Disclosure of Invention
The invention aims to solve the technical problem that the invention provides a communication safety guarantee method and system for an intelligent lock of power supply equipment, which can improve the safety of the intelligent lock in the communication process.
In order to solve the above technical problem, as an aspect of the present invention, a communication security guaranteeing method for an intelligent lock of a power supply device is provided, which includes the following steps:
step S10, the management server receives an unlocking request of the selected intelligent lock from the mobile terminal; the unlocking request carries an identification number of the intelligent lock;
step S11, the management server and the intelligent lock perform a key negotiation process, and both sides obtain a key for the unlocking operation;
step S12, the management server encrypts the unlocking instruction by the key and transmits the encrypted unlocking instruction to the intelligent lock through the NB-IOT network;
step S13, the intelligent lock decrypts the unlocking instruction by adopting the negotiated secret key, and carries out unlocking operation according to the unlocking instruction;
and step S14, the intelligent lock feeds back the unlocking result to the management server.
Preferably, the step S11 further includes:
after the management server is connected with the intelligent lock for the first time or the management server controls the intelligent lock to unlock, the same current secret key is stored in both the management server and the intelligent lock;
the management server generates a first random number A, encrypts the first random number A by using the current secret key and sends the encrypted first random number A to the intelligent lockset;
the intelligent lockset receives the encrypted first random number and decrypts by adopting a current secret key to obtain the first random number A;
the intelligent lockset generates a second random number B, encrypts the second random number B by adopting the first random number A and sends the encrypted second random number B to the management server;
the management server decrypts the encrypted second random number by using the first random number A to obtain a second random number B;
and both the management server and the intelligent lock replace the second random number B with a current secret key.
Preferably, further comprising:
after the management server is connected with the intelligent lock for the first time, the management server generates a random number and sends the random number to the intelligent lock;
and the management server and the intelligent lock determine the random number as a current secret key.
Preferably, further comprising:
and the management server forwards the unlocking result to the mobile terminal.
Preferably, https communication is adopted between the mobile terminal and the management server, and when the mobile terminal and the management server establish communication, handshake negotiation is performed first, and https bidirectional authentication is performed.
Accordingly, in another aspect of the present invention, a communication security guarantee system for an intelligent lock of a power supply device is further provided, which at least includes a plurality of intelligent locks arranged at the power supply device, a management server and a mobile terminal, where the intelligent locks directly communicate with the management server, where:
the mobile terminal is used for generating an unlocking request for the intelligent lock to be unlocked, sending the unlocking request to the management server and receiving the unlocking result forwarded by the management server; the unlocking request carries an identification number of the intelligent lock;
the management server is used for carrying out key negotiation with the intelligent lock after receiving the unlocking request, encrypting the unlocking instruction by adopting the negotiated current key and sending the current key to the intelligent lock through an NB-IOT network; the intelligent lock is used for receiving the unlocking result from the intelligent lock and forwarding the unlocking result to the mobile terminal;
the intelligent lock is used for carrying out key negotiation with the management server, decrypting the encrypted unlocking instruction sent by the management server by adopting the negotiated current key, carrying out unlocking operation and feeding back an unlocking result to the management server after unlocking.
Preferably, the management server and the intelligent lock perform key agreement by using the following method:
after the management server is connected with the intelligent lock for the first time or the management server controls the intelligent lock to unlock, the same current secret key is stored in both the management server and the intelligent lock;
the management server generates a first random number A, encrypts the first random number A by using the current secret key and sends the encrypted first random number A to the intelligent lockset;
the intelligent lockset receives the encrypted first random number and decrypts by adopting a current secret key to obtain the first random number A;
the intelligent lockset generates a second random number B, encrypts the second random number B by adopting the first random number A and sends the encrypted second random number B to the management server;
the management server decrypts the encrypted second random number by using the first random number A to obtain a second random number B;
and both the management server and the intelligent lock replace the second random number B with a current secret key.
Preferably, after the management server is connected with the intelligent lock for the first time, the management server is used for generating a random number and sending the random number to the intelligent lock; and the random number is determined as a current secret key by the management server and the intelligent lock.
Preferably, https communication is adopted between the mobile terminal and the management server, and when the mobile terminal and the management server establish communication, handshake negotiation is performed first, and https bidirectional authentication is performed.
