A chip COS security protection method and system

Abstract

The present application relates to a chip COS security protection method and system, and relates to the field of smart cards. The method includes receiving the number information of a passport and the device identity information of a current scanning device, obtaining the working state of the real scanning device corresponding to the device identity information, and if it is in a scanning state, obtaining the personal information of the target passport and the storage location of the personal information, and generating encryption instructions for the current personal information in the target passport, so that the passport control verification chip retrieves the personal information according to the encryption instructions, determines the encryption strategy according to the encryption instructions, and encrypts the personal information according to the encryption strategy to obtain the encrypted personal information, receives the encrypted personal information, and decrypts the encrypted personal information to obtain the real personal information, and determines whether the passport is stolen based on the real personal information and the personal information of the target passport. The present application can reduce the possibility of sensitive information in a passport being stolen and improve the security of the passport.

Description

Technical Field

[0001] The present application relates to the field of smart cards, and in particular to a chip COS security protection method and system. Background Art

[0002] With the maturity and development of chip electronics and other technologies, the relevant technologies of the chip operating system (COS) of smart cards have become mature. The chip operating system of smart cards has gradually been applied in the fields of ID cards, bank cards and passports. Since passports are important credentials for entry and exit, and they store personal information and sensitive identity characteristics of people, once lost or stolen, the sensitive data in the passport is easy to leak. Therefore, how to reduce the possibility of sensitive information in passports being stolen and improve passport security has become a problem. Summary of the invention

[0003] In order to reduce the possibility of sensitive information in a passport being stolen and improve passport security, the present application provides a chip COS security protection method and system.

[0004] In the first aspect, the present application provides a chip COS security protection method, which adopts the following technical solution:

[0005] A chip COS security protection method, executed by a server, comprising:

[0006] Receiving the number information of a passport and the device identity information of a current scanning device by which the passport is scanned, wherein the passport includes a verification chip, and the number information is stored in the verification chip;

[0007] Acquire the working state of the real scanning device corresponding to the device identity information, where the working state includes a scanning state and an idle state;

[0008] If in scanning state, obtaining at least one personal information of the target passport and the storage location of each personal information, the target passport being the passport being scanned by the real scanning device;

[0009] Generate an encryption instruction for the current personal information in the target passport based on the current personal information and the storage location of the current personal information, and send the encryption instruction to the passport, so that the passport controls the verification chip to retrieve the personal information according to the encryption instruction, determine the encryption strategy according to the encryption instruction, and encrypt the personal information according to the encryption strategy to obtain the encrypted personal information;

[0010] Receiving the encrypted personal information of the passport, and decrypting the encrypted personal information to obtain the real personal information of the passport;

[0011] It is determined whether the passport has been stolen based on the real personal information and the personal information of the target passport.

[0012] By adopting the above technical solution, if the device identity information of the current scanning device is consistent with the preset device identity information, the scanning device may be a real and legal scanning device, or it may be an illegal scanning device that has been simulated and disguised. Therefore, the working status of the real scanning device is obtained according to the device identity information. If the working status of the real scanning device is the scanning status, it means that the real scanning device and the current scanning device are the same scanning device, but the current scanning device may still be an illegal disguised scanning device. The personal information of the target passport being scanned by the real scanning device and the storage location of each personal information are obtained, an encryption instruction is generated according to each personal information and the storage location, and the encryption instruction is sent to the passport. The encrypted personal information encrypted by the passport according to the encryption instruction is received, and the encrypted personal information is compared with the personal information of the target passport. If the personal information is consistent with the personal information of the target passport, it means that the passport is the same as the target passport, and there is no passport fraud. If it is inconsistent, it means that there is a fraud, and the current scanning device only transmits the encrypted personal information. When the current scanning device is an illegal disguised scanning device, the possibility of cracking the encrypted personal information is reduced. The specific encryption strategy and encryption steps are only operated in the passport, thereby reducing the possibility of sensitive information in the passport being stolen and improving the security of the passport.

[0013] In another possible implementation, judging whether the passport is stolen based on the real personal information and the personal information of the target passport includes:

[0014] Determining whether the real personal information is consistent with the personal information of the target passport;

[0015] If they are consistent, the following steps are executed in a loop: determining the current personal information in the target passport that needs to be determined to be consistent, generating an encryption instruction for the current personal information in the target passport based on the current personal information and the storage location of the current personal information, and sending the encryption instruction to the passport, so that the passport controls the verification chip to retrieve the personal information according to the encryption instruction, determining the encryption strategy according to the encryption instruction, and encrypting the personal information according to the encryption strategy to obtain the encrypted personal information, receiving the encrypted personal information sent by the current scanning device, decrypting the encrypted personal information to obtain the real personal information of the passport, and returning to execute to determine whether the real personal information is consistent with the personal information of the target passport, until the preset condition is met;

[0016] The preset condition includes any of the following:

[0017] The current real personal information is inconsistent with the personal information of the target passport;

[0018] The current real personal information is consistent with the personal information of the target passport, and the current real personal information is the last personal information in the passport.

[0019] In another possible implementation, the encryption instruction includes an identifier of at least one encryption strategy, and the encryption instruction of the current personal information in the target passport generated based on the current personal information and the storage location of the current personal information includes:

[0020] Determining the identifier of the number of encryption policies required for the current personal information from a preset database based on a preset method, wherein the preset method includes according to the importance level of the current personal information and the encryption level of the encryption policy, or randomly;

[0021] determining an encrypted data segment for each encryption strategy based on the data length of the current personal information of the target passport;

[0022] Determine the correspondence between each identifier and the encrypted data segment;

[0023] The storage location of the current personal information is determined, and an encryption instruction is generated based on the storage location, the identifier, the encrypted data segment, and the corresponding relationship.

[0024] In another possible implementation, if the current real personal information is inconsistent with the personal information of the target passport, the method further includes:

[0025] A termination instruction is sent to the passport, so that the passport controls the verification chip to self-lock and disconnects the communication connection between the verification chip and the storage chip storing the personal information.

[0026] In another possible implementation, the method further includes:

[0027] If the current personal information is a biometric feature, multiple data segments are determined from the data of the biometric feature, each data segment corresponding to a data length and a position;

[0028] Determine an identification of the encryption policy for each data segment;

[0029] Generate an encryption instruction based on the length, position and identifier of each data segment, so that the verification chip in the passport retrieves the data segment in the passport according to the length and position of each data segment, and determines the encryption strategy of each data segment according to the identifier, and encrypts each data segment based on the encryption strategy, so that the passport sends the encrypted data segment;

[0030] receiving the encrypted data segment, and decrypting the encrypted data segment to obtain a real data segment;

[0031] If there is a real data segment that is inconsistent with the data segment in the corresponding target passport, it is determined that the passport has been stolen.

