A security enhancement method and system based on access control

Abstract

The present invention proposes a security enhancement method and system based on access control, the method comprising the following steps: the access control card reader device extracts a derived key from n local derived keys as the first real-time unlocking key according to the synchronization key pointer, generates a random number, and uses the first real-time unlocking key to encrypt the random number to obtain ciphertext information, and sends the ciphertext information to the access control APP of the mobile terminal through the NFC communication link; the access control APP extracts a derived key from n derived keys in the card application according to the synchronization key pointer as the second real-time unlocking key, uses the second real-time unlocking key to decrypt the ciphertext information, obtains plaintext information and returns it to the access control card reader device; the access control card reader device compares the plaintext information to see if it is consistent with the random number, if it is consistent, continues to determine whether the corresponding seed key exceeds the validity period, if not, executes to open the access control. The present invention can effectively improve the portability of users and the security of the access control system.

Description

Technical Field

[0001] The present invention relates to the technical field of smart door locks, and in particular to a security enhancement method and system based on access control. Background Art

[0002] At present, there are many kinds of access control systems in residential communities or office places, including simple punch card systems, that is, users carry door cards with user identification inside, and bring the door cards close to the card reader when entering the door. If the door card has been authorized for access, the background server will send the information allowing entry to the access control system, and the access control system will open the door with the card reader installed to allow the user to enter. The advantage of this method is that the equipment is simple and the steps for users to enter the door are relatively simple. The disadvantage is very obvious, that is, if the door card is lost, anyone who picks up the door card can enter at will, which is a great challenge to the safety of residents and offices.

[0003] Based on the above, people have proposed using a mobile phone to copy the access card information and save it in the mobile wallet in the form of a copy card. When the access needs to be opened, the mobile phone communicates with the access card reader through NFC, and the access card reader reads the copy card information in the mobile wallet to see if it is authorized. If so, the access is opened. In this way, although the user does not need to carry the access card, the security factor is not high because anyone can copy and obtain the access card information. Summary of the invention

[0004] Based on the above, it is necessary to provide a security enhancement method and system based on access control, which can not only improve the portability of users, but also effectively improve the security of the access control system.

[0005] A first aspect of the present invention provides a security enhancement method based on access control, the method comprising the following steps:

[0006] Step 1: Download and install the access control APP on the mobile terminal, register the user information with the cloud platform through the access control APP, and register the device identification information of the access control card reader with the cloud platform;

[0007] Step 2, the cloud platform establishes a binding relationship between the user information and the device identification information, generates an AID and a PIN code based on the binding relationship, and sends the AID and the PIN code to the access control APP of the mobile terminal and the access control card reader device respectively, and the access control APP of the mobile terminal generates a card application based on the received AID, and stores the PIN code in the card application;

[0008] Step 3, the cloud platform generates a seed key, sets the validity period of the seed key according to management requirements, and formulates a synchronization key pointer;

[0009] Step 4, the cloud platform sends the seed key, the effective time of the seed key and the synchronization key pointer to the access control card reader, and sends the seed key and the synchronization key pointer to the card application of the mobile terminal;

[0010] Step 5: The access control APP of the mobile terminal and the access control card reader device respectively generate n derived keys based on the same seed key and the same key derivation algorithm, and store them locally;

[0011] Step 6, when the mobile terminal is close to the access control card reader, the access control card reader and the mobile terminal establish an NFC communication link based on the same AID and PIN code;

[0012] Step 7: The access control card reader device extracts a derived key from the n derived keys pre-stored locally as the first real-time unlocking key according to the synchronization key pointer, generates a random number, and uses the first real-time unlocking key to encrypt the random number to obtain ciphertext information, and then sends the ciphertext information to the access control APP of the mobile terminal through the NFC communication link;

[0013] Step 8: The access control APP of the mobile terminal extracts a derived key from the n derived keys in the card application according to the synchronization key pointer as the second real-time unlocking key, uses the second real-time unlocking key to decrypt the ciphertext information, obtains the plaintext information and returns it to the access control card reader device via the NFC communication link;

[0014] Step 9, the access control card reader compares the plain text information to see if it is consistent with the random number. If so, it continues to determine whether the corresponding seed key has exceeded its validity period. If not, it executes the access control opening operation.

