TWI633231B - Smart lock and smart lock control method - Google Patents

Abstract

A smart lock comprises a lock module, a communication module, a storage module for storing an identity identification data, an application of at least one of the signature and the encryption, and a reference module key and a processing module. The processing module verifies whether the application is the specific application according to the reference program key, and when the verification result is yes, executes the application and establishes a connection with a control terminal. When receiving the identity authentication data from the control terminal, the processing module determines whether the identity authentication data from the control terminal matches the stored identity identification data. When the determination result is yes and a control instruction from the control terminal and related to the smart lock is received, the processing module controls the smart lock to perform a corresponding operation according to the control instruction.

Description

Smart lock and smart lock control method

The invention relates to a lock and an operation method thereof, in particular to a smart lock and a smart lock control method.

With the development and advancement of technology, the Internet of Things has gradually been implemented in our lives. When the Internet of Things technology is integrated into locks, it not only allows us to carry out the key without having to carry the keys, but also realizes the idea of remotely operating the locks.

However, the safety of locks is the most basic but also the core requirement of the family. Although smart locks will have a positive impact on our daily lives, even if we don't solve the problem of security, even smart locks can bring us a lot of things. The convenience, no one dares to use.

Therefore, strengthening the security of smart locks has become a top issue that developers have to face and deal with.

Therefore, the object of the present invention is to provide a smart lock with high security Control Method.

Therefore, the smart lock control method of the present invention is implemented by a smart lock, which is electrically connected to a control terminal and used to store at least one identity identification data, a signature and an encryption corresponding to a specific user. The application program, and a reference program key associated with a specific application, the smart lock control method includes the following steps: (A) verifying, by the smart lock, whether the application is the a specific application; (B) when the application is verified as the specific application, the application is executed by the smart lock, and a connection to the control terminal is established on a communication network; (C) when the smart lock is Receiving the identity authentication data from the control terminal, determining, by the smart lock, whether the identity authentication data from the control terminal matches the stored identity identification data; and (D) when the smart lock determines the identity authentication The data is consistent with the stored identity identification data, and when a control command from the control terminal and related to the smart lock is received, the smart lock is used. The control instruction to a corresponding operation.

Another object of the present invention is to provide a smart lock with high security.

Thus, the smart lock of the present invention comprises a lock module, a communication module, and a A storage module and a processing module.

The lock module is operable in one of a locked state and an unlocked state.

The communication module is connected to a control terminal via a communication network.

The storage module is configured to store an application corresponding to at least one of a specific user's identity identification data, a signature and an encryption, and a reference program key associated with a specific application.

The processing module is electrically connected to the lock module, the communication module and the storage module, and is configured to verify whether the application is the specific application according to the reference program key. When the application is verified as the specific application, the processing module executes the application and establishes a connection with the control terminal on the communication network. When the processing module receives the identity authentication data from the control terminal via the communication module, the processing module determines whether the identity authentication data from the control terminal matches the stored identity identification data. When the processing module determines that the identity authentication data matches the stored identity identification data, and receives a control command from the control terminal and related to the smart lock via the communication module, the processing module is configured according to the The control command controls the smart lock to perform a corresponding operation.

The effect of the present invention is that the smart lock verifies whether the application is the specific application according to the reference program key to ensure that the smart lock is executed. The application is the specific application, not the maliciously modified application of the hacker, thereby improving the security of the smart lock.

1‧‧‧Smart lock

11‧‧‧Lock module

12‧‧‧Communication Module

13‧‧‧Short-range communication module

14‧‧‧Storage module

141‧‧‧First storage unit

201‧‧‧Operation record

202‧‧‧ at least one of signature and encryption Application

142‧‧‧Second storage unit

203‧‧‧ Identity Identification Information

204‧‧‧Reference program key

205‧‧‧Reference console key

206‧‧‧Device Key

15‧‧‧Power Detection Module

16‧‧‧Processing module

161‧‧‧Micro Control Unit

162‧‧‧ Hardware Security Unit

100‧‧‧Communication network

2‧‧‧Control end

21‧‧‧Control side key

22‧‧‧Reference device key

301~314‧‧‧Steps

Other features and advantages of the present invention will be apparent from the embodiments of the present invention. FIG. 1 is a block diagram of a first embodiment of the smart lock of the present invention; FIG. 2 is a smart lock of the present invention. a block diagram of a second embodiment; FIG. 3 is a flow chart illustrating a verification procedure in a first embodiment of the smart lock control method of the present invention; and FIG. 4 is a flow chart illustrating the smart lock control of the present invention An authentication procedure in the first embodiment of the method.

