Access control method and system for smart door lock

Abstract

The present application relates to an access control method and system for a smart door lock. The method is applied to a smart door lock and includes: performing key negotiation with a user device to generate a temporary key pair for establishing a secure channel; receiving an encrypted data packet from the user device, wherein the encrypted data packet is obtained by encrypting access information using a first persistent symmetric key and encrypting data generated by encrypting the first persistent symmetric key using the temporary key pair; decrypting the encrypted data packet using the first persistent symmetric key and the temporary key pair; and in response to successful decryption, performing a corresponding action according to the access information. The present application scheme combines the security of two-way authentication and can use the symmetric key obtained through two-way authentication negotiation to accelerate access, thereby improving system security and user experience.

Description

Technical Field

[0001] The present application relates to the technical field of Internet of Things, and in particular to an access control method and system for a smart door lock. Background Art

[0002] With the continuous development of smart home technology, smart door locks, as a key device, are favored by more and more users. However, the current smart door locks mainly use the traditional symmetric key model for access control, which has problems such as complex authentication process, slow speed, and low security. These problems not only affect the user experience, but also pose risks such as information leakage and illegal access, posing a threat to the user's property and privacy security. There are also smart door locks that simply use RSA and other asymmetric, two-way authentication methods to encrypt the communication process, but the communication process of such smart door locks is slow, affecting the user experience.

[0003] Therefore, there is a need for an access control solution for a smart door lock that can ensure security while performing rapid authentication. Summary of the invention

[0004] In response to the above-mentioned problems existing in the prior art, the present application provides an access control solution for smart door locks, which combines the security of two-way authentication and can use the symmetric key obtained by two-way authentication negotiation to accelerate access, thereby improving system security and user experience.

[0005] According to a first aspect of the present application, there is provided an access control method for a smart door lock, which is applied to the smart door lock and is characterized by comprising:

[0006] Perform key negotiation with the user device to generate a temporary key pair for establishing a secure channel;

[0007] Receiving an encrypted data packet from the user device, wherein the encrypted data packet is obtained by encrypting access information using a first persistent symmetric key and encrypting data generated by encrypting the first persistent symmetric key using the temporary key pair;

[0008] decrypting the encrypted data packet using the first persistent symmetric key and the temporary key pair; and

[0009] In response to successful decryption, a corresponding action is performed according to the access information.

[0010] According to a second aspect of the present application, there is provided an access control method for a smart door lock, which is applied to a user device and is characterized by comprising:

[0011] Perform key negotiation with the smart door lock to generate a temporary key pair for establishing a secure channel;

[0012] Encrypting the access information using the first persistent symmetric key, and encrypting the data generated by encrypting the first persistent symmetric key using the temporary key pair to obtain an encrypted data packet; and

[0013] Send the encrypted data packet to the smart door lock.

[0014] According to a third aspect of the present application, there is provided an access control system for a smart door lock, characterized in that it includes:

[0015] A smart door lock, used to execute the method according to the first aspect; and

[0016] User equipment, used to execute the method as described in the second aspect.

[0017] According to a fourth aspect of the present application, there is provided an electronic device, including:

[0018] Processor; and

[0019] A memory stores computer instructions, and when the computer instructions are executed by the processor, the processor executes the methods described in the first aspect and the second aspect.

[0020] According to a fifth aspect of the present application, a non-transitory computer storage medium is provided, storing a computer program, which, when executed by multiple processors, enables the processors to execute the methods described in the first and second aspects.

[0021] According to the access control method and system of the smart door lock provided in this application, under the premise of providing channel security and anti-tracking, the persistent symmetric key obtained by the previous two-way authentication negotiation is used to accelerate access, thereby improving the authentication speed while ensuring security and enhancing the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without exceeding the scope of protection required by the present application.

[0023] Figure 1 It is a schematic diagram of the network configuration process of the access control system of the smart door lock according to an embodiment of the present application.

[0024] Figure 2 It is a schematic diagram of the transaction process of the access control system of the smart door lock according to an embodiment of the present application.

[0025] Figure 3It is a flow chart of an access control method implemented by a smart door lock according to an embodiment of the present application.

[0026] Figure 4 It is a flow chart of an access control method implemented by a smart door lock according to another embodiment of the present application.

[0027] Figure 5 It is a flowchart of an access control method implemented by a user device according to an embodiment of the present application.