[0015] A second aspect of the present invention provides a security enhancement system based on access control, the system comprising a mobile terminal, an access control card reader and a cloud platform, the mobile terminal and the access control card reader respectively perform network communication with the cloud platform, and the mobile terminal performs proximal communication with the access control card reader;

[0016] The mobile terminal is used to download and install the access control APP, and register user information with the cloud platform through the access control APP;

[0017] The cloud platform is used to establish a binding relationship between the user information and the device identification information of the access control card reader, and to generate an AID and a PIN code based on the binding relationship, and to send the AID and the PIN code to the access control APP of the mobile terminal and the access control card reader respectively, so that the access control APP of the mobile terminal generates a card application based on the AID and stores the PIN code in the card application; it is also used to generate a seed key, and to set the validity period of the seed key according to management requirements, and to formulate a synchronization key pointer; it is also used to send the seed key, the validity period of the seed key and the synchronization key pointer to the access control card reader, and to send the seed key and the synchronization key pointer to the card application of the mobile terminal; so that the access control APP of the mobile terminal and the access control card reader respectively generate n derived keys based on the same seed key and the same key derivation algorithm, and store them locally;

[0018] The access control APP of the mobile terminal is used to extract a derived key from the n derived keys in the card application as the second real-time unlocking key according to the synchronization key pointer, and use the second real-time unlocking key to decrypt the ciphertext information from the access control card reader device to obtain the plaintext information and return it to the access control card reader device via the NFC communication link;

[0019] The access control card reader device is used to register its own device identification information with the cloud platform; it is also used to establish an NFC communication link with the mobile terminal based on the same AID and PIN code when the mobile terminal is close; it is also used to extract a derived key from the local n derived keys as the first real-time unlocking key according to the synchronization key pointer after establishing the NFC communication link, generate a random number, and use the first real-time unlocking key to encrypt the random number to obtain ciphertext information, and then send the ciphertext information to the access control APP of the mobile terminal through the NFC communication link; it is also used to compare whether the plaintext information from the mobile terminal is consistent with the random number. If they are consistent, continue to determine whether the corresponding seed key exceeds the validity period. If not, perform the access control opening operation.

[0020] The present invention synchronizes multiple derived keys between a mobile terminal and an access control card reader based on a synchronous pointer, and then performs access control operations based on the synchronized keys. During the entire operation, the user does not need to carry a traditional access control card, thereby improving the user's portability. In addition, the keys for access control operations in similar time periods are different. Even if others steal all the derived keys, normal access control operations cannot be achieved due to the lack of a synchronous pointer or the pointers are not synchronized, effectively preventing others from replaying attacks by stealing keys, and further improving the security of the access control system.

[0021] Additional aspects and advantages of the present invention will become apparent from the following description or may be learned by practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The above and / or additional aspects and advantages of the present invention will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0023] Figure 1 A flow chart of a method for enhancing security based on access control according to the present invention is shown;

[0024] Figure 2 A block diagram of a security enhancement system based on access control according to the present invention is shown. DETAILED DESCRIPTION

[0025] In order to more clearly understand the above-mentioned purpose, features and advantages of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be noted that the embodiments of the present application and the features in the embodiments can be combined with each other without conflict.

[0026] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Therefore, the protection scope of the present invention is not limited to the specific embodiments disclosed below.

