Method for realizing access control card terminal authorization-free by using multi-dimensional key encryption and decryption algorithm

Abstract

The application relates to the technical field of access control cards, in particular to a method for realizing terminal authorization-free of an access control card by using a multi-dimensional key encryption and decryption algorithm. The method comprises the following steps: S1, establishing a terminal authorization-free key and parameter system in an access control system; S2, determining corresponding permission quadrants and access control terminal condition comparison parameters; S3, performing check code calculation; S4, randomly generating a symmetric key and performing symmetric encryption calculation; S5, performing encryption calculation of the multi-dimensional key algorithm; S6, manufacturing an access control card; S7, an access control terminal reads the access control card, when the access control card contains information in conformity with the authorization-free data format, decryption of the multi-dimensional key encryption algorithm is performed, and it is judged whether to release or not to release. Compared with the prior art, the multi-dimensional key encryption and decryption algorithm can directly omit the authorization operation of the system to the access control terminal in the card authorization, and effectively drives the access control door opening.

Description

Technical Field

[0001] The present invention relates to the technical field of access control cards, and more specifically, to a method for realizing unauthorized access control card terminals by applying a multi-dimensional key encryption and decryption algorithm. Background Art

[0002] The access control card is an effective method for personnel access management at present. Using an authorized access control card can achieve normal access within the authorized time limit and authorized channels, and has become a necessary means in modern enterprise, property, community, and security management.

[0003] In a system with an access control card as the access management carrier, the authorization of the access control card has always been a relatively heavy task in the system. Considering security, the access control terminal requires normal access control card identification and door opening drive even when offline and disconnected from the network. Therefore, a user / card library often needs to be established on the device side, and all authorized user / card information on this device side is stored in this library to facilitate the door opening drive immediately after the user / card is recognized.

[0004] To ensure the normal realization of the access control function, the system needs to maintain the terminal user / card library in real time. Especially when a certain access control terminal needs to update a large amount of user / card information, the server side of the access control system software and the access control terminal need to maintain a long-time data exchange, which is easily affected by network noise, resulting in incomplete card library synchronization. The long card library synchronization time causes the time period event information not to be reported in time, and the intelligent system linkage event cannot be triggered in time; when authorizing multiple access control terminals for a user / card, such as opening a temporary card for a certain courier, it is necessary to wait for the authorization operation replies of multiple access control terminals, and the user experience is poor.

[0005] Currently, in an access control system using access control cards, each access control card is respectively bound to a certain person. Therefore, when adding a person to the access control system, usually a card will be added. The access control system usually uses the physical serial number of the access control card as the unique identifier of the card. In most IC card systems, the physical serial number of the card is written in the 0th sector of the IC card by the card supplier. Since the end user cannot rewrite the data in the 0th sector of the IC card, it can be ensured that the card number is the unique identifier in the access control system on the premise of the uniqueness of the access control card supplier. Due to the uniqueness of the physical serial number within the system, setting up a card library on the access control terminal to record the physical serial number of the card and the access authorization has become a common method in the current traditional access control system.

[0006] Whenever a new user with access permissions is added, the access control system administrator must add the user to the system and create a new access card with a physical serial number, binding it to the new user. When adding or removing access permissions for a user, an authorization or deletion operation must be performed on the designated access control terminal to ensure that the access card can or cannot pass through that terminal after the setting operation is completed. The access control terminal reads the access card number using an RFID reader, then searches the card database to determine if the card has access permissions. If access permissions are granted, the access control system triggers the door opening mechanism; otherwise, an audible prompt is given and the door is not opened.

[0007] This demonstrates that in traditional access control systems, authorizing or deleting authorized access cards always involves a process where the access control system sends a card number permission operation instruction to the access control terminal and waits for the terminal to complete the permission operation. In certain special scenarios, such as new students registering for access cards at schools or newly built smart building systems issuing cards to users in a centralized manner, each user must complete the authorization of all relevant access control systems simultaneously during card issuance and retrieval. Card issuance waiting time can reach several minutes, which is highly detrimental to the user experience. For example, in current intelligent office buildings, temporary card issuance for visitors and couriers also involves multiple access control terminals needing to authorize a particular access card. Retrieving temporary cards also requires timely deletion of previous authorizations; otherwise, the card may still be able to open access control systems other than those currently authorized when used again for card issuance. Summary of the Invention

[0008] To overcome the shortcomings of existing technologies, this invention provides a method for implementing unauthorized access control card terminals using a multi-dimensional key encryption and decryption algorithm.

