CN115051802B - Five-prevention lock management system and method - Google Patents
Five-prevention lock management system and method Download PDFInfo
- Publication number
- CN115051802B CN115051802B CN202210788924.7A CN202210788924A CN115051802B CN 115051802 B CN115051802 B CN 115051802B CN 202210788924 A CN202210788924 A CN 202210788924A CN 115051802 B CN115051802 B CN 115051802B
- Authority
- CN
- China
- Prior art keywords
- key
- prevention
- operated
- dynamic
- task
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/088—Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Mobile Radio Communication Systems (AREA)
- Storage Device Security (AREA)
- Lock And Its Accessories (AREA)
Abstract
Description
技术领域Technical Field
本发明涉及五防锁管理领域,具体涉及一种五防锁管理系统及方法。The present invention relates to the field of five-defense lock management, and in particular to a five-defense lock management system and method.
背景技术Background technique
电气设备五防主要是指:1、防止误拉合开关,2、防止带负荷拉合隔离开关,3、防止误入带电间隔,4、防止带电挂地线,5防止带地线(接地刀闸)合闸。为此,给电气设备增加五防锁,防止五防事故的发生。The five protections of electrical equipment mainly refer to: 1. Preventing the accidental closing of switches, 2. Preventing the closing of isolating switches with load, 3. Preventing the accidental entry into live compartments, 4. Preventing the hanging of ground wires with power on, and 5. Preventing the closing of switches with ground wires (grounding switches). For this reason, five protection locks are added to electrical equipment to prevent the occurrence of five protection accidents.
在现有技术中,常常将五防锁的数字钥匙存储于服务器上,待工作人员使用时,通过移动终端登录账号,直接拉取服务器上的数字钥匙,然后远程打开五防锁。但是,现有技术因钥匙不是动态的以及可以直接获取服务器上的数字钥匙,导致数字钥匙可能被工作人员泄露以及被攻击盗取,从而导致非法人员打开五防锁进行设备的偷盗。同时,由于数字钥匙被工作人员悉知,工作人员可能不需要经过服务器,就直接向五防主机请求打开五防锁,导致无法形成时间记录,从而导致出现事故(例如,忘关柜门)无法追溯。In the prior art, the digital key of the five-defense lock is often stored on the server. When the staff uses it, they log in to the account through the mobile terminal, directly pull the digital key on the server, and then remotely open the five-defense lock. However, because the key is not dynamic and the digital key on the server can be directly obtained in the prior art, the digital key may be leaked by the staff and stolen by attacks, which may cause illegal personnel to open the five-defense lock and steal equipment. At the same time, because the digital key is known to the staff, the staff may not need to go through the server, but directly request the five-defense host to open the five-defense lock, resulting in the inability to form a time record, which may cause accidents (for example, forgetting to close the cabinet door) that cannot be traced.
发明内容Summary of the invention
本发明所要解决的技术问题是现有技术中五防锁的数字钥匙容易被截获以及无法追溯的问题,目的在于提供一种五防锁管理系统及方法,解决了现有技术中存在的问题。The technical problem to be solved by the present invention is that the digital keys of the five-protection locks in the prior art are easily intercepted and cannot be traced. The purpose is to provide a five-protection lock management system and method to solve the problems existing in the prior art.
本发明通过下述技术方案实现:The present invention is achieved through the following technical solutions:
第一方面,本发明提供了一种五防锁管理系统,包括钥匙服务器、多个钥匙移动终端、验电器、五防主机、五防锁以及待操作设备;In a first aspect, the present invention provides a five-protection lock management system, including a key server, a plurality of key mobile terminals, a tester, a five-protection host, a five-protection lock, and a device to be operated;
每个所述钥匙移动终端与工作人员一一对应,所述钥匙服务器分别与五防主机以及多个钥匙移动终端通信连接,所述钥匙终端还与验电器通信连接,所述验电器与待操作设备电性连接,所述五防主机与五防锁电性连接,所述五防锁设置于待操作设备上,所述钥匙移动终端上设置有摄像头。Each of the key mobile terminals corresponds to a staff member one by one, the key server is communicated with the five-protection host and multiple key mobile terminals respectively, the key terminal is also communicated with the tester, the tester is electrically connected to the device to be operated, the five-protection host is electrically connected to the five-protection lock, the five-protection lock is set on the device to be operated, and the key mobile terminal is provided with a camera.
