WO2020259397A1

WO2020259397A1 - Smart lock, security platform and authentication method therefor

Info

Publication number: WO2020259397A1
Application number: PCT/CN2020/097011
Authority: WO
Inventors: 彭小斌
Original assignee: 国民技术股份有限公司
Priority date: 2019-06-26
Filing date: 2020-06-19
Publication date: 2020-12-30
Also published as: CN112152963B; CN112152963A; TW202105222A

Abstract

Disclosed in the present invention are a smart lock, a security platform and an authentication method therefor. The smart lock comprises a first security chip and a first communication unit communicatively connected to the first security chip, and before performing data transmission with a security platform, the smart lock performs bidirectional authentication with the security platform by means of the first security chip and the first communication unit, thereby solving the problem in the prior art of high risk caused by no authentication being performed or authentication being performed only at a single end before data transmission between a smart lock and a security platform, and improving the security of data transmission between the smart lock and the security platform. Also disclosed in the present invention is a security platform. The security platform comprises a second security chip and a second communication unit, and before data transmission with a smart lock, the security platform performs bidirectional verification with the smart lock by means of the second security chip and the second communication unit, thereby improving the security of data transmission between the security platform and the smart lock.

Description

Intelligent lock, safety platform and authentication method thereof

Technical field

The invention relates to the field of smart locks, and more specifically, to a smart lock, a safety platform and an authentication method thereof.

Background technique

For some existing smart locks and security platforms, the smart lock will not authenticate the security platform before data transmission, and the security platform will not authenticate the smart lock. In this way, the risk of data transmission between the smart lock and the security platform is It will be very high. The smart lock may send data to other security platforms, and the security platform may also send data to other smart locks, causing data leakage; in some other smart locks and security platforms, before data transmission, The smart lock will authenticate the security platform to determine whether it is the target security platform, or the security platform will authenticate the smart lock to determine whether it is the target smart lock, but this authentication method is not highly secure and easily leads to data leakage.

Summary of the invention

The technical problem to be solved by the present invention lies in the high risk that the existing smart lock and the safety platform do not perform authentication before transmitting data or only perform authentication by a single end. Aiming at this technical problem, a smart lock and a safety platform are provided.

In order to solve the above technical problems, the present invention provides a smart lock, which includes:

A first security chip and a first communication unit communicatively connected with the first security chip;

The first security chip is used to generate a first random sequence and obtain a second random sequence from a security platform through the first communication unit, and encrypt the device authentication plaintext using an authentication key pre-stored on the smart lock side The device authentication code is obtained by processing, and then the device authentication code is transmitted to the security platform through the first communication unit, so that the security platform can authenticate the smart lock; the device authentication plaintext is written by the first communication unit A random sequence and the second random sequence are combined according to the first combination rule; the first security chip is also used to transmit the first random sequence to the security platform through the first communication unit, and pass The first communication unit receives the platform authentication code generated by the security platform based on the first random sequence and the second random sequence, and then uses the authentication key to decrypt the platform authentication code to obtain platform authentication plaintext; The first security chip is further configured to combine the first random sequence and the second random sequence according to a second combination rule to obtain platform authentication plaintext, and compare the platform authentication plaintext with the platform authentication plaintext, and according to the comparison result Determine whether the authentication of the security platform is passed;

The first communication unit is used to implement data transmission between the first security chip and the security platform.

Optionally, the first communication unit is configured to send the device authentication code and the first random sequence to the security platform together.

Optionally, the first random sequence is a first random number, the second random sequence is a second random number, the device authentication plaintext is (first random number|second random number), and the platform authentication The plain text is (second random number|first random number).

Optionally, the first security chip is further configured to perform encryption key-based data transmission with the security platform through the first communication unit after passing the authentication of the security platform.

Optionally, the first security chip is further configured to generate a first process key based on the encryption key, the first random sequence, and the second random sequence, and use the first process key to be sent Encrypt the first data of the security platform, and send the encrypted first data cipher text to the security platform through the first communication unit; the first security chip is also used to based on the encryption key , The first random sequence and the second random sequence generate a second process key, and use the second process key to encrypt the second data sent by the security platform received through the first communication unit The text is decrypted to obtain the second data.

Optionally, the first process key is different from the second process key.

Further, the present invention also provides a smart lock authentication method, which is applied to the above smart lock, the smart lock includes: a first security chip and a first communication unit communicatively connected with the first security chip; Methods include:

The first security chip generates a first random sequence, and obtains a second random sequence from the security platform through the first communication unit, and encrypts the device authentication plaintext using an authentication key pre-stored on the smart lock side Obtain the device authentication code, and then transmit the device authentication code to the security platform through the first communication unit; wherein the device authentication plaintext consists of the first random sequence and the second random sequence in accordance with the first Combination rules are combined;

The first security chip transmits the first random sequence to the security platform through the first communication unit, and receives the security platform based on the first random sequence and the security platform through the first communication unit. The platform authentication code generated by the second random sequence, and then use the authentication key to decrypt the platform authentication code to obtain the platform authentication plaintext;

The first security chip combines the first random sequence and the second random sequence according to the second combination rule to obtain platform authentication plaintext, compares the platform authentication plaintext with the platform authentication plaintext, and determines the right to the platform according to the comparison result. Whether the certification of the security platform is passed.