[0009] To achieve the above objectives, a method for implementing unauthorized access control card terminals using multi-dimensional key encryption and decryption algorithms is designed, characterized by the following steps:

[0010] S1, Establish a terminal unauthorized key and parameter system in the access control system;

[0011] The terminal unauthorized key and parameter system operation in step S1 includes the following steps:

[0012] S11, The access control system generates and distributes a single-user key P for a multi-dimensional encryption / decryption algorithm for each access control terminal. x ;

[0013] S12, for the access control system, the permission schemes for various access control combinations are divided into several different permission quadrants;

[0014] S13, Calculate and generate the key length value N for each permission quadrant. yand Euler's totient function value

[0015] S14, determine the coprime integers e in each quadrant. y coprime integers e y Euler totient function values ​​in each quadrant All are coprime;

[0016] S15, Calculate the modulo inverse element value d in each quadrant. y ;

[0017] S2, based on access control requirements, determine the corresponding permission quadrant and access control terminal condition comparison parameters;

[0018] S3, using the comparison condition parameters determined in step S2 as the original data to be transmitted, calculate the check code;

[0019] S4: Randomly generate a symmetric key and perform symmetric encryption calculations on the data to be transmitted;

[0020] S5, using the permission quadrant parameter (N) determined in step S2. y d y The symmetric key generated in step S4 is then used for encryption calculation using a multidimensional key algorithm, i.e., using the modulo inverse element value d. y The power value of the symmetric key in step S4 is calculated, and then divided by the key length N in that quadrant. y The remainder is used as the symmetric key encryption value;

[0021] S6, create an access control card according to the data format of the access control terminal's unauthorized card, and write the following information into the access control card: the symmetric encrypted data of the access control terminal's comparison condition parameters and the original data verification value, and the coprime integer e of the permission quadrant confirmed in step S2. y , and the multi-dimensional key encryption value of the symmetric key;

[0022] S7, the access control terminal reads the access card. When the access card contains information that conforms to the unauthorized data format, it decrypts the information using a multi-dimensional key encryption algorithm and determines whether to allow or deny access.

[0023] The access control terminal condition comparison parameter is the access card's valid time period, including the start and end times.

[0024] The time values ​​within the effective time period are stored using a data bit definition method.

[0025] The single-user key P x The keys are stored separately in the access control terminal and the access control system. The access control terminal only stores its own single-user key, which is used for decrypting the terminal's unauthorized access card. The access control system stores the single-user keys of all access control terminals in the system, which are used to create unauthorized access control cards for the access control terminals.

[0026] The single-user key P x The range of values ​​for is a prime number not less than 255.

[0027] The key length value N y The calculation method is to calculate all single-user keys P within this quadrant. x The product of the products, the Euler totient function value The calculation method is to calculate all single-user keys P within this quadrant. x The product of -1 values.

[0028] The range of values ​​for the coprime integer e is:

[0029] In step S15, the modular inverse element value d y The calculation method is as follows:

[0030] In step S7, when performing the decryption operation of the multi-dimensional key algorithm, the symmetric key encrypted value and the coprime function value are obtained. The coprime function power of the symmetric key encrypted value is calculated and divided by the single-user key of the current access control terminal to calculate the symmetric key value. The authorized condition comparison parameters are calculated using the symmetric key and the verification value is compared. If the verification passes and the condition comparison parameter comparison also passes, the card is allowed to pass. Otherwise, the card database query for the current card number is performed again. Cards within the authorized range are allowed to pass, and unauthorized cards are not allowed to pass.

[0031] The symmetric key encryption operation method in step S4 includes, but is not limited to, one or more of the following symmetric encryption operations: XOR, modular addition, modular multiplication, DES, or 3DES.

[0032] Compared with existing technologies, this invention uses a multi-dimensional key encryption and decryption algorithm, which can directly omit the system authorization operation to the access control terminal in the card authorization process and effectively drive the access control door opening. Attached Figure Description

[0033] Figure 1 This is a schematic diagram illustrating how time values ​​are stored using a data bit definition method in Embodiment 1 of the present invention.

