Authentication device and authentication system

Abstract

The present disclosure relates to the technical field of security authentication, and discloses an authentication device and an authentication system, wherein the authentication device includes a security unit, a main controller, and a plurality of communication components, wherein a part of the communication components is directly connected to the security unit, and another part of the communication components is connected to the security unit through the main controller; the security unit is configured to: upon receiving different authentication requests sent by a user terminal through different communication components, store each authentication request in a cache area; process each authentication request in turn, generate response data corresponding to each authentication request, and transmit each response data to the main controller. The above-mentioned authentication device can ensure that all authentication requests will not be lost, and the integrity of the request can be guaranteed even under high load conditions. The authentication requests in the cache area are actively processed in an orderly manner by the security unit. This method reduces the waiting time for authentication requests and helps to improve the overall authentication efficiency.

Description

Technical Field

[0001] The present disclosure relates to the technical field of security authentication, for example, to an authentication device and an authentication system. Background Art

[0002] An authentication system (such as a digital key system) is a technical system for verifying user authority. The system usually includes a user terminal and an authentication device. The authentication device includes a controller and a security unit, and the user terminal can be carried by the user. There are multiple communication channels in the authentication system, which are connected to the security unit through the controller. The user terminal can send an authentication request to the security unit through these communication channels, and the security unit can transmit the response data corresponding to the authentication request to the controller, and the controller then performs corresponding operations based on the response data.

[0003] In the related art, if the user terminal sends authentication requests to the security unit through multiple communication channels at the same time or in a short period of time, these authentication requests cannot reach the security unit at the same time and can only be polled and waited by the controller. Since the controller can only process authentication requests one by one when calling the security unit, some authentication requests may be lost during the waiting process and the authentication process cannot be completed normally. Even if the authentication requests that are not processed immediately are not lost, these requests must wait for the previous authentication request to be processed and the next polling of the controller to arrive before they can be sent to the security unit for processing. Since the polling process of the controller is relatively long, this will extend the waiting time of the authentication request and affect the overall authentication efficiency.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] In order to provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. The summary is not an extensive review, nor is it intended to identify key / critical components or delineate the scope of protection of these embodiments, but rather serves as a prelude to the detailed description that follows.

[0006] The embodiments of the present disclosure provide an authentication device and an authentication system, which can ensure that all authentication requests are not lost, and can also reduce the waiting time of authentication requests, thereby improving the overall authentication efficiency.

[0007] According to a first aspect of the present disclosure, an authentication device is provided, the authentication device comprising a security unit, a main controller and a plurality of communication components, a part of the communication components being directly connected to the security unit, and another part of the communication components being connected to the security unit through the main controller;

[0008] The security unit is configured as:

[0009] When receiving different authentication requests sent by a user terminal through different communication components, storing each authentication request in a cache area;

[0010] Each authentication request is processed in sequence, response data corresponding to each authentication request is generated, and each response data is transmitted to the main controller.

[0011] In some embodiments, the security unit is configured to: when receiving different authentication requests sent by a user terminal through different communication components, store each authentication request in a cache area corresponding to the communication component that receives the authentication request.

[0012] In some embodiments, the security unit is configured to:

[0013] Determine the priority of each authentication request, and then loop through the following steps:

[0014] Process the authentication request with the highest current priority, and generate response data corresponding to the authentication request with the highest current priority;

[0015] The response data corresponding to the authentication request with the highest current priority is transmitted to the main controller.

[0016] In some embodiments, the main controller and the safety unit are connected via a first signal line and a second signal line, and the safety unit is configured as follows:

[0017] Determine the priority of each authentication request, and then loop through the following steps:

[0018] Process the current highest priority authentication request and generate response data corresponding to the current highest priority authentication request;

[0019] Sending prompt information to the main controller via the first signal line, wherein the prompt information is used to prompt the main controller to prepare to receive the response data;

[0020] The response data corresponding to the current authentication request with the highest priority is transmitted to the main controller via the second signal line.

[0021] In some embodiments, there are multiple first signal lines, each communication component corresponds to one first signal line, and the security unit is configured as follows:

[0022] Determine the priority of each authentication request, and then loop through the following steps:

[0023] Process the current highest priority authentication request and generate response data corresponding to the current highest priority authentication request;

[0024] Sending prompt information to the main controller via the first signal line corresponding to the communication component that receives the current highest priority authentication request;

[0025] The response data corresponding to the current authentication request with the highest priority is transmitted to the main controller via the second signal line.

[0026] In some embodiments, the number of the first signal line is one, and the security unit is configured as follows:

[0027] Determine the priority of each authentication request, and then loop through the following steps:

[0028] Process the current highest priority authentication request and generate response data corresponding to the current highest priority authentication request;

[0029] Sending prompt information of the type corresponding to the highest priority authentication request to the main controller via the first signal line;

[0030] The response data corresponding to the current authentication request with the highest priority is transmitted to the main controller via the second signal line.

