Data interaction method of check-in system, check-in system and computer device

Abstract

The application relates to a data interaction method of a check-in system, a check-in system and a computer device. When a user password fed back by a server is acquired, a password synchronization header can be determined by determining original data of privacy and first local information associated with a user end; the original data is encrypted by the user password and the first local information to obtain encrypted data; when the encrypted data and the password synchronization header are data-encapsulated, encapsulated data sent to the server is obtained. Since the password synchronization header is a generation element of an encryption key, and each original data corresponds to an encryption key, when privacy protection of a large amount of user data is involved, the encrypted data and the password synchronization header are directly data-encapsulated, a password fed back by the server does not need to be acquired, and the password can be dynamically generated without being set by the user, so that the security strength of interaction between user data is improved.

Description

Technical Field

[0001] This application relates to the field of teaching management, and in particular to a data interaction method, a check-in system, and computer equipment for a check-in system. Background Technology

[0002] Currently, enterprises manage their time and attendance systems by deploying time and attendance terminals and backend servers. These systems typically employ password, fingerprint, and facial recognition methods, requiring a certain level of fixed investment and network deployment. Furthermore, personal information collection and binding to the attendance system are necessary during operation. However, in higher education, such as university English classes which are primarily taught in large classrooms, the amount of student personal information collected is substantial. Since teaching locations vary each semester, multiple bindings to attendance terminals are required, making system management inconvenient and posing a risk of personal information leakage during storage and transmission.

[0003] Therefore, how to manage check-in information for a large amount of users and ensure the security of data exchange between users is a problem that needs to be solved at this stage. Summary of the Invention

[0004] Based on this, the purpose of this application is to provide a data interaction method, check-in system, computer device, and readable storage medium that ensure the security of user data interaction, so as to solve the technical problems mentioned in the background art.

[0005] Firstly, this application provides a data interaction method for a check-in system, applied to the user end. This includes:

[0006] When the user password is received from the server, the original data to be sent is determined, and the password synchronization header is determined based on the first local information associated with the user terminal.

[0007] The original data is encrypted using the user password and the first local information to obtain encrypted data;

[0008] The encrypted data and the cryptographic synchronization header are encapsulated to obtain encapsulated data;

[0009] The encapsulated data is sent to the server so that the server can decrypt the encapsulated data to obtain the decrypted original data.

[0010] In one embodiment, the first local information includes the first time and the first latitude and longitude corresponding to the user terminal; determining the password synchronization header based on the first local information associated with the user terminal includes: determining the low-order time bit in the first time and the low-order latitude and longitude bit in the first latitude and longitude bit; concatenating the low-order time bit in the first time and the low-order latitude and longitude bit in the first latitude and longitude bit to obtain the password synchronization header.

[0011] In one embodiment, encrypting the original data using the user password and the first local information to obtain encrypted data includes: associating the user password and the first local information using a preset key generation algorithm to obtain an encryption key; and encrypting the original data using a preset block cipher algorithm and the encryption key to obtain encrypted data.

[0012] In one embodiment, the encrypted data and the cryptographic synchronization header are encapsulated to obtain encapsulated data, including: determining the data frame of the encrypted data; the data frame includes at least frame length, message type, message payload, and frame checksum; and encapsulating the data frame and the cryptographic synchronization header according to a preset data frame format to obtain encapsulated data.

[0013] In the data interaction method of the aforementioned check-in system, when the user password fed back by the server is obtained, the password synchronization header can be determined by identifying the original data containing privacy and the first local information associated with the user's client. The original data is then encrypted using the user password and the first local information to obtain encrypted data. Finally, the encrypted data and the password synchronization header are encapsulated to obtain the encapsulated data sent to the server. Since the password synchronization header is a key generation element, and each piece of original data corresponds to a unique encryption key, when protecting the privacy of large amounts of user data, the encrypted data and password synchronization header can be directly encapsulated without needing to obtain the password fed back by the server or for the user to set it manually. This enhances the security of data exchange between users.

[0014] Secondly, this application provides a data interaction method for a check-in system, applied to a server. This includes:

[0015] When the encapsulated data fed back by the user is obtained, the corresponding user password is determined, and the password synchronization header is read from the encapsulated data;

[0016] Based on the password synchronization header and the second local information associated with the server, the first local information associated with the encapsulated data is recovered;

[0017] The encapsulated data is decrypted using the user password and the first local information to obtain the decrypted original data.

