CN113784344B - Trusted address binding device - Google Patents

Trusted address binding device Download PDF

Info

Publication number
CN113784344B
CN113784344B CN202110956358.1A CN202110956358A CN113784344B CN 113784344 B CN113784344 B CN 113784344B CN 202110956358 A CN202110956358 A CN 202110956358A CN 113784344 B CN113784344 B CN 113784344B
Authority
CN
China
Prior art keywords
equipment
trusted
module
administrator
secret key
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN202110956358.1A
Other languages
Chinese (zh)
Other versions
CN113784344A (en
Inventor
程希冀
周丹丹
罗骁
张志文
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Hangzhou Vastchain Technology Co ltd
Original Assignee
Hangzhou Vastchain Technology Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Hangzhou Vastchain Technology Co ltd filed Critical Hangzhou Vastchain Technology Co ltd
Priority to CN202110956358.1A priority Critical patent/CN113784344B/en
Publication of CN113784344A publication Critical patent/CN113784344A/en
Application granted granted Critical
Publication of CN113784344B publication Critical patent/CN113784344B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04WWIRELESS COMMUNICATION NETWORKS
    • H04W12/00Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06Authentication
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04WWIRELESS COMMUNICATION NETWORKS
    • H04W12/00Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04WWIRELESS COMMUNICATION NETWORKS
    • H04W12/00Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/40Security arrangements using identity modules
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04WWIRELESS COMMUNICATION NETWORKS
    • H04W60/00Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
    • YGENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02DCLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D30/00Reducing energy consumption in communication networks
    • Y02D30/70Reducing energy consumption in communication networks in wireless communication networks

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Lock And Its Accessories (AREA)

Abstract

The invention discloses a trusted address binding device, which comprises a trusted data module, an anti-disassembly module and an address authentication module, wherein the trusted data module further comprises an initialization unit and a registration unit, and the initialization unit is used for presetting a device serial number and two dispersion factors, and newly-built manager application and common authority user application; the registration unit defaults to be in a registration state when the equipment is powered on after being installed, an administrator performs data interaction with the equipment through communication of the administrator equipment, the equipment confirms the identity of the administrator, completes equipment registration after receiving a registration instruction, and the equipment which completes registration enters a working state; the disassembly prevention module is provided with a pressing disassembly prevention switch or a Hall sensor; the address authentication module is used for the third party equipment to acquire the random number of the equipment, then the random number is encrypted by using the secret key, the encrypted result is returned to the equipment, and the equipment performs external authentication on the encrypted result by using the secret key of the corresponding secret key number in the trusted data unit.