[0027] Example 1

[0028] like Figure 1 As shown, the present invention proposes a security enhancement method based on access control, the method comprising the following steps:

[0029] Step 1: Download and install the access control APP on the mobile terminal, register the user information with the cloud platform through the access control APP, and register the device identification information of the access control card reader with the cloud platform;

[0030] Step 2, the cloud platform establishes a binding relationship between the user information and the device identification information, generates an AID and a PIN code based on the binding relationship, and sends the AID and the PIN code to the access control APP of the mobile terminal and the access control card reader device respectively, and the access control APP of the mobile terminal generates a card application based on the received AID, and stores the PIN code in the card application;

[0031] Step 3, the cloud platform generates a seed key, sets the validity period of the seed key according to management requirements, and formulates a synchronization key pointer;

[0032] Step 4, the cloud platform sends the seed key, the effective time of the seed key and the synchronization key pointer to the access control card reader, and sends the seed key and the synchronization key pointer to the card application of the mobile terminal;

[0033] Step 5: The access control APP of the mobile terminal and the access control card reader device respectively generate n derived keys based on the same seed key and the same key derivation algorithm, and store them locally;

[0034] Step 6: When the mobile terminal is close to the access control card reader, the access control card reader and the mobile terminal establish an NFC communication link based on the same AID and PIN code;

[0035] Step 7: The access control card reader device extracts a derived key from the local n derived keys as the first real-time unlocking key according to the synchronization key pointer, generates a random number, and uses the first real-time unlocking key to encrypt the random number to obtain ciphertext information, and then sends the ciphertext information to the access control APP of the mobile terminal through the NFC communication link;

[0036] Step 8: The access control APP of the mobile terminal extracts a derived key from the n derived keys in the card application according to the synchronization key pointer as the second real-time unlocking key, decrypts the ciphertext information using the second real-time unlocking key, obtains the plaintext information and returns it to the access control card reader;

[0037] Step 9, the access control card reader compares the received plain text information with the random number (the random number generated in step 7) to see if it is consistent. If so, continue to determine whether the corresponding seed key has exceeded the validity period. If not, perform the access control operation.

[0038] Usually, when the access control card reader device leaves the factory or is delivered to the customer, it needs to register its device identification information with the cloud platform; if the user needs to request to open the access control, the user sends a request message to the cloud platform, and the request message includes at least the user information and the identification information of the access control card reader device that needs to be opened. The cloud platform will then review it, and if the review is passed, a binding relationship between the two will be established.

[0039] It is understandable that in places such as hotels, guesthouses, and apartments, it is only necessary to open access control permissions for users for a valid period of time according to needs, such as valid during the stay. Therefore, the present invention sets the validity period of the seed key to achieve secure management of access control in the time dimension.

[0040] It should be noted that, since the cloud platform establishes a binding relationship based on user information and device identification information, and generates an AID and a PIN code based on the binding relationship; then, different user information and the same device identification information can establish a many-to-one binding relationship. In the case where multiple users jointly manage and use the same access control card reader device, the cloud platform generates multiple sets of AIDs, PIN codes, seed keys, valid time of seed keys, and synchronization key pointers, and sends each set of AIDs, PIN codes, seed keys, and synchronization key pointers to the access control APP of the corresponding mobile terminal (corresponding to the user information), and sends multiple sets of AIDs, PIN codes, seed keys, valid time of seed keys, and synchronization key pointers to the same access control card reader device;

[0041] Therefore, the present invention can achieve the security management of the same access control between access control APPs of different mobile terminals by setting a many-to-one binding relationship between different user information and the same device identification information.

[0042] It can be understood that after establishing a many-to-one binding relationship, multiple sets of access control management information are pre-stored in the access control card reader: AID, PIN code, seed key, seed key validity time and synchronization key pointer. Multiple sets of access control management information correspond to access control APPs of multiple mobile terminals. The seed keys, seed key validity time and synchronization key pointers in different groups of access control management information can be different to ensure that the access control APPs of different mobile terminals do not affect each other when jointly managing and using the same access control.

