Authentication system for remote monitoring of smart home based on identity verification

Abstract

The invention relates to the technical field of identity authentication, in particular to an authentication system based on identity authentication and used for intelligent home remote monitoring. The system comprises a verification evaluation unit, a remote monitoring unit, a communication encryption unit and an optimization decryption unit. According to the invention, the length comparison module derives the symmetric encryption key from the calculated shared key of the intelligent lock, and then counts the length of the symmetric encryption key according to the derived symmetric encryption key; according to the method, the key length of the symmetric encryption is compared with the key length of the symmetric encryption in the set standard key length range, and then the key length of the symmetric encryption is intercepted, so that the calculation complexity can be reduced by controlling the key length, the key length is greatly reduced, and the calculation efficiency is improved. According to the technical scheme, the response speed of the intelligent lock can be remarkably improved, so that smoother user experience is provided, meanwhile, the short key length is used, needed computing resources are greatly reduced, computing resource consumption can be reduced, and the performance of the intelligent lock is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of identity authentication, and in particular to an authentication system for remote monitoring of smart homes based on identity authentication. Background Art

[0002] Authentication based on identity verification for smart home remote monitoring usually refers to a method of using advanced identity verification technology to ensure that only authorized users can access smart home devices, and includes security measures such as multi-factor authentication, biometric technology (such as fingerprint or facial recognition), and encrypted communication. The main purpose is to protect the smart home environment from unauthorized access and control, while also ensuring the privacy and security of data. When the fingerprint or password or face image data is obtained, the obtained fingerprint or password or face image is used to authenticate with the fingerprint, lock password and face image previously entered in the smart lock. During the authentication process, the authenticity of the user's identity needs to be verified. Once the identity verification is successful, the smart lock encrypts the communication data during the unlocking process. Since more complex mathematical operations and key management technologies are used to encrypt the communication data during the unlocking process, the complexity of the calculation is greatly increased, resulting in a long secret key length. When the secret key length is too long, more steps and processing time are required to execute, which slows down the response speed of the smart lock and greatly reduces the overall authentication effect. In order to avoid the use of more complex mathematical operations and key management technologies to cause the secret key length to be too long, which leads to a reduction in the overall authentication effect, we provide an authentication system based on identity verification for smart home remote monitoring. Summary of the invention

[0003] The purpose of the present invention is to provide an authentication system based on identity authentication for remote monitoring of smart homes to solve the problems raised in the above background technology.

[0004] To achieve the above object, the present invention provides an authentication system for remote monitoring of smart homes based on identity authentication, including a remote monitoring login unit, a public-private key signature unit, a signature and key unit, and an encryption and decryption unit;

[0005] The remote monitoring unit is used to obtain basic information of the user to log in to the main interface, and use the main interface to perform remote monitoring, and remotely unlock the smart lock through remote monitoring;

[0006] The public-private key signature unit is used to receive the remote unlocking command data and the acquired user basic information in the remote monitoring unit and generate a pair of public and private keys, and digitally sign according to the private key and the acquired user basic information, and then send the digital signature and the acquired user basic information together to the smart lock;

[0007] The signature and key unit is used to receive the digital signature in the public-private key signature unit, the public key and the basic user information obtained by logging into the remote monitoring unit, and use the public key to verify the validity of the digital signature. When the verification is valid, the ECDH algorithm is triggered to generate a shared key according to the public key and the basic user information obtained;

[0008] The encryption and decryption unit is used to receive the shared key generated in the signature and key unit and the public key and private key in the public-private key signature unit, derive a symmetric encryption key based on the generated shared key and calculate the key length of the symmetric encryption, and then determine whether the key length of the symmetric encryption is too long. If the key length is too long, the key length of the symmetric encryption is intercepted, and decryption authentication is performed through the intercepted content; if the key length is not too long, decryption authentication is performed directly.

[0009] As a further improvement of the present technical solution, the login remote monitoring unit is used to obtain the user's basic information, and directly log in to the main interface based on the obtained user basic information. The main interface is used for remote real-time monitoring. The user remotely monitors the surrounding environment in real time based on the camera built into the smart lock. Remote real-time monitoring includes smart lock status monitoring and historical records. Smart lock status monitoring is used for users to view the real-time status of the smart lock through mobile applications or web applications. The real-time status of the smart lock includes locked status, unlocked status and battery power. When the smart lock is remotely unlocked using remote real-time monitoring, the remote unlocking command data is passed into the public and private key signature units.