Description

Trusted address binding device
Technical Field
The invention belongs to the technical field of computer equipment, and particularly relates to trusted address binding equipment.
Background
In a large number of workplaces, manual patrol security inspection is needed, such as dangerous chemical warehouses, office lifts, factory control rooms, school fences, hotels, hospitals and the like, and most of the patrol inspection is currently completed manually and is not performed by a supervision mechanism. The inspection and card punching work content generally consists of inspection personnel, addresses, time and events, and the most difficult is the positioning of a trusted address in the process of unmanned supervision.
The prior art generally performs card punching through fixed-point NFC (NEARFIELD COMMUNICATION ) cards, two-dimensional codes and GPS (Global Positioning System ) signals. Through NFC, two-dimensional code, all accomplish the binding of place and position simply, can't accomplish the position credibility in the position work, the card punching personnel can duplicate the two-dimensional code, NFC, perhaps remove the NFC of binding place or two-dimensional code to other places. The GPS signal has the condition that part of the area is weak in signal or a certain area needs intensive inspection but the GPS signal is not accurate enough.
Disclosure of Invention
In view of the above technical problems, the present invention is configured to provide a trusted address binding device, which is configured to provide an internet of things device with an identity authentication capability and an anti-disassembly function.
In order to solve the technical problems, the invention adopts the following technical scheme:
A trusted address binding device comprises a trusted data module, an anti-disassembly module and an address authentication module,
The trusted data module further comprises an initialization unit and a registration unit, wherein the initialization unit is used for presetting a device serial number and two dispersion factors, and newly creating an administrator application and a common authority user application, each application is added with a secret key of the application to form an administrator user secret key and a common authority user secret key, and the administrator user secret key and the common authority user secret key are sub secret keys which are dispersed by the system by using the corresponding dispersion factors of the administrator user root secret key and the common authority user root secret key respectively; the registration unit defaults to be in a registration state when the equipment is powered on after being installed, an administrator performs data interaction with the equipment through communication of the administrator equipment, the equipment confirms the identity of the administrator, completes equipment registration after receiving a registration instruction, and the equipment which completes registration enters a working state;
The anti-disassembly module is provided with a pressing anti-disassembly switch or a Hall sensor, when the equipment is fixed at the position of the real physical environment to be bound, the pressing anti-disassembly switch or the Hall sensor of the equipment is in an anti-disassembly state after the equipment is fixed;
The address authentication module is used for the third party equipment to acquire the random number of the equipment, then the random number is encrypted by using a secret key, the encrypted result is returned to the equipment, the equipment uses the secret key of the corresponding secret key number to carry out external authentication on the encrypted result in the trusted data unit, if the authentication is passed, the third party is considered to have the corresponding authority, then the operation requirement of the authority possessed by the user is passed, otherwise, the third party equipment is refused, and the third party equipment is an administrator or common authority user equipment.
Preferably, if the anti-disassembly module is provided with a pressing anti-disassembly switch, when the equipment is disassembled, the anti-disassembly switch is triggered, the equipment immediately becomes a forced disassembly state, an alarm is sent, and the address authentication service is stopped being provided.
Preferably, if the anti-disassembly module is provided with a hall sensor, when the equipment is disassembled, the hall sensor leaves a small magnet fixed on the equipment backboard, the level change of the hall sensor is triggered, the equipment detects the level change to immediately change the equipment state into a forced disassembly state, an alarm is sent, and the address authentication service is stopped being provided.
Preferably, the device further comprises an activation module, which is used for receiving a state activation instruction sent by an administrator to re-provide the address authentication service when the device is in the forced-dismantling state.
Preferably, the hardware of the trusted data unit comprises a security chip, a PSAM card or an ESIM card.
Preferably, the device is in data communication with the third party device including at least one wireless communication means of bluetooth, NFC, zigbee, wifi.
Preferably, the device is in data communication with the third party device in at least one wired communication mode including a USB or magnetic interface.
Preferably, after the third party identity is trusted by the device, operations including at least one of punching a card, acquiring electric quantity, acquiring a record, synchronizing a record, acquiring time, synchronizing time, and acquiring backup address information are performed.
Preferably, the device performs a loop record of the operation with the third party, and the record information includes at least one of time, a third party device ID and an interface event.
Preferably, the encryption algorithm used by the authentication encryption process of the present device and the third party includes at least one of a symmetric and an asymmetric algorithm.
The invention has the following beneficial effects:
(1) The device has identity uniqueness, identity authentication capability, low-power-consumption near field communication capability, trusted data unit and anti-disassembly function;
(2) The identity uniqueness of the equipment is guaranteed by the equipment trusted data unit;
(3) When the device is in a forced disassembly state, the address authentication service can be continuously provided only after a state activation instruction sent by an administrator is received;
(4) Firstly, the anti-disassembly function of the low-power-consumption Internet of things equipment and an address form a strong binding relation, secondly, a person and mobile equipment are bound by using the current person identification technology, and then an identity card is carried out with a third party through a trusted data operation unit, so that the uniqueness of the equipment is ensured, and a trusted address authentication service is provided for the outside.
Drawings
