Information management method and system for access control card chip

Abstract

The present invention proposes an information management method and system for access card chips, the method comprising: providing an anonymous identifier, initializing the authentication process, laying the foundation for privacy protection and data chain; completing mutual trust authentication between the access card and the device, and providing authentication challenge data for subsequent behavior recording and tracing; based on the results and challenge data generated after the authentication is completed, generating a complete encrypted behavior record and establishing a chain hash structure; storing the encrypted behavior record and the chain hash value locally or synchronizing them to a server to ensure the reliability and traceability of the behavior record; using the complete behavior chain data, detecting abnormal behavior and supporting traceability verification. The present invention significantly improves the privacy protection capability, security and tracing efficiency of the access control system by integrating dynamic identity generation, encrypted behavior chain storage and a two-way authentication mechanism in the access card chip.

Description

Technical Field

[0001] The present invention belongs to the technical field of information management, and in particular relates to an information management method and system for access control card chips. Background Art

[0002] With the development of Internet of Things technology, access card systems have become an important identity authentication and security management tool in modern society and are widely used in enterprises, schools, communities and high-security places (such as data centers, laboratories, etc.). Traditional access card systems mainly rely on card swiping devices and backend servers to verify user identities. Core technologies include fixed key authentication, user information storage and access log recording. However, the existing technology has the following deficiencies in practical applications:

[0003] Insufficient user privacy protection:

[0004] Traditional access card systems usually use the user's unique identity (such as card number or user name) as the basis to complete user authentication through one-way verification. Although this method achieves access control, there is a risk of privacy leakage because the user's identity information is directly exposed during the authentication process. For example, when an attacker steals authentication information or copies a card through the network, he can easily obtain the user's identity and conduct illegal access. In addition, the data transmission between the access card and the backend server is usually not strictly encrypted, which further increases the possibility of user information being tampered with or intercepted.

[0005] Insufficient authentication security:

[0006] Existing access control systems generally use one-way authentication, that is, the user's identity is verified to the access control device, while the identity of the access control device is not reversely verified. This mechanism makes it possible to forge access control devices or man-in-the-middle attacks, resulting in reduced security of the access control system. In addition, static key mechanisms (such as fixed encryption keys) are easily cracked or leaked, allowing attackers to bypass system security by copying authentication data. For example, replay attacks are a common security vulnerability in access control systems, and attackers can gain access rights by replaying authentication requests from legitimate users.

[0007] Behavior records lack integrity and traceability:

[0008] The access control system records user access logs as a basis for subsequent tracing. However, these records are usually stored in plain text or unencrypted form in the device or backend database, which is easy to be tampered with or forged. In addition, the decentralized storage of access logs makes information tracing costly and unreliable. Once an abnormal event occurs (such as unauthorized access or card loss), it is difficult to restore the true behavior trajectory.

[0009] Redundancy and security risks of data transmission:

[0010] Current access control systems usually transmit a large amount of redundant information during the authentication process, such as the user's complete identity data or device configuration data. This transmission mode not only increases bandwidth requirements and authentication time, but also makes sensitive information more likely to be exposed. In scenarios with high privacy protection requirements (such as hospitals and financial institutions), this redundant transmission has become one of the main problems.

[0011] In summary, the existing access card system has deficiencies in privacy protection, security authentication, behavior tracing and data transmission. To address these issues, there is an urgent need for a new access card information management method and system that can effectively protect user privacy, improve authentication security, achieve complete tracing of behavior records and optimize data transmission efficiency. Summary of the invention

[0012] The purpose of the present invention is to design an information management method and system for access control card chips. By integrating dynamic identity generation, encrypted behavior chain storage and a two-way authentication mechanism in the access control card chip, the present invention can significantly improve the privacy protection capability, security and traceability efficiency of the access control system.

[0013] In order to achieve the above object, a first aspect of the present invention provides an information management method for an access card chip, the method comprising:

[0014] S1. The access card chip receives the user identity key and timestamp, uses the SHA-256 hash function to generate a dynamic identity, and uses the hardware pseudo-random number generator in the chip to generate an authentication random number. The dynamic identity is combined with the authentication random number to form an initial authentication request. Before the initial authentication request is sent, the access card chip encrypts it using a symmetric key algorithm to obtain an encrypted authentication request. , if the encrypted authentication request If the verification is successful, jump to S2;

[0015] S2: The access control device receives the encrypted initial authentication request sent by the access control card After that, the initial authentication request is encrypted using the shared device key pair Decrypt and parse out the authentication request data, i.e. the initial authentication request. The access control device generates a second random number, initiates an authentication challenge to the access control card chip, and generates an authentication response value for the access control device. The access control device combines the calculated authentication response value with the generated second random number, encrypts it with the shared device key to generate a response message, and sends the response message to the access control card chip. After receiving the response message, the access control card uses the shared device key to decrypt it, obtains the authentication response value generated by the device and the second random number of the device for two-way authentication. If the authentication response value calculated by the access control device is the same as the authentication response value calculated by the access control card, the two-way authentication verification is passed, and the authentication result is output If not, output the authentication result ;

[0016] S3. The access control device generates a complete encrypted behavior record and establishes a chain hash structure based on the authentication result and challenge data, and stores the chain hash structure locally to build a local chain storage structure, wherein the encrypted behavior record includes a behavior feature tag, and the chain hash structure includes an authentication module and a chain hash value. At the same time, it is determined whether synchronization to the server is required based on the characteristics of the behavior: the local chain storage structure is stored in a behavior chain data structure to achieve an unalterable time chain;

[0017] If it is normal behavior and the two-way authentication is successful, it will be stored locally on the device; if it is abnormal behavior or the two-way authentication fails, the record will be encrypted and uploaded to the server for centralized audit and backup;

[0018] S4. The access control device stores the authentication module and chain hash value of normal behavior and successful two-way authentication as a local chain structure, encrypts the authentication module and chain hash value of abnormal behavior or two-way authentication failure through an asymmetric encryption algorithm and sends them to the server. At the same time, chain verification is performed on the access control device and the server regularly to ensure the consistency of the local chain and the cloud chain;

[0019] S5. The access control device receives the authentication module and chain hash, and decrypts the behavior record to extract the authentication and construct the behavior feature vector. At the same time, it verifies whether the current behavior chain remains intact through chain verification. If the chain verification fails, the device marks the current chain as abnormal and synchronizes the abnormal data to the cloud for audit. For the behavior records that pass the chain verification, the access control device uses the adaptive anomaly detection model to calculate the anomaly score and output the anomaly score. If the anomaly score is greater than the preset threshold, the current behavior is judged to be abnormal. The device records the anomaly and triggers further tracing process. When abnormal behavior is detected, the device analyzes the context of the abnormal record through the behavior chain backtracking. If the distance between the feature vector of the context and the behavior feature vector exceeds the preset threshold, the current abnormal behavior is considered to be a chain-related anomaly. The device records the complete chain fragment and uploads it to the server for centralized auditing.