[0010] As a further improvement of the technical solution, the public-private key signature unit includes a public-private key module and a digital signature module;

[0011] The public key and private key module is used to receive the command data of remote unlocking in the remote monitoring unit and the basic information of the user obtained. When the command data of remote unlocking is received, the user device, smart lock, elliptic curve and base point are obtained from the basic information of the user, and a pair of public keys and private keys are generated according to the user device and the smart lock respectively, and the user private key and the smart lock private key are kept confidential, and then the user public key and the smart lock public key are made public;

[0012] Among them, the public key includes the user public key G u and smart lock public key G l , the private key includes the user's private key S u And smart lock private key S l ;

[0013] The digital signature module is used to receive the private key in the public key and private key module and the basic user information obtained by logging into the remote monitoring unit, and to perform a digital signature based on the private key and the obtained basic user information. The signing process uses the elliptic curve digital signature algorithm ECDSA, and obtains a digital signature, which is then sent to the smart lock together with the digital signature and the obtained basic user information.

[0014] As a further improvement of the technical solution, the implementation steps of generating a pair of public keys and private keys in the public key and private key module are as follows:

[0015] Step 1: User private key S u is a random integer d u , and then use the random integer d u Multiply it with the base point G to get the user's public key G u , user public key G u It's Q u , Q u The algorithm formula is: Q u =d u ×G;

[0016] Step 2: Smart lock private key S l is a random integer d l , and then use the random integer d l Multiply it with the base point G to get the smart lock public key G l , smart lock public key G l It's Q l , Q l The algorithm formula is: Q l =d l ×G.

[0017] As a further improvement of the technical solution, the elliptic curve digital signature algorithm ECDSA in the digital signature module implements the following steps:

[0018] S1. First, take the base point G and the elliptic curve E from the basic information of the user, then select a random integer k, and multiply the random integer k with the base point G to obtain the point R, where the point R can be expressed in the coordinate form (x1, y1), and the algorithm formula of the point R is: R = K × G;

[0019] S2. Secondly, from the infinite point on the elliptic curve E, the infinite point is also called the zero point O. The remainder is obtained by using the zero point O and the base point G. The remainder is the modulus n=O%G, where % represents the sign of the remainder. Then, the x-axis coordinate point in point R and the modulus n are used to obtain the first value r of the digital signature. The specific algorithm formula is: r=x1%n. When r=0, k is reselected.

[0020] S3. Finally, take the user's private key S from the private key u, and use the hash function H to process the obtained user basic information m to generate a fixed-length hash value H m , and then according to the hash value H m ,d u 、User private key S u The second value s of the digital signature is obtained by adding the first value r of the digital signature and the second value s of the digital signature. Finally, the digital signature (r, s) is generated according to the first value r of the digital signature and the second value s of the digital signature. The specific algorithm formula of the second value s of the digital signature is:

[0021] s=k -1 ×(H m +S u ×r)%n;

[0022] Among them, k -1 is the modulo n inverse of a random integer k, that is, k -1 is an integer. When s=0, k is reselected.

[0023] As a further improvement of the technical solution, the signature and key unit includes a signature verification module and a shared key module;

[0024] The signature verification module is used to receive the digital signature, modulus and basic user information obtained by logging into the remote monitoring unit in the digital signature module, and receive the user public key in the public key and private key module. When the smart lock receives the digital signature, the obtained basic user information and the user public key, it uses the user public key to verify the digital signature and verify the validity of the digital signature;

[0025] The shared key module is used to receive valid command data in the signature verification module and random integers, smart lock public keys, and user public keys in the public key and private key modules, and receive basic user information obtained by logging into the remote monitoring unit. When valid command data is received, the ECDH algorithm is triggered to generate a shared key according to the random integer, smart lock public key, user public key, and the obtained basic user information;

[0026] The generated shared key includes the calculated user shared key and the calculated smart lock shared key.

[0027] As a further improvement of the technical solution, the encryption and decryption unit includes a length comparison module, a communication encryption module and an optimized decryption module;

[0028] The length comparison module is used to receive the user shared key and the calculated smart lock shared key calculated in the shared key module, and then derive a symmetric encryption key from the calculated user shared key or the calculated smart lock shared key, obtain the derived symmetric encryption key, and then calculate the key length of the symmetric encryption according to the derived symmetric encryption key, and compare the key length of the symmetric encryption with the set standard key length range, and the specific comparison includes:

[0029] Case ①: When the key length of the symmetric encryption is within the set standard key length range, it means that the key length of the symmetric encryption is not too long, and the derived symmetric encryption key is transferred to the communication encryption module;