FIG. 1 is a functional block diagram of a trusted address binding device according to one embodiment of the present invention;
Fig. 2 is a functional block diagram of a trusted address binding apparatus according to yet another embodiment of the present invention.
Detailed Description
The following description of the embodiments of the present invention will be made clearly and fully with reference to the accompanying drawings, in which it is evident that the embodiments described are some, but not all embodiments of the invention. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
Example 1
Referring to fig. 1, a schematic block diagram of a trusted address binding device according to an embodiment of the present invention is shown, where the trusted address binding device includes a trusted data module, an anti-disassembly module, and an address authentication module, and the trusted data module further includes an initialization unit and a registration unit, where the initialization unit is configured to preset a device serial number and two dispersion factors, and create an administrator application and a general authority user application, each application adds a private key to form an administrator user private key and a general authority user private key, where the administrator user private key and the general authority user private key are subprivate keys that are dispersed by using, respectively, the administrator user root private key and the general authority user root private key corresponding to the dispersion factors by the system; the registration unit defaults to be in a registration state when the equipment is powered on after being installed, an administrator performs data interaction with the equipment through communication of the administrator equipment, the equipment confirms the identity of the administrator, completes equipment registration after receiving a registration instruction, and the equipment which completes registration enters a working state; the anti-disassembly module is provided with a pressing anti-disassembly switch or a Hall sensor, when the equipment is fixed at the position of the real physical environment to be bound, the pressing anti-disassembly switch or the Hall sensor of the equipment is in an anti-disassembly state after the equipment is fixed; the address authentication module is used for the third party equipment to acquire the random number of the equipment, then the random number is encrypted by using a secret key, the encrypted result is returned to the equipment, the equipment uses the secret key of the corresponding secret key number to carry out external authentication on the encrypted result in the trusted data unit, if the authentication is passed, the third party is considered to have the corresponding authority, then the operation requirement of the authority possessed by the user is passed, otherwise, the third party equipment is refused, and the third party equipment is an administrator or common authority user equipment. After the third party identity is trusted and authenticated by the equipment, operations comprising at least one of punching a card, acquiring electric quantity, acquiring records, synchronizing records, acquiring time, synchronizing time and acquiring backup address information are performed. The device performs a cyclical recording of operations with the third party, the recorded information including at least one of time, a third party device ID, and an interface event.
Example 2
Based on embodiment 1, referring to fig. 2, the trusted address binding apparatus according to the embodiment of the present invention further includes an activation module, configured to, when the apparatus is in a forced-disassembly state, receive a state activation instruction sent by an administrator to re-provide the address authentication service. The activation process is that after the equipment is disassembled, for example, a battery is replaced, the equipment is maintained, the equipment is prevented from being disassembled and is triggered by mistake, at the moment, the equipment is in a forced disassembly to be activated state, only the manager authority can reactivate the equipment, and the common authority user does not have the authority of reactivating the equipment.
When the trusted address binding device provided by the embodiment of the invention is used, the battery is firstly installed and then fixed at a designated place needing to provide the trusted address, such as a wall of a certain machine room, a wall of a certain kitchen and the like. The registered equipment enters a working state, and meanwhile, the equipment stores the working state in a flash so as to be convenient for reading after restarting.
When the device is fixed at the position of the real physical environment to be bound in a punching mode, an adhesive buckle mode and the like, the anti-collision device of the device is in an anti-dismantling state after being fixed. In a specific application example, if the anti-disassembly module is a push anti-disassembly switch, when the equipment is disassembled, the anti-disassembly switch is triggered, the equipment immediately becomes a forced disassembly state, an alarm is sent, and the address authentication service is stopped being provided. If the anti-disassembly module is provided with a Hall sensor, when the equipment is disassembled, the Hall sensor leaves a small magnet fixed on the equipment backboard, the level change of the Hall sensor is triggered, the equipment detects the level change to immediately change the equipment state into a forced disassembly state, an alarm is sent, and the address authentication service is stopped being provided.
In a specific application example, the hardware of the trusted data unit includes a security chip, a PSAM (Point of Service Security Control Module, terminal security control module) card or an eSIM (Embedded SIM) card. The identity uniqueness of the equipment is guaranteed by the equipment trusted data unit.
In a specific application example, the data communication between the device and the third party device includes at least one wireless communication mode of bluetooth and NFC, zigbee, wifi. The device communicates data with the third party device in at least one wired communication mode including a USB or magnetic interface.
In a specific application example, the encryption algorithm used by the authentication encryption process of the device and the third party comprises at least one of a symmetric algorithm and an asymmetric algorithm. The authentication encryption algorithm is selected according to different key numbers, and the symmetric encryption 3DES algorithm is used by default, or symmetric encryption DES, AES and the like or asymmetric encryption algorithms such as RSA and the like can be selected.
It should be understood that the exemplary embodiments described herein are illustrative and not limiting. Although one or more embodiments of the present invention have been described with reference to the accompanying drawings, it will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the spirit and scope of the present invention as defined by the following claims.