[0032] In another possible implementation, the real scanning device corresponds to a plurality of associated scanning devices, and the method further includes:

[0033] Determine a first target associated scanning device based on the device identity information, current time, and encryption algorithm;

[0034] Sending a first instruction to the real scanning device, so that the real scanning device determines a second target associated scanning device from the multiple associated scanning devices, wherein the first target associated scanning device and the second target associated scanning device are the same scanning device;

[0035] Sending a second instruction to the current scanning device so that the real scanning device determines a third target associated scanning device from the multiple associated scanning devices;

[0036] If the first target associated scanning device is consistent with the third target associated scanning device, controlling the real scanning device to send first networking data to the first target associated scanning device, and controlling the current real scanning device to send second networking data to the third target associated scanning device;

[0037] receiving the networking data sent by the first target associated scanning device, wherein the networking data includes the first networking data of the real scanning device and the third networking data of the first target associated scanning device, or includes the first networking data, the second networking data and the third networking data;

[0038] If the received networking data includes the first networking data, the second networking data and the third networking data, and the first networking data, the second networking data and the third networking data are all the same, determining that the current scanning device is the real scanning device;

[0039] If the first networking data and the third networking data are received, determining that the current scanning device is an illegal scanning device;

[0040] If the first networking data, the second networking data and the third networking data are received, and the second networking data is different from the first networking data and the second networking data is different from the third networking data, it is determined that the current scanning device is an illegal scanning device.

[0041] In another possible implementation, if the current real personal information is inconsistent with the personal information of the target passport, the method further includes:

[0042] Searching for a relevant person corresponding to the passport based on the number information, and determining a terminal device of the relevant person;

[0043] Sending a prompt message to the terminal device.

[0044] In the second aspect, the present application provides a chip COS security protection method, which adopts the following technical solution:

[0045] A chip COS security protection method, executed by a passport, wherein the passport includes a verification chip, comprises:

[0046] Receiving device identity information sent to the passport, wherein the device identity information represents the identity of the current scanning device;

[0047] If the device identity information is consistent with at least one preset device identity information stored in the verification chip, the number information of the passport in the verification chip is retrieved, and the number information of the passport and a control instruction are sent to the current scanning device, so that the current scanning device sends the number information and the device identity information to the server after receiving the number information and the control instruction, and obtains the working state of the real scanning device corresponding to the device identity information, the working state includes a scanning state and an idle state, and if it is in the scanning state, obtains at least one personal information of the target passport and the storage location corresponding to each personal information, the target passport is the passport being scanned by the real scanning device, and obtains the working state of the real scanning device corresponding to the device identity information, the working state includes a scanning state and an idle state, and if it is in the scanning state, obtains at least one personal information of the target passport and the storage location corresponding to each personal information, the target passport is the passport being scanned by the real scanning device;

[0048] receiving an encryption instruction, and controlling the verification chip to retrieve personal information according to a storage location, and encrypting the personal information in the passport based on the encryption instruction to obtain encrypted personal information, wherein the encryption instruction is an encryption instruction for the server to generate the current personal information in the target passport based on the current personal information and the storage location of the current personal information;

[0049] The encrypted personal information is sent so that the server obtains the encrypted personal information of the passport, decrypts the encrypted personal information to obtain the real personal information of the passport, and determines whether the passport is stolen based on the personal information of the target passport and the storage location corresponding to each item of personal information.

[0050] In a third aspect, the present application provides a chip COS security protection system, which adopts the following technical solutions:

[0051] A chip COS security protection system, the system comprising:

[0052] A server, which is in communication connection with the current scanning device of the passport and then in communication connection with the passport, and is in communication connection with the real scanning device, and is used to execute a chip COS security protection method as described in the first aspect;

[0053] A passport is communicatively connected to the current scanning device and then to the server, the passport comprises a verification chip, at least one processor, at least one memory, and at least one application, the verification chip is communicatively connected to the processor, the verification chip is communicatively connected to the memory, the at least one application is stored in the memory and is configured to be executed by the at least one processor, the at least one application: is used to execute a chip COS security protection method described in the second aspect.

[0054] In a fourth aspect, the present application provides a passport, which adopts the following technical solution:

[0055] A passport including:

[0056] A verification chip, the verification chip is communicatively connected to the processor, the verification chip is communicatively connected to the memory, and is used to retrieve personal information according to the storage location, and encrypt the personal information in the passport based on the encryption instruction to obtain encrypted personal information;

[0057] at least one processor;

[0058] at least one memory;

[0059] At least one application, the at least one application is stored in the memory and is configured to be executed by the at least one processor, and the at least one application is used to execute a chip COS security protection method described in the second aspect.

[0060] In summary, the present application includes at least one of the following beneficial technical effects:

[0061] If the device identity information of the current scanning device is consistent with the preset device identity information, the scanning device may be a real and legal scanning device, or it may be an illegal scanning device that has been simulated and disguised. Therefore, the working status of the real scanning device is obtained according to the device identity information. If the working status of the real scanning device is the scanning status, it means that the real scanning device and the current scanning device are the same scanning device, but the current scanning device may still be an illegal disguised scanning device. The personal information of the target passport being scanned by the real scanning device and the storage location of each personal information are obtained, an encryption instruction is generated according to each personal information and the storage location, and the encryption instruction is sent to the passport, the encrypted personal information encrypted by the passport according to the encryption instruction is received, and the encrypted personal information is compared with the personal information of the target passport. If the personal information is consistent with the personal information of the target passport, it means that the passport is the same as the target passport, and there is no passport fraud. If it is inconsistent, it means that there is fraud, and the current scanning device only transmits the encrypted personal information. When the current scanning device is an illegal disguised scanning device, the possibility of cracking the encrypted personal information is reduced. The specific encryption strategy and encryption steps are only operated in the passport, thereby reducing the possibility of sensitive information in the passport being stolen and improving the security of the passport. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 It is a flow chart of a chip COS security protection method according to an embodiment of the present application.

[0063] Figure 2 It is a schematic diagram of a specific process of generating encryption instructions in an embodiment of the present application.

[0064] Figure 3 It is another flow chart of a chip COS security protection method in an embodiment of the present application.

[0065] Figure 4 It is a structural diagram of a chip COS security protection system in an embodiment of the present application.

[0066] Figure 5 It is a schematic diagram of the structure of a passport according to an embodiment of the present application.

[0067] Figure numerals: 301, server; 302, current scanning device; 303, passport; 304, real scanning device; 3031, processor; 3032, bus; 3033, memory; 3034, verification chip; 3035, storage chip; 3036, transceiver. DETAILED DESCRIPTION

[0068] The present application is further described in detail below in conjunction with the accompanying drawings.

[0069] After reading this specification, those skilled in the art may make non-creative modifications to this embodiment as needed, but such modifications are protected by patent law as long as they are within the scope of the claims of this application.

[0070] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0071] In addition, the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article, unless otherwise specified, generally means that the associated objects before and after are in an "or" relationship.

[0072] The embodiments of the present application are further described in detail below in conjunction with the drawings in the specification.

[0073] In the first aspect, the embodiments of the present application provide a chip COS security protection method, which is executed by a server, and the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services. The embodiments of the present application are not limited here, such as Figure 1 As shown, the method includes step S101, step S102, step S103, step S104, step S105 and step S106, wherein:

[0074] S101, receiving the passport number information and the device identity information of the current scanning device by which the passport is scanned.