[0043] Furthermore, in step 6, when the access control card reader establishes an NFC communication link with the mobile terminal based on the AID and the PIN code, the following steps are performed:

[0044] The access control card reader generates adaptation request information based on the AID and transmits it to the mobile terminal; wherein the adaptation request information includes the AID;

[0045] The mobile terminal traverses the local card package to find the card application that is consistent with the AID in the adaptation request information;

[0046] After receiving a response message from the mobile terminal that the corresponding card application has been found, the access control card reading device sends a PIN verification instruction to the mobile terminal; wherein the PIN verification instruction includes a PIN code;

[0047] After the mobile terminal corresponding card application receives the PIN verification instruction, it compares the PIN code in the PIN verification instruction with the pre-stored PIN code to see if they are consistent. If they are consistent, it returns verification success information.

[0048] It can be understood that the AID is the identification ID of the card application. Since multiple card applications may be stored in the card package of the mobile terminal, different card applications hold different AIDs. Based on the current access control card reader, the mobile terminal traverses and reads the card applications with the same AID. If it is read, the subsequent PIN code verification will continue. If it is not read, the reading failure information will be fed back.

[0049] It should be noted that when the access control apps on different mobile terminals jointly manage and use the same access control, the AID and PIN codes in the access control management information of different groups are different;

[0050] Since the access control card reader device may pre-store multiple AIDs, when the access control card reader device generates adaptation request information based on the AID, the access control card reader device may obtain the required AID in the following manner:

[0051] When the mobile terminal is close to the access control card reader, the mobile terminal communicates with the access control card reader based on the NFC communication function. The access control card reader reads the device identification (or NFC identification) from the mobile terminal, and searches for the corresponding AID based on the pre-stored mapping relationship between the mobile terminal's device identification (or NFC identification) and the access control management information.

[0052] Furthermore, after step 9, the method further comprises the following steps:

[0053] After the access control card reader sends access control successful opening information to the mobile terminal, the local synchronization key pointer is updated to the next pointer;

[0054] After the mobile terminal receives the access control successful opening information, it updates the local synchronization key pointer to the next pointer, so that the synchronization key pointer updated by the access control card reader device is consistent with the synchronization key pointer updated by the mobile terminal.

[0055] It should be noted that when the access control APPs on different mobile terminals jointly manage and use the same access control, the synchronization key pointers in the access control management information of different groups may be different. It is necessary to ensure that the synchronization key pointers in the access control management information corresponding to the access control APP on the same mobile terminal and the access control card reader device remain consistent before and after the update.

[0056] Furthermore, the synchronization key pointer is in the shape of a clock, and the initial pointer positions of the mobile terminal and the access control card reader are the same; the preset number of pointers is m, the m pointers correspond to different derived keys, and m is less than or equal to n, and the m pointers periodically poll the n derived keys.

[0057] It can be understood that the synchronization key pointer is used to point to the storage location of a derived key.

[0058] It should be noted that the access control APP of the mobile terminal and the access control card reader device derive n identical derived keys based on the same seed key and the same key derivation algorithm (or key derivation function); when the synchronization key pointers of both parties are the same, the first real-time unlocking key in step 7 is the same as the second real-time unlocking key in step 8; therefore, the present invention can quickly and securely implement offline access control authentication when the mobile terminal is close to the access control card reader device, thereby improving the user experience.

[0059] Furthermore, the step 9 further includes the following steps:

[0060] If it is determined that the corresponding seed key exceeds the validity period, access control expiration information is fed back to the mobile terminal.

[0061] Specifically, the mobile terminal may be a mobile phone, a smart watch, or other portable device that can be installed with a door access control APP and has an NFC communication function.