[0018] In one embodiment, recovering the first local information associated with the encapsulated data based on the second local information associated with the password synchronization header and the server includes: determining the target low-order information in the password synchronization header and the second low-order information associated with the second local information; performing modulo operation on the target low-order information and the second low-order information to obtain an information difference; and determining the first local information associated with the encapsulated data based on the target numerical range to which the information difference belongs.

[0019] In one embodiment, decrypting the encapsulated data using the user password and the first local information to obtain the decrypted original data includes: associating the user password and the first local information using a preset key generation algorithm to obtain a decryption key; and decrypting the encapsulated data using a preset block cipher algorithm and the decryption key to obtain the decrypted original data.

[0020] Thirdly, this application also provides a check-in system, including a client and a server, wherein:

[0021] On the user end, when obtaining the user password returned by the server, the original data to be sent is determined, and a password synchronization header is determined based on the first local information associated with the user end; the original data is encrypted using the user password and the first local information to obtain encrypted data; the encrypted data and the password synchronization header are encapsulated to obtain encapsulated data.

[0022] When the server receives encapsulated data from the user, it determines the corresponding user password and reads the password synchronization header from the encapsulated data. Based on the password synchronization header and the second local information associated with the server, it recovers the first local information associated with the encapsulated data. Using the user password and the first local information, it decrypts the encapsulated data to obtain the decrypted original data.

[0023] Fourthly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the data interaction method of the above-mentioned check-in system.

[0024] Fifthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the data interaction method of the aforementioned check-in system.

[0025] The aforementioned check-in system's data interaction method, check-in system, computer equipment, and readable storage medium, upon receiving encapsulated data from the user's end, can determine the corresponding user password and read the password synchronization header from the encapsulated data. Based on the password synchronization header and the second local information associated with the server, the first local information associated with the encapsulated data can be directly recovered. Then, using the user password and the first local information, the encapsulated data is decrypted to obtain the decrypted original data. Since the password synchronization header is the element that generates the decryption key, and each piece of original data corresponds to a separate encryption key, when privacy protection of large amounts of user data is involved, the encapsulated data can be directly recovered from the password synchronization header without having to send the password back to the user's end, thus improving the security strength of user data interaction. Attached Figure Description

[0026] Figure 1 This is an application environment diagram of a check-in system in one embodiment;

[0027] Figure 2 This is a flowchart illustrating the data interaction method of a check-in system in one embodiment;

[0028] Figure 3 This is a flowchart illustrating the data interaction method of a check-in system in one embodiment.

[0029] Figure 4 This is a flowchart illustrating the data interaction method of the check-in system in another embodiment;

[0030] Figure 5 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0031] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0032] The data interaction method for the check-in system provided in this application embodiment can be applied to, for example... Figure 1 The attendance system shown is comprised of a user terminal and a server. The user terminal includes a teacher's terminal and a student's terminal. The application software for the user terminal is provided by a third party. Teachers or students can download the application software via smartphones or tablets. The teacher's application software includes modules such as registration / login, classroom management, student management, attendance statistics, spatiotemporal data acquisition, privacy protection, and QR code projection. The student's application software includes modules such as registration / login, spatiotemporal data acquisition, privacy protection, and QR code scanning for attendance. The third-party server includes modules such as attendance management, QR code management, spatiotemporal data acquisition, privacy protection, and attendance recognition.

[0033] For the teacher's client, the module includes: Registration / Login: Teachers fill in personal information such as name, contact information, university name, and college / department / major name. Course Management: Teachers fill in course information in the course management interface. Student Management: Teachers fill in or import student information in the student management interface. Attendance Statistics: Teachers manage student attendance statistics in the attendance management interface. Spatiotemporal Data: Teachers obtain local time and coordinates. Privacy Protection: A real-time privacy protection key is used between the teacher and server to encrypt teacher registration and classroom management information using a cryptographic algorithm. This key is generated based on the user password sent via SMS, the teacher's local time, and local coordinates. QR Code Projection: The module receives encrypted dynamic QR codes from the server, decrypts them, projects them onto the classroom wall for students to scan, and notifies the server when attendance ends, thus exiting the system.

[0034] Among them, teachers have three roles: one is the university student administrator, who can import student information in batches and add new student information; the second is the course manager, who can add courses, delete courses, and modify courses; and the third is the statistician, who can query attendance information and export statistical scoring information.