第二方面,本发明提供了一种基于五防锁管理系统的五防锁管理方法,包括:In a second aspect, the present invention provides a five-defense lock management method based on a five-defense lock management system, comprising:
通过五防主机生成待操作任务,并将该待操作任务分别传输至所述钥匙服务器以及对应的钥匙移动终端;Generate pending operation tasks through the five-defense host, and transmit the pending operation tasks to the key server and the corresponding key mobile terminal respectively;
通过验电器对待操作设备的电压进行采集,得到待操作设备的采集电压,并等待钥匙移动终端获取该采集电压;The voltage of the device to be operated is collected by an electroscope to obtain the collected voltage of the device to be operated, and the key mobile terminal is waited for to obtain the collected voltage;
通过钥匙服务器接收待操作任务,根据待操作任务生成基于五防主机属性的第一动态五防钥匙以及基于钥匙移动终端属性的第二动态五防钥匙,并将第一动态五防钥匙传输至五防主机,将第二动态五防钥匙传输至钥匙移动终端,所述待操作任务包括五防主机属性以及待操作任务对应的钥匙移动终端属性;Receive the task to be operated through the key server, generate a first dynamic five-defense key based on the attributes of the five-defense host and a second dynamic five-defense key based on the attributes of the key mobile terminal according to the task to be operated, and transmit the first dynamic five-defense key to the five-defense host, and transmit the second dynamic five-defense key to the key mobile terminal, wherein the task to be operated includes the attributes of the five-defense host and the attributes of the key mobile terminal corresponding to the task to be operated;
通过钥匙移动终端获取待操作任务、验电器上的采集电压以及实时人像,并根据采集电压以及实时人像对工作人员进行验证,若验证通过,则接收第二动态五防钥匙,并对第二动态五防钥匙解密,得到第一解密钥匙,将该第一解密钥匙传输至五防主机;The task to be operated, the collected voltage on the electroscope and the real-time portrait are obtained through the key mobile terminal, and the staff is verified according to the collected voltage and the real-time portrait. If the verification is passed, the second dynamic five-defense key is received, and the second dynamic five-defense key is decrypted to obtain the first decryption key, and the first decryption key is transmitted to the five-defense host;
还通过五防主机接收第一动态五防钥匙以及第一解密钥匙,对第一动态五防钥匙进行解密,得到第二解密钥匙,并校验第一解密钥匙是否与第二解密钥匙,若是,则打开待操作设备对应的五防锁,并将工作人员打开五防锁的记录存储,否则拒绝打开待操作设备对应的五防锁。The first dynamic five-protection key and the first decryption key are also received through the five-protection host, the first dynamic five-protection key is decrypted to obtain the second decryption key, and the first decryption key is verified to be the same as the second decryption key. If so, the five-protection lock corresponding to the device to be operated is opened, and the record of the staff opening the five-protection lock is stored. Otherwise, the five-protection lock corresponding to the device to be operated is refused to be opened.
进一步地,所述待操作任务包括唯一任务编码、工作人员信息、工作人员对应的钥匙移动终端属性、五防主机属性以及待操作设备对应的五防锁。Furthermore, the task to be operated includes a unique task code, staff information, key mobile terminal attributes corresponding to the staff, five-defense host attributes, and a five-defense lock corresponding to the device to be operated.
进一步地,根据待操作任务生成基于五防主机属性的第一动态五防钥匙以及基于钥匙移动终端属性的第二动态五防钥匙,包括:Further, generating a first dynamic five-defense key based on the attributes of the five-defense host and a second dynamic five-defense key based on the attributes of the key mobile terminal according to the task to be operated includes:
根据待操作任务中的唯一任务编码,生成第一动态五防钥匙以及第二动态五防钥匙,所述第一动态五防钥匙与第二动态五防钥匙相同;Generate a first dynamic five-defense key and a second dynamic five-defense key according to a unique task code in the task to be operated, wherein the first dynamic five-defense key is the same as the second dynamic five-defense key;
根据待操作任务中的五防主机属性,生成基于五防主机属性的第一动态五防钥匙;According to the five-defense host attributes in the task to be operated, generate a first dynamic five-defense key based on the five-defense host attributes;
根据待操作任务中的钥匙移动终端属性,生成基于钥匙移动终端属性的第二动态五防钥匙。According to the key mobile terminal attributes in the task to be operated, a second dynamic five-defense key based on the key mobile terminal attributes is generated.
进一步地,根据待操作任务中的唯一任务编码,生成第一动态五防钥匙以及第二动态五防钥匙,包括:Further, according to the unique task code in the task to be operated, a first dynamic five-defense key and a second dynamic five-defense key are generated, including:
从待操作任务中的唯一任务编码中随机取出两位数q和数p,所述唯一任务编码中的数字个数大于或者等于K;Randomly extract a two-digit number q and a number p from a unique task code in the task to be operated, where the number of digits in the unique task code is greater than or equal to K;
将数q与数p相乘,得到数N;Multiply the number q by the number p to get the number N;
获取数q-1以及数p-1的最小公倍数,得到数L,L=lcm(p-1,q-1),lcm表示求取最小公倍数;Obtain the least common multiple of the number q-1 and the number p-1, and obtain the number L, L=lcm(p-1,q-1), where lcm represents the least common multiple;
根据所述数L,获取数E为:According to the number L, the number E is obtained as:
1<E<L1<E<L
gcd(E,L)=1gcd(E,L)=1
其中,gcd表示求取最大公约数;Among them, gcd means finding the greatest common divisor;
根据数E和数L,获取数D为:According to the number E and the number L, the number D is obtained as:
1<D<L1<D<L
E*D mod L=1E*D mod L=1
其中,mod表示求余符号;Among them, mod represents the remainder symbol;
以数q、数p、数N、数E以及数D随机组成第一动态五防钥匙以及第二动态五防钥匙。The first dynamic five-defense key and the second dynamic five-defense key are randomly composed of the number q, the number p, the number N, the number E and the number D.
进一步地,根据待操作任务中的五防主机属性,生成基于五防主机属性的第一动态五防钥匙,包括:Further, according to the five-defense host attributes in the task to be operated, a first dynamic five-defense key based on the five-defense host attributes is generated, including:
根据待操作任务中的五防主机属性,采用属性基加密算法生成基于五防主机属性的第一动态五防钥匙。According to the attributes of the five-defense host in the task to be operated, an attribute-based encryption algorithm is used to generate a first dynamic five-defense key based on the attributes of the five-defense host.