[0031] In some embodiments, the communication component includes a Bluetooth component, and the security unit is connected to the Bluetooth component.

[0032] In some embodiments, the communication component includes a UWB component, and the UWB component is connected to the security unit through the main controller.

[0033] In some embodiments, the communication component includes an NFC component, and the NFC component is connected to the security unit through the main controller.

[0034] According to a second aspect of the present disclosure, an authentication system is provided. The authentication system includes a user terminal and the authentication device provided by the first aspect of the present disclosure.

[0035] The authentication device and authentication system provided by the embodiments of the present disclosure can achieve the following technical effects:

[0036] The authentication device provided by the embodiment of the present disclosure has a security unit that can receive different authentication requests sent by the user terminal through different communication components at the same time or in a short period of time, and store each authentication request in a cache area. This ensures that all authentication requests will not be lost, and the integrity of the requests can be guaranteed even under high load conditions. The security unit reads and processes each authentication request from the cache area in sequence. The authentication requests in the cache area do not have to wait to be polled by the main controller before being sent to the security unit for processing. Instead, the security unit actively processes each authentication request in the cache area in an orderly manner. This method reduces the waiting time for authentication requests and helps to improve the overall authentication efficiency.

[0037] The foregoing general description and the following description are exemplary and explanatory only and are not intended to limit the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] One or more embodiments are exemplarily described by corresponding drawings, which do not limit the embodiments. Elements with the same reference numerals in the drawings are shown as similar elements, and the drawings do not constitute a scale limitation, and wherein:

[0039] Figure 1 is a schematic diagram of an authentication system provided by an embodiment of the present disclosure;

[0040] Figure 2 is a schematic diagram of an application scenario of an authentication system provided by an embodiment of the present disclosure;

[0041] Figure 3 is a structural diagram of an authentication device provided by an embodiment of the present disclosure;

[0042] Figure 4 is a structural diagram of an authentication device provided by an embodiment of the present disclosure;

[0043] Figure 5 is a structural diagram of an authentication device provided by an embodiment of the present disclosure;

[0044] Figure 6 It is a schematic diagram of a user terminal provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0045] In order to be able to understand the features and technical contents of the embodiments of the present disclosure in more detail, the implementation of the embodiments of the present disclosure is described in detail below in conjunction with the accompanying drawings. The attached drawings are for reference only and are not used to limit the embodiments of the present disclosure. In the following technical description, for the convenience of explanation, a full understanding of the disclosed embodiments is provided through multiple details. However, one or more embodiments can still be implemented without these details. In other cases, to simplify the drawings, well-known structures and devices can be simplified for display.

[0046] The terms "first", "second", etc. in the specification and claims of the embodiments of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchanged where appropriate, so that the embodiments of the embodiments of the present disclosure described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions.

[0047] Unless otherwise stated, the term "plurality" means two or more.

[0048] In the embodiment of the present disclosure, the character " / " indicates that the preceding and following objects are in an "or" relationship. For example, A / B indicates: A or B.

[0049] The term "and / or" is a description of the association relationship between objects, indicating that three relationships can exist. For example, A and / or B means: A or B, or, A and B.

[0050] The term "correspondence" may refer to an association relationship or a binding relationship. The correspondence between A and B means that there is an association relationship or a binding relationship between A and B.

[0051] An authentication system (such as a digital key system) is a technical system for verifying user authority. The system usually includes a user terminal and an authentication device. The authentication device includes a controller and a security unit, and the user terminal can be carried by the user. There are multiple communication channels in the authentication system, which are connected to the security unit through the controller. The user terminal can send an authentication request to the security unit through these communication channels, and the security unit can transmit the response data corresponding to the authentication request to the controller, and the controller then performs corresponding operations based on the response data.

[0052] In the related art, if the user terminal sends authentication requests to the security unit through multiple communication channels at the same time or in a short period of time, these authentication requests cannot reach the security unit at the same time, and can only be polled and waited by the controller. Since the controller can only process authentication requests one by one when calling the security unit, some authentication requests may be lost during the waiting process, and the authentication process cannot be completed normally. For example, some authentication requests require the user to manually trigger through the user terminal. When the user manually triggers a certain authentication request, the user terminal sends another authentication request, and these two authentication requests are sent to the controller through different communication channels. However, the two authentication requests cannot be transmitted to the security unit by the controller at the same time. If the manually triggered authentication request is not transmitted to the security unit first, then the authentication request may be lost, and the user needs to manually trigger the authentication request again, affecting the user experience. Even if the authentication requests that are not processed immediately are not lost, these requests must wait for the previous authentication request to be processed and the next polling of the controller to arrive before they can be sent to the security unit for processing. Since the polling process of the controller is long, this will extend the waiting time of the authentication request and affect the overall authentication efficiency.