[0028] Figure 6 It is a flowchart of an access control method implemented by a user device according to another embodiment of the present application.

[0029] Figure 7 It is a structural diagram of an electronic device provided by this application. DETAILED DESCRIPTION

[0030] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0031] Figure 1 FIG. 1 is a schematic diagram of a network configuration process of an access control system for a smart door lock according to an embodiment of the present application. Figure 1 As shown, the system includes a user device, a smart door lock and a central control unit. According to some implementations, the user device includes a mobile phone, a tablet computer, a smart watch and other devices, which are equipped with a communication module and a security module for generating, encrypting and transmitting the user's authentication information. Smart door locks refer to locks that are improved on the basis of traditional mechanical locks and are more intelligent and simple in terms of user security, identification and manageability. They include a communication module, a control module and an encryption module for receiving and processing authentication information and control commands sent by the user device, and performing corresponding locking or unlocking operations. The central control unit includes an edge gateway or a cloud, which is responsible for functions such as key distribution, event recording and remote control.

[0032] The network configuration process is the configuration process after the smart door lock is powered on for the first time or reset. This process will issue certificates for the user device and the smart door lock, providing a basis for the subsequent rapid authentication stage. Figure 1 As shown in the figure, the network configuration process includes the following steps.

[0033] 1. Connect the user device to the smart door lock device

[0034] The user device connects to the smart door lock device via wireless technologies such as BLE (Bluetooth Low Energy) or NFC (Near Field Communication). This step establishes a communication channel between the two devices.

[0035] 2. Smart door lock device transmits certificate request

[0036] The smart door lock device transmits a certificate request encrypted by a preset key to the user device. The preset key is written by the manufacturer when the door lock device is produced. Among them, this certificate request contains content that needs to be verified and issued by the central control unit. It is encrypted with a preset key to ensure data security.

[0037] 3. User device requests key issuance

[0038] The user equipment sends the received certificate request to the central control unit, requesting it to issue a key and related certificates.

[0039] 4. The central control unit performs equipment verification and certificate issuance

[0040] The central control unit verifies the certificate request of the smart door lock device to verify whether it is a request from a legitimate device, and after the verification is passed, generates and issues a certificate (including the corresponding public key).

[0041] 5. The central control unit distributes the certificate (including the corresponding public key)

[0042] The central control unit distributes the generated certificates of the user device and the smart door lock device to the user device.

[0043] 6. User device distributes certificate to smart door lock device

[0044] The user device transmits the certificate received from the central control unit to the smart door lock device.

[0045] This step completes the key distribution process, so that both the smart door lock device and the user device have their own and each other's certificates and corresponding public keys, and generate persistent symmetric keys based on the public keys, which can be used for further encrypted communication and identity authentication.

[0046] The technical solution of this application is divided into four main parts: access protocol, transmission protocol, trust framework and access credentials.

[0047] The access protocol is the core step for authentication and transmission of access credentials between the user device and the smart door lock, which is divided into two stages:

[0048] Fast transaction phase: In this phase, the user device proves to the smart door lock that it has a given key. If the smart door lock is able to successfully match this key, it can indicate success to the user device and complete the transaction. If this phase cannot be passed, the standard transaction phase will be entered.

[0049] Standard transaction stage: If the quick authentication fails, a complete standard transaction will be carried out. The standard transaction process will carry out two-way authentication, and the user device and the smart door lock device will verify each other's identity through the public key corresponding to the certificate.

[0050] During each communication initiation process, both the fast transaction phase and the standard transaction phase use the temporary key negotiated by the user device and the smart door lock to protect the channel security.

[0051] The access credential contains detailed information such as user identity information, access rights, and validity period. The user device signs the access credential with a private key derived from the public key of its own certificate. After receiving the signed access credential, the smart door lock verifies the signature based on the public key of the user device certificate. If all verification steps pass, the smart door lock will perform the corresponding unlocking operation. The smart door lock derives a persistent symmetric key based on the public key of the user device certificate and caches the negotiated persistent symmetric key for use in the next quick transaction.

[0052] The transmission protocol is used to achieve the secure transmission of authentication information (certificates of both parties) and access credentials between user devices and smart door locks, and supports multiple communication methods, including BLE (Bluetooth Low Energy), UWB (Ultra-Wideband), active NFC, etc.

