), write the public-private key pair into the corresponding authorized user's smart password key, replace the preset manufacturer's public-private key pair, and use β to symmetric encrypt its public key (i.e. , and calculate the hash value of the encrypted data (i.e. ), encrypt the public key and hash value Insert the security chip in the lock cylinder.

[0051] Through the above operations, after the user purchases, these n smart password keys have obtained the basic authority to control and manage the lock core after the relevant authorization of the smart password key of the "super administrator", which is equivalent to completing the initialization work before the use of the smart password key and the lock core. After this initialization is completed, the public and private key pairs originally set at the factory are replaced, thereby completing the change of the core parameters of the key generation from the factory settings to the core authority data of the actual purchaser through the above operations.

[0052] 3) Initialization of characteristic data of authorized user i (user):

[0053] 3.1) Use the public key d of any smart password key with the highest management authority (super administrator) usr and the public key d of the other n smart password keys that can grant the lock cylinder unlocking authority usri After adding (i∈[1,n], n is a natural number), the added data is hashed to prevent tampering, and the hashed data d is obtained. usri '(i∈[1,n], n is a natural number), public key d usri That is, password characteristic data.

[0054] 3.2) For the n authorized smart password keys, determine the unique representative physical feature data of the corresponding user of the smart password key array, using the super administrator's public key (d usr ) + physical characteristic data Then, the sum data is hashed to obtain the hash value. , where M represents the specific physical feature data of a person or object, s represents the classification attribute of the feature, m represents the attribute number of the attribute, and n represents the specific value of the attribute.

[0055] The uniquely representative physical feature data may be uniquely representative physical data of the human body such as fingerprints and faces.

[0056] 3.3) Encrypt and hash the physical feature data and password feature data to ensure that even if the sensitive security parameters (top-level keys) are leaked, the lock security will not be damaged. The specific operations are as follows:

[0057] 3.3.1 Data representing the physical characteristics of the authorized user (such as fingerprint recognition data of people or objects, face recognition data, etc.), hash value of physical feature data With top-level key As the symmetric encryption key, the array is obtained after encryption { }, the public key data d usri (i∈[1,n], n is a natural number) and data d representing the unique cryptographic digital feature usri '(i∈[1,n], n is a natural number) with top-level key As the symmetric encryption key, the array is obtained after encryption { }, save these two arrays to the secure storage area of ​​the security chip in the electronic lock core, or store them in the lock core security chip and the key chip in a double backup manner.

[0058] The calculation process is shown as follows: } as an example:

[0059] ( , ) = { }.

[0060] 3.3.2 Using hash algorithm to }and{ }Calculate and obtain the hash array of encrypted data { }.

[0061] That is: Hash ({ }, { }) = { }

[0062] 3.3.3 The hash array { }Reuse The encrypted data is stored in the security chip of the electronic lock core to protect the hash array. As of this step, the feature data { }、{ } and hash array { }Security purposes of separate calculations.

[0063] 3.3.4 The lock core public key is used to sign respectively to obtain a signature array, and the signature array is stored in the secure storage area of ​​the lock core password chip for storage.

[0064] 4) Feature encryption data backup: The signature array and the hash value corresponding to the signature array are exported and saved in other places in the lock core or stored in a removable storage medium (such as a USB flash drive) for use as disaster recovery backup and recovery of the highest authority.

[0065] 5) When the lock is put into use, the data stored in the lock core will be hashed and decrypted for backup

[0066] When the product is put into use, the { }, { } Perform hash calculation and compare the calculation result with the saved hash value { }, and at the same time { }, { } to verify the signature. If the result is consistent, indicating that the data has not been altered or forged, the encrypted data { } is decrypted with β. After decryption, it is restored to (d usri , d usri '), take out the authorized public key d usri The hash value is calculated by adding the corresponding authorized administrator's public key and d usri 'Compare and verify that there is no error, then encrypt the public key of the lock core with the public key of the authorized user and send it to the ordinary storage area of ​​the password security chip of the authorized user's smart password key for standby use through the digital envelope transmission method.

