Embodiment
Hereinafter will describe the present invention with reference to the accompanying drawings and in conjunction with the embodiments in detail.Need to prove that under the situation of not conflicting, embodiment and the feature among the embodiment among the application can make up mutually.
Embodiment one
In the present embodiment, provide a kind of access control system, Fig. 1 is the access control system structural representation according to the embodiment of the invention one, and this system comprises: far-end access control system 100, a plurality of gate inhibition's switchgear 102, wherein,
Each gate inhibition's switchgear 102, be used to obtain the request of opening the door and the user account of user's input of using portable terminal 104, request of opening the door and user account are sent to the access control system 100 of far-end, and be used to receive the check code that comes from access control system 100, and the password that utilizes the check code verified users to import, verification is by then carrying out opening door operation;
Access control system 100, store the corresponding relation of user account and customer mobile terminal sign, be used to receive request of opening the door and user account from gate inhibition's switchgear 102, and generation is corresponding to the password and the check code of user account, corresponding relation according to user account and customer mobile terminal sign, password is sent to portable terminal 104 corresponding to above-mentioned user account, check code is sent to gate inhibition's switchgear 102.
Existing gate control system needs the user to carry key substitute or memory switch door password, and by the input of the keyboard on gate inhibition's switchgear password, to realize the switch door operation, in case key loss or user forget Password, not only bring constantly to the user, and there is the hidden danger of security.The above-mentioned access control system that present embodiment provides, make full use of the ubiquity of portable terminal, when each switch door operation, by access control system is that the user generates random cipher, and send to user's portable terminal, the user imports the random cipher that receives on gate inhibition's switchgear, carry out cryptographic check by gate inhibition's switchgear, thereby the user be need not at the different password of each gate inhibition's switchgear memory, also need not to carry the key substitute, only need to utilize the portable terminal of carrying promptly can receive switch door password, thus greatly convenient for users to use.And password or check code are not to be stored in gate inhibition's switchgear, but generate by the access control system of far-end, operate same gate inhibition's switchgear at same user at different time, each entrance guard management equipment generates random cipher for the user, each password that generates is also inequality, therefore, even the user loses password or password leaks, can there be potential safety hazard yet, thereby have improved the security of access control system greatly.
In implementation process, can be connected by wired networking between access control system 100 and the gate inhibition's switchgear 102, also can connect by mobile communication network, for example can but be not limited to adopt non-constructed supplementary business (Unstructured Supplementary ServiceData, USSD) mode connect.
Fig. 2 is the preferred access control system structural representation according to the embodiment of the invention one, preferably, as shown in Figure 2, the access control system that present embodiment provides also comprises: a plurality of access controllers 106, wherein, the one or more gate inhibition's switchgears 102 of each access controller 106 management, each access controller 106 is used for, reception comes from the user account of its gate inhibition's switchgear 102 of managing, the sign of the request of opening the door and this gate inhibition's switchgear 102, with user account, the request of opening the door and the sign of this gate inhibition's switchgear 102 and the sign of access controller 106 send to access control system 100 by mobile communications network, and the sign that receives identifying code and the gate inhibition's switchgear 102 come from access control system 100, and identifying code sent to the gate inhibition switchgear 102 corresponding with the sign of gate inhibition's switchgear.
Preferably, each gate inhibition's switchgear 102, also be used to obtain the request of closing the door and the password of user's input, password comparison and decoding, if consistent, then carry out and close door operation, otherwise, the prompting user imports user account, and sends user account, password, the sign of gate inhibition's switchgear and the request of closing the door by access controller 106 to access control system 100;
Access control system 100 also is used for password that relatively receives and the password that opens the door and generated when asking at the user before, if consistent, then notify gate inhibition's switchgear 102 to carry out and closes door operations, otherwise, notify gate inhibition's switchgear 102 not carry out the pass door operation.
Preferably, access control system 100 is preserved gate inhibition's configuration information, user profile and gate inhibition's switch historical information in this locality, wherein, gate inhibition's configuration information comprises: by the sign of the access controller 106 of access control system 100 management, with the sign of gate inhibition's switchgear of each access controller binding, and corresponding to the key of each access controller 106.User profile comprises: user account, with the terminal iidentification of user account binding, and the authority of user account operation gate inhibition switchgear 102.