[0030] Case ②: When the key length of the symmetric encryption exceeds the set standard key length range, it indicates that the key length of the symmetric encryption is too long, and the key length of the symmetric encryption is intercepted until the key length of the symmetric encryption is within the set standard key length range, and the intercepted symmetric encryption key is obtained, and the intercepted symmetric encryption key is transferred to the communication encryption module;

[0031] The communication encryption module is used to receive the symmetric encryption key derived from the length comparison module or the intercepted symmetric encryption key, and encrypt the communication data in the unlocking process according to the derived symmetric encryption key or the intercepted symmetric encryption key;

[0032] The optimized decryption module is used for the communication data encrypted in the communication encryption module and the symmetric encryption key derived or intercepted in the length comparison module. When the encrypted communication data is decrypted according to the derived symmetric encryption key or the intercepted symmetric encryption key and the encrypted communication data, the encrypted communication data is optimized and decrypted using the P-256 elliptic curve cryptography algorithm. The smart lock performs authentication based on the optimized decrypted data and executes unlocking.

[0033] As a further improvement of the technical solution, the specific situation in the signature verification module includes:

[0034] L1. First, make sure that r and s in the digital signature are in the range [1, n-1], and then calculate the integer w based on the second value s of the digital signature and the modulus n. The specific algorithm formula is: w = s -1 %n, where s -1 It represents the inverse element of s modulus n in the digital signature, that is, the multiplicative inverse element of s in the digital signature under the modulus n;

[0035] L2, by obtaining the hash value H of the user's basic information m m Multiply by the integer w and modulo n to get u1 = H m×w%n, then multiply r in the digital signature by the integer w and take the modulus n to get u2=r×w%n;

[0036] L3, using the obtained u1, obtained u2, base point G and user public key G u Calculate point p, where point P can be expressed in coordinate form (x2, y2). The specific algorithm formula is: p = u1×G + u2×G u , and then divide the abscissa value x2 of point P by the modulus n to obtain the remainder rr = x2% n;

[0037] L4. Use the remainder rr and r in the digital signature for verification. When the remainder rr is equal to r in the digital signature, it means that the verified digital signature is valid and the identity authentication is successful. When the remainder rr is not equal to r in the digital signature, the verified digital signature is invalid.

[0038] As a further improvement of the technical solution, the shared key module uses the ECDH algorithm to implement the following specific steps:

[0039] K1. Using random integer d u 、Smart lock public key G l , random integer d l Calculate the user shared key with the base point G and obtain the calculated user shared key YH my =d u ×G l =d u ×d l ×G;

[0040] K2, using random integer d u 、User public key G u , random integer d l Calculate the user shared key with the base point G and obtain the calculated smart lock shared key ZNS my =d l ×G u =d l ×d u ×G;

[0041] K3, due to d u ×d l ×G=d l ×d u ×G, indicating the calculated user shared key YH my Shared key ZNS with the calculated smart lock my Consistent.

[0042] Compared with the prior art, the present invention has the following beneficial effects:

[0043] 1. This identity authentication is used in the authentication system of smart home remote monitoring. The length comparison module derives a symmetric encryption key from the calculated user shared key or the calculated smart lock shared key, and then calculates the key length of the symmetric encryption based on the derived symmetric encryption key. The symmetric encryption key length is compared with the set standard key length range, and the symmetric encryption key length is intercepted. Controlling the key length can reduce the complexity of the calculation, greatly reduce the length of the secret key, and significantly improve the response speed of the smart lock, thereby providing a smoother user experience. At the same time, using a shorter key length, the required computing resources are also greatly reduced, which can reduce computing resource consumption and improve the performance of the smart lock.

[0044] 2. This identity authentication is used in the authentication system of smart home remote monitoring. The optimized decryption module decrypts according to the derived symmetric encryption key or the intercepted symmetric encryption key and the encrypted communication data, and then optimizes the decryption of the encrypted communication data. The optimized decryption algorithm and process can significantly reduce the processing time. The fast decryption process means that the identity authentication can be completed faster, thereby reducing the overall authentication delay and improving the authentication effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 is an overall block diagram of the present invention;

[0046] Figure 2 It is a block diagram of the public and private key signature unit of the present invention;

[0047] Figure 3 It is a block diagram of the signature and key unit of the present invention;

[0048] Figure 4 It is a block diagram of the encryption and decryption unit of the present invention.