[0062] Example 2

[0063] Based on Example 1, this example provides a specific implementation of a security enhancement system based on access control, such as Figure 2 As shown;

[0064] The access control-based security enhancement system includes a mobile terminal, an access control card reader and a cloud platform, wherein the mobile terminal and the access control card reader respectively perform network communication with the cloud platform, and the mobile terminal performs proximal communication with the access control card reader;

[0065] The mobile terminal is used to download and install the access control APP, and register user information with the cloud platform through the access control APP;

[0066] The cloud platform is used to establish a binding relationship between the user information and the device identification information of the access control card reader, and to generate an AID and a PIN code based on the binding relationship, and to send the AID and the PIN code to the access control APP of the mobile terminal and the access control card reader respectively, so that the access control APP of the mobile terminal generates a card application based on the AID and stores the PIN code in the card application; it is also used to generate a seed key, and to set the validity period of the seed key according to management requirements, and to formulate a synchronization key pointer; it is also used to send the seed key, the validity period of the seed key and the synchronization key pointer to the access control card reader, and to send the seed key and the synchronization key pointer to the card application of the mobile terminal; so that the access control APP of the mobile terminal and the access control card reader respectively generate n identical derived keys based on the same seed key and the same key derivation algorithm, and store them locally;

[0067] The access control APP of the mobile terminal is used to extract a derived key from the n derived keys in the card application as the second real-time unlocking key according to the synchronization key pointer, and use the second real-time unlocking key to decrypt the ciphertext information from the access control card reader device to obtain the plaintext information and return it to the access control card reader device via the NFC communication link;

[0068] The access control card reader device is used to register its own device identification information with the cloud platform; it is also used to establish an NFC communication link with the mobile terminal based on the same AID and PIN code when the mobile terminal approaches; it is also used to extract a derived key from the local n derived keys as the first real-time unlocking key according to the synchronization key pointer, generate a random number, and use the first real-time unlocking key to encrypt the random number to obtain ciphertext information, and then send the ciphertext information to the access control APP of the mobile terminal through the NFC communication link; it is also used to compare whether the plaintext information from the mobile terminal is consistent with the random number. If they are consistent, it continues to determine whether the corresponding seed key exceeds the validity period. If not, it performs the access control opening operation.

[0069] It should be noted that when the mobile terminal is close to the access control card reader, the access control card reader and the mobile terminal establish an NFC communication link between the mobile terminal and the access control card reader based on the same AID and PIN code; the access control card reader extracts a derived key from the local n derived keys as the first real-time unlocking key according to the synchronization key pointer, generates a random number, and uses the first real-time unlocking key to encrypt the random number to obtain ciphertext information, and then sends the ciphertext information to the access control APP of the mobile terminal through the NFC communication link; the access control APP of the mobile terminal extracts a derived key from the n derived keys in the card application as the second real-time unlocking key according to the same synchronization key pointer, and uses the second real-time unlocking key to decrypt the ciphertext information to obtain plaintext information and return it to the access control card reader; the access control card reader compares the plaintext information to see if it is consistent with the random number. If so, it continues to determine whether the corresponding seed key exceeds the validity period. If not, the access control is opened.

[0070] Furthermore, when the access control card reader and the mobile terminal establish an NFC communication link based on the same AID and PIN code,

[0071] The access control card reader device is specifically used to: generate adaptation request information based on the AID and transmit it to the mobile terminal; after receiving a response message from the mobile terminal that the corresponding card application has been found, send a PIN verification instruction to the mobile terminal; wherein the adaptation request information includes the AID, and the PIN verification instruction includes the PIN;

[0072] The mobile terminal is specifically used to: traverse the local card package to find the card application consistent with the AID in the adaptation request information; after the mobile terminal corresponding to the card application receives the PIN verification instruction, compare the PIN code in the PIN verification instruction with the pre-stored PIN code to see if they are consistent, and if they are consistent, return the verification pass information.

[0073] Furthermore, after performing the door opening operation,

[0074] The access control card reader device is also used to: send access control successful opening information to the mobile terminal, and update the local synchronization key pointer to the next pointer;

[0075] The mobile terminal is also used to: after receiving the access control successful opening information, update the local synchronization key pointer to the next pointer, so that the synchronization key pointer updated by the access control card reader device is consistent with the synchronization key pointer updated by the mobile terminal.