Preferably, the user is under casual user's the situation, each gate inhibition's switchgear 102, also be used to obtain the terminal iidentification and the request of opening the door of user's input, and terminal iidentification and the request of opening the door sent to the access control system 100 of far-end, and the casual user's number of the account and the interim password that are used to obtain user's input, utilizing the interim password of interim check code verification, verification is by then carrying out opening door operation; Access control system 100, also be used for described terminal iidentification and the request of opening the door are sent to keeper's authentication, the described user who passes through for authentication generates casual user's number of the account and corresponding to the interim password and the interim check code of casual user's number of the account, casual user's number of the account and interim password are sent to user terminal 104, interim check code is sent to gate inhibition's switchgear 102.
In implementation process, can be connected by cable network between access control system 100 and the access controller 106.Also can connect by mobile communication network, for example, can but be not limited to adopt the USSD mode to communicate by letter; Between access control system 100 and the portable terminal 104 can but be not limited to adopt short message way to communicate by letter; Between access controller 106 and the gate inhibition's switchgear 102 can but be not limited to adopt wired netting twine connected mode, if both are one-to-one relationships, i.e. gate inhibition's switchgear 102 of access controller 106 management, then both can integrate realization.
Embodiment two
In implementation process, need the system manager, the access control system that entrance guard management person and user (incomer) provide by embodiment one carries out alternately, to realize opening the door or closing door operation of each gate inhibition's switchgear, present embodiment describes in detail to the preferred access control system that the foregoing description one provides, in access control system as shown in Figure 2, access control system 100 also provides a WAP web portal pages, be the system manager, entrance guard management person and incomer provide registration or service are set, and wherein three roles can have following rights of using respectively:
One, the system manager has following authority:
(1), have the operation access control system all authorities, comprise systematic parameter and door authority are set;
(2), the authority that has managing gate inhibition keeper and incomer, mainly comprise: can stipulate which access controller entrance guard management person manages, which gate inhibition's switchgear the regulation access controller manages, and stipulates that the incomer allows to enter which gate inhibition and entry time restriction;
(3), examine the application that relevant gate inhibition keeper submits to, comprise access controller essential information (access controller numbering in the application, the controller phone number, affiliated entrance guard management person, detailed place, affiliated unit, institute's access control), the essential information of gate inhibition's switchgear (gate inhibition's numbering, affiliated access controller, key, detailed place), entrance guard management person's essential information (administrator username, administrator's password, binding management person's phone number, name, the address) and incomer's essential information (incomer's user account number, phone number, name, the address, enter the term of validity, dynamic password is generated by system, donor's information);
(4), inquire about all gate inhibition's switching information and history alarms.
Two, entrance guard management person mainly has following function:
(1), the phone number (being used for communicating by letter with access control system) of each access controller, entrance guard management person's phone number, login user name and password are set;
(2), the relation of each gate inhibition's switchgear and access controller and the key of gate inhibition's switchgear are set;
(3), incomer and gate inhibition's relation and incomer's user account and binding phone number are set;
(4), examine relevant incomer and comprise the application that interim incomer submits to;
(5), newly-built incomer and interim incomer, and corresponding access permission is set;
(6), relevant gate inhibition's switching information of inquiry and history alarm.
Three, the incomer mainly has following function:
(1), after incomer's mobile phone is lost, by the WAP door or send the phone number that USSD modifying of order oneself is bound, need entrance guard management person to examine;
(2), when emergency condition not by the gate inhibition, when need authorizing other users to open the door, by the WAP door or send other users of USSD authorization by instruction and accept the part access permission of oneself, need entrance guard management person to examine.
