RFID smart card security authentication method and system

Abstract

The invention relates to the technical field of smart card security authentication, and discloses a RFID smart card security authentication method and system. The method comprises: initializing and configuring an RFID system and extracting features of an RFID smart card to obtain a signal feature vector; analyzing through a multi-level positioning algorithm to obtain real-time position data; creating an encryption module and a decryption module and generating secure communication data; analyzing a multi-factor authentication protocol to obtain an authentication process model; generating a distributed authentication network according to the authentication process model, and generating a security authentication result of the RFID smart card according to the distributed authentication network, wherein the distributed authentication network comprises a plurality of local authentication nodes and a central authentication node. The invention comprehensively considers multi-factor verification, precise positioning and distributed authentication to perform RFID smart card security authentication, thereby improving the security, reliability and scalability of the RFID system.

Description

Technical Field

[0001] The present invention relates to the technical field of smart card security authentication, and in particular to a RFID smart card security authentication method and system. Background Art

[0002] RFID smart cards have been widely used in access control systems, public transportation, and electronic payments, becoming critical infrastructure. However, the security and privacy issues of RFID systems are becoming increasingly prominent, and traditional single authentication methods are difficult to cope with complex security threats. Existing RFID authentication methods often ignore the importance of location information and are difficult to effectively prevent replay attacks and man-in-the-middle attacks.

[0003] In addition, as the scale of RFID applications expands, centralized authentication architectures face challenges such as high communication overhead, degraded system performance, and low cross-region access efficiency. Existing lightweight cryptographic algorithms often fail to meet the resource-constrained characteristics of RFID smart cards while ensuring security, affecting authentication efficiency and user experience. Summary of the invention

[0004] The present invention provides an RFID smart card security authentication method and system. The present invention comprehensively considers multi-factor verification, precise positioning and distributed authentication to perform RFID smart card security authentication, thereby improving the security, reliability and scalability of the RFID system.

[0005] In a first aspect, the present invention provides an RFID smart card security authentication method, the RFID smart card security authentication method comprising:

[0006] Initialize and configure the RFID system, and extract the signal features of the RFID smart card through the configured RFID system to obtain a signal feature vector;

[0007] Inputting the signal feature vector into a multi-level positioning algorithm for analysis to obtain real-time location data of the RFID smart card;

[0008] Creating an encryption module and a decryption module of a lightweight cryptographic algorithm according to the hardware constraints of the RFID smart card, and generating secure communication data according to the encryption module and the decryption module;

[0009] Performing a multi-factor authentication protocol analysis based on the real-time location data and the secure communication data to obtain an authentication process model, wherein the authentication process model integrates processing logics of key verification, location verification, and timestamp verification;

[0010] A distributed authentication network is generated according to the authentication process model, and a security authentication result of the RFID smart card is generated according to the distributed authentication network. The distributed authentication network includes a plurality of local authentication nodes and a central authentication node.

[0011] In a second aspect, the present invention provides an RFID smart card security authentication system, the RFID smart card security authentication system comprising:

[0012] A configuration module is used to initialize and configure the RFID system, and extract the signal characteristics of the RFID smart card through the configured RFID system to obtain a signal characteristic vector;

[0013] An analysis module, used for inputting the signal feature vector into a multi-level positioning algorithm for analysis to obtain real-time location data of the RFID smart card;

[0014] A creation module, used to create an encryption module and a decryption module of a lightweight cryptographic algorithm according to the hardware constraints of the RFID smart card, and generate secure communication data according to the encryption module and the decryption module;

[0015] An integration module, configured to perform a multi-factor authentication protocol analysis based on the real-time location data and the secure communication data to obtain an authentication process model, wherein the authentication process model integrates processing logics of key verification, location verification, and timestamp verification;

[0016] A generation module is used to generate a distributed authentication network according to the authentication process model, and generate a security authentication result of the RFID smart card according to the distributed authentication network, wherein the distributed authentication network includes multiple local authentication nodes and one central authentication node.