[0035] For the server, the spatiotemporal data module obtains local time and latitude / longitude, and recovers the complete time and latitude / longitude corresponding to the private information sent by teachers or students. The privacy protection module uses a privacy protection key between teachers / students and the server. It decrypts and restores teacher registration information and classroom management information using a password algorithm, and decrypts and restores student registration information and returned QR code information using the same password algorithm. The privacy protection key is generated based on three elements: the user password generated by the server, the complete time and latitude / longitude corresponding to the private information sent by the teacher or student. The attendance management module manages the decrypted and restored teacher / student registration / login information and attendance information. It can score student attendance information according to scoring rules and maintain the attendance system database. The QR code management module dynamically generates attendance QR codes on a regular basis, encrypts them using the privacy protection key, and sends them to the teacher. The attendance recognition module recognizes and judges the dynamic QR codes scanned and uploaded by students, determines whether the QR code is scanned within a preset time, and determines whether the distance between the student and teacher is within a preset range based on the student's latitude / longitude.

[0036] For the student client: Registration / Login Module: Used for students to fill in personal information such as name, contact information, university name, college / department / major, and courses. Spatiotemporal Data Module: Used to obtain local time and latitude / longitude. Privacy Protection Module: Used for a privacy protection key between students and the server. This key encrypts student registration / login information, attendance QR codes, and other private information using a cryptographic algorithm. The privacy protection key is generated by the server using the user's password sent via SMS, the student's local time, and local latitude / longitude. QR Code Attendance Module: Used to scan classroom attendance QR codes and encrypt them using the privacy protection key.

[0037] Therefore, when the attendance system is running, teachers or students perform various application operations by opening the application software. Their respective data transmission and reception monitoring units monitor data from the network, receiving or sending encrypted privacy information in real time and processing it accordingly, thus completing student attendance and various attendance management functions. Specifically, on the user end, when obtaining the user password from the server, the system determines the original data to be sent and, based on the first local information associated with the user end, determines the password synchronization header; it encrypts the original data using the user password and the first local information to obtain encrypted data; and it encapsulates the encrypted data and the password synchronization header to obtain encapsulated data. On the server end, when obtaining the encapsulated data from the user end, the system determines the corresponding user password and reads the password synchronization header from the encapsulated data; it recovers the first local information associated with the encapsulated data based on the password synchronization header and the second local information associated with the server; and it decrypts the encapsulated data using the user password and the first local information to obtain the decrypted original data.

[0038] In one embodiment, the check-in system is based on a B / S service architecture.

[0039] In one embodiment, such as Figure 2 As shown, a data interaction method for a sign-in system is provided. Since the process of teachers or students performing sign-in management functions through application software is basically similar, for the sake of simplicity, this method is applied to... Figure 1 Taking the teacher's client as an example, the data encryption process is performed by the teacher's client as the sender, including the following steps:

[0040] Step 202: When the user password returned by the server is obtained, the original data to be sent is determined, and the password synchronization header is determined according to the first local information associated with the user terminal.

[0041] When the user terminal is a teacher's terminal, the raw data consists of the teacher's private information. The first local information includes the teacher's corresponding first time (Time) and first latitude and longitude. The first time is the teacher's local time or network time, expressed as a 14-digit decimal number (year, month, day, hour, minute, second), where Time = T.i 14 T1 i 1≤i≤14; The first latitude and longitude is the teacher's local latitude and longitude, which can be converted from degrees, minutes, and seconds to decimal seconds with an accuracy of 0.1 seconds (representing 3 meters), totaling 7 decimal digits, denoted as longitude Lon=lon j 7 lon1 j , 1≤j≤7, latitudeLat=lat j 7 lat1 j , 1≤j≤7.

[0042] Specifically. For example... Figure 3 As shown, Figure 3 This document presents a flowchart illustrating the data interaction method for an attendance system. When a teacher activates the attendance system, the client obtains the user password X_pwd from the server. X_pwd includes the teacher's corresponding user password T_Pwd. The client then responds to the teacher's input of privacy information, determining the original data to be sent. The client constructs a corresponding password synchronization header CH-syn based on the teacher's local time and latitude / longitude. This password synchronization header is used for key generation between the data sender and receiver.

[0043] In one embodiment, determining the password synchronization header based on the first local information associated with the user terminal includes: determining the low-order time bit in the first time and the low-order latitude and longitude bit in the first latitude and longitude; concatenating the low-order time bit in the first time and the low-order latitude and longitude bit in the first latitude and longitude to obtain the password synchronization header.

[0044] Among them, the lower latitude and longitude positions in the first latitude and longitude include the lower longitude position and the lower latitude position.