Before the present invention is described in detail, it should be noted that in the following description, similar elements are denoted by the same reference numerals.

Referring to FIG. 1 , a first embodiment of the smart lock 1 of the present invention is electrically connected to a control terminal 2 , and includes a lock module 11 , a communication module 12 , a short distance communication module 13 , and a storage module . 14. A power detection module 15 and an electrical connection between the communication module 12, the short-range communication module 13, the storage module 14, and the power detection module 15 Processing module 16.

The control terminal 2 stores a control terminal key 21 and a reference device key 22.

The lock module 11 is operable in one of a locked state and an unlocked state.

The communication module 12 is connected to a control terminal 2 via a communication network 100.

The short-range communication module 13 is connected to a short-range communication network (not shown).

The storage module 14 includes a first storage unit 141 and a second storage unit 142. The first storage unit 141 is configured to store an operation record 201 related to the smart lock 1 and an application 202 that is at least one of a signature and an encryption. The second storage unit 142 is configured to store identity identification data 203 corresponding to a specific user, a reference program key 204 related to a specific application, a related to a specific console application, and corresponding to the control terminal. The reference control key 205 of the key 21 and a device key 206 corresponding to the reference device key 22. In this embodiment, the identity identification data 203 includes a pair of identification codes (Tokens) corresponding to the specific user and a central processing unit related to the control terminal code of the control terminal 2, such as the control terminal code or the control terminal. Serial number, etc.

The power detecting module 15 is configured to detect the power of the smart lock 1 and respond to a power indication request of the processing module 16 to transmit the detected power to the location Module 16.

The processing module 16 includes a micro control unit 161 electrically connected to the communication module 12, the short-range communication module 13, the first storage unit 141 and the power detection module 15, and an electrical connection The control unit 161, the communication module 12, the short-range communication module 13, the first storage unit 141 and the hardware security unit 162 of the second storage unit 142. In this embodiment, the implementation of the hardware security unit 162 and the second storage unit 142 is, for example, an integrated circuit. The hardware security unit 162 is configured to verify, according to the reference program key 204, whether the application 202 is the specific application. When the application 202 is verified by the hardware security unit 162 as the specific application, the hardware security unit 162 transmits a verification success notification to the micro control unit 161 when the micro control unit 161 receives the hardware from the hardware. When the verification of the security unit 162 is successfully notified, the micro control unit 161 executes the application 202 and establishes a connection with the control terminal 2 on the communication network 100. It is worth mentioning that when the application 202 is encrypted, the hardware security unit 162 first uses the reference program key 204 to decrypt the encrypted application before the micro control unit 161 executes the application 202. The program 202 is also transmitted to the micro control unit 161 for the micro control unit 161 to execute the decrypted application 202.

After the micro control unit 161 establishes the connection with the control terminal 2, when the hardware security unit 162 receives the control terminal 2 via the communication module 12, When the console 2 performs a control terminal application (not shown) of at least one of the signature and the encryption, the hardware security unit 162 verifies whether the console application is the Specific console application. It is worth mentioning that the control terminal application of at least one of the signature and the encryption is at least one of the control terminal 2 signing and encrypting the control application with the control terminal key 21. . In addition, when the control terminal application is encrypted, before the control terminal 2 executes the control terminal application, the control terminal 2 first decrypts the encrypted control terminal application by using the control terminal key 21, and then Execute the decrypted console application. When the console application is verified by the hardware security unit 162 as the particular console application, the hardware security unit 162 transmits another verification success notification to the micro control unit 161.

