WO2017071249A1

WO2017071249A1 - Access management method and system

Info

Publication number: WO2017071249A1
Application number: PCT/CN2016/086211
Authority: WO
Inventors: 洪伟
Original assignee: 广州畅联信息科技有限公司
Priority date: 2015-10-28
Filing date: 2016-06-17
Publication date: 2017-05-04
Also published as: CN105389870A

Abstract

An access management method and system, the method comprising: a back-end processing centre receives a creator registration request command, and after registration conditions are satisfied, assigns a cluster to the creator (S1); the back-end processing centre, on the basis of a received member addition command, adds the corresponding member to the cluster (S2); the back-end processing centre, on the basis of a received role setup command, assigns corresponding roles to the members in the cluster (S3); and the back-end processing centre, on the basis of a received access usage permission setup command, sets up access usage permission for the corresponding members of the cluster (S4), the access usage permission comprising virtual access serial number information and validity time information corresponding to the virtual access serial number information. The present method and system implement access mobile management and role hierarchy management, facilitating permissions management of the members in the cluster by a manager, the members in the cluster being able to generate online a virtual key in the access usage permission, and also being able to share the virtual key, having great flexibility and real-time performance.

Description

Access control management method and system

Technical field

The invention relates to an access control management method and system.

Background technique

At present, the access control management system is mainly based on local stand-alone or C/S model. The setting and management of access control is operated by main means such as induction card, wireless signal and online network. The access control system focuses on the use and management of peripheral data, especially concentrated. On the relevant data of the access control. Both access control and authorization are required to be implemented offline and personnel are required to participate. For example, in the hotel scene, the induction card lock and its access control system are commonly used. The system is usually a localized stand-alone version of the windows exe software, which uses the induction card as the key to open the access control, usually called a room card. The setting and management of the room card needs to use the USB interface to access the card writer, and update the data to the room card through the card writer. The system does not pay attention to the roles and permissions of the people themselves, and the dynamic change of their data. In this process, the management of access control relies heavily on the participation of personnel, and requires additional peripheral configuration, which cannot be updated online, real-time rights release, etc., and cannot adapt and adjust the dynamic changes of personnel roles and permissions in a timely manner. .

Summary of the invention

In order to overcome the deficiencies of the prior art, the present invention aims to provide an access control management method and system, realize mobile management and role level management, facilitate permission control, and generate virtual keys and share virtual keys online, thereby reducing management. cost.

In order to solve the above problems, the technical solution adopted by the present invention is as follows:

Option One:

An access control management method includes the following steps:

The backend processing center receives the registration request instruction of the creator, and allocates at least one cluster to the creator after the registration condition is met, and each cluster includes a virtual access control corresponding to the entity access control;

The backend processing center adds corresponding members in the corresponding cluster according to the received member addition instruction;

The backend processing center allocates a corresponding role to the members in the corresponding cluster according to the received role setting instruction;

The back-end processing center sets the access control permission for the corresponding member in the corresponding cluster according to the received access control permission setting instruction, and the access control permission includes the virtual access control number information and the valid time information corresponding to the virtual access control number information;

The user communicates with the backend processing center through a mobile terminal or a PC terminal.

Preferably, the role includes an administrator, a group administrator, and a normal member; wherein the administrator has the access permission of all the virtual access control and the authority of the management group administrator and the ordinary member; the access permission and the member management authority of the group administrator are Administrator settings; access rights for ordinary members are set by the administrator or the corresponding group administrator.

Preferably, the method further comprises the following steps:

The backend processing center receives the key generation request instruction, determines whether the key generation request instruction is legal, and if so, generates a corresponding virtual key to be sent to the terminal that initiates the key generation request, otherwise returns a failure information; and determines whether the key generation request is legal. The rule is: whether the virtual access number information and the valid time information in the key generation request are initiated The key generates the access permission of the member of the request.

Preferably, the method further comprises the following steps:

The back-end processing center receives the key sharing request command, and determines the role of the member who initiated the key generation request instruction. If the role is an administrator or a group administrator, the corresponding virtual key is generated and sent to the terminal of the sharing target; if the role is a normal member Then, the corresponding group administrator or administrator reviews the information of the sharing target, and the audit generates a corresponding virtual key to be sent to the terminal of the sharing target.