[0049] The meaning of each number in the figure is:

[0050] 1. Login remote monitoring unit; 2. Public and private key signature unit; 21. Public and private key module; 22. Digital signature module;

[0051] 3. Signature and key unit; 31. Signature verification module; 32. Shared key module;

[0052] 4. Encryption and decryption unit; 41. Length comparison module; 42. Communication encryption module; 43. Optimized decryption module. DETAILED DESCRIPTION

[0053] The following will be combined with the accompanying drawings in the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0054] Example 1

[0055] The present invention provides an authentication system based on identity verification for remote monitoring of smart homes, see Figure 1-Figure 4 , including a remote monitoring unit 1 for logging in, a public and private key signature unit 2, a signature and key unit 3, and an encryption and decryption unit 4;

[0056] The login remote monitoring unit 1 is used to obtain the user's basic information to log in to the main interface, and use the main interface for remote monitoring, and remotely unlock the smart lock through remote monitoring; the public-private key signature unit 2 is used to receive the remote unlock command data and the obtained user basic information in the login remote monitoring unit 1 and generate a pair of public keys and private keys, and digitally sign according to the private key and the obtained user basic information, and then send the digital signature and the obtained user basic information to the smart lock together; the signature and key unit 3 is used to receive the digital signature, public key and the basic user information obtained by logging in to the remote monitoring unit 1 in the public-private key signature unit 2, and use the public key to perform The digital signature is verified to be valid. When the verification is valid, the ECDH algorithm is triggered to generate a shared key based on the public key and the obtained basic information of the user; the encryption and decryption unit 4 is used to receive the shared key generated in the signature and key unit 3 and the public key and private key in the public-private key signature unit 2, derive the symmetric encryption key according to the generated shared key and calculate the key length of the symmetric encryption, and then judge whether the key length of the symmetric encryption is too long. If the key length is too long, the key length of the symmetric encryption is intercepted, and decryption authentication is performed through the intercepted content; if the key length is not too long, decryption authentication is performed directly.

[0057] The following is a refinement of the above units, see Figure 1-Figure 4 ;

[0058] The logging in remote monitoring unit 1 is used to obtain the basic information of the user, and directly log in to enter the main interface according to the obtained basic information of the user. The main interface is used for remote real-time monitoring. The user remotely monitors the surrounding environment in real time according to the built-in camera of the smart lock. The remote real-time monitoring includes smart lock status monitoring and historical records (querying all records of using the smart lock). The smart lock status monitoring is used for the user to view the real-time status of the smart lock through a mobile application or a web application. The real-time status of the smart lock includes the locked status, unlocked status and battery power. When the smart lock is remotely unlocked by remote real-time monitoring, the remote unlocking command data is transmitted to the public-private key signature unit 2;

[0059] The basic information obtained includes name, ID number, phone number, residential address, user name, password, smart lock model, user's fingerprint, lock password, face image information, user device, smart lock, elliptic curve and base point;

[0060] The public-private key signature unit 2 includes a public-private key module 21 and a digital signature module 22;

[0061] The public key and private key module 21 is used to receive the command data of remote unlocking in the remote monitoring unit 1 and the basic information of the user obtained. When the command data of remote unlocking is received, 21 takes the user device, smart lock, elliptic curve and base point from the basic information of the user obtained, and generates a pair of public keys and private keys according to the user device and the smart lock respectively, keeps the user private key and the smart lock private key confidential, and then makes the user public key and the smart lock public key public;

[0062] Among them, the public key includes the user public key G u and smart lock public key G l , the private key includes the user's private key S u And smart lock private key S l ;

[0063] The steps for generating a pair of public and private keys in the public and private key module 21 are as follows:

[0064] Step 1: User private key S u is a random integer d u , and then use the random integer d u Multiply it with the base point G to get the user's public key G u , user public key G u It's Q u , Q u The algorithm formula is: Q u =d u ×G;

[0065] Step 2: Smart lock private key S l is a random integer d l , and then use the random integer dl Multiply it with the base point G to get the smart lock public key G l , smart lock public key G l It's Q l , Q l The algorithm formula is: Q l =d l ×G.

[0066] The digital signature module 22 is used to receive the private key in the public key and private key module 21 and the basic user information obtained by logging into the remote monitoring unit 1, and to perform a digital signature based on the private key and the basic user information obtained. The signing process uses the elliptic curve digital signature algorithm ECDSA, and obtains a digital signature, and then uses the digital signature and the obtained basic user information to send it to the smart lock;

[0067] The implementation steps of the elliptic curve digital signature algorithm ECDSA in the digital signature module 22 are as follows:

[0068] S1. First, take the base point G and the elliptic curve E from the basic information of the user, then select a random integer k, and multiply the random integer k with the base point G to obtain the point R, where the point R can be expressed in the coordinate form (x1, y1), and the algorithm formula of the point R is: R = K × G;

[0069] S2. Secondly, from the infinite point on the elliptic curve E, the infinite point is also called the zero point O. The remainder is obtained by using the zero point O and the base point G. The remainder is the modulus n=O%G, where % represents the sign of the remainder. Then, the x-axis coordinate point in point R and the modulus n are used to obtain the first value r of the digital signature. The specific algorithm formula is: r=x1%n. When r=0, k is reselected.