When the hardware security unit 162 receives the control terminal 2 from the control terminal 2, and includes, for example, a usage code, an authentication value generated by the control terminal 2 according to the control terminal key 21, and a correlation. Based on the identity authentication data of the identification code of the control terminal 2, and at the same time, the control terminal application is verified by the hardware security unit 162 as the specific control terminal application, the hardware security unit 162 is based on the reference control terminal key. 205: Generate a reference authentication value, and determine whether the usage code and the identification code of the identity authentication data from the control terminal 2 respectively correspond to the stored identification code and the control terminal code of the identity identification data 203, and the identity authentication data Is the authentication value in the phase? Applicable to the reference authentication value. In this embodiment, the authentication value is a one-time authentication value. When the hardware security unit 162 determines that the usage code and the identification code of the identity authentication data respectively correspond to the stored identification code and the control terminal code of the identity identification data 203, and at the same time, the authentication value in the identity authentication data matches The hardware security unit 162 transmits an authentication success notification to the micro control unit 161 at the time of the reference authentication value. When the micro control unit 161 receives the authentication success notification from the hardware security unit 162 and receives a control command from the control terminal 2 and related to the smart lock 1 via the communication module 12, the micro control unit 161 receives the control success notification from the hardware security unit 162. The control unit 161 controls the smart lock 1 to perform a corresponding operation according to the control command, and generates and transmits a control reply to the hardware security unit 162, and stores the operation record 201 performed by the smart lock 1 on the first The storage unit 141. When the hardware security unit 162 receives the control reply from the micro control unit 161, the hardware security unit 162 encrypts the control reply with the device key 206 and transmits the control reply to the control terminal 2 for the control terminal. 2 determining whether the encrypted control reply is from the smart lock 1 based on the reference device key 22 and the encrypted control reply. The control command may be, for example, a lock request or an unlock request related to the lock module 11 , a data request related to the operation record 201 of the smart lock 1 stored by the first storage unit 141 , or related to A power indication request of the power of the smart lock 1 detected by the power detecting module 15 is detected.

In this embodiment, the control terminal 2 is held by the specific user. An electronic device, such as a smart phone or a tablet computer, when the control terminal 2 is the electronic device, the control terminal 2 can also communicate with the smart lock 1 via the short-distance communication network to transmit the signed The control terminal application, the identity authentication data, and the control instruction of at least one of the chapter and the encryption. However, in other embodiments of the present invention, the control terminal 2 is a cloud server, and the control terminal 2 can transmit the identity authentication data in response to a service request generated by the electronic device held by the specific user. The smart lock 1 is used for identity authentication, and the control command is transmitted to the smart lock 1 to control the smart lock 1. In addition, when the control terminal 2 is the cloud server, ideally, the control terminal application executed by the control terminal 2 is the specific control terminal application that has not been tampered with, so the control terminal 2 does not need to The control end application performs at least one of signing and encryption and transmits to the smart lock 1 for the hardware security unit 162 to verify the control end application of at least one of the signature and the encryption, and The authentication terminal 2 generates the authentication value according to the control terminal key 21 for the hardware security unit 162 to perform authentication, thereby achieving the effect of verifying the authenticity of the cloud server. Moreover, when the control terminal 2 is the cloud server, the cloud server may further apply the application 202 to at least one of the signature and the encryption stored in the first storage unit 141 of the smart lock 1. In an implementation, the cloud server stores a cloud key corresponding to the reference program key 204, and the cloud server uses the cloud key to update at least one of the signature and the encryption. Another specific application of the application 202 is signed And at least one of the encryption.