[0045] Specifically, after the user terminal obtains the first time and first latitude and longitude corresponding to the teacher terminal based on the spatiotemporal data module, it determines the lower time byte in the first time and the lower latitude and longitude byte in the first latitude and longitude, such as extracting the lower 1 bit of the time byte T_T1. 1 The low-i-bit longitude and low-i-bit latitude T_lon1 i T_lat1 i Therefore, the user end concatenates the low-order timestamp from the first time interval, the low-order longitude and low-order latitude from the first latitude and longitude interval to obtain the password synchronization header CH-syn = T_T1. 1 ||T_lon1 i ||T_lat1 i .

[0046] In this embodiment, by concatenating the low-order timestamps and low-order latitude and longitude coordinates, the fusion of time and location information is achieved, which helps to identify and synchronize data, ensures the correlation and consistency of the cryptographic synchronization header across different time and spatial locations, and enables the encryption or decryption key to be accurately obtained subsequently based on the cryptographic synchronization header.

[0047] Step 204: Encrypt the original data using the user password and the first local information to obtain encrypted data.

[0048] Specifically, the user terminal obtains the encryption key based on the user password and the first local information, and uses the encryption key to encrypt the original data to obtain encrypted data.

[0049] In one embodiment, encrypting the original data using a user password and first local information to obtain encrypted data includes: associating the user password and first local information using a preset key generation algorithm to obtain an encryption key; and encrypting the original data using a preset block cipher algorithm and the encryption key to obtain encrypted data.

[0050] The key generation algorithm is a symmetric encryption method used when transmitting private information between the user end and the server. The same encryption or decryption key is used between the teacher's end and the server, and the same encryption or decryption key is used between the student's end and the server. The key generation algorithm can use the domestic hash algorithm SM3, outputting the lower 128 bits of a 256-bit sequence. The preset block cipher algorithm includes the SM4 block cipher algorithm, with a block length of 128 bits and a 128-bit key. The encryption mode uses cipher block chaining mode.

[0051] Specifically, refer to Figure 3 As shown, the client associates the user password with the first local information to obtain the encryption key XX-key: XX-key=SM3(Init, Pwd, Time, Lon, Lat).

[0052] Among them, XX-key includes TS-key for the teacher and SS-key for the student; Init is the SM3 initialization constant and padded to 512 bits; Pwd is the user password provided by the server via SMS when the teacher or student registers, which is an 8-bit ASCII character or decimal number; X_pwd includes the user password T_Pwd for the teacher and S_Pwd for the student; Time includes the local time or network time of the teacher or student, i.e., the first time; Lon and Lat are the local longitude and latitude of the teacher or student, i.e., the first latitude and longitude.

[0053] Next, when the user terminal is the teacher terminal, the user terminal encrypts the original data using a preset block cipher algorithm and encryption key, resulting in encrypted data EMF=SM4-E(TS_key, MF). Here, MF represents the data frame transmitted between the teacher terminal and the server.

[0054] In this embodiment, by associating the user password with the first local information and generating an encryption key using a key generation algorithm, the connection between the password and the specific local information can be established. This helps improve the security and randomness of the password and reduces the risk of the password being cracked or forged. By using a block cipher algorithm to group and transform the data, combined with the encryption key, the purpose of protecting and keeping the data confidential is achieved, preventing unauthorized users from accessing and interpreting the data during transmission or storage.

[0055] Step 206: Encapsulate the encrypted data and the password synchronization header to obtain encapsulated data.

[0056] In one embodiment, the encrypted data and the password synchronization header are encapsulated to obtain encapsulated data, including: determining the data frame of the encrypted data; and encapsulating the data frame and the password synchronization header according to a preset data frame format to obtain encapsulated data.

[0057] The data frames transmitted between the teacher's end, the student's end, and the server must include at least the frame length, message type, message payload, and frame checksum, such as MF = frame length || message type || message payload || frame checksum. The frame length is the length of the transmitted data frame; the message type includes registration, login, check-in initiation, QR code push, QR code acquisition, check-in, check-in statistics, etc.; the message payload includes the teacher's privacy information such as registration, login, check-in initiation, and QR codes; the frame checksum is a 32-bit CRC error detection code.

[0058] Specifically, the user terminal encapsulates the encrypted EMF data frame and the password synchronization header according to a preset data frame format, resulting in a frame format of: Message Source Identifier | Password Synchronization Header | Frame Length | Message Type | Message Payload | Frame Checksum. The Message Source Identifier serves as the identifier between the teacher's client and the server, used for identification between them.

[0059] Step 208: Send the encapsulated data to the server so that the server can decrypt the encapsulated data to obtain the decrypted original data.