[0053] •BLE transmission: Suitable for low-power scenarios. The user device sends encrypted authentication information to the smart door lock via BLE to ensure efficient data transmission and low power consumption.

[0054] •UWB transmission: This technology is used for high-precision positioning authentication, ensuring that user devices are within a reasonable physical range, further improving system security.

[0055] •NFC transmission: This technology is used for near-field communication. When the smart door lock contains active NFC, it can replace BLE for encrypted data transmission. When using NFC transmission, since it is near-field communication itself, the UWB protocol is not required for physical distance confirmation.

[0056] This application ensures the efficiency and security of data transmission by reasonably designing the transmission mechanism and combining the advantages of BLE, UWB and NFC:

[0057] •Sending authentication request: The user device sends an authentication request via BLE or NFC, which includes the user identity and a one-time random number.

[0058] •Precise positioning verification: After receiving the authentication request, the smart door lock device uses UWB to perform precise positioning verification to ensure that the user device is within a reasonable physical range. UWB has the characteristics of high-precision positioning to prevent illegal remote access.

[0059] •Multi-factor authentication: After BLE completes basic authentication and UWB completes location verification, the system can also perform further multi-factor authentication, such as biometrics or password entry.

[0060] The trust framework is an important part of the smart door lock system. It provides the trust foundation required for user devices and smart door locks to verify and authenticate communication information, including:

[0061] •Key generation and management: When the system is used for the first time, the central control unit issues certificates for the smart door lock and user device. The certificate is issued by a trusted certificate authority (CA) and contains the device public key and other authentication information. The certificate is used for mutual authentication between the user device and the smart door lock device to ensure the security and reliability of communication.

[0062] •Key update mechanism: In order to maintain long-term security, the system can also implement a regular key update mechanism. By regularly replacing key pairs, the impact of system attacks can be reduced.

[0063] The access credential contains important information such as the user's identity information, access rights, and validity period, which is used by the door lock device to make the final access decision:

[0064] •Identity information: Contains the user’s unique identifier, such as user name, device ID, etc.

[0065] •Access rights: Describe in detail the actions that the user can perform, such as unlocking, locking, accessing specific areas, etc.

[0066] •Validity period: The time range during which the access credential is valid. Credentials beyond this time range will become unusable.

[0067] Through access credentials, door lock devices can finely control user access rights to ensure the security and flexibility of the system.

[0068] Figure 2 FIG. 1 is a schematic diagram of a transaction process of an access control system of a smart door lock according to an embodiment of the present application. Figure 2 As shown, the transaction process includes: transaction initialization stage, secure channel establishment stage, fast transaction stage and standard transaction stage.

[0069] In the transaction initialization phase, the physical layer and transport layer between the user device and the smart door lock are initialized to establish communication between the user device and the smart door lock. The transaction can use NFC or BLE as the transmission mechanism of the access protocol. When conducting transactions through BLE, UWB can be used to securely determine the proximity distance. When using NFC, since it is near-field communication itself, UWB is not required to determine the distance.

[0070] When the user device and the smart door lock start a communication, in the stage of establishing a secure channel, the user device and the smart door lock perform key negotiation and generate a temporary key pair for establishing a secure channel. According to some embodiments, ECDH (Elliptic Curve Diffie-Hellman key Exchange) can be used to establish a secure channel. The smart door lock generates a first temporary key pair, including a first temporary public key and a first temporary private key, and the user device generates a second temporary key pair, including a second temporary public key and a second temporary private key. The smart door lock and the user device send the first temporary public key and the second temporary public key generated by each to each other, and then the smart door lock generates a temporary key pair based on the second temporary public key and the first temporary private key, and the user device generates the same temporary key pair based on the first temporary public key and the second temporary private key. The temporary key pair generated by the key negotiation between the smart door lock and the user device is used for encryption and decryption of the data packets sent and received between the two later (including the fast transaction stage and the standard transaction stage), thereby ensuring the security of the transmission channel between the two and having anti-tracking properties.