[0017] The third aspect of the present invention provides a computer device, comprising: a memory and at least one processor, wherein the memory stores instructions; the at least one processor calls the instructions in the memory so that the computer device executes the above-mentioned RFID smart card security authentication method.

[0018] A fourth aspect of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores instructions, which, when executed on a computer, enable the computer to execute the above-mentioned RFID smart card security authentication method.

[0019] In the technical solution provided by the present invention, the positioning accuracy of the RFID smart card is improved through a multi-level positioning algorithm, combined with signal feature vector analysis and multi-reader information fusion, providing a reliable basis for subsequent location verification. The encryption module and the decryption module are designed using a lightweight cryptographic algorithm, which not only meets the hardware constraints of the RFID smart card, but also ensures the security of the communication data, and effectively balances security and performance. The multi-factor authentication protocol integrating key verification, location verification and timestamp verification significantly improves the reliability of authentication and effectively prevents security threats such as replay attacks and man-in-the-middle attacks. Based on the design of a distributed authentication network, the communication overhead and performance problems in large-scale RFID systems are solved, and the scalability and cross-regional access efficiency of the system are improved. Through the collaborative work of local authentication nodes and central authentication nodes, decentralized processing and dynamic load balancing of authentication tasks are realized, and the authentication efficiency and robustness of the overall system are improved. The credibility evaluation mechanism is introduced, and the credibility score of the local authentication result is used to dynamically determine whether the central node needs further verification, thereby optimizing the authentication process and reducing system resource consumption. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying any creative work.

[0021] Figure 1 A schematic diagram of the steps of the RFID smart card security authentication method in an embodiment of the present invention;

[0022] Figure 2 Schematic diagram of the structure of the RFID smart card security authentication system in an embodiment of the present invention. DETAILED DESCRIPTION

[0023] The embodiment of the present invention provides a RFID smart card security authentication method and system. The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments described here can be implemented in an order other than that illustrated or described here. In addition, the terms "including" or "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0024] For ease of understanding, the specific process of the embodiment of the present invention is described below. Figure 1 , an embodiment of the RFID smart card security authentication method in the embodiment of the present invention includes:

[0025] Step S1, initializing and configuring the RFID system, and extracting the signal features of the RFID smart card through the configured RFID system to obtain a signal feature vector;

[0026] It is understandable that the execution subject of the present invention may be an RFID smart card security authentication system, or a terminal or a server, which is not limited here. The embodiment of the present invention is described by taking a server as the execution subject as an example.

[0027] Specifically, the security parameters of the RFID system are set, that is, the basic security elements such as the encryption key length, the hash function type, and the random number generator seed are set. Through the parameter setting, the corresponding key is generated and used to establish an RFID tag information database. The database stores the key data of all RFID tags, including the unique identifier of each tag, the initial key, and the last authentication time. The reader network is configured. The physical location coordinates of each reader and the data of its coverage are determined. This information helps the system understand the actual area that each reader can monitor, and use this data for location verification during the authentication process. At the same time, the RFID tags are initialized, and the globally unique unique identifier and initial key are assigned to each RFID tag. This allows each RFID tag to be uniquely identified, and its key information can be used by the system as the basis for subsequent encryption and decryption. Reference tags are arranged in the system deployment area. The arrangement of reference tags helps to establish a stable positioning reference, because the reference tags periodically send signals to the system so that the system can determine the location of these tags by receiving signal strength indications and phase information. The received signal strength indication and phase information are input into the environmental parameter model, and the initial positioning model is obtained by analyzing these data. The initial positioning model reflects the basic environmental characteristics of the system deployment area and can help the system accurately locate RFID tags under different environmental conditions. The initial positioning model is processed with the tag information set, and the unique identifier, initial key and other authentication information of the tag are comprehensively considered to form a multi-factor verification rule. Through the configured RFID system, the signal characteristics of the RFID smart card can be extracted in actual applications to obtain the signal feature vector.