进一步地,根据待操作任务中的钥匙移动终端属性,生成基于钥匙移动终端属性的第二动态五防钥匙,包括:Further, according to the key mobile terminal attributes in the task to be operated, a second dynamic five-defense key based on the key mobile terminal attributes is generated, including:
根据待操作任务中的钥匙移动终端属性,采用属性基加密算法生成基于钥匙移动终端属性的第二动态五防钥匙。According to the key mobile terminal attributes in the task to be operated, an attribute-based encryption algorithm is used to generate a second dynamic five-defense key based on the key mobile terminal attributes.
进一步地,根据采集电压以及实时人像对工作人员进行验证,包括:Furthermore, the staff is verified based on the collected voltage and real-time portrait, including:
对所述采集电压进行一次验证,得到一次验证结果,所述一次验证结果为合格或者不合格;Performing a verification on the collected voltage to obtain a verification result, wherein the verification result is qualified or unqualified;
根据待操作任务中的工作人员信息,对实时人像进行二次验证,得到二次验证结果,所述二次验证结果为合格或者不合格;According to the staff information in the task to be operated, the real-time portrait is secondary verified to obtain a secondary verification result, which is qualified or unqualified;
若一次验证结果和二次验证结果均为合格,则对工作人员的验证通过,否则对工作人员的验证不通过。If both the first verification result and the second verification result are qualified, the verification of the staff member passes, otherwise the verification of the staff member fails.
进一步地,对所述采集电压进行一次验证,得到一次验证结果,包括:Further, the collected voltage is verified once to obtain a verification result, including:
判断所述采集电压是否小于或者等于设定的电压阈值,若是,则确定一次验证结果为合格,否则确定一次验证结果为不合格。It is determined whether the collected voltage is less than or equal to a set voltage threshold. If so, a verification result is determined to be qualified; otherwise, a verification result is determined to be unqualified.
进一步地,根据待操作任务中的工作人员信息,对实时人像进行二次验证,包括:Furthermore, according to the staff information in the task to be operated, the real-time portrait is verified twice, including:
采用神经网络模型对实时人像进行识别,得到识别结果,所述识别结果包括实时人像对应的信息,所述神经网络模型为预先训练的人脸识别模型;Using a neural network model to recognize the real-time portrait to obtain a recognition result, the recognition result includes information corresponding to the real-time portrait, and the neural network model is a pre-trained face recognition model;
判断实时人像对应的信息是否与工作人员信息相同,若是,则确定二次验证结果为合格,否则确定二次验证结果为不合格。It is determined whether the information corresponding to the real-time portrait is the same as the staff member information. If so, the secondary verification result is determined to be qualified, otherwise, the secondary verification result is determined to be unqualified.
本发明与现有技术相比,具有如下的优点和有益效果:Compared with the prior art, the present invention has the following advantages and beneficial effects:
本发明提供了一种五防锁管理系统及方法,通过钥匙服务器进行基于设备的加密,并且在每次任务时才生成密码,不仅有效避免了服务器中的数字密码泄露,同时还对钥匙移动终端进行了验证,而每个钥匙移动终端与工作人员一一对应,从而使五防锁的打开记录与工作人员关联,方便事件的追溯。The present invention provides a five-protection lock management system and method, which performs device-based encryption through a key server and generates a password for each task, which not only effectively avoids the leakage of digital passwords in the server, but also verifies the key mobile terminal. Each key mobile terminal corresponds to a staff member one by one, so that the opening record of the five-protection lock is associated with the staff member, which facilitates the tracing of events.
附图说明BRIEF DESCRIPTION OF THE DRAWINGS
为了更清楚地说明本发明示例性实施方式的技术方案,下面将对实施例中所需要使用的附图作简单地介绍,应当理解,以下附图仅示出了本发明的某些实施例,因此不应被看作是对范围的限定,对于本领域普通技术人员来讲,在不付出创造性劳动的前提下,还可以根据这些附图获得其他相关的附图。在附In order to more clearly illustrate the technical solutions of the exemplary embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. It should be understood that the following drawings only illustrate certain embodiments of the present invention and should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.
图中:In the figure:
图1为本发明实施例提供的一种五防锁管理系统的结构示意图;FIG1 is a schematic diagram of the structure of a five-protection lock management system provided by an embodiment of the present invention;
图2为本发明实施例提供的一种五防锁管理方法的流程图。FIG. 2 is a flow chart of a five-protection lock management method provided by an embodiment of the present invention.
具体实施方式Detailed ways
为使本发明的目的、技术方案和优点更加清楚明白,下面结合实施例和附图,对本发明作进一步的详细说明,本发明的示意性实施方式及其说明仅用于解释本发明,并不作为对本发明的限定。In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with embodiments and drawings. The exemplary implementation modes of the present invention and their description are only used to explain the present invention and are not intended to limit the present invention.
实施例1Example 1
如图1所示,本发明实施例提供了一种五防锁管理系统,包括钥匙服务器、多个钥匙移动终端、验电器、五防主机、五防锁以及待操作设备。As shown in FIG1 , an embodiment of the present invention provides a five-protection lock management system, including a key server, multiple key mobile terminals, a tester, a five-protection host, a five-protection lock, and a device to be operated.