Embodiment three
In the present embodiment, provide a kind of access control method, Fig. 3 is the access control method process flow diagram according to the embodiment of the invention three, and as shown in Figure 3, this method comprises:
Step S302, gate inhibition's switchgear obtains the request of opening the door and the user account of user's input, and the request of will opening the door and user account send to the access control system of far-end, and wherein, access control system stores the corresponding relation that user account and customer mobile terminal identify;
Step S304, access control system generates password and check code corresponding to user account in response to the request of opening the door, according to the corresponding relation of user account and customer mobile terminal sign, password is sent to portable terminal corresponding to user account, check code is sent to gate inhibition's switchgear;
Step S306, gate inhibition's switchgear obtain the password of user's input, utilize check code verification password, and verification is by then carrying out opening door operation.
The above-mentioned access control method that present embodiment provides, make full use of the ubiquity of portable terminal, when each switch door operation, by access control system is that the user generates random cipher, and send to user's portable terminal, the user imports the random cipher that receives on gate inhibition's switchgear, carry out cryptographic check by gate inhibition's switchgear, compared with prior art, the method that present embodiment provides, the user need not also to need not to carry the key substitute at the different password of each gate inhibition's switchgear memory, only need to utilize the portable terminal of carrying promptly can receive switch door password, thus greatly convenient for users to use.And password or check code are not to be stored in gate inhibition's switchgear, but generate by the access control system of far-end, operate same gate inhibition's switchgear at same user at different time, each entrance guard management equipment generates random cipher for the user, each password that generates is also inequality, therefore, even the user loses password or password leaks, can there be potential safety hazard yet, thereby have improved the security of access control system greatly.
In implementation process, can be connected by wired networking between access control system and the gate inhibition's switchgear, also can connect by mobile communication network, for example can but be not limited to adopt non-constructed supplementary business (Unstructured Supplementary Service Data, USSD) mode connect.
Preferably, the user who opens the door for current request is casual user's a situation, i.e. unregistered this casual user's information in access control system, and then as shown in Figure 4, this method also comprises:
Step S402, gate inhibition's switchgear obtain the terminal iidentification and the request of opening the door of user's input, and terminal iidentification and the request of opening the door are sent to the access control system of far-end;
Step S404, access control system is sent to keeper's authentication with above-mentioned terminal iidentification and the request of opening the door, the user who passes through for authentication generates casual user's number of the account and corresponding to the interim password and the interim check code of casual user's number of the account, casual user's number of the account and interim password are sent to user's terminal, interim check code is sent to gate inhibition's switchgear;
In implementation process, after access control system receives a certain gate inhibition's switchgear terminal iidentification that sends and the request of opening the door, terminal iidentification and the request of opening the door can be sent on keeper's the portable terminal, carrying out authentication by the keeper examines, also can on the web portal pages of access control system, immediately eject and examine prompting, examine for keeper's authentication.Preferably, this keeper can be the entrance guard management person that the foregoing description provides, and also can be the system manager.
Step S406, gate inhibition's switchgear obtain the casual user's number of the account and the interim password of user's input, utilize the interim password of interim check code verification, and verification is by then carrying out opening door operation.
Preferably, access control system also can be managed a plurality of access controllers, and each access controller can be controlled one or more gate inhibition's switchgears.
As shown in Figure 5, preferably, gate inhibition's switchgear comprises the user account and the access control system of asking to send to far-end that opens the door:
Step S502, gate inhibition's switchgear sends to the access controller corresponding with gate inhibition's switchgear with the sign of user account, the request of opening the door and gate inhibition's switchgear;
In implementation process, for gate inhibition's switchgear of its management is unified numbering, to form sign corresponding to each gate inhibition's switchgear, access control system writes down each access controller and specifically manages which gate inhibition's switchgear, it is concerning of access controller and gate inhibition's switchgear to using, after gate inhibition's switchgear receives the number of the account of user input, the request of opening the door, be carried in the lump with the sign of self and send to corresponding access controller in the request message.
Step S504, the access controller corresponding with gate inhibition's switchgear sends to access control system with the sign of the user account that receives, the request of opening the door, gate inhibition's switchgear and the sign of access controller by mobile communications network;
In implementation process, the access controller mobile communication network connects, can but be not limited to adopt the USSD mode to communicate by letter, communicate by letter for realizing the USSD mode, access controller and access control system all need inside to be provided with mobile communications device, possess the SIM card that is used for mobile communication accordingly, the sign of above-mentioned access controller can but be not limited to adopt the SIM card number of access controller.When access controller receives user account, after the sign of the request of opening the door, gate inhibition's switchgear, the sign of user account, the request of opening the door, gate inhibition's switchgear and the card number of itself be carried in the password request message send to access control system.