[0075] Among them, the passport includes a verification chip, and the number information is stored in the verification chip.

[0076] For the embodiment of the present application, in order to store personal information and biometric features in the passport, a storage chip can be provided in the passport to store personal information and biometric features, etc., and a processor can be provided in the passport to encrypt, call, and perform other operations on the personal information and biometric features in the storage chip. In order to protect the data in the storage chip and verify the identity of the scanning device, a verification chip is also provided in the passport, and the verification chip is connected to the processor through a wire, and the verification chip is connected to the memory through a wire.

[0077] In daily entry and exit scenarios, for example, at least one scanning device is placed in the entry and exit hall to verify the identity of the passport and the person, and each scanning device has an independent number. The server stores the number of each device and other related information. During the passport scanning process, the identity of the scanning device needs to be verified first. The scanning device sends its own device identity information to the passport. After receiving the device identity information, the passport verifies the device identity information. The device identity information of the scanning device that is allowed to be scanned is stored in the verification chip of the passport. Therefore, the passport compares and matches the device identity information with the device identity information in the verification chip. If there is a matching device identity information, it means that the current scanning device may be a real device that is allowed to scan. The current scanning device sends the passport number information and the device identity information of the current scanning device to the server.

[0078] If the current scanning device is a real scanning device, the device is connected to the server via wired or wireless communication to perform data transmission and other operations. If the current scanning device is a disguised scanning device used to steal passports, it is also possible to establish a communication connection with the server, so that the server can receive the passport number information and the device identity information of the current scanning device sent by the current scanning device, and further determine whether the passport has been stolen.

[0079] S102, obtaining the working status of the real scanning device corresponding to the device identity information.

[0080] The working state includes a scanning state and an idle state.

[0081] For the embodiments of the present application, if the current scanning device is an illegal, disguised scanning device, it will also use a link consistent with the real scanning device when connecting to the server, that is, the current scanning device connects to the server according to the virtually generated link, so that the server cannot know whether the current scanning device is a real scanning device.

[0082] The current scanning device can send the passport number information to the server, which means that the current scanning device can obtain the number information by scanning the passport, so the current scanning device is in the scanning state. After receiving the device identity information, the server can use the backup link to send a status acquisition request to the real scanning device. The backup link is set by the relevant personnel when establishing the connection between the real scanning device and the server. The real scanning device sends its own working status according to the status acquisition request, and then the server obtains the working status of the real scanning device.

[0083] S103: If in the scanning state, obtaining at least one personal information of the target passport and the storage location of each personal information.

[0084] The target passport is the passport being scanned by the real scanning device.

[0085] For the embodiment of the present application, if it is in the scanning state, it means that the real scanning device is also scanning a certain passport, that is, the target passport, so the server obtains at least one personal information of the target passport and the storage location of each personal information. Personal information includes name, gender, age, iris features, fingerprint features, etc.

[0086] If it is not in scanning state but in idle state, it means that the working state of the real scanning device is inconsistent with the current scanning device, which further indicates that the current scanning device is an illegal device and the passport has been stolen.

[0087] S104, based on the current personal information and the storage location of the current personal information, an encryption instruction of the current personal information in the target passport is generated, and the encryption instruction is sent to the passport, so that the passport control verification chip retrieves the personal information according to the encryption instruction, determines the encryption strategy according to the encryption instruction, and encrypts the personal information according to the encryption strategy to obtain the encrypted personal information.

[0088] For the embodiment of the present application, assuming that there is no fraudulent use of the passport, the passport scanned by the real scanning device and the current scanning device are the same passport. When both the real scanning device and the current scanning device are in the scanning state, it is necessary to further determine whether the passport has been fraudulently used based on personal information.

[0089] Passports usually store personal information according to universal standards, that is, each type of personal information is stored in a certain location. After the server obtains the personal information of the target passport, it verifies the consistency of the personal information in the passport in sequence according to the order in which the personal information is obtained or the order in which the storage location is stored. Since the server verifies according to the personal information in sequence, the server generates different encryption instructions according to the personal information and the storage location of the personal information. After generating the encryption instruction, the server sends the encryption instruction to the passport, so that the verification chip in the passport retrieves the corresponding personal information according to the storage location in the encryption instruction. There are multiple encryption strategies stored in the verification chip. The verification chip can determine the encryption strategy corresponding to the personal information according to the encryption instruction, and encrypt the personal information in the verification chip according to the encryption strategy, thereby obtaining the encrypted personal information.

[0090] S105, receiving the encrypted personal information of the passport, and decrypting the encrypted personal information to obtain the real personal information of the passport.

[0091] For the embodiment of the present application, the current scanning device sends the encrypted personal information generated by the passport to the server, and the server receives the encrypted personal information and decrypts it according to the encryption instruction to obtain the real personal information of the passport. The server stores decryption strategies corresponding to multiple encryption strategies in advance, so the real personal information can be obtained by decrypting according to the decryption strategy.

[0092] S106, judging whether the passport has been stolen based on the real personal information and the personal information of the target passport.

[0093] For the embodiment of the present application, after the server decrypts and obtains the real personal information of the passport, it compares the real personal information with the personal information of the target passport to determine whether the passport has been stolen. Taking the name as an example, if the name on the passport is the same as the name on the target passport, it means that there may be no theft, or there may be a duplicate name, so other personal information is needed to provide evidence to determine whether there is theft. By sending an encryption instruction to the passport, the verification chip in the passport retrieves the personal information according to the encryption instruction and determines the corresponding encryption strategy, and then encrypts the personal information in the passport. At this time, the current scanning device only plays the role of data transmission, and sends the encrypted personal information to the server, which is decrypted by the server. Since the current scanning device cannot know the encryption strategy and the real information behind the encrypted personal information, it protects the personal information in the passport, so that when the legitimacy of the current scanning device is not determined, the current scanning device is not easy to crack the personal information in the passport, reducing the possibility of sensitive information in the passport being stolen and improving the security of the passport.

[0094] In a possible implementation of the embodiment of the present application, in step S106, judging whether the passport is stolen based on the real personal information and the personal information of the target passport specifically includes step S1061 (not shown in the figure) and step S1062 (not shown in the figure), wherein:

[0095] S1061, determining whether the real personal information is consistent with the personal information of the target passport.

[0096] S1062, if they are consistent, then execute in a loop: determine the current personal information in the target passport that needs to be judged consistent, generate an encryption instruction for the current personal information in the target passport based on the current personal information and the storage location of the current personal information, and send the encryption instruction to the passport, so that the passport control verification chip retrieves the personal information according to the encryption instruction, determines the encryption strategy according to the encryption instruction, and encrypts the personal information according to the encryption strategy to obtain the encrypted personal information, receives the encrypted personal information sent by the current scanning device, decrypts the encrypted personal information, obtains the real personal information of the passport, returns to execute to determine whether the real personal information is consistent with the personal information of the target passport, until the preset conditions are met.