[0071] According to some embodiments, Figure 1 As shown, before sending the first temporary public key to the user device, the smart door lock signs the first temporary public key with the long-term private key derived from the public key in the smart door lock certificate, and the smart door lock sends the signed first temporary public key to the user device. After receiving the signed first temporary public key, the user device performs signature verification (signature verification) according to the public key in the smart door lock certificate to verify the identity of the smart door lock. If the verification is successful, the smart door lock and the user device generate a temporary key pair and proceed to the subsequent fast transaction stage. Otherwise, the transaction is rejected and the process is terminated. In this process, the user device authenticates the identity of the smart door lock, ensuring that a man-in-the-middle attack will not lead to the leakage of privacy-sensitive data. This principle also allows the user device to transmit data to the door lock device without being leaked by a passive or active eavesdropper.

[0072] In the fast transaction phase, the user device sends an encrypted data packet to the smart door lock. The encrypted data packet is obtained by the user device using a persistent symmetric key to encrypt the access information, and then re-encrypting the encrypted data with a temporary key pair. The access information includes instructions sent by the user device to the smart door lock, such as unlocking instructions. The persistent symmetric key is a symmetric key pair derived from the public key in the certificate exchanged between the user device and the smart door lock during the network configuration phase or the standard transaction phase. For a smart door lock, it can be networked with multiple user devices and can store persistent symmetric keys corresponding to multiple user devices.

[0073] like Figure 1As shown, after receiving the encrypted data packet from the user device, the smart door lock uses a temporary key pair and traverses one or more persistent symmetric keys stored in itself to decrypt the encrypted data packet. If the decryption is successful, the persistent symmetric keys between the user device and the smart door lock match, and fast decryption and fast authentication are achieved at the same time. The smart door lock performs corresponding actions, such as unlocking. If the decryption is not successful, it means that due to some reasons (such as loss), there is no persistent symmetric key in the smart door lock that matches the user device. The smart door lock returns an error code, and the smart door lock and the user device need to enter the standard transaction phase to renegotiate a new persistent symmetric key.

[0074] During the standard transaction phase, the user device and the smart door lock can use challenge response to achieve mutual authentication.

[0075] According to some embodiments, the user device signs the first challenge information according to the private key derived from the public key in the user device certificate, obtains the signed first challenge information, and sends the signed first challenge information and the public key in the user device certificate to the smart door lock; wherein the first challenge information includes a random number and / or user credentials generated by the user device. Since certificates have been exchanged between the smart door lock and the user device during the network configuration process, it is also possible to send a public key identifier. After the smart door lock receives the signed first challenge information from the user device and the public key or public key identifier in the user device certificate, it performs signature verification on the signed first challenge information according to the public key in the user device certificate.

[0076] At the same time or immediately afterwards, the smart door lock signs the second challenge information according to the private key derived from the public key in the smart door lock certificate, obtains the signed second challenge information, and sends the signed second challenge information and the public key in the smart door lock certificate to the user device; wherein, the second challenge information includes a random number generated by the smart door lock. Since the certificates have been exchanged between the smart door lock and the user device during the network configuration process, it is also possible to send a public key identifier. After the user device receives the signed second challenge information from the smart door lock and the public key or public key identifier in the smart door lock certificate, it performs signature verification on the signed second challenge information according to the public key in the smart door lock certificate.

[0077] If the signature verification is successful, the smart door lock generates and stores a second persistent symmetric key based on the public key in the user device certificate, and the user device generates and stores the same second persistent symmetric key based on the public key in the smart door lock certificate. The generated second persistent symmetric key can be used in the subsequent fast transaction phase.

[0078] exist Figure 1In the embodiment shown, the user device and the smart door lock first perform a quick transaction process, and then enter a standard transaction if it fails, which can effectively speed up the speed of regular access to the device. In the standard transaction stage, the user device and the smart door lock send the public key (or public key identifier) ​​and the signed challenge information in the established secure channel. The smart door lock verifies the signature of the user device and the user device verifies the signature of the smart door lock, so that two-way authentication can be achieved.

[0079] Based on the above-mentioned access control system of the smart door lock, the present application provides an access control method of the smart door lock. Figure 3 FIG. 1 is a flow chart of an access control method implemented by a smart door lock according to an embodiment of the present application. Figure 3 As shown, the method comprises the following steps:

[0080] Step S301: perform key negotiation with a user device to generate a temporary key pair for establishing a secure channel.