[0067] Example 2

[0068] This embodiment specifically describes the verification process of the electronic lock cylinder of the present invention. Figure 2 As shown, including:

[0069] 1. The authorized user sends an unlock request and uses the encrypted public key of the lock core to unlock the lock core with the authorized user's private key W. usri Unlock, obtain the lock core public key, and use the lock core public key to usri Encrypted and sent to the password security chip of the lock cylinder.

[0070] 2. After receiving the unlocking request, the security chip of the lock core decrypts the data sent by the authorized user with its private key.

[0071] 3. The lock core uses the saved authorized user to encrypt the public key and hash value Decrypt the authorized user's public key d obtained by decrypting the private key usriAfter the signature verification is passed, the password security chip of the lock core extracts the feature data corresponding to the authorized user from the secure storage area. }、{ } and hash value data { }, and use Decrypt.

[0072] 4. Will pass After decryption { }、{ }Data is hashed to calculate a hash value, and the hash value is compared with the decrypted hash value { }, if it is correct, it proves that the data stored in the security chip has not been tampered with or forged. usri Calculate the hash value after adding it to the corresponding authorized administrator's public key, and save the hash value d usri 'Make a comparison.

[0073] If the comparison is correct, the password security chip of the lock core generates a 128-bit random number α, which is used as the key for symmetric encryption. This random number α and its hash value are used with the public key d usri The encrypted data is sent to authorized users.

[0074] 5. After receiving the data, the authorized user uses his private key W usri Decryption is performed to obtain the random number α and the hash value, and the hash value of α is calculated and compared with the hash value obtained by decryption.

[0075] 6. After the authorized user calculates and compares correctly, the random number α is used to encrypt the hash value and signed with the public key of the lock core's security chip.

[0076] 7. The password security chip of the lock core uses the private key to decrypt the data sent by the authorized user, and uses the random number α generated by it as the decryption key to decrypt it. The obtained value is compared with the original hash value. If the comparison is correct, it means that the user is legally authorized.

[0077] 8. If the comparison is correct, the data collection of various acquisition function modules is triggered to obtain the collected physical feature data and password feature data for extraction. After extraction, these two types of data are encrypted with the public key of the password security chip of the lock core and sent to the lock core. The password security key of the lock core decrypts the obtained data private key and compares it with the physical feature data and password feature data stored in the security area of ​​the lock core in advance. If the comparison of physical features and password features is also correct, the embedded control system (COS) of the password security chip in the lock core sends a command to the servo motor to unlock, and sends an unlock prompt message to the authorized user's mobile terminal / PC.

[0078] If the comparison is incorrect, the embedded control system (COS) of the password security chip in the lock core will send instructions to various alarm modules to generate alarm sounds, while triggering the collection function module to extract continuous physical feature data of the surrounding environment and send illegal unlocking prompt data information to the authorized user's mobile terminal / PC.

Claims

1. An encryption method for an electronic lock device, the electronic lock device comprising an electronic lock cylinder and a smart password key paired therewith, characterized in that: The smart password key is provided with a security chip, the electronic lock core is provided with a security chip and a processing chip, and the encryption method includes: When a user purchases a lock core, a random number generator is used to generate a random number as a first key; Using the buyer's identity information as the fixed first parameter, the current time obtained from the atomic clock timing system as the dynamic second parameter, and the seller's information as the fixed third parameter, the key management system device is used to generate the lock core public and private keys and m pairs of super administrator public and private keys, which are written into the lock core and the smart password keys of the m super administrators respectively; the super administrator authorizes n pairs of authorized users' public and private keys to be generated and written into the smart password keys of the n authorized users respectively; the lock core public key and the public keys of the m+n smart password keys are encrypted with the first key and stored in the security chip of the lock core; Use the public key of any super administrator to perform mathematical operations with the public key of the authorized user and the physical feature data of the corresponding authorized user, obtain the password feature data and the physical feature data, and calculate the hash values ​​respectively; encrypt the password feature data and its hash value, the physical feature data and its hash value respectively using the first key, and obtain the array { }、{ } and store it in the security chip of the lock cylinder; }、{ }Calculate the hash value and get the hash array { },Will{ }The first key is used to encrypt and store the public key in the lock core's security chip; when the product is put into use, the public key of the lock core is encrypted with the public key of the authorized user and transmitted to the security chip of the smart password key corresponding to the authorized user.