[0097] The preset conditions include any of the following:

[0098] The current real personal information is inconsistent with the personal information of the target passport;

[0099] The current real personal information is consistent with the personal information in the target passport, and the current real personal information is the last personal information in the passport.

[0100] For the embodiment of the present application, the server determines whether the real personal information is consistent with the personal information of the target passport. If they are consistent, it means that the current personal information of the passport is consistent with the personal information of the target passport. The current scanning device may be a real scanning device or an illegal scanning device, and other personal information is needed for judgment. Therefore, after the server obtains the personal information of the target passport, it determines the next personal information that needs to be determined to be consistent according to a predetermined order. The preset order can be the order in which each type of information is stored as specified in the passport standard, or the order in which the server obtains each type of personal information, or other orders.

[0101] After determining the personal information that needs to be verified, due to the difference in each type of personal information, the server generates encryption instructions for the current personal information in the target passport based on the storage location of each type of personal information and the current personal information. The server sends the encryption instructions for the current personal information to the current scanning device, so that the current scanning device sends the encryption instructions to the passport. After the passport receives the encryption instructions, the control verification chip determines the encryption strategy of the current personal information according to the encryption instructions. The verification chip retrieves the personal information according to the storage location in the encryption instructions, and encrypts the personal information according to the encryption strategy to obtain the encrypted personal information. The passport sends the encrypted personal information to the current scanning device, so that the current scanning device sends the encrypted personal information to the server, and then the server receives the encrypted personal information sent by the current scanning device. The server stores the decryption strategy corresponding to the encryption strategy, and then combines the encryption instructions to decrypt the encrypted personal information to obtain the real personal information of the current personal information of the passport.

[0102] The server compares the current personal information with the real personal information of the corresponding target passport. If they are consistent, it means that the current scanning device may be a real scanning device, but it may still be a forged and illegal scanning device. If they are inconsistent, it means that the passport is not the same as the target passport, that is, the current scanning device is an illegal and forged scanning device, and then it is determined that the passport has been stolen.

[0103] If they are consistent, the server returns to the step of re-determining the current personal information in the target passport and reselects the personal information for determination. The server generates an encryption instruction based on the current personal information and the storage location of the current personal information, and sends the encryption instruction to the passport to verify whether the current personal information is consistent with the current personal information of the target passport in the above manner. Until the current personal information is inconsistent with the personal information of the target passport, in this case it is determined that the passport has been stolen. Until the current real personal information is consistent with the personal information of the target passport, and the current real personal information is the last personal information in the passport, in this case, it means that the personal information in the passport is consistent with the personal information of the target passport, the current scanning device is the real scanning device, and there is no passport theft. By repeatedly determining whether the personal information of the passport is consistent with the personal information of the target passport, it can be accurately determined whether the passport has been stolen.

[0104] In a possible implementation of the embodiment of the present application, the encryption instruction includes at least one identifier of an encryption strategy. In step S104 or step S1062, an encryption instruction for the current personal information in the target passport is generated based on the current personal information and the storage location of the current personal information, specifically including steps Sa, Sb, Sc and Sd, as shown in the figure, wherein:

[0105] Sa, an identifier of an encryption strategy for determining a required amount of current personal information from a preset database based on a preset method.

[0106] The preset methods include encryption levels according to the importance level of the current personal information and the encryption policy, or random.

[0107] For the embodiment of the present application, a plurality of encryption strategies are stored in the server, and each encryption strategy corresponds to an identifier. In addition, a decryption strategy corresponding to each encryption strategy is also stored in the server. Since the importance level of each personal information is different, the encryption strategy to be determined is also different. For example, the importance level of basic information such as name, gender, and age is relatively low, and only one encryption strategy with a lower encryption level is used to encrypt the personal information. For personal information with a higher importance level such as ID number, iris features, and fingerprint features, multiple encryption strategies are required for encryption, and the encryption strategy with a high encryption level is used to encrypt the personal information, thereby reducing the possibility of the personal information being cracked and stolen in the current scanning device.

[0108] Specifically, the server can store the importance level of each type of personal information, for example, the importance level of personal information such as name, gender and age is 1, the importance level of ID number is 2, and the importance level of iris features and fingerprint features is 3. The higher the encryption level, the more difficult it is to crack the encryption strategy. Therefore, relevant personnel can divide the encryption level of the encryption strategy and store it in the server. The higher the encryption level, the higher the encryption degree, the higher the security, and the more difficult it is to crack. Each encryption level in the server includes multiple encryption strategies.

[0109] After obtaining the personal information of the target passport, the server determines the data length and importance level of the personal information. The longer the data length, the higher the encryption level required. That is, the data length and the importance level of the personal information are the key factors affecting the encryption strategy used. Therefore, different weights can be set for the data length and personal information. For example, the weight of the importance level is 0.6, and the weight of the data length is 0.4. The server performs weighted calculation according to the encryption level, data length and the corresponding weights to obtain a score for the personal information. The server pre-stores multiple intervals about the score, each interval corresponds to the number of encryption strategies required. After the server determines the score, it determines the interval where the score is located, and determines the number corresponding to the interval as the number of encryption strategies required for the encryption of the personal information. The server also pre-stores multiple intervals about the score, each interval corresponds to the encryption level of the encryption strategy required. After the server determines the score, it determines the interval where the score is located, and determines the encryption level corresponding to the interval as the level of the encryption strategy required for the encryption of the personal information, thereby allowing the server to select the determined number of encryption strategies from the encryption level. After determining the appropriate number and the required encryption level, the server can use a random algorithm to randomly select an appropriate number of encryption strategies in the required encryption level.

[0110] Alternatively, after the server determines an appropriate number of encryption strategies, it uses a random algorithm to randomly select an encryption strategy from all encryption strategies.

[0111] Sb, determines the encrypted data segment of each encryption policy based on the data length of the current personal information of the target passport.

[0112] For the embodiment of the present application, after the server determines the data length, it divides the data length by the number of encryption policies according to the determined number of required encryption policies to obtain the encrypted data segment.

[0113] Sc, determine the correspondence between each identifier and the encrypted data segment.

[0114] For the embodiment of the present application, since the server stores the identifier corresponding to each encryption strategy, the server can determine the encryption strategy corresponding to each encrypted data segment according to the order of the determined encryption strategies and the order of the positions of the encrypted data segments. After determining the encryption strategy, the server determines the correspondence between each encrypted data segment and the identifier of the encryption strategy, so that the passport can know the encryption strategy used by each encrypted data segment after receiving the encryption instruction. Since the encryption instruction is generated using the identifier, it is not easy for the current scanning device to know the specific encryption strategy during the transmission of the encryption instruction, which improves security.

[0115] Sd, determines the storage location of the current personal information, and generates encryption instructions based on the storage location, identification, encrypted data segment and corresponding relationship.