[0060] It's easy to understand that when the user is a student, the original data is the student's private information. In this case, the student performs the data encryption process, which is similar to the teacher's data encryption process described above. The only difference is that the parameters T_Pwd, T_T, T_Lon, and T_Lat are replaced with S_Pwd, S_T, S_Lon, and S_Lat, respectively, and T_T1 is changed to... 1 T_Lon1 i T_Lat1 i Replace with S_T1 1 S_Lon1 i S_Lat1 i Replace TS_key with SS_key.

[0061] In the data interaction method of the aforementioned check-in system, when the user password fed back by the server is obtained, the password synchronization header can be determined by identifying the original data containing privacy and the first local information associated with the user's client. The original data is then encrypted using the user password and the first local information to obtain encrypted data. Finally, the encrypted data and the password synchronization header are encapsulated to obtain the encapsulated data sent to the server. Since the password synchronization header is a key generation element, and each piece of original data corresponds to a unique encryption key, when protecting the privacy of large amounts of user data, the encrypted data and password synchronization header can be directly encapsulated without needing to obtain the password fed back by the server or for the user to set it manually. This enhances the security of data exchange between users.

[0062] In one embodiment, such as Figure 4 As shown, a data interaction method for a sign-in system is provided. To simplify the description, the method is illustrated using the encapsulated data obtained from the teacher's feedback as an example, and its application is discussed below. Figure 1 The server in the process, that is, the server acting as the receiver, performs the data decryption process, which includes the following steps:

[0063] Step 402: When the encapsulated data fed back by the user is obtained, the corresponding user password is determined, and the password synchronization header is read from the encapsulated data.

[0064] Specifically, refer to Figure 3 As shown, when the encapsulated data fed back from the teacher's end is obtained, the server directly determines the user password fed back to the teacher's end when the teacher triggers the sign-in system, and reads the password synchronization header CH-syn associated with the teacher's end from the encapsulated data sent in privacy.

[0065] Step 404: Based on the password synchronization header and the second local information associated with the server, recover the first local information associated with the encapsulated data.

[0066] The second local information includes the second time and the second latitude and longitude corresponding to the server.

[0067] Specifically, the server obtains the associated second local information based on the spatiotemporal data module and determines the second low-order information associated with the second local information. The second low-order information includes the low-order time in the second time and the low-order longitude and latitude in the second latitude and longitude, such as the low-order time byte Sv_T1. 1 The low-i latitude and longitude coordinates of the low-i Sv_lon1 i 、Sv_lat1 i The server reconstructs the first local information of the teacher's end from the password synchronization header and the second least significant bit information.

[0068] Step 406: Decrypt the encapsulated data using the user password and the first local information to obtain the decrypted original data.

[0069] Specifically, the server obtains the decryption key based on the user's password and the first local information, and uses the decryption key to decrypt the encapsulated data to obtain the decrypted original data.

[0070] In one embodiment, decrypting the encapsulated data using a user password and first local information to obtain the decrypted original data includes: associating the user password and first local information using a preset key generation algorithm to obtain a decryption key; and decrypting the encapsulated data using a preset block cipher algorithm and the decryption key to obtain the decrypted original data.

[0071] Specifically, refer to Figure 3 As shown, the server associates the user password corresponding to the teacher with the first local information to obtain the decryption key XX-key: XX-key=SM3(Init, T_Pwd, Time, Lon, Lat). The server decrypts the encapsulated data using a preset block cipher algorithm and the decryption key to obtain the decrypted original data MF=SM4-D(TS_key, EMF).

[0072] In the data interaction method of the aforementioned check-in system, when the encapsulated data fed back by the user is obtained, the corresponding user password can be determined, and the password synchronization header can be read from the encapsulated data. Based on the password synchronization header and the second local information associated with the server, the first local information associated with the encapsulated data can be directly recovered, and the encapsulated data can be decrypted using the user password and the first local information. Since the password synchronization header is the element that generates the decryption key, and each piece of original data corresponds to a separate encryption key, when privacy protection of a large amount of user data is involved, the encapsulated data can be recovered directly from the password synchronization header without having to feed the password back to the user, thus improving the security strength of the interaction between user data.

[0073] In one embodiment, recovering the first local information associated with the encapsulated data based on the second local information associated with the password synchronization header and the server includes: determining the target low-order information in the password synchronization header and the second low-order information associated with the second local information; performing modulo operation on the target low-order information and the second low-order information to obtain the information difference; and determining the first local information associated with the encapsulated data based on the target numerical range to which the information difference belongs.