每个钥匙移动终端与工作人员一一对应,钥匙服务器分别与五防主机以及多个钥匙移动终端通信连接,钥匙终端还与验电器通信连接,验电器与待操作设备电性连接,五防主机与五防锁电性连接,五防锁设置于待操作设备上,钥匙移动终端上设置有摄像头。Each key mobile terminal corresponds to a staff member one by one, the key server is communicated with the five-protection host and multiple key mobile terminals respectively, the key terminal is also communicated with the tester, the tester is electrically connected to the device to be operated, the five-protection host is electrically connected to the five-protection lock, the five-protection lock is set on the device to be operated, and the key mobile terminal is equipped with a camera.
钥匙移动终端可以是手机、平板或笔记本等移动设备,其具备数据处理以及数据通信供能的同时,能够实现人脸识别。本实施例中的五防锁主要是指可以通过远程指令打开的五防锁。The key mobile terminal can be a mobile device such as a mobile phone, a tablet or a notebook, which can realize face recognition while having data processing and data communication power supply. The five-defense lock in this embodiment mainly refers to a five-defense lock that can be opened by remote commands.
本实施例通过设置验电器,可以使工作人员在操作之前获取待操作设备的电压,该验电器可以设置为手持式或者固定式,当设置为固定式时,其应当固定于待操作设备上,且其执行端设置于待操作设备的电压板上,以实现对待操作设备的验电。值得说明的是,验电器应当具备通信功能,以将验电所产生的采集电压传输给钥匙移动终端。In this embodiment, by setting up an electric tester, the staff can obtain the voltage of the device to be operated before the operation. The electric tester can be set to be handheld or fixed. When set to be fixed, it should be fixed on the device to be operated, and its execution end is set on the voltage board of the device to be operated to realize the voltage test of the device to be operated. It is worth noting that the electric tester should have a communication function to transmit the collected voltage generated by the voltage test to the key mobile terminal.
本实施例设置单独的钥匙服务器进行钥匙的生成以及基于设备的加密,即保证了五防锁钥匙的安全,又能对钥匙移动终端进行认证,保证了工作人员与待操作任务相关,避免其他工作人员非法获取五防锁钥匙。而钥匙移动终端还设置有摄像头,可以实时采集图像,以实现人脸识别,从而保证钥匙移动终端是工作人员本人在使用,进一步加强了工作人员与待操作任务的关联性。This embodiment sets up a separate key server to generate keys and encrypt based on the device, which ensures the security of the five-defense lock keys and can authenticate the key mobile terminal, ensuring that the staff is related to the task to be operated, and preventing other staff from illegally obtaining the five-defense lock keys. The key mobile terminal is also equipped with a camera that can capture images in real time to achieve face recognition, thereby ensuring that the key mobile terminal is used by the staff himself, further strengthening the relevance of the staff to the task to be operated.
实施例2Example 2
如图2所示,本发明实施例提供了一种基于五防锁管理系统的五防锁管理方法,包括:As shown in FIG2 , an embodiment of the present invention provides a five-defense lock management method based on a five-defense lock management system, including:
通过五防主机生成待操作任务,并将该待操作任务分别传输至钥匙服务器以及对应的钥匙移动终端。The five-defense host generates pending tasks and transmits the pending tasks to the key server and the corresponding key mobile terminal respectively.
通过验电器对待操作设备的电压进行采集,得到待操作设备的采集电压,并等待钥匙移动终端获取该采集电压。The voltage of the device to be operated is collected by an electric tester to obtain the collected voltage of the device to be operated, and the key mobile terminal is waited to obtain the collected voltage.
通过钥匙服务器接收待操作任务,根据待操作任务生成基于五防主机属性的第一动态五防钥匙以及基于钥匙移动终端属性的第二动态五防钥匙,并将第一动态五防钥匙传输至五防主机,将第二动态五防钥匙传输至钥匙移动终端,待操作任务包括五防主机属性以及待操作任务对应的钥匙移动终端属性。The task to be operated is received through the key server, and a first dynamic five-defense key based on the attributes of the five-defense host and a second dynamic five-defense key based on the attributes of the key mobile terminal are generated according to the task to be operated, and the first dynamic five-defense key is transmitted to the five-defense host, and the second dynamic five-defense key is transmitted to the key mobile terminal. The task to be operated includes the attributes of the five-defense host and the attributes of the key mobile terminal corresponding to the task to be operated.
通过钥匙移动终端获取待操作任务、验电器上的采集电压以及实时人像,并根据采集电压以及实时人像对工作人员进行验证,若验证通过,则接收第二动态五防钥匙,并对第二动态五防钥匙解密,得到第一解密钥匙,将该第一解密钥匙传输至五防主机。The key mobile terminal obtains the task to be operated, the collected voltage on the electroscope and the real-time portrait, and verifies the staff based on the collected voltage and the real-time portrait. If the verification is successful, the second dynamic five-defense key is received, and the second dynamic five-defense key is decrypted to obtain the first decryption key, which is then transmitted to the five-defense host.
还通过五防主机接收第一动态五防钥匙以及第一解密钥匙,对第一动态五防钥匙进行解密,得到第二解密钥匙,并校验第一解密钥匙是否与第二解密钥匙,若是,则打开待操作设备对应的五防锁,并将工作人员打开五防锁的记录存储,否则拒绝打开待操作设备对应的五防锁。The first dynamic five-protection key and the first decryption key are also received through the five-protection host, the first dynamic five-protection key is decrypted to obtain the second decryption key, and the first decryption key is verified to be the same as the second decryption key. If so, the five-protection lock corresponding to the device to be operated is opened, and the record of the staff opening the five-protection lock is stored. Otherwise, the five-protection lock corresponding to the device to be operated is refused to be opened.