Preferably, access control system is preserved gate inhibition's configuration information, user profile and gate inhibition's switch historical information in this locality, wherein, gate inhibition's configuration information comprises: by the sign of the access controller of gate control system management, with the sign of gate inhibition's switchgear of each access controller binding, and corresponding to the key of each access controller; User profile comprises: user account, with the terminal iidentification of user account binding, and the authority of user account operation gate inhibition switchgear.
In implementation process, above-mentioned. gate inhibition's configuration information, user profile be by can be by entrance guard management person by the typing of WAP door, by the system manager examine by.
Preferably, as shown in Figure 6, before the password and check code of access control system generation corresponding to user account, this method can also comprise:
Step S602, the legitimacy of the sign of access control system checking access controller;
In implementation process, access control system is resolved the password solicitation message, parse user account respectively, the request of opening the door, the sign of gate inhibition's switchgear and the sign (card number) of access controller, at first, whether whether the sign (card number) of verifying access controller is legal, promptly authorized this thresholding controller to have the function of application password.
Step S604, the corresponding relation of the sign of checking access controller and the sign of gate inhibition's switchgear;
In implementation process, after the legitimacy of the sign of checking access controller, can also verify the corresponding relation of gate inhibition's switchgear sign and access controller sign, verify promptly whether this gate inhibition's switchgear has this access controller management.
Step S606 determines that the user of user account correspondence possesses the authority of operation gate inhibition switchgear.
In implementation process, before generating password and check code, also need user account and gate inhibition's switchgear sign are bound checking for the user, verify whether this user has the authority of this gate inhibition's switchgear of operation.
By above-mentioned preferable methods, can before carry out cryptographic check, increase one deck and be positioned at the sign and the authorization check of access control system, thereby further increased access control system security,
Preferably, as shown in Figure 7, password and check code that access control system generates corresponding to user account comprise:
Step S702, access control system generate a password corresponding to user account at random;
Step S704, access control system search the key corresponding with the sign of gate inhibition's switchgear in this locality, wherein, access control system is preserved the corresponding relation of gate inhibition's switchgear and key in this locality;
Step S706, access control system adopt predetermined cryptographic algorithm to generate check code according to password and key;
Step S708, be threshold time the effective time of setting check code, in implementation process, system manager and entrance guard management person consult to determine above-mentioned threshold time, for example, can but to be not limited to be provided with effective time be 1 minute, by entrance guard management person is set this effective time on gate inhibition's switchgear.
By above-mentioned preferable methods, the thresholding management system can generate a dynamic password for each user account, because the password that generates is at random, at of the open the door request of same user account at different time, the password that generates is also inequality, thereby make user and password not have regular corresponding relation, the security that has further improved access control system.
Preferably, as shown in Figure 8, access control system sends to gate inhibition's switchgear with check code and comprises:
Step S802, access control system sends to the access controller corresponding with the sign of access controller with the sign of identifying code and gate inhibition's switchgear by mobile communications network;
Step S804, access controller send to corresponding gate inhibition's switchgear according to the sign of gate inhibition's switchgear with identifying code.
Preferably, as shown in Figure 9, after gate inhibition's switchgear receives check code, utilize the password of check code verified users input to comprise:
Step S902, whether the mistiming of the input time of authentication password with the time that receives check code surpass threshold time, ageing with authentication password;
In implementation process, gate inhibition's switchgear this locality is provided with timer, picks up counting in the moment that receives check code, and when the user finishes the password input,, stop timing, judge whether the mistiming of timing surpasses default effective time, ageing with authentication password, if the mistiming is no more than effective time, the password verification of correctness after then carrying out is if surpass, then point out user cipher expired, again application.
Step S904, the key of the local storage of employing, deciphering obtains decoding to check code, and relatively decodes and password the correctness of authentication password.