Preferably, the virtual key includes two-dimensional code data or signal data for opening a corresponding physical access control.

Option II:

An access control management system applied to a back-end processing center, including the following modules:

a module is configured to receive a registration request instruction of the creator, and at least one cluster is allocated to the creator after the registration condition is met, and each cluster includes a virtual access control corresponding to the entity access control;

a member adding module, configured to add a corresponding member in the corresponding cluster according to the received member adding instruction;

a role assignment module, configured to allocate a corresponding role to a member in the corresponding cluster according to the received role setting instruction;

The access control permission setting module is configured to set the access control permission for the corresponding member in the corresponding cluster according to the received access control permission setting instruction, where the access control permission information includes the virtual access control number information and the valid time information corresponding to the virtual access control number information. ;

Wherein, it is used to perform with the backend processing center through a mobile terminal or a PC terminal. Communication.

Preferably, the following modules are also included:

a key generation module, configured to receive a key generation request, determine whether the key generation request is legal, and if yes, generate a corresponding virtual key to be sent to the terminal that initiates the key generation request, otherwise return a failure information; determine whether the key generation request is legal The rule is: whether the virtual door number information and the valid time information in the key generation request are in the access permission of the member who initiated the key generation request.

Preferably, the following modules are also included:

a key sharing module, configured to receive a key sharing request, determine a role of a member that initiates the key generation request, and if the role is an administrator or a group administrator, generate a corresponding virtual key to send to the terminal of the sharing target; if the role is a normal member Then, the corresponding group administrator or administrator reviews the information of the sharing target, and the audit generates a corresponding virtual key to be sent to the terminal of the sharing target.

Compared with the prior art, the beneficial effects of the present invention are as follows: 1. Implementing mobility management of the access control and role level management, facilitating the administrator to control the rights of the members in the cluster; 2. Members in the cluster can generate the access control online. Use the virtual key within the permission, And the ability to share virtual keys with great flexibility and real-time, no longer relying on physical keys. 3. The virtual key can be obtained through the mobile terminal to realize the way the mobile phone opens the access control. 4, using the QR code as a virtual key, can share the key through SMS, WeChat, email, etc., improving the convenience of access control.

DRAWINGS

1 is a flow chart of a method for managing access control according to the present invention.

2 is a flow chart of a method for generating a virtual key based on two-dimensional code data according to the present invention.

3 is a block diagram showing the structure of an access control management system of the present invention.

detailed description

The present invention will be further described below in conjunction with the drawings and specific embodiments.

Referring to FIG. 1, an access control management method is mainly applied to a backend processing center, wherein a user communicates with the backend processing center through a mobile terminal or a PC terminal, and the user may be a creator, a member in the cluster, or Visitors can easily communicate with the back-end processing center through terminals with network communication functions, especially portable mobile terminals such as smart phones and smart tablets, and users can use different clients through the open interfaces corresponding to the back-end processing center. The third party application accesses the backend processing center for data communication. The method includes the following steps:

S1: The backend processing center receives the registration request instruction of the creator, and allocates at least one cluster to the creator after the registration condition is met, and each cluster includes a virtual access control corresponding to the physical access control. The creator needs to satisfy the registration condition by real-name authentication, etc., and the allocated cluster is determined according to different physical scenarios, such as a hotel, an office building, or An apartment determines the structure in the cluster according to the structure in different entity scenarios, that is, the entity access control in the entity scenario corresponds to the virtual access control in the cluster, and the creator can be allocated multiple times according to the request when the creator registers. Different clusters, each cluster corresponds to a different entity scenario.

S2: The backend processing center adds corresponding members in the corresponding cluster according to the received member addition instruction. Among them, the added members first need to be registered as a registered member to be added to the cluster.

S3: The backend processing center allocates a corresponding role to the members in the corresponding cluster according to the received role setting instruction.