[0028] Furthermore, the physical location coordinates and coverage data of the card reader are set in the configured RFID system. These data are used to determine the precise location of each card reader and the range it can cover, and the inquiry signal sending interval of the card reader is set accordingly to form a complete inquiry signal sending time sequence, so as to ensure that each card reader queries the RFID smart card in an orderly manner in different time periods to avoid signal interference and data conflicts. Inquiry signals are sent to all RFID smart cards within its coverage range at a predetermined time interval. After receiving these inquiry signals, the RFID smart card automatically generates a response signal containing its unique identifier and returns it to the card reader. By real-time acquisition of the response signal, the response signal data containing the unique identifier is obtained. At the same time, the signal strength is measured based on the received response signal to obtain the received signal strength indication value, which reflects the relative distance between the RFID smart card and the card reader and the stability of the signal transmission, and is helpful for subsequent positioning and authentication analysis. Phase analysis is performed on each response signal to obtain the phase value of the signal. Phase information is helpful for accurate positioning and judgment of multipath effects, and can improve the spatial resolution of the signal and the reliability of authentication. The received signal strength indicator value, signal phase value and signal reception timestamp are combined to generate the original feature vector. The original feature vectors collected multiple times are weighted averaged to effectively eliminate accidental errors, reduce the impact of signal fluctuations, and obtain a more stable feature vector. The processed stable feature vector is associated with the corresponding reader identifier and the unique identifier of the RFID smart card to obtain the signal feature vector.

[0029] Step S2, inputting the signal feature vector into a multi-level positioning algorithm for analysis to obtain real-time location data of the RFID smart card;

[0030] Specifically, the received signal strength indicator value in the signal feature vector is compared with a threshold value to preliminarily determine the relative position range of the RFID smart card, and thereby determine its initial positioning area. The coverage range of the RFID system is grid-divided based on the initial positioning area to generate a set of multiple candidate locations. The entire area is divided into several small grid units, each of which corresponds to a possible RFID smart card location. The signal feature vector is input into the K-means clustering algorithm to cluster the candidate location set. The K-means clustering algorithm can effectively classify candidate locations with similar signal characteristics into one category to form multiple cluster centers. These cluster centers represent the main location distribution characteristics in the candidate location set. The Euclidean distance between the signal feature vector and each cluster center is calculated, and the N cluster centers with the smallest distance are selected as the coarse-grained search results, thereby narrowing the location search range based on the initial positioning area. In the cluster corresponding to the coarse-grained search results, the weighted Euclidean distance between the signal feature vector and each location fingerprint is calculated to obtain M target location fingerprints. Multi-reader information fusion is performed on the M target location fingerprints. By fusing the signal feature data from different readers, a more accurate fused feature vector is constructed. The fused feature vector integrates the observation information of multiple readers, reducing the limitations of the positioning accuracy of a single reader. The similarity between the signal feature vector and each fused feature vector in the candidate position set is calculated by Mahalanobis distance to obtain the final positioning result of the RFID smart card. In order to improve the positioning accuracy and stability, the final positioning result is smoothed by Kalman filtering. Kalman filtering is a state estimation algorithm that effectively filters out noise and short-term fluctuations, smoothes positioning data, and generates more stable and continuous real-time position data.

[0031] Step S3: creating an encryption module and a decryption module of a lightweight cryptographic algorithm according to the hardware constraints of the RFID smart card, and generating secure communication data according to the encryption module and the decryption module;

