Credit granting method and system for gate equipment bound with hardware unique identification code
By binding the hardware unique identification code and generating the device token, the untrustworthy problem of the communication between the door gate device and the server is solved, the reliability and security of the device is ensured, the interaction process is simplified and the risk of errors is reduced.
Patent Information
- Application Number
- CN202411882271.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-19
- Publication Date
- 2025-03-21
AI Technical Summary
HTTP communication between existing gate gate equipment and servers is prone to packet hijacking, and lacks uniqueness verification, resulting in untrustworthy problems.
By binding the hardware unique identification code, the device token is generated, the physical unique identification code and authorization key are used for obfuscation, and the legality of the device token is verified through the server to ensure the uniqueness and security of the device.
It effectively ensures the reliability and security of the door gate equipment, prevents the reuse of device tokens after messaging and communication are captured, simplifies the interaction process and reduces the risk of errors.
Smart Images
Figure CN119675973A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to electronic security technology, and more specifically, to a gate device credit authorization method and system bound to a hardware unique identification code. Background Art
[0002] As part of the smart security supervision system, the gate device undertakes the functions of face recognition, identity authentication, attendance and access control, etc. Due to its low manufacturing cost, it is impossible to perform too complex calculations on it. At the same time, considering the construction cost of the server, without using a large-scale IoT platform, the interaction between the gate device and the server is mainly based on the HTTP protocol.
[0003] There is currently an untrustworthy problem between the gate device and the server. The main reasons are:
[0004] 1. HTTP communication is easily hijacked and illegally modified;
[0005] 2. The server lacks uniqueness verification of the gate device. If a user applies a device authorization to two or more gate devices at the same time, the server cannot identify it. Summary of the invention
[0006] The technical problem to be solved by the present invention is to provide a gate device credit authorization method and system bound to a hardware unique identification code in view of the deficiencies in the prior art, thereby ensuring the reliability and security of the gate device.
[0007] The present invention provides a gate device credit authorization method for binding a hardware unique identification code, the method comprising:
[0008] The first step is to apply for device authorization and authorization key for the gate device;
[0009] Step 2: Select a matching SDK according to the operating system type of the gate device;
[0010] Step 3: Install the SDK, device authorization and authorization key into the gate device;
[0011] Step 4: Collect the physical unique identification code of the gate device, and confuse the physical unique identification code and the authorization key to obtain a device token; the SDK reads the device token and sends a verification request to the server;
[0012] Step 5: The server verifies the legitimacy of the device token, and if the device token is legitimate, decodes the physical unique identification code in the device token;
[0013] Step 6: Bind the physical unique identification code obtained in step 5 to the device authorization.
[0014] Preferably, in the fourth step, the obfuscation process is specifically:
[0015] Concatenate the physical unique identification code and the authorization key to obtain a code string;
[0016] Obtaining a current time series, and then inserting the time series into the code string at intervals to form an obfuscated physical unique identification code;
[0017] The obfuscated physical unique identification code is encrypted to obtain the device token.
[0018] Preferably, the time series adopts a millisecond timestamp, and the millisecond timestamp is converted into a character string according to a set character string format, and the character string is inserted into the code string every other frame.
[0019] Preferably, verifying the legitimacy of the device token is specifically as follows:
[0020] Decoding the device token to obtain a decoded string, and then decrypting the decoded string to obtain a decoding result;
[0021] Extract characters from the decoded result at alternate frames, and then verify whether the extracted characters meet the set string format. If so, obtain the remaining string of the decoded result after the alternate frame extraction, and calibrate whether there are characters identical to the authorization key in the remaining string. If so, cut off the part of the remaining string that is identical to the authorization key to obtain the target string;
[0022] It is determined whether the target character string is bound to other device authorizations other than the device authorizations. If not, the verification is passed.
[0023] Preferably, the calibration of whether there are characters identical to the authorization key in the remaining character string is specifically as follows:
[0024] Obtain n-bit characters whose median number is consistent with the number of digits in the authorization key, compare the character string consisting of the n-bit characters with the authorization key, and if the character string consisting of the n-bit characters is consistent with the authorization key, determine whether there are characters in the remaining character string that are the same as the authorization key; wherein n is a natural number.
