Vault safety box unlocking system based on encrypted communication

Abstract

The invention relates to the technical field of safety box unlocking control, and particularly discloses a vault safety box unlocking system based on encrypted communication, which comprises an unlocking request generation module, an application end, a safety box unlocking module and a safety box unlocking module, the generation end obtains an authorization level index of the management personnel according to the identity information, and generates an unlocking request according to the identity information, the safety box ID and the application time; according to the unlocking request processing module, a preprocessing end obtains the application time of each unlocking request and judges whether the unlocking requests are high-concurrency requests or not; calculating verification consumption time of the high-concurrency requests, and dividing the high-concurrency requests into short verification requests and long verification requests according to the verification consumption time; the verification terminal verifies the unlocking request and generates an unlocking instruction; and the unlocking instruction processing module is used for calculating the priority value of each unlocking instruction, sorting the unlocking instructions from high to low according to the priority values, and sequentially executing each unlocking instruction according to the sorted sequence.

Description

Technical Field

[0001] The invention relates to the technical field of safe unlocking control, and in particular to a safe unlocking system for a vault based on encrypted communication. Background Art

[0002] Safes are often used in bank branches to store important seals and documents to ensure the security of information; these safes generally use physical network cables for communication, and exchange public keys through secure mailboxes and SM2 encryption algorithms to enable authorized personnel to manually or remotely unlock the safes.

[0003] In the prior art, since the remote unlocking of safes is highly dependent on network bandwidth, when multiple safes initiate unlocking requests at the same time, as the number of requests increases, the performance of the system will be affected, resulting in a decrease in the efficiency of unlocking request processing; at this time, the security risks faced by the system will increase accordingly, causing attackers to attack the system's vulnerabilities or weaknesses at this time, steal sensitive information or disrupt the normal operation of the system; therefore, a good unlocking request processing method is needed. Summary of the invention

[0004] The purpose of the present invention is to provide a safe deposit box unlocking system based on encrypted communication to solve the above technical problems.

[0005] The purpose of the present invention can be achieved through the following technical solutions: A safe deposit box unlocking system based on encrypted communication, comprising: Unlock request generation module: including an application end and a generation end; the application end obtains the identity information and safe ID of the manager and records the application time; the generation end obtains the authorization level index of the manager according to the identity information, and generates an unlock request according to the identity information, safe ID and application time; Unlock request processing module: including a preprocessing end and a verification end; the preprocessing end obtains the application time of each unlock request, and if |Tmin-Tmax|≤t and g≥G are satisfied within a time interval [Tmin, Tmax] consisting of g consecutive application times, where t is a preset time difference threshold and G is a preset number threshold, then all unlock requests within the time interval are recorded as high-concurrency requests; Get the IP address of the safe ID corresponding to the high-concurrency request, obtain the distance d between the generating end and the IP address, and obtain the verification consumption time Tc=2d / v of the high-concurrency request, where v is the current network transmission rate; according to the verification consumption time of each high-concurrency request, get the sequence , where Tc kis the kth verification consumption time, n is the total number of verification consumption time; select the minimum value in the sequence J and record it as Min(J), where the verification consumption time corresponding to Min(J) is Tc Min , and remember to satisfy Tc k ≤Tc Min The high-concurrency request corresponding to the verification consumption time is a short verification request, and all high-concurrency requests except the short verification request are recorded as long verification requests; The verification end is used to verify the unlocking request; the verification end obtains the maximum number N of simultaneous verifications and the total number m of the high-concurrency requests, and when m≥N, selects N / 2 long verification requests from long to short for verification according to the verification consumption time, and selects N / 2 short verification requests from short to long for verification, and generates unlocking instructions for each high-concurrency request; Unlock instruction processing module: for any unlock instruction, get the priority value of each unlock instruction ,in α , β is the preset weight coefficient, and α > β >0, Q max is the maximum authorization level index, Q is the authorization level index corresponding to the unlocking instruction; the unlocking instructions are sorted from high to low according to the priority value, and each unlocking instruction is executed in sequence according to the sorted order.

[0006] As a further solution of the present invention: the identity information includes the employee ID and name of the manager.

[0007] As a further solution of the present invention: the process of obtaining the authorization level index of the manager includes: Get all the job levels of managers, divide each job level into several job level intervals, set an authorization level for each job level interval, and obtain several authorization levels; sort each authorization level from low to high and number them 1, 2, ..., num in sequence, where num is the total number of authorization levels; then the number corresponding to each authorization level is the authorization level index.

[0008] As a further solution of the present invention: when m<N, m / 2 long check requests are selected from long to short for verification according to the verification time consumption, and m / 2 short check requests are selected from short to long for verification, and unlocking instructions for each high concurrency request are generated.