[0116] For the embodiment of the present application, since each type of personal information stored in the memory of the passport is usually determined according to the standard, the storage location of each type of personal information is fixed, and the storage location of a certain personal information in the target passport is the same as the storage location of the same type of personal information in the passport. Therefore, it is necessary to generate an encryption instruction based on the storage location of the current personal information so that the passport can retrieve the same type of personal information. The server then generates an encryption instruction based on the identifier of the encryption strategy, the encrypted data segment, and the corresponding relationship. The encryption strategy required for each type of personal information is comprehensively determined based on the importance level of the personal information, the data length, and the encryption level of the encryption strategy, so that the passport can encrypt the personal information with higher security, and the current scanning device is not easy to crack the encrypted personal information during the data transmission process.

[0117] In a possible implementation of the embodiment of the present application, if the current real personal information is inconsistent with the personal information of the target passport, the method further includes step S107 (not shown in the figure), wherein:

[0118] S107, sending a termination instruction to the passport, so that the passport controls the verification chip to self-lock and disconnects the communication connection between the verification chip and the storage chip storing the personal information.

[0119] For the embodiment of the present application, if the current real personal information is inconsistent with the personal information of the target passport, it means that the passport has been stolen and the current scanning device is an illegal device. The server sends a termination instruction through the current scanning device. After receiving the termination instruction, the passport controls the verification chip to self-lock. All instructions except specific instructions sent by external devices to the passport are not processed or operated, and the verification chip and the storage chip are connected through a semiconductor switch device. After receiving the termination instruction, the verification chip controls the semiconductor switch device to disconnect, so that the memory cannot be accessed.

[0120] In a possible implementation manner of the embodiment of the present application, the method further includes step S108, step S109, step S110, step S111 and step S112, wherein:

[0121] S108: If the current personal information is a biometric feature, a plurality of data segments are determined from the biometric feature data.

[0122] Each data segment has a corresponding data length and position.

[0123] For the embodiment of the present application, the biometric features include iris features and fingerprint features, etc., and the importance level of the biometric features is relatively high. In order to reduce the possibility of the biometric features being cracked and obtained during the transmission process, the server can select multiple data segments at intervals according to the biometric data of the target passport, that is, some random numbers can be determined by a random algorithm, and each random number is the number of data bits of the interval. The length of each data segment can be a preset length or a random number determined by a random algorithm, and the random number is used as the length of the data segment.

[0124] After the server determines the number of data bits of the interval and the length of each data segment, it can determine multiple data segments from the biometric data of the target passport.

[0125] S109, determine the identifier of the encryption strategy for each data segment.

[0126] For the embodiment of the present application, the server determines the score according to the importance of the biometric feature and the length of the data in step Sa, thereby determining the encryption level of the required encryption strategy. The server then randomly selects an encryption strategy from the encryption strategies corresponding to the encryption level, and determines the corresponding relationship between each data segment and the identifier of the encryption strategy.

[0127] S110, generating encryption instructions based on the length, position and identifier of each data segment, so that the verification chip in the passport retrieves the data segment in the passport according to the length and position of each data segment, and determines the encryption strategy of each data segment according to the identifier, and encrypts each data segment based on the encryption strategy, so that the passport sends the encrypted data segment.

[0128] For the embodiment of the present application, the server generates an encryption instruction according to the length, position and identifier of the data segment, and the current scanning device sends the encryption instruction, so that the passport parses the encryption instruction after receiving it, controls the verification chip to retrieve the biometric data in the passport from the memory according to the length and position, and retrieves the encryption strategy of each data segment according to the identifier, and encrypts each data segment, thereby obtaining the encrypted data segment, and the current scanning device sends the encrypted data segment to the server. If the current scanning device is an illegal disguised scanning device, even if the current scanning device cracks the encrypted data segment, since the data segment is obtained at intervals, the current scanning device cannot obtain the complete biometric feature.

[0129] S111, receiving the encrypted data segment, and decrypting the encrypted data segment to obtain the real data segment.

[0130] For the embodiment of the present application, the server receives the encrypted data segment sent by the current scanning device, and retrieves the decryption strategy corresponding to each encryption strategy, thereby decrypting the encrypted data segment to obtain the real data segment.

[0131] S112: If there is a real data segment that is inconsistent with the data segment in the corresponding target passport, it is determined that the passport has been stolen.

[0132] For the embodiment of the present application, after the server obtains the real data segment, it compares the data segments of the target device in sequence. If there are inconsistent real data segments, it means that there is a difference in the same biometric feature between the passport and the target passport, and the passport is different from the passport being scanned by the real scanning device, which means that the passport has been stolen.

[0133] In a possible implementation manner of the embodiment of the present application, the real scanning device corresponds to multiple associated scanning devices, and the method further includes step S113 (not shown in the figure), step S114 (not shown in the figure), step S115 (not shown in the figure), step S116 (not shown in the figure), step S117 (not shown in the figure), step S118 (not shown in the figure), step S119 (not shown in the figure) and step S120 (not shown in the figure), wherein:

[0134] S113: Determine a first target associated scanning device based on the device identity information, current time, and encryption algorithm.

[0135] S114: Send a first instruction to the real scanning device, so that the real scanning device determines a second target associated scanning device from the multiple associated scanning devices.

[0136] The first target-associated scanning device and the second target-associated scanning device are the same scanning device.

[0137] S115: Send a second instruction to the current scanning device, so that the real scanning device determines a third target associated scanning device from the multiple associated scanning devices.

[0138] S116, if the first target associated scanning device is consistent with the third target associated scanning device, control the real scanning device to send first networking data to the first target associated scanning device, and control the current real scanning device to send second networking data to the third target associated scanning device.

[0139] S117, receiving networking data sent by the first target associated scanning device.

[0140] The networking data includes the first networking data of the real scanning device and the third networking data of the first target-associated scanning device, or includes the first networking data, the second networking data and the third networking data.

[0141] S118: If the received networking data includes the first networking data, the second networking data and the third networking data, and the first networking data, the second networking data and the third networking data are all the same, then it is determined that the current scanning device is the real scanning device.

[0142] S119: If the first networking data and the third networking data are received, determine that the current scanning device is an illegal scanning device.

[0143] S120: If the first networking data, the second networking data and the third networking data are received, and the second networking data is different from the first networking data and the second networking data is different from the third networking data, it is determined that the current scanning device is an illegal scanning device.

[0144] For the embodiment of the present application, after receiving the device identity information of the current scanning device, the server can determine the real scanning device corresponding to the device identity information. Usually, multiple real scanning devices are set up in an entry-exit location, that is, associated scanning devices. The staff can bundle and mark the device identity information of all real scanning devices in an entry-exit scene in advance and then store it in the server, so that multiple real scanning devices in an entry-exit scene are associated and corresponded to each other.

[0145] After receiving the device identity information, the server can determine the associated scanning device corresponding to the real scanning device according to the bundled tag, that is, other real scanning devices in the same entry and exit scenario. The server can generate a set of numbers through the device identity information, current time and encryption algorithm of each scanning device, and determine a number by rounding or taking the remainder of the number. Each real scanning device has a different number, so the first target associated scanning device can be determined according to the above algorithm. The real scanning device also stores the same encryption algorithm as the server and has the same time as the server.