Claims (10)

1. A trusted address binding device is characterized by comprising a trusted data module, an anti-disassembly module and an address authentication module,
The trusted data module further comprises an initialization unit and a registration unit, wherein the initialization unit is used for presetting a device serial number and two dispersion factors, and newly creating an administrator application and a common authority user application, each application is added with a secret key of the application to form an administrator user secret key and a common authority user secret key, and the administrator user secret key and the common authority user secret key are sub secret keys which are dispersed by the system by using the corresponding dispersion factors of the administrator user root secret key and the common authority user root secret key respectively; the registration unit defaults to be in a registration state when the equipment is powered on after being installed, an administrator performs data interaction with the equipment through communication of the administrator equipment, the equipment confirms the identity of the administrator, completes equipment registration after receiving a registration instruction, and the equipment which completes registration enters a working state;
The anti-disassembly module is provided with a pressing anti-disassembly switch or a Hall sensor, when the equipment is fixed at the position of the real physical environment to be bound, the pressing anti-disassembly switch or the Hall sensor of the equipment is in an anti-disassembly state after the equipment is fixed;
The address authentication module is used for the third party equipment to acquire the random number of the equipment, then the random number is encrypted by using a secret key, the encrypted result is returned to the equipment, the equipment uses the secret key of the corresponding secret key number to carry out external authentication on the encrypted result in the trusted data unit, if the authentication is passed, the third party is considered to have the corresponding authority, then the operation requirement of the authority possessed by the user is passed, otherwise, the third party equipment is refused, and the third party equipment is an administrator or common authority user equipment.
2. The trusted address binding apparatus of claim 1, wherein if the tamper module is configured to press the tamper switch, the tamper switch is activated when the apparatus is removed, the apparatus immediately becomes in a forced-dismantling state, an alarm is sent, and the provision of address authentication services is stopped.
3. The trusted address binding apparatus of claim 1, wherein if the tamper module is a hall sensor, the hall sensor leaves a small magnet fixed on the back plate of the apparatus when the apparatus is detached, triggers a level change of the hall sensor, and the apparatus detects the level change to immediately change the status of the apparatus to a forced detach status, and sends an alarm to stop providing the address authentication service.
4. The trusted address binding apparatus of claim 1, further comprising an activation module to receive a status activation instruction from an administrator to re-provide address authentication services when the apparatus is in a forced state.
5. The trusted address binding device of claim 1, wherein the hardware of the trusted data unit comprises a security chip, a PSAM card, or an ESIM card.
6. A trusted address binding device as claimed in any one of claims 1 to 5, wherein the data communication between the device and the third party device comprises at least one of bluetooth, NFC, zigbee, wifi wireless communication.
7. A trusted address binding device as claimed in any one of claims 1 to 5, wherein the data communication between the device and the third party device comprises at least one wired communication mode of a USB or magnetic interface.
8. The trusted address binding apparatus of any one of claims 1 to 5, wherein the third party identity is trusted by the apparatus, and wherein the operations including at least one of punching a card, obtaining an electrical quantity, obtaining a record, synchronizing a record, obtaining a time, synchronizing a time, and obtaining backup address information are performed.
9. The trusted address binding apparatus of any one of claims 1 to 5, wherein the apparatus is to perform a loop record of operations with a third party, the record information including at least one of time, a third party device ID and an interface event.
10. A trusted address binding device as claimed in any one of claims 1 to 5, wherein the encryption algorithm used by the device and the authentication encryption process of the third party comprises at least one of a symmetric and an asymmetric algorithm.
CN202110956358.1A 2021-08-19 2021-08-19 Trusted address binding device Active CN113784344B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202110956358.1A CN113784344B (en) 2021-08-19 2021-08-19 Trusted address binding device

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202110956358.1A CN113784344B (en) 2021-08-19 2021-08-19 Trusted address binding device

Publications (2)

Publication Number Publication Date
CN113784344A CN113784344A (en) 2021-12-10
CN113784344B true CN113784344B (en) 2024-05-24

Family

ID=78838631

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202110956358.1A Active CN113784344B (en) 2021-08-19 2021-08-19 Trusted address binding device

Country Status (1)

Country Link
CN (1) CN113784344B (en)