[0053] Combination Figure 1 As shown, the embodiment of the present disclosure provides an authentication system, which includes an authentication device 100 and a user terminal 200, and the authentication device 100 and the user terminal 200 can be connected in communication. When the user terminal 200 can send an authentication request to the authentication device 100, the authentication device 100 can complete the corresponding authentication operation based on the authentication request.

[0054] In the embodiment of the present disclosure, the specific types of the authentication device 100 and the user terminal 200 in the authentication system may be determined according to the application scenario. Here, the authentication system may be applied to automobiles, smart door lock systems, industrial control systems, etc. Of course, the application scenarios of the authentication system are not limited thereto. Figure 2 As shown, when the authentication system is applied to a car, the authentication system can be used as a digital key system, the authentication device 100 can be deployed in the car computer, and the user terminal 200 can be a digital car key. When the user carries the user terminal 200 into the communication range of the authentication device 100, the user terminal 200 can send an authentication request to the authentication device 100, and the authentication device 100 can complete the corresponding authentication operation based on the authentication request; when the authentication is passed, the authentication device 100 can control the door to open.

[0055] Optionally, when the authentication system is applied to a smart door lock system, the authentication device 100 is deployed in the smart door lock, and the user terminal 200 can be a mobile electronic device (such as a mobile phone). When the user carries the user terminal 200 into the communication range of the authentication device 100, the user terminal 200 can send an authentication request to the authentication device 100, and the authentication device 100 can complete the corresponding authentication operation based on the authentication request; when the authentication is passed, the authentication device 100 can control the door lock to open.

[0056] Optionally, when the authentication system is applied to an industrial control system, the authentication device 100 is deployed on industrial equipment (such as a machine tool), and the user terminal 200 can be a mobile electronic device (such as a mobile phone). When the user carries the user terminal 200 into the communication range of the authentication device 100, the user terminal 200 can send an authentication request to the authentication device 100, and the authentication device 100 can complete the corresponding authentication operation based on the authentication request; when the authentication is passed, the authentication device 100 can remove the restrictions on the industrial equipment and allow the user to operate the industrial equipment.

[0057] Combination Figure 3 As shown, the authentication device 100 provided in the embodiment of the present disclosure includes a secure element (SE) 1, a main controller 2 and multiple communication components, some of which are directly connected to the secure element 1, and other communication components are connected to the secure element 1 through the main controller 2, and each communication component is used to build a communication channel in the authentication system. The communication components include a Bluetooth component 2, a UWB (Ultra Wideband) component 4 and an NFC (Near Field Communication) component, etc.

[0058] In the disclosed embodiment, the security unit 1 is a hardware component specially designed for storing and processing sensitive information. The security unit 1 can be an embedded security unit 1 (Embedded Secure Element, eSE), a universal integrated circuit card (Universal Integrated Circuit Card, UICC) or a secure digital memory card (Secure Digital Memory Card, SD Card), etc. The embedded security unit 1 is a security unit welded on the terminal motherboard, which is usually used to store and process sensitive information, such as keys, certificates, etc. The secure digital memory card integrates the security unit 1 into the SD memory card, which can be used to store and process sensitive information and is commonly used in various electronic devices, such as cameras, mobile phones, etc. The security unit 1 can encrypt and decrypt data to ensure the security of data during transmission. The security unit 1 can generate and verify digital signatures to ensure the integrity of the data and the authenticity of the source. The security unit 1 can generate and manage various keys to ensure the safe storage and use of the keys. The security unit 1 can perform various identity authentication operations, such as username and password verification, biometric recognition, etc. The security unit 1 can safely store sensitive data, such as private keys, certificates, keys, etc.

[0059] In the embodiment of the present disclosure, the main controller 2 can be a microcontroller unit (MCU), a field programmable gate array (FPGA), a system on a chip (SoC), a programmable logic controller (PLC), etc.

[0060] In the disclosed embodiment, the main controller 2 and the security unit 1 may be connected via a serial peripheral interface (SPI) or an inter-integrated circuit (I2C). Of course, the main controller 2 and the security unit 1 may also be connected via other types of interfaces.

[0061] In some embodiments, the security unit 1 is connected to the Bluetooth component 3. The user terminal 200 can establish a communication connection with the Bluetooth component 3 in a Bluetooth communication mode, and the security unit 1 can receive the authentication request sent by the user terminal 200 through the Bluetooth component 3. Specifically, the Bluetooth component 3 includes a Bluetooth module 31 and a first antenna 32, and the Bluetooth module 31 is respectively connected to the first antenna 32, the security unit 1 and the main controller 2. The Bluetooth module 31 and the security unit 1 can be connected through a serial peripheral interface or an internal integrated circuit, and the Bluetooth module 31 and the main controller 2 can be connected through a universal asynchronous receiver-transmitter (Universal Asynchronous Receiver-Transmitter, UART) or a universal synchronous asynchronous receiver-transmitter (Universal Synchronous Asynchronous Receiver-Transmitter, USART). The operating frequency of the Bluetooth module 31 is 2400MHz to 2483.5MHz.