[0081] According to some embodiments, ECDH can be used to establish a secure channel. The smart door lock generates a first temporary key pair, including a first temporary public key and a first temporary private key, and the user device generates a second temporary key pair, including a second temporary public key and a second temporary private key. The smart door lock and the user device send the first temporary public key and the second temporary public key generated by each to each other, and then the smart door lock generates a temporary key pair based on the second temporary public key and the first temporary private key, and the user device generates the same temporary key pair based on the first temporary public key and the second temporary private key. The temporary key pair generated by the key negotiation between the smart door lock and the user device is used for encryption and decryption of the data packets sent and received between the two later (including the fast transaction stage and the standard transaction stage), thereby ensuring the security of the transmission channel between the two and having anti-tracking properties.

[0082] According to some optional embodiments, step S301 may include:

[0083] Generate a first temporary public key and a first temporary private key of the smart door lock;

[0084] Sending the first temporary public key to the user equipment;

[0085] receiving a second temporary public key from the user device; and

[0086] The temporary key pair is generated according to the second temporary public key and the first temporary private key.

[0087] Step S302: receiving an encrypted data packet from the user device, wherein the encrypted data packet is obtained by encrypting access information using a first persistent symmetric key and encrypting data generated by encrypting the first persistent symmetric key using the temporary key pair.

[0088] In the fast transaction phase, the user device sends an encrypted data packet to the smart door lock. The encrypted data packet is obtained by the user device using a persistent symmetric key to encrypt the access information, and then re-encrypting the encrypted data using a temporary key pair. The access information includes the instructions sent by the user device to the smart door lock, such as unlocking instructions. The persistent symmetric key is a symmetric key pair generated by the user device and the smart door lock based on the public key in the certificate exchanged between the two during the network configuration phase or the standard transaction phase.

[0089] Step S303, decrypting the encrypted data packet using the first persistent symmetric key and the temporary key pair; and

[0090] Step S304: in response to successful decryption, executing a corresponding action according to the access information.

[0091] For a smart door lock, it can be networked with multiple user devices and can store persistent symmetric keys corresponding to multiple user devices.

[0092] like Figure 1 As shown, after receiving the encrypted data packet from the user device, the smart door lock uses a temporary key pair and traverses one or more persistent symmetric keys stored in itself to decrypt the encrypted data packet. If the decryption is successful, the persistent symmetric keys between the user device and the smart door lock match, and fast decryption and fast authentication are achieved at the same time. The smart door lock performs corresponding actions, such as unlocking. If the decryption is not successful, it means that due to some reasons (such as loss), there is no persistent symmetric key in the smart door lock that matches the user device. The smart door lock returns an error code, and the smart door lock and the user device need to enter the standard transaction phase to renegotiate a new persistent symmetric key.

[0093] Figure 4 is a flow chart of an access control method implemented by a smart door lock according to another embodiment of the present application. Figure 3 compared to, Figure 4 Steps S401 to S404 are Figure 3 The steps S301 to S304 are the same as above, except that: Figure 4 The method shown also includes the following steps:

[0094] Step S405, in response to unsuccessful decryption, receiving a signed first challenge message from the user device and a public key or a public key identifier in the user device certificate, wherein the signed first challenge message is signed by the user device using a private key derived from the public key in its own certificate, and the first challenge message includes a random number generated by the user device and / or a user credential;

[0095] Step S406, performing signature verification on the signed first challenge information according to the public key in the user equipment certificate;

[0096] Step S407, signing the second challenge information according to the private key derived from the public key in the smart door lock certificate to obtain the signed second challenge information, wherein the second challenge information includes the random number generated by the smart door lock;

[0097] Step S408, sending the signed second challenge information and the public key or public key identifier in the smart door lock certificate to the user device; and

[0098] Step S409: if the signature verification is passed, generate a second persistent symmetric key according to the public key in the user equipment certificate.

[0099] According to some embodiments, the user device signs the first challenge information according to the private key derived from the public key in the user device certificate, obtains the signed first challenge information, and sends the signed first challenge information and the public key in the user device certificate to the smart door lock; wherein the first challenge information includes a random number and / or user credentials generated by the user device. Since certificates have been exchanged between the smart door lock and the user device during the network configuration process, it is also possible to send a public key identifier. After the smart door lock receives the signed first challenge information from the user device and the public key or public key identifier in the user device certificate, it performs signature verification on the signed first challenge information according to the public key in the user device certificate.