[0032] Specifically, in order to adapt to the limited computing power, storage space and energy consumption of RFID smart cards, cryptographic algorithms suitable for lightweight applications are preferred, and the key length and group size are set according to the hardware characteristics of RFID smart cards to generate a basic parameter set. The key length determines the security strength of the encryption process, while the group size affects the efficiency and applicability of data encryption. Based on the determined basic parameter set, a nonlinear permutation box (S-box) is constructed. By designing a reasonable S-box, attackers are prevented from cracking the encryption process through linear analysis or differential analysis, and a key expansion function is generated to expand the input original key into multiple round keys. The key expansion function combines the information in the basic parameter set and generates a round key sequence corresponding to each round of encryption operation through multiple rounds of transformation. At the same time, a round key sequence is generated according to the key expansion function and a preset round constant to obtain an encryption round function. The communication data to be encrypted is divided into left and right halves, and then the encryption round function is applied to the right half. The data of the right half is combined with the round key, and the updated right half data is obtained after a series of nonlinear transformations. The updated right half is XORed with the left half to obtain a new left half. Repeat multiple rounds of encryption operations, each of which includes the application of encryption round functions and XOR operations, so as to continuously update the data in the left and right halves. After multiple round function processing, an encryption module is formed. The encryption module encrypts the input communication data into ciphertext, providing reliable data confidentiality. At the same time, a decryption module is created to ensure that the encrypted data is correctly decrypted by legitimate users. The generation process of the decryption module is similar to that of the encryption module, but it reverses the round key sequence used in the encryption process, that is, the method of reverse round key processing is adopted in the decryption module. In this way, the decryption module reversely recovers the modified data in the encryption process round by round, and accurately restores the original plaintext data. The communication data is encrypted and decrypted based on the encryption module and the decryption module. The communication data to be transmitted is input into the encryption module, and the ciphertext data is obtained after multiple rounds of transformation of the encryption algorithm. The ciphertext data is transmitted through the communication channel between the RFID smart card and the card reader. At the receiving end, the decryption module is used to decrypt the received ciphertext data to restore the original plaintext communication data.

[0033] Furthermore, the communication data is processed in groups and divided into a plurality of fixed-length data block sequences. The first data block is XORed according to a preset initial vector. The initial vector is usually a random or fixed value with the same length as the data block, which is used to provide a source of randomness in each encryption process. The initial encrypted input is obtained by XORing the initial vector with the first data block. The initial encrypted input is sent to the encryption module for encryption processing. The encryption module performs multiple rounds of encryption operations on the input data according to the preset encryption algorithm and round key sequence to obtain the first ciphertext block. The first ciphertext block is XORed with the next data block to be encrypted to generate a new encryption input. This encryption mode is a chained block encryption, which can effectively prevent the replay attack of a single data block and improve the security and unpredictability of data encryption. The above encryption processing and XOR operation process are repeated, and each data block is input into the encryption module in turn for encryption processing, and the ciphertext block of the previous round is XORed with the plaintext data block of the next round to obtain the next encryption input. This process continues until all data blocks are processed, and finally a complete ciphertext sequence is generated. After the encryption process is completed, the complete ciphertext sequence is used as input and sent to the decryption module for decryption processing. By using the same round key sequence and decryption algorithm as the encryption module, the decryption module can restore the plaintext data block corresponding to each ciphertext block round by round. Each ciphertext block is input into the decryption module in turn, and the decrypted data block is XORed with the previous ciphertext block (or initial vector) to gradually restore the original data block sequence and obtain the decrypted data block sequence. The decrypted data block sequence is verified and integrity checked. According to pre-defined verification rules, such as checksums or message authentication codes, the integrity of each data block is checked to ensure the accuracy and reliability of the data. If a data block in the data block sequence fails to pass the verification, the data block is marked as invalid data and excluded in subsequent processing. Conversely, all data blocks that pass the verification will be marked as valid data. According to the verification results, all valid data blocks are screened out and recombined into a complete secure communication data sequence.

[0034] Step S4: Perform multi-factor authentication protocol analysis based on real-time location data and secure communication data to obtain an authentication process model, which integrates the processing logic of key verification, location verification, and timestamp verification;