[0009] As a further solution of the present invention: when N is an odd number, select the verification time from the longest to the shortest. Long check requests are checked and selected in order from short to long A short verification request is used for verification, and an unlocking instruction for each high-concurrency request is generated.

[0010] As a further solution of the present invention: the process of the verification end for verifying the unlocking request includes: The verification process is based on the SM2 encryption algorithm; the generating end generates a private key through the SM2 encryption algorithm, and the verifying end generates a public key through the SM2 encryption algorithm; the generating end signs the unlocking request through the SM2 digital signature algorithm and the private key to obtain the signature identifier sign; the unlocking request and the signature identifier are processed through Java to generate a response message, and the response message is sent to the verifying end, the verifying end verifies the signature of the response message through the SM2 signature verification algorithm and the public key, and generates a reply message, and sends the reply message to the generating end.

[0011] As a further solution of the present invention: the weight coefficient is obtained by constructing a hierarchical model and a pairwise comparison matrix.

[0012] As a further solution of the present invention: if there are g consecutive application times, |Tmin-Tmax|>t or g<G, the g application times are sorted from early to late, and each unlocking request is verified in turn according to the sorted application time.

[0013] Beneficial effects of the present invention: The present invention can ensure that only authorized personnel can access the safe in the vault by using encrypted communication and identity authentication; reduce the risk of unauthorized access and protect the valuables stored in the safe; the initial request processing module can identify high-concurrency requests and optimize the processing order according to network conditions and the verification consumption time of the requests; this method can reduce waiting time and improve processing speed; by distinguishing short verification requests from long verification requests and adopting different verification strategies, it can improve processing efficiency while ensuring security; the unlocking request processing module sorts according to the priority value of the unlocking instruction to ensure that high-priority requests can be responded to quickly; this dynamic sorting mechanism can adjust the execution order according to the real-time situation, thereby improving the flexibility and response speed of the system; the present invention can adapt to different network conditions and request loads to ensure that high performance can be maintained in different environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The present invention will be further described below in conjunction with the accompanying drawings.

[0015] Figure 1 The invention discloses a structural schematic diagram of a safe deposit box unlocking system based on encrypted communication. DETAILED DESCRIPTION