[0070] S3. Finally, take the user's private key S from the private key u , and use the hash function H to process the obtained user basic information m to generate a fixed-length hash value H m , and then according to the hash value H m ,d u 、User private key S u The second value s of the digital signature is obtained by adding the first value r of the digital signature and the second value s of the digital signature. Finally, the digital signature (r, s) is generated according to the first value r of the digital signature and the second value s of the digital signature. The specific algorithm formula of the second value s of the digital signature is:

[0071] s=k -1 ×(H m +S u ×r)%n;

[0072] Among them, k -1 is the modulo n inverse of a random integer k, that is, k -1is an integer. When s=0, k is reselected. This formula is used to calculate the second value of the digital signature, which serves as the basis for subsequent data signature verification.

[0073] The signature and key unit 3 includes a signature verification module 31 and a shared key module 32;

[0074] The signature verification module 31 is used to receive the digital signature, modulus and basic user information obtained by logging into the remote monitoring unit 1 in the digital signature module 22, and receive the user public key in the public key and private key module 21. When the smart lock receives the digital signature, the obtained basic user information and the user public key, it uses the user public key to verify the digital signature and verify the validity of the digital signature;

[0075] The specific situation in the signature verification module 31 includes:

[0076] L1. First, make sure that r and s in the digital signature are in the range [1, n-1], and then calculate the integer w based on the second value s of the digital signature and the modulus n. The specific algorithm formula is: w = s -1 %n, where s -1 It represents the inverse element of s modulus n in the digital signature, that is, the multiplicative inverse element of s in the digital signature under the modulus n;

[0077] L2, by obtaining the hash value H of the user's basic information m m Multiply by the integer w and modulo n to get u1 = H m ×w%n, then multiply r in the digital signature by the integer w and take the modulus n to get u2=r×w%n;

[0078] L3, using the obtained u1, obtained u2, base point G and user public key G u Calculate point p, where point P can be expressed in coordinate form (x2, y2). The specific algorithm formula is: p = u1 × G + u2 × G u , and then divide the abscissa value x2 of point P by the modulus n to obtain the remainder rr = x2% n;

[0079] L4. Use the remainder rr and r in the digital signature for verification. When the remainder rr is equal to r in the digital signature, it means that the verified digital signature is valid and the identity authentication is successful. When the remainder rr is not equal to r in the digital signature, the verified digital signature is invalid.

[0080] The shared key module 32 is used to receive the valid command data in the signature verification module 31 and the random integer, smart lock public key, and user public key in the public key and private key module 21, and receive the basic user information obtained by logging into the remote monitoring unit 1. When receiving the valid command data, the ECDH algorithm is triggered to generate a shared key according to the random integer, smart lock public key, user public key, and the obtained basic user information;

[0081] The specific implementation steps of using the ECDH algorithm in the shared key module 32 are as follows:

[0082] K1. Using random integer d u 、Smart lock public key G l , random integer d l Calculate the user shared key with the base point G and obtain the calculated user shared key YH my =d u ×G l =d u ×d l ×G;

[0083] K2, using random integer d u 、User public key G u , random integer d l Calculate the user shared key with the base point G and obtain the calculated smart lock shared key ZNS my =d l ×G u =d l ×d u ×G;

[0084] K3, due to d u ×d l ×G=d l ×d u ×G, indicating the calculated user shared key YH my Shared key ZNS with the calculated smart lock my Consistency;

[0085] The generated shared key includes the calculated user shared key and the calculated smart lock shared key.

[0086] The encryption and decryption unit 4 includes a length comparison module 41, a communication encryption module 42 and an optimization decryption module 43;

[0087] The length comparison module 41 is used to receive the user shared key and the calculated smart lock shared key calculated in the shared key module 32, and then derive a symmetric encryption key from the calculated user shared key or the calculated smart lock shared key, obtain the derived symmetric encryption key, and then calculate the key length of the symmetric encryption according to the derived symmetric encryption key, and compare the key length of the symmetric encryption with the set standard key length range;

[0088] The specific comparison conditions in the length comparison module 41 include:

[0089] Case ①: when the key length of the symmetric encryption is within the set standard key length range, it means that the key length of the symmetric encryption is not too long, and the derived symmetric encryption key is transferred to the communication encryption module 42;