[0035] Specifically, a random challenge and a current timestamp are generated based on secure communication data to form authentication request data. The random challenge is generated to prevent replay attacks and ensure that the data of each authentication request is random and unpredictable. The current timestamp is used to verify the timeliness of the authentication response data to prevent attackers from using expired data to perform illegal authentication operations. The authentication request data is sent to the RFID smart card and waits for it to return the authentication response data. When the system receives the authentication response data from the RFID smart card, the authentication response data is decrypted. Through decryption, the unique identifier, random number and timestamp information of the RFID smart card are extracted. The decrypted unique identifier can uniquely identify the RFID smart card and is used to query the historical authentication information stored in the background database. During the query process, all historical authentication records associated with the unique identifier are retrieved, including the time, location and other important information of the last authentication. The real-time location data is compared with the last authentication location in the historical authentication information to calculate the position deviation value. The position deviation value reflects the displacement of the RFID smart card between two authentications. If the position deviation value exceeds the preset threshold range, it indicates that the RFID smart card has been illegally moved or an abnormal situation has occurred. At the same time, the timestamp information in the authentication response data is verified for validity. By comparing the timestamp with the current time, it is determined whether the timestamp is within the allowed time window. If the timestamp is expired or too early, it means that the authentication response data has been tampered with or replayed. A comprehensive analysis is performed based on the location deviation value and the timestamp verification result to obtain the multi-factor verification result. If the location deviation value is within a reasonable range and the timestamp verification result is valid, the multi-factor verification result is passed, indicating that the location, time and identity of the RFID smart card are in line with expectations, and the subsequent authentication process continues; conversely, if any verification result does not meet expectations, the multi-factor verification result is marked as failed, and the corresponding security warning is triggered or other countermeasures are taken. A complete authentication process model is generated based on the multi-factor verification result. The authentication process model includes the processing logic of key verification, location verification and timestamp verification. Key verification refers to the verification of the random number and unique identifier returned by the RFID smart card to confirm whether it is consistent with the information in the database. Location verification refers to the comparison of real-time location data with historical authentication locations to confirm whether the RFID smart card is within the expected geographical location range. Timestamp verification is to check the timestamp returned by the RFID smart card to ensure that it is within the specified time window to prevent replay attacks.

[0036] Step S5: Generate a distributed authentication network according to the authentication process model, and generate a security authentication result of the RFID smart card according to the distributed authentication network, wherein the distributed authentication network includes a plurality of local authentication nodes and a central authentication node.

[0037] Specifically, the coverage area of ​​the RFID system is divided based on the authentication process model, and the entire coverage area is divided into several authentication domains. Each authentication domain represents a relatively independent authentication area, which can perform independent authentication processing on the RFID smart card in the area. A local authentication server is deployed in each authentication domain as the local authentication node of the authentication domain. The local authentication node is responsible for processing the authentication request of the RFID smart card in its area and providing preliminary security authentication judgment. By reasonably dividing the authentication domain and deploying local authentication nodes, the authentication load is effectively shared, and the authentication efficiency and reliability of the system are improved. The public key infrastructure (PKI) is configured for the local authentication node and the central authentication node to ensure the security of communication between nodes. A pair of public and private keys is assigned to each authentication node, and the public key is registered to a trusted certificate authority, so that each node can verify each other's identity during communication and prevent unauthorized nodes from joining the authentication network. Based on the public and private keys between nodes, the inter-node secure communication keys are generated, and these keys are used to establish a secure communication channel between the local authentication node and the central authentication node. Through the secure communication channel, each node in the distributed authentication network securely exchanges authentication information, prevents communication data from being eavesdropped or tampered with, and builds a secure and reliable distributed authentication network. The authentication request of the RFID smart card is forwarded to the local authentication node of the authentication domain to which it belongs. The local authentication node executes the multi-factor authentication protocol according to the authentication process model, including key verification, location verification and timestamp verification of the RFID smart card. Through these verification steps, the local authentication node obtains a local authentication result, indicating whether the RFID smart card meets the requirements of security authentication. The local authentication result is evaluated for credibility to obtain a credibility score. The credibility score reflects the reliability and credibility of the local authentication result. If the credibility score is higher than the preset threshold, it means that the local authentication result has a high credibility, and the security authentication result is directly generated based on the result; conversely, if the credibility score is lower than the preset threshold, it means that the local authentication node may encounter a complex situation that cannot be handled independently, and further verification by the central authentication node is required. In this case, the authentication request is forwarded to the central authentication node. The central authentication node is the core node of the distributed authentication network and has stronger computing and analysis capabilities. The central authentication node performs a more comprehensive verification of the authentication request that the local authentication node fails to effectively process, including in-depth analysis of historical authentication data, comprehensive comparison of multi-domain authentication information, etc. After processing the authentication request, the central authentication node returns a verification result of the central authentication node. The verification result is comprehensively analyzed and decided with the local authentication result to obtain the final RFID smart card security authentication result. The security authentication result is sent to the card reader that initiated the authentication request so that the card reader can process the RFID smart card accordingly based on the authentication result.At the same time, the authentication result is updated to the authentication information database in the distributed authentication network so that historical authentication data can be referenced in future authentication processes.