[0074] The second local information includes the second time and the second latitude and longitude corresponding to the server; the second low-order information includes the low-order time in the second time and the low-order latitude and longitude in the second latitude and longitude; the low-order latitude and longitude in the second latitude and longitude includes the low-order longitude and the low-order latitude.

[0075] Specifically, assuming the server is located outside the province, within the province, or within the city, and the straight-line distance between it and the user terminal is 3000 kilometers, 300 kilometers, and 30 kilometers respectively, that is, assuming the longitude or latitude difference between the server and the user terminal is 10... 6 10 5 10 4 Each 0.1 second (0.1 second ≈ 3 meters) corresponds to a value of 6, 5, and 4 respectively. To facilitate the calculation and comparison of longitude or latitude, the longitude or latitude is divided by 2. The server or user terminal has Beidou or network real-time time synchronization. It is assumed that the time of receiving the message is always behind the time of sending the message. For example, it is assumed that the maximum delay of the receiver when sending a message between the server and the user terminal is 10 seconds.

[0076] Therefore, based on the above assumptions, the relationship between the first local information and the second local information can be obtained as follows:

[0077] |X_Lon-Y_Lon|=|X_lon1 i -Y_lon1 i |≤10 i+3 / 2; 1≤i≤3

[0078] |X_Lat-Y_Lat|=|X_lat1 i -Y_lat1 i |≤10 i+3 / 2; 1≤i≤3

[0079] |X_T-Y_T|=|X_T1 1 -Y_T1 1 |≤10.

[0080] Where X represents the teacher's end (S) or the student's end (T), and Y represents the server (Sv). At this point, the data receiver can completely recover the sender's time and latitude / longitude; that is, the server can completely recover the first local information corresponding to the teacher's end through the following methods.

[0081] When the target low-level information is the low-longitude position within the first latitude and longitude coordinates corresponding to the teacher's end, the second low-level information is the low-longitude position within the second latitude and longitude coordinates. The information difference is obtained by performing a modulo operation between the low-longitude positions in the first and second latitude and longitude coordinates. =(X_lon1 i -Y_lon1 i mod10 i+3 Next, based on the target numerical range to which the information difference belongs, the server determines the first longitude X_Lon in the first local information associated with the encapsulated data as follows:

[0082]

[0083] Similarly, when the target low-level information is the low-latitude position of the first latitude and longitude corresponding to the teacher's end, the second low-level information is the low-latitude position of the second latitude and longitude. The information difference is obtained by performing modulo processing on the low-latitude positions of the first and second latitude and longitudes. =(X_lat1 i -Y_lat1 i mod10 i+3 Next, based on the target numerical range to which the information difference belongs, the server determines the first dimension X_Lat in the first local information associated with the encapsulated data as follows:

[0084]

[0085] Similarly, when the target low-order information is the low-order time in the first time corresponding to the teacher's end, the second low-order information is the low-order time in the second time. By performing modulo processing on the low-order time in the first time and the low-order time in the second time, the information difference is obtained. =(Y_T1 1 -X_T1 1 mod10. Next, based on the target value range to which the information difference belongs, the server determines the first time X_T in the first local information associated with the encapsulated data as: X_T = Y_T - , .

[0086] In this embodiment, by performing modulo operations and calculating information differences, data security can be achieved. Furthermore, when determining the first local information associated with the encapsulated data, subsequent data security and privacy protection are strengthened, helping to prevent data leakage and tampering, and improving the security and trustworthiness of data transmission. Based on the target numerical range to which the information difference belongs, the associated information of the corresponding encapsulated data can be accurately obtained, thus enabling a more targeted determination of the first local information associated with the encapsulated data.

[0087] In one embodiment, the server verifies the validity of a student's QR code check-in by satisfying the following conditions:

[0088] |Sv_T-S_T|≤60 seconds

[0089] |T_Lon-S_Lon|≤3 seconds (approximately 90 meters)

[0090] |T_Lat-S_Lat|≤3 seconds (approximately 90 meters)

[0091] In other words, the student and teacher must be within 90 meters of each other, and the student must scan the dynamic QR code pushed by the server within 60 seconds for the check-in to be considered valid and successful.

[0092] In one embodiment, when the server dynamically pushes the QR code to the teacher's end, or when information feedback such as attendance statistics is provided, the server, as the sender, performs the data encryption process, and the teacher, as the receiver, performs the data decryption process.