In implementation process, the exclusive key of this equipment is all preserved in this locality of each gate inhibition's switchgear, is used for the check code deciphering to receiving, the cryptographic algorithm of implementing in its decipherment algorithm and access control system inverse operation each other.
Preferably, the method that present embodiment provides comprises that also the user imports the request triggering access control system of closing the door and closes door operation, and Figure 10 is the operational flowchart of closing the door according to the embodiment of the invention three, and as shown in figure 10, this flow process comprises:
S1002, gate inhibition's switchgear obtain the request of closing the door and the password of user's input;
S1004, if gate inhibition's switchgear password comparison and decoding identical, then carry out and close door operation, otherwise the prompting user imported user account, and send user account, password, the sign of gate inhibition's switchgear and the request of closing the door by access controller;
If password that S1006, access control system relatively receive and the password that the request of opening the door at the user is generated consistent, then notify gate inhibition's switchgear to carry out the pass door operation, otherwise, notify gate inhibition's switchgear not carry out the pass door operation.
Embodiment four
In the present embodiment, the flow process of the work of opening the door based on the wireless entrance guard system of mobile communication network is described in detail, as shown in figure 11, the workflow of opening the door is as follows:
Step S1101, entrance guard management person land access control system typing access controller, gate inhibition's switchgear and incomer's essential information, the system manager examine by;
Step S1102, interim incomer presses " application enters " key on the gate inhibition, and gate inhibition's device prompts is imported interim incomer's phone number;
Step S1103, behind interim incomer's input handset number, gate inhibition's switchgear is issued access controller with the application request of entering, comprise application entry instruction, gate inhibition's numbering, interim incomer's phone number, access controller resolves to USSD message and sends to access control system, message content is * 125#77#1#13966662223#, and interim incomer's phone number is 13966662223;
Step S1104, after access control system receives that application enters request, find the keeper of this access controller, transmit application to the mobile phone of binding in the USSD mode and enter request, whether the access controller keeper is effective by phone confirmation this application, examine the result to the access control system answer, comprise whether allowing to enter and the term of validity;
Step S1105, access control system is handled according to examining the result, if examine by generate casual user's account and dynamic password 123456 for this interim incomer, sending to casual user's account binding phone number is 13966662223, and add that according to the key of this gate inhibition's switchgear dynamic password generates gate inhibition's password 654321 and sends to gate inhibition's switchgear by access controller, if examine not by system enter application by gate inhibition's switchgear to user prompt is rejected;
Step S1106, interim incomer jumps to step S1116 and carries out according to the input of the prompting on gate inhibition's switchgear casual user account;
Step S1107, common incomer press " opening the door " instruction on gate inhibition's switchgear, by the prompting input user account of gate inhibition's switchgear;
Step S1108, gate inhibition's switchgear send the request of opening the door to access controller, comprise the instruction of opening the door, gate inhibition's numbering, user account;
Step S1109, access controller utilizes the built-in mobile phone module to send USSD gate inhibition by mobile communication network and opens the door request message to access control system, message content is * 125#88#1#1001#, and calling number is this access controller phone number 13966661111;
Step S1110, whether access control system checking access controller phone number 13966661111 legitimacies belong to this access controller management if the legal checking of continuation again gate inhibition numbers 1, and whether this user account 1001 has the authority of opening this gate inhibition 1;
Step S1111, judging fails then returns the failed message that opens the door to access controller, and access controller is transmitted to corresponding gate inhibition's switchgear, and the prompting incomer imports wrong on gate inhibition's switchgear;
Step S1112 behind the correct judgment, for this user account generates a dynamic password 123456 at random and is recorded in the system, extracts the key of this gate inhibition's switchgear again, encrypts and generates gate inhibition's check code 654321, timeliness 1 minute;
Step S1113, access control system sends gate inhibition's password 654321 of gate inhibition's switchgear 1 to access controller 13966661111 by the USSD response, send a note that has dynamic password 123456 by short message mode to the phone number 13966662222 of incomer's user account binding simultaneously, system log (SYSLOG) sends daily record;
Step S1114, access controller receive that USSD response back according to gate inhibition's numbering, sends gate inhibition's check code to gate inhibition's switchgear 1;
The note dynamic password 123456 that step S1115, incomer receive by the prompting input on gate inhibition's switchgear;
Step S1116, gate inhibition's check code that gate inhibition's switchgear 1 utilizes the secret key decryption of setting to receive, and the recorder time, whether the dynamic password time of judging incomer's input is above 1 minute, and compare with the dynamic password of incomer input, if surpass 1 minute or the inconsistent then prompting to open door failure of password, and send the short breath of alarm to entrance guard management person 13966661112, if in 1 minute and password correctly then opening door operation is carried out in prompting to open door success;
Step S1117, gate inhibition's switchgear 1 reports open the door failure or success message by access controller to access control system, and USSD message is * 125#88#1#1001#0#;
Step S1118, access control system writes down the daily record of opening the door, and writes down the state of this gate inhibition's switchgear.