[0038] In this embodiment, the authentication request of the RFID smart card is forwarded to the local authentication node in the authentication domain. The local authentication node parses the received authentication request and extracts the unique identifier and current location information of the RFID smart card. Based on this information, the local authentication node queries the historical authentication records in its cache database to obtain the time and location changes of the smart card in the recent authentications. The historical authentication records are compared and analyzed with the current authentication request to calculate the time interval and position change between different authentication events of the RFID smart card, reflecting the mobile characteristics of the RFID smart card. Based on the time interval and position change, the moving speed of the RFID smart card between two authentications is calculated. The moving speed is compared with the preset reasonable speed range to evaluate the rationality of the speed. If the moving speed is within a reasonable range, it means that the moving behavior of the RFID smart card is normal; on the contrary, if the speed exceeds the reasonable range, it indicates that the smart card has been illegally transferred or other abnormal conditions. The authentication response data returned by the RFID smart card is decrypted and integrity checked. The authentication information of the RFID smart card is extracted from the encrypted authentication response data, including the unique identifier, random number, timestamp, etc. of the smart card. After decryption is completed, the decrypted authentication information is integrity checked to confirm whether the data has been tampered with or damaged during transmission. After the verification is passed, the decrypted authentication information is compared with the locally stored RFID smart card key information to verify whether the key information returned by the RFID smart card is consistent with the local record, and confirm the legitimacy of the smart card identity. A multi-factor comprehensive evaluation is performed based on the speed rationality evaluation results and the key verification results. If the speed rationality evaluation results show that the movement speed of the RFID smart card is within a reasonable range and the key verification results pass, it indicates that the authentication request of the RFID smart card is credible, and a local authentication result is generated; if any verification result fails, the local authentication result is a failure. The local authentication node generates a local authentication result based on the results of the multi-factor comprehensive evaluation. This result is used to determine whether the RFID smart card continues to access system resources or whether further verification processing is required.

[0039] In the embodiment of the present invention, the positioning accuracy of the RFID smart card is improved by combining the signal feature vector analysis and the multi-reader information fusion through the multi-level positioning algorithm, which provides a reliable basis for the subsequent location verification. The encryption module and the decryption module are designed by using a lightweight cryptographic algorithm, which not only meets the hardware constraints of the RFID smart card, but also ensures the security of the communication data, and effectively balances the security and performance. The multi-factor authentication protocol integrating key verification, location verification and timestamp verification significantly improves the reliability of authentication and effectively prevents security threats such as replay attacks and man-in-the-middle attacks. Based on the design of the distributed authentication network, the communication overhead and performance problems in the large-scale RFID system are solved, and the scalability and cross-regional access efficiency of the system are improved. Through the collaborative work of the local authentication node and the central authentication node, the decentralized processing and dynamic load balancing of the authentication task are realized, and the authentication efficiency and robustness of the overall system are improved. The credibility evaluation mechanism is introduced, and the credibility score of the local authentication result is used to dynamically determine whether the central node needs further verification, thereby optimizing the authentication process and reducing the system resource consumption.

[0040] In a specific embodiment, the process of executing step S1 may specifically include the following steps:

[0041] Set security parameters for the RFID system to obtain encryption key length, hash function type, and random number generator seed;

[0042] Establishing an RFID tag information database based on the encryption key length, the hash function type, and the random number generator seed, and obtaining a tag information set including a unique identifier, an initial key, and a last authentication time;

[0043] The card reader network is configured to obtain the physical location coordinates and coverage data of each card reader, and the RFID tag is initialized to obtain an initialized RFID tag with a globally unique unique identifier and an initial key;

[0044] Reference tags are arranged in the system deployment area, and the reference tags are periodically scanned to obtain received signal strength indication and phase information, and the received signal strength indication and phase information are input into the environmental parameter model to obtain an initial positioning model;

[0045] The initial positioning model and tag information set are processed to obtain multi-factor verification rules, and the signal features of the RFID smart card are extracted through the configured RFID system to obtain a signal feature vector.