Further, the present invention also provides a security platform, which includes:

A second security chip and a second communication unit communicatively connected with the second security chip;

The second security chip is used to generate a second random sequence and send the second random sequence to the smart lock through the second communication unit, obtain the first random sequence from the smart lock through the second communication unit, and The smart lock generates a device authentication code based on the first random sequence and the second random sequence, and then uses an authentication key pre-stored on the security platform to decrypt the device authentication code to obtain device authentication Plain text; the second security chip is also used to combine the first random sequence and the second random sequence according to the first combination rule to obtain the device authentication plain text; and compare the device authentication plain text and the device authentication plain text According to the comparison result, it is determined whether the authentication of the smart lock is passed; the smart lock is also used to use the authentication key to encrypt the platform authentication plaintext to obtain the platform authentication code, and then to pass the authentication code to the platform through the second communication unit The platform authentication code is transmitted to the smart lock for the smart lock to authenticate the security platform; the platform authentication plaintext is combined by the first random sequence and the second random sequence according to a second combination rule get;

The second communication unit is used to implement data transmission between the second security chip and the smart lock.

Optionally, the second security chip is further configured to generate a first subkey based on the root key, and then based on the unique identifier of the first security chip of the smart lock received through the second communication unit and the The first subkey generates an authentication key, stores the authentication key, and sends the authentication key to the smart lock through the second communication unit, so that the smart lock stores the authentication key.

Optionally, the second security chip is further configured to generate a second subkey based on the root key, and then based on the unique identifier of the first security chip of the smart lock received through the second communication unit and the The second subkey generates an encryption key, stores the encryption key, and sends the encryption key to the smart lock through the second communication unit, so that the smart lock stores the encryption key.

Optionally, the second security chip is further configured to receive the public key sent by the smart lock through the second communication unit, and use the public key to encrypt the encryption key to obtain the encryption key. And send the encryption key ciphertext to the smart lock through the second communication unit, so that the smart lock uses the private key corresponding to the public key to perform the encryption key ciphertext The encryption key is obtained by decryption and stored.

Further, the present invention also provides a security platform authentication method, which is applied to the aforementioned security platform, the security platform comprising: a second security chip and a second communication unit communicatively connected with the second security chip; Methods include:

The second security chip generates a second random sequence and sends the second random sequence to the smart lock through the second communication unit, and obtains the first random sequence from the smart lock and the smart lock through the second communication unit. The smart lock generates a device authentication code based on the first random sequence and the second random sequence, and then uses an authentication key pre-stored on the security platform to decrypt the device authentication code to obtain the device authentication plaintext;

The second security chip combines the first random sequence and the second random sequence according to the first combination rule to obtain the device authentication plain text; and compares the device authentication plain text and the device authentication plain text, and determines according to the comparison result Whether the authentication of the smart lock is passed; the smart lock also uses the authentication key to encrypt the platform authentication plaintext to obtain the platform authentication code, and then transmits the platform authentication code to the station through the second communication unit The smart lock is used for the smart lock to authenticate the security platform; wherein the platform authentication plaintext is obtained by combining the first random sequence and the second random sequence according to a second combination rule.

Beneficial effect

The present invention provides a smart lock, a security platform and an authentication method thereof, aiming at the high risk of not performing authentication before transmitting data between the existing smart lock and the security platform or only performing authentication by a single end, the smart lock includes a first security chip and A first communication unit communicatively connected with the first security chip. The security platform includes a second security chip and a second communication unit communicatively connected with the second security chip. Before data transmission, the first security chip passes through the first communication unit Send the generated first random sequence to the security platform, the second security chip sends the generated second random sequence to the smart lock through the second communication unit, and the first security chip generates device authentication based on the first random sequence and the second random sequence The code is sent to the security platform for the security platform to authenticate the smart lock. The second security chip generates the platform identification code based on the first random sequence and the second random sequence and sends it to the smart lock for the smart lock to authenticate the security platform. That is, in the present invention, before data transmission between the smart lock and the security platform, the smart lock authenticates the security platform based on the platform authentication code, and the security platform authenticates the smart lock based on the device authentication code, which improves the security of data transmission.

Description of the drawings

The present invention will be further described below in conjunction with the accompanying drawings and embodiments. In the accompanying drawings:

Figure 1 is a schematic structural diagram of a smart lock provided by a first embodiment of the present invention;

2 is a schematic diagram of the first structure of the smart lock provided by the first embodiment of the present invention

FIG. 3 is a schematic structural diagram of a security platform provided by the first embodiment of the present invention;

4 is a schematic diagram of the first structure of the security platform provided by the first embodiment of the present invention;

5 is a first schematic diagram of the security platform and smart lock authentication provided by the first embodiment of the present invention;

6 is a schematic diagram of a second structure of the smart lock provided by the first embodiment of the present invention;

7 is a schematic diagram of the authentication key generation provided by the first embodiment of the present invention;

8 is a schematic diagram of a second structure of the security platform provided by the first embodiment of the present invention;

9 is a second schematic diagram of the security platform and smart lock authentication provided by the first embodiment of the present invention;

10 is a schematic diagram of encryption key generation provided by the first embodiment of the present invention;

FIG. 11 is a schematic diagram of interaction between the security platform and the smart lock provided by the second embodiment of the present invention.