[0062] In some embodiments, the main controller 2 may also be directly connected to the Bluetooth component 3. Specifically, the main controller 2 is directly connected to the Bluetooth module 31 in the Bluetooth component 3.

[0063] In some embodiments, the UWB component 4 is connected to the security unit 1 through the main controller 2. The user terminal 200 can establish a communication connection with the UWB component 4 in the form of UWB communication, and the main controller 2 can receive the authentication request sent by the user terminal 200 through the UWB component 4, and transmit the authentication request to the security unit 1. Specifically, the UWB component 4 includes a UWB module 41 and a second antenna 42, and the UWB module 41 is connected to the second antenna 42 and the main controller 2 respectively. The UWB module 41 and the main controller 2 can be connected through a serial peripheral interface or an internal integrated circuit, and the operating frequency of the UWB module 41 is 7163MHz to 8812MHz.

[0064] In some embodiments, the NFC component is connected to the security unit 1 through the main controller 2. The user terminal 200 can establish a communication connection with the NFC component in a near field communication manner, and the main controller 2 can receive an authentication request sent by the user terminal 200 through the NFC component, and transmit the authentication request to the security unit 1. Specifically, the NFC component includes an NFC module and an antenna, and the NFC module is connected to the antenna and the main controller 2 respectively.

[0065] In some embodiments, the number of NFC components may be two, and the two NFC components are respectively a first NFC component 5 and a second NFC component 6. The first NFC component 5 includes a first NFC module 51 and a third antenna 52, and the first NFC module 51 is respectively connected to the third antenna 52 and the main controller 2. The second NFC component 6 includes a slave controller 61, a second NFC module 62 and a fourth antenna 63, and the slave controller 61 is respectively connected to the main controller 2 and the second NFC module 62, and the second NFC module 62 is respectively connected to the fourth antenna 63 and the slave controller 61.

[0066] In the embodiment of the present disclosure, the first NFC module 51 and the main controller 2 can be connected through a serial peripheral interface or an internal integrated circuit. The main controller 2 and the slave controller 61 can be connected through a CAN (Controller Area Network) bus, and the second NFC module 62 and the slave controller 61 can be connected through a serial peripheral interface or an internal integrated circuit. The operating frequency of the first NFC module 51 and the second NFC module 62 can be 13.56MHz±7kHz.

[0067] In the embodiment of the present disclosure, the security unit 1 is configured to: when receiving different authentication requests sent by the user terminal 200 through different communication components, store each authentication request in a cache area; process each authentication request in turn, generate response data corresponding to each authentication request, and transmit each response data to the main controller 2.

[0068] In some embodiments, the security unit 1 is configured to: when different authentication requests sent by the user terminal 200 are simultaneously received through different communication components, store each authentication request in a cache area; process each authentication request in turn, generate response data corresponding to each authentication request, and transmit each response data to the main controller 2.

[0069] In the embodiment of the present disclosure, the security unit 1 simultaneously receives different authentication requests sent by the user terminal 200 through different communication components, which means that: the security unit 1 receives different authentication requests sent by the user terminal 200 through different communication components at the same time, or the security unit 1 receives different authentication requests sent by the user terminal 200 through different communication components within a shorter time threshold. The time threshold can be determined according to actual design needs, for example, the time threshold can be 0.1 seconds.

[0070] In the embodiment of the present disclosure, the user terminal 200 can send authentication requests to the authentication device 100 through different communication methods at the same time or within a short period of time, and the authentication device 100 uses the corresponding communication components to receive different authentication requests sent by the user terminal 200. For example, at the same time or within a short period of time, the user terminal 200 can establish a communication connection with the Bluetooth component 3 in the form of Bluetooth communication, and the security unit 1 can receive the authentication request sent by the user terminal 200 through the Bluetooth component 3; the user terminal 200 can establish a communication connection with the UWB component 4 in the form of UWB communication, and the main controller 2 can receive the authentication request sent by the user terminal 200 through the UWB component 4, and transmit the authentication request to the security unit 1; the user terminal 200 can establish a communication connection with the NFC component in the form of near field communication, and the main controller 2 can receive the authentication request sent by the user terminal 200 through the NFC component, and transmit the authentication request to the security unit 1.