[0034] Figure 2 This is a schematic diagram of the unauthorized data sector space allocation of the access card sector multi-dimensional key terminal in Embodiment 1 of the present invention.

[0035] Figure 3 This is a schematic diagram of the permission quadrant in step S12 of Embodiment 1 of the present invention.

[0036] Figure 4 This is an example diagram of the multi-dimensional key quadrant encryption parameters in steps S13 to S15 of Embodiment 1 of the present invention.

[0037] Figure 5 This is an example diagram of the unauthorized data of the access control card sector multi-dimensional key terminal according to Embodiment 1 of the present invention.

[0038] Figure 6 This is an example diagram showing the multi-dimensional key decryption calculation results of different access control terminals in Embodiment 1 of the present invention. Detailed Implementation

[0039] The present invention will now be further described with reference to the accompanying drawings.

[0040] This embodiment addresses the need for unauthorized operation of three access control terminals (A, B, and C) and provides a method for implementing unauthorized access control card terminals using a multi-dimensional key encryption / decryption algorithm, comprising the following steps:

[0041] S1, Establish a terminal unauthorized key and parameter system in the access control system;

[0042] The terminal unauthorized key and parameter system operation in step S1 includes the following steps:

[0043] S11, The access control system generates and distributes a single-user key P for a multi-dimensional encryption / decryption algorithm for each access control terminal. A =257; P B =263; P C =269;

[0044] S12, for the access control system, divides the various access control combinations into several different access quadrants, such as... Figure 3 As shown;

[0045] S13, Calculate the key length value N for each permission quadrant. y and Euler's totient function value

[0046] S14, determine the coprime integers e in each quadrant. y coprime integers e y Euler totient function values ​​in each quadrant All are coprime;

[0047] S15, Calculate the modulo inverse element value d in each quadrant. y ,like Figure 4 As shown.

[0048] S2. Based on the access control requirements, determine the corresponding permission quadrant and access control terminal condition comparison parameters. In this embodiment, the valid time period of the access card is used as the condition comparison parameter of the access control terminal.

[0049] The access card's valid time period in step S2 includes a start and end time. In this embodiment, the time value is stored using a data bit definition method. Specifically, 12 data bits represent "year", 4 data bits represent "month", 5 data bits represent "day", 5 data bits represent "hour", 6 data bits represent "minute", and 6 data bits represent "second", thus "packing" the time data into a 5-byte data space. In actual use, other conditional data that can restrict access, such as shift number and card type, can also be stored according to user needs and the characteristics of the access control hardware.

[0050] like Figure 1 As shown, in this embodiment, an access card is issued, authorizing the user to use the card to access two access control terminals, A and C, during the period from 9:45:23 on July 15, 2023 to 18:00:00 on July 15, 2023.

[0051] The start time values ​​for unencrypted access control authorization are: 0xE7, 0x77, 0x2F, 0xB5, 0x17, and the end time values ​​are: 0xE7, 0x77, 0x4F, 0x02, 0x00.

[0052] S3. Using the comparison condition parameters determined in step S2 as the original data to be transmitted, the check code is calculated. In this embodiment, the data verification is calculated by accumulation, and the check value is 0x08.

[0053] S4. Randomly generate a symmetric key and perform symmetric encryption calculation on the data to be transmitted. In this embodiment, the randomly generated key is 0x11. After using this key to perform an XOR operation to encrypt the access control authorization period data, the data is 0xF6, 0x66, 0x3E, 0XA4, 0x06, 0xF6, 0x66, 0x5E, 0x13, 0x11.

[0054] S5, using the permission quadrant parameter (N) determined in step S2. y d y The symmetric key generated in step S4 is then used for encryption calculation using a multidimensional key algorithm, i.e., using the modulo inverse element value d. y The power value of the symmetric key in step S4 is calculated, and then divided by the key length N in that quadrant. y The remainder is used as the symmetric key encryption value;

[0055] S6, create an access control card according to the data format of the access control terminal's unauthorized card, and write the following information into the access control card: the symmetric encrypted data of the access control terminal's comparison condition parameters and the original data verification value, and the coprime integer e of the permission quadrant confirmed in step S2. y And the multi-dimensional key encryption value of the symmetric key, such as Figure 5 As shown;