[0100] At the same time or immediately afterwards, the smart door lock signs the second challenge information according to the private key derived from the public key in the smart door lock certificate, obtains the signed second challenge information, and sends the signed second challenge information and the public key in the smart door lock certificate to the user device; wherein, the second challenge information includes a random number generated by the smart door lock. Since the certificates have been exchanged between the smart door lock and the user device during the network configuration process, it is also possible to send a public key identifier. After the user device receives the signed second challenge information from the smart door lock and the public key or public key identifier in the smart door lock certificate, it performs signature verification on the signed second challenge information according to the public key in the smart door lock certificate.

[0101] If the signature verification is successful, the smart door lock generates and stores a second persistent symmetric key based on the public key in the user device certificate, and the user device generates and stores the same second persistent symmetric key based on the public key in the smart door lock certificate. The generated second persistent symmetric key can be used in the subsequent fast transaction phase.

[0102] Figure 5 FIG. 1 is a flow chart of an access control method implemented by a user device according to an embodiment of the present application. Figure 5 As shown, the method comprises the following steps:

[0103] Step S501, perform key negotiation with the smart door lock to generate a temporary key pair for establishing a secure channel.

[0104] According to some embodiments, ECDH can be used to establish a secure channel. The smart door lock generates a first temporary key pair, including a first temporary public key and a first temporary private key, and the user device generates a second temporary key pair, including a second temporary public key and a second temporary private key. The smart door lock and the user device send the first temporary public key and the second temporary public key generated by each to each other, and then the smart door lock generates a temporary key pair based on the second temporary public key and the first temporary private key, and the user device generates the same temporary key pair based on the first temporary public key and the second temporary private key. The temporary key pair generated by the key negotiation between the smart door lock and the user device is used for encryption and decryption of the data packets sent and received between the two later (including the fast transaction stage and the standard transaction stage), thereby ensuring the security of the transmission channel between the two and having anti-tracking properties.

[0105] According to some optional embodiments, step S501 may include:

[0106] Generate a second temporary public key and a second temporary private key of the user equipment;

[0107] Sending the second temporary public key to the smart door lock;

[0108] Receiving a first temporary public key from the smart door lock; and

[0109] The temporary key pair is generated according to the first temporary public key and the second temporary private key.

[0110] Step S502, using the first persistent symmetric key to encrypt the access information, and using the temporary key pair to encrypt the data generated by encrypting the first persistent symmetric key to obtain an encrypted data packet; and

[0111] Step S503, sending the encrypted data packet to the smart door lock.

[0112] In the fast transaction phase, the user device sends an encrypted data packet to the smart door lock. The encrypted data packet is obtained by the user device using a persistent symmetric key to encrypt the access information, and then re-encrypting the encrypted data with a temporary key pair. The access information includes instructions sent by the user device to the smart door lock, such as unlocking instructions. The persistent symmetric key is a symmetric key pair derived from the public key in the certificate exchanged between the user device and the smart door lock during the network configuration phase or the standard transaction phase. For a smart door lock, it can be networked with multiple user devices and can store persistent symmetric keys corresponding to multiple user devices.

[0113] Figure 6 is a flow chart of an access control method implemented by a user device according to another embodiment of the present application. Figure 5 compared to, Figure 6 Steps S601 to S603 are Figure 5 The steps S501 to S503 are the same as those in the embodiment except that: Figure 6 The method shown also includes the following steps:

[0114] Step S604, in response to unsuccessful decryption, receiving a signed second challenge message from the smart door lock and a public key or a public key identifier in the smart door lock certificate;

[0115] Step S605, performing signature verification on the signed second challenge information according to the public key in the smart door lock certificate;

[0116] Step S606, signing the first challenge information according to the private key derived from the public key in the user equipment certificate to obtain the signed first challenge information;

[0117] Step S607, sending the signed first challenge information and the public key or public key identifier in the user device certificate to the smart door lock; and

[0118] Step S608, when the signature verification passes, generate a second persistent symmetric key according to the public key in the smart door lock certificate.

[0119] According to some embodiments, the user device signs the first challenge information according to the private key derived from the public key in the user device certificate, obtains the signed first challenge information, and sends the signed first challenge information and the public key in the user device certificate to the smart door lock; wherein the first challenge information includes a random number and / or user credentials generated by the user device. Since certificates have been exchanged between the smart door lock and the user device during the network configuration process, it is also possible to send a public key identifier. After the smart door lock receives the signed first challenge information from the user device and the public key or public key identifier in the user device certificate, it performs signature verification on the signed first challenge information according to the public key in the user device certificate.