[0071] In the embodiments of the present disclosure, different communication components have different working ranges, and the specific value of the working range of each communication component can be determined according to actual design requirements. Figure 2 As shown, the working range of Bluetooth component 3 is Figure 2 The working range of Bluetooth is shown, and the working range of UWB component 4 is Figure 2 The UWB operating range shown in FIG. 1 is greater than the UWB operating range of the Bluetooth embodiment of the present disclosure. It can be understood that Figure 2 In the figure, position 1 is outside the Bluetooth working range and the UWB working range, position 2 is within the Bluetooth working range and outside the UWB working range, and position 3 is within the Bluetooth working range and the UWB working range.

[0072] When the authentication system is applied to a car, the authentication device 100 can be deployed in the car's computer, and the user terminal 200 can be a digital car key. Here, the digital car key can be a separate terminal or an application set in the terminal. When the user carries the digital car key in position 1, the digital car key cannot send an authentication request to the security unit 1 through Bluetooth communication and UWB communication; when the user carries the digital car key in position 2, the digital car key can send an authentication request to the security unit 1 through Bluetooth communication, but cannot send an authentication request to the security unit 1 through UWB communication; when the user carries the digital car key in position 3, the digital car key sends an authentication request to the security unit 1 through Bluetooth communication and UWB communication at the same time. Therefore, when the user carries the digital car key in position 3, if the digital car key sends an authentication request to the security unit 1 through Bluetooth communication and UWB communication at the same time or in a short period of time, the security unit 1 will receive different authentication requests sent by the user terminal 200 through different communication components. That is to say, when the digital car key is within the UWB working range, the digital car key can send an authentication request to the security unit 1 through Bluetooth communication and UWB communication at the same time or in a short period of time, and the security unit 1 will receive different authentication requests sent by the user terminal 200 through different communication components.

[0073] For example, the authentication request received by the UWB component 4 is actively sent by the digital car key, and the authentication request received by the Bluetooth component 3 is sent by the digital car key in response to a manual trigger by the user, wherein the manual trigger can be the user pressing the Bluetooth switch of the digital car key. Assume that the user carries the digital car key into the UWB working range, at this time, the digital car key actively sends the authentication request received by the UWB component 4, and at the same time, the user presses the Bluetooth switch of the digital car key, and the digital car key will send the authentication request received by the Bluetooth component 3. Therefore, the digital car key can send authentication requests to the security unit 1 through Bluetooth communication and UWB communication at the same time or in a short period of time, and the security unit 1 will receive different authentication requests sent by the digital car key through different communication components.

[0074] When the security unit 1 receives different authentication requests sent by the user terminal 200 through different communication components, it stores each authentication request in the cache area, which can avoid the loss of the authentication request. After storing each authentication request in the cache area, the security unit 1 can process each authentication request in turn, generate response data corresponding to each authentication request, and transmit each response data to the main controller 2.

[0075] Specifically, for each authentication request, the security unit 1 can extract necessary information from the authentication request, such as user identity, request type, etc.; check the legitimacy of the authentication request, such as verifying the digital signature, checking the format and content of the request, etc.; and then generate response data, wherein the response data usually includes the authentication result (success or failure). When the authentication results of each authentication request indicate success, the authentication device 100 passes the authentication, and then can perform corresponding subsequent operations, such as controlling the door to open.

[0076] The authentication device 100 provided by the embodiment of the present disclosure, its security unit 1 can receive different authentication requests sent by the user terminal 200 through different communication components at the same time or in a short period of time, and store each authentication request in a cache area. This can ensure that all authentication requests will not be lost, and the integrity of the requests can be guaranteed even under high load conditions. The security unit 1 reads and processes each authentication request from the cache area in sequence. The authentication requests in the cache area do not have to wait to be polled by the main controller 2 before being sent to the security unit 1 for processing. Instead, the security unit 1 actively processes each authentication request in the cache area in an orderly manner. This method reduces the waiting time for authentication requests and helps to improve the overall authentication efficiency.

[0077] In some embodiments, the authentication device 100 has multiple caches, one for each communication component. The security unit 1 is configured to: when receiving different authentication requests sent by the user terminal 200 through different communication components, store each authentication request in the cache corresponding to the communication component receiving the authentication request.

[0078] The disclosed embodiment can classify and manage different types of authentication requests by storing the authentication requests received by different communication components in corresponding buffer areas respectively. This helps to improve the orderliness and efficiency of request processing. For example, the authentication request received by the Bluetooth component 3 is stored in the Bluetooth buffer area, the authentication request received by the UWB component 4 is stored in the UWB buffer area, and the authentication request received by the NFC component is stored in the NFC buffer area. In this way, the security unit 1 can more clearly identify and process requests from different communication channels. The cache areas of different communication components independently store authentication requests, which can effectively reduce conflicts between requests. Furthermore, through independent buffer areas, even if there is a problem with the authentication request processing of a certain communication component, it will not affect the request processing of other communication components.