[0056] S7, the access control terminal reads the access card. If the access card contains information conforming to the unauthorized data format, it decrypts the information using a multi-dimensional key encryption algorithm and determines whether to allow or deny access. For example... Figure 6 As shown, when performing the decryption operation of the multidimensional key algorithm, the symmetric key encrypted value and the coprime function value are obtained. The coprime function power of the symmetric key encrypted value is calculated and divided by the single-user key of the current access control terminal to calculate the symmetric key value. The authorized condition comparison parameters are calculated using the symmetric key and the verification value is compared. If the verification passes and the condition comparison parameter comparison also passes, the card is allowed to pass. Otherwise, the card database query for the current card number is performed again. Cards within the authorized range are allowed to pass, and unauthorized cards are not allowed to pass.

[0057] The single-user key P x The keys are stored separately in the access control terminal and the access control system. The access control terminal only stores its own single-user key, which is used for decrypting the terminal's unauthorized access card. The access control system stores the single-user keys of all access control terminals in the system, which are used to create unauthorized access control cards for the access control terminals.

[0058] The single-user key P x The range of values ​​for is a prime number not less than 255.

[0059] The key length value N y The calculation method is to calculate all single-user keys P within this quadrant. x The product of the products, the Euler totient function value The calculation method is to calculate all single-user keys P within this quadrant. x The product of -1 values.

[0060] The range of values ​​for the coprime integer e is:

[0061] In step S15, the modular inverse element value d y The calculation method is as follows:

[0062] The symmetric key encryption operation method in step S4 includes, but is not limited to, one or more of the following symmetric encryption operations: XOR, modular addition, modular multiplication, DES, or 3DES.

[0063] The access control card uses an IC card with data storage capability. In this embodiment, the access control card is an S50 card. A typical access control IC card has 16 data sectors, of which sector 0 is pre-installed by the IC card manufacturer and cannot be rewritten. The remaining 15 sectors may be used by systems outside the access control system, such as bank cards, campus wallets, library cards, etc. Depending on the actual application requirements, one or more unused sectors that do not conflict with other systems can be selected as the data sectors for the multi-dimensional key of the access control card in this embodiment.

[0064] like Figure 2As shown, each data sector contains 4 data blocks, and each data block contains 16 bytes. Except for data block 3, which is used to store the read / write password for the current sector, data blocks 0, 1, and 2 can be used to store user-defined data information. That is, each sector has 48 bytes of space available for access control multi-key data storage.

[0065] In this embodiment, to more effectively utilize the storage space within the sector, the access control card application employs a symmetric encryption hybrid multidimensional encryption algorithm. Data storage is encoded using the TLV method.

[0066] In this embodiment, the information to be stored in the sector space includes the actual start and end times of access card authorization, coprime function values, and symmetric encryption values.

[0067] The start and end times for access card authorization are defined using data storage bits: 1 byte for identifier data length, 10 bytes for storage space, and 1 byte for data verification value. For coprime function values, the identifier data length is 1 byte, and the storage space is 1 byte. For symmetric encryption values, the identifier data length is 1 byte, and the storage space is 33 bytes.

[0068] The principle of the multi-dimensional key encryption and decryption algorithm of this invention is demonstrated as follows:

[0069] In the multi-dimensional key encryption and decryption method of this invention, the following parameters mainly exist, which can be respectively attributed to the key and the encryption / decryption operation:

[0070] P x A single-user key must be a prime number not less than the value of the encrypted data. The single-user keys of different users participating in encrypting the same set of published and transmitted data must be independent and unique.

[0071] P n Auxiliary key: An optional parameter, which must be a prime number not less than the value of the single-user key. It is recommended to use an auxiliary key when transmitting or publishing data through insecure communication channels to increase the difficulty of deducing the key from the source.

[0072] N: Key length value, which is the product of all single-user keys involved in data encryption and decryption. That is, when there are three single-user keys (P... A P B P C When participating in data encryption and decryption operations, N = P A *P B *P C ;

[0073] The Euler's totient function value of the key length. Assume the key length is three single-user keys (P...). A PB P C When multiplying the single-user key and the auxiliary key, since both are prime numbers, the Euler totient function value is...