[0076] Furthermore, the synchronization key pointer is in the shape of a clock, and the initial pointer positions of the mobile terminal and the access control card reader are the same; the preset number of pointers is m, the m pointers correspond to different derived keys, and m is less than or equal to n, and the m pointers periodically poll the n derived keys.

[0077] The present invention synchronizes multiple derived keys between a mobile terminal and an access control card reader based on a synchronous pointer, and then performs access control operations based on the synchronized keys. During the entire operation, users do not need to carry traditional access control cards, thereby improving the portability of users. In addition, the present invention uses one key at a time, and even if the real-time unlocking keys used for access control operations performed at similar times are different, even if others steal all the derived keys, normal access control operations cannot be achieved due to the lack of synchronous pointers or the pointers are not synchronized, which can effectively prevent others from replaying attacks by stealing keys, further improving the security of the access control system.

[0078] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A security enhancement method based on access control, characterized in that: The following steps are involved: Step 1: Download and install the access control APP on the mobile terminal, register the user information with the cloud platform through the access control APP, and register the device identification information of the access control card reader with the cloud platform; Step 2, the cloud platform establishes a binding relationship between the user information and the device identification information, generates an AID and a PIN code based on the binding relationship, and sends the AID and the PIN code to the access control APP of the mobile terminal and the access control card reader device respectively, and the access control APP of the mobile terminal generates a card application based on the AID, and stores the PIN code in the card application; Step 3, the cloud platform generates a seed key, sets the validity period of the seed key according to management requirements, and formulates a synchronization key pointer; Step 4, the cloud platform sends the seed key, the effective time of the seed key and the synchronization key pointer to the access control card reader, and sends the seed key and the synchronization key pointer to the card application of the mobile terminal; Step 5: The access control APP of the mobile terminal and the access control card reader device respectively generate n derived keys based on the same seed key and the same key derivation algorithm, and store them locally; Step 6: When the mobile terminal is close to the access control card reader, the access control card reader and the mobile terminal establish an NFC communication link based on the AID and the PIN code; Step 7, the access control card reader device extracts a derived key from the n derived keys pre-stored locally as the first real-time unlocking key according to the synchronization key pointer, generates a random number, and uses the first real-time unlocking key to encrypt the random number to obtain ciphertext information, and then sends the ciphertext information to the access control APP of the mobile terminal through the NFC communication link; Step 8: The access control APP of the mobile terminal extracts a derived key from the n derived keys in the card application as the second real-time unlocking key according to the synchronization key pointer, decrypts the ciphertext information using the second real-time unlocking key, obtains the plaintext information and returns it to the access control card reader device via the NFC communication link; Step 9, the access control card reader compares the plain text information to see if it is consistent with the random number. If so, it continues to determine whether the corresponding seed key has exceeded its validity period. If not, it executes the access control opening operation.

2. The access control-based security enhancement method according to claim 1, characterized in that: In step 6, when the access control card reader establishes an NFC communication link with the mobile terminal based on the AID and the PIN code, the following steps are performed: The access control card reader generates adaptation request information based on the AID and transmits it to the mobile terminal; The mobile terminal traverses the local card package to find the card application that is consistent with the AID in the adaptation request information; After receiving a response message from the mobile terminal that the corresponding card application has been found, the access control card reading device sends a PIN verification instruction to the mobile terminal; After the mobile terminal corresponding card application receives the PIN verification instruction, it compares the PIN code in the PIN verification instruction with the pre-stored PIN code to see if they are consistent. If they are consistent, it returns verification success information.

3. The access control-based security enhancement method according to claim 1, characterized in that: After step 9, the method further comprises the following steps: After the access control card reader sends access control successful opening information to the mobile terminal, the local synchronization key pointer is updated to the next pointer; After the mobile terminal receives the access control successful opening information, it updates the local synchronization key pointer to the next pointer, so that the synchronization key pointer updated by the access control card reader device is consistent with the synchronization key pointer updated by the mobile terminal.