Detailed ways

In order to make the content of the present invention easier to understand, the present invention will be further described in detail below through specific embodiments in conjunction with the accompanying drawings. It should be understood that the specific embodiments described here are only used to explain the present invention, but not to limit the present invention.

Example one:

In order to solve the problem of low security due to no authentication or only single-ended authentication before data transmission between the existing smart lock and the security chip, this embodiment provides a smart lock and a security platform.

As shown in FIG. 1, the smart lock includes a first security chip 101 and a first communication unit 102 communicatively connected with the first security chip 101.

Wherein, the first security chip 101 and the first communication unit 102 may be directly connected, or, as shown in FIG. 2, the smart lock further includes a first processor 103, and the first processor 103 is connected to the first security chip 101, The first processor 103 is connected to the first communication unit 102, and the first security chip 101 communicates with the first communication unit 102 through the first processor 103.

This embodiment also provides an authentication method corresponding to the smart lock, and the method includes:

The first security chip generates the first random sequence, and obtains the second random sequence from the security platform through the first communication unit, and uses the authentication key pre-stored on the smart lock side to encrypt the device authentication plaintext to obtain the device authentication code, and then The device authentication code is transmitted to the security platform through the first communication unit; wherein the device authentication plaintext is obtained by combining the first random sequence and the second random sequence according to the first combination rule;

The first security chip transmits the first random sequence to the security platform through the first communication unit, and receives the platform authentication code generated by the security platform based on the first random sequence and the second random sequence through the first communication unit, and then uses the authentication key pair Platform authentication code decrypts to obtain platform authentication plaintext;

The first security chip combines the first random sequence and the second random sequence according to the second combination rule to obtain platform authentication plaintext, compares the platform authentication plaintext with the platform authentication plaintext, and determines whether the authentication of the security platform is passed according to the comparison result.

As shown in FIG. 3, the security platform includes a second security chip 301 and a second communication unit 302 communicatively connected with the second security chip 301.

Wherein, the second security chip 301 and the second communication unit 302 can be directly connected, or, as shown in FIG. 4, the security platform further includes a second processor 303, and the second processor 303 is connected to the second security chip 301, The second processor 303 is connected to the second communication unit 302, and the second security chip 301 communicates with the second communication unit 302 through the second processor 303.

The second communication unit is used to realize data transmission between the second security chip and the smart lock.

This embodiment also provides a corresponding authentication method of the security platform, which includes:

The second security chip generates a second random sequence and sends the second random sequence to the smart lock through the second communication unit, obtains the first random sequence from the smart lock through the second communication unit, and the smart lock is based on the first random sequence and the second random sequence. The device authentication code generated by a random sequence is then used to decrypt the device authentication code with the authentication key pre-stored on the security platform side to obtain the device authentication plaintext;

The second security chip combines the first random sequence and the second random sequence according to the first combination rule to obtain the device authentication plaintext; and compares the device authentication plaintext with the device authentication plaintext, and determines whether the smart lock is authenticated according to the comparison result; the smart lock The authentication key is also used to encrypt the platform authentication plaintext to obtain the platform authentication code, and then the platform authentication code is transmitted to the smart lock through the second communication unit for the smart lock to authenticate the security platform; among them, the platform authentication plaintext is the first The random sequence and the second random sequence are combined according to the second combination rule.

Before data transmission, the smart lock will authenticate the security platform, and the security platform will also authenticate the smart lock. Among them, the security platform may authenticate the smart lock after the smart lock successfully authenticates the security platform, or the smart lock may authenticate the security platform after the security platform successfully authenticates the smart lock. The following describes the above two cases.

After the security platform successfully authenticates the smart lock, the smart lock then authenticates the security platform. The detailed process is shown in Figure 5:

S501. The security platform generates a second random sequence.

The second security chip generates a second random sequence, and the second random sequence is formed by a combination of at least one random number. After generating at least one random number, the second security chip may sort the generated random numbers to obtain the second random sequence. For example, after the second security chip generates random numbers 11, 13, and 18, these three random arrays can be synthesized into 111318, or 11-18-13. It should be understood that what are listed here are only two relatively common combinations, and the specific combination and the number of random numbers generated can be set by the developer based on experience.

S502. The security platform sends the second random sequence to the smart lock.

The second security chip sends the second random sequence to the smart lock through the second communication unit.

S503: The smart lock generates a first random sequence.

The first security chip generates a first random sequence, where the first security chip may generate the first random sequence after receiving the second random sequence through the first communication unit, or may also generate the first random sequence after receiving the second random sequence through the first communication unit. Before the random sequence, the first random sequence is generated. The first random sequence is formed by a combination of at least one random number, and the first security chip may, after generating at least one random number, sort the generated random numbers to obtain the first random sequence. For details, please refer to the related description of the second random sequence.

S504. The smart lock generates a device authentication code.

After receiving the second random sequence through the first communication unit, the first security chip combines the first random sequence and the second random sequence according to the first combination rule to obtain the device authentication plaintext, and uses the authentication key stored on the smart lock side Encrypt the device authentication plain text to obtain the device authentication code.