[0020] Furthermore, the SHA-256 hash function is used to generate a dynamic identity, which is expressed as:

[0021] in, Indicates the user identity key, 128 bits, used to uniquely identify the user; Indicates the current authentication timestamp, accurate to milliseconds, used for the uniqueness of dynamic identities; Indicates the scenario weight parameter. The value is 1 in the common access control scenario and 2 or higher in the high-security access control scenario. It is used to adjust the complexity of the dynamic identity. Represents the SHA-256 hash function, which is used to generate irreversible fixed-length dynamic identifiers; represents a bitwise XOR operation, which is used to enhance the randomness of input data; the symmetric key algorithm is AES-128.

[0022] Furthermore, the second random number is generated by a hardware pseudo-random number generator in the chip, and a dynamic adjustment parameter is introduced during the generation process. , dynamically adjust the complexity of random number generation according to the security level of the device, expressed as:

[0023] in, Indicates the second random number generated by the device, in the range of [1,(2^{64}-1)], used for two-way authentication; Represents the private key inside the device, ensuring that the random number is bound to the device; Represents the current device timestamp, which is used to ensure the uniqueness of the time of random number generation; Represents a dynamically adjusted parameter, which is related to the security level of the device; the authentication response value of the access control device is expressed as:

[0024] in, Indicates the authentication response value of the device; Represents a secure hash function used to generate a fixed-length response value; It represents the security enhancement item of the device, and its value can be dynamically adjusted according to the real-time network security evaluation; the authentication response value of the access card is expressed as:

[0025] in, Indicates the response value calculated by the access card, which is used to verify the identity of the device; Indicates the security enhancement items of the access card, which is different from the device side Correspondingly, it is used to ensure data consistency and anti-attack in two-way authentication.

[0026] Furthermore, the complete encryption behavior record is expressed as:

[0027] in, It indicates a record of behavior; Represents a behavioral feature tag, which is used to identify the uniqueness of the behavior; the chain hash structure is constructed as follows:

[0028] Encrypted behavior records to ensure data privacy during local storage and transmission:

[0029] in, It is the shared key of the device, used to encrypt the behavior records. is the authentication module, Is an encryption algorithm; and generates a chained hash value based on the encrypted record , link the behavior record to the previous record:

[0030] in, is the chained hash value of the current record; is the hash value of the previous record; is the chain random perturbation term, which is dynamically generated and used to further enhance the unpredictability of the chain; It is a bitwise XOR operation used to enhance the randomness of the input data.

[0031] Furthermore, each time the device generates a new Then, compare it with the locally stored Verification is performed to ensure the integrity and security of the behavior chain, expressed as:

[0032] If the verification fails, the access card device triggers an alarm, marks the current record as abnormal and synchronizes it to the server.

[0033] Furthermore, the access control device stores the authentication module and chain hash value of normal behavior and successful two-way authentication as a local chain structure, including: the record of the behavior chain data structure is timestamped For index, by chained hash value Perform sequential linking, each record stores and ;Introduce dynamic weight parameters , combined with behavioral characteristics Fix the hash calculation in the chain:

[0034] in, ,in is the adjustment coefficient inside the device, Feature markers; dynamic weights Dynamically adjust the chain linking mode according to the behavior characteristics to improve the adaptability of the chain to diversified scenarios; encrypt the authentication module and chain hash value of abnormal behavior or two-way authentication failure through an asymmetric encryption algorithm and send them to the server, using the server's public key encryption; and regularly perform chain verification on the access control device and the server to ensure the consistency of the local chain and the cloud chain, including: the device extracts the latest local chain hash value , and sends it to the server; the server extracts the corresponding hash value it stores , for comparison:

[0035] If the verification fails, the device obtains the complete chain segment data from the server and resynchronizes; if successful, the local chain index is updated.

[0036] Furthermore, S4 also includes that the access control device establishes a dual index in the local chain, including a time index and a hash index; the time index stores behavior records in time segments to support fast positioning; the hash index maintains a mapping between the chain hash value of each record and its chain context for fast detection of tampering points.

[0037] Furthermore, the behavior feature vector is expressed as

[0038] ,in, is the behavior feature vector; is the weighted combination result of behavioral characteristics, calculated by the following formula: in, is the feature weight, which reflects the importance of different behavioral features; is the specific component of the behavioral characteristics, derived from the decrypted ; The chain verification verifies whether the current behavior chain remains intact, including:

[0039] in, Dynamic weights, combined with behavioral characteristics Adjust the calculation of hash value; is the chain hash value of the previous record, used to link the chain; the adaptive anomaly detection model is expressed as:

[0040] in, A function that represents the deviation of the behavioral feature from the baseline; represents the time-dependent correction term, which is used to deal with the dynamic changes of behavior; Indicates the normal mode based on historical behavior statistics, indicating the behavioral reference standard of the system; Deviation function The calculation of is based on the following formula:

[0041] if , the current behavior is judged as abnormal, the device records the abnormality and triggers further tracing process.

[0042] Furthermore, when abnormal behavior is detected, the device analyzes the context of the abnormal record through the behavior chain back-tracing. If the distance between the feature vector of the context and the behavior feature vector exceeds the preset threshold, the current abnormal behavior is considered to be a chain-related abnormality. The device records the complete chain fragment and uploads it to the server for centralized auditing, including: extracting the current abnormal record and its adjacent chain records and ; Calculate the distance between the feature vectors of these records , looking for correlated features of abnormal behavior:

[0043] if Beyond the preset threshold, abnormal behavior is considered a chain-related anomaly, and the device records the complete chain fragment and uploads it to the server for centralized auditing.