本实施例先进行验电后,才能进行下一步操作,以保证工作人员的人身安全。然后通过钥匙移动终端进行人脸认证,保证待操作任务由工作人员本人来执行,实现任务与工作人员的关联。再然后通过基于钥匙移动终端属性的第二动态五防钥匙,实现设备认证,而钥匙移动终端与工作人员一一对应,即使没有进行人脸认证,也能够将任务与工作人员关联,同时避免了钥匙服务器上的数字钥匙丢失。In this embodiment, the next step can only be performed after the power test to ensure the personal safety of the staff. Then, face recognition is performed through the key mobile terminal to ensure that the task to be operated is performed by the staff himself, and the task is associated with the staff. Then, the second dynamic five-defense key based on the key mobile terminal attribute is used to realize device authentication. The key mobile terminal corresponds to the staff one by one. Even if face recognition is not performed, the task can be associated with the staff, and the loss of the digital key on the key server is avoided.
值得说明的是,五防主机还可以接收人机交互产生的钥匙移动终端挂失请求,挂失后五防主机向钥匙服务器发送该钥匙移动终端已丢失的信息,五防主机也不再接受该钥匙移动终端的开锁请求。钥匙移动终端不再基于该钥匙移动终端的属性进行动态五防钥匙的生成,并且消除已有的动态五防钥匙,避免五防锁被非法人员打开。It is worth noting that the five-defense host can also receive a request for reporting the loss of a key mobile terminal generated by human-computer interaction. After the report is lost, the five-defense host sends a message to the key server that the key mobile terminal has been lost, and the five-defense host no longer accepts unlocking requests from the key mobile terminal. The key mobile terminal no longer generates dynamic five-defense keys based on the attributes of the key mobile terminal, and eliminates existing dynamic five-defense keys to prevent the five-defense lock from being opened by illegal personnel.
在一种可能的实施方式中,待操作任务包括唯一任务编码、工作人员信息、工作人员对应的钥匙移动终端属性、五防主机属性以及待操作设备对应的五防锁。In a possible implementation, the task to be operated includes a unique task code, staff information, key mobile terminal attributes corresponding to the staff, five-defense host attributes, and a five-defense lock corresponding to the device to be operated.
可选的,唯一任务编码可以按照预先设定的规则生成,也可以响应于人机交互产生。Optionally, the unique task code may be generated according to a pre-set rule or in response to human-computer interaction.
在一种可能的实施方式中,根据待操作任务生成基于五防主机属性的第一动态五防钥匙以及基于钥匙移动终端属性的第二动态五防钥匙,包括:In a possible implementation, generating a first dynamic five-defense key based on the attributes of a five-defense host and a second dynamic five-defense key based on the attributes of a key mobile terminal according to the task to be operated includes:
根据待操作任务中的唯一任务编码,生成第一动态五防钥匙以及第二动态五防钥匙,第一动态五防钥匙与第二动态五防钥匙相同。According to the unique task code in the task to be operated, a first dynamic five-protection key and a second dynamic five-protection key are generated, and the first dynamic five-protection key is the same as the second dynamic five-protection key.
根据待操作任务中的五防主机属性,生成基于五防主机属性的第一动态五防钥匙。According to the attributes of the five-defense host in the task to be operated, a first dynamic five-defense key based on the attributes of the five-defense host is generated.
根据待操作任务中的钥匙移动终端属性,生成基于钥匙移动终端属性的第二动态五防钥匙。According to the key mobile terminal attributes in the task to be operated, a second dynamic five-defense key based on the key mobile terminal attributes is generated.
在一种可能的实施方式中,根据待操作任务中的唯一任务编码,生成第一动态五防钥匙以及第二动态五防钥匙,包括:In a possible implementation, generating a first dynamic five-protection key and a second dynamic five-protection key according to a unique task code in a task to be operated includes:
从待操作任务中的唯一任务编码中随机取出两位数q和数p,唯一任务编码中的数字个数大于或者等于K,K可以为2、3、4、5、6、7或者其他更大的数字,唯一任务编码中至少存在两个不同的数字。取出的数q与数p可以不相同(如:数q与数p互质)。Randomly extract two digits q and p from the unique task code in the task to be operated. The number of digits in the unique task code is greater than or equal to K. K can be 2, 3, 4, 5, 6, 7 or other larger numbers. There are at least two different digits in the unique task code. The extracted numbers q and p can be different (for example, q and p are mutually prime).
将数q与数p相乘,得到数N。Multiply the number q by the number p to get the number N.
获取数q-1以及数p-1的最小公倍数,得到数L,L=lcm(p-1,q-1),lcm表示求取最小公倍数。Obtain the least common multiple of the number q-1 and the number p-1 to obtain the number L, L=lcm(p-1,q-1), where lcm represents the least common multiple.
根据数L,获取数E为:According to the number L, the number E is obtained as:
1<E<L1<E<L
gcd(E,L)=1gcd(E,L)=1
其中,gcd表示求取最大公约数。Among them, gcd means finding the greatest common divisor.
根据数E和数L,获取数D为:According to the number E and the number L, the number D is obtained as:
1<D<L1<D<L
E*D mod L=1E*D mod L=1
其中,mod表示求余符号。Among them, mod represents the remainder symbol.
以数q、数p、数N、数E以及数D随机组成第一动态五防钥匙以及第二动态五防钥匙。The first dynamic five-defense key and the second dynamic five-defense key are randomly composed of the number q, the number p, the number N, the number E and the number D.