[0146] The server sends an instruction, namely the first instruction and the second instruction, to the current scanning device and the real scanning device corresponding to the device identity information. The real scanning device can determine the scanning device consistent with the first target associated scanning device according to the device identity information, the current time and the encryption algorithm, namely the second target associated scanning device. The current scanning device may or may not determine the third target associated scanning device. The current scanning device cannot know the encryption algorithm in the server. Even if it knows the encryption algorithm, the associated scanning device determined at different times is different. Therefore, the third target associated scanning device may or may not be the same as the first target associated scanning device.

[0147] If the current scanning device is the same as the associated scanning device determined by the real scanning device, it means that the current scanning device and the real scanning device may be the same scanning device. The server sends another instruction to the current scanning device and the real scanning device, so that the current scanning device sends the local area network, Bluetooth network, mesh network and other networking data where the current scanning device is located to the third target associated scanning device, that is, the second networking data, so that the real scanning device sends the local area network, Bluetooth network, mesh network and other networking data to the associated scanning device, that is, the first networking data.

[0148] The first target associated scanning device sends the received networking data and the networking data of the first target associated scanning device itself to the server. The server compares the received networking data. If three sets of networking data are received and the networking data are consistent, it means that the current scanning device is a real scanning device. If three sets of networking data are received and the networking data of the current scanning device is inconsistent with the other two sets of networking data, it means that the current scanning device is an illegal scanning device. If two sets of networking data are received, it means that the current scanning device is not in the same network as the associated scanning device and the current scanning device is an illegal scanning device.

[0149] In a possible implementation of the embodiment of the present application, if the current real personal information is inconsistent with the personal information of the target passport, the method further includes step S113 (not shown in the figure) and step S114, wherein:

[0150] S113, searching for the relevant person corresponding to the passport based on the number information, and determining the terminal device of the relevant person.

[0151] S114, sending a prompt message to the terminal device.

[0152] For the embodiment of the present application, the server stores the corresponding personnel and managers of each passport, and stores the contact information of the corresponding terminal devices of the corresponding personnel and managers. If the server determines that the passport has been stolen, it sends a prompt message to the terminal device of the corresponding personnel and the terminal device of the manager. Specifically, it can be a text message "The passport numbered xxxxxxxx has been stolen, please pay attention".

[0153] In a second aspect, the embodiment of the present application also provides a chip COS security protection method, which is executed by a passport, in which a verification chip is provided, such as Figure 3 As shown, the method includes step S201, step S202, step S203 and step S204, wherein:

[0154] S201, receiving device identity information sent to the passport.

[0155] The device identity information represents the identity of the current scanning device.

[0156] For the embodiment of the present application, the current scanning device needs to perform identity authentication before obtaining the passport data. The current scanning device sends device identity information to the passport. The device identity information may be an identifier such as a device ID.

[0157] S202: If the device identity information is consistent with at least one preset device identity information stored in the verification chip, retrieve the passport number information in the verification chip, and send the passport number information and control instructions to the current scanning device.

[0158] So that the current scanning device sends the number information and the device identity information to the server after receiving the number information and the control instruction, and obtains the working state of the real scanning device corresponding to the device identity information, the working state includes the scanning state and the idle state, if it is in the scanning state, then obtain at least one personal information of the target passport and the storage location corresponding to each personal information, the target passport is the passport being scanned by the real scanning device, and obtains the working state of the real scanning device corresponding to the device identity information, the working state includes the scanning state and the idle state, if it is in the scanning state, then obtain at least one personal information of the target passport and the storage location corresponding to each personal information.

[0159] The target passport is the passport being scanned by the real scanning device.

[0160] For the embodiment of the present application, the verification chip of the passport stores the device identity information of multiple scanning devices that are allowed to be scanned. The verification chip verifies the received device identity information and the stored device identity information. If there is preset identity information that is consistent with the device identity information, it means that the identity of the current scanning device has passed the verification and may belong to a legal device, but the device identity information of the current scanning device may be forged or virtually simulated, so it is also necessary to verify whether the passport has been stolen. The verification chip stores the passport number, and the passport sends the number and control instructions to the current scanning device, so that the current scanning device sends the number information to the server after receiving the control instruction.

[0161] After the server obtains the device identity information of the current scanning device, if the current scanning device is a real scanning device, the device is connected to the server via wired or wireless to perform data transmission and other operations. If the current scanning device is a disguised scanning device used to steal passports, it is also possible to establish a communication connection with the server, so the server can receive the passport number information and the device identity information of the current scanning device sent by the current scanning device, and further determine whether the passport has been stolen.

[0162] The current scanning device can send the passport number information to the server, which means that the current scanning device can obtain the number information by scanning the passport, so the current scanning device is in the scanning state. After the server receives the device identity information, it can use the backup link to send a status acquisition request to the real scanning device. The backup link is set by the relevant personnel when establishing the connection between the real scanning device and the server. The real scanning device sends its own working status according to the status acquisition request, and then the server obtains the working status of the real scanning device. If it is in the scanning state, it means that the real scanning device is also scanning a certain passport, that is, the target passport, so the server obtains at least one personal information of the target passport and the storage location of each personal information. Personal information includes name, gender, age, iris features, and fingerprint features. If it is not in the scanning state, but in the idle state, it means that the working state of the real scanning device is inconsistent with that of the current scanning device, which means that the current scanning device is an illegal device and the passport has been stolen.

[0163] S203, receiving the encryption instruction, and controlling the verification chip to retrieve the personal information according to the storage location, and encrypting the personal information in the passport based on the encryption instruction to obtain the encrypted personal information. The encryption instruction is an encryption instruction for the server to generate the current personal information in the target passport based on the current personal information and the storage location of the current personal information.

[0164] For the embodiment of the present application, assuming that there is no fraudulent use of the passport, the passport scanned by the real scanning device and the current scanning device are the same passport. When both the real scanning device and the current scanning device are in the scanning state, it is necessary to further determine whether the passport has been fraudulently used based on personal information.

[0165] Passports usually store personal information according to universal standards, that is, each type of personal information is stored in a certain location. After the server obtains the personal information of the target passport, it verifies the consistency of the personal information in the passport in sequence according to the order in which the personal information is obtained or the order in which the storage location is stored. Since the server verifies according to the personal information in sequence, the server generates different encryption instructions according to the personal information and the storage location of the personal information. After generating the encryption instruction, the server sends the encryption instruction to the passport, so that the verification chip in the passport retrieves the corresponding personal information according to the storage location in the encryption instruction. There are multiple encryption strategies stored in the verification chip. The verification chip can determine the encryption strategy corresponding to the personal information according to the encryption instruction, and encrypt the personal information in the verification chip according to the encryption strategy, thereby obtaining the encrypted personal information.

[0166] S204, sending the encrypted personal information so that the server obtains the encrypted personal information of the passport, and decrypts the encrypted personal information to obtain the real personal information of the passport, and determines whether the passport is stolen based on the personal information of the target passport and the storage location corresponding to each personal information.