Wherein, the first combination rule may be to combine the first random sequence and the second random sequence in a unit of sequence, or to combine the first random sequence and the second random sequence in a unit of random number. For example, when the first random sequence includes two random numbers 11 and 04, the first random sequence is 1104, and the second random sequence includes a random number 68, the number after combining according to the first combination rule can be 110468, or it can be 116804.

The authentication key can be stored in the first security chip, or, as shown in FIG. 6, the smart lock further includes a first memory 104 connected to the first processor 103, and the authentication key can be stored in the first In the memory 104.

Among them, as shown in Figure 7, the authentication key generation process can be:

S701. The smart lock sends the unique identifier of the first security chip to the security platform.

The first security chip sends its unique identification to the security platform through the first communication unit.

S702. The security platform generates a first subkey based on the root key.

Wherein, the root key may be the unique identifier of the second security chip or other keys stored in the second security chip.

After receiving the unique identifier of the first security chip sent by the smart lock through the second communication unit, the second security chip generates the first subkey based on the root key.

S703. The security platform generates and stores an authentication key based on the first subkey and the root key.

The second security chip generates an authentication key based on the first subkey and the root key, where the authentication key can be stored in the second security chip, or, as shown in FIG. 8, the security platform further includes a second memory 304 , The second memory 104 is connected to the first processor 303, and the authentication key can be stored in the second memory 304.

S704. The security platform sends the authentication key to the smart lock.

The second security chip sends the authentication key to the smart lock through the second communication unit.

S705. The smart lock stores the authentication key.

After the smart lock receives the authentication key through the first communication unit, it can be stored in the first security chip or the first memory.

Among them, in order to ensure the security of the authentication key in the transmission process, the first processor or the first security chip may generate a set of asymmetric keys. It is understandable that regardless of whether the set of asymmetric keys is generated by the first processor Whether it is generated by the first security chip, it can be stored in the first memory or the first security chip. After the asymmetric key is generated, the public key in the asymmetric key is sent to the security platform through the first communication unit. After receiving the public key through the second communication unit, the second security chip uses the public key to encrypt the authentication key to obtain the authentication key cipher text, and sends the authentication key cipher text to the smart lock through the second communication unit. After receiving the authentication key cipher text through the first communication unit, a processor or a first security chip uses the private key corresponding to the public key to decrypt the authentication key cipher text to obtain the authentication key and store it in the first memory Or the first security chip.

S505. The smart lock sends the device authentication code to the security platform.

The first security chip sends the device authentication code to the security platform through the first communication unit.

S506. The smart lock sends the first random sequence to the security platform.

The first security chip sends the first random sequence to the security platform through the first communication unit.

The first security chip may send the first random sequence and the device authentication code to the security platform through the first communication unit, and the first security chip may also send the device authentication code to the security platform through the first communication unit. The first random sequence is sent to the security platform, or after the device authentication code is sent to the security platform, the first random sequence is sent to the security platform through the first communication unit.

S507. The security platform generates a clear text for device certification.

After receiving the device authentication code and the first random sequence through the second communication unit, the second security chip combines the first random sequence and the second random sequence according to the first combination rule to obtain the device authentication plaintext. It should be understood that this The first combination rule at is the same as the first combination rule when the first security chip generating device authenticates plaintext.

S508. The security platform decrypts the device authentication code based on the authentication key to obtain the device authentication plaintext.

The second security chip uses the authentication key to decrypt the device authentication code to obtain the device authentication plaintext. The authentication key here is the same as the authentication key on the smart lock side.

It should be understood that the timing relationship between S507 and S508 is not limited in this embodiment, that is, S508 may be implemented after S507 is implemented, or S507 may be implemented after S508 is implemented.

S509. The security platform compares the device authentication plain text with the device authentication plain text, and determines whether the smart lock is authenticated according to the comparison result.

The second security chip compares the device authentication plain text with the device authentication plain text, and determines whether the smart lock is authenticated according to the comparison result.

When the device authentication plaintext and the device authentication plaintext are the same, it is determined that the authentication of the smart lock is passed, and when the device authentication plaintext and the device authentication plaintext are different, it is determined that the authentication of the smart lock has failed.

S510. After the security platform determines that the smart lock is authenticated, it generates a platform authentication code.

The second security chip combines the first random sequence and the second random sequence according to the second combination rule to obtain the platform authentication plaintext, and uses the authentication key stored on the security platform to encrypt the platform authentication plaintext to obtain the platform authentication code. It should be noted that the second combination rule may be to combine the first random sequence and the second random sequence in units of sequence, or it may be to combine the first random sequence and the second random sequence in units of random numbers. To improve security, the second combination rule is different from the first combination rule. Therefore, the device authentication plaintext generated by the first security chip based on the first combination rule is different from the platform authentication plaintext generated by the second security chip based on the second combination rule. The data certified by the security platform is different.

S511. The security platform sends the platform authentication code to the smart lock.

The second security chip sends the platform authentication code to the smart lock through the second communication unit.

S512. The smart lock decrypts the platform authentication code based on the authentication key to obtain the platform authentication plaintext.