The embodiment of the invention has the following beneficial effects:
the invention provides a communication safety guarantee method and a system for an intelligent lock of power supply equipment.A management server and the intelligent lock negotiate a latest secret key before an unlocking instruction is sent each time; replay attacks by hackers can be prevented;
meanwhile, https communication is adopted between the management server and the mobile terminal, and a bidirectional identity authentication mechanism is adopted, so that deception attack by a man in the middle can be prevented, the safety of the intelligent lock in the application process is further improved, and the safety of the power supply equipment can be improved.
Detailed Description
In order to make the objects, technical solutions and advantages of the present invention more apparent, the present invention will be described in further detail with reference to the accompanying drawings.
The invention is described in further detail below with reference to specific embodiments and with reference to the accompanying drawings.
Fig. 1 is a schematic structural diagram illustrating an embodiment of a communication security system for an intelligent lock of a power supply device according to the present invention. Referring to fig. 2 together, in this embodiment, the system at least includes a plurality of intelligent locks 1 disposed at a power supply device, a management server 2 and a mobile terminal 3, where the intelligent locks 1 directly communicate with the management server 2, for example, communicate in an NB-IOT network manner, where:
the mobile terminal 3 is used for generating an unlocking request for the intelligent lock to be unlocked, sending the unlocking request to the management server, and receiving the unlocking result forwarded by the management server; the unlocking request carries an identification number of the intelligent lock;
the management server 2 is used for performing key negotiation with the intelligent lock after receiving the unlocking request, encrypting the unlocking instruction by adopting the negotiated current key, and sending the encrypted unlocking instruction to the intelligent lock through an NB-IOT network; the intelligent lock is used for receiving the unlocking result from the intelligent lock and forwarding the unlocking result to the mobile terminal;
the intelligent lock 1 is used for carrying out key negotiation with the management server, decrypting the encrypted unlocking instruction sent by the management server by adopting the negotiated current key, carrying out unlocking operation, and feeding back an unlocking result to the management server after unlocking.
It is understood that in the prior art, encryption algorithms are mainly classified into two types, symmetric encryption algorithms and asymmetric encryption algorithms. The symmetric encryption algorithm uses the same secret key in the encryption and decryption processes, has the characteristics of quick encryption and decryption, high efficiency and high safety, and mainly comprises DES, AES and SM 1; the common asymmetric encryption algorithms mainly include RSA algorithm and ECC algorithm. Different keys are used in the encryption and decryption processes of the asymmetric encryption algorithm, and the characteristics of long key length, complex algorithm and the like enable the encryption and decryption speed to be low, but the security is high. In addition, the key length of AES is larger than DES, it is difficult to be exhausted and solved, it is safer, it can also be set as any multiple of 32 bits, the minimum is 128 bits, the maximum is 256 bits; and DES is a block cipher algorithm, the block length is 64 bits, suitable for the encryption of a large amount of data. Therefore, the AES is suitable for 8-bit small single-chip microcomputers or common 32-bit microprocessors, and has very low requirements and high operation speed compared with DES memories. SM1 is comparable to AES performance, but needs the proprietary encryption chip, and is costly, and the smart lock small-size equipment space is limited, and the introduction has the limitation.
Because the intelligent lockset needs to meet the requirements of low power consumption and low cost, is not suitable for independently deploying an encryption module with complex calculation and deploying a lightweight security communication module to encrypt, store and access control equipment terminal data, and a security communication protocol which occupies less resources, is relatively safe and has high calculation efficiency is preferably adopted in consideration of the requirements of data storage, calculation performance and power consumption on the terminal, the AES symmetric encryption algorithm is selected to encrypt transmission data in the invention.
As shown in fig. 2, the management server 2 and the intelligent lock 1 perform key agreement by the following method:
after the management server is connected with the intelligent lock for the first time or the management server controls the intelligent lock to unlock, the same current secret key K is stored in both the management server and the intelligent lock;
the management server generates a first random number A, encrypts the first random number A by using the current secret key and sends the encrypted first random number A to the intelligent lock, wherein the first random number A is K (A) in the figure;
the intelligent lockset receives the encrypted first random number and decrypts by adopting a current secret key to obtain the first random number A;
the intelligent lockset generates a second random number B, the first random number A is adopted to encrypt the second random number B, and the second random number B is sent to the management server, wherein A (B) is shown in the figure;
the management server decrypts the encrypted second random number by using the first random number A to obtain a second random number B;
and both the management server and the intelligent lock replace the second random number B with a current secret key.