通过上述步骤生成了随机的第一动态五防钥匙以及第二动态五防钥匙,并且每次生成的第一动态五防钥匙以及第二动态五防钥匙的长度可能不同,增加了随机性。Through the above steps, a random first dynamic five-protection key and a second dynamic five-protection key are generated, and the lengths of the first dynamic five-protection key and the second dynamic five-protection key generated each time may be different, thereby increasing randomness.
在一种可能的实施方式中,根据待操作任务中的五防主机属性,生成基于五防主机属性的第一动态五防钥匙,包括:In a possible implementation, according to the five-defense host attributes in the task to be operated, generating a first dynamic five-defense key based on the five-defense host attributes includes:
根据待操作任务中的五防主机属性,采用属性基加密算法生成基于五防主机属性的第一动态五防钥匙。According to the attributes of the five-defense host in the task to be operated, an attribute-based encryption algorithm is used to generate a first dynamic five-defense key based on the attributes of the five-defense host.
在一种可能的实施方式中,根据待操作任务中的钥匙移动终端属性,生成基于钥匙移动终端属性的第二动态五防钥匙,包括:In a possible implementation, generating a second dynamic five-defense key based on the key mobile terminal attribute in the task to be operated includes:
根据待操作任务中的钥匙移动终端属性,采用属性基加密算法生成基于钥匙移动终端属性的第二动态五防钥匙。According to the key mobile terminal attributes in the task to be operated, an attribute-based encryption algorithm is used to generate a second dynamic five-defense key based on the key mobile terminal attributes.
在本实施例中,提供一种属性基加密的方法:In this embodiment, a method for attribute-based encryption is provided:
生成q阶的循环群G1,循环群G1的生成元为g,双线性映射(e:G1×G1→G2)。随机选择参数值σ和参数值δ,循环群G1中的元素为γ1,γ2,...,γu,则公钥PK={g,gσ,e(g,g)δ,γ1,γ2,...,γu},私钥MSK=gδ。Generate a cyclic group G 1 of order q, the generator of the cyclic group G 1 is g, and a bilinear map (e: G 1 ×G 1 →G 2 ). Randomly select parameter values σ and δ, the elements in the cyclic group G 1 are γ 1 ,γ 2 ,...,γ u , then the public key PK = {g,g σ ,e(g,g) δ ,γ 1 ,γ 2 ,...,γ u }, and the private key MSK = g δ .
加密(PK,m,Γ):Γ为(M,ρ),Γ由钥匙移动终端属性(或五防主机属性)通过逻辑关系符关联起来,M表示l×n的矩阵,矩阵M中的任意行为Mi,i表示矩阵M的行标,ρ表示单射函数,ρ:{1,...,l}->{1,...,u}。选择随机向量v=(s,t2,t3,...,tn),s表示秘密共享密钥,t2,t3,...,tn均为随机值,λi=V(Mi),λi表示秘密共享密钥份额,在密文中添加信息Di,h,为解密过程提供函数条件。获取密文为:Encryption (PK, m, Γ): Γ is (M, ρ), Γ is associated by the key mobile terminal attributes (or five-defense host attributes) through logical relationship symbols, M represents a l×n matrix, any row in the matrix M is Mi , i represents the row index of the matrix M, ρ represents an injective function, ρ: {1,...,l}->{1,...,u}. Select a random vector v=(s,t 2 ,t 3 ,...,t n ), s represents the secret sharing key, t 2 ,t 3 ,...,t n are all random values, λ i =V(M i ), λ i represents the secret sharing key share, add information Di ,h to the ciphertext to provide function conditions for the decryption process. The ciphertext is obtained as:
其中,h∈Γ/ρ(i)表示在访问结构Γ的关联属性中去除ρ(i)属性。Among them, h∈Γ/ρ(i) means removing the ρ(i) attribute from the associated attributes of the access structure Γ.
获取用户属性私钥(MSK,B):输入私钥MSK以及钥匙移动终端属性集合B,选择随机参数t,并获取属性私钥为:Get the user attribute private key (MSK, B): Enter the private key MSK and the key mobile terminal attribute set B, select the random parameter t, and get the attribute private key as:
SK={k=gδg-σt,L=gt}SK={k=g δ g -σt ,L=g t }
其中,钥匙移动终端属性集合B任意属性为x,中间参数 Among them, any attribute of the key mobile terminal attribute set B is x, and the intermediate parameter
值得说明的是,访问结构Γ中的属性为待操作任务中的属性(也就是五防主机存储的钥匙移动终端标准属性),钥匙移动终端属性集合B为钥匙移动终端请求加密时所发送的属性。It is worth noting that the attributes in the access structure Γ are the attributes in the task to be operated (that is, the standard attributes of the key mobile terminal stored in the five-defense host), and the key mobile terminal attribute set B is the attributes sent by the key mobile terminal when requesting encryption.
当钥匙移动终端收到密文CT、私钥SK以及访问结构Γ后,如果该钥匙移动终端的钥匙移动终端属性集合B不满足访问结构Γ,则无法进行解密,否则进行解密。When the key mobile terminal receives the ciphertext CT, the private key SK and the access structure Γ, if the key mobile terminal attribute set B of the key mobile terminal does not satisfy the access structure Γ, decryption cannot be performed, otherwise decryption is performed.