[0079] In some embodiments, the priority of request processing of each communication component can be preset. The security unit 1 is configured to: determine the priority of each authentication request, and then loop through the following steps: process the authentication request with the highest current priority, generate response data corresponding to the authentication request with the highest current priority; and transmit the response data corresponding to the authentication request with the highest current priority to the main controller 2.

[0080] The authentication device 100 can flexibly determine the priority of each authentication request, ensure that key requests are processed in a timely manner, optimize resource utilization, improve user experience, enhance system reliability, and flexibly respond to different application scenarios. This priority processing mechanism provides the authentication system with stronger performance and higher reliability.

[0081] In some embodiments, the priority of each authentication request may be determined based on multiple feature items of each authentication request. The feature items of the authentication request include but are not limited to the following: the type of communication component corresponding to the authentication request, the sending time of the authentication request, the triggering sending method of the authentication request, the number of repeated sending times of the authentication request, and the amount of resources required for the authentication request.

[0082] Specifically, determining the priority of each authentication request includes: calculating the scores of each feature item of each authentication request, calculating the total score of all feature items of each authentication request, and determining the priority of each authentication request based on the total score of each authentication request. The total score of the authentication request is positively correlated with the priority of the authentication request, that is, the higher the total score of the authentication request, the higher the priority of the authentication request.

[0083] In the disclosed embodiment, a corresponding score can be set in advance for each type of communication component. The score of the sending time of the authentication request is positively correlated with the early or late sending time of the authentication request. The earlier the sending time of the authentication request, the higher the score of the sending time of the authentication request. A score can be set in advance for each trigger sending mode of the authentication request, wherein the trigger sending mode includes active sending by the user terminal 200 and sending by the user terminal 200 in response to manual triggering by the user, and the score of the user terminal 200 sending in response to manual triggering by the user is higher than the score of the user terminal 200 actively sending. The score of the number of repeated sending times of the authentication request is positively correlated with the number of repeated sending times of the authentication request. That is, the more repeated sending times of the authentication request, the higher the score of the number of repeated sending times of the authentication request. The score of the amount of resources required for the authentication request is negatively correlated with the amount of resources required for the authentication request. That is, the more resources required for the authentication request, the lower the score of the amount of resources required for the authentication request.

[0084] In some embodiments, the main controller 2 and the security unit 1 are connected via a first signal line and a second signal line. Figure 4 and Figure 5As shown, the main controller 2 and the security unit 1 are connected via more than two signal lines. Among these signal lines, one signal line is the second signal line, and the remaining signal lines are the first signal lines. The security unit 1 is configured to: determine the priority of each authentication request, and then loop through the following steps: process the current highest priority authentication request, generate response data corresponding to the current highest priority authentication request; send a prompt message to the main controller 2 via the first signal line, wherein the prompt message is used to prompt the main controller 2 to prepare to receive the response data; transmit the response data corresponding to the current highest priority authentication request to the main controller 2 via the second signal line.

[0085] In the embodiment of the present disclosure, after the security unit 1 obtains the response data, it actively sends a prompt message to the main controller 2. The main controller 2 can prepare to receive the response data in advance according to the prompt message so that the response data can be transmitted to the main controller 2 in time, reducing the delay in data transmission.

[0086] In some embodiments, there are multiple first signal lines, and each communication component corresponds to one first signal line. Figure 4 As shown, the main controller 2 and the security unit 1 are connected via four signal lines. Among these signal lines, one signal line is the second signal line, and the remaining three signal lines are the first signal lines. The security unit 1 is configured to: determine the priority of each authentication request, and then loop through the following steps: process the current authentication request with the highest priority, generate the response data corresponding to the current authentication request with the highest priority; send a prompt message to the main controller 2 via the first signal line corresponding to the communication component that receives the current authentication request with the highest priority; transmit the response data corresponding to the current authentication request with the highest priority to the main controller 2 via the second signal line. Taking the current authentication request with the highest priority as an example, the authentication request received by the Bluetooth component 3, after the security unit 1 generates the response data corresponding to the current authentication request with the highest priority, it sends a prompt message to the main controller 2 via the first signal line corresponding to the Bluetooth component 3.

[0087] After the security unit 1 generates the response data corresponding to the current highest priority authentication request, the level of the first signal line output corresponding to the communication component receiving the current highest priority authentication request is adjusted to a high level, and the high level is used as a prompt information. After the response data is sent, the security unit 1 restores the level of the first signal line output corresponding to the communication component receiving the current highest priority authentication request to a low level.

[0088] In the embodiment of the present disclosure, by allocating an independent first signal line to each communication component, signal conflicts can be reduced and the integrity and accuracy of data can be ensured.