[0090] Case ②, when the key length of the symmetric encryption exceeds the set standard key length range, it indicates that the key length of the symmetric encryption is too long, and the key length of the symmetric encryption is intercepted, and the intercepted symmetric encryption key is obtained until the key length of the symmetric encryption is within the set standard key length range, and the intercepted symmetric encryption key is transmitted to the communication encryption module 42;

[0091] The communication encryption module 42 is used to receive the symmetric encryption key derived from the length comparison module 41 or the intercepted symmetric encryption key, and encrypt the communication data in the unlocking process according to the derived symmetric encryption key or the intercepted symmetric encryption key, to ensure the security of communication, prevent data from being stolen or tampered with, and ensure that only authorized devices can communicate, thereby protecting the privacy and property safety of users.

[0092] The optimized decryption module 43 is used for the communication data encrypted in the communication encryption module 42 and the symmetric encryption key derived or intercepted in the length comparison module 41, receiving the public key, private key in the public key and private key module 21 and the shared key generated in the shared key module 32, and decrypting the encrypted communication data according to the derived symmetric encryption key or intercepted symmetric encryption key and the encrypted communication data, and then optimizing the decryption of the encrypted communication data by using the P-256 elliptic curve cryptography algorithm, the smart lock authenticates according to the optimized decrypted data, and performs unlocking, after the unlocking operation is completed, the current session is terminated, and the session key is destroyed to ensure that it will not be reused, thereby increasing the security of the system;

[0093] The implementation steps of optimizing the decryption of communication data using the P-256 elliptic curve cryptography algorithm are as follows:

[0094] Step 1: First obtain the user's private key S u , Smart lock private key S l 、User public key G u、Smart lock public key G l , calculated user shared key YH my Or calculate the smart lock shared key ZNS my Data, due to the calculated user shared key YH my Shared key ZNS with the calculated smart lock my The data is equal, the user shared key YH will be calculated my Shared key ZNS with the calculated smart lock my The data is uniformly named as the shared key GX s ;

[0095] Step 2: Get the random value sj and then use the SHA-256 hash function to hash the shared key GX s Perform hash operation and generate the symmetric encryption key MY k , and then use the AES algorithm to encrypt the communication data tx , symmetric encryption key MY k Or intercepted symmetric encryption key GMY k And the random value sj is decrypted to obtain the decrypted original data p m (Decrypted user basic information);

[0096] Step 3: Get the user's public key G u Data, the user public key G is obtained from step ① of the implementation step of encrypting communication data using elliptic curve cryptography u It's Q u , click Q u It can be expressed in coordinate form (a1, b1), point Q u It also represents the compressed form of the elliptic curve point E, and then the point Q u The parity of the y-axis coordinate value is judged, and the specific judgment situations include:

[0097] M1, click Q u The complete representation on the elliptic curve E is (a1, b1), that is, the coordinates of a1 and b1 are stored at the same time, and the point Q u It is also expressed as (a1,{parity}b1), where (a1,{parity}b1) indicates the parity of the b1 coordinate;

[0098] M2. When {parity}b1=0, it means y is an even number, then Q u is (a1,0), when {parity}b1=1, it means y is an odd number, then Q u is (a1,1);

[0099] Example:

[0100] Suppose we have a point Qu =(a1,b1), when the coordinate of b1 is 17, and 17 is an odd number, then the compression point Q u It is expressed as: (a1,1). On the contrary, when the coordinate of b1 is 18, and 18 is an even number, the compression point Q u It is represented as: (a1,0);

[0101] Step 4: Get the user's private key S u , Smart lock private key S l Confidential, user public key G u 、Smart lock public key G l The commonly used values ​​of the base point G are cached to reduce repeated calculations, the results are cached for quick use, and then multiple hash values ​​are calculated in parallel using multi-threading, and the decryption calculation tasks are decomposed and distributed to multiple processing units for execution.

[0102] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited by the above embodiments. The above embodiments and descriptions are only preferred examples of the present invention and are not intended to limit the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. An authentication system for remote monitoring of smart homes based on identity verification, characterized in that: It includes a remote monitoring unit (1), a public and private key signature unit (2), a signature and key unit (3), and an encryption and decryption unit (4); The login remote monitoring unit (1) is used to obtain basic information of the user to log in to the main interface, and use the main interface to perform remote monitoring, and remotely unlock the smart lock through remote monitoring; The public-private key signature unit (2) is used to receive the remote unlocking command data and the acquired user basic information in the remote monitoring unit (1) and generate a pair of public and private keys, and to perform a digital signature based on the private key and the acquired user basic information, and then to send the digital signature and the acquired user basic information together to the smart lock; The signature and key unit (3) is used to receive the digital signature in the public-private key signature unit (2), the public key and the basic user information obtained by logging into the remote monitoring unit (1), and use the public key to verify the validity of the digital signature. When the verification is valid, the ECDH algorithm is triggered to generate a shared key according to the public key and the obtained basic user information; The encryption and decryption unit (4) is used to receive the shared key generated in the signature and key unit (3) and the public key and private key in the public-private key signature unit (2), derive a symmetric encryption key based on the generated shared key and calculate the key length of the symmetric encryption, and then determine whether the key length of the symmetric encryption is too long. If the key length is too long, the key length of the symmetric encryption is intercepted and decryption authentication is performed based on the intercepted content; if the key length is not too long, decryption authentication is performed directly.