4. The access control-based security enhancement method according to claim 1, characterized in that: The synchronous key pointer is in the shape of a clock, and the initial pointer position of the mobile terminal is the same as that of the access control card reader; the preset number of pointers is m, the m pointers correspond to different derived keys respectively, and m is less than or equal to n, and the m pointers periodically poll the n derived keys.

5. The access control-based security enhancement method according to claim 1, characterized in that: The step 9 further comprises the following steps: If it is determined that the corresponding seed key exceeds the validity period, access control expiration information is fed back to the mobile terminal.

6. A security enhancement system based on access control, characterized in that: It includes a mobile terminal, an access control card reader and a cloud platform, wherein the mobile terminal and the access control card reader respectively perform network communication with the cloud platform, and the mobile terminal performs proximal communication with the access control card reader; The mobile terminal is used to download and install the access control APP, and register user information with the cloud platform through the access control APP; The cloud platform is used to establish a binding relationship between the user information and the device identification information of the access control card reader, and to generate an AID and a PIN code based on the binding relationship, and to send the AID and the PIN code to the access control APP of the mobile terminal and the access control card reader respectively, so that the access control APP of the mobile terminal generates a card application based on the AID and stores the PIN code in the card application; it is also used to generate a seed key, and to set the validity period of the seed key according to management requirements, and to formulate a synchronization key pointer; it is also used to send the seed key, the validity period of the seed key and the synchronization key pointer to the access control card reader, and to send the seed key and the synchronization key pointer to the card application of the mobile terminal; so that the access control APP of the mobile terminal and the access control card reader respectively generate n derived keys based on the same seed key and the same key derivation algorithm, and store them locally; The access control APP of the mobile terminal is used to extract a derived key from the n derived keys in the card application as the second real-time unlocking key according to the synchronization key pointer, and use the second real-time unlocking key to decrypt the ciphertext information from the access control card reader device to obtain the plaintext information and return it to the access control card reader device via the NFC communication link; The access control card reader is used to register its own device identification information with the cloud platform; it is also used to establish an NFC communication link with the mobile terminal based on the same AID and PIN code when the mobile terminal is close; it is also used to extract a derived key from the local n derived keys as the first real-time unlocking key according to the synchronization key pointer, generate a random number, and use the first real-time unlocking key to encrypt the random number to obtain ciphertext information, and then send the ciphertext information to the access control APP of the mobile terminal through the NFC communication link; It is also used to compare whether the plaintext information from the mobile terminal is consistent with the random number. If they are consistent, it continues to determine whether the corresponding seed key exceeds the validity period. If not, it executes the door opening operation.

7. The access control-based security enhancement system according to claim 6, characterized in that: When the access control card reader and the mobile terminal establish an NFC communication link based on the AID and the PIN code, The access control card reader device is specifically used to: generate adaptation request information based on the AID and transmit it to the mobile terminal; after receiving a response message from the mobile terminal that the corresponding card application has been found, send a PIN verification instruction to the mobile terminal; The mobile terminal is specifically used to: traverse the local card package to find the card application consistent with the AID in the adaptation request information; after the mobile terminal corresponding to the card application receives the PIN verification instruction, compare the PIN code in the PIN verification instruction with the pre-stored PIN code to see if they are consistent, and if they are consistent, return the verification pass information.

8. The access control-based security enhancement system according to claim 6, characterized in that: After opening the door, The access control card reader device is also used to: send access control successful opening information to the mobile terminal, and update the local synchronization key pointer to the next pointer; The mobile terminal is also used to: after receiving the access control successful opening information, update the local synchronization key pointer to the next pointer, so that the synchronization key pointer updated by the access control card reader device is consistent with the synchronization key pointer updated by the mobile terminal.

9. The access control-based security enhancement system according to claim 6, characterized in that: The synchronous key pointer is in the shape of a clock, and the initial pointer positions of the mobile terminal and the access control card reader are the same; the preset number of pointers is m, the m pointers correspond to different derived keys respectively, and m is less than or equal to n, and the m pointers periodically poll the n derived keys.

Images