Embodiment five
In the present embodiment, the flow process of the work of closing the door based on the wireless entrance guard system of mobile communication network is described in detail, as shown in figure 11, the workflow of closing the door is as follows:
Step S1201, incomer are at gate inhibition's switchgear place, and input sends the instruction of closing the door, by the dynamic password 123456 of pointing out input to receive when opening the door;
After step S1202, gate inhibition's switchgear received the dynamic password of incomer's input and the instruction of closing the door, the password when extracting last opening the door after the deciphering compared;
Step S1203, if password unanimity then carry out the pass door operation, and reporting the success message * 125#99#1#1001#0# that closes the door to access control system by access controller, access controller is transmitted this operation to access control system, carries out log record by access control system;
Step S 1204, and is inconsistent if gate inhibition's switchgear is found password, then points out the incomer to import user account, again by access controller to access control system send that the gate inhibition numbers 1, user account 1001, dynamic password 123456, the instruction 99 of closing the door;
Step S1205, access control system deciphering receive gate inhibition's numbering, user account, dynamic password and the instruction of closing the door after, whether the authority of this user account of checking correct earlier, and extracts the dynamic password that opens the door that sent to this user last time and compare;
If step S1206 is password unanimity then return to gate inhibition's switchgear and to close the door successfully;
Step S1207 is if incomer's user account authority is incorrect or password is inconsistent then return the failure of closing the door to gate inhibition's switchgear;
Step S1208, access control system writes down the daily record of closing the door;
Step S1209, gate inhibition's switchgear receive the success of closing the door and then carry out the pass door operation;
Step S1210 is if receive the failure then to point out the user to import wrong of closing the door.
The present invention program can be widely used in the entrance guard managements such as machine room, building, individual house, sub-district.Scheme of the present invention is not restricted to listed utilization in instructions and the embodiment.Concerning the technology of the present invention those of ordinary skill in the field, can make various corresponding changes and distortion according to the present invention, and all these corresponding changes and distortion all belong to the protection domain of claim of the present invention.Such as interactive communicate mode between each network element in the change system, simply two network elements are integrated, the function of a network element is moved in another network element realize.
From above description, technical scheme provided by the invention as can be seen, the incomer need not to carry the key substitute, also need not to remember complicated passwords, be user-friendly to, and password generates at every turn at random, there is not the problem of losing, also be difficult for being cracked, and adopt multiple-authentication mechanism, thereby make access control system safe.
Obviously, those skilled in the art should be understood that, above-mentioned each module of the present invention or each step can realize with the general calculation device, they can concentrate on the single calculation element, perhaps be distributed on the network that a plurality of calculation element forms, alternatively, they can be realized with the executable program code of calculation element, thereby, they can be stored in the memory storage and carry out by calculation element, and in some cases, can carry out step shown or that describe with the order that is different from herein, perhaps they are made into each integrated circuit modules respectively, perhaps a plurality of modules in them or step are made into the single integrated circuit module and realize.Like this, the present invention is not restricted to any specific hardware and software combination.
The above is the preferred embodiments of the present invention only, is not limited to the present invention, and for a person skilled in the art, the present invention can have various changes and variation.Within the spirit and principles in the present invention all, any modification of being done, be equal to replacement, improvement etc., all should be included within protection scope of the present invention.