[0093] The encryption process is as follows: The server retrieves the teacher's user password T_Pwd; the server's spatiotemporal data module obtains the second least significant bit information from the associated second local information, such as the lower 1 bit of time, Sv_T1. 1 The low-i latitude and longitude coordinates of the low-i Sv_lon1 i Sv_lat1; The server prepares the privacy information to be sent and concatenates the low-order timestamps of the second time and the low-order latitude and longitudes of the second latitude and longitude to obtain the password synchronization header CH-syn=Sv_T1. 1 ‖Sv_lon1 i ‖Sv_lat1 i The server calls a preset key generation algorithm to obtain the encryption key TS_key=SM3(Init, T_Pwd, Sv_T, T_Lon, T_Lat). At this time, Sv_Lon and Sv_Lat will be used as the Init data. The server calls a preset block cipher algorithm to encrypt the privacy information in the frame format to be sent to obtain the encrypted data EMF=SM4-E(TS_key, MF), adds a cipher synchronization header CH-syn, encapsulates the data according to the frame format requirements, and sends it to the teacher's end so that the teacher can decrypt the encapsulated data.

[0094] The decryption process is as follows: The teacher retrieves the user password T_Pwd; after obtaining the corresponding first time and first latitude and longitude from the spatiotemporal data module, the teacher determines the lower digit of the time in the first time and the lower digit of the latitude and longitude in the first latitude and longitude, such as retrieving the lower digit of the time T_T1. 1 The low-i latitude and longitude of the low-i-th bit T_lon1 i T_lat1 iExtract the low i-bit information of longitude and latitude T_lon1 i T_lat1 i The teacher's data transmission and reception monitoring module receives the privacy information sent by the server and reads the password synchronization header CH-syn. Based on the password synchronization header, the first time and the first latitude and longitude corresponding to the teacher, it recovers the second local information Sv_T, Sv_Lon, and Sv_Lat associated with the server. The teacher calls the preset key generation algorithm to calculate and decrypt TS_key=SM3(Init, T_Pwd, Sv_T, T_Lon, T_Lat). At this time, Sv_Lon and Sv_Lat will be used as Init to fill in the data. The teacher calls the preset block cipher algorithm to decrypt the received server frame format privacy information MF=SM4-D(TS_key, EMF).

[0095] In the above embodiment, the encryption and decryption keys between the teacher and the server contain three factors. The first is the user password returned by the server, such as an 8-digit login password specified via SMS. The second is the time factor for sending the original private data; assuming students scan the code to sign in within 10 minutes after the teacher opens the sign-in process, the time variation is at least 600 seconds. The third is the sender's latitude and longitude factor, or the latitude and longitude difference factor between the sender and receiver. The high-order bits of the sender's latitude and longitude are not transmitted through the actual network channel, resulting in a variation of 10. 2i This results in a precision unit (i=1, 2, 3) of 0.1 seconds, ensuring that the privacy-preserving key proposed in this invention varies by at least 10 units. 8 *600*10 2i =6*10 8+2i+2 This corresponds to approximately 8+5, 8+7, and 8+9 decimal digits, respectively. The number of digits that can be changed in a password is about twice that of a traditional single 8-digit decimal number, making its security much stronger than traditional passwords.

[0096] In one embodiment, the teacher's end and the server are encrypted bidirectionally, while the student's end and the server are encrypted unidirectionally. That is, the student's end sends encrypted private information to the server, and the server only sends user passwords and notification information to the student's end.

[0097] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0098] Based on the same inventive concept, this application also provides a data interaction device for implementing the data interaction method of the check-in system described above. The solution provided by this device is similar to the implementation described in the above method. Therefore, the specific limitations of one or more data interaction device embodiments of the check-in system provided below can be found in the limitations of the data interaction method of the check-in system above, and will not be repeated here.

[0099] In one embodiment, a data interaction device for a check-in system is provided, comprising: a password synchronization header determination module, an encrypted data determination module, and an encapsulated data transmission module, wherein:

[0100] The password synchronization header determination module is used to determine the original data to be sent when the user password is received from the server, and to determine the password synchronization header based on the first local information associated with the user terminal.

[0101] The encrypted data determination module is used to encrypt the original data using the user password and the first local information to obtain encrypted data; and to encapsulate the encrypted data and the password synchronization header to obtain encapsulated data.

[0102] The encapsulated data sending module is used to send encapsulated data to the server so that the server can decrypt the encapsulated data to obtain the decrypted original data.