[0089] In some embodiments, the number of the first signal line is one. Figure 5 As shown, the main controller 2 and the security unit 1 are connected via two signal lines. Among these signal lines, one signal line is the second signal line, and the other signal line is the first signal line. The security unit 1 is configured to: determine the priority of each authentication request, and then loop through the following steps: process the current authentication request with the highest priority, generate the response data corresponding to the current authentication request with the highest priority; send the prompt information of the type corresponding to the authentication request with the highest priority to the main controller 2 via the first signal line; transmit the response data corresponding to the current authentication request with the highest priority to the main controller 2 via the second signal line.

[0090] In the disclosed embodiment, a corresponding type of prompt information can be configured for the authentication request received by each communication component, and the type of prompt information configured for the authentication request received by each communication component is different. Here, different high and low level combinations can be configured for the first signal line to output different types of prompt information. For example, for the authentication request received by Bluetooth component 3, the prompt information is that the level of the first signal line continues to remain at a high level; for the authentication request received by UWB component 4, the prompt information is that the level of the first signal line remains at a high level and returns to a low level after t seconds.

[0091] In the embodiment of the present disclosure, the number of the first signal line is limited to one to simplify the hardware design and reduce the hardware complexity. Moreover, reducing the number of signal lines can reduce the risk of electromagnetic interference.

[0092] In some embodiments, the authentication request sent by the user terminal 200 to the authentication device 100 through the Bluetooth component 3 is an identity authentication request, and the authentication request sent by the user terminal 200 to the authentication device 100 through the UWB component 4 is a distance authentication request. After receiving the identity authentication request and the distance authentication request through the Bluetooth component 3 and the UWB component 4, respectively, the security unit 1 stores the identity authentication request and the distance authentication request in the corresponding cache area. The security unit 1 determines the priority of each authentication request according to a preset priority rule.

[0093] Take the example that the priority of the identity authentication request is higher than that of the distance authentication request. The security unit 1 processes the identity authentication request first and then processes the distance authentication request. The security unit 1 extracts necessary information from the identity authentication request, such as user identity, request type, etc. The security unit 1 checks the legitimacy of the identity authentication request, such as verifying the digital signature, checking the format and content of the request, etc. The security unit 1 generates response data for the identity authentication request, and the response data includes the identity authentication result (success or failure). The security unit 1 transmits the response data of the Bluetooth request to the main controller 2 through the second signal line. The security unit 1 extracts necessary information from the distance authentication request, such as user distance, request type, etc. The security unit 1 checks the legitimacy of the distance authentication request, such as verifying the digital signature, checking the format and content of the request, etc. The security unit 1 generates response data for the distance authentication request, and the response data includes the distance authentication result (success or failure). The security unit 1 transmits the response data of the distance authentication request to the main controller 2 through the second signal line. When the authentication results of both the identity authentication request and the distance authentication request indicate success, the authentication device 100 can determine that the authentication is passed, and then can perform corresponding subsequent operations, such as controlling the door to open.

[0094] Combination Figure 6 As shown, the user terminal 200 provided in the embodiment of the present disclosure includes a processor 201 and a memory 202. Optionally, the computer 20 may also include a communication interface 203 and a bus 204. The processor 201, the communication interface 203, and the memory 202 may communicate with each other through the bus 204. The communication interface 203 may be used for information transmission and for sending authentication requests.

[0095] In addition, the logic instructions in the memory 202 described above may be implemented in the form of software functional units and when sold or used as independent products, may be stored in a computer-readable storage medium.

[0096] The memory 202 is a computer-readable storage medium that can be used to store software programs and computer executable programs, such as program instructions / modules corresponding to the method in the embodiment of the present disclosure. The processor 201 executes the functional application and data processing by running the program instructions / modules stored in the memory 202, that is, the NFC signal detection method in the above embodiment is implemented.

[0097] The memory 202 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function; the data storage area may store data created according to the use of the terminal device, etc. In addition, the memory 202 may include a high-speed random access memory and may also include a non-volatile memory.

[0098] The technical solution of the embodiment of the present disclosure can be embodied in the form of a software product, which is stored in a storage medium and includes one or more instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in the embodiment of the present disclosure. The aforementioned storage medium may be a non-transient storage medium, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, and other media that can store program codes.