2. The encryption method according to claim 1, characterized in that: The security chip has a readable and writable common storage area, a non-readable private storage area, and a secure storage area. The common storage area stores public key data, the private storage area stores a first key, and other data is stored in the secure storage area.

3. The encryption method according to claim 1, characterized in that: The electronic lock device has the manufacturer's public and private key pairs preset in the lock core and the security chip of the smart password key before leaving the factory. After the user purchases the electronic lock device, the public and private key pairs of the super administrator and the authorized user are used to replace the preset manufacturer's public and private key pairs.

4. The encryption method according to claim 1, characterized in that: The method for the super administrator to authorize the generation of n pairs of public and private keys for authorized users is as follows: using the super administrator's public key as the first fixed parameter, the current time obtained from the atomic clock timing system as the dynamic second parameter, and the vendor information as the fixed third parameter, and using the key management system device to generate n pairs of public and private keys for authorized users.

5. The encryption method according to claim 1, characterized in that: Also includes, Sign with the lock core public key respectively. The signature array and the hash value corresponding to the signature array are exported and saved in other storage areas in the lock core or stored in a removable storage medium as a disaster recovery backup or for restoring the highest authority.

6. The encryption method according to claim 1, characterized in that: Also includes, and Sign with the lock core public key respectively, and store the obtained signature array in the lock core password chip for storage; When the product is put into use, the { }、{ }Using hash arrays{ } to perform hash value verification, and at the same time }, { } to verify the signature. If the verification is correct, the encrypted data { After decrypting with the first key and taking out the public key of the authorized user, the public key of the lock core is encrypted with the public key of the authorized user and transmitted to the security chip of the smart password key corresponding to the authorized user through the digital envelope transmission method.

7. The encryption method according to claim 1, characterized in that: If the public keys of different super administrators are used to perform mathematical operations with the public keys of authorized users and the physical feature data of the corresponding authorized users, a record table is constructed in the lock core to record the authorized users and the corresponding super administrator public keys for signature verification during authentication.

8. The authentication method of the electronic lock device according to any one of claims 1 to 7, characterized in that: include: The authorized user sends an unlock request, unlocks the encrypted lock core public key with the authorized user's private key, obtains the lock core public key, and uses the lock core public key to convert the authorized user's public key d usri The encrypted data is sent to the security chip of the lock core; After the lock core security chip receives the unlocking request, the data sent by the authorized user is decrypted with the lock core private key, and then the decrypted data is signed with the saved authorized user encryption public key and hash value. After the signature is verified, the feature data corresponding to the authorized user is extracted from the lock core security chip. }、{ } and hash value data { }, and decrypt with the first key; The decrypted { }、{ } and hash it with the hash value { }Compare, if correct, then d usri Add the corresponding authorized administrator's public key to calculate the hash value and save it in d usri 'Compare, if the comparison is correct, the security chip of the lock core generates a random number α, and α and its hash value are used with the public key d usri The smart password key is encrypted and sent to the authorized user; The authorized user uses his private key to decrypt and obtain the random number α and its hash value, and performs a hash value verification on α. ​​After the verification passes, the random number α is used to encrypt the hash value, and it is signed with the lock core public key and sent to the lock core security chip; The lock core security chip uses the private key and α decryption to perform hash value verification on the data sent by the authorized user. If the comparison is correct, it means that the user is a legitimate authorized user. The user's password feature data and physical feature data are collected and compared. If the comparison is consistent, the verification is passed.

9. The authentication method according to claim 8, characterized in that: If any link fails to pass the authentication, the lock core security chip triggers the alarm module to issue a warning, and triggers the video acquisition device to extract data on the continuous physical characteristics of the surrounding environment, and sends an illegal unlocking prompt and the extracted physical characteristic data information to the authorized user's terminal.

10. An electronic lock device constructed by the encryption method according to any one of claims 1 to 7.

Images