[0044] In a second aspect of the present invention, an information management system for access control card chips is provided, the system comprising:

[0045] The access card chip unit is used to receive the user identity key and timestamp, use the SHA-256 hash function to generate a dynamic identity, and use the hardware pseudo-random number generator in the chip to generate an authentication random number. The dynamic identity is combined with the authentication random number to form an initial authentication request. Before the initial authentication request is sent, the access card chip is encrypted by a symmetric key algorithm to obtain an encrypted authentication request. , if the encrypted authentication request If the verification is successful, jump to S2;

[0046] The command encryption unit is used for the access control device to receive the encrypted initial authentication request sent by the access control card. After that, the initial authentication request is encrypted using the shared device key pair Decrypt and parse out the authentication request data, i.e. the initial authentication request. The access control device generates a second random number, initiates an authentication challenge to the access control card chip, and generates an authentication response value for the access control device. The access control device combines the calculated authentication response value with the generated second random number, encrypts it with the shared device key to generate a response message, and sends the response message to the access control card chip. After receiving the response message, the access control card uses the shared device key to decrypt it, obtains the authentication response value generated by the device and the second random number of the device for two-way authentication. If the authentication response value calculated by the access control device is the same as the authentication response value calculated by the access control card, the two-way authentication verification is passed, and the authentication result is output If not, output the authentication result ;

[0047] The instruction chain storage unit is used for the access control device to generate a complete encrypted behavior record and establish a chain hash structure according to the result and challenge data generated by the authentication, and store the chain hash structure locally to build a local chain storage structure, wherein the encrypted behavior record includes a behavior feature tag, and the chain hash structure includes an authentication module and a chain hash value, and at the same time, it is determined whether synchronization to the server is required according to the characteristics of the behavior: the local chain storage structure is stored in a behavior chain data structure to realize an unalterable time chain;

[0048] If it is normal behavior and the two-way authentication is successful, it will be stored locally on the device; if it is abnormal behavior or the two-way authentication fails, the record will be encrypted and uploaded to the server for centralized audit and backup;

[0049] The two-way authentication unit is used for the access control device to store the authentication module and chain hash value of normal behavior and successful two-way authentication as a local chain structure, and encrypt the authentication module and chain hash value of abnormal behavior or two-way authentication failure through an asymmetric encryption algorithm and send them to the server. At the same time, the access control device and the server are regularly chained to ensure the consistency of the local chain and the cloud chain;

[0050] The abnormal tracing unit is used for the access control device to receive the authentication module and chain hash, and decrypt the behavior record to extract the authentication and construct the behavior feature vector. At the same time, it verifies whether the current behavior chain remains intact through chain verification. If the chain verification fails, the device marks the current chain as abnormal and synchronizes the abnormal data to the cloud for audit. For the behavior records that pass the chain verification, the access control device uses the adaptive anomaly detection model to calculate the abnormal score and output the abnormal score. If the abnormal score is greater than the preset threshold, the current behavior is judged to be abnormal, the device records the abnormality and triggers further tracing process. When abnormal behavior is detected, the device analyzes the context of the abnormal record through behavior chain backtracking. If the distance between the context feature vector and the behavior feature vector exceeds the preset threshold, the current abnormal behavior is considered to be a chain-related abnormality. The device records the complete chain fragment and uploads it to the server for centralized auditing.

[0051] The beneficial technical effects of the present invention are at least as follows:

[0052] (1) To address the problem of insufficient user privacy protection, the present invention adopts a dynamic identity generation mechanism and a zero-knowledge proof protocol to avoid exposing the real identity during the authentication process and ensure user privacy security. At the same time, through a two-way authentication mechanism, the access card and the access control device mutually verify the identity to prevent counterfeit devices or man-in-the-middle attacks. This mechanism combines dynamic encryption keys with random number generation to solve the problem that static keys are easily cracked in traditional authentication methods.

[0053] (2) To solve the problem that existing behavior records lack integrity and traceability, the present invention introduces chain encryption storage technology to store the access behavior records of access control cards in a behavior chain in an unalterable manner. Each record is linked to the previous record through a hash value to ensure the integrity of the behavior data. At the same time, the behavior chain storage can be synchronized locally and in the cloud to achieve rapid tracing and abnormal analysis.

[0054] (3) In order to solve the problems of data transmission redundancy and security risks, the present invention optimizes the transmission mode of authentication information and only transmits the necessary data generated dynamically to avoid leakage of sensitive information. In addition, through the built-in anomaly detection algorithm of the access control device (such as time series analysis based on behavior patterns), abnormal card swiping behavior can be identified in real time and an alarm can be triggered, effectively improving the security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] The present invention is further described using the accompanying drawings, but the embodiments in the accompanying drawings do not constitute any limitation to the present invention. A person skilled in the art can obtain other drawings based on the following drawings without creative work.

[0056] Figure 1 The present invention is a flow chart of the information management method for access control card chips.

[0057] Figure 2 This is a framework diagram of the information management system for access control card chips of the present invention. DETAILED DESCRIPTION

[0058] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be understood as limiting the present invention.

[0059] In one or more embodiments, Figure 1 As shown, the information management for access control card chip is disclosed, and the method includes the following steps S1-S5:

[0060] S1. The access card chip receives the user identity key and timestamp, uses the SHA-256 hash function to generate a dynamic identity, and uses the hardware pseudo-random number generator in the chip to generate an authentication random number. The dynamic identity is combined with the authentication random number to form an initial authentication request. Before the initial authentication request is sent, the access card chip encrypts it using a symmetric key algorithm to obtain an encrypted authentication request. , if the encrypted authentication request If the verification is successful, jump to S2.

[0061] Specifically, the access card chip receives the user identity key and timestamp As input, used to generate dynamic identity The dynamic identity is generated using a hash function , by combining the user key and timestamp for calculation, and introducing the scene weight parameter To adapt to different authentication scenario security levels:

[0062] in, Indicates the user identity key, 128 bits, used to uniquely identify the user. Indicates the current authentication timestamp, accurate to milliseconds, used for the uniqueness of dynamic identities. Indicates the scenario weight parameter. The value is 1 in the common access control scenario and 2 or higher in the high-security access control scenario. It is used to adjust the complexity of dynamic identity. Represents the SHA-256 hash function, which is used to generate irreversible fixed-length dynamic identifiers. Represents a bitwise XOR operation, which is used to enhance the randomness of the input data.

[0063] Furthermore, the access card chip generates a random number , as the challenge data for the authentication request. The random number is generated by the hardware pseudo-random number generator (PRNG) in the chip, and the input is the user key and timestamp : in, Represents the authentication random number, ranging from [1, ], ensuring randomness and uniqueness, and used to resist replay attacks. Represents a hardware pseudo-random number generator, using and Used as a seed to generate random numbers.

[0064] Furthermore, dynamic identity and authentication random number Combined into an initial authentication request : in, Represents the initial authentication request, which is made by the dynamic identity and random numbers Composition, as input for subsequent authentication steps.