[0103] In one embodiment, another data interaction device for a check-in system is provided, comprising: a data acquisition module, a local information recovery module, and a data decryption module, wherein:

[0104] The encapsulated data acquisition module is used to determine the corresponding user password when encapsulated data is received from the user terminal, and to read the password synchronization header from the encapsulated data.

[0105] The local information recovery module is used to recover the first local information associated with the encapsulated data based on the password synchronization header and the second local information associated with the server.

[0106] The encapsulated data decryption module is used to decrypt the encapsulated data using the user password and the first local information to obtain the decrypted original data.

[0107] The various modules in the data interaction of the aforementioned check-in system can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0108] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 5 As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a data interaction method for a check-in system.

[0109] Those skilled in the art will understand that Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0110] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0111] In one embodiment, a computer-readable storage medium is provided storing a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0112] In one embodiment, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and executes the computer instructions, causing the computer device to perform the steps in the above method embodiments.

[0113] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0114] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0115] The above embodiments are merely illustrative of several implementation methods of this application, and their descriptions are relatively specific and detailed. However, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A data interaction method for a check-in system, characterized in that, The method is applied to a server and includes: When the encapsulated data fed back by the user terminal is obtained, the corresponding user password is determined, and the password synchronization header is read from the encapsulated data; the encapsulated data is: encrypted data obtained by encrypting the original data with the user password and the first local information; the encrypted data and the password synchronization header are encapsulated to obtain the encapsulated data; the first local information includes the first time and the first latitude and longitude corresponding to the user terminal; the password synchronization header is obtained by concatenating the low-order time bits of the first time and the low-order latitude and longitude bits of the first latitude and longitude. Based on the password synchronization header and the second local information associated with the server, the first local information associated with the encapsulated data is recovered, including: determining the target low-order information in the password synchronization header and the second low-order information associated with the second local information; performing modulo operation on the target low-order information and the second low-order information to obtain an information difference; determining the first local information associated with the encapsulated data based on the target numerical range to which the information difference belongs; the second local information includes the second time and the second latitude and longitude corresponding to the server; the second low-order information includes the low-order time in the second time and the low-order latitude and longitude in the second latitude and longitude. The encapsulated data is decrypted using the user password and the first local information to obtain the decrypted original data.

2. The method according to claim 1, characterized in that, The step of decrypting the encapsulated data using the user password and the first local information to obtain the decrypted original data includes: The user password and the first local information are associated using a preset key generation algorithm to obtain a decryption key; The encapsulated data is decrypted using a preset block cipher algorithm and the decryption key to obtain the decrypted original data.

3. A data interaction method for a check-in system, characterized in that, The method is applied to the user terminal and includes: When the user password is received from the server, the original data to be sent is determined, and the password synchronization header is determined based on the first local information associated with the user terminal. The original data is encrypted using the user password and the first local information to obtain encrypted data; The encrypted data and the cryptographic synchronization header are encapsulated to obtain encapsulated data; The encapsulated data is sent to the server so that when the server decrypts the encapsulated data, the decrypted original data can be obtained. The data interaction of the server adopts the method of any one of claims 1 to 2.

4. The method according to claim 3, characterized in that, The step of encrypting the original data using the user password and the first local information to obtain encrypted data includes: The user password and the first local information are associated using a preset key generation algorithm to obtain an encryption key; The original data is encrypted using a preset block cipher algorithm and the encryption key to obtain encrypted data.

5. The method according to claim 3, characterized in that, The step of encapsulating the encrypted data and the cryptographic synchronization header to obtain encapsulated data includes: The data frame containing the encrypted data is determined; the data frame includes at least frame length, message type, message payload, and frame checksum. According to the preset data frame format, the data frame and the password synchronization header are encapsulated to obtain encapsulated data.

6. A check-in system, characterized in that, The system includes a user terminal and a server. Data interaction on the server is performed using the method described in any one of claims 1 to 2; data interaction on the user terminal is performed using the method described in any one of claims 3 to 5; wherein: On the user end, when obtaining the user password returned by the server, the original data to be sent is determined, and a password synchronization header is determined based on the first local information associated with the user end; the original data is encrypted using the user password and the first local information to obtain encrypted data; the encrypted data and the password synchronization header are encapsulated to obtain encapsulated data. When the server receives encapsulated data from the user, it determines the corresponding user password and reads the password synchronization header from the encapsulated data. Based on the password synchronization header and the second local information associated with the server, it recovers the first local information associated with the encapsulated data. Using the user password and the first local information, it decrypts the encapsulated data to obtain the decrypted original data.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images