[0016] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0017] See also Figure 1 As shown, the present invention is a safe deposit box unlocking system based on encrypted communication, comprising: Unlock request generation module: including an application end and a generation end; the application end obtains the identity information and safe ID of the manager and records the application time; the generation end obtains the authorization level index of the manager according to the identity information, and generates an unlock request according to the identity information, safe ID and application time; It is understandable that the identity information of the manager is obtained to verify the legitimacy of the request and ensure that only authorized managers can initiate unlocking requests; the safe ID is used to specify which specific safe needs to be opened to ensure the accuracy of the operation; the application time is used to track the timestamp of the request; As a preferred embodiment of the present invention, the identity information includes the employee ID and name of the manager; As a preferred embodiment of the present invention, the process of obtaining the authorization level index of the manager includes: Obtain all job levels of managers, divide each job level into several job level intervals, and set authorization levels for each job level interval to obtain several authorization levels; sort each authorization level from low to high and number them 1, 2, ..., num in sequence, where num is the total number of authorization levels; then the number corresponding to each authorization level is the authorization level index; It can be understood that the importance of the documents in the safe required by the manager who initiates the unlocking request is determined according to the authorization level index of the manager; managers with higher authorization level indexes usually hold higher positions and bear more important responsibilities in the organization; therefore, the business they need to handle is often of higher importance; Unlock request processing module: including a preprocessing end and a verification end; the preprocessing end obtains the application time of each unlock request, and if |Tmin-Tmax|≤t and g≥G are satisfied within a time interval [Tmin, Tmax] consisting of g consecutive application times, where t is a preset time difference threshold and G is a preset number threshold, then all unlock requests within the time interval are recorded as high-concurrency requests; Get the IP address of the safe ID corresponding to the high-concurrency request, obtain the distance d between the generating end and the IP address, and obtain the verification consumption time Tc=2d / v of the high-concurrency request, where v is the current network transmission rate; according to the verification consumption time of each high-concurrency request, get the sequence , where Tc k is the kth verification consumption time, n is the total number of verification consumption time; select the minimum value in the sequence J and record it as Min(J), where the verification consumption time corresponding to Min(J) is Tc Min , and remember to satisfy Tc k ≤Tc Min The high-concurrency request corresponding to the verification consumption time is a short verification request, and all high-concurrency requests except the short verification request are recorded as long verification requests; The verification end is used to verify the unlocking request; the verification end obtains the maximum number N of simultaneous verifications and the total number m of the high-concurrency requests, and when m≥N, selects N / 2 long verification requests from long to short for verification according to the verification consumption time, and selects N / 2 short verification requests from short to long for verification, and generates unlocking instructions for each high-concurrency request; It can be understood that if a number of consecutive unlocking requests satisfy |Tmin-Tmax|≤t and g≥G, these unlocking requests are a large number of unlocking requests initiated in a short period of time, so they are recorded as high-concurrency requests; the time difference threshold and the number threshold are reasonably set and adjusted according to actual business needs, system performance and security requirements. In general, the time difference threshold is set to be less than or equal to 10 minutes, and the number threshold is greater than or equal to 5; As a preferred embodiment of the present invention, if there are g consecutive application times, |Tmin-Tmax|>t or g<G, the g application times are sorted from early to late, and each unlocking request is verified in turn according to the sorted application time; It can be understood that if there are g consecutive application times, |Tmin-Tmax|>t or g<G, then these application times are not the situation where a large number of requests appear in a short period of time, and they can be directly checked from early to late according to the application time; As a preferred embodiment of the present invention, when m<N, m / 2 long check requests are selected from long to short according to the check consumption time for verification, and m / 2 short check requests are selected from short to long for verification, and unlocking instructions for each high concurrent request are generated; As a preferred embodiment of the present invention, when N is an odd number, the verification time is selected from the longest to the shortest. Long check requests are checked and selected in order from short to long A short verification request is performed to verify and generate unlocking instructions for each high-concurrency request; It can be understood that the maximum number N of simultaneous checks represents that there are N positions that can be checked simultaneously, and the check of the long check request consumes longer time, so more positions are required for checking to ensure the rate, so the number of positions selected by the long check request is N / 2 rounded up, and the number of positions selected by the short check request is N / 2 rounded down; As a preferred embodiment of the present invention, the process of the verification end for verifying the unlocking request includes: The verification process is based on the SM2 encryption algorithm; the generating end generates a private key through the SM2 encryption algorithm, and the verifying end generates a public key through the SM2 encryption algorithm; the generating end signs the unlocking request through the SM2 digital signature algorithm and the private key to obtain a signature identifier sign; the unlocking request and the signature identifier are processed by Java to generate a response message, and the response message is sent to the verifying end, the verifying end verifies the signature of the response message through the SM2 signature verification algorithm and the public key, and generates a reply message, and sends the reply message to the generating end; It should be noted that the private key is used to sign the sent message, and the public key is used to verify the signature of the received message; the production end and the verification end exchange the public key of the SM2 encryption algorithm through a secure mailbox; the unlocking request is recorded as biz_content, and the signature identifier sign is obtained after signing biz_content; in Java, a Map object is created through libraries such as Gson or Jackson, biz_content and sign are placed in it, and the Map object is converted into a string in Json format, and a request is sent to the verification end through Socket; the getOutputStream() method of the Socket class can be used to obtain the output stream, and then the PrintWriter class is used to write the Json string into the output stream; For each interface, the response message examples of the unlock request after signing are as follows: {"sign":"abcdefg123456","biz_content":"{"srvId":"10","box_id":"00-0000338969"}"}; For each interface, the response message examples after signature verification are as follows: {"sign":"abcdefg123456","biz_content":"{"srvId":"10","error_code":"00"," error_message":""}"}\n; Unlock instruction processing module: for any unlock instruction, get the priority value of each unlock instruction ,in α , β is the preset weight coefficient, and α > β >0, Q max is the maximum authorization level index, Q is the authorization level index corresponding to the unlocking instruction; the unlocking instructions are sorted from high to low according to the priority value, and each unlocking instruction is executed in sequence according to the sorted order; It is worth noting that after the safe is unlocked, the unlocking result is fed back to the generating end, and the unlocking result includes the ID of the unlocked safe; the generating end verifies the safe ID again, and the verification process is as follows: The ID of the unlocked safe in the unlocking result is recorded as the completion ID, and the safe ID is compared with the completion ID to determine whether the two are the same. If they are the same, the unlocking is correct; otherwise, there is an error in the unlocking process; As a preferred embodiment of the present invention, the weight coefficient is obtained by constructing a hierarchical model and a pairwise comparison matrix; It should be noted that the hierarchical model is constructed, the target layer is determined, the criterion layer is set, and the solution layer is established. Graphical tools (such as tree diagrams, network diagrams, etc.) are used to intuitively display the above-mentioned layers and their relationships; the target layer, criterion layer and solution layer are connected from top to bottom to form an inverted tree structure; then a pairwise comparison matrix is ​​constructed, a questionnaire or interview outline is designed, and specific pairwise comparison questions are formulated for each criterion; data is collected, and pairwise comparisons are performed on the elements of each level to obtain the original scoring data; for each criterion, the solutions under the criterion are paired with each other, and the matrix is ​​filled in according to the collected scoring data; the main diagonal elements of the matrix are 1 (compared with themselves), and the remaining position elements are the degree of advantage of solution i relative to solution j under the criterion; the consistency ratio (CR) of each pairwise comparison matrix is ​​calculated. If the CR value exceeds the threshold (usually 0.1), it is considered that the judgment matrix has poor consistency; the eigenvalue method or other algorithms are used to solve the eigenvectors of each single criterion pairwise comparison matrix, and the weight of each solution under each criterion is obtained after normalization; then the total ranking weight of each solution is calculated by weighted summation in combination with the weight of the criterion layer.