[0025] Preferably, if the extracted characters do not satisfy the set character string format and the remaining character string does not contain the same characters as the authorization key, an error message is returned to the gate device.
[0026] Preferably, if the extracted characters satisfy a set string format, the extracted characters are further subjected to anti-leakage verification.
[0027] Preferably, the anti-leakage verification is specifically:
[0028] It is queried whether the data submitted by the gate device within the set time contains a string consisting of the extracted characters. If the same string is found, a verification failure is returned to the gate device; if the same string is not found, it means that the anti-leakage verification has passed.
[0029] Preferably, the setting time is 5-10 minutes.
[0030] A system for implementing the gate device credit authorization method bound to a hardware unique identification code, comprising:
[0031] A collection module is used to apply for device authorization and authorization key of the gate device, select a matching SDK according to the operating system type of the gate device, install the SDK, device authorization and authorization key into the gate device, and collect the physical unique identification code of the gate device;
[0032] The device token generation module is used to confuse the physical unique identification code and the authorization key to obtain a device token; the SDK reads the device token and sends a verification request to the server;
[0033] A device token verification module, used to verify the legitimacy of the device token through the server, and if the device token is legitimate, decode the physical unique identification code in the device token;
[0034] The device authorization binding module is used to bind the physical unique identification code and the device authorization.
[0035] Beneficial Effects
[0036] The advantages of the present invention are:
[0037] 1. The present invention constructs a device token through a physical unique identification code and an authorization key. The physical unique identification code obfuscation algorithm and the corresponding server-side verification algorithm used by the device token can ensure that even if the message communication is captured and read, the device token cannot be reused. This ensures the reliability and security of the gate device.
[0038] 2. The credit verification of the gate device of the present invention adopts the strategy of instant verification by instant communication, and does not require additional operations such as pre-authorization and activation, which simplifies the interaction process and reduces the risk of errors.
[0039] 3. The SDK of the present invention only realizes a single function, that is, reading the hardware unique identification code and generating a device token. It does not invade the core business of the gate device, and the installation and upgrade cost is low. BRIEF DESCRIPTION OF THE DRAWINGS
[0040] Figure 1 A schematic diagram of the flow of the gate device credit authorization method for binding a hardware unique identification code of the present invention;
[0041] Figure 2 A schematic diagram of inserting a millisecond-level timestamp character string into a code string every other frame according to the present invention;
[0042] Figure 3 This is a schematic diagram of extracting characters from alternate frames of the decoding result of the present invention. DETAILED DESCRIPTION
[0043] The present invention will be further described below in conjunction with the embodiments, but it does not constitute any limitation to the present invention. Any limited number of modifications made by anyone within the scope of the claims of the present invention are still within the scope of the claims of the present invention.
[0044] See also Figure 1 The present invention provides a gate device authorization method that is bound to a hardware unique identification code. The unique identification code of the hardware device is read through the SDK shared library, and after obfuscating and encrypting the identification code, the device authorization provided by the server, the time series and other information, a device token is generated and authorized and verified by the server. The server decrypts the device token to verify the legitimacy of the content therein.
[0045] Specifically, the method comprises the following steps:
[0046] Step 1: The user (including the equipment supplier) submits the equipment access application. After the administrator reviews and approves it, the device authorization and 32-bit authorization key are obtained. In this embodiment, the user's gate device type is RV1109, the obtained device authorization is: TEST202435001, and the 32-bit authorization key is 0E6BBBAA775D562C978A49F5438BE674 as an example.
[0047] Step 2: The device supplier installs the SDK corresponding to the gate device operating system into the gate device operating system (or burns it into the gate operating system installation image). In this embodiment, the operating system corresponding to the gate device is linux-arm. Start the gate device, and the processing method is divided into the following according to the SDK loading result:
[0048] If SDK loading fails, please contact the SDK developer to obtain the latest compatible version.
[0049] If the SDK is loaded successfully, proceed to step 3.