Among them, the role includes the administrator, the group administrator and the ordinary member; the administrator has the access permission of all virtual access control and the authority of the management group administrator and the ordinary member; the access permission and member management authority of the group administrator are set by the administrator. The access rights of ordinary members are set by the administrator or the corresponding group administrator. For rights management, it uses the RBAC model for horizontal and vertical expansion of roles and permissions. It should be noted that the creator is also a member of the cluster. It has the highest access control rights and member management rights. It can also disband the cluster and modify the virtual access control in the cluster. It can be understood as the role of the super administrator. The creator is assigned according to the members in the cluster, which can be one or more, and the administrator's permissions are second only to the creator's permissions.

The group administrator's access control rights and member management rights can also be set by the creator. For example, in an office building scenario, a company's administrator needs to rent 101 of them to work, and the company has 9 Employees, after the company’s administrators and employees are registered, the company’s administrators can be assigned as group administrators and are set up. In order to have the access control permission of virtual access number 101 and the management rights of members managing 9 ordinary members, the group administrator can also assign the access control permission of virtual access number 101 to the nine ordinary members managed by the group. .

S4: The back-end processing center sets the access control permission for the corresponding member in the corresponding cluster according to the received access permission setting instruction. The access permission includes the virtual access number information and the valid time information corresponding to the virtual access number information. The virtual access control number information refers to the number of the virtual access control in the cluster, and the valid time information refers to the start time and the end time of the corresponding access control.

S5: The backend processing center receives the key generation request instruction, determines whether the key generation request instruction is legal, and if yes, generates a corresponding virtual key to be sent to the terminal that initiates the key generation request, otherwise returns a failure information; and determines the key generation request instruction. Whether the rule is legal is whether the virtual door number information and the valid time information in the key generation request instruction are in the access permission of the member who initiated the key generation request.

Among them, any member in the cluster can set the corresponding access control permission, but different members may have different access control permissions, so when receiving the key generation request command, it is necessary to determine whether the request is legal, mainly in the verification request. Whether the virtual access number information is included in the virtual access number information of the access permission of the member initiating the request, and whether the time information is within the valid time information of the access permission of the member initiating the request.

S6: The backend processing center receives the key sharing request command, and determines the role of the member that initiates the key generation request instruction. If the role is an administrator or a group administrator, the corresponding virtual key is generated and sent to the sharing target terminal; if the role is Ordinary member The group administrator or the administrator reviews the information of the sharing target, and the auditing generates a corresponding virtual key to be sent to the terminal of the sharing target.

Among them, members with access control rights or personnel management rights can share virtual keys within their rights. For example, in the office building scenario, there are often visitors who need to conduct business contacts. Members can share the corresponding virtual key. For members who have administrative rights, they belong to the administrator who can assign access rights to members, and they must have corresponding access rights. Moreover, if the ordinary member performs virtual key sharing, the corresponding group administrator or administrator needs to perform the review. Specifically, the visitor can register the visitor identity information to the backend processing center through the mobile terminal, and then the ordinary member targets the The visitor identity information initiates a key sharing request command, and the corresponding group administrator or administrator receives the visitor identity information and the key sharing request command, and then performs an audit. After the audit is passed, the corresponding virtual key is generated and sent to the sharing target terminal. Specifically, the corresponding virtual key is generated according to the information in the key sharing request and the identity information of the visitor.

The above-mentioned virtual key includes two-dimensional code data or signal data for opening a corresponding physical access control. For example, if it is two-dimensional code data, it is sent to the display module of the corresponding terminal to display the two-dimensional code picture, and the corresponding physical access control also needs to have a two-dimensional code reading function; if it is signal data, the signal data is sent. To the corresponding signal carrier, the corresponding physical access control also needs to have a signal reading function, such as Bluetooth signal data, radio frequency signal data and the like.

Based on the above-mentioned access control management method, it can be widely applied to hotel access control management, office building access control, and apartment access control management, for example, based on a hotel to generate a corresponding cluster. Add the manager of the hotel to the administrator in the cluster, the staff member is a normal member, and add the registered member to the ordinary member. The manager of the hotel can set the corresponding access control permission for the ordinary member. For some, there is no registration. The customer can also obtain the corresponding virtual key by registering the visitor identity information and then sharing the virtual key by the staff member.