[0074] e: a coprime integer, and For coprime integers, the range of values ​​is:

[0075] d: e relative to The modular inverse element, namely:

[0076] m: Original data. When the amount of original data is large (e.g., strings) or the value is large (e.g., integers, long integers, floating-point numbers, double precision), it can usually be split into multiple consecutive single-byte arrays, with each single byte having a value of 0 ≤ m ≤ 255;

[0077] c: Encrypted data.

[0078] The data encryption formula in the multi-dimensional key encryption / decryption method of this patent is as follows:

[0079] m d ≡c (mod N)

[0080] That is, the method for calculating encrypted data c is to raise the original data value m to the power of d (modular inverse element), divide by N (key length value) and take the remainder.

[0081] The algorithm principle underlying this patent's multi-dimensional key encryption and decryption method is as follows:

[0082] c e ≡m(mod P x )

[0083] That is, the calculation method for data decryption is to raise the encrypted data value c to the power of e (a coprime integer), divided by P. x (Single-user key) Modulo operation.

[0084] The decryption calculation principle of this algorithm will now be demonstrated. If the decryption is proven to be correct, then the multi-dimensional key encryption and decryption method of this invention is valid.

[0085] According to encryption algorithm m d ≡c(modN), this equation can be transformed into:

[0086] c + k * N = m d

[0087] Note: Let k be a positive integer.

[0088] c = m d -k*N

[0089] Substitute this formula into the decryption algorithm c e ≡m(mod P x In ), then:

[0090] (m d -k*N) e ≡m(mod P x )

[0091] Since N is P x For positive integer multiples of N, after splitting the polynomial on the left side of the equation, every term that has a k*N term can be P. x Divisible by integer, so after removing k*N terms, it can be simplified to:

[0092] m e*d ≡m(mod P x )

[0093] Since d is relative to e The modular inverse element, namely: but:

[0094]

[0095] Note: Let h be a positive integer.

[0096] Substituting into the previous equation:

[0097]

[0098] That is: when the equation At the time of its establishment, the multi-dimensional key encryption and decryption algorithm of this patent was correct.

[0099] Since the value of N is the product of multiple prime numbers greater than m, N and m must be coprime. According to Euler's theorem, the equation... If true, then:

[0100]

[0101] Note: Let k be a positive integer.

[0102] Since the equation remains an equation with values ​​of the same power on both sides, that is:

[0103]

[0104] After splitting the right side of the equation, all terms containing k*N are divisible by N, so it can be transformed into:

[0105]

[0106]

[0107] Since m < N, after multiplying both sides of the equation by m, the equation still holds:

[0108]

[0109]

[0110] Since N is a positive integer multiple of P x the equation can be written as:

[0111]

[0112] Note: k' is a positive integer.

[0113] Since P x > m, then:

[0114]

[0115] Therefore, the multi-key encryption and decryption algorithm of this patent holds.

[0116] Several other concepts related to the multi-dimensional key encryption and decryption algorithm in this invention are described as follows:

[0117] 1. Permission quadrants and shared relatively prime integers. In the multi-dimensional key encryption and decryption algorithm, according to the different user permissions for transmitting and publishing information, it is divided into several data quadrants that are either exclusively owned by a single user or shared by multiple users. For a single user, the quadrant data with permissions needs to use its single-user key to participate in encryption. Only the key participating in encryption can successfully decrypt the data.

[0118] Since there are multiple quadrants in the transmitted and published data, by using the method of "shared relatively prime integers", the relatively prime integers used for decrypting each quadrant are set to the same value, which can reduce the transmission of decryption parameters and improve the efficiency of decryption operations.

[0119] 2. Key value range and data confidentiality requirements. When the encrypted data can be split by single byte, the encrypted data (stream) can be split into a single-byte array, and each byte in this array is used as an encryption element and encrypted and decrypted separately. Therefore, the single-user key generally uses a prime number greater than 255.

[0120] When the data to be encrypted has a high confidentiality requirement, it can be set as an extremely large prime number. For example, using single-user keys and auxiliary keys of extremely large prime numbers with more than 384 (or larger) binary digits, when the key length value reaches a level where the current computer program cannot perform factorization, the security of the transmitted and published information can be guaranteed to a certain extent.