More specifically, after the management server is connected with the intelligent lock for the first time, the management server is used for generating a random number K and sending the random number to the intelligent lock; and the random number is determined as a current secret key K by the management server and the intelligent lock. This step is only performed once, and subsequently, the key for the current unlocking operation is generated by performing negotiation again on the basis of the current key (i.e., the key negotiated by the previous unlocking operation).
It can be understood that the keys encrypted during each unlocking are different, and when an attacker intercepts data therein and performs replay attack, the intelligent lock cannot decrypt the data due to the absence of the key negotiation process, so that the replay attack can be invalidated.
More particularly, to further improve the communication security of the present system. Https communication is adopted between the mobile terminal 3 and the management server 2, and when the communication is established between the mobile terminal and the management server, handshake negotiation is performed first, and https bidirectional identity authentication is performed.
In the invention, https bidirectional authentication is adopted, the management server performs certificate authentication on the client in the mobile terminal requesting it, and the client in the mobile terminal also performs certificate authentication on the management server requested by itself. Once the management server verifies that the client requesting itself is untrustworthy, the management server refuses to continue communication. The client also suspends communication if the management server is found to be untrusted. Therefore, data transmitted by the App and the server can be prevented from being stolen and utilized by a man-in-the-middle, and deception handshake operation is carried out.
Fig. 3 is a main flow diagram illustrating an embodiment of a communication security method for an intelligent lock of a power supply device according to the present invention. In this embodiment, the method includes the steps of:
step S10, the management server receives an unlocking request of the selected intelligent lock from the mobile terminal; the unlocking request carries an identification number of the intelligent lock;
step S11, the management server and the intelligent lock perform a key negotiation process, and both sides obtain a key for the unlocking operation;
step S12, the management server encrypts the unlocking instruction by the key and transmits the encrypted unlocking instruction to the intelligent lock through the NB-IOT network;
step S13, the intelligent lock decrypts the unlocking instruction by adopting the negotiated secret key, and carries out unlocking operation according to the unlocking instruction;
step S14, the intelligent lock feeds back the unlocking result to the management server; and the management server forwards the unlocking result to the mobile terminal.
More specifically, as shown in fig. 2, the step S11 further includes:
after the management server is connected with the intelligent lock for the first time or the management server controls the intelligent lock to unlock, the same current secret key K is stored in both the management server and the intelligent lock;
the management server generates a first random number A, encrypts the first random number A by using the current secret key and sends the encrypted first random number A to the intelligent lock, wherein the first random number A is K (A) in the figure;
the intelligent lockset receives the encrypted first random number and decrypts by adopting a current secret key to obtain the first random number A;
the intelligent lockset generates a second random number B, the first random number A is adopted to encrypt the second random number B, and the second random number B is sent to the management server, wherein A (B) is shown in the figure;
the management server decrypts the encrypted second random number by using the first random number A to obtain a second random number B;
and both the management server and the intelligent lock replace the second random number B with a current secret key.
More specifically, after the management server is connected with the intelligent lock for the first time, the management server is used for generating a random number K and sending the random number to the intelligent lock; and the random number is determined as a current secret key K by the management server and the intelligent lock. This step is only performed once, and subsequently, the key for the current unlocking operation is generated by performing negotiation again on the basis of the current key (i.e., the key negotiated by the previous unlocking operation).
More specifically, https communication is adopted between the mobile terminal and the management server, and when the mobile terminal and the management server establish communication, handshake negotiation is performed first, and https bidirectional authentication is performed.
For more details, reference may be made to and combined with the foregoing description of fig. 1 and 2, which are not repeated herein.
The embodiment of the invention has the following beneficial effects:
the invention provides a communication safety guarantee method and a system for an intelligent lock of power supply equipment.A management server and the intelligent lock negotiate a latest secret key before an unlocking instruction is sent each time; replay attacks by hackers can be prevented;
meanwhile, https communication is adopted between the management server and the mobile terminal, and a bidirectional identity authentication mechanism is adopted, so that deception attack by a man in the middle can be prevented, the safety of the intelligent lock in the application process is further improved, and the safety of the power supply equipment can be improved.
As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, apparatus, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
While the invention has been described in connection with what is presently considered to be the most practical and preferred embodiment, it is to be understood that the invention is not to be limited to the disclosed embodiment, but on the contrary, is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.