Referring to FIG. 2, a second embodiment of the smart lock 1 of the present invention is substantially the same as the first embodiment, and the same is not in the rumor, wherein the hardware security unit 162 is electrically connected to the micro control. The unit 161, the first storage unit 141 and the second storage unit 142 are electrically connected to the communication module 12 and the short-range communication module 13. At this time, the control terminal application and the identity authentication data of at least one of the signature and the encryption are received by the micro control unit 161 via the communication module 12, and the micro control unit 161 passes the communication module. After the group 12 receives the control terminal application and the identity authentication data, the micro control unit 161 transmits the control terminal application and the identity authentication data to the hardware security unit 162 for the hardware security unit 162 to perform. Verification and certification. In addition, when the smart lock 1 wants to transmit the control reply encrypted by the device key 206 to the control terminal 2, the hardware security unit 162 first transmits the control reply encrypted by the device key 206 to the control The micro control unit 161 transmits the control reply encrypted by the device key 206 to the control terminal 2 via the communication module 12 via the communication module 12.

Referring to FIG. 1 , FIG. 3 and FIG. 4 , a first embodiment of the smart lock control method of the present invention is implemented by the first embodiment of the smart lock 1 of the present invention. The embodiment includes a verification program and an authentication in sequence. The program, the verification program and the certification program respectively include the following steps.

In step 301, the hardware security unit 162 verifies whether the application 202 is the specific application based on the reference program key 204. When the application 202 is verified by the hardware security unit 162 as the specific application, the process proceeds to step 302; otherwise, the flow proceeds to step 306.

In step 302, the hardware security unit 162 transmits the verification success notification to the micro control unit 161.

In step 303, when the micro control unit 161 receives the verification success notification from the hardware security unit 162, the micro control unit 161 executes the application 202 and establishes on the communication network 100 and the control terminal. 2 links.

In step 304, when the hardware security unit 162 receives the control terminal application from the control terminal 2 and is executed by the control terminal 2 via at least one of the signature and the encryption, The hardware security unit 162 verifies whether the console application is the specific console application based on the reference console key 205. The control terminal application of at least one of the signature and the encryption is configured by the control terminal 2 to sign and encrypt the control terminal application with the control terminal key 21. When the console application is verified by the hardware security unit 162 as the particular console application, the flow proceeds to step 305; otherwise, the flow proceeds to step 306.

In step 305, the hardware security unit 162 transmits the another verification success notification to the micro control unit 161.

In step 306, the hardware security unit 162 transmits the verification failure notification to the micro control unit 161.

In step 307, when the micro control unit 161 receives the verification failure notification from the hardware security unit 162, the micro control unit 161 stores the operation record 201 of the verification failure.

In step 308, when the hardware security unit 162 receives the control terminal 2 via the communication module 12, and includes the usage code, the control terminal 2 generates the key according to the control terminal key 21. The authentication value and the identity authentication data related to the identifier of the control terminal 2, and when the console application is verified by the hardware security unit 162 as the specific console application, the hardware security unit 162 The reference control key 205 generates the reference authentication value, and determines whether the usage code and the identification code of the identity authentication data from the control terminal 2 respectively correspond to the stored identification code and the control terminal code of the identity identification data 203. And whether the authentication value in the identity authentication data matches the reference authentication value. In this embodiment, the authentication value is a one-time authentication value. When the hardware security unit 162 determines that the usage code and the identification code of the identity authentication data respectively correspond to the stored identification code and the control terminal code of the identity identification data 203, and at the same time, the authentication value in the identity authentication data matches When the reference authentication value is used, the flow proceeds to step 309; otherwise, the flow proceeds to step 313.

In step 309, the hardware security unit 162 transmits the authentication success notification. To the micro control unit 161.

In step 310, when the micro control unit 161 receives the authentication success notification from the hardware security unit 162, and receives the control from the control terminal 2 and related to the smart lock 1 via the communication module 12 When instructing, the micro control unit 161 controls the smart lock 1 to perform the corresponding operation according to the control command.

In step 311, the micro control unit 161 generates and transmits the control reply to the hardware security unit 162, and stores the operation record 201 performed by the smart lock 1 in the first storage unit 141.

In step 312, when the hardware security unit 162 receives the control reply from the micro control unit 161, the hardware security unit 162 encrypts the control reply with the device key 206 and transmits the control reply via the communication module 12. To the control terminal 2, the control terminal 2 determines whether the encrypted control response is from the smart lock 1 according to the reference device key 22 and the encrypted control reply.