[0121] 3. Explanation of the differences between the multi-key encryption / decryption algorithm and the RSA algorithm: Both the multi-key encryption / decryption algorithm and the RSA algorithm originate from Euler's theorem, and there are many similarities in their principle demonstrations. However, they also have many differences: RSA is an asymmetric data encryption / decryption algorithm, where the public key used for encryption and the private key used for decryption are completely different; in the multi-key encryption / decryption algorithm, the encryption key is generated by multiple single-user keys, and each single-user key is used for decryption, thus it is not an asymmetric key algorithm. The RSA algorithm is for data encryption and decryption of a single user; the multi-key encryption / decryption algorithm is for data encryption and decryption of multiple users' data permissions in parallel, and the information permission boundaries of each user can be set separately.

[0122] This invention combines multidimensional key algorithms with symmetric key encryption. The symmetric key encrypts the original data, and the multidimensional algorithm then encrypts this key. During decryption, the multidimensional key algorithm decrypts the key, and the decrypted key is used to calculate the decryption of the original data. The purpose of this approach is twofold: First, multidimensional key encryption involves extremely large power operations, resulting in lengthy computation times. While encrypting and decrypting a single byte individually may not take much time, it adds tens or hundreds of times the time compared to ordinary symmetric encryption algorithms. When the amount of encrypted data is large, the encryption and decryption times become extremely long. Second, multidimensional key encryption produces very large data volumes. Encrypting data byte-by-byte could result in data that is ten or even tens of times larger than the original data, posing a significant challenge for data transmission and distribution. This embodiment simplifies the computation and improves efficiency by combining multidimensional key algorithms with symmetric key encryption.

[0123] This invention relates to a special scenario function implemented in an existing access control system by optimizing the access control terminal algorithm. It can be applied to scenarios such as temporary access cards in commercial buildings, centralized large-scale card permission setting operations, and applications with a very large number of accessible personnel / cards.

[0124] For temporary access cards in commercial buildings, visitors and couriers are the most common functions requiring temporary access cards in buildings using access control systems. However, because temporary cards should have time limits and specified access restrictions, building management often cannot provide the corresponding services based on existing hardware capabilities without the necessary technical support. Therefore, the more common practices are: 1. Notifying the person being visited or the recipient by phone to come to the building lobby for pickup or goods exchange; 2. Abandoning the existing access control system and allowing free access regardless of whether an access card is available.

[0125] In such cases, by applying multi-dimensional key algorithms to upgrade the access control terminal firmware and access control system software, access control terminals can be quickly made available without authorization under existing hardware and network conditions, thereby improving the service quality of commercial office buildings.

[0126] For large-scale card permission setting operations, such as the construction or upgrading of new access control systems in buildings and parks, and similar times like the graduation of graduating students and the registration of new students on campus, there are usually concentrated periods of large-scale access control card authorization or revocation. Due to operation delays, the card issuance and setting speed cannot keep up with the on-site users' card retrieval requirements; some systems also use background tasks for card authorization operations, but because the card setting operation cannot be tracked, it often happens that the access control terminal has not yet authorized the card before the card is swiped.

[0127] The application of multi-dimensional key algorithms provides an effective solution for offloading access control authorization operations in such scenarios. Specifically, when opening a card, the multi-dimensional key method is used to store the access authorization for a certain period of time in the card. At the same time, the card access authorization operation is scheduled to be performed in the background, and the authorization operation is performed when the system data communication is relatively idle.

[0128] For situations involving an extremely large number of authorized personnel / cards, such as the gates of large-scale parks requiring authorization for tens of thousands or even more people, access control systems often place extremely high performance demands on terminal card database storage and card database indexing. Due to the large database capacity, even with optimized card number addressing procedures, confirming the authorization of a single card number can still take a considerable amount of time. Some systems in these scenarios employ a "black card" management mode, which only blocks cards that are not authorized to enter, allowing all cards outside the black card range to pass, thus lowering management standards. Using a multi-dimensional key algorithm allows access control terminals to quickly identify whether a card is authorized for passage. Furthermore, by customizing the card sector data content, access control terminals can obtain more information, such as department, work group, and shift, thereby achieving more effective management.