[0120] At the same time or immediately afterwards, the smart door lock signs the second challenge information according to the private key derived from the public key in the smart door lock certificate, obtains the signed second challenge information, and sends the signed second challenge information and the public key in the smart door lock certificate to the user device; wherein, the second challenge information includes a random number generated by the smart door lock. Since the certificates have been exchanged between the smart door lock and the user device during the network configuration process, it is also possible to send a public key identifier. After the user device receives the signed second challenge information from the smart door lock and the public key or public key identifier in the smart door lock certificate, it performs signature verification on the signed second challenge information according to the public key in the smart door lock certificate.

[0121] If the signature verification is successful, the smart door lock generates and stores a second persistent symmetric key based on the public key in the user device certificate, and the user device generates and stores the same second persistent symmetric key based on the public key in the smart door lock certificate. The generated second persistent symmetric key can be used in the subsequent fast transaction phase.

[0122] According to the access control method and system of the smart door lock provided by this application, under the premise of providing channel security and anti-tracking, the persistent symmetric key obtained by the previous two-way authentication negotiation is used to accelerate access, improve the authentication speed while ensuring security, and enhance the user experience. This application adopts phased transmission and signature technology to make the authentication process more secure and prevent illegal access. In addition, the system supports multiple communication methods, such as NFC, BLE, etc., to adapt to different user devices and actual application scenarios.

[0123] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0124] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present application.

[0125] In the several embodiments provided in the present application, it should be understood that the disclosed device can be implemented in other ways. For example, the device embodiments described above are only schematic, such as the division of the units, which is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the device or unit can be electrical connection or other forms.

[0126] See also Figure 7 , Figure 7 An electronic device is provided, comprising a processor and a memory. The memory stores computer instructions, and when the computer instructions are executed by the processor, the processor executes the computer instructions to achieve the following Figures 3 to 6 The method and refinement scheme shown.

[0127] It should be understood that the above device embodiments are only illustrative, and the device disclosed in the present invention can also be implemented in other ways. For example, the division of units / modules described in the above embodiments is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units, modules or components can be combined, or can be integrated into another system, or some features can be ignored or not executed.

[0128] In addition, unless otherwise specified, each functional unit / module in each embodiment of the present invention may be integrated into one unit / module, each unit / module may exist physically separately, or two or more units / modules may be integrated together. The above-mentioned integrated unit / module may be implemented in the form of hardware or in the form of a software program module.

[0129] If the integrated unit / module is implemented in the form of hardware, the hardware may be a digital circuit, an analog circuit, etc. The physical implementation of the hardware structure includes but is not limited to transistors, memristors, etc. Unless otherwise specified, the processor or chip may be any appropriate hardware processor, such as CPU, GPU, FPGA, DSP, and ASIC, etc. Unless otherwise specified, the on-chip cache, off-chip memory, and storage may be any appropriate magnetic storage medium or magneto-optical storage medium, such as resistive random access memory RRAM (Resistive Random Access Memory), dynamic random access memory DRAM (Dynamic Random Access Memory), static random access memory SRAM (Static Random-Access Memory), enhanced dynamic random access memory EDRAM (Enhanced Dynamic Random Access Memory), high-bandwidth memory HBM (High-Bandwidth Memory), hybrid memory cube HMC (Hybrid Memory Cube), etc.

[0130] If the integrated unit / module is implemented in the form of a software program module and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a memory and includes several instructions for a computer electronic device (which can be a personal computer, a server or a network electronic device, etc.) to perform all or part of the steps of the method described in each embodiment of the present disclosure. The aforementioned memory includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc., various media that can store program codes.

[0131] The present application also provides a non-transitory computer storage medium storing a computer program. When the computer program is executed by a plurality of processors, the processors execute the following Figures 3 to 6 The method and refinement scheme shown.

[0132] The embodiments of the present application are described in detail above. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and its core idea of ​​the present application. At the same time, changes or deformations made by those skilled in the art based on the ideas of the present application, the specific implementation methods and the scope of application of the present application, all belong to the scope of protection of the present application. In summary, the content of this specification should not be construed as a limitation on the present application.