After receiving the platform authentication code through the first communication unit, the first security chip decrypts the platform authentication code based on the authentication key to obtain the platform authentication plaintext.

S513. The smart lock generates platform authentication plaintext based on the second combination rule.

The first security chip combines the first random sequence and the second random sequence according to the second combination rule to obtain platform authentication plaintext. It should be noted that the second combination rule here is the same as the second combination rule used when the security platform generates platform authentication plaintext.

The timing relationship between S512 and S513 is not limited in this embodiment. That is, S512 may be implemented after S513, or S513 may be implemented after S512.

S514. The smart lock compares the platform authentication plaintext with the platform authentication plaintext, and determines whether the authentication of the security platform is passed according to the comparison result.

The first security platform compares the platform authentication plaintext with the platform authentication plaintext, and determines whether the authentication of the security platform is passed according to the comparison result. When the platform authentication plaintext and the platform authentication plaintext are the same, it determines that the authentication of the security platform has passed; the platform authentication plaintext When it is different from the platform authentication plaintext, it is determined that the authentication of the security platform has failed.

After the smart lock has successfully authenticated the security platform, the security platform will then authenticate the smart lock. The detailed process is shown in Figure 9:

S901. The smart lock generates a first random sequence.

The first security chip generates a first random sequence. For a detailed description of the first random sequence, please refer to the foregoing description.

S902. The smart lock sends the first random sequence to the security platform.

S903. The security platform generates a second random sequence.

The second security chip generates a second random sequence, where the second security chip may generate a second random sequence after receiving the first random sequence through the second communication unit, or may also generate the second random sequence after receiving the first random sequence through the second communication unit. Before the random sequence, a second random sequence is generated. For a detailed description of the second random sequence, please refer to the previous description.

S904. The security platform generates a platform authentication code.

After receiving the first random sequence through the second communication unit, the second security chip combines the first random sequence and the second random sequence according to the second combination rule to obtain the platform authentication plaintext, and uses the authentication key to encrypt the platform authentication plaintext Get the platform authentication code.

For the detailed description of the second combination rule and authentication key, please refer to the previous description.

S905. The security platform sends the platform authentication code to the smart lock.

S906. The security platform sends the second random sequence to the smart lock.

The second security chip may send the second random sequence and the platform authentication code to the smart lock through the second communication unit. The second security chip may also send the platform authentication code to the smart lock through the second communication unit. The second random sequence is sent to the smart lock, or after the platform authentication code is sent to the smart lock, the second random sequence is sent to the smart lock through the second communication unit.

S907. The smart lock generates platform authentication plaintext.

After receiving the platform authentication code and the first random sequence through the first communication unit, the first security chip combines the first random sequence and the second random sequence according to the second combination rule to obtain the platform authentication plaintext.

S908. The smart lock decrypts the platform authentication code based on the authentication key to obtain platform authentication plaintext.

The first security chip uses the authentication key to decrypt the platform authentication code to obtain the platform authentication plaintext.

It should be understood that the timing relationship between S908 and S907 is not limited in this embodiment, that is, S908 may be implemented after S907 is implemented, or S907 may be implemented after S908 is implemented.

S909. The smart lock compares the platform authentication plain text with the platform authentication plain text, and determines whether the authentication of the security platform is passed according to the comparison result.

The first security chip compares the platform authentication plaintext with the platform authentication plaintext, and determines whether the authentication of the security platform is passed according to the comparison result.

When the platform authentication plaintext and the platform authentication plaintext are the same, it is determined that the authentication of the security platform is passed, and when the platform authentication plaintext and the platform authentication plaintext are different, it is determined that the authentication of the security platform has failed.

S910. After the smart lock determines that the authentication of the security platform is passed, it generates a device authentication code.

The first security chip combines the first random sequence and the second random sequence according to the first combination rule to obtain the device authentication plaintext, and uses the authentication key to encrypt the device authentication plaintext to obtain the device authentication code.

S911. The smart lock sends the device identification code to the security platform.

S912. The security platform decrypts the device authentication code based on the authentication key to obtain the device authentication plaintext.

After receiving the device authentication code through the second communication unit, the second security chip decrypts the device authentication code based on the authentication key to obtain the device authentication plaintext.

S913. The security platform generates a device authentication plaintext based on the first combination rule.

The second security chip combines the first random sequence and the second random sequence according to the first combination rule to obtain the device authentication plaintext.

The timing relationship between S912 and S913 is not limited in this embodiment, that is, S912 may be implemented after S913, or S913 may be implemented after S912.

S914. The security platform compares the device authentication plain text with the device authentication plain text, and determines whether the smart lock is authenticated according to the comparison result.

The second security chip compares the device authentication plaintext with the device authentication plaintext. When the device authentication plaintext and the device authentication plaintext are the same, it determines that the smart lock is authenticated; when the device authentication plaintext and the device authentication plaintext are different, it determines the smart lock The certification failed.

After the smart lock has passed the authentication of the security platform and the security platform has passed the authentication of the smart lock, the first security chip is also used for data transmission based on the encryption key through the first communication unit and the security platform, that is, the first The security chip will encrypt the data sent to the security platform based on the encryption key, and decrypt the data sent by the security platform received through the first communication unit based on the encryption key. Accordingly, the second security chip will treat the data based on the encryption key The data sent to the smart lock is encrypted, and the data sent by the smart lock received through the second communication unit is decrypted based on the encryption key.