[0050] The SDK is written in C language, and the delivered product only contains dynamic link libraries and necessary header files, so the risk of being cracked is low. In addition, the SDK is written in pure C language and provides cross-platform capabilities through cross-compilation, which can adapt to different versions of target systems (including but not limited to linux-x86, linux-x64, linux-arm, linux-aarch64).
[0051] Step 3: Start the gate device, install the device authorization and authorization key into the gate device, and the gate device begins to prepare for the first call to the server interface for message communication.
[0052] Step 4: The gate device calls the SDK interface GetHwCode.
[0053] Step 5: SDK starts collecting physical unique identification codes through the hardware unique identification code collection module. For RV1109 type gate devices, the collection command is: "cat / proc / cpuinfo|grep Serial". The processing methods are divided into the following according to the collection results:
[0054] If the collection fails, contact the SDK developer to check the problem;
[0055] If the collection is successful, proceed to step 6; in this embodiment, assume that the collected physical unique identification code is "MKSC000301".
[0056] Step 6: Concatenate the physical unique identification code and the authorization key to obtain the following code string:
[0057] "MKSC0003010E6BBBAA775D562C978A49F5438BE674".
[0058] Step 7: Get the current millisecond timestamp and convert it into a string that meets the fixed format of "yyyyMMddHHmmssSSSSSS". Assume that its value is "20241210091532584938". Then insert the string into the code string generated in step 6 every other frame. The specific process is as follows Figure 2 As shown. The final output obfuscated physical unique identification code is:
[0059] "M2K0S2C401020130001901E563B2B5B8A4A973785D562C978A49F5438BE674".
[0060] Step 8: Encrypt the obfuscated physical unique identification code generated in step 7 using the method agreed upon with the server and output it in Base64 encoding. In this embodiment, the AES algorithm is used for encryption, the key is "XnKfDF0s3H6CZM8n", and the calculation method is:
[0061] $temporary result 1 = Aes.encode($step 7 result, $key = XnKfDF0s3H6CZM8n);
[0062] $final result = Base64.encode($temporary result 1).
[0063] The final output is:
[0064] "Db4uPREiIsNTe8I4KMgmRxsqVzY / tItjYK099U2 / evWgnHfNxfNapMimJpgcw4ANnXYETVS6q1bppivGImdgJw==".
[0065] Step 9: Use the output result of step 8 as the device token, package it into the Http Header of the gate device message, and then transmit it to the server.
[0066] Step 10: The server receives the gate device message and reads the device token from the Http Header. The processing methods are divided into the following according to the reading results:
[0067] If the device token cannot be read, verification failure is returned to the gate device;
[0068] If the device token is read successfully, go to step 11.
[0069] Step 11: The server decodes the device token read in step 10 by Base64, and decrypts the Base64-decoded string using the method agreed with the SDK. In this embodiment, the AES algorithm is used for decryption, and the key is "XnKfDF0s3H6CZM8n", and the calculation method is:
[0070] $tempResult1 = Base64.decode($deviceToken);
[0071] $decoding result = Aes.decode($temporary result 1, $key = XnKfDF0s3H6CZM8n).
[0072] The calculated decoding result is:
[0073] "M2K0S2C401020130001901E563B2B5B8A4A973785D562C978A49F5438BE674";
[0074] The processing methods are divided into the following according to the decryption results:
[0075] If the decryption calculation process fails, the verification failure is returned to the gate device;
[0076] If the decryption calculation is successful, proceed to step 12.
[0077] Step 12: To echo the obfuscation algorithm in step 7, extract one character from the decoded result obtained in step 11 every other frame, and then verify whether the extracted result satisfies the string format of "yyyyMMddHHmmssSSSSSS". In this embodiment, a total of 20 extractions are performed to form a new string. The extraction process is as follows: Figure 3 As shown. The final extraction result should be "20241210091532584938". The extraction results are processed and verified according to the string format and are divided into:
[0078] If the verification string does not meet the format, the verification failure is returned to the gate device;
[0079] If the format is satisfied, go to step 13.