Claims

1. A smart door lock access control method, applied to a smart door lock, characterized in that: include: Perform key negotiation with the user device to generate a temporary key pair for establishing a secure channel; Receiving an encrypted data packet from the user device, wherein the encrypted data packet is obtained by encrypting access information using a first persistent symmetric key, and encrypting data generated by encrypting the first persistent symmetric key using the temporary key pair, wherein the first persistent symmetric key is a symmetric key pair derived from a public key in a certificate exchanged between the user device and the smart door lock; Decrypting the encrypted data packet using the first persistent symmetric key and the temporary key pair; In response to successful decryption, performing a corresponding action based on the access information; In response to unsuccessful decryption, receiving a signed first challenge message from the user device and a public key or a public key identifier in the user device certificate, wherein the signed first challenge message is obtained by signing the user device using a private key derived from the public key in its own certificate, and the first challenge message includes a random number generated by the user device and / or a user credential; Performing signature verification on the signed first challenge information according to the public key in the user equipment certificate; Sign the second challenge information according to the private key derived from the public key in the smart door lock certificate to obtain the signed second challenge information, wherein the second challenge information includes the random number generated by the smart door lock; and Sending the signed second challenge information and the public key or public key identifier in the smart door lock certificate to the user device, so that the user device performs signature verification on the signed second challenge information according to the public key in the smart door lock certificate; and When the signature verification passes, a second persistent symmetric key is generated according to the public key in the user equipment certificate.

2. The method according to claim 1, characterized in that The performing key negotiation with the user equipment to generate a temporary key pair includes: Generate a first temporary public key and a first temporary private key of the smart door lock; Sending the first temporary public key to the user equipment; receiving a second temporary public key from the user device; and The temporary key pair is generated according to the second temporary public key and the first temporary private key.

3. The method according to claim 2, characterized in that The sending the first temporary public key to the user equipment includes: Signing the first temporary public key using a private key derived from the public key in the smart door lock certificate to obtain a signed first temporary public key; and The signed first temporary public key is sent to the user equipment.

4. A method for access control of a smart door lock, applied to a user device, characterized in that: include: Perform key negotiation with the smart door lock to generate a temporary key pair for establishing a secure channel; Encrypting the access information using a first persistent symmetric key, and encrypting the data encrypted by the first persistent symmetric key using the temporary key pair to obtain an encrypted data packet, wherein the first persistent symmetric key is a symmetric key pair derived from a public key in a certificate exchanged between the user device and the smart door lock; and Sending the encrypted data packet to the smart door lock, so that the smart door lock uses the first persistent symmetric key and the temporary key pair to decrypt the encrypted data packet; In response to the smart door lock failing to decrypt successfully, signing the first challenge information according to a private key derived from a public key in the user device certificate to obtain the signed first challenge information; Sending the signed first challenge information and the public key or public key identifier in the user device certificate to the smart door lock, so that the smart door lock performs signature verification on the signed first challenge information according to the public key in the user device certificate, wherein the first challenge information includes a random number generated by the user device and / or user credentials; Receiving a signed second challenge message from the smart door lock and a public key or a public key identifier in the smart door lock certificate, wherein the signed second challenge message is obtained by the smart door lock using a private key derived from the public key in its own certificate to sign, and the second challenge message includes a random number generated by the smart door lock; Performing signature verification on the signed second challenge information according to the public key in the smart door lock certificate; and When the signature verification passes, a second persistent symmetric key is generated according to the public key in the smart door lock certificate.

5. The method according to claim 4, characterized in that The performing key negotiation with the smart door lock to generate a temporary key pair includes: Generate a second temporary public key and a second temporary private key of the user equipment; Sending the second temporary public key to the smart door lock; Receiving a first temporary public key from the smart door lock; and The temporary key pair is generated according to the first temporary public key and the second temporary private key.

6. The method according to claim 5, characterized in that The first temporary public key is signed by a private key derived from a public key in the smart door lock certificate, and the generating of the temporary key pair according to the first temporary public key and the second temporary private key includes: Performing signature verification on the signed first temporary public key according to the public key in the smart door lock certificate; and When the signature verification passes, the temporary key pair is generated according to the first temporary public key and the second temporary private key.

7. An access control system for a smart door lock, characterized in that: include: An intelligent door lock, used to execute the method according to any one of claims 1 to 3; as well as User equipment, configured to execute the method according to any one of claims 4 to 6.

8. An electronic device, characterized in that: The method comprises a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the method according to any one of claims 1 to 6 when executing the computer program in the memory.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images