Claims

1. A method for implementing authorization-free access control card terminals using multi-dimensional key encryption and decryption algorithms, characterized in that: Includes the following steps: S1, Establish a terminal unauthorized key and parameter system in the access control system; The terminal unauthorized key and parameter system operation in step S1 includes the following steps: S11, The access control system generates and distributes a single-user key P for a multi-dimensional encryption / decryption algorithm for each access control terminal. x ; S12, for the access control system, the permission schemes for various access control combinations are divided into several different permission quadrants; S13, Calculate and generate the key length value N for each permission quadrant. y and Euler's totient function value S14, determine the coprime integers e in each quadrant. y coprime integers e y Euler totient function values ​​in each quadrant All are coprime; S15, Calculate the modulo inverse element value d in each quadrant. y ; S2, based on access control requirements, determine the corresponding permission quadrant and access control terminal condition comparison parameters; S3, using the comparison condition parameters determined in step S2 as the original data to be transmitted, calculate the check code; S4: Randomly generate a symmetric key and perform symmetric encryption calculations on the data to be transmitted; S5, using the permission quadrant parameter (N) determined in step S2. y d y The symmetric key generated in step S4 is then used for encryption calculation using a multidimensional key algorithm, i.e., using the modulo inverse element value d. y The power value of the symmetric key in step S4 is calculated, and then divided by the key length N in that quadrant. y The remainder is used as the symmetric key encryption value; S6, create an access control card according to the data format of the access control terminal's unauthorized card, and write the following information into the access control card: the symmetric encrypted data of the access control terminal's comparison condition parameters and the original data verification value, and the coprime integer e of the permission quadrant confirmed in step S2. y , and the multi-dimensional key encryption value of the symmetric key; S7: The access control terminal reads the access card. When the access card contains information that conforms to the unauthorized data format, it decrypts the information using a multi-dimensional key encryption algorithm and determines whether to allow or deny access.

2. The method for implementing authorization-free access control card terminals using a multi-dimensional key encryption / decryption algorithm according to claim 1, characterized in that: The access control terminal condition comparison parameter is the access card's valid time period, including the start and end times.

3. The method for implementing authorization-free access control card terminals using a multi-dimensional key encryption / decryption algorithm according to claim 2, characterized in that: The time values ​​within the effective time period are stored using a data bit definition method.

4. The method for implementing authorization-free access control card terminals using a multi-dimensional key encryption / decryption algorithm according to claim 1, characterized in that: The single-user key P x The keys are stored separately in the access control terminal and the access control system. The access control terminal only stores its own single-user key, which is used for decrypting the terminal's unauthorized access card. The access control system stores the single-user keys of all access control terminals in the system, which are used to create unauthorized access control cards for the access control terminals.

5. The method for implementing authorization-free access control card terminals using a multi-dimensional key encryption / decryption algorithm according to claim 1 or 4, characterized in that: The single-user key P x The range of values ​​for is a prime number not less than 255.

6. The method for implementing authorization-free access control card terminals using a multi-dimensional key encryption / decryption algorithm according to claim 1, characterized in that: The key length value N y The calculation method is to calculate all single-user keys P in this quadrant. x The product of the products, the Euler totient function value The calculation method is to calculate all single-user keys P in this quadrant. x The product of -1 values.

7. The method for implementing unauthorized access control card terminals using a multi-dimensional key encryption / decryption algorithm according to claim 1, characterized in that: The range of values ​​for the coprime integer e is:

8. The method for implementing authorization-free access control card terminals using a multi-dimensional key encryption / decryption algorithm according to claim 1, characterized in that: In step S15, the modular inverse element value d y The calculation method is as follows:

9. The method for implementing authorization-free access control card terminals using a multi-dimensional key encryption / decryption algorithm according to claim 1, characterized in that: In step S7, when performing the decryption operation of the multi-dimensional key algorithm, the symmetric key encrypted value and the coprime function value are obtained. The coprime function power of the symmetric key encrypted value is calculated and divided by the single-user key of the current access control terminal to calculate the symmetric key value. The authorized condition comparison parameters are calculated using the symmetric key and the verification value is compared. If the verification passes and the condition comparison parameter comparison also passes, the card is allowed to pass. Otherwise, the card database query for the current card number is performed again. Cards within the authorized range are allowed to pass, and unauthorized cards are not allowed to pass.

10. The method for implementing authorization-free access control card terminals using a multi-dimensional key encryption / decryption algorithm according to claim 1, characterized in that: The symmetric key encryption operation method in step S4 includes, but is not limited to, one or more of the following symmetric encryption operations: XOR, modular addition, modular multiplication, DES, or 3DES.

Images