[0167] For the embodiment of the present application, the verification chip in the passport encrypts the personal information according to the encryption strategy to obtain the encrypted personal information, and the passport sends the encrypted personal information to the current scanning device, and the current scanning device sends the encrypted personal information generated by the passport to the server, and the server receives the encrypted personal information and decrypts it according to the encryption instruction, thereby obtaining the real personal information of the passport. The server stores the decryption strategy corresponding to a variety of encryption strategies in advance, so the real personal information can be obtained by decrypting according to the decryption strategy. After the server decrypts the real personal information of the passport, it compares the real personal information with the personal information of the target passport to determine whether the passport has been stolen. Taking the name as an example, if the name of the passport is the same as the name of the target passport, it means that there may be no theft, and there may be a duplicate name, so other personal information is needed to prove it, and then determine whether there is theft. By sending an encryption instruction to the passport, the verification chip in the passport retrieves the personal information according to the encryption instruction and determines the corresponding encryption strategy, and then encrypts the personal information in the passport. At this time, the current scanning device only plays the role of data transmission, and sends the encrypted personal information to the server, which is decrypted by the server. Since the current scanning device cannot know the encryption strategy and the real information behind the encrypted personal information, it can protect the personal information in the passport. When the legitimacy of the current scanning device is not confirmed, the current scanning device cannot easily crack the personal information in the passport, thereby reducing the possibility of sensitive information in the passport being stolen and improving the security of the passport.

[0168] In the third aspect, the above embodiment introduces a chip COS security protection method from the perspective of the method flow, and the following embodiment introduces a chip COS security protection system, such as Figure 4 As shown, the chip COS security protection system may specifically include:

[0169] A server 301 is connected in communication with a current scanning device 302 of a passport and further connected in communication with a passport 303, and connected in communication with a real scanning device 304, and is used to execute a chip COS security protection method of the method embodiment executed by the server 301 in the first aspect;

[0170] Passport 303 is communicatively connected to the current scanning device 302 and further communicatively connected to the server 301. Passport 301 includes a verification chip, at least one processor, at least one memory, and at least one application. The verification chip is communicatively connected to the processor, the verification chip is communicatively connected to the memory, at least one application is stored in the memory and is configured to be executed by at least one processor, and the at least one application is used to execute the method embodiment of the second aspect executed by passport 303.

[0171] For the embodiment of the present application, the current scanning device 302 sends device identity information to the passport 303. After receiving the device identity information, the passport 303 compares and matches it with multiple preset device identity information in the verification chip. If there is consistent preset device identity information, the number information and control instructions of the passport 303 are sent to the current scanning device 302, so that the current scanning device 302 sends the number information device identity information to the server 301. After receiving the number information and the device identity information, the server 301 obtains the working state of the real scanning device 304 corresponding to the device identity information. If it is in the scanning state, the personal information of the target passport being scanned and the storage location of each personal information are obtained, and an encryption instruction is generated according to the personal information and the storage location. The server 301 sends the encryption instruction to the current scanning device 302 so that the passport 303 receives the encryption instruction. After receiving the encryption instruction, the passport 303 parses the encryption instruction, retrieves the personal information according to the storage location through the verification chip, and selects the encryption strategy according to the encryption strategy identifier in the encryption instruction, and then encrypts the personal information to obtain the encrypted personal information. The passport 303 sends the encrypted personal information to the server 301 through the current scanning device 302. The server 301 decrypts the encrypted personal information and compares the personal information of the target passport. If they are consistent, it means that the passport scanned by the current scanning device 302 is consistent with the target passport. Then, according to other personal information, it is determined whether the passport 303 is stolen, that is, whether the current scanning device 302 is an illegal scanning device. If all personal information of passport 303 is consistent with that of the target passport, it means that passport 303 has not been stolen. If there is inconsistent personal information, it means that passport 303 is not the same as the target passport and passport 303 has been stolen.

[0172] In a fourth aspect, a passport 303 is provided in an embodiment of the present application, such as Figure 5 As shown, Figure 5 The passport 303 shown includes: a processor 3031 and a memory 3033. The processor 3031 and the memory 3033 are connected, such as through a bus 3032. It also includes a verification chip 3034 and a memory chip 3035. The memory chip 3035 is used to store personal information. The verification chip 3034 is connected to the processor 3031 through a bus 3032. The verification chip 3034 and the memory chip 3035 are connected through a wire. A semiconductor switch device is provided between the verification chip 3034 and the memory chip 3035 to control the conduction and disconnection of the circuit between the verification chip 3034 and the memory chip 3035. Optionally, the passport 303 may also include a transceiver 3036. It should be noted that in actual applications, the transceiver 3036 is not limited to one, and the structure of the passport 303 does not constitute a limitation on the embodiments of the present application.

[0173] Processor 3031 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. Processor 3031 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc. The structure of verification chip 3034 may be the same as processor 3031 or may be different from that of processor 3031.

[0174] The bus 3032 may include a path to transmit information between the above components. The bus 3032 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus 3032 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one thick line is used in the diagram, but it does not mean that there is only one bus or only one type of bus.

[0175] The memory 3033 may be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The storage chip 3035 may have the same structure as the memory 3033, or may be different.

[0176] The memory 3033 is used to store the application code for executing the solution of the present application, and the execution is controlled by the processor 3031. The processor 3031 is used to execute the application code stored in the memory 3033 to implement the content shown in the above method embodiment.

[0177] Figure 5 The passport 303 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0178] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0179] The above description is only a partial implementation method of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A chip COS security protection method, characterized in that: Executed by the server, including: Receiving the number information of a passport and the device identity information of a current scanning device by which the passport is scanned, wherein the passport includes a verification chip, and the number information is stored in the verification chip; Acquire the working state of the real scanning device corresponding to the device identity information, where the working state includes a scanning state and an idle state; If in scanning state, obtaining at least one personal information of a target passport and a storage location of each personal information, wherein the target passport is the passport being scanned by the real scanning device; Generate an encryption instruction for the current personal information in the target passport based on the current personal information and the storage location of the current personal information, and send the encryption instruction to the passport, so that the passport controls the verification chip to retrieve the personal information according to the encryption instruction, determine the encryption strategy according to the encryption instruction, and encrypt the personal information according to the encryption strategy to obtain the encrypted personal information; Receiving the encrypted personal information of the passport, and decrypting the encrypted personal information to obtain the real personal information of the passport; Determining whether the passport has been stolen based on the real personal information and the personal information of the target passport; wherein determining whether the passport has been stolen based on the real personal information and the personal information of the target passport includes: Determining whether the real personal information is consistent with the personal information of the target passport; If they are consistent, the following steps are executed in a loop: determining the current personal information in the target passport that needs to be determined to be consistent, generating an encryption instruction for the current personal information in the target passport based on the current personal information and the storage location of the current personal information, and sending the encryption instruction to the passport, so that the passport controls the verification chip to retrieve the personal information according to the encryption instruction, determining the encryption strategy according to the encryption instruction, and encrypting the personal information according to the encryption strategy to obtain the encrypted personal information, receiving the encrypted personal information sent by the current scanning device, decrypting the encrypted personal information to obtain the real personal information of the passport, and returning to execute to determine whether the real personal information is consistent with the personal information of the target passport, until the preset condition is met; The preset condition includes any of the following: The current real personal information is inconsistent with the personal information of the target passport; The current real personal information is consistent with the personal information of the target passport, and the current real personal information is the last personal information in the passport.