For the above virtual key, if the virtual key is two-dimensional code data, the present invention also discloses a preferred virtual key generation method based on two-dimensional code data, and the specific virtual key method includes the following steps:

Step 1: Receive a data request for generating a virtual key, and generate basic data of the virtual key according to the data request.

Step 2: Verify the valid time information in the basic data. If the verification passes, go to step 3. If the verification fails, return the verification failure message and end the process.

Step 3: The basic data is compressed into consecutive bytes according to a preset format to generate formatted data.

Step 4: Convert the encrypted data according to the specified hexadecimal to generate hexadecimal conversion data.

Step 5: Generate the corresponding two-dimensional code data by using the hexadecimal conversion data as the final data of the virtual key.

In step 1, the data request is initiated by a user who needs to apply for a virtual key corresponding to the access control, and the virtual key needs to be input when the virtual key is applied, and the user's identity information, virtual access control number information, and valid information are included in the data request. Time information, and then obtain the corresponding number in the database according to the identity information and the virtual access number information respectively According to the data obtained from the database combined with the effective time information, the basic data of the virtual key is generated. In addition, after receiving the identity information and the virtual access control number information, the step of verifying the legitimacy may be included to ensure that the user has the right to apply for the virtual key, and the target access control exists. Of course, in addition to the identity information and the virtual access number information, the data request may include other key information, and finally combine various data to generate basic data of the virtual key.

In step 2, specifically, the valid time data in the check basic data includes the following check condition: whether the format of the valid time data is valid, and whether the start time in the valid time data is greater than Or equal to the current time; if all the check conditions are yes, the check passes, otherwise the check fails. For example, if the length of the valid time data is invalid, the verification fails. If the month occurs, the verification fails.

Basic data may include operators, identifiers, time, access control, etc., each of which has a separate byte space, but some data does not fill the space in the byte, for example, the operator may only occupy one word. The 4 bits in the section have the remaining space in the byte. In order to make the basic data occupy less memory and increase the data reading efficiency as much as possible, in step 3, the data in the basic data is pre-predicted. The format is compressed in consecutive bytes, there is no waste of space, and the generated formatted data takes up less space.

In step 4, the partial data specified in the formatted data is dynamized, and the dynamization process is specifically: performing a reserved format encryption operation, that is, transforming the original data to obtain data of the same format and length, but the data value is changed. After the reserved format encryption operation, the CRC check is performed, for example, the identity information, the virtual access control number information, and the valid The time information is verified by the key information. After verification, the check code is generated and the check code is stored in a field for later verification of data integrity. In the subsequent decoding, the data in the field is verified. Verify the integrity of the data. The cryptographically processed formatted data is encrypted, and the encryption algorithm can use an existing encryption algorithm to generate encrypted data after encryption. In step 5, the encrypted data is converted according to the specified hexadecimal to generate hexadecimal conversion data, and specifically, binary conversion can be performed. After the processing of step S3, the data is first transformed by the reserved format encryption operation, and then the encryption process is performed, so that the data has good security and finally converted into binary data, so that non-plain data is obtained, which further Increased data security.

Corresponding to the access control management method in the above embodiment, the present invention also discloses an access control management system, which is applied to a backend processing center, and includes the following modules:

The creating module is configured to receive a registration request instruction of the creator, and allocate a cluster to the creator after the registration condition is met, where the cluster includes a virtual access control corresponding to the entity access control;

a member adding module, configured to add a corresponding member in the cluster according to the received member adding instruction;

a role assignment module, configured to allocate a corresponding role to a member in the cluster according to the received role setting instruction;

The access permission setting module is configured to set the access permission for the corresponding member in the cluster according to the received access permission setting instruction, where the access permission includes virtual access number information and valid time information corresponding to the virtual access number information;

Wherein, it is used for communicating with the backend processing center through a mobile terminal or a PC terminal.

Preferably, the following modules are also included:

Various other changes and modifications may be made by those skilled in the art in light of the above-described technical solutions and concepts, and all such changes and modifications are intended to fall within the scope of the appended claims.

Claims

An access control management method, comprising the steps of:

The backend processing center receives the registration request instruction of the creator, and allocates at least one cluster to the creator after the registration condition is met, and each cluster includes a virtual access control corresponding to the entity access control;

The backend processing center adds corresponding members in the corresponding cluster according to the received member addition instruction;

The backend processing center allocates a corresponding role to the members in the corresponding cluster according to the received role setting instruction;

The back-end processing center sets the access control permission for the corresponding member in the corresponding cluster according to the received access control permission setting instruction, and the access control permission includes the virtual access control number information and the valid time information corresponding to the virtual access control number information;

The user communicates with the backend processing center through a mobile terminal or a PC terminal.
The access control management method according to claim 1, wherein the role includes an administrator, a group administrator, and a normal member; wherein the administrator has the access permission of all the virtual access control and the authority of the management group administrator and the ordinary member; The access permission and member management rights of the group administrator are set by the administrator; the access rights of the ordinary members are set by the administrator or the corresponding group administrator.
The access control management method according to claim 2, further comprising the following steps:

The backend processing center receives the key generation request instruction, determines whether the key generation request instruction is legal, and if so, generates a corresponding virtual key to be sent to the initiation key generation request. In the terminal, otherwise, the failure information is returned; the rule for determining whether the key generation request instruction is legal is: whether the virtual door number information and the valid time information in the key generation request are in the access permission of the member who initiated the key generation request instruction.
The access control management method according to claim 3, further comprising the following steps:

The back-end processing center receives the key sharing request command, and determines the role of the member who initiated the key generation request instruction. If the role is an administrator or a group administrator, the corresponding virtual key is generated and sent to the terminal of the sharing target; if the role is a normal member Then, the corresponding group administrator or administrator reviews the information of the sharing target, and the audit generates a corresponding virtual key to be sent to the terminal of the sharing target.
The access control management method according to claim 3 or 4, wherein the virtual key includes two-dimensional code data or signal data for opening a corresponding physical access control.
An access control management system is characterized in that it is applied to a backend processing center, and includes the following modules:

a module is configured to receive a registration request instruction of the creator, and at least one cluster is allocated to the creator after the registration condition is met, and each cluster includes a virtual access control corresponding to the entity access control;

a member adding module, configured to add a corresponding member in the corresponding cluster according to the received member adding instruction;

a role assignment module, configured to allocate a corresponding role to a member in the corresponding cluster according to the received role setting instruction;

The access control permission setting module is configured to set the access control permission for the corresponding member in the corresponding cluster according to the received access control permission setting instruction, where the access control permission information includes the virtual access control number information and the valid time information corresponding to the virtual access control number information. ;

Wherein, it is used for communicating with the backend processing center through a mobile terminal or a PC terminal.
The access control management system according to claim 6, wherein the role comprises an administrator, a group administrator, and a general member; wherein the administrator has the access permission of all the virtual access control and the authority of the management group administrator and the ordinary member; The access permission and member management rights of the group administrator are set by the administrator; the access rights of the ordinary members are set by the administrator or the corresponding group administrator.
The access control management system according to claim 7, further comprising the following modules:

a key generation module, configured to receive a key generation request instruction, determine whether the key generation request instruction is legal, and if yes, generate a corresponding virtual key to be sent to the terminal that initiates the key generation request, otherwise return a failure information; and determine the key generation request instruction Whether the rule is legal is whether the virtual door number information and the valid time information in the key generation request instruction are in the access permission of the member who initiated the key generation request instruction.
The access control management system according to claim 8, further comprising the following modules:

a key sharing module, configured to receive a key sharing request command, determine a role of a member that initiates the key generation request instruction, and if the role is an administrator or a group administrator, generate a corresponding virtual key to send to the terminal of the sharing target; Ordinary member The group administrator or the administrator reviews the information of the sharing target, and the auditing generates a corresponding virtual key to be sent to the terminal of the sharing target.
The access control management system according to claim 8 or 9, wherein the virtual key includes two-dimensional code data or signal data for opening a corresponding physical access control.