[0065] Initial authentication request The symmetric key algorithm is used to encrypt the data before sending it to ensure the security of the transmission process. The access card chip uses the device key right AES-128 encryption is performed in, Represents the device key, 128 bits, used for encrypted communication between the access card chip and the access control device. Indicates the encrypted authentication request data.

[0066] Furthermore, the access card will encrypt the authentication request Sent to the access control device, which uses the same device key Decrypt and obtain the initial authentication request After decryption, the access control device verifies the timestamp The time stamp error is usually controlled within 30 seconds. If the verification is successful, the access control device will and As input for subsequent two-way authentication steps.

[0067] Understandably, through dynamic identity and random numbers This step provides the necessary input data for subsequent authentication and passes the scene weight parameters Dynamically adapt to authentication scenarios with different security levels. This step ensures the security of data during transmission and provides basic data support for subsequent processing of behavior records.

[0068] S2: The access control device receives the encrypted initial authentication request sent by the access control card After that, the initial authentication request is encrypted using the shared device key pair Decrypt and parse out the authentication request data, i.e. the initial authentication request. The access control device generates a second random number, initiates an authentication challenge to the access control card chip, and generates an authentication response value for the access control device. The access control device combines the calculated authentication response value with the generated second random number, encrypts it with the shared device key to generate a response message, and sends the response message to the access control card chip. After receiving the response message, the access control card uses the shared device key to decrypt it, obtains the authentication response value generated by the device and the second random number of the device for two-way authentication. If the authentication response value calculated by the access control device is the same as the authentication response value calculated by the access control card, the two-way authentication verification is passed, and the authentication result is output If not, output the authentication result .

[0069] Specifically, the access control device receives the encrypted initial authentication request sent by the access control card Then, use the shared device key Decrypt it and parse out the authentication request data Here It is a dynamic identity generated by the access card. Is a random number generated by the access card. The device passes the inspection and the current timestamp The consistency of the request is confirmed to confirm whether the request is valid and avoid replay attacks. After decryption is completed, the access control device records and , providing input for subsequent authentication calculations.

[0070] Furthermore, the access control device generates a random number , used to initiate authentication challenges to access control cards. During the generation process, dynamic adjustment parameters are introduced , dynamically adjust the complexity of random number generation according to the security level of the device: in, Indicates the random number generated by the device, in the range of [1,(2^{64}-1)], used for two-way authentication; Represents the private key inside the device, ensuring that the random number is bound to the device; Represents the current device timestamp, which is used to ensure the uniqueness of the time of random number generation; Indicates a dynamically adjusted parameter, which is related to the security level of the device (1 in normal scenarios and can be set to a higher value in high-security scenarios). This is a new security enhancement item added to this patent, which is designed to adapt to the needs of different security scenarios, such as authentication requirements for general access control and high-security areas.

[0071] Furthermore, access control devices use dynamic identity , random numbers , random number generated by the device And an additional security enhancement , calculate the authentication response value of the device

[0072] : in, Indicates the authentication response value of the device; Represents a secure hash function used to generate a fixed-length response value; Represents the security enhancement item of the device, whose value can be dynamically adjusted based on real-time network security assessment (for example, increasing its randomness when abnormal traffic is detected). The design makes the authentication response more resistant to forgery and can defend against predictive attacks based on fixed inputs.

[0073] Furthermore, the device calculates the and the generated random numbers After combination, through the shared key Encryption generates response message , and send it to the access card:

[0074] in, Indicates the encrypted response message sent by the device; Represents the device key, which is used for encrypted communication. Encryption ensures the security of the authentication response during transmission to prevent eavesdropping and tampering.

[0075] Furthermore, the access card verification device responds and completes the two-way authentication:

[0076] The access card receives the encrypted response message After that, use Decrypt and obtain the response value generated by the device and the random number of the device . The access card combines your own input value , and decrypted , calculate its own response value : in, Indicates the response value calculated by the access card, which is used to verify the identity of the device; Indicates the security enhancement items of the access card, which is different from the device side Corresponding to ensure data consistency and anti-attack in two-way authentication. And the decrypted Compare: If , authentication successful, two-way identity authentication completed, authentication result Output and pass to the next step.

[0077] S3. The access control device generates a complete encrypted behavior record and establishes a chain hash structure based on the authentication result and challenge data, and stores the chain hash structure locally to build a local chain storage structure, wherein the encrypted behavior record includes a behavior feature tag, and the chain hash structure includes an authentication module and a chain hash value. At the same time, it is determined whether synchronization to the server is required based on the characteristics of the behavior; the local chain storage structure is stored in a behavior chain data structure to achieve an unalterable time chain.

[0078] Specifically, after the two-way authentication is completed, the access control device receives the output from step 2, including the dynamic identity , random numbers and , Certification results , and security enhancements and The device uses this data as a basis, combined with the timestamp of the behavior , build the current behavior record :

[0079] in, It indicates a record of behavior; Represents a behavioral feature marker, which is used to identify the uniqueness of the behavior (such as the device's geographic location or network status); understandably, by introducing ,The behavior record structure can adapt to different access control scenarios, ,especially complex scenarios (such as dynamic device states or ,multi-device collaboration), and provide additional information dimensions for ,subsequent behavior chain storage.

[0080] Furthermore, the access control equipment Encryption and hashing are performed to build a secure behavior chain: Encrypted behavior records ensure the privacy of data during local storage and transmission:

[0081] in It is the device key used to encrypt behavior records.

[0082] Generate chained hash values ​​based on encrypted records , link the behavior record to the previous record:

[0083] in, Represents the chained hash value of the current record; Indicates the hash value of the previous record; Represents the chain random perturbation term, which is dynamically generated and used to further enhance the unpredictability of the chain. By dynamically perturbing the chain hash structure, malicious tampering or hash collision attacks can be prevented.

[0084] Furthermore, after the behavior chain is generated, the device will and Stored locally, and determine whether to synchronize to the server based on the characteristics of the behavior: Normal behavior: only stored locally on the device to reduce the load on the server; Abnormal behavior (such as or Device status marked in is abnormal): The records are encrypted and uploaded to the server for centralized audit and backup.

[0085] Furthermore, the behavior chain stored in the server maintains consistency with the local chain of the device for data integrity verification and remote traceability.

[0086] Furthermore, to ensure the integrity and security of the behavior chain, the device generates a new Then, compare it with the locally stored To verify:

[0087] If the verification fails, the device triggers an alarm, marks the current record as abnormal and synchronizes it to the server. Chain verification mechanism combined with random perturbation term The reliability of tampering detection is improved, which is suitable for behavior chain management needs in high-security scenarios.

[0088] S4. The access control device stores the authentication module and chain hash value of normal behavior and successful two-way authentication as a local chain structure, encrypts the authentication module and chain hash value of abnormal behavior or two-way authentication failure through an asymmetric encryption algorithm and sends them to the server. At the same time, chain verification is performed on the access control device and the server regularly to ensure the consistency of the local chain and the cloud chain.

[0089] Specifically, the access control device receives data from the behavior chain module in step S3, including the encrypted behavior record , chained hash value and behavioral signatures In addition, the dynamic identity passed from the authentication module , random numbers , and security enhancements , Extract additional contextual information.

[0090] if Marked as normal status and authentication result , data is stored locally on the device first; if Contains abnormal markers (such as abnormal device status or timestamp offset), or , then synchronized to the cloud for centralized auditing and backup. This logic ensures that the system dynamically adjusts storage strategies according to scenarios, optimizes device resources, and meets high security requirements.

[0091] Furthermore, the access control device will and Stored as a chain structure to ensure the integrity of the behavior record: Behavior chain data structure: Records are timestamped For index, by chaining hash values Perform sequential linking, each record stores and , realizing an unalterable time chain.

[0092] Dynamic weight adjustment: In order to further improve the flexibility and anti-attack ability of the chain, dynamic weight parameters are introduced , combined with behavioral characteristics Fix the hash calculation in the chain:

[0093] in, ,in is the adjustment coefficient inside the device, Feature markers; dynamic weights Dynamically adjust the chain connection method according to behavioral characteristics to improve the chain's adaptability to diverse scenarios.

[0094] Furthermore, for abnormal records that need to be uploaded, the device will and Encrypted by an asymmetric encryption algorithm and sent to the server:

[0095] in, Indicates the data packet uploaded to the cloud; Indicates an asymmetric encryption algorithm, using the server's public key encryption; Indicates the server public key.

[0096] Furthermore, the data synchronized with the cloud is stored in a distributed database, and the server maintains a behavior chain consistent with the device, while verifying the integrity of the received chain to ensure that the data uploaded by the device has not been tampered with.

[0097] Furthermore, to ensure the consistency of the local chain and the cloud chain, the device and the server regularly perform chain verification: the device extracts the latest local chain hash value , and sends it to the server; the server extracts the corresponding hash value it stores , for comparison:

[0098] If the verification fails, the device obtains the complete chain segment data from the server and resynchronizes; if successful, the local chain index is updated.

[0099] Furthermore, to achieve efficient chain operations (such as query, insertion, and verification), the device establishes dual indexes in the local chain:

[0100] Time index: store behavior records by time segment to support quick positioning;

[0101] Hash index: maintains each record The mapping between it and its chained context is used to quickly detect tampering points. The dual index design optimizes the performance of storage operations, suitable for resource-constrained devices, while supporting fast auditing and synchronization in the cloud.

[0102] S5. The access control device receives the authentication module and chain hash, and decrypts the behavior record to extract the authentication and construct the behavior feature vector. At the same time, it verifies whether the current behavior chain remains intact through chain verification. If the chain verification fails, the device marks the current chain as abnormal and synchronizes the abnormal data to the cloud for audit. For the behavior records that pass the chain verification, the access control device uses the adaptive anomaly detection model to calculate the anomaly score and output the anomaly score. If the anomaly score is greater than the preset threshold, the current behavior is judged to be abnormal. The device records the anomaly and triggers further tracing process. When abnormal behavior is detected, the device analyzes the context of the abnormal record through the behavior chain backtracking. If the distance between the feature vector of the context and the behavior feature vector exceeds the preset threshold, the current abnormal behavior is considered to be a chain-related anomaly. The device records the complete chain fragment and uploads it to the server for centralized auditing.

[0103] Specifically, the access control device receives the encrypted behavior record from the behavior chain module in step S4 and chained hash values , and decrypt the behavior record to extract authentication and behavior feature data. After decryption, the behavior record data is obtained

[0104] The extracted behavioral feature vector is constructed as:

[0105] in, represents the behavioral feature vector; Represents the weighted combination result of behavioral characteristics, calculated by the following formula: in, Indicates feature weight, reflecting the importance of different behavioral features; The specific component representing the behavior characteristics comes from the decrypted The feature weighting is designed by dynamically adjusting Emphasize important features (such as unusual certification marks and reinforcement ), making subsequent anomaly detection more targeted.

[0106] Furthermore, consistency verification of the behavior chain is the basis for anomaly detection. The access control device verifies whether the current behavior chain remains intact:

[0107] in, Represents dynamic weights, combined with behavioral characteristics Adjust the calculation of hash value; The chain hash value of the previous record is used to link the chain. If the chain verification fails, the device marks the current chain as abnormal and synchronizes the abnormal data to the cloud for audit. The verification mechanism ensures the integrity of the behavior chain and provides trusted input for abnormal behavior detection.

[0108] Furthermore, for the behavior records that pass the chain verification, the device uses the Adaptive Behavior Anomaly Detection (ABAD) model to calculate the anomaly score. :

[0109] in, A function that represents the deviation of the behavioral feature from the baseline; represents the time-dependent correction term, which is used to deal with the dynamic changes of behavior; It represents the normal mode based on historical behavior statistics and represents the behavioral reference standard of the system. Deviation function The calculation of is based on the following formula:

[0110] if , the current behavior is judged as abnormal, the device records the abnormality and triggers further tracing process.

[0111] Furthermore, when abnormal behavior is detected, the device traces back and analyzes the context of the abnormal record through the behavior chain: extract the current abnormal record and its adjacent chain records and ; Calculate the distance between the feature vectors of these records and find the associated features of abnormal behavior:

[0112] if Beyond the preset threshold, abnormal behavior is considered a chain-related anomaly, and the device records the complete chain fragment and uploads it to the server for centralized auditing.

[0113] In one or more embodiments, Figure 2 As shown, an information management system for access card chips is disclosed, the system includes: an access card chip unit 101, which is used to receive a user identity key and a timestamp, generate a dynamic identity using a SHA-256 hash function, and generate an authentication random number using a hardware pseudo-random number generator in the chip, and combine the dynamic identity with the authentication random number to form an initial authentication request. Before the initial authentication request is sent, the access card chip is encrypted by a symmetric key algorithm to obtain an encrypted authentication request , if the encrypted authentication request If the verification is successful, jump to S2; instruction encryption unit 102, used for the access control device to receive the encrypted initial authentication request sent by the access control card After that, the initial authentication request is encrypted using the shared device key pair Decrypt and parse out the authentication request data, i.e. the initial authentication request. The access control device generates a second random number, initiates an authentication challenge to the access control card chip, and generates an authentication response value for the access control device. The access control device combines the calculated authentication response value with the generated second random number, encrypts it with the shared device key to generate a response message, and sends the response message to the access control card chip. After receiving the response message, the access control card uses the shared device key to decrypt it, obtains the authentication response value generated by the device and the second random number of the device for two-way authentication. If the authentication response value calculated by the access control device is the same as the authentication response value calculated by the access control card, the two-way authentication verification is passed, and the authentication result is output If not, output the authentication result ; Instruction chain storage unit 103, used for the access control device to generate a complete encrypted behavior record and establish a chain hash structure according to the result and challenge data generated by the authentication, and store the chain hash structure locally to build a local chain storage structure, wherein the encrypted behavior record includes a behavior feature mark, and the chain hash structure includes an authentication module and a chain hash value, and at the same time, determines whether it needs to be synchronized to the server according to the characteristics of the behavior: the local chain storage structure is stored in a behavior chain data structure to achieve an unalterable time chain; if it is normal behavior and the two-way authentication is successful, it is stored locally on the device; if it is abnormal behavior or the two-way authentication fails, the record is encrypted and uploaded to the server for centralized audit and backup; the two-way authentication unit 104, used for the access control device to store the authentication module and chain hash value of normal behavior and successful two-way authentication as a local chain structure, and encrypt the authentication module and chain hash value of abnormal behavior or two-way authentication failure through an asymmetric encryption algorithm and send them to The server also regularly performs chain verification on the access control device and the server to ensure the consistency of the local chain and the cloud chain; the abnormal tracing unit 105 is used for the access control device to receive the authentication module and the chain hash, and decrypt the behavior record to extract the authentication and construct the behavior feature vector, and verify whether the current behavior chain remains intact through chain verification. If the chain verification fails, the device marks the current chain as abnormal and synchronizes the abnormal data to the cloud for audit. For the behavior records that pass the chain verification, the access control device uses an adaptive anomaly detection model to calculate the abnormal score and output the abnormal score. If the abnormal score is greater than the preset threshold, the current behavior is judged to be abnormal, the device records the abnormality and triggers a further tracing process. When abnormal behavior is detected, the device analyzes the context of the abnormal record through the behavior chain backtracking. If the distance between the context feature vector and the behavior feature vector exceeds the preset threshold, the current abnormal behavior is considered to be a chain-related abnormality. The device records the complete chain fragment and uploads it to the server for centralized auditing.

[0114] It is worth noting that the specific workflow of the information management system for access control card chips provided in the embodiment of the present invention is the same as the workflow of the information management method for access control card chips described in the above embodiment, and will not be repeated here.

[0115] Compared with the prior art, the information management system for access card chips provided by the embodiment of the present invention receives the user identity key and timestamp, generates a dynamic identity using the SHA-256 hash function, and generates an authentication random number using the hardware pseudo-random number generator in the chip. The dynamic identity is combined with the authentication random number to form an initial authentication request. Before the initial authentication request is sent, the access card chip is encrypted by a symmetric key algorithm to obtain an encrypted authentication request. , if the encrypted authentication request Verification passed; the access control device receives the encrypted initial authentication request sent by the access control card After that, the initial authentication request is encrypted using the shared device key pair Decrypt and parse out the authentication request data, i.e. the initial authentication request. The access control device generates a second random number, initiates an authentication challenge to the access control card chip, and generates an authentication response value for the access control device. The access control device combines the calculated authentication response value with the generated second random number, encrypts it with the shared device key to generate a response message, and sends the response message to the access control card chip. After receiving the response message, the access control card uses the shared device key to decrypt it, obtains the authentication response value generated by the device and the second random number of the device for two-way authentication. If the authentication response value calculated by the access control device is the same as the authentication response value calculated by the access control card, the two-way authentication verification is passed, and the authentication result is output If not, output the authentication result ; The access control device generates a complete encrypted behavior record and establishes a chain hash structure based on the authentication result and challenge data, and stores the chain hash structure locally to build a local chain storage structure, wherein the encrypted behavior record includes a behavior feature tag, the chain hash structure includes an authentication module and a chain hash value, and the local chain storage structure is stored in a behavior chain data structure to achieve an unalterable time chain, and at the same time, determines whether it needs to be synchronized to the server based on the characteristics of the behavior: if it is normal behavior and the two-way authentication is successful, it is stored locally on the device; if it is abnormal behavior or the two-way authentication fails, the record is encrypted and uploaded to the server for centralized audit and backup; the access control device stores the authentication module and chain hash value of normal behavior and successful two-way authentication as a local chain structure, encrypts the authentication module and chain hash value of abnormal behavior or failed two-way authentication through an asymmetric encryption algorithm and sends them to the server, and at the same time determines Chain verification is performed on the access control device and the server to ensure the consistency of the local chain and the cloud chain; the access control device receives the authentication module and chain hash, and decrypts the behavior record to extract the authentication and construct the behavior feature vector. At the same time, the chain verification is used to verify whether the current behavior chain remains intact. If the chain verification fails, the device marks the current chain as abnormal and synchronizes the abnormal data to the cloud for audit. For the behavior records that pass the chain verification, the access control device uses the adaptive anomaly detection model to calculate the anomaly score and output the anomaly score. If the anomaly score is greater than the preset threshold, the current behavior is judged to be abnormal, the device records the anomaly and triggers further tracing process. When abnormal behavior is detected, the device analyzes the context of the abnormal record through the behavior chain backtracking. If the distance between the context feature vector and the behavior feature vector exceeds the preset threshold, the current abnormal behavior is considered to be a chain-related anomaly. The device records the complete chain fragment and uploads it to the server for centralized auditing.

[0116] The embodiment of the present invention also provides an information management device for an access card chip, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, the steps in the above-mentioned information management method embodiment for an access card chip are implemented, such as Figure 1 or, the processor implements the functions of each module in the above-mentioned system embodiments when executing the computer program.

[0117] Exemplarily, the computer program may be divided into one or more modules, which are stored in the memory and executed by the processor to complete the present invention. The one or more modules may be a series of computer program instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program in the information management device for access control card chips.

[0118] The information management device for the access card chip can be a computing device such as a desktop computer, a notebook, a PDA, and a cloud server. The information management device for the access card chip can include, but is not limited to, a processor and a memory. Those skilled in the art can understand that the information management device for the access card chip can also include an input and output device, a network access device, a bus, etc.

[0119] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASAC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the information management device for the access card chip, and uses various interfaces and lines to connect the various parts of the entire information management device for the access card chip.

[0120] The memory can be used to store the computer program and / or module, and the processor realizes various functions of the information management device for the access card chip by running or executing the computer program and / or module stored in the memory, and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function, etc.; the data storage area can store data created according to the operation of the air-conditioning controller, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (SmartMedaaCard, SMC), a secure digital (SecureDagatal, SD) card, a flash card (FlashCard), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0121] Wherein, if the module integrated with the information management device for the access card chip is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Wherein, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form, etc. The computer-readable medium may include: any entity or device that can carry the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium, etc.

[0122] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0123] The above is a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method for managing information of an access card chip, characterized in that: The method comprises: S1. The access card chip receives the user identity key and timestamp, generates a dynamic identity using the SHA-256 hash function, and uses the hardware pseudo-random number generator in the chip to generate an authentication random number. The dynamic identity is combined with the authentication random number to form an initial authentication request. Before the initial authentication request is sent, the access card chip encrypts it using a symmetric key algorithm to obtain an encrypted authentication request C. If the encrypted authentication request C is verified, jump to S2. S2. After the access control device receives the encrypted initial authentication request C sent by the access control card, it uses the shared device key to decrypt the encrypted initial authentication request C, parses the authentication request data, i.e., the initial authentication request, and generates a second random number to initiate an authentication challenge to the access control card chip, and generates an authentication response value for the access control device. The access control device combines the calculated authentication response value with the generated second random number, encrypts it with the shared device key to generate a response message, and sends the response message to the access control card chip. After receiving the response message, the access control card uses the shared device key to decrypt it, obtains the authentication response value generated by the device and the second random number of the device for two-way authentication. If the authentication response value calculated by the access control device is the same as the authentication response value calculated by the access control card, the two-way authentication verification is passed, and the authentication result is output. If not, output the authentication result ; S3. The access control device generates a complete encrypted behavior record and establishes a chain hash structure based on the authentication result and challenge data, and stores the chain hash structure locally to build a local chain storage structure, wherein the encrypted behavior record includes a behavior feature tag, the chain hash structure includes an authentication module and a chain hash value, and the local chain storage structure is stored in a behavior chain data structure to achieve an unalterable time chain, and at the same time, determines whether it needs to be synchronized to the server based on the characteristics of the behavior: If it is normal behavior and the two-way authentication is successful, it will be stored locally on the device; if it is abnormal behavior or the two-way authentication fails, the record will be encrypted and uploaded to the server for centralized audit and backup; S4. The access control device stores the authentication module and chain hash value of normal behavior and successful two-way authentication as a local chain structure, encrypts the authentication module and chain hash value of abnormal behavior or two-way authentication failure through an asymmetric encryption algorithm and sends them to the server. At the same time, chain verification is performed on the access control device and the server regularly to ensure the consistency of the local chain and the cloud chain; S5. The access control device receives the authentication module and chain hash, and decrypts the behavior record to extract the authentication and construct the behavior feature vector. At the same time, it verifies whether the current behavior chain remains intact through chain verification. If the chain verification fails, the device marks the current chain as abnormal and synchronizes the abnormal data to the cloud for audit. For the behavior records that pass the chain verification, the access control device uses the adaptive anomaly detection model to calculate the anomaly score and output the anomaly score. If the anomaly score is greater than the preset threshold, the current behavior is judged to be abnormal. The device records the anomaly and triggers further tracing process. When abnormal behavior is detected, the device analyzes the context of the abnormal record through the behavior chain backtracking. If the distance between the feature vector of the context and the behavior feature vector exceeds the preset threshold, the current abnormal behavior is considered to be a chain-related anomaly. The device records the complete chain fragment and uploads it to the server for centralized auditing. The S4 also includes that the access control device establishes a dual index in the local chain, including a time index and a hash index; The time index stores the behavior records in time segments to support fast positioning; The hash index maintains a mapping between the chained hash value of each record and its chained context, which is used to quickly detect tampering points.

2. The information management method for access control card chip according to claim 1, characterized in that: The SHA-256 hash function is used to generate a dynamic identity , expressed as: in, Indicates the user identity key, 128 bits, used to uniquely identify the user; Indicates the current authentication timestamp, accurate to milliseconds, used for the uniqueness of dynamic identities; Indicates the scenario weight parameter. The value is 1 in the common access control scenario and 2 or higher in the high-security access control scenario. It is used to adjust the complexity of the dynamic identity. Represents the SHA-256 hash function, which is used to generate irreversible fixed-length dynamic identifiers; Represents a bitwise XOR operation, which is used to enhance the randomness of input data; The symmetric key algorithm is AES-128.

3. The information management method for access control card chip according to claim 2, characterized in that: The second random number is generated by a hardware pseudo-random number generator in the chip, and a dynamic adjustment parameter is introduced during the generation process. , dynamically adjust the complexity of random number generation according to the security level of the device, expressed as: in, Indicates the second random number generated by the device, in the range of [1,(2^{64}-1)], used for two-way authentication; Represents the private key inside the device, ensuring that the random number is bound to the device; Represents the current device timestamp, which is used to ensure the uniqueness of the time of random number generation; Indicates dynamic adjustment parameters, which are related to the security level of the device; The authentication response value of the access control device is expressed as: in, Indicates the authentication response value of the device; Represents a secure hash function used to generate a fixed-length response value; Represents the security enhancement item of the device, and its value is dynamically adjusted according to the real-time network security assessment; Indicates a dynamic identity; It is a random number for authentication; The authentication response value of the access card is expressed as: in, Indicates the response value calculated by the access card, which is used to verify the identity of the device; Indicates the security enhancement items of the access card, which is different from the device side Correspondingly, it is used to ensure data consistency and anti-attack in two-way authentication.

4. The information management method for access card chip according to claim 3 is characterized in that: The complete encryption behavior record is expressed as: in, It indicates a record of behavior; Indicates a behavioral feature marker, used to identify the uniqueness of the behavior. The timestamp indicating when the action occurred; The chain hash structure is constructed as follows: Encrypted behavior records to ensure data privacy during local storage and transmission: in, It is the shared key of the device, used to encrypt the behavior records. is the authentication module, is the encryption algorithm; And generate chained hash values ​​based on encrypted records , link the behavior record to the previous record: in, is the chained hash value of the current record; is the hash value of the previous record; is the chain random perturbation term, which is dynamically generated and used to further enhance the unpredictability of the chain; It is a bitwise XOR operation used to enhance the randomness of the input data.

5. The information management method for access control card chip according to claim 4, characterized in that: The S3 also includes, when the device generates a new Then, compare it with the locally stored Verification is performed to ensure the integrity and security of the behavior chain, expressed as: If the verification fails, the access card device triggers an alarm, marks the current record as abnormal and synchronizes it to the server.

6. The information management method for access control card chip according to claim 5, characterized in that: The access control device stores the authentication module and the chain hash value of normal behavior and successful two-way authentication as a local chain structure, including: The behavior chain data structure is recorded with a timestamp For index, by chained hash value Perform sequential linking, each record stores and ; Introducing dynamic weight parameters , combined with behavioral characteristics Fix the hash calculation in the chain: in, in is the adjustment coefficient inside the device, Feature markers; dynamic weights Dynamically adjust the chain connection mode according to behavioral characteristics to improve the chain's adaptability to diverse scenarios; The authentication module and chain hash value of the abnormal behavior or two-way authentication failure are encrypted by an asymmetric encryption algorithm and sent to the server, encrypted using the server's public key; The chain verification is performed regularly on the access control device and the server to ensure the consistency of the local chain and the cloud chain, including: The device extracts the latest local chain hash value , send it to the server; The server extracts the corresponding hash value it stores , for comparison: If the verification fails, the device obtains the complete chain segment data from the server and resynchronizes; if successful, the local chain index is updated.

7. The information management method for access control card chip according to claim 6, characterized in that: The behavior feature vector is expressed as ,in, is the behavior feature vector; is the weighted combination result of behavioral characteristics, calculated by the following formula: in, is the feature weight, which reflects the importance of different behavioral features; is the specific component of the behavioral characteristics, derived from the decrypted ; The chain verification verifies whether the current behavior chain remains intact, including: in, Dynamic weights, combined with behavioral characteristics Adjust the calculation of hash value; It is the chain hash value of the previous record, used to link the chain; The adaptive anomaly detection model is expressed as: in, A function that represents the deviation of the behavioral feature from the baseline; represents the time-dependent correction term, which is used to deal with the dynamic changes of behavior; It represents the normal mode based on historical behavior statistics and represents the behavioral reference standard of the system; Deviation function The calculation of is based on the following formula: if , the current behavior is judged as abnormal, the device records the abnormality and triggers further tracing process.

8. The information management method for access control card chip according to claim 7, characterized in that: When abnormal behavior is detected, the device analyzes the context of the abnormal record through the behavior chain back-tracing. If the distance between the feature vector of the context and the behavior feature vector exceeds the preset threshold, the current abnormal behavior is considered to be a chain-related abnormality. The device records the complete chain fragment and uploads it to the server for centralized auditing, including: Extract current exception records and its adjacent chain records and ; Calculate the distance between the feature vectors of these records , looking for correlated features of abnormal behavior: if Beyond the preset threshold, abnormal behavior is considered a chain-related anomaly, and the device records the complete chain fragment and uploads it to the server for centralized auditing.

9. An information management system for access card chips, characterized in that: The system comprises: The access card chip unit is used to receive the user identity key and timestamp, generate a dynamic identity using the SHA-256 hash function, and use the hardware pseudo-random number generator in the chip to generate an authentication random number, and combine the dynamic identity with the authentication random number to form an initial authentication request. Before the initial authentication request is sent, the access card chip encrypts the encrypted authentication request C using a symmetric key algorithm. If the encrypted authentication request C is verified, the instruction encryption unit is jumped; The instruction encryption unit is used for the access control device to decrypt the encrypted initial authentication request C sent by the access control card using the shared device key, parse out the authentication request data, i.e., the initial authentication request, after receiving the encrypted initial authentication request C sent by the access control card, the access control device generates a second random number, initiates an authentication challenge to the access control card chip, and generates an authentication response value of the access control device. The access control device combines the calculated authentication response value with the generated second random number, encrypts the generated response message using the shared device key, and sends the response message to the access control card chip. After receiving the response message, the access control card uses the shared device key to decrypt it, obtains the authentication response value generated by the device and the second random number of the device for two-way authentication. If the authentication response value calculated by the access control device is the same as the authentication response value calculated by the access control card, the two-way authentication verification is passed, and the authentication result is output If not, output the authentication result ; The instruction chain storage unit is used for the access control device to generate a complete encrypted behavior record and establish a chain hash structure according to the result and challenge data generated by the authentication, and store the chain hash structure locally to build a local chain storage structure, wherein the encrypted behavior record includes a behavior feature tag, the chain hash structure includes an authentication module and a chain hash value, and the local chain storage structure is stored in a behavior chain data structure to realize an unalterable time chain, and at the same time, it is determined whether it needs to be synchronized to the server according to the characteristics of the behavior; If it is normal behavior and the two-way authentication is successful, it will be stored locally on the device; if it is abnormal behavior or the two-way authentication fails, the record will be encrypted and uploaded to the server for centralized audit and backup; The two-way authentication unit is used for the access control device to store the authentication module and chain hash value of normal behavior and successful two-way authentication as a local chain structure, and encrypt the authentication module and chain hash value of abnormal behavior or two-way authentication failure through an asymmetric encryption algorithm and send them to the server. At the same time, the access control device and the server are regularly chained to ensure the consistency of the local chain and the cloud chain; The abnormal tracing unit is used for the access control device to receive the authentication module and chain hash, and decrypt the behavior record to extract the authentication and construct the behavior feature vector. At the same time, it verifies whether the current behavior chain remains intact through chain verification. If the chain verification fails, the device marks the current chain as abnormal and synchronizes the abnormal data to the cloud for audit. For the behavior records that pass the chain verification, the access control device uses the adaptive anomaly detection model to calculate the abnormal score and output the abnormal score. If the abnormal score is greater than the preset threshold, the current behavior is judged to be abnormal, the device records the abnormality and triggers further tracing process. When abnormal behavior is detected, the device analyzes the context of the abnormal record through behavior chain backtracking. If the distance between the feature vector of the context and the behavior feature vector exceeds the preset threshold, the current abnormal behavior is considered to be a chain-related abnormality. The device records the complete chain fragment and uploads it to the server for centralized auditing; The two-way authentication unit further includes, the access control device establishing a dual index in the local chain, including a time index and a hash index; The time index stores the behavior records in time segments to support fast positioning; The hash index maintains a mapping between the chained hash value of each record and its chained context, which is used to quickly detect tampering points.

Images