Among them, as shown in Figure 10, the encryption key generation process can be:

S1001. The smart lock sends the unique identifier of the first security chip to the security platform.

S1002. The security platform generates a second subkey based on the root key.

The second security chip generates a second subkey based on the root key.

S 1003. The security platform generates and stores an encryption key based on the second subkey and the root key.

The second security chip generates an encryption key based on the second subkey and the root key, where the encryption key can be stored in the second security chip or in the second memory.

S1004. The security platform sends the encryption key to the smart lock.

The second security chip sends the encryption key to the smart lock through the second communication unit.

S1005. The smart lock stores the encryption key.

After the smart lock receives the encryption key through the first communication unit, it can be stored in the first memory or the first security chip.

Among them, in order to ensure the security of the encryption key during transmission, the second security chip uses the public key to encrypt the encryption key to obtain the encryption key ciphertext, and sends the encryption key ciphertext to the smart through the second communication unit. After the smart lock receives the encryption key cipher text through the first communication unit, it uses the private key corresponding to the public key to decrypt the encryption key cipher text to obtain the encryption key and store it in the first memory or first security In the chip.

Further, in order to improve the security of data transmission, the first security chip may generate the first process key based on at least one of the first random sequence and the second random sequence and the encryption key, and use the first process key to be sent. Encrypt the first data of the security platform, and send the encrypted first data cipher text to the security platform through the first communication unit; the first security chip is also configured to be based on at least one of the first random sequence and the second random sequence The second process key is generated by the encryption key, and the second process key is used to decrypt the second data ciphertext sent by the security platform received through the first communication unit to obtain the second data; correspondingly, the second security chip It is also used to generate a first process key based on at least one of the first random sequence and the second random sequence and the encryption key, and use the first process key to pair the first process key sent by the smart lock received through the second communication unit The data ciphertext is decrypted to obtain the first data; the second security chip can generate a second process key based on at least one of the first random sequence and the second random sequence and the encryption key, and use the second process key to be sent to The second data of the smart lock is encrypted, and the encrypted second data ciphertext is sent to the smart lock through the second communication unit. It should be understood that the rules for the first security chip to generate the first process key are the same as the rules for the second security chip to generate the first process key, that is, the first process key generated by the first security chip is the same as the second process key. The first process key generated by the security chip is the same; the rule for generating the second process key by the first security chip is the same as the rule for generating the second process key by the second security chip, that is, the second process key generated by the first security chip The process key is the same as the second process key generated by the second security chip. The first process key and the second process key may be the same. In order to improve the security of data transmission, the first process key and the second process key may also be different.

In this embodiment, the smart lock includes a first security chip, a first communication unit communicatively connected with the first security chip, and a security platform includes a second security chip, and a second communication unit communicatively connected with the second security chip is performing data Before transmission, the smart lock will authenticate the security platform based on the platform authentication code, and the security platform will authenticate the smart lock based on the device authentication code. After both ends are authenticated, data transmission is performed, which solves the problem of smart The problem that the lock and security platform does not perform authentication before data transmission or is only authenticated by a single end, and the security is low, which improves the security of the smart lock and security platform.

Example two

The smart lock in this embodiment includes a first security chip and a first communication unit communicatively connected with the first security chip.

The security platform in this embodiment includes a second security chip, and a second communication unit communicatively connected with the second security chip.

The interaction process between the smart lock and the security chip is shown in Figure 11:

S1101. The first security chip generates a set of asymmetric keys.

S1102. The first security chip sends the unique identifier of the first security chip and the public key in the asymmetric key to the security platform through the first communication unit.

S1103. The second security chip generates a first subkey and a second subkey based on the root key.

S1104. The second security chip generates an authentication key and an encryption key, and uses the public key to encrypt the authentication key and the encryption key to obtain a key ciphertext.

The second security chip generates an authentication key based on the first subkey and the unique identifier of the first security chip, and generates an encryption key based on the second subkey and the unique identifier of the first security chip.

S1105. The second security chip sends the key ciphertext to the smart lock through the second communication unit.

S1106. The first security chip uses the private key corresponding to the public key to decrypt the key ciphertext to obtain the authentication key and the encryption key, and store them in the first security chip.

S1107. The second security chip generates a second random number.

S1108. The second security chip sends the second random number to the smart lock through the second communication unit.

S1109. After receiving the second random number through the first communication unit, the first security chip generates a first random number.

Among them, the first random number and the second random number are both 8-byte random numbers

S1110. The first security chip generates a device authentication code.

The first security chip combines the first random number and the second random number according to the first combination rule to obtain the device authentication plaintext, the device authentication plaintext is (first random number|second random number), and the first security chip uses the authentication key Encrypt the device authentication plaintext to obtain the device authentication code.

S1111. The first security chip sends the device authentication code and the first random number to the security platform through the first communication unit.

S1112. The second security chip uses the authentication key to decrypt the device authentication code to obtain the device authentication plaintext, and generate the device authentication plaintext.