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1379343A (en) * 2002-04-30 2002-11-13 北京信源咨讯信息技术有限公司 Entrance guard method and system using blue tooth technique in wireless authentication and data transmitting/receiving
US6836548B1 (en) * 1991-10-29 2004-12-28 The Commonwealth Of Australia Communications security and trusted path method and means
CN103078757A (en) * 2013-01-04 2013-05-01 中兴通讯股份有限公司 Near field communication-based network element management method and system, inspection terminal, network manager and network element
CN108764857A (en) * 2018-06-08 2018-11-06 北京阿尔山金融科技有限公司 Check card motivational techniques and the punch card system for equipment of checking card
CN109461222A (en) * 2018-10-22 2019-03-12 北京阿尔山金融科技有限公司 Information access method of checking card, system and electronic equipment based on equipment of checking card
CN111147239A (en) * 2019-12-27 2020-05-12 郑州信大捷安信息技术股份有限公司 Offline remote authorization authentication method and system
CN111859348A (en) * 2020-07-31 2020-10-30 上海微位网络科技有限公司 Identity authentication method and device based on user identification module and block chain technology

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6836548B1 (en) * 1991-10-29 2004-12-28 The Commonwealth Of Australia Communications security and trusted path method and means
CN1379343A (en) * 2002-04-30 2002-11-13 北京信源咨讯信息技术有限公司 Entrance guard method and system using blue tooth technique in wireless authentication and data transmitting/receiving
CN103078757A (en) * 2013-01-04 2013-05-01 中兴通讯股份有限公司 Near field communication-based network element management method and system, inspection terminal, network manager and network element
CN108764857A (en) * 2018-06-08 2018-11-06 北京阿尔山金融科技有限公司 Check card motivational techniques and the punch card system for equipment of checking card
CN109461222A (en) * 2018-10-22 2019-03-12 北京阿尔山金融科技有限公司 Information access method of checking card, system and electronic equipment based on equipment of checking card
CN111147239A (en) * 2019-12-27 2020-05-12 郑州信大捷安信息技术股份有限公司 Offline remote authorization authentication method and system
CN111859348A (en) * 2020-07-31 2020-10-30 上海微位网络科技有限公司 Identity authentication method and device based on user identification module and block chain technology

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
基于身份的双向认证及密钥协商协议;刘斌;徐吉斌;;巢湖学院学报(第03期);全文 *
密钥分散管理系统——密钥生成算法实现;张安东;中国优秀硕士学位论文全文数据库;全文 *

Also Published As

Publication number Publication date
CN113784344A (en) 2021-12-10

Similar Documents

Publication Publication Date Title
AU2017276840B2 (en) Padlock device, systems including a padlock device, and methods of operating therefor
US11423724B2 (en) Method and system for activating electronic lockers
RU2576586C2 (en) Authentication method
CN104778765B (en) mobile access control system and method
US10911946B2 (en) Local unit for monitoring the maintenance of an item of equipment and method for the validation of a task on the item of equipment
WO2017096970A1 (en) Method and device for determining position of target portable device
WO2018000885A1 (en) Time card clocking method, device, system, mobile terminal and server
CN102693381A (en) Method, device and system for anti-theft of portable computer equipment
EP2492878A9 (en) Methods and apparatus to control access
CN103634477A (en) Method and system for preventing thievery of mobile phone with fingerprint device
US20170230365A1 (en) Method and system for securing electronic data exchange between an industrial programmable device and a portable programmable device
CN104091376A (en) Intelligent lock control method and apparatus thereof
RU2013140418A (en) SAFE ACCESS TO PERSONAL HEALTH RECORDS IN EMERGENCIES
CN103985169B (en) Handheld terminal and USB port is utilized to carry out door lock open and close system and control method
CN105279830A (en) Voice frequency access control system based on mobile equipment
JP2022535763A (en) Methods and systems for reporting and monitoring mobile device location-related activity
RU2596587C2 (en) Mobile communication device
CN109964499A (en) There are identifications
JP6013848B2 (en) Facility management system and facility management method
KR20140021874A (en) System for entrance management using smart code and method of the same
CN113784344B (en) Trusted address binding device
CN104506710B (en) Short message management method, terminal and device
CN113781675B (en) Trusted inspection card punching method
CN108684035A (en) Method for retrieving, device, terminal and the computer readable storage medium of mobile phone
CN108337385A (en) A kind of system for establishing call connection using safety equipment

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant