Unified access and real-time management method for multi-source heterogeneous access control devices and cards

Abstract

This invention discloses a unified access and real-time management method for multi-source heterogeneous access control devices and cards, belonging to the fields of access control and Internet of Things (IoT) technology. The real-time access gateway uses a lockless circular buffer queue to poll and receive raw access events reported by the devices. Simultaneously, a multimodal biometric feature acquisition unit is triggered at the identification station to acquire multi-view biometric samples such as iris, fingerprint, and face. These samples are associated with timestamps and card serial numbers. A multimodal feature fusion engine extracts feature vectors and matches them with registration templates. A dynamic permission topology graph is constructed by combining device health scores, generating permission decision metrics. Decision records are persisted to a database and audit logs through distributed transactions, and execution instructions are issued to the access control controller. This invention achieves unified access for multi-source heterogeneous devices, real-time fusion of multimodal credentials, and dynamic permission decision-making, significantly improving the compatibility, security, and intelligent management level of the access control system.

Description

Technical Field

[0001] This invention discloses a unified access and real-time management method for multi-source heterogeneous access control devices and cards, belonging to the field of access control and Internet of Things technology. Background Technology

[0002] With the rapid development and popularization of IoT technology, modern access control systems are no longer limited to the simple function of swiping cards to open doors. Instead, they have gradually evolved into comprehensive security platforms integrating identity recognition, security monitoring, personnel tracking, and access control. In actual deployment, access control systems face an extremely complex environment of heterogeneous devices and cards. On the one hand, there are many types of front-end devices, including card readers, biometric devices, electric lock controllers, and door magnetic sensors with different communication protocols. These devices often come from different manufacturers and use multiple interfaces such as RS485, Wiegand, and Ethernet, lacking a unified access standard. On the other hand, access credentials also exhibit diverse characteristics, including physical cards such as low-frequency ID cards, high-frequency MIFARE cards, and CPU cards, as well as biometric features such as fingerprints, faces, irises, and voiceprints, and virtual credentials such as mobile NFC and Bluetooth. This multi-source heterogeneous situation makes system integration extremely difficult, forming data silos between subsystems and making it difficult to achieve unified management and linkage control across devices and credentials.

[0003] Existing access control system solutions typically employ a method of developing separate drivers for each device and configuring separate authentication servers for each credential. This tightly coupled integration model not only has a long development cycle and high maintenance costs, but also struggles to meet the demands of device upgrades or the addition of new credential types. Furthermore, access event processing often uses a simple request-response model, which is prone to processing delays or data loss under high-concurrency scenarios. In the identity authentication stage, most systems rely solely on single-modality biometrics or card information, lacking multimodal fusion mechanisms. This limits their anti-forgery capabilities and recognition accuracy. More critically, permission decision-making mechanisms are generally based on static rules, failing to fully consider dynamic factors such as real-time personnel location, device operating status, and historical behavior patterns. This results in coarse-grained permission control, making it difficult to address internal threats and abnormal behavior. In addition, various access records are scattered across different subsystems, lacking unified audit logs and transaction guarantees, making post-event traceability and accountability difficult.

[0004] Existing technologies have significant shortcomings in handling unified access to multi-source heterogeneous access control devices and cards, real-time event processing, multimodal identity authentication, dynamic permission decision-making, and data consistency assurance. With the continuous improvement of security and intelligence requirements, there is an urgent need for a unified access and management method that can shield the differences between underlying devices, integrate multimodal credentials, perceive contextual states in real time, and make accurate permission judgments. This would improve the overall reliability, scalability, and security of access control systems and meet the security management needs of modern complex scenarios. Summary of the Invention

[0005] To achieve the above objectives, this application provides the following technical solution: A unified access and real-time management method for multi-source heterogeneous access control devices and cards includes the following steps: Step A: Encapsulate various heterogeneous access control devices into a unified device object model through a device driver adapter, and abstract various types of access control cards into a unified credential object model through a card reader / writer. Register the device object model and the credential object model to the runtime container of the real-time access gateway. Step B: Through the circular buffer queue maintained by the real-time access gateway, poll and receive the original access events reported by each access control device; Step C: At the real-time processing station, the device status information and cardholder biometrics corresponding to the original access event are read concurrently by the multimodal recognition unit. The first biometric acquisition unit is activated to collect the first biometric sample from the first position, and the second biometric acquisition unit is activated to collect the second biometric sample from the second position. During the acquisition, the environmental adaptive lighting array is activated simultaneously. Step D: Establish an association between the first biometric sample, the second biometric sample, the device identifier, and the card serial number, and store them in the temporary object storage area of ​​the distributed memory database; Step E: Retrieve the first biometric sample and the second biometric sample corresponding to the same card serial number from the distributed memory database, input them into the pre-configured multimodal feature fusion engine, and obtain the first feature vector and the second feature vector, as well as the health score of the device status information; Step F: Construct an access context graph in the dynamic permission topology space that represents the spatiotemporal location of the card holder, the device trust level, and the validity period of the permission; Step G: Based on the node attributes and edge constraints in the access context graph, calculate the card holder's real-time access permission level, multi-factor authentication fusion score, abnormal behavior deviation coefficient, and device access decision threshold. Step H: Combine each metric value with the read card serial number to form an access control decision record, write it to the distributed transaction log through the asynchronous persistence engine, and issue an execution command to the access control controller.

[0006] Furthermore, the device driver adapter mentioned in step A consists of a configuration descriptor, a communication protocol stack instance, and a state mapping table. The communication protocol stack instance dynamically loads a serial communication protocol or network communication protocol that matches the device type through a reflection mechanism. The state mapping table converts the device's native state code into a unified state enumeration value. The card reader / writer uses a radio frequency front-end module independent of the carrier frequency. The operating frequency can be switched through software configuration to adapt to low-frequency, high-frequency or ultra-high-frequency access control cards. The credential object model includes a globally unique card identifier, a card type identifier and a key derivation factor. The real-time access gateway maintains a bidirectional index between the device registry and the card registry, and the runtime container uses a non-blocking input / output model to manage the lifecycle of connection sessions.

[0007] Furthermore, step C specifically includes: C1. The multimodal recognition unit includes an iris acquisition module, a fingerprint acquisition module, and a face acquisition module, each module being installed in a preset spatial position in the access control channel; C2. When the original access events to be processed in the circular buffer queue are assigned to the worker thread by the scheduler, the worker thread sends a workstation activation instruction to the programmable logic controller. The instruction includes the device identifier and the pre-assigned workstation number in the original access event. C3. After receiving the workstation activation command, the programmable logic controller sends a concurrent acquisition trigger signal to the multimodal recognition unit. The trigger signal is transmitted in parallel to the control ports of the iris acquisition module, fingerprint acquisition module and face acquisition module through hardwiring. C4. The iris acquisition module acquires iris image sequences through near-infrared illumination, the fingerprint acquisition module acquires fingerprint ridge images through a capacitive sensor, and the face acquisition module acquires face images through a visible light complementary metal-oxide-semiconductor sensor. Each module temporarily stores the acquired raw biometric samples in an on-chip buffer memory. C5. After each acquisition module successfully acquires the data, the original biometric sample is transmitted to the shared memory area of ​​the real-time access gateway, and a module identifier and acquisition timestamp are attached to each sample. C6. The programmable logic controller collects the acquisition completion flags returned by each module, performs a logical AND operation on all flag bits, and after all modules have returned success flags, encapsulates the module identifier, acquisition timestamp, workstation number, and corresponding device identifier and card serial number into grouping metadata and writes it into the metadata descriptor table of the shared memory area. C7. If any acquisition module fails to return an acquisition completion flag within a preset timeout period, the programmable logic controller sends a reset command to the module and increments the error count, while recording the missing module information in the exception event log. C8. The real-time access gateway continuously monitors the write pointer changes of the shared memory region. When it detects that the grouped metadata has been written, it triggers a soft interrupt to notify the corresponding data association thread to read it.

[0008] Furthermore, step F specifically includes: F1. Extract the pre-constructed physical topology layer from the dynamic permission topology space, perform graph simplification operation on the physical topology layer, remove redundant connection edges, retain the backbone nodes that constitute the minimum connected dominating set, and record the device identifier, spatial coordinates and Manhattan distance between adjacent nodes of each backbone node. F2. Perform similarity matching between the first feature vector, the second feature vector and the device trust level vector of the backbone node in the physical topology layer, calculate the cosine distance between each feature vector and the device historical registration feature vector, mark the feature vector pairs with a cosine distance less than a preset matching threshold as valid identity credentials, remove outlier feature vectors with a cosine distance greater than the preset matching threshold, and sort the timestamps of the valid identity credentials along the time axis. F3. Use the sensor values ​​in the device status monitoring data corresponding to the health score as the real-time load factor of the device in the physical topology layer, and use the frequency and time distribution of the card holder's historical access patterns as the behavioral baseline factor of the card in the permission topology layer. F4. Based on the shortest path between backbone nodes in the physical topology layer and the role inheritance relationship in the permission topology layer, pre-calculate the reachability matrix and permission transfer function between each node, establish the path constraint relationship between the current node of the card holder and the target node through the reachability matrix, mark the node pairs with path distance less than the preset reachability threshold as potential access paths, and generate all feasible paths from the current node to the target node and the corresponding intermediate node sequence through the graph traversal algorithm; F5. Using the backbone nodes of the physical topology layer as anchor points for the access context, the timestamps corresponding to the valid identity credentials are used as event nodes on each anchor point. Each event node stores its device identifier, spatial coordinates, and access direction vector in the physical topology layer. The potential access path is mapped to the planar coordinate system of the physical topology layer through spatial interpolation and associated with the nearest anchor event node, forming a tree-like access context graph data structure with anchor points as vertices, paths as edges, and credentials as payloads.

[0009] Furthermore, step G specifically includes: G1. In the access context graph, extract the device trust level value of the current anchor point of the card holder and the device trust level value of the target anchor point. The trust level of the current anchor point corresponds to the real-time value of the health score, and the trust level of the target anchor point corresponds to the static value in the permission configuration table. Calculate the weighted difference between the trust level values ​​of the two endpoints, and convert the weighted difference into a dimensionless permission level score according to the pre-configured level mapping table. Output the real-time access permission level. G2. Count the number of valid identity credentials marked along the potential access path in the access context graph, exclude duplicate matches and invalid outlier feature vectors, and perform a weighted sum of the fusion matching score of the first feature vector and the second feature vector and the health score, and output the multi-factor authentication fusion score. G3. Calculate the deviation between the behavior baseline factor and the real-time load factor of all event nodes in the access context graph. Use the ratio of the behavior frequency of the current access period to the behavior frequency of the same period in history as the deviation base, and the ratio of the current device load to the rated load as the load base. Output the product of the deviation base and the load base as the abnormal behavior deviation coefficient. G4. Identify anchor points in the access context graph that have three or more inbound and outbound edges besides the first and last anchor points, determine them as multi-path convergence points, count the number of multi-path convergence points, and output the path complexity coefficient. G5. For each intermediate node sequence in the potential access path, calculate the sum of the Manhattan distances between adjacent nodes. If there are multiple feasible paths in the access context graph, determine the shortest path distance using the Dijkstra algorithm. Based on the spatial scale calibration coefficient of the physical topology layer, convert the shortest path distance into a physical length in meters and output it as a path length metric.

[0010] Furthermore, step H specifically includes: H1. Serialize the real-time access permission level, multi-factor authentication fusion score, abnormal behavior deviation coefficient, path complexity coefficient, and path length metric, and convert them into field values ​​corresponding to the relational database table structure using a binary serialization protocol; H2. Combine the serialized field values ​​with the card serial number to construct a Structured Query Language insert statement, which includes a conflict update clause; H3. Execute the structured query language insert statement through the database connection pool interface to write the permission decision record into the decision record table of the remote database server; H4. Export the combined field values ​​as comma-separated text lines, append them to the audit log file on the local network attached storage device, and then roll over the audit log file and add a cyclic redundancy checksum. H5. The real-time access gateway sends an execution instruction containing the card serial number and real-time access permission level to the access controller through a message queue. The execution instruction format adopts a binary handshake protocol, and the instruction includes forward error correction coding. The instruction that fails to be sent is automatically transferred to the retry queue, and the retry interval is exponentially backed up.

[0011] Further, step B includes: B1. The circular buffer queue is implemented using a lock-free circular queue. The queue depth is pre-configured according to the peak concurrency of the access control device. The queue head maintains a read pointer and a write pointer, which are updated through atomic variable operations. B2. The real-time access gateway concurrently polls the communication sockets of each access control device through multiple working threads. When any working thread reads the original data frame from the socket, it decapsulates the original data frame according to the state mapping table of the device driver adapter and extracts the device identifier, card serial number and timestamp. B3. Multiple proximity sensors are evenly distributed along the physical path of the circular guide rail, corresponding to the entrance area, identification area and exit area of ​​each access control channel respectively, and the sensor output terminals are connected to the digital input module of the programmable logic controller; B4. When a person carrying an access card passes by the proximity sensor, the sensor detects the presence of the person and outputs a digital level transition signal. The programmable logic controller captures the signal and records the current system timestamp as a supplementary timestamp field for the original access event. B5. The programmable logic controller determines the current workstation stage of the person passing through based on the sequence of received digital level transition signals and the physical location of the sensor, and appends the workstation stage identifier to the metadata of the original passage event and writes it to the temporary storage area of ​​shared memory. B6. If the multimodal recognition unit is in a busy state, the programmable logic controller reduces the speed of the drive motor of the annular guide rail by adjusting the duty cycle of the pulse width modulation signal.

[0012] Further, step D includes: D1. The real-time access gateway starts an independent data association thread to continuously monitor the temporary buffer of shared memory in a polling manner. The polling interval is set through the configuration file. D2. When the first biometric sample and the second biometric sample are written into the temporary buffer, the data association thread reads the biometric sample pair and the corresponding first collection timestamp, second collection timestamp, shared memory start address and data length, and locks the biometric sample data; D3. The data association thread initiates an identity query request to the programmable logic controller, which is encapsulated in an industrial Ethernet message format and includes the union information of the first collection timestamp and the second collection timestamp, as well as the request sequence number. D4. The programmable logic controller searches its internal register array based on the first and second acquisition timestamps to find the identification station trigger event record that precisely matches the timestamp, including the card serial number, the identification station number, and the counter count value of the trigger event; D5. The programmable logic controller encapsulates the found card serial number and workstation number into a response message, the response message containing the original request serial number, and returns it to the data association thread of the real-time access gateway via industrial Ethernet; D6. After receiving the response message, the data association thread parses out the card serial number and workstation number, uses the card serial number as the primary key, and uses the first collection timestamp, the second collection timestamp, the workstation number, and the shared memory start address as attribute fields. Together with the Uniform Resource Identifier of the first biometric sample and the second biometric sample in the distributed file system, these are written into the metadata index table of the distributed key-value storage system. D7. After successfully writing to the metadata index table, the data association thread sends a release instruction to the shared memory, clears the processed first biometric sample and second biometric sample data in the temporary cache through atomic operations, and decrements the reference count of the current cache. D8. If the data association thread does not receive a response message from the programmable logic controller within a preset timeout threshold, the first biometric sample and the second biometric sample are marked as orphan data and transferred to the abnormal data queue.

[0013] Further, step E includes: E1. The pre-configured multimodal feature fusion engine includes a feature extraction pipeline, which consists of multiple cascaded feature processors. Each processor performs calculations for a specific biometric modality. The first biometric sample is output as a first feature vector by the iris feature processor, and the second biometric sample is output as a second feature vector by the face feature processor. E2. The device status information includes the communication round-trip time of the access controller, the drive current value of the electromagnetic lock, and the signal strength indication of the card reader. The status information is periodically collected and reported by the device drive adapter. The health score is calculated by the status evaluator based on the weighted combination of the communication round-trip time, drive current value, and signal strength indication. E3. The first feature vector and the second feature vector are synchronized and calibrated by the timestamp alignment module before fusion. If the difference between the first acquisition timestamp and the second acquisition timestamp exceeds the preset synchronization tolerance, the feature vector acquired later is discarded and acquisition is retried. E4. The aligned first feature vector and the second feature vector are input to the feature concatenation unit, which connects the two vectors in sequence to generate a fused feature vector. The fused feature vector contains the dimension information and modality label of each original feature vector. E5. The fused feature vector is matched with the pre-stored registration feature template library. The matching process uses the nearest neighbor search algorithm to return the card holder identity identifier corresponding to the registration feature template with the smallest distance to the fused feature vector. E6. The health score and the matching score of the fused feature vector are input together to the decision logic unit. The decision logic unit calculates the weighted total score according to the preset weight coefficients and uses the weighted total score as the intermediate calculation result of the multi-factor authentication fusion score.

[0014] This invention discloses a unified access and real-time management method for multi-source heterogeneous access control devices and cards, belonging to the fields of access control and Internet of Things (IoT) technology. The real-time access gateway uses a lockless circular buffer queue to poll and receive raw access events reported by the devices. Simultaneously, a multimodal biometric feature acquisition unit is triggered at the identification station to acquire multi-view biometric samples such as iris, fingerprint, and face. These samples are associated with timestamps and card serial numbers. A multimodal feature fusion engine extracts feature vectors and matches them with registration templates. A dynamic permission topology graph is constructed by combining device health scores, generating permission decision metrics. Decision records are persisted to a database and audit logs through distributed transactions, and execution instructions are issued to the access control controller. This invention achieves unified access for multi-source heterogeneous devices, real-time fusion of multimodal credentials, and dynamic permission decision-making, significantly improving the compatibility, security, and intelligent management level of the access control system. Attached Figure Description

[0015] Figure 1 The flowchart illustrates a unified access and real-time management method for multi-source heterogeneous access control devices and cards, as claimed in an embodiment of the present invention. Figure 2The second flowchart is a method for unified access and real-time management of multi-source heterogeneous access control devices and cards, as claimed in an embodiment of the present invention. Figure 3 The third flowchart is a method for unified access and real-time management of multi-source heterogeneous access control devices and cards, as claimed in an embodiment of the present invention. Figure 4 The fourth flowchart is a method for unified access and real-time management of multi-source heterogeneous access control devices and cards, as claimed in an embodiment of the present invention. Detailed Implementation

[0016] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0017] The terms "first," "second," and "third" in this application are for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first," "second," or "third" may explicitly or implicitly include at least one of those features. In the description of this application, "multiple" means at least two, such as two, three, etc., unless otherwise explicitly specified. All directional indications in the embodiments of this application, such as up, down, left, right, front, back, etc., are only used to explain the relative positional relationships and movements between components in a specific orientation as shown in the accompanying drawings. If the specific orientation changes, the directional indications will change accordingly. Furthermore, the terms "including" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or devices.

[0018] References to embodiments herein mean that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a mutually exclusive, independent, or alternative embodiment. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0019] According to a first embodiment of the present invention, the present invention claims protection for a unified access and real-time management method for multi-source heterogeneous access control devices and cards, referring to... Figure 1 This includes the following steps: Step A: Encapsulate various heterogeneous access control devices into a unified device object model through a device driver adapter, and abstract various types of access control cards into a unified credential object model through a card reader / writer. Register the device object model and credential object model to the runtime container of the real-time access gateway. Step B: By polling the circular buffer queue maintained by the real-time access gateway, receive the original access events reported by each access control device. Step C: At the real-time processing station, the device status information and cardholder biometrics corresponding to the original access event are read concurrently by the multimodal recognition unit. The first biometric acquisition unit is activated to collect the first biometric sample from the first position, and the second biometric acquisition unit is activated to collect the second biometric sample from the second position. During the acquisition, the environmental adaptive lighting array is activated simultaneously. Step D: Establish an association between the first biometric sample, the second biometric sample, the device identifier, and the card serial number, and store them in the temporary object storage area of ​​the distributed memory database; Step E: Retrieve the first biometric sample and the second biometric sample corresponding to the same card serial number from the distributed memory database, input them into the pre-configured multimodal feature fusion engine, and obtain the first feature vector, the second feature vector, and the health score of the device status information; Step F: Construct an access context graph in the dynamic permission topology space that represents the spatiotemporal location of the card holder, the device trust level, and the validity period of the permission; Step G: Based on the node attributes and edge constraints in the access context graph, calculate the card holder's real-time access permission level, multi-factor authentication fusion score, abnormal behavior deviation coefficient, and device access decision threshold. Step H: Combine each metric value with the read card serial number to form an access control decision record, write it to the distributed transaction log through the asynchronous persistence engine, and issue an execution command to the access control controller.

[0020] This embodiment is based on a deployed access control management system. The system includes multiple physical access points, each equipped with various heterogeneous devices. All devices are connected to a real-time access gateway via industrial Ethernet. The gateway is deployed in a data center and equipped with a high-performance CPU, large-capacity memory, and SSD storage. The programmable logic controller (PLC) uses the S7-1500 series and is responsible for field signal acquisition and device control. The distributed in-memory database uses a Redis cluster, the distributed file system uses HDFS, and the relational database uses a MySQL cluster.

[0021] When the system starts, the real-time access gateway reads the configuration file and loads the driver adapters of all registered devices. For a certain model of card reader, its driver adapter communicates with the device via RS485 bus. The configuration descriptor includes a baud rate of 19200, 8 data bits, 1 stop bit, and no parity. The communication protocol stack instance is dynamically loaded through reflection mechanism when the gateway starts, implementing the ModbusRTU protocol, which is responsible for parsing the read card data frame into device identifier and card serial number. The state mapping table is initially empty and then updated through heartbeat. The card reader adopts a software radio architecture, and its RF front-end module supports 13.56MHz high-frequency cards. When the card is close, the reader reads the card UID and determines the card type as MIFAREClassic based on the UID prefix. The key derivation factor is a preset 16-byte key. The credential object model is encapsulated and registered to the gateway's runtime container. The container maintains a device registry hash table with the device ID as the key and the ChannelHandlerContext as the value, and a card registry key with the card UID as the value and the credential object as the value.

[0022] The gateway internally creates a lock-free circular queue of a fixed size, such as 1024. Four worker threads continuously poll for readable events of all device channels. When the card reader has data, the thread reads the raw byte stream, calls the decapsulation method of the corresponding driver adapter, and extracts the device IDR001, card serial number ABCD1234, and device timestamp 2026-03-03 10:15:30.123. At the same time, the photoelectric sensor at the entrance of the access control channel is triggered. The PLC captures the signal and records the system timestamp 10:15:30.200, with the workstation stage identified as the entrance. The PLC combines these two data into a raw access event and writes it to the tail of the circular buffer queue through shared memory. After the worker thread pushes the event into the queue, it wakes up the processing thread.

[0023] The processing thread retrieves events from the queue, determines the corresponding access point based on device IDR001, and sends a workstation activation command to the PLC of that access point. The command uses the PROFINET protocol and includes the device ID and workstation number G01. Upon receiving the command, the PLC simultaneously sends TTL high-level trigger signals to the iris, fingerprint, and face recognition modules via hardwiring. The iris module activates its near-infrared LED, continuously acquires 5 frames of images, evaluates clarity using its built-in DSP, and temporarily stores the best frame. The fingerprint module detects finger pressure, acquires a 500dpi fingerprint image, removes noise, and temporarily stores it. The face recognition module uses an environmental adaptive lighting array... The system captures facial images using an illumination array composed of 12 high-brightness LEDs. The PLC adjusts the LED brightness to a suitable level based on the illuminance value fed back by the ambient light sensor using a PID algorithm. After each module completes its acquisition, the raw image data is transmitted to the gateway's shared memory via the PCIe bus using DMA. Each data packet includes the module identifier Iris, Finger, Face, and acquisition timestamp. Once the PLC detects the completion flag for all modules, it writes the grouped metadata module identifier, acquisition timestamp, workstation number, device ID, and card serial number into the metadata descriptor table in the shared memory and triggers a soft interrupt to notify the data association thread.

[0024] The data association thread polls the shared memory. Upon detecting new metadata, it reads three biometric samples and locks the corresponding memory regions. The thread sends an identity query request to the PLC, containing the iris capture timestamp 10:15:31.050 and the face capture timestamp 10:15:31.052, along with the request sequence number 1001. The PLC's internal register array stores the most recent 1000 trigger events. When an event with a matching timestamp is found, the thread returns the card serial number ABCD1234 and the workstation number G01. After parsing, the data association thread uses the card serial number as the primary key and writes the capture timestamp, workstation number, shared memory start address, and the sample's URI in HDFS (e.g., hdfs: / / namenode / … / iris_001.jpg) into the Cassandra metadata index table. A read-write lock is used to ensure concurrency consistency. After successful writing, the thread sends a release command to the shared memory, clearing the sample data and decrementing the reference count. If no response is received from the PLC within 2 seconds, the sample is marked as orphan data and moved to the exception queue.

[0025] The multimodal feature fusion engine reads iris and face samples from HDFS. The iris feature processor segments and normalizes the iris image, extracting a 256-dimensional iris feature vector. The face feature processor aligns the face image, extracting a 128-dimensional face feature vector. Device status information is periodically collected by the gateway, including the current communication round-trip latency of 5ms, electromagnetic lock current of 300mA, and reader signal strength of -65dBm. The status evaluator calculates a health score of 92. The timestamp alignment module checks that the difference between the two collected timestamps is 2ms, which is less than the preset tolerance of 50ms, allowing fusion. The feature splicing unit connects the two vectors into a 384-dimensional fused feature vector and adds a modal label. The fused feature vector is then compared with the 1000 templates in the registered feature template library stored in HDFS using Euclidean distance. The template with the smallest distance is returned, corresponding to the identity identifier Zhang San, with a matching score of 0.85. The decision logic unit calculates a weighted total score of 88.9 by combining the health score of 92 and the matching score of 0.85 with a weight ratio of 0.3:0.7, which serves as an intermediate result for the multi-factor authentication fusion score.

[0026] The system pre-constructs a physical topology layer: all access control devices are abstracted as nodes, including device ID, spatial coordinates x, y, and static trust level (e.g., core server room nodes are level 5, ordinary office nodes are level 1). Edges represent physical connectivity, with weights based on Manhattan distance. A graph simplification algorithm preserves the minimum connected dominance set to obtain a backbone node list. The historical feature vector corresponding to the identity identifier Zhang San from step E is compared with the device trust level vector of each backbone node. Cosine distance is calculated for each node storing resident features. A match is found at node N005, Zhang San's office, with a distance of 0.12, less than the threshold of 0.2. This is marked as a valid identity credential, and a timestamp of 10:15:32 is recorded. Simultaneously, node N005's real-time load factor (CPU utilization 45%) and health score (92) are appended to the node. Zhang San's historical access data is then loaded from the database. The distribution of travel time over the past 30 days is used as a baseline factor for behavior. Based on Zhang San's current node N005 and target node N010 (Finance Department), the existence of paths is determined from the reachability matrix. Two feasible paths are generated through depth-first search: N005→N007→N010 and N005→N006→N008→N010. These two paths are mapped to the physical topology plane coordinate system and associated with the anchor point N005 to form a tree-like access context graph. The vertices in the graph store the coordinates of N005, N007, N010, etc., and the edges store the path distances.

[0027] Extract the current node N005 (trust level 92, dynamic) and the target node N010 (trust level 5, static) from the access context graph. Calculate the real-time access permission level by weighted difference. According to the level mapping table, a difference of 0-20 corresponds to level 1, 20-40 corresponds to level 2, and so on, resulting in level 3. The number of valid identity credentials is counted as 1 (only for this match). The weighted sum of the fusion matching score of 0.85 and the health score of 92 yields 88.9 as the multi-factor authentication fusion score. Calculate the abnormal behavior deviation coefficient: the historical average access frequency at 10 AM is 50 times, the current frequency is 1 time, the ratio is 0.02; the ratio of the current device load of 45% to the rated load of 50% is 0.9, the product is 0.018. Path complexity coefficient: In the path, excluding the beginning and end, node N007 has three inbound and outbound edges, counted as 1. The sum of the Manhattan distances of the shortest path N005→N007→N010 is 15 meters, converted to 1.5 meters per pixel according to the calibration coefficient of 0.1 meters per pixel.

[0028] The above metrics are serialized as follows: real-time access permission level 3, multi-factor authentication fusion score 88.9, abnormal behavior deviation coefficient 0.018, path complexity coefficient 1, and path length 1.5 meters. An SQL insert statement is constructed and written to the MySQL decision record table through the HikariCP connection pool. The table fields correspond to the serialized data. At the same time, the same data is appended to the NAS audit log file in CSV format. The file name includes the current timestamp, and a CRC32 is calculated and appended to the end of the file. An execution command is sent to the access controller IP 192.168.1.100 via RabbitMQ. The binary format of the command includes the card serial number ABCD1234 and the access permission level 3, indicating that entry is allowed. If the sending times out, the message enters the retry queue. The first retry interval is 1 second, the second is 2 seconds, the third is 4 seconds, and the maximum number of retries is 5.

[0029] Furthermore, in step A, the device driver adapter consists of a configuration descriptor, a communication protocol stack instance, and a state mapping table. The communication protocol stack instance dynamically loads a serial communication protocol or network communication protocol that matches the device type through a reflection mechanism. The state mapping table converts the device's native state code into a unified state enumeration value. The card reader / writer uses a radio frequency front-end module independent of the carrier frequency. It switches the operating frequency through software configuration to adapt to low-frequency, high-frequency or ultra-high-frequency access control cards. The credential object model includes a globally unique card identifier, a card type identifier, and a key derivation factor. The gateway maintains a bidirectional index of the device registry and card registry in real time, and the runtime container uses a non-blocking input / output model to manage the lifecycle of connection sessions.

[0030] In this embodiment, the configuration descriptor of the device driver adapter is stored as an XML file in the gateway configuration file directory. Taking a certain model of fingerprint scanner as an example, its descriptor includes communication parameters: baud rate 115200, 8 data bits, 1 stop bit, no parity; protocol type is a custom binary protocol; status mapping definition: device returns 0x00 to indicate normal operation, 0x01 to indicate sensor dirt, and 0x02 to indicate no finger. The communication protocol stack instance is dynamically loaded through the Java class loader. This stack implements the SerialPortEventListener interface and is responsible for opening the serial port, configuring parameters, sending commands, and receiving data. After the received raw data frame is parsed, the device's native status code is converted into a unified status enumeration, such as DEVICE_OK, DEVICE_DIRTY, and DEVICE_NO_FINGER. The status mapping table is a ConcurrentHashMap in memory, with the device ID as the key and the latest status enumeration and timestamp as the value. The gateway sends a heartbeat command to all devices every 30 seconds via a scheduled task to update the status table.

[0031] The card reader / writer uses the ADF7021 RF chip, supporting software configuration of the center frequency. Upon system startup, based on access control point requirements, a configuration register is written to the chip via the SPI interface, setting the operating frequency to 13.56MHz. For low-frequency cards (125kHz), the register is reconfigured to change the frequency. Card type identification is based on the length and starting byte of the UID: if the UID length is 4 bytes and the first byte is 0x08, it is identified as a MIFAREClassic; if the UID length is 7 bytes and the first byte is 0x03, it is identified as a CPU card. The key derivation factor is obtained from the secure storage area based on the card type. MIFAREClassic uses a fixed 16-byte key, while CPU cards use a distributed algorithm. The credential object model consists of a hexadecimal string of the card UID, a card type enumeration value, and a key derivation factor byte array, registered in the gateway's card registry Redis hash structure. The runtime container is based on Netty, with each device connection corresponding to a NioSocketChannel. The gateway maintains the device registry (device ID -> Channel) and the card registry (card UID -> credential object), providing a query interface for other modules to call.

[0032] Furthermore, referring to Figure 2 Step C specifically includes: C1. The multimodal recognition unit includes an iris acquisition module, a fingerprint acquisition module, and a face acquisition module, each module being installed in a preset spatial location in the access control channel; C2. When the original access events pending processing in the circular buffer queue are assigned to the worker thread by the scheduler, the worker thread sends a station activation instruction to the programmable logic controller. The instruction contains the device identifier and the pre-assigned station number from the original access event. C3. After receiving the workstation activation command, the programmable logic controller sends a concurrent acquisition trigger signal to the multimodal recognition unit. The trigger signal is transmitted in parallel to the control ports of the iris acquisition module, fingerprint acquisition module and face acquisition module through hard wiring. C4. The iris acquisition module acquires iris image sequences through near-infrared illumination, the fingerprint acquisition module acquires fingerprint ridge images through a capacitive sensor, and the face acquisition module acquires face images through a visible light complementary metal-oxide-semiconductor sensor. Each module temporarily stores the acquired raw biometric samples in an on-chip buffer memory. C5. After each acquisition module successfully acquires the data, it transmits the original biometric sample to the shared memory area of ​​the real-time access gateway and adds a module identifier and acquisition timestamp to each sample. C6. The programmable logic controller collects the acquisition completion flags returned by each module, performs a logical AND operation on all flag bits, and after all modules have returned success flags, encapsulates the module identifier, acquisition timestamp, workstation number, and corresponding device identifier and card serial number into grouping metadata and writes it into the metadata descriptor table in the shared memory area. C7. If any acquisition module fails to return the acquisition completion flag within the preset timeout period, the programmable logic controller sends a reset command to the module and increments the error count, while recording the missing module information in the exception event log. C8. The real-time access gateway continuously monitors changes in the write pointer of the shared memory area. When it detects that the grouped metadata has been written, it triggers a soft interrupt to notify the corresponding data association thread to read it.

[0033] In this embodiment, the multimodal recognition unit is installed in the access control channel, with the following specific layout: the iris recognition module is installed on the right side wall of the channel at a height of 1.5 meters, with the lens optical axis parallel to the ground and at a 45-degree angle to the direction of passage, ensuring that the eyes of the person standing are within a depth of field of 20-40cm; the fingerprint recognition module is embedded in the handrail panel, with a surface covered with an anti-fouling coating; and the face recognition module uses a Baslerac A1300-60gc industrial camera, installed directly in front of the channel at a distance of 1 meter from the standing position, with the lens optical axis perpendicular to the channel direction, covering the entire standing area.

[0034] When the PLC receives the station activation command, it outputs three TTL high-level pulses via hardwiring, which are connected to the trigger input terminals of each module respectively. The pulse width is 10ms to ensure that each module starts synchronously. After the iris module starts, the built-in near-infrared LED array with a wavelength of 850nm lights up and continuously acquires 5 frames of images, each with a resolution of 640x480. The FPGA embedded in the module calculates the contrast and sharpness of each frame and selects the frame with the highest contrast to store in the on-chip 4MB cache. After the fingerprint module starts, the capacitive sensor scans at a rate of 50fps. When a finger touch is detected, a single frame of 500dpi image is acquired, and after being processed by Gaussian filtering and histogram equalization algorithms, it is stored in the cache. When the face module starts, the PLC simultaneously adjusts the lighting array: the ambient light sensor TSL2561 detects the current illuminance as 200 lux, and the PLC calculates the target brightness through a PID algorithm and outputs a PWM signal to drive 12 LEDs to stabilize the illuminance at 400 lux after supplemental lighting. The face module captures data at 30fps. When a face is detected by the built-in face detection algorithm, it automatically focuses and captures a 1920x1080 image frame, which is then stored in the cache.

[0035] After each module completes data acquisition, it transmits the data to the gateway's shared memory via the PCIe bus using DMA. Each module corresponds to a DMA buffer. The buffer header contains the module ID (0x01 iris), (0x02 fingerprint), (0x03 face), the acquisition timestamp synchronized by the PLC using IRIG-B code, and the data length. The gateway's shared memory is divided into multiple fixed-size blocks, each 4MB, managed using a circular buffer. After the DMA controller writes the data to an empty block, it updates the write pointer.

[0036] The PLC continuously monitors the completion signals of each module. The iris module outputs a high level upon completion, the fingerprint module outputs a low level, and the face module outputs a TTL pulse. The PLC reads these signals through the digital input module and performs logical AND operations. When all three signals are high, it indicates success. The PLC writes the grouped metadata module ID list, each acquisition timestamp, workstation number G01, device IDR001, and card serial number ABCD1234 into the shared memory metadata descriptor table. If any signal times out before the preset timeout period of 200ms, the PLC sends a reset command to that module via RS232, increments the error count, and records the abnormal event in the PLC's internal log. Other successfully acquired samples continue to the subsequent process, but missing module information in the metadata is filled with 0xFF.

[0037] The gateway's data association thread monitors changes in the shared memory write pointer. When the write pointer moves, it reads the metadata descriptor table and triggers subsequent processing.

[0038] Furthermore, referring to Figure 3 Step F specifically includes: F1. Extract the pre-built physical topology layer from the dynamic permission topology space, perform graph simplification operation on the physical topology layer, remove redundant connection edges, retain the backbone nodes that constitute the minimum connected dominating set, and record the device identifier, spatial coordinates and Manhattan distance between adjacent nodes of each backbone node. F2. Perform similarity matching between the first feature vector, the second feature vector and the device trust level vector of the backbone node in the physical topology layer, calculate the cosine distance between each feature vector and the device historical registration feature vector, mark the feature vector pairs with a cosine distance less than the preset matching threshold as valid identity credentials, remove outlier feature vectors with a cosine distance greater than the preset matching threshold, and sort the timestamps of the valid identity credentials along the time axis. F3. Use the sensor values ​​in the device status monitoring data corresponding to the health score as the real-time load factor of the device in the physical topology layer, and use the frequency and time distribution of the card holder's historical access patterns as the behavioral baseline factor of the card in the permission topology layer. F4. Based on the shortest path between backbone nodes in the physical topology layer and the role inheritance relationship in the permission topology layer, pre-calculate the reachability matrix and permission transfer function between each node. Establish the path constraint relationship between the current node of the card holder and the target node through the reachability matrix. Mark the node pairs with path distance less than the preset reachability threshold as potential access paths. Generate all feasible paths from the current node to the target node and the corresponding intermediate node sequence through the graph traversal algorithm. F5. Using the backbone nodes of the physical topology layer as anchor points for the access context, the timestamps corresponding to valid identity credentials are used as event nodes on each anchor point. Each event node stores its device identifier, spatial coordinates, and access direction vector in the physical topology layer. Potential access paths are mapped to the planar coordinate system of the physical topology layer through spatial interpolation and associated with the nearest anchor event node, forming a tree-like access context graph data structure with anchor points as vertices, paths as edges, and credentials as payloads.

[0039] In this embodiment, a physical topology layer is pre-constructed: all access control device nodes are stored in the Neo4j graph database. Each node has the following attributes: device_id (string), x_coord (floating-point number), y_coord (floating-point number), trust_level (integer, 0-10), edge records of source and target node IDs, and weight (Manhattan distance). Graph simplification operation: the minimum connected dominating set algorithm is run to retain key nodes such as all access control points with card readers, and delete pure path nodes such as the midpoint of a corridor, resulting in a backbone node list. For example, if there are 50 access control points on three floors, 30 backbone nodes are retained after simplification.

[0040] The first feature vector (iris, 256 dimensions) and the second feature vector (face, 128 dimensions) obtained from step E are used. Each backbone node pre-stores the registration feature vectors of resident personnel, with a maximum of 10 per node. The cosine distance between the current feature vector and the stored vectors of each node is calculated to obtain the matching degree. For example, the distance between the Zhang San vector and node N005 is 0.12, which is less than the threshold of 0.2, and it is marked as a valid identity credential. The timestamp of the credential's appearance is recorded as 10:15:32. At the same time, the device trust level vector of node N005 includes a static level of 5 and a dynamic health score of 92. The score of 92 is attached as the real-time trust level. The node load factor is taken from the device status monitoring: the current CPU utilization is 45%, memory usage is 30%, and network latency is 5ms, which is combined to form a load factor of 0.45.

[0041] Load Zhang San's historical access patterns from MySQL: Over the past 30 days, the average number of accesses at 10 AM each day was 50, with a standard deviation of 10, serving as the frequency distribution of the behavioral baseline factor. Real-time access count: The current hour's access count is 1.

[0042] Given the coordinates of the current node N005 (10, 20) and the target node N010 (50, 60), query the graph database for the reachability of all node pairs pre-calculated using the reachability matrix. The matrix displays reachability. Run a depth-first search algorithm, starting from N005, traversing along the edges and recording the paths to all unique nodes. This yields two paths: Path A: N005 → N007 → N010 (total distance Manhattan sum 15 meters), and Path B: N005 → N006 → N008 → N010 (total distance Manhattan sum 25 meters). Save the node sequence for each path.

[0043] The path is mapped through spatial interpolation: In the planar coordinate system, the coordinates of each node on the path are connected into a polyline. Interpolation points are set every 0.5 meters between adjacent nodes. These interpolation points are associated with the nearest anchor event node, i.e., the current node N005, forming a graph structure: vertices include N005, N007, N010, etc., and edges are polyline segments. The tree-like access context graph is rooted at N005, with child nodes N007, N006, and further child nodes N010, N008, etc. Each vertex stores coordinates and a unit vector pointing from the parent node to the current node.

[0044] Furthermore, referring to Figure 4 Step G specifically includes: G1. In the access context graph, extract the device trust level value of the current anchor point of the card holder and the device trust level value of the target anchor point. The trust level of the current anchor point corresponds to the real-time value of the health score, and the trust level of the target anchor point corresponds to the static value in the permission configuration table. Calculate the weighted difference between the trust level values ​​of the two ends, convert the weighted difference into a dimensionless permission level score according to the pre-configured level mapping table, and output the real-time access permission level. G2. Count the number of valid identity credentials marked along potential access paths in the access context graph, exclude duplicate matches and invalid outlier feature vectors, and perform a weighted sum of the fusion matching score of the first feature vector and the second feature vector and the health score, and output the multi-factor authentication fusion score. G3. Statistically analyze the deviation of the behavior baseline factor and the real-time load factor of all event nodes in the access context graph. Use the ratio of the behavior frequency of the current access period to the behavior frequency of the same period in history as the deviation base, and the ratio of the current device load to the rated load as the load base. Output the product of the deviation base and the load base as the abnormal behavior deviation coefficient. G4. Identify anchor points in the access context graph that have three or more inbound and outbound edges (excluding the first and last anchor points), determine them as multi-path convergence points, count the number of multi-path convergence points, and output the path complexity coefficient. G5. For each intermediate node sequence in a potential access path, calculate the sum of Manhattan distances between adjacent nodes. If there are multiple feasible paths in the access context graph, determine the shortest path distance using the Dijkstra algorithm. Based on the spatial scale calibration coefficient of the physical topology layer, convert the shortest path distance into a physical length in meters and output it as a path length metric.

[0045] In this embodiment, the trust level value of the current node N005 is obtained from the access context graph: a real-time trust level of 92 (health score), and the static trust level of the target node N010 is a preset 5. The weighted difference is calculated: the weight coefficient is dynamically adjusted according to time, with a weight of 0.3 during the day (6:00-18:00) and 0.7 at night. The current time is 10:15, which is daytime, with a weight of 0.3. The weighted difference = (92-5)*0.3 = 26.1. According to the level mapping table: 0-20 corresponds to level 1, 20-40 to level 2, 40-60 to level 3, 60-80 to level 4, and 80-100 to level 5. 26.1 falls within the 20-40 range, mapping to level 2, therefore the real-time access permission level output is 2.

[0046] Count the number of valid identity credentials: Starting from the root node in the diagram, search for all marked valid identity credentials along the path. Currently, only the root node N005 has one credential that matches this time, so the count is 1.

[0047] Multi-factor authentication fusion score: The fusion matching score of 0.85 and the health score of 92 are weighted and summed, with weights of 0.7 and 0.3 respectively. The score is 0.85*0.7+92*0.3=0.595+27.6=28.195, approximately 28.2.

[0048] Abnormal behavior deviation coefficient: The historical average passage frequency during the current period (10:00-11:00) is 50 times, and the real-time frequency is 1 time. Deviation base = real-time / historical = 1 / 50 = 0.02. The ratio of the current node load factor (0.45) to the rated load factor (0.5) is load base = 0.45 / 0.5 = 0.9. The product = 0.02 * 0.9 = 0.018.

[0049] Path complexity coefficient: Traverse the intermediate nodes on the path and count the number of incoming and outgoing edges for each node. Node N007 has three edges connecting N005, N010, and N009 in the graph, so it is a multi-path convergence point and is counted as 1. Node N006 has only two edges and is not counted. The total number is 1.

[0050] Shortest path distance: Calculate the Manhattan distance for feasible paths: Distances of each segment of path A: Manhattan distance from N005 to N007 |20-10|+|30-20|=10+10=20 meters. Assuming the actual coordinates are N005(10,20), N007(20,30), N010(50,60), then the distance from N005 to N007 is 20, the distance from N007 to N010 is 50, and the total is 70. However, according to the calibration coefficient, each coordinate unit represents 0.1 meters in reality, so the actual length of path A is 7 meters. Path B: Distance from N005(10,20) to N006(15,25) is 10, the distance from N006 to N008(30,40) is 20, the distance from N008 to N010(50,60) is 30, and the total is 60 coordinate units, which is 6 meters. The shortest path is B, with a distance of 6 meters. The output path length is 6 meters.

[0051] Furthermore, step H specifically includes: H1. Serialize the real-time access permission level, multi-factor authentication fusion score, abnormal behavior deviation coefficient, path complexity coefficient, and path length metric, and convert them into field values ​​corresponding to the relational database table structure using a binary serialization protocol; H2. Combine the serialized field values ​​with the card serial number to construct a Structured Query Language insert statement, which includes a conflict update clause; H3. Execute a Structured Query Language insert statement through the database connection pool interface to write the permission decision record into the decision record table of the remote database server; H4. Export the combined field values ​​as comma-separated text lines, append them to the audit log file on the local network attached storage device, and then roll over the audit log file and add a cyclic redundancy checksum. H5. The real-time access gateway sends execution instructions containing card serial numbers and real-time access permission levels to the access controller through a message queue. The execution instruction format adopts a binary handshake protocol and includes forward error correction coding. Failed instructions are automatically transferred to the retry queue, and the retry interval exhibits exponential backoff.

[0052] Further, step B includes: B1. The circular buffer queue is implemented using a lock-free circular queue. The queue depth is pre-configured according to the peak concurrency of the access control device. The queue head maintains read pointers and write pointers, which are updated through atomic variable operations. B2. The real-time access gateway concurrently polls the communication sockets of each access control device through multiple worker threads. When any worker thread reads the original data frame from the socket, it decapsulates the original data frame according to the state mapping table of the device driver adapter and extracts the device identifier, card serial number and timestamp. B3. Multiple proximity sensors are evenly distributed along the physical path of the circular guide rail, corresponding to the entrance area, identification area and exit area of ​​each access control channel respectively. The sensor output is connected to the digital input module of the programmable logic controller. B4. When a person carrying an access card passes the proximity sensor, the sensor detects the person's presence and outputs a digital level transition signal. The programmable logic controller captures this signal and records the current system timestamp as a supplementary timestamp field for the original access event. B5. The programmable logic controller determines the current work station stage of the person passing through based on the sequence of received digital level transition signals and the physical location of the sensor, and appends the work station stage identifier to the metadata of the original passage event and writes it to the temporary storage area of ​​shared memory. B6. If the multimodal recognition unit is busy, the programmable logic controller reduces the speed of the drive motor of the ring rail by adjusting the duty cycle of the pulse width modulation signal.

[0053] In this embodiment, the circular buffer queue is implemented using the Disruptor framework, with a size that is a power of 2, such as 1024. Queue elements are Event objects, containing the device ID, card serial number, timestamp, and workstation stage. Read and write pointers use AtomicLong, updated via CAS operations. The four worker threads are each bound to a different CPU core to avoid context switching.

[0054] The worker thread listens for read events of all device channels through NIOSelector. When a card reader channel has data, the thread calls the read() method to read the raw bytes, finds the corresponding driver adapter based on the device ID, decapsulates the event data, and then attempts to write it through RingBuffer's tryPublishEvent. If the queue is full, it blocks and waits.

[0055] The PLC connects four proximity sensors via hardwiring to the inlet, identification zone, outlet, and backup. The sensors are photoelectric switches, outputting a normally open NPN signal. The PLC's digital input module scans every 10ms. When a falling edge is detected indicating personnel entry, the PLC records the current system time with a precision of 1ms and triggers an event. The station entry point and sensor ID are written to the shared memory buffer. The PLC communicates with the gateway via PROFINET to append the station entry point to the original access event and write it to the circular buffer.

[0056] When the multimodal recognition unit is busy, the PLC's internal state machine detects that the recognition area occupancy flag is true. At this time, if the next person arrives at the entrance area, the PLC reduces the inverter frequency via the analog output module, thereby reducing the conveyor belt speed and causing the person to approach slowly. Specifically, a rated frequency of 50Hz corresponds to a linear speed of 0.5m / s, and reducing it to 20Hz corresponds to 0.2m / s. Simultaneously, the PLC maintains the entrance sensor trigger but does not allow entry into the recognition area until the recognition area is empty. When the recognition area occupancy flag is cleared, the PLC restores the frequency to 50Hz and allows the person to enter the recognition area, triggering a new data acquisition.

[0057] Further, step D includes: D1. The real-time access gateway starts an independent data association thread to continuously monitor the temporary buffer of shared memory in a polling manner. The polling interval is set through the configuration file. D2. When the first biometric sample and the second biometric sample are written into the temporary buffer, the data association thread reads the biometric sample pair and the corresponding first collection timestamp, second collection timestamp, shared memory start address and data length, and locks the biometric sample data. D3. The data association thread initiates an identity query request to the programmable logic controller, which is encapsulated in an industrial Ethernet message format and includes the union of the first and second acquisition timestamps and the request sequence number. D4. The programmable logic controller searches its internal register array based on the first and second acquisition timestamps to find the identification station trigger event record that precisely matches the timestamp, including the card serial number, the identification station number, and the counter count value of the trigger event; D5. The programmable logic controller encapsulates the found card serial number and workstation number into a response message. The response message contains the original request serial number and is returned to the data association thread of the real-time access gateway via the industrial Ethernet. D6. After receiving the response message, the data association thread parses out the card serial number and workstation number, uses the card serial number as the primary key, and uses the first collection timestamp, the second collection timestamp, the workstation number, and the shared memory start address as attribute fields. Together with the Uniform Resource Identifier of the first biometric sample and the second biometric sample in the distributed file system, these are written into the metadata index table of the distributed key-value storage system. D7. After successfully writing to the metadata index table, the data association thread sends a release command to the shared memory, clears the processed first and second biometric sample data in the temporary cache through atomic operations, and decrements the reference count of the current cache. D8. If the data association thread does not receive a response message from the programmable logic controller within the preset timeout threshold, the first biometric sample and the second biometric sample are marked as orphan data and transferred to the abnormal data queue.

[0058] In this embodiment, the data association thread is a Java thread with a configurable loop interval of 10ms. Each loop checks the header of the shared memory's temporary buffer for new data. The temporary buffer is a memory-mapped file consisting of two 4MB regions. It uses double buffering switching; when the write pointer points to region 1 and the data length is full, it automatically switches to region 2, and region 1 is marked as readable.

[0059] The thread detects new data in region 1, locks region 1, and reads the grouping metadata: module ID list [0x01, 0x02, 0x03], collection timestamp [1746783331050, 1746783331052, 1746783331051], workstation number "G01", device ID "R001", and card serial number obtained from the PLC. The metadata already contains the card serial number, and step D6 parses it out. However, the original grouping metadata in step C6 included both device identifiers and card serial numbers, so the card serial number returned by the PLC in step D4 might be duplicated. Since it was already written in step C6, the query in step D3 retrieves the card serial number. Step D3 initiates an identity query request, and step D4 searches for records matching the timestamp, which includes the individual identification code. Here, the card serial number is the identification code. Therefore, the metadata may already contain the card serial number, but to confirm, it is still necessary to query the PLC. An example could be as follows: the grouping metadata does not contain the card serial number, only the module identifier, timestamp, and workstation number. Step D3 queries the PLC, and the PLC returns the card serial number based on the timestamp. This is more logical.

[0060] Therefore, the following adjustments were made: the grouped metadata includes a list of module identifiers, timestamps of each acquisition, workstation numbers, and device IDs. After reading these, the data association thread constructs a query request containing two timestamps and a request sequence number, and sends it to the PLC. The PLC's register array stores the timestamp, card sequence number, and workstation number for each triggered event. The PLC finds a matching record by comparing the timestamps, allowing for an error of ±1ms, and returns the card sequence number.

[0061] After receiving the response, the thread parses the card serial number ABCD1234. Then, it writes the sample data—iris, fingerprint, and face images—to the distributed file system via the HDFS client. The path format is: / biometrics / YYYY / MM / DD / card serial number / module identifier_timestamp.jpg. Upon successful writing, the URI is obtained. Next, a Cassandra insert statement is constructed, using the card serial number as the partition key, the collection timestamp as the cluster key, and other fields as columns. Cassandra's lightweight transaction IFNOTEXISTS ensures atomicity. After successful writing, a release command is sent to shared memory, decrementing the region reference count using AtomicInteger. If the reference count reaches zero, the region is cleared, ready for the next round of use.

[0062] If no response is received from the PLC within 2 seconds, the thread writes the sample data to the local disk's exception directory and writes the metadata to the exception queue, where the exception handler periodically retryes querying the PLC or requires manual intervention.

[0063] Further, step E includes: E1. The pre-configured multimodal feature fusion engine includes a feature extraction pipeline, which consists of multiple cascaded feature processors. Each processor performs calculations for a specific biometric modality. The first biometric sample is processed by the iris feature processor to output a first feature vector, and the second biometric sample is processed by the face feature processor to output a second feature vector. E2. Device status information includes the communication round-trip time of the access controller, the drive current value of the electromagnetic lock, and the signal strength indication of the card reader. The status information is periodically collected and reported by the device drive adapter. The health score is calculated by the status evaluator based on the weighted combination of the communication round-trip time, drive current value, and signal strength indication. E3. The first feature vector and the second feature vector are synchronized and calibrated by the timestamp alignment module before fusion. If the difference between the first acquisition timestamp and the second acquisition timestamp exceeds the preset synchronization tolerance, the feature vector acquired later is discarded and acquisition is retried. E4. Input the aligned first feature vector and the second feature vector into the feature concatenation unit. The feature concatenation unit connects the two vectors in sequence to generate a fused feature vector. The fused feature vector contains the dimensional information and modality label of each original feature vector. E5. The fused feature vector is matched with the pre-stored registration feature template library. The matching process uses the nearest neighbor search algorithm to return the card holder identity identifier corresponding to the registration feature template with the smallest distance to the fused feature vector. E6. The health score and the matching score of the fusion feature vector are input together into the decision logic unit. The decision logic unit calculates the weighted total score according to the preset weight coefficients and uses the weighted total score as the intermediate calculation result of the multi-factor authentication fusion score.

[0064] In this embodiment, the feature extraction pipeline is deployed on a GPU server and communicates with the gateway via REST API. The iris feature processor receives the iris image, first performs iris localization and detection of the inner and outer circles, then expands it into a rectangular normalized image, applies Gabor filter banks to extract texture features, and generates a 256-dimensional floating-point vector. The face feature processor receives the face image, detects facial key points through MTCNN, aligns them, and then inputs them into a lightweight CNNMobileNet to extract a 128-dimensional feature vector.

[0065] Device status information is collected every minute by the gateway monitoring module. Communication round-trip latency is measured by sending a Ping command, currently 5ms; electromagnetic lock current is read by a Hall sensor, 300mA; card reader signal strength is obtained by reading the chip's RSSI register, -65dBm. The status evaluator compares these three values ​​with the baseline values: latency <10ms is full score, current 200-400mA is full score, and RSSI > -70dBm is full score. The scores are calculated as follows: latency score 100, current score 100, signal score 90, and the weighted average yields a health score of 96.7.

[0066] The timestamp alignment module compares the iris acquisition timestamp 1746783331050 and the face acquisition timestamp 1746783331052. The difference is 2ms, which is less than the synchronization tolerance of 50ms, so fusion is allowed. If the difference is greater than 50ms, the later feature vector is discarded and an instruction is sent to the PLC to re-acquire the module. The feature splicing unit connects the two vectors into a 384-dimensional fused vector and adds metadata card serial number and acquisition time.

[0067] Matching Process: The fused vector and the registration template library are stored in HBase for nearest neighbor search. An index is built using the Faiss library. First, all registration templates are loaded into memory, and an L2 distance index is established. For the fused vector, a k=1 search is performed, returning the nearest template with a distance of 0.15 and the corresponding identity identifier Zhang San. The matching score is defined as 1 / (1+distance), i.e., 0.87. The decision logic unit calculates a weighted total score of 96.7 health score and 0.87 with a weight of 0.2:0.8: 96.7*0.2+0.87*0.8=19.34+0.696=20.036, which serves as an intermediate result for the multi-factor authentication fusion score.

[0068] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, or indirect coupling or communication connection between apparatuses or units, and may be electrical, mechanical, or other forms.

[0069] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated units described above can be implemented in hardware or as software functional units. The above are merely embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made based on the description and drawings of this application, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

[0070] The specific embodiments of the invention have been described in detail above, but they are only examples, and this application is not limited to the specific embodiments described above. For those skilled in the art, any equivalent modifications or substitutions to the invention are also within the scope of this application. Therefore, all equivalent changes, modifications, and improvements made without departing from the spirit and principles of this application should be covered within the scope of this application.

Claims

1. A unified access and real-time management method for multi-source heterogeneous access control devices and cards, characterized in that, Includes the following steps: Step A: Encapsulate various heterogeneous access control devices into a unified device object model through a device driver adapter, and abstract various types of access control cards into a unified credential object model through a card reader / writer. Register the device object model and the credential object model to the runtime container of the real-time access gateway. Step B: Through the circular buffer queue maintained by the real-time access gateway, poll and receive the original access events reported by each access control device; Step C: At the real-time processing station, the device status information and cardholder biometrics corresponding to the original access event are read concurrently by the multimodal recognition unit. The first biometric acquisition unit is activated to collect the first biometric sample from the first position, and the second biometric acquisition unit is activated to collect the second biometric sample from the second position. During the acquisition, the environmental adaptive lighting array is activated simultaneously. Step D: Establish an association between the first biometric sample, the second biometric sample, the device identifier, and the card serial number, and store them in the temporary object storage area of ​​the distributed memory database; Step E: Retrieve the first biometric sample and the second biometric sample corresponding to the same card serial number from the distributed memory database, input them into the pre-configured multimodal feature fusion engine, and obtain the first feature vector and the second feature vector, as well as the health score of the device status information; Step F: Construct an access context graph in the dynamic permission topology space that represents the spatiotemporal location of the card holder, the device trust level, and the validity period of the permission; Step G: Based on the node attributes and edge constraints in the access context graph, calculate the card holder's real-time access permission level, multi-factor authentication fusion score, abnormal behavior deviation coefficient, and device access decision threshold. Step H: Combine each metric value with the read card serial number to form an access control decision record, write it to the distributed transaction log through the asynchronous persistence engine, and issue an execution command to the access control controller.

2. The method of claim 1, wherein, The device driver adapter mentioned in step A consists of a configuration descriptor, a communication protocol stack instance, and a state mapping table. The communication protocol stack instance dynamically loads a serial communication protocol or network communication protocol that matches the device type through a reflection mechanism. The state mapping table converts the device's native state code into a unified state enumeration value. The card reader / writer uses a radio frequency front-end module independent of the carrier frequency. The operating frequency can be switched through software configuration to adapt to low-frequency, high-frequency or ultra-high-frequency access control cards. The credential object model includes a globally unique card identifier, a card type identifier and a key derivation factor. The real-time access gateway maintains a bidirectional index between the device registry and the card registry, and the runtime container uses a non-blocking input / output model to manage the lifecycle of connection sessions. 3.The method of claim 1, wherein, Step C specifically includes: C1. The multimodal recognition unit includes an iris acquisition module, a fingerprint acquisition module, and a face acquisition module, each module being installed in a preset spatial position in the access control channel; C2. When the original access events to be processed in the circular buffer queue are assigned to the worker thread by the scheduler, the worker thread sends a workstation activation instruction to the programmable logic controller. The instruction includes the device identifier and the pre-assigned workstation number in the original access event. C3. After receiving the workstation activation command, the programmable logic controller sends a concurrent acquisition trigger signal to the multimodal recognition unit. The trigger signal is transmitted in parallel to the control ports of the iris acquisition module, fingerprint acquisition module and face acquisition module through hardwiring. C4. The iris acquisition module acquires iris image sequences through near-infrared illumination, the fingerprint acquisition module acquires fingerprint ridge images through a capacitive sensor, and the face acquisition module acquires face images through a visible light complementary metal-oxide-semiconductor sensor. Each module temporarily stores the acquired raw biometric samples in an on-chip buffer memory. C5. After each acquisition module successfully acquires the data, the original biometric sample is transmitted to the shared memory area of ​​the real-time access gateway, and a module identifier and acquisition timestamp are attached to each sample. C6. The programmable logic controller collects the acquisition completion flags returned by each module, performs a logical AND operation on all flag bits, and after all modules have returned success flags, encapsulates the module identifier, acquisition timestamp, workstation number, and corresponding device identifier and card serial number into grouping metadata and writes it into the metadata descriptor table of the shared memory area. C7. If any acquisition module fails to return an acquisition completion flag within a preset timeout period, the programmable logic controller sends a reset command to the module and increments the error count, while recording the missing module information in the exception event log. C8. The real-time access gateway continuously monitors the write pointer changes of the shared memory region. When it detects that the grouped metadata has been written, it triggers a soft interrupt to notify the corresponding data association thread to read it.

4. The unified access and real-time management method for multi-source heterogeneous access control devices and cards according to claim 1, characterized in that, Step F specifically includes: F1. Extract the pre-constructed physical topology layer from the dynamic permission topology space, perform graph simplification operation on the physical topology layer, remove redundant connection edges, retain the backbone nodes that constitute the minimum connected dominating set, and record the device identifier, spatial coordinates and Manhattan distance between adjacent nodes of each backbone node. F2. Perform similarity matching between the first feature vector, the second feature vector and the device trust level vector of the backbone node in the physical topology layer, calculate the cosine distance between each feature vector and the device historical registration feature vector, mark the feature vector pairs with a cosine distance less than a preset matching threshold as valid identity credentials, remove outlier feature vectors with a cosine distance greater than the preset matching threshold, and sort the timestamps of the valid identity credentials along the time axis. F3. Use the sensor values ​​in the device status monitoring data corresponding to the health score as the real-time load factor of the device in the physical topology layer, and use the frequency and time distribution of the card holder's historical access patterns as the behavioral baseline factor of the card in the permission topology layer. F4. Based on the shortest path between backbone nodes in the physical topology layer and the role inheritance relationship in the permission topology layer, pre-calculate the reachability matrix and permission transfer function between each node, establish the path constraint relationship between the current node of the card holder and the target node through the reachability matrix, mark the node pairs with path distance less than the preset reachability threshold as potential access paths, and generate all feasible paths from the current node to the target node and the corresponding intermediate node sequence through the graph traversal algorithm; F5. Using the backbone nodes of the physical topology layer as anchor points for the access context, the timestamps corresponding to the valid identity credentials are used as event nodes on each anchor point. Each event node stores its device identifier, spatial coordinates, and access direction vector in the physical topology layer. The potential access path is mapped to the planar coordinate system of the physical topology layer through spatial interpolation and associated with the nearest anchor event node, forming a tree-like access context graph data structure with anchor points as vertices, paths as edges, and credentials as payloads.

5. The unified access and real-time management method for multi-source heterogeneous access control devices and cards according to claim 1, characterized in that, Step G specifically includes: G1. In the access context graph, extract the device trust level value of the current anchor point of the card holder and the device trust level value of the target anchor point. The trust level of the current anchor point corresponds to the real-time value of the health score, and the trust level of the target anchor point corresponds to the static value in the permission configuration table. Calculate the weighted difference between the trust level values ​​of the two endpoints, and convert the weighted difference into a dimensionless permission level score according to the pre-configured level mapping table. Output the real-time access permission level. G2. Count the number of valid identity credentials marked along the potential access path in the access context graph, exclude duplicate matches and invalid outlier feature vectors, and perform a weighted sum of the fusion matching score of the first feature vector and the second feature vector and the health score, and output the multi-factor authentication fusion score. G3. Calculate the deviation between the behavior baseline factor and the real-time load factor of all event nodes in the access context graph. Use the ratio of the behavior frequency of the current access period to the behavior frequency of the same period in history as the deviation base, and the ratio of the current device load to the rated load as the load base. Output the product of the deviation base and the load base as the abnormal behavior deviation coefficient. G4. Identify anchor points in the access context graph that have three or more inbound and outbound edges besides the first and last anchor points, determine them as multi-path convergence points, count the number of multi-path convergence points, and output the path complexity coefficient. G5. For each intermediate node sequence in the potential access path, calculate the sum of the Manhattan distances between adjacent nodes. If there are multiple feasible paths in the access context graph, determine the shortest path distance using the Dijkstra algorithm. Based on the spatial scale calibration coefficient of the physical topology layer, convert the shortest path distance into a physical length in meters and output it as a path length metric.

6. The unified access and real-time management method for multi-source heterogeneous access control devices and cards according to claim 1, characterized in that, Step H specifically includes: H1. Serialize the real-time access permission level, multi-factor authentication fusion score, abnormal behavior deviation coefficient, path complexity coefficient, and path length metric, and convert them into field values ​​corresponding to the relational database table structure using a binary serialization protocol; H2. Combine the serialized field values ​​with the card serial number to construct a Structured Query Language insert statement, which includes a conflict update clause; H3. Execute the structured query language insert statement through the database connection pool interface to write the permission decision record into the decision record table of the remote database server; H4. Export the combined field values ​​as comma-separated text lines, append them to the audit log file on the local network attached storage device, and then roll over the audit log file and add a cyclic redundancy checksum. H5. The real-time access gateway sends an execution instruction containing the card serial number and real-time access permission level to the access controller through a message queue. The execution instruction format adopts a binary handshake protocol, and the instruction includes forward error correction coding. The instruction that fails to be sent is automatically transferred to the retry queue, and the retry interval is exponentially backed up.

7. The unified access and real-time management method for multi-source heterogeneous access control devices and cards according to claim 1, characterized in that, Step B includes: B1. The circular buffer queue is implemented using a lock-free circular queue. The queue depth is pre-configured according to the peak concurrency of the access control device. The queue head maintains a read pointer and a write pointer, which are updated through atomic variable operations. B2. The real-time access gateway concurrently polls the communication sockets of each access control device through multiple working threads. When any working thread reads the original data frame from the socket, it decapsulates the original data frame according to the state mapping table of the device driver adapter and extracts the device identifier, card serial number and timestamp. B3. Multiple proximity sensors are evenly distributed along the physical path of the circular guide rail, corresponding to the entrance area, identification area and exit area of ​​each access control channel respectively, and the sensor output terminals are connected to the digital input module of the programmable logic controller; B4. When a person carrying an access card passes by the proximity sensor, the sensor detects the presence of the person and outputs a digital level transition signal. The programmable logic controller captures the signal and records the current system timestamp as a supplementary timestamp field for the original access event. B5. The programmable logic controller determines the current workstation stage of the person passing through based on the sequence of received digital level transition signals and the physical location of the sensor, and appends the workstation stage identifier to the metadata of the original passage event and writes it to the temporary storage area of ​​shared memory. B6. If the multimodal recognition unit is in a busy state, the programmable logic controller reduces the speed of the drive motor of the annular guide rail by adjusting the duty cycle of the pulse width modulation signal.

8. The unified access and real-time management method for multi-source heterogeneous access control devices and cards according to claim 1, characterized in that, Step D includes: D1. The real-time access gateway starts an independent data association thread to continuously monitor the temporary buffer of shared memory in a polling manner. The polling interval is set through the configuration file. D2. When the first biometric sample and the second biometric sample are written into the temporary buffer, the data association thread reads the biometric sample pair and the corresponding first collection timestamp, second collection timestamp, shared memory start address and data length, and locks the biometric sample data; D3. The data association thread initiates an identity query request to the programmable logic controller, which is encapsulated in an industrial Ethernet message format and includes the union information of the first collection timestamp and the second collection timestamp, as well as the request sequence number. D4. The programmable logic controller searches its internal register array based on the first and second acquisition timestamps to find the identification station trigger event record that precisely matches the timestamp, including the card serial number, the identification station number, and the counter count value of the trigger event; D5. The programmable logic controller encapsulates the found card serial number and workstation number into a response message, the response message containing the original request serial number, and returns it to the data association thread of the real-time access gateway via industrial Ethernet; D6. After receiving the response message, the data association thread parses out the card serial number and workstation number, uses the card serial number as the primary key, and uses the first collection timestamp, the second collection timestamp, the workstation number, and the shared memory start address as attribute fields. Together with the Uniform Resource Identifier of the first biometric sample and the second biometric sample in the distributed file system, these are written into the metadata index table of the distributed key-value storage system. D7. After successfully writing to the metadata index table, the data association thread sends a release instruction to the shared memory, clears the processed first biometric sample and second biometric sample data in the temporary cache through atomic operations, and decrements the reference count of the current cache. D8. If the data association thread does not receive a response message from the programmable logic controller within a preset timeout threshold, the first biometric sample and the second biometric sample are marked as orphan data and transferred to the abnormal data queue.

9. The unified access and real-time management method for multi-source heterogeneous access control devices and cards according to claim 1, characterized in that, Step E includes: E1. The pre-configured multimodal feature fusion engine includes a feature extraction pipeline, which consists of multiple cascaded feature processors. Each processor performs calculations for a specific biometric modality. The first biometric sample is output as a first feature vector by the iris feature processor, and the second biometric sample is output as a second feature vector by the face feature processor. E2. The device status information includes the communication round-trip time of the access controller, the drive current value of the electromagnetic lock, and the signal strength indication of the card reader. The status information is periodically collected and reported by the device drive adapter. The health score is calculated by the status evaluator based on the weighted combination of the communication round-trip time, drive current value, and signal strength indication. E3. The first feature vector and the second feature vector are synchronized and calibrated by the timestamp alignment module before fusion. If the difference between the first acquisition timestamp and the second acquisition timestamp exceeds the preset synchronization tolerance, the feature vector acquired later is discarded and acquisition is retried. E4. The aligned first feature vector and the second feature vector are input to the feature concatenation unit, which connects the two vectors in sequence to generate a fused feature vector. The fused feature vector contains the dimension information and modality label of each original feature vector. E5. The fused feature vector is matched with the pre-stored registration feature template library. The matching process uses the nearest neighbor search algorithm to return the card holder identity identifier corresponding to the registration feature template with the smallest distance to the fused feature vector. E6. The health score and the matching score of the fusion feature vector are input together to the decision logic unit. The decision logic unit calculates the weighted total score according to the preset weight coefficients and uses the weighted total score as the intermediate calculation result of the multi-factor authentication fusion score.

Images