解密过程可以为:The decryption process can be:
定义集合P={i:ρ(i)∈B且1≤i≤l},并且P∈{1,2,...,l}.Define the set P = {i:ρ(i)∈B and 1≤i≤l}, and P∈{1,2,...,l}.
设置目标向量为V=(1,0,...,0),根据线性秘密共享方案,若钥匙移动终端属性集合B满足访问结构Γ,并能找到一组向量W=(w1,w2,...,wn)使成立,则n表示用户属性个数。Set the target vector to V = (1, 0, ..., 0). According to the linear secret sharing scheme, if the key mobile terminal attribute set B satisfies the access structure Γ, and a set of vectors W = (w 1 ,w 2 , ...,w n ) can be found such that If established, n represents the number of user attributes.
定义交集集合o={x:存在i∈P,x=ρ(i),且x∈B∩Γ}。Define the intersection set o = {x: there exists i∈P, x = ρ(i), and x∈B∩Γ}.
自定义函数:其中,γ(x)表示G1中元素对应的属性值γx,β(o)表示属性集合中元素连乘。Custom functions: Among them, γ(x) represents the attribute value γ x corresponding to the element in G 1 , and β(o) represents the multiplication of elements in the attribute set.
其中,Ci'表示共享秘钥份额λi在属性集合o上的分配,密文中共享秘钥份额λi的i值通过x∈o/ρ(i)中的ρ(i)进行分配。Where C i ′ represents the distribution of the shared key share λ i on the attribute set o, and the i value of the shared key share λ i in the ciphertext is distributed through ρ(i) in x∈o/ρ(i).
其中,Ko'表示连乘积,用于对解密用户私钥份额Kx进行连乘,并将β(o)函数代入其中,以供推导。Wherein, K o ' represents a continuous product, which is used to continuously multiply the decrypted user private key share K x , and the β(o) function is substituted into it for derivation.
总上所述,可以对密文CT进行解密,以获取明文m,具体为:In summary, the ciphertext CT can be decrypted to obtain the plaintext m, as follows:
在一种可能的实施方式中,根据采集电压以及实时人像对工作人员进行验证,包括:In a possible implementation, verifying a worker based on the collected voltage and the real-time portrait includes:
对采集电压进行一次验证,得到一次验证结果,一次验证结果为合格或者不合格;The collected voltage is verified once to obtain a verification result, which is qualified or unqualified;
根据待操作任务中的工作人员信息,对实时人像进行二次验证,得到二次验证结果,二次验证结果为合格或者不合格;According to the staff information in the task to be operated, the real-time portrait is verified twice to obtain a secondary verification result, which is qualified or unqualified;
若一次验证结果和二次验证结果均为合格,则对工作人员的验证通过,否则对工作人员的验证不通过。If both the first verification result and the second verification result are qualified, the verification of the staff member passes, otherwise the verification of the staff member fails.
在一种可能的实施方式中,对采集电压进行一次验证,得到一次验证结果,包括:In a possible implementation manner, the collected voltage is verified once to obtain a verification result, including:
判断采集电压是否小于或者等于设定的电压阈值,若是,则确定一次验证结果为合格,否则确定一次验证结果为不合格。It is determined whether the collected voltage is less than or equal to the set voltage threshold. If so, the verification result is determined to be qualified, otherwise, the verification result is determined to be unqualified.
可选的,电压阈值可以设置为0。Optionally, the voltage threshold can be set to 0.
在一种可能的实施方式中,根据待操作任务中的工作人员信息,对实时人像进行二次验证,包括:In a possible implementation, a secondary verification is performed on the real-time portrait according to the worker information in the task to be operated, including:
采用神经网络模型对实时人像进行识别,得到识别结果,识别结果包括实时人像对应的信息,神经网络模型为预先训练的人脸识别模型;A neural network model is used to recognize the real-time portrait to obtain a recognition result, which includes information corresponding to the real-time portrait. The neural network model is a pre-trained face recognition model.
判断实时人像对应的信息是否与工作人员信息相同,若是,则确定二次验证结果为合格,否则确定二次验证结果为不合格。It is determined whether the information corresponding to the real-time portrait is the same as the staff member information. If so, the secondary verification result is determined to be qualified, otherwise, the secondary verification result is determined to be unqualified.
钥匙移动终端中可以设置预先训练好的神经网络模型,该神经网络模型通过所有工作人员的人脸图像进行训练,训练完成的神经网络模型可以对实时人像进行识别,得到识别结果。而每个识别结果均对应有工作人员的信息,当得到人脸识别结果后,就得到了该工作人员的信息。A pre-trained neural network model can be set in the key mobile terminal. The neural network model is trained through the facial images of all staff members. The trained neural network model can recognize real-time portraits and obtain recognition results. Each recognition result corresponds to the information of the staff member. When the face recognition result is obtained, the information of the staff member is obtained.
本发明提供了一种五防锁管理系统及方法,通过钥匙服务器进行基于设备的加密,并且在每次任务时才生成密码,不仅有效避免了服务器中的数字密码泄露,同时还对钥匙移动终端进行了验证,而每个钥匙移动终端与工作人员一一对应,从而使五防锁的打开记录与工作人员关联,方便事件的追溯。The present invention provides a five-protection lock management system and method, which performs device-based encryption through a key server and generates a password for each task, which not only effectively avoids the leakage of digital passwords in the server, but also verifies the key mobile terminal. Each key mobile terminal corresponds to a staff member one by one, so that the opening record of the five-protection lock is associated with the staff member, which facilitates the tracing of events.