The second security chip combines the first random number and the second random number according to the first combination rule to obtain the device authentication plaintext, where the first combination rule is the same as the first combination rule used when the first security chip generates the device to authenticate the plaintext, so The device authentication plaintext is (first random number|second random number).

S1113. The second security chip compares the device authentication plain text with the device authentication plain text.

When the comparison result is consistent, the second security chip determines that the smart lock authentication is successful, and when the comparison result is inconsistent, it determines that the smart lock authentication fails.

S1114. After determining that the smart lock is successfully authenticated, the second security chip generates a platform authentication code.

After the second security chip determines that the smart lock is successfully authenticated, it combines the first random number and the second random number according to the second combination rule to obtain the platform authentication plaintext, and the platform authentication plaintext is (second random number|first random number) , Use the authentication key to encrypt the platform authentication plaintext to obtain the platform authentication code.

S1115. The second security chip sends the platform authentication code to the smart lock through the second communication unit.

S1116. The first security chip generates platform authentication plaintext, and uses the authentication key to decrypt the platform authentication code to obtain platform authentication plaintext.

The first security chip combines the first random number and the second random number according to the second combination rule to obtain the platform authentication plaintext, where the second combination rule is the same as the second combination rule used when the second security chip generates the platform authentication plaintext, so The platform authentication plaintext is (second random number|first random number).

S1117. The first security chip compares the platform authentication plaintext with the platform authentication plaintext.

When the comparison result is consistent, it is determined that the security platform authentication is successful, and when the comparison result is inconsistent, it is determined that the security platform authentication has failed.

S1118. After determining that the authentication of the security platform is successful, the first security chip generates a first process key and a second process key.

The first security chip uses the encryption key, the first random number and the second random number to generate the first process key, and uses the encryption key, the first random number and the second random number to generate the second process key, where the first The process key is different from the rules for generating the second process key, so the first process key is different from the second process key.

S1119. The second security chip generates a first process key and a second process key.

The rules for the second security chip to generate the first process key are the same as the rules for the first security chip to generate the first process key, and the rules for the second security chip to generate the second process key are the same as those for the first security chip to generate the second process key. The rules are the same.

S1120. The first security chip uses the first process key to encrypt the first data to obtain the first data ciphertext.

S1121, the first security chip sends the first data ciphertext to the security platform through the first communication unit.

S1122, the second security chip uses the first process key to decrypt the ciphertext of the first data received through the second communication unit to obtain the first data.

S1123. The second security chip uses the second process key to encrypt the second data to obtain the second data ciphertext.

S1124. The second security chip sends the second data ciphertext to the smart lock through the second transmission unit.

S1125. The first security chip uses the second process key to decrypt the ciphertext of the second data received through the first communication unit to obtain the second data.

It should be understood that, in this embodiment, only the line embodiment S1120 is implemented in S1123 for explanation. In other embodiments, S1123 may be implemented first, and then S1120 is implemented.

In this embodiment, the smart lock includes a first security chip, a first communication unit communicatively connected with the first security chip, and a security platform includes a second security chip, and a second communication unit communicatively connected with the second security chip is performing data Before transmission, the security platform will authenticate the smart lock based on the device authentication code, and after the authentication is successful, the smart lock will authenticate the security platform based on the platform authentication code. After the security platform is successfully authenticated, data transmission is performed, which solves the existing problem. In technology, smart locks and security platforms do not perform authentication before data transmission or are only authenticated by a single end. The security problem is low, which improves the security of data transmission between smart locks and security platforms. During data transmission, the first process key and the second process key are used to encrypt the data, which further improves the security of data transmission between the smart lock and the security platform.

The embodiments of the present invention are described above with reference to the accompanying drawings, but the present invention is not limited to the above-mentioned specific embodiments. The above-mentioned specific embodiments are only illustrative and not restrictive. Those of ordinary skill in the art are Under the enlightenment of the present invention, many forms can be made without departing from the purpose of the present invention and the protection scope of the claims, and these all fall within the protection of the present invention.

Claims

A smart lock, characterized in that, the smart lock includes: a first security chip and a first communication unit communicatively connected with the first security chip;

The first security chip is used to generate a first random sequence and obtain a second random sequence from a security platform through the first communication unit, and encrypt the device authentication plaintext using an authentication key pre-stored on the smart lock side The device authentication code is obtained through processing, and then the device authentication code is transmitted to the security platform through the first communication unit, so that the security platform can authenticate the smart lock;

The device authentication plaintext is obtained by combining the first random sequence and the second random sequence according to a first combination rule;

The first security chip is further configured to transmit the first random sequence to the security platform through the first communication unit, and receive the security platform based on the first random sequence through the first communication unit And the platform authentication code generated by the second random sequence, and then use the authentication key to decrypt the platform authentication code to obtain the platform authentication plaintext;

The first security chip is further configured to combine the first random sequence and the second random sequence according to a second combination rule to obtain platform authentication plaintext, and compare the platform authentication plaintext with the platform authentication plaintext, and according to the comparison result Determine whether the authentication of the security platform is passed;