2. The identity authentication system for remote monitoring of smart homes according to claim 1 is characterized in that: The login remote monitoring unit (1) is used to obtain basic information of the user, and directly log in to enter the main interface according to the obtained basic information of the user. The main interface is used for remote real-time monitoring. The user monitors the surrounding environment remotely and in real time according to the camera built into the smart lock. The remote real-time monitoring includes smart lock status monitoring and historical records. The smart lock status monitoring is used for the user to view the real-time status of the smart lock through a mobile application or a web application. The real-time status of the smart lock includes the lock status, the unlock status and the battery power. When the smart lock is remotely unlocked by remote real-time monitoring, the remote unlocking command data is transmitted to the public-private key signature unit (2).

3. The identity authentication system for remote monitoring of smart homes according to claim 2 is characterized in that: The public-private key signature unit (2) comprises a public-private key module (21) and a digital signature module (22); The public key and private key module (21) is used to receive the command data of remote unlocking and the basic information of the user obtained by logging into the remote monitoring unit (1). When the command data of remote unlocking is received, (21) obtains the user device, the smart lock, the elliptic curve and the base point from the basic information of the user, and generates a pair of public keys and private keys according to the user device and the smart lock respectively, keeps the user private key and the smart lock private key confidential, and then makes the user public key and the smart lock public key public; Among them, the public key includes the user public key G u and smart lock public key G l , the private key includes the user's private key S u And smart lock private key S l ; The digital signature module (22) is used to receive the private key in the public key and private key module (21) and the basic user information obtained by logging into the remote monitoring unit (1), and to perform a digital signature based on the private key and the obtained basic user information. The signing process uses the elliptic curve digital signature algorithm ECDSA to obtain a digital signature, and then the digital signature and the obtained basic user information are sent to the smart lock together.

4. The identity verification system for remote monitoring of smart homes according to claim 3 is characterized in that: The steps for generating a pair of public and private keys in the public and private key module (21) are as follows: Step 1: User private key S u is a random integer d u , and then use the random integer d u Multiply it with the base point G to get the user's public key G u , user public key G u It's Q u , Q u The algorithm formula is: Q u =d u ×G; Step 2: Smart lock private key S l is a random integer d l , and then use the random integer d l Multiply it with the base point G to get the smart lock public key G l , smart lock public key G l It's Q l , Q l The algorithm formula is: Q l =d l ×G.

5. The identity verification system for remote monitoring of smart homes according to claim 4 is characterized in that: The elliptic curve digital signature algorithm ECDSA implementation steps in the digital signature module (22) are: S1. First, take the base point G and the elliptic curve E from the basic information of the user, then select a random integer k, and multiply the random integer k with the base point G to obtain the point R, where the point R can be expressed in the coordinate form (x1, y1), and the algorithm formula of the point R is: R = K × G; S2. Secondly, from the infinite point on the elliptic curve E, the infinite point is also called the zero point O. The remainder is obtained by using the zero point O and the base point G. The remainder is the modulus n=O%G, where % represents the sign of the remainder. Then, the x-axis coordinate point in point R and the modulus n are used to obtain the first value r of the digital signature. The specific algorithm formula is: r=x1%n. When r=0, k is reselected. S3. Finally, take the user's private key S from the private key u , and use the hash function H to process the obtained user basic information m to generate a fixed-length hash value H m , and then according to the hash value H m ,d u 、User private key S u The second value s of the digital signature is obtained by adding the first value r of the digital signature and the second value s of the digital signature. Finally, the digital signature (r, s) is generated according to the first value r of the digital signature and the second value s of the digital signature. The specific algorithm formula of the second value s of the digital signature is: s=k -1 ×(H m +S u ×r)%n; Among them, k -1 is the modulo n inverse of a random integer k, that is, k -1 is an integer. When s=0, k is reselected.