In step 313, the hardware security unit 162 transmits the authentication failure notification to the micro control unit 161.

In step 314, when the micro control unit 161 receives the authentication failure notification from the hardware security unit 162, the micro control unit 161 stores the operation record 201 of the authentication failure.

A second embodiment of the smart lock control method of the present invention is The second embodiment of the smart lock 1 is implemented and is substantially the same as the first embodiment, and the same is not in the rumor, wherein the difference is that before the step 304 is performed, a receiving step is also included (Fig. The micro-control unit 161 receives the control terminal application from the control terminal 2 via at least one of the signature and the encryption executed by the control terminal 2 via the communication module 12, the micro-control Unit 161 transmits the console application of at least one of the signature and the encryption to the hardware security unit 162. In step 304, the control terminal application received by the hardware security unit 162 and executed by the control terminal 2 is from the micro control unit 161. In addition, before performing step 308, another receiving step (not shown) is further included. When the micro control unit 161 receives the identity authentication data from the control terminal 2 via the communication module 12, the micro control unit 161 transmits the identity authentication data to the hardware security unit 162. In step 308, the identity authentication data received by the hardware security unit 162 is from the micro control unit 161. Moreover, in step 312, the hardware security unit 162 transmits the encrypted control reply to the micro control unit 161, and after step 312, further includes a transmitting step (not shown), when the micro control unit When receiving the encrypted control reply, the micro control unit 161 transmits the encrypted control reply to the control terminal 2 via the communication module 12.

In summary, the smart lock and smart lock control method of the present invention, by the smart lock 1 , verify whether the application 202 is specific to the application based on the reference program key 204. The application ensures that the application 202 executed by the smart lock 1 is the specific application, thereby improving the security of the use of the smart lock 1. In addition, by replacing the user account with the identification code as the identity authentication of the specific user, the privacy of the specific user can be protected, and even if the identification code is lost, there is no need to worry that the person who obtains the identification code will speculate. The smart lock 1 corresponding to the identification code. Furthermore, by using the one-time authentication value, the use security of the smart lock 1 can also be improved. Moreover, when the control terminal 2 is an electronic device held by the specific user, since the control terminal 2 directly communicates with the lock device, the operation record 201 of the control device 2 for the lock device is only recorded in the lock device 201. The lock is not recorded in a third party, thereby ensuring the privacy of the particular user, and indeed the object of the present invention can be achieved.

However, the above is only the embodiment of the present invention, and the scope of the invention is not limited thereto, and all the simple equivalent changes and modifications according to the scope of the patent application and the patent specification of the present invention are still Within the scope of the invention patent.

Claims (12)