[0099] The above description and the accompanying drawings fully illustrate the embodiments of the present disclosure so that those skilled in the art can practice them. Other embodiments may include structural, logical, electrical, process and other changes. The embodiments represent only possible changes. Unless explicitly required, separate components and functions are optional, and the order of operation may vary. The parts and features of some embodiments may be included in or replace the parts and features of other embodiments. Moreover, the words used in this application are only used to describe the embodiments and are not used to limit the claims. As used in the description of the embodiments and the claims, unless the context clearly indicates, the singular forms of "a", "an" and "the" are intended to include plural forms as well. Similarly, the term "and / or" as used in this application refers to any and all possible combinations of listings containing one or more associated ones. In addition, when used in the present application, the term "comprise" and its variants "comprises" and / or comprising refer to the presence of stated features, wholes, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or groups thereof. In the absence of further restrictions, the elements defined by the sentence "comprising a ..." do not exclude the presence of other identical elements in the process, method or device comprising the elements. In this article, each embodiment may focus on the differences from other embodiments, and the same and similar parts between the various embodiments may refer to each other. For the methods, products, etc. disclosed in the embodiments, if they correspond to the method part disclosed in the embodiments, then the relevant parts can refer to the description of the method part.

[0100] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software may depend on the specific application and design constraints of the technical solution. The technicians may use different methods for each specific application to implement the described functions, but such implementations should not be considered to exceed the scope of the embodiments of the present disclosure. The technicians may clearly understand that, for the convenience and simplicity of description, the specific working processes of the systems, devices and units described above may refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here.

[0101] In the embodiments disclosed herein, the disclosed methods and products (including but not limited to devices, equipment, etc.) can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units can be only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between each other shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms. The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to implement this embodiment. In addition, each functional unit in the embodiment of the present disclosure may be integrated in a processing unit, or each unit may exist physically alone, or two or more units may be integrated in one unit.

[0102] The flowchart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to the embodiment of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. In some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, which can depend on the functions involved. In the description corresponding to the flowchart and the block diagram in the accompanying drawings, the operations or steps corresponding to different boxes can also occur in a different order from the order disclosed in the description, and sometimes there is no specific order between different operations or steps. For example, two consecutive operations or steps can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, which can depend on the functions involved. Each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented by a dedicated hardware-based system that performs the specified functions or actions, or may be implemented by a combination of dedicated hardware and computer instructions.

Claims

1. An authentication device, characterized in that: It includes a safety unit, a main controller and a plurality of communication components, a part of the communication components are directly connected to the safety unit, and another part of the communication components are connected to the safety unit through the main controller; The security unit is configured as: When receiving different authentication requests sent by a user terminal through different communication components, storing each authentication request in a cache area; Each authentication request is processed in sequence, response data corresponding to each authentication request is generated, and each response data is transmitted to the main controller.

2. The authentication device according to claim 1, characterized in that: The security unit is configured to: when receiving different authentication requests sent by the user terminal through different communication components, store each authentication request in a cache area corresponding to the communication component that receives the authentication request.

3. The authentication device according to claim 1, characterized in that: The security unit is configured as: Determine the priority of each authentication request, and then loop through the following steps: Process the authentication request with the highest current priority, and generate response data corresponding to the authentication request with the highest current priority; The response data corresponding to the authentication request with the highest current priority is transmitted to the main controller.

4. The authentication device according to claim 1, characterized in that: The main controller and the safety unit are connected via a first signal line and a second signal line, and the safety unit is configured as follows: Determine the priority of each authentication request, and then loop through the following steps: Process the current highest priority authentication request and generate response data corresponding to the current highest priority authentication request; Sending prompt information to the main controller via the first signal line, wherein the prompt information is used to prompt the main controller to prepare to receive the response data; The response data corresponding to the current authentication request with the highest priority is transmitted to the main controller via the second signal line.

5. The authentication device according to claim 4, characterized in that: There are multiple first signal lines, each communication component corresponds to one first signal line, and the security unit is configured as follows: Determine the priority of each authentication request, and then loop through the following steps: Process the current highest priority authentication request and generate response data corresponding to the current highest priority authentication request; Sending prompt information to the main controller via the first signal line corresponding to the communication component that receives the current highest priority authentication request; The response data corresponding to the current authentication request with the highest priority is transmitted to the main controller via the second signal line.

6. The authentication device according to claim 4, characterized in that: The number of the first signal line is one, and the safety unit is configured as follows: Determine the priority of each authentication request, and then loop through the following steps: Process the current highest priority authentication request and generate response data corresponding to the current highest priority authentication request; Sending prompt information of the type corresponding to the highest priority authentication request to the main controller via the first signal line; The response data corresponding to the current authentication request with the highest priority is transmitted to the main controller via the second signal line.

7. The authentication device according to claim 1, characterized in that: The communication component includes a Bluetooth component, and the security unit is connected to the Bluetooth component.

8. The authentication device according to claim 1, characterized in that: The communication component includes a UWB component, and the UWB component is connected to the security unit through a main controller.

9. The authentication device according to claim 1, characterized in that: The communication component includes an NFC component, and the NFC component is connected to the security unit through the main controller.

10. An authentication system, characterized in that: It comprises a user terminal and an authentication device as claimed in any one of claims 1 to 9.

Images