6. The identity verification system for remote monitoring of smart homes according to claim 3 is characterized in that: The signature and key unit (3) comprises a signature verification module (31) and a shared key module (32); The signature verification module (31) is used to receive the digital signature, modulus and basic user information obtained by logging into the remote monitoring unit (1) in the digital signature module (22), and receive the user public key in the public key and private key module (21). When the smart lock receives the digital signature, the obtained basic user information and the user public key, it uses the user public key to verify the digital signature and verify the validity of the digital signature; The shared key module (32) is used to receive valid command data in the signature verification module (31) and the random integer, the smart lock public key, and the user public key in the public key and private key module (21), receive basic user information obtained by logging into the remote monitoring unit (1), and when receiving valid command data, trigger the ECDH algorithm to generate a shared key according to the random integer, the smart lock public key, the user public key, and the obtained basic user information; The generated shared key includes the calculated user shared key and the calculated smart lock shared key.

7. The identity verification system for remote monitoring of smart homes according to claim 6 is characterized in that: The encryption and decryption unit (4) comprises a length comparison module (41), a communication encryption module (42) and an optimization decryption module (43); The length comparison module (41) is used to receive the user shared key and the calculated smart lock shared key calculated in the shared key module (32), and then derive a symmetric encryption key from the calculated user shared key or the calculated smart lock shared key to obtain the derived symmetric encryption key, and then calculate the key length of the symmetric encryption according to the derived symmetric encryption key, and compare the key length of the symmetric encryption with the set standard key length range, and the specific comparison includes: Case ①: when the key length of the symmetric encryption is within the set standard key length range, it means that the key length of the symmetric encryption is not too long, and the derived symmetric encryption key is transferred to the communication encryption module (42); Case ②, when the key length of the symmetric encryption exceeds the set standard key length range, it indicates that the key length of the symmetric encryption is too long, and the key length of the symmetric encryption is intercepted until the key length of the symmetric encryption is within the set standard key length range, and the intercepted symmetric encryption key is obtained, and the intercepted symmetric encryption key is transmitted to the communication encryption module (42); The communication encryption module (42) is used to receive the symmetric encryption key derived or intercepted in the length comparison module (41), and encrypt the communication data in the unlocking process according to the derived symmetric encryption key or the intercepted symmetric encryption key; The optimized decryption module (43) is used for the communication data encrypted in the communication encryption module (42) and the symmetric encryption key derived or intercepted in the length comparison module (41). When the encrypted communication data is decrypted according to the derived symmetric encryption key or the intercepted symmetric encryption key and the encrypted communication data, the encrypted communication data is optimized and decrypted using the P-256 elliptic curve cryptography algorithm. The smart lock performs authentication according to the optimized decrypted data and performs unlocking.

8. The identity authentication system for remote monitoring of smart homes according to claim 6 is characterized by: The specific conditions in the signature verification module (31) include: L1. First, make sure that r and s in the digital signature are in the range [1, n-1], and then calculate the integer w based on the second value s of the digital signature and the modulus n. The specific algorithm formula is: w = s -1 %n, where s -1 It represents the inverse element of s modulus n in the digital signature, that is, the multiplicative inverse element of s in the digital signature under the modulus n; L2, by obtaining the hash value H of the user's basic information m m Multiply by the integer w and modulo n to get u1 = H m ×w%n, then multiply r in the digital signature by the integer w and take the modulus n to get u2=r×w%n; L3, using the obtained u1, obtained u2, base point G and user public key G u Calculate point p, where point P can be expressed in coordinate form (x2, y2). The specific algorithm formula is: p = u1 × G + u2 × G u , and then divide the abscissa value x2 of point P by the modulus n to obtain the remainder rr = x2% n; L4. Use the remainder rr and r in the digital signature for verification. When the remainder rr is equal to r in the digital signature, it means that the verified digital signature is valid and the identity authentication is successful. When the remainder rr is not equal to r in the digital signature, the verified digital signature is invalid.

9. The identity verification system for remote monitoring of smart homes according to claim 6, characterized in that: The shared key module (32) uses the ECDH algorithm to implement the following specific steps: K1. Using random integer d u 、Smart lock public key G l , random integer d l Calculate the user shared key with the base point G and obtain the calculated user shared key YH my =d u ×G l =d u ×d l ×G; K2, using random integer d u 、User public key G u , random integer d l Calculate the user shared key with the base point G and obtain the calculated smart lock shared key ZNS my =d l ×G u =d l ×d u ×G; K3, due to d u ×d l ×G=d l ×d u ×G, indicating the calculated user shared key YH my Shared key ZNS with the calculated smart lock my Consistent.

Images