以上的具体实施方式,对本发明的目的、技术方案和有益效果进行了进一步详细说明,所应理解的是,以上仅为本发明的具体实施方式而已,并不用于限定本发明的保护范围,凡在本发明的精神和原则之内,所做的任何修改、等同替换、改进等,均应包含在本发明的保护范围之内。The above specific implementation methods further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above are only specific implementation methods of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.
Claims (10)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202210788924.7A CN115051802B (en) | 2022-07-06 | 2022-07-06 | Five-prevention lock management system and method |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202210788924.7A CN115051802B (en) | 2022-07-06 | 2022-07-06 | Five-prevention lock management system and method |
Publications (2)
Publication Number | Publication Date |
---|---|
CN115051802A CN115051802A (en) | 2022-09-13 |
CN115051802B true CN115051802B (en) | 2024-07-02 |
Family
ID=83164937
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CN202210788924.7A Active CN115051802B (en) | 2022-07-06 | 2022-07-06 | Five-prevention lock management system and method |
Country Status (1)
Country | Link |
---|---|
CN (1) | CN115051802B (en) |
Family Cites Families (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP3604737B2 (en) * | 1994-07-29 | 2004-12-22 | キヤノン株式会社 | Secret information processing method in communication system having a plurality of information processing devices and communication system thereof |
CN105323061B (en) * | 2015-12-02 | 2019-07-12 | 河海大学 | It is a kind of can keyword search outsourcing key generate and decryption attribute based system and decryption method |
CN105915344B (en) * | 2016-04-15 | 2019-03-22 | 重庆金瓯科技发展有限责任公司 | A kind of electron key shared service system for house lease |
US11233637B2 (en) * | 2018-10-18 | 2022-01-25 | Secret Double Octopus Ltd | System and method for validating an entity |
CN109461236B (en) * | 2018-10-26 | 2021-02-26 | 海南电网有限责任公司三亚供电局 | Intelligent lockset safety management and control method and system |
CN110148233A (en) * | 2019-04-19 | 2019-08-20 | 国网上海市电力公司 | It is a kind of for unlocking the system and method for substation's error-proof device |
CN112017411A (en) * | 2020-08-21 | 2020-12-01 | 广东电网有限责任公司清远供电局 | Substation operation anti-error early warning system |
CN112351063B (en) * | 2020-09-15 | 2022-07-29 | 国网浙江省电力有限公司湖州供电公司 | A system and method for monitoring operation of electrical equipment based on operation ticket |
-
2022
- 2022-07-06 CN CN202210788924.7A patent/CN115051802B/en active Active
Non-Patent Citations (1)
Title |
---|
可视化操作过程监控防误系统技术方案研究;杨成钢等;《电工技术》;20180225;42-43 * |
Also Published As
Publication number | Publication date |
---|---|
CN115051802A (en) | 2022-09-13 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US11063941B2 (en) | Authentication system, authentication method, and program | |
US9235697B2 (en) | One-time passcodes with asymmetric keys | |
CN111447414B (en) | Video monitoring system and method convenient to dispatch and monitor | |
Kim et al. | Cryptanalysis and improvement of a biometrics-based multi-server authentication with key agreement scheme | |
CN103346888B (en) | A kind of remote identity authentication method based on password, smart card and biological characteristic | |
CN105389500A (en) | Method of using one device to unlock another device | |
CN110519046A (en) | Quantum communications service station cryptographic key negotiation method and system based on disposable asymmetric key pair and QKD | |
CN101815091A (en) | Cipher providing equipment, cipher authentication system and cipher authentication method | |
JP2008504595A (en) | Renewable and private biometrics | |
CN110505055A (en) | Based on unsymmetrical key pond to and key card outer net access identity authentication method and system | |
CN110138548A (en) | Based on unsymmetrical key pond to and DH agreement quantum communications service station cryptographic key negotiation method and system | |
CN106059764B (en) | Password and Fingerprint Three-Party Authentication Method Based on Termination Key Derivation Function | |
Panchal et al. | Designing secure and efficient biometric-based access mechanism for cloud services | |
CN110380859A (en) | Based on unsymmetrical key pond to and DH agreement quantum communications service station identity identifying method and system | |
CN112073422A (en) | Intelligent home protection system and protection method thereof | |
CN113302876A (en) | Offline non-interception interaction with cryptocurrency network using network-disabled devices | |
CN110176989A (en) | Quantum communications service station identity identifying method and system based on unsymmetrical key pond | |
CN115051802B (en) | Five-prevention lock management system and method | |
CN116049792B (en) | Face registration and recognition method and face data protection system | |
CN106815907A (en) | A kind of method and intelligent access control system based on picture password management intelligent entrance guard | |
Liao et al. | Rudba: Reusable user-device biometric authentication scheme for multi-service systems | |
Murdoch et al. | A Forward-secure Efficient Two-factor Authentication Protocol | |
CN111817843A (en) | A program code encryption method and system based on homomorphic encryption algorithm | |
CN110176997A (en) | Based on unsymmetrical key pond to and digital signature quantum communications service station AKA cryptographic key negotiation method and system, computer equipment | |
Tsague et al. | DS-NIZKP: a ZKP-based strong authentication using digital signature for distributed systems |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PB01 | Publication | ||
PB01 | Publication | ||
SE01 | Entry into force of request for substantive examination | ||
SE01 | Entry into force of request for substantive examination | ||
GR01 | Patent grant |