[0080] Step 13: Use the extraction result obtained in step 12, such as "20241210091532584938", to check the server cache and query whether the data submitted by the gate device within 5 minutes contains this value. The processing results are divided into:
[0081] If the same data is found, it means that the message is not credible and may be copied or tampered with, and the verification failure is returned to the gate device;
[0082] If the same data cannot be found, it means the verification is passed. The result "20241210091532584938" is first stored in the server cache for the next check, and then go to step 14.
[0083] Step 14: Obtain the remaining character string of the decoding result after frame extraction. In this embodiment, the remaining character string should be: "MKSC0003010E6BBBAA775D562C978A49F5438BE674". In this remaining character string, the verification result should satisfy that the last 32 bits of the character string are the same as the authorization key. Therefore, the processing results are divided into:
[0084] If the last 32 bits of the remaining character string are different from the authorization key, it means that the authorization key is wrong, and an error message is returned to the gate device;
[0085] If the last 32 bits of the remaining character string are the same as the authorization key, it means that the verification is passed, and then proceed to step 15.
[0086] Step 15: After the last 32 bits of the remaining string in step 14 are cut off, the final target string in this embodiment should be "MKSC000301", which is the physical unique identification code of the gate device. Use this physical unique identification code to query whether it is bound to other device authorizations other than the device authorization. In this embodiment, check whether it is bound to other device authorizations other than "TEST202435001", and the processing results are divided into:
[0087] It is found that other authorizations other than "TEST202435001" have been bound, and an error message is returned to the gate device;
[0088] If no other authorizations other than "TEST202435001" are found, the verification is successful, and then proceed to step 16.
[0089] Step 16: In this embodiment, the physical unique identification code "MKSC000301" of the gate device and the device authorization "TEST202435001" are bound. After the binding is successful, the subsequent business interface processing logic is entered.
[0090] The invention also discloses a system for implementing the gate device credit authorization method bound to the hardware unique identification code, the system comprises a collection module, a device token generation module, a device token verification module and a device authorization binding module.
[0091] Among them, the acquisition module is used to apply for the device authorization and authorization key of the gate device, and select the matching SDK according to the operating system type of the gate device, install the SDK, device authorization and authorization key into the gate device, and collect the physical unique identification code of the gate device. The acquisition module is deployed in the gate device SDK and is used to read the physical unique identification code of the gate device. In the gate device, the common non-tamperable physical unique identification codes are mainly the following: CpuID, System Serial, DevID, UUID and AndroidID (specifically used for Android devices). This module reads the physical unique identification code of the gate device and provides it to the device token generation module for use.
[0092] The device token generation module is used to confuse the physical unique identification code and the authorization key to obtain the device token; the SDK reads the device token and sends a verification request to the server. This module is deployed in the gate device SDK and is used to confuse the physical unique identification code with the time series and the authorization key, and then encrypt it using the method agreed with the server (reversible algorithms such as AES and RAS), and finally use Base64 encoding to convert the entire device token into an ASCII code string that can be directly transmitted over the network.
[0093] Regarding the physical unique identification code obfuscation process: the original physical unique identification code and the authorization key are concatenated to generate a new code string. The time series uses millisecond timestamps to ensure that the gate device is unique each time it is acquired and cannot be reversed. The millisecond timestamp is converted into a string that meets the fixed format of "yyyyMMddHHmmssSSSSSS", and inserted into the generated code string every other frame, and finally the obfuscated physical unique identification code is output.
[0094] The device token verification module is used to verify the legitimacy of the device token through the server, and when the device token is legal, decode the physical unique identification code in the device token. This module is deployed on the server, and is used to perform Base64 decoding on the device token transmitted through the network, and then decrypt it using the method agreed with the device token generation module (reversible algorithms such as AES and RAS). Finally, according to the physical unique identification code obfuscation algorithm, the obfuscated string decrypted in the previous step is restored into three key attributes: physical unique identification code, time series, and authorization key. The unique legitimacy of the device is verified through these three key attributes to ensure that the device is trustworthy.
[0095] The device authorization binding module is used to bind the physical unique identification code and the device authorization, that is, to bind the gate device unique identification code and the device authorization one-to-one to support the verification work of the device token verification module.