2. A chip COS security protection method according to claim 1, characterized in that: The encryption instruction includes an identifier of at least one encryption strategy, and the encryption instruction for generating the current personal information in the target passport based on the current personal information and the storage location of the current personal information includes: Determining the identifier of the number of encryption policies required for the current personal information from a preset database based on a preset method, wherein the preset method includes according to the importance level of the current personal information and the encryption level of the encryption policy, or randomly; determining an encrypted data segment for each encryption strategy based on the data length of the current personal information of the target passport; Determine the correspondence between each identifier and the encrypted data segment; The storage location of the current personal information is determined, and an encryption instruction is generated based on the storage location, the identifier, the encrypted data segment, and the corresponding relationship.

3. A chip COS security protection method according to claim 1, characterized in that: If the current real personal information is inconsistent with the personal information of the target passport, the method further includes: A termination instruction is sent to the passport, so that the passport controls the verification chip to self-lock and disconnects the communication connection between the verification chip and the storage chip storing the personal information.

4. A chip COS security protection method according to claim 1, characterized in that: The method further comprises: If the current personal information is a biometric feature, multiple data segments are determined from the data of the biometric feature, each data segment corresponding to a data length and a position; Determine an identification of the encryption policy for each data segment; Generate an encryption instruction based on the length, position and identifier of each data segment, so that the verification chip in the passport retrieves the data segment in the passport according to the length and position of each data segment, and determines the encryption strategy of each data segment according to the identifier, and encrypts each data segment based on the encryption strategy, so that the passport sends the encrypted data segment; receiving the encrypted data segment, and decrypting the encrypted data segment to obtain a real data segment; If there is a real data segment that is inconsistent with the data segment in the corresponding target passport, it is determined that the passport has been stolen.

5. A chip COS security protection method according to claim 1, characterized in that: The real scanning device corresponds to a plurality of associated scanning devices, and the method further includes: Determine a first target associated scanning device based on the device identity information, current time, and encryption algorithm; Sending a first instruction to the real scanning device, so that the real scanning device determines a second target associated scanning device from the multiple associated scanning devices, wherein the first target associated scanning device and the second target associated scanning device are the same scanning device; Sending a second instruction to the current scanning device, so that the current scanning device determines a third target associated scanning device from the multiple associated scanning devices; If the first target associated scanning device is consistent with the third target associated scanning device, controlling the real scanning device to send first networking data to the first target associated scanning device, and controlling the current scanning device to send second networking data to the third target associated scanning device; receiving network data sent by the first target associated scanning device, wherein the network data includes the first network data of the real scanning device and the third network data of the first target associated scanning device itself, or includes the first network data, the second network data and the third network data; If the received networking data includes the first networking data, the second networking data and the third networking data, and the first networking data, the second networking data and the third networking data are all the same, determining that the current scanning device is the real scanning device; If the first networking data and the third networking data are received, determining that the current scanning device is an illegal scanning device; If the first networking data, the second networking data and the third networking data are received, and the second networking data is different from the first networking data and the second networking data is different from the third networking data, it is determined that the current scanning device is an illegal scanning device.

6. A chip COS security protection method according to claim 1, characterized in that: If the current real personal information is inconsistent with the personal information of the target passport, the method further includes: Searching for a relevant person corresponding to the passport based on the number information, and determining a terminal device of the relevant person; Sending a prompt message to the terminal device.

7. A chip COS security protection method, characterized in that: Performed by a passport that includes a verification chip, including: Receiving device identity information sent to the passport, wherein the device identity information represents the identity of the current scanning device; If the device identity information is consistent with at least one preset device identity information stored in the verification chip, the passport number information in the verification chip is retrieved, and the passport number information and a control instruction are sent to the current scanning device, so that the current scanning device sends the number information and the device identity information to the server after receiving the number information and the control instruction, and obtains the working state of the real scanning device corresponding to the device identity information, the working state including the scanning state and the idle state. If it is in the scanning state, obtain at least one personal information of the target passport and the storage location corresponding to each personal information, and the target passport is the passport being scanned by the real scanning device; receiving an encryption instruction, and controlling the verification chip to retrieve personal information according to a storage location, and encrypting the personal information in the passport based on the encryption instruction to obtain encrypted personal information, wherein the encryption instruction is an encryption instruction for the server to generate the current personal information in the target passport based on the current personal information and the storage location of the current personal information; Sending the encrypted personal information so that the server obtains the encrypted personal information of the passport, decrypts the encrypted personal information to obtain the real personal information of the passport, and determines whether the passport is stolen based on the personal information of the target passport and the storage location corresponding to each item of personal information; Wherein, whether the passport is stolen is determined by the server based on the real personal information and the personal information of the target passport through the following steps, including: Determining whether the real personal information is consistent with the personal information of the target passport; If they are consistent, the following steps are executed in a loop: determining the current personal information in the target passport that needs to be determined to be consistent, generating an encryption instruction for the current personal information in the target passport based on the current personal information and the storage location of the current personal information, and sending the encryption instruction to the passport, so that the passport controls the verification chip to retrieve the personal information according to the encryption instruction, determining the encryption strategy according to the encryption instruction, and encrypting the personal information according to the encryption strategy to obtain the encrypted personal information, receiving the encrypted personal information sent by the current scanning device, decrypting the encrypted personal information to obtain the real personal information of the passport, and returning to execute to determine whether the real personal information is consistent with the personal information of the target passport, until the preset condition is met; The preset condition includes any of the following: The current real personal information is inconsistent with the personal information of the target passport; The current real personal information is consistent with the personal information of the target passport, and the current real personal information is the last personal information in the passport.

8. A chip COS security protection system, characterized in that: include: A server, which is connected to the current scanning device of the passport and then connected to the passport, and connected to the real scanning device, and is used to execute a chip COS security protection method according to any one of claims 1 to 6; A passport is communicatively connected to the current scanning device and then to the server, the passport comprises a verification chip, at least one processor, at least one memory, and at least one application, the verification chip is communicatively connected to the processor, the verification chip is communicatively connected to the memory, the at least one application is stored in the memory and is configured to be executed by the at least one processor, the at least one application is used to execute a chip COS security protection method according to claim 7.

9. A passport, characterized in that: include: at least one processor; at least one memory; A verification chip, the verification chip is in communication with the processor, the verification chip is in communication with the memory, and is used to retrieve personal information according to a storage location, and encrypt the personal information in the passport based on an encryption instruction to obtain encrypted personal information; At least one application, the at least one application is stored in the memory and is configured to be executed by the at least one processor, and the at least one application is used to execute a chip COS security protection method according to claim 7.

Images