[0046] Specifically, the security parameters of the RFID system are set to obtain the encryption key length, hash function type and random number generator seed. The encryption key length determines the encryption strength of the system, usually in bits, such as 128 bits, 192 bits or 256 bits. The hash function type is used to ensure the integrity and immutability of the data. The random number generator seed is used to generate the random numbers required in the encryption process. It is the basis of the encryption algorithm and ensures that the generated keys and other security parameters have sufficient randomness, thereby enhancing the security of the system. By setting these security parameters reasonably, the RFID system is ensured to have sufficient security during data transmission and authentication. Based on the set encryption key length, hash function type and random number generator seed, an RFID tag information database is established. The database is used to store the information of all RFID tags, including the unique identifier of each tag, the initial key and the last authentication time. The reader network is configured to ensure that the physical location coordinates and coverage data of each reader can be accurately recorded. The physical location coordinates of the reader are usually expressed in latitude and longitude coordinates, while the coverage represents the effective area that the reader can monitor. All RFID tags are initialized. Each RFID tag is assigned a globally unique identifier and an initial key. This information is used for subsequent authentication and encrypted communication. This information is stored in the tag information database for quick query and comparison during the authentication process. Reference tags are arranged in the deployment area of ​​the system. Reference tags are RFID tags with known locations, which are used for calibration and establishing positioning models. The reference tags are scanned periodically to collect their received signal strength indication (RSSI) and phase information. RSSI reflects the distance between the tag and the reader, while the phase information provides more accurate distance measurement data. The initial positioning model is established by inputting the received signal strength indication and phase information into the environmental parameter model. Assume that three reference tags are arranged in a certain area, located at (0, 0), (10, 0) and (5, 10), and the reader is located at (5, 5). The distance between the tag and the reader is calculated using the received signal strength and phase information, for example, by the formula:

[0047] ;

[0048] in, is the distance between the tag and the reader, is the speed of light, is the phase difference of the received signal, and is the frequency of the signal. Through this formula, the distance between the reference tag and the reader is calculated, and the distance information is input into the initial positioning model. The initial positioning model is combined with the tag information set in the tag information database to generate multi-factor verification rules, including multi-factor authentication of tag location, key, timestamp and other information. For example, when a tag attempts to authenticate, check whether its current position is within a reasonable range, whether the key is valid, whether the last authentication time is within the allowed time window, etc. Multi-factor verification rules effectively prevent tags from being forged, copied or illegally transferred, thereby improving the security of the system. The signal features of the RFID smart card are extracted through the configured RFID system to obtain a signal feature vector. The signal feature vector is a set of parameters used to describe the communication characteristics between the RFID smart card and the reader, including RSSI, phase information, timestamp, etc.

[0049] In a specific embodiment, the execution step extracts the signal features of the RFID smart card through the configured RFID system to obtain the signal feature vector, which may specifically include the following steps:

[0050] The card reader inquiry signal sending interval is set by using the card reader physical position coordinates and coverage data in the configured RFID system to obtain the inquiry signal sending time series;

[0051] Based on the time sequence of the query signal transmission, the RFID smart card is subjected to signal collection to obtain a response signal including a unique identifier;

[0052] Recording the time of receiving the response signal to obtain a signal receiving timestamp, and measuring the signal strength based on the response signal to obtain a received signal strength indicator value;

[0053] Performing phase analysis on the response signal to obtain a signal phase value, and combining the received signal strength indication value, the signal phase value and the signal receiving timestamp to obtain an original feature vector;

[0054] The original feature vectors collected multiple times are weighted averaged to obtain a stable feature vector, and the stable feature vector is associated with the card reader identifier and the RFID smart card unique identifier to obtain a signal feature vector.