[0096] The above is only a preferred embodiment of the present invention. It should be pointed out that for those skilled in the art, several modifications and improvements can be made without departing from the structure of the present invention, which will not affect the effect of the implementation of the present invention and the practicality of the patent.
Claims
1. A gate device credit authorization method bound to a hardware unique identification code, characterized in that: The method is: The first step is to apply for device authorization and authorization key for the gate device; Step 2: Select a matching SDK according to the operating system type of the gate device; Step 3: Install the SDK, device authorization and authorization key into the gate device; Step 4: Collect the physical unique identification code of the gate device, and confuse the physical unique identification code and the authorization key to obtain a device token; The SDK reads the device token and sends a verification request to the server; Step 5: The server verifies the legitimacy of the device token, and if the device token is legitimate, decodes the physical unique identification code in the device token; Step 6: Bind the physical unique identification code obtained in step 5 to the device authorization.
2. A gate device credit authorization method binding hardware unique identification code according to claim 1, characterized in that: In the fourth step, the obfuscation process is specifically as follows: Concatenate the physical unique identification code and the authorization key to obtain a code string; Obtaining a current time series, and then inserting the time series into the code string at intervals to form an obfuscated physical unique identification code; The obfuscated physical unique identification code is encrypted to obtain the device token.
3. A gate device credit authorization method binding hardware unique identification code according to claim 2, characterized in that: The time series uses a millisecond timestamp, and the millisecond timestamp is converted into a character string according to a set character string format, and the character string is inserted into the code string every other frame.
4. A gate device credit authorization method binding hardware unique identification code according to claim 1, characterized in that: Verifying the legitimacy of the device token is as follows: Decoding the device token to obtain a decoded string, and then decrypting the decoded string to obtain a decoding result; Extract characters from the decoded result at alternate frames, and then verify whether the extracted characters meet the set string format. If so, obtain the remaining string of the decoded result after the alternate frame extraction, and calibrate whether there are characters identical to the authorization key in the remaining string. If so, cut off the part of the remaining string that is identical to the authorization key to obtain the target string; It is determined whether the target character string is bound to other device authorizations other than the device authorizations. If not, the verification is passed.
5. A gate device credit authorization method bound to a hardware unique identification code according to claim 4, characterized in that: Check whether there are characters in the remaining character string that are identical to the authorization key, specifically: Obtain n-bit characters whose median number is consistent with the number of digits in the authorization key, compare the character string consisting of the n-bit characters with the authorization key, and if the character string consisting of the n-bit characters is consistent with the authorization key, determine whether there are characters in the remaining character string that are the same as the authorization key; wherein n is a natural number.
6. A gate device credit authorization method binding hardware unique identification code according to claim 4, characterized in that: If the extracted characters do not meet the set character string format and the remaining character string does not contain the same characters as the authorization key, an error message is returned to the gate device.
7. A gate device credit authorization method binding hardware unique identification code according to claim 4, characterized in that: If the extracted characters meet the set string format, the extracted characters continue to be checked for leakage.
8. A gate device credit authorization method bound to a hardware unique identification code according to claim 7, characterized in that: The anti-leakage verification is specifically as follows: It is queried whether the data submitted by the gate device within the set time contains a string consisting of the extracted characters. If the same string is found, a verification failure is returned to the gate device; if the same string is not found, it means that the anti-leakage verification has passed.
9. A gate device credit authorization method bound to a hardware unique identification code according to claim 8, characterized in that: The setting time is 5-10 minutes.
10. A system for implementing the gate device credit authorization method bound to a hardware unique identification code as described in any one of claims 1 to 9, characterized in that: include: A collection module is used to apply for device authorization and authorization key of the gate device, select a matching SDK according to the operating system type of the gate device, install the SDK, device authorization and authorization key into the gate device, and collect the physical unique identification code of the gate device; A device token generation module, used for performing obfuscation processing on the physical unique identification code and the authorization key to obtain a device token; The SDK reads the device token and sends a verification request to the server; A device token verification module, used to verify the legitimacy of the device token through the server, and if the device token is legitimate, decode the physical unique identification code in the device token; The device authorization binding module is used to bind the physical unique identification code and the device authorization.