The first communication unit is used to implement data transmission between the first security chip and the security platform.
The smart lock according to claim 1, wherein the first communication unit is used to send the device authentication code and the first random sequence to the security platform together.
The smart lock of claim 1, wherein the first random sequence is a first random number, the second random sequence is a second random number, and the device authentication plaintext is (first random number| Second random number), the platform authentication plaintext is (second random number|first random number).
The smart lock according to any one of claims 1 to 3, wherein the first security chip is also used to pass the first communication unit and the security platform after the authentication of the security platform is passed. Perform data transmission based on encryption keys.
The smart lock of claim 4, wherein the first security chip is further configured to generate a first process key based on the encryption key, the first random sequence, and the second random sequence, The first process key is used to encrypt the first data to be sent to the security platform, and the encrypted first data ciphertext is sent to the security platform through the first communication unit; the first security The chip is also used to generate a second process key based on the encryption key, the first random sequence, and the second random sequence, and use the second process key pair to be received through the first communication unit The second data ciphertext sent by the security platform is decrypted to obtain the second data.
5. The smart lock of claim 5, wherein the first process key is different from the second process key.
A smart lock authentication method, characterized in that it is applied to the smart lock according to any one of claims 1-6, the smart lock comprising: a first security chip and a first security chip communicatively connected with the first security chip A communication unit; the method includes:

The first security chip generates a first random sequence, and obtains a second random sequence from the security platform through the first communication unit, and encrypts the device authentication plaintext using an authentication key pre-stored on the smart lock side Obtain the device authentication code, and then transmit the device authentication code to the security platform through the first communication unit; wherein the device authentication plaintext consists of the first random sequence and the second random sequence in accordance with the first Combination rules are combined;

The first security chip transmits the first random sequence to the security platform through the first communication unit, and receives the security platform based on the first random sequence and the security platform through the first communication unit. The platform authentication code generated by the second random sequence, and then use the authentication key to decrypt the platform authentication code to obtain the platform authentication plaintext;

The first security chip combines the first random sequence and the second random sequence according to the second combination rule to obtain platform authentication plaintext, compares the platform authentication plaintext with the platform authentication plaintext, and determines the right to the platform according to the comparison result. Whether the certification of the security platform is passed.
A security platform, wherein the security platform includes: a second security chip and a second communication unit communicatively connected with the second security chip;

The second security chip is used to generate a second random sequence and send the second random sequence to the smart lock through the second communication unit, obtain the first random sequence from the smart lock through the second communication unit, and The smart lock generates a device authentication code based on the first random sequence and the second random sequence, and then uses an authentication key pre-stored on the security platform to decrypt the device authentication code to obtain device authentication Plaintext

The second security chip is further configured to combine the first random sequence and the second random sequence according to the first combination rule to obtain the device authentication plain text; and compare the device authentication plain text and the device authentication plain text, according to The result of the comparison determines whether the authentication of the smart lock is passed; the smart lock is also used to use the authentication key to encrypt the platform authentication plaintext to obtain the platform authentication code, and then to pass the platform authentication code through the second communication unit The authentication code is transmitted to the smart lock for the smart lock to authenticate the security platform;

The platform identification plaintext is obtained by combining the first random sequence and the second random sequence according to a second combination rule;

The second communication unit is used to implement data transmission between the second security chip and the smart lock.
The security platform according to claim 8, wherein the second security chip is further used to generate a first subkey based on the root key, and then based on the smart lock received through the second communication unit The unique identifier of the first security chip and the first subkey generate an authentication key, store the authentication key, and send the authentication key to the smart lock through the second communication unit for the The smart lock stores the authentication key.
The security platform according to claim 8 or 9, wherein the second security chip is further configured to generate a second subkey based on the root key, and then based on the smart key received through the second communication unit The unique identifier of the first security chip of the lock and the second subkey generate an encryption key, store the encryption key, and send the encryption key to the smart lock through the second communication unit to For the smart lock to store the encryption key.
The security platform of claim 10, wherein the second security chip is further configured to receive a public key sent by the smart lock through the second communication unit, and use the public key to encrypt the encryption After the key is encrypted, the encryption key ciphertext is obtained, and the encryption key ciphertext is sent to the smart lock through the second communication unit, so that the smart lock can adopt the private key corresponding to the public key. The key decrypts the encryption key ciphertext to obtain the encryption key and store it.
A security platform authentication method, characterized by being applied to the security platform according to any one of claims 8-11, the security platform comprising: a second security chip and a second security chip communicatively connected with the second security chip Two communication unit; the method includes:

The second security chip generates a second random sequence and sends the second random sequence to the smart lock through the second communication unit, and obtains the first random sequence from the smart lock and the smart lock through the second communication unit. The smart lock generates a device authentication code based on the first random sequence and the second random sequence, and then uses an authentication key pre-stored on the security platform to decrypt the device authentication code to obtain the device authentication plaintext;

The second security chip combines the first random sequence and the second random sequence according to the first combination rule to obtain the device authentication plain text; and compares the device authentication plain text and the device authentication plain text, and determines according to the comparison result Whether the authentication of the smart lock is passed; the smart lock also uses the authentication key to encrypt the platform authentication plaintext to obtain the platform authentication code, and then transmits the platform authentication code to the station through the second communication unit The smart lock is used for the smart lock to authenticate the security platform; wherein the platform authentication plaintext is obtained by combining the first random sequence and the second random sequence according to a second combination rule.