[0018] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. A safe deposit box unlocking system based on encrypted communication, characterized in that: include: Unlock request generation module: including an application end and a generation end; the application end obtains the identity information of the manager and the safe ID, and records the application time; The generating end obtains the authorization level index of the manager according to the identity information, and generates an unlocking request according to the identity information, the safe ID and the application time; Unlock request processing module: including a preprocessing end and a verification end; the preprocessing end obtains the application time of each unlock request, and if |Tmin-Tmax|≤t and g≥G are satisfied within a time interval [Tmin, Tmax] consisting of g consecutive application times, where t is a preset time difference threshold and G is a preset number threshold, then all unlock requests within the time interval are recorded as high-concurrency requests; Get the IP address of the safe ID corresponding to the high-concurrency request, obtain the distance d between the generating end and the IP address, and obtain the verification consumption time Tc=2d / v of the high-concurrency request, where v is the current network transmission rate; according to the verification consumption time of each high-concurrency request, get the sequence , where Tc k is the kth verification consumption time, n is the total number of verification consumption time; select the minimum value in the sequence J and record it as Min(J), where the verification consumption time corresponding to Min(J) is Tc Min , and remember to satisfy Tc k ≤Tc Min The high-concurrency request corresponding to the verification consumption time is a short verification request, and all high-concurrency requests except the short verification request are recorded as long verification requests; The verification end is used to verify the unlocking request; The verification end obtains the maximum number N of simultaneous verifications and the total number m of the high-concurrency requests. When m≥N, N / 2 long verification requests are selected from long to short in order according to the verification time consumption, and N / 2 short verification requests are selected from short to long in order for verification, and unlocking instructions for each high-concurrency request are generated; Unlock instruction processing module: for any unlock instruction, get the priority value of each unlock instruction ,in α , β is the preset weight coefficient, and α > β >0, Q max is the maximum authorization level index, Q is the authorization level index corresponding to the unlocking instruction; the unlocking instructions are sorted from high to low according to the priority value, and each unlocking instruction is executed in sequence according to the sorted order.

2. A safe deposit box unlocking system based on encrypted communication according to claim 1, characterized in that: The identity information includes the employee ID and name of the manager.

3. According to claim 1, a safe deposit box unlocking system based on encrypted communication is characterized in that: The process of obtaining the authorization level index of the manager includes: Get all the job levels of managers, divide each job level into several job level intervals, set an authorization level for each job level interval, and obtain several authorization levels; sort each authorization level from low to high and number them 1, 2, ..., num in sequence, where num is the total number of authorization levels; then the number corresponding to each authorization level is the authorization level index.

4. A safe deposit box unlocking system based on encrypted communication according to claim 1, characterized in that: If there are g consecutive application times, |Tmin-Tmax|>t or g<G, the g application times are sorted from early to late, and each unlocking request is verified in turn according to the sorted application time.

5. According to the encrypted communication-based safe unlocking system of claim 1, it is characterized in that: When m<N, m / 2 long check requests are selected from long to short according to the check consumption time for verification, and m / 2 short check requests are selected from short to long for verification, and unlocking instructions for each high concurrency request are generated.

6. A safe deposit box unlocking system based on encrypted communication according to claim 1, characterized in that: When N is an odd number, select the verification time from long to short. Long check requests are checked and selected in order from short to long A short verification request is used for verification, and an unlocking instruction for each high-concurrency request is generated.

7. A safe deposit box unlocking system based on encrypted communication according to claim 1, characterized in that: The process of the verification end for verifying the unlocking request includes: The verification process is based on the SM2 encryption algorithm; the generating end generates a private key through the SM2 encryption algorithm, and the verifying end generates a public key through the SM2 encryption algorithm; the generating end signs the unlocking request through the SM2 digital signature algorithm and the private key to obtain the signature identifier sign; the unlocking request and the signature identifier are processed through Java to generate a response message, and the response message is sent to the verifying end, the verifying end verifies the signature of the response message through the SM2 signature verification algorithm and the public key, and generates a reply message, and sends the reply message to the generating end.

8. The safe deposit box unlocking system based on encrypted communication according to claim 1, characterized in that: The weight coefficients are obtained by constructing a hierarchical model and a pairwise comparison matrix.

Images