A smart lock control method is implemented by a smart lock, which is electrically connected to a control terminal and used to store an application corresponding to at least one of identity identification data, signature and encryption of a specific user. a program, a device key, and a reference program key associated with a specific application, the control end storing a reference device key corresponding to the device key, the smart lock control method comprising the following steps: (A) Verifying, by the smart lock, whether the application is the specific application based on the reference program key; (B) executing the application by the smart lock when the application is verified as the specific application, and Establishing a connection with the control terminal on a communication network; (C) when the smart lock receives the identity authentication data from the control terminal, by using the smart lock, determining whether the identity authentication data from the control terminal is consistent with the stored The identity identification data; (D) when the smart lock determines that the identity authentication data matches the stored identity identification data, and receives the control from the And related to the control command of the smart lock, by the smart lock, performing a corresponding operation according to the control command; and (E) generating a control reply by the smart lock, and encrypting with the device key The control replies and transmits to the control terminal for the control terminal to The reference device key, and the encrypted control reply, determine whether the encrypted control reply is from the smart lock. The smart lock control method according to claim 1, wherein the identity identification data includes an identification code, and in the step (C), the identity authentication material includes a usage code. The smart lock control method according to claim 2, wherein the control terminal stores a control terminal key, and the smart lock further stores a reference control terminal key corresponding to the control terminal key, wherein, in step (C) The identity authentication data further includes an authentication value generated by the control terminal according to the control terminal key, and the smart lock further generates a reference authentication value according to the reference control terminal key, and determines the identity in the identity authentication data. Whether the authentication value corresponds to the reference authentication value, and in step (D), when the smart lock determines that the usage code of the identity authentication data matches the stored identification code of the identity identification data, and at the same time the identity authentication data When the authentication value in the certificate matches the reference authentication value, the smart lock performs the corresponding operation according to the control instruction. The smart lock control method according to claim 2, wherein the identity identification data further includes a control terminal code associated with the control terminal, and in step (C), the identity authentication data further includes a control terminal Identifier. The smart lock control method according to claim 1, wherein the smart lock is further configured to store a reference control key associated with a specific console application, and between step (B) and step (C), The following steps: (F) when the smart lock receives a control terminal application from the control terminal and is executed by the control terminal, at least one of the signature and the encryption, according to the smart lock, according to the reference control terminal key, Verify that the console application is the particular console application; wherein step (C) is executed when the console application is verified as the particular console application. The smart lock control method according to claim 1, after step (D), further comprising, in a step (G), storing, by the smart lock, an operation record performed by the step (D) in the smart lock. A smart lock, the communication ground is connected to a control end storing a reference device key, and includes: a lock module operable to one of a locked state and an unlocked state; and a communication module via a a communication network is connected to the control terminal; a storage module is configured to store an application corresponding to at least one of identity identification data, a signature and encryption of a specific user, and a device corresponding to the reference device key a key, and a reference program key associated with a specific application; and a processing module electrically connecting the lock module, the communication module and the storage module, and for verifying according to the reference program key Whether the application is for that particular application, when the application is verified as the specific application In the program, the processing module executes the application and establishes a connection with the control terminal on the communication network. When the processing module receives the identity authentication data from the control terminal via the communication module, the processing module Determining whether the identity authentication data from the control terminal matches the stored identity identification data, and when the processing module determines that the identity authentication data matches the stored identity identification data, and receives the identity identification data via the communication module, When the control terminal is related to a control command of the smart lock, the processing module controls the smart lock to perform a corresponding operation according to the control command, and the processing module controls the smart lock according to the control command to perform the corresponding operation. After the operation, the processing module further generates a control reply, and encrypts the control reply with the device key and transmits the control reply to the control terminal, so that the control terminal determines according to the reference device key and the encrypted control reply. Whether the encrypted response to the control is from the smart lock. The smart lock according to claim 7, wherein the identity identification data includes an identification code, and the identity authentication material includes a usage code. The smart terminal of claim 8, wherein the control terminal stores a control terminal key, wherein the storage module is further configured to store a reference control key corresponding to the control terminal key, and the identity authentication data is further The processing module further generates a reference authentication value according to the reference control terminal key, and determines whether the authentication value in the identity authentication data matches the authentication value generated by the control terminal according to the control terminal key. The reference authentication value when the processing module Determining that the usage code of the identity authentication data matches the identification code of the stored identity identification data, and at the same time, the authentication value in the identity authentication data matches the reference authentication value, the smart lock is performed according to the control instruction. Corresponding to this operation. The smart lock according to claim 8, wherein the identity identification data further includes a control terminal code associated with the control terminal, and the identity authentication data further includes an identification code associated with the control terminal. The smart lock according to claim 7, wherein the storage module is further configured to store a reference control key associated with a specific console application, after the processing module establishes the connection with the control terminal, When the processing module further receives, via the communication module, a control terminal application from the control terminal and executed by the control terminal, at least one of a signature and an encryption, the processing module is configured according to the reference control terminal Key, verifying whether the console application is the specific console application, and when the console application is verified as the specific console application, the processing module determines the received identity authentication of the console Whether the data matches the stored identity identification data. The smart lock according to claim 7, wherein the processing module further stores an operation record performed by the smart lock in the storage module.