[0055] Specifically, the reader interrogation signal sending interval is set by the physical position coordinates and coverage data of the reader in the configured RFID system. The physical position coordinates represent the specific position of the reader in three-dimensional space. The coverage data refers to the spatial area where the reader can effectively identify the RFID tag, usually expressed in the form of radius or three-dimensional range. When setting the interrogation signal sending interval, the signal interleaving and possible interference between multiple readers are considered. In order to avoid conflicts and signal confusion caused by multiple readers sending interrogation signals at the same time, a reasonable time interval is designed based on the physical position coordinates and coverage data of the reader. Assume that there are three readers in an RFID system, and their physical position coordinates are (0, 0, 2), (5, 5, 2) and (10, 0, 2), and the coverage radius is 10 meters. This means that each reader works effectively in a circular plane with a radius of 10 meters centered on them. In order to prevent signal overlap and interference between card readers, an independent query signal sending time interval is set for each card reader. For example, the sending time interval of the first card reader is T1, the second is T2, and the third is T3. The three time intervals are staggered to form a complete query signal sending time sequence. The time sequence is expressed as . The signal of the RFID smart card is collected based on the time sequence of the inquiry signal transmission. When the first card reader sends an inquiry signal within the time interval T1, all RFID smart cards within its coverage will receive the inquiry signal and return a response signal. The response signal contains the unique identifier of the RFID smart card and other authentication-related information. In this way, all RFID smart cards in the current range are identified. After receiving the response signal from the RFID smart card, the system records the reception time of each response signal, which is the signal reception timestamp. After receiving the response signal, the signal strength is measured to obtain the received signal strength indicator (RSSI). RSSI reflects the distance between the RFID smart card and the card reader. The signal strength is usually expressed in dBm (decibel milliwatts). The smaller the value, the weaker the signal. The RSSI value of each response signal is recorded as reference data for subsequent positioning and authentication. At the same time, the response signal is phase analyzed. The phase information provides the phase change during signal propagation, which can help the system more accurately determine the distance and position of the RFID smart card. Assume that the phase of the signal received by the system is , the phase is expressed as:

[0056] ;

[0057] in, is the phase of the signal, is the propagation distance of the signal, is the wavelength of the signal. By measuring and analyzing the phase information, the relative position change of the RFID smart card is inferred. The received signal strength indicator value, signal phase value and signal reception timestamp are combined to form an original feature vector. The original feature vectors collected multiple times are weighted averaged to eliminate random noise and instantaneous fluctuations to obtain a stable feature vector. The stable feature vector is associated with the corresponding reader identifier and RFID smart card unique identifier to form a complete signal feature vector.

[0058] In a specific embodiment, the process of executing step S2 may specifically include the following steps:

[0059] Perform threshold comparison on the received signal strength indicator value in the signal feature vector to obtain the initial positioning area of ​​the RFID smart card, and divide the system coverage area into grids based on the initial positioning area to obtain a set of candidate locations;

[0060] The signal feature vector is input into the K-means clustering algorithm to cluster the candidate location set to obtain the cluster center set, and the Euclidean distance between the signal feature vector and each cluster center is calculated. The N cluster centers with the smallest distance are selected to obtain the coarse-grained search results.

[0061] In the cluster corresponding to the coarse-grained search results, the weighted Euclidean distance between the signal feature vector and each location fingerprint is calculated to obtain M target location fingerprints;

[0062] The multi-reader information is fused for the M target location fingerprints to construct a fused feature vector to obtain a candidate location set. The similarity between the signal feature vector and each fused feature vector in the candidate location set is calculated using the Mahalanobis distance to obtain the final positioning result.

[0063] The final positioning result is smoothed by Kalman filtering to obtain the real-time location data of the RFID smart card.

[0064] Specifically, the received signal strength indicator (RSSI) in the signal feature vector is compared with a threshold value to determine the initial positioning area of ​​the RFID smart card. The received signal strength indicator reflects the distance between the RFID smart card and the card reader. By setting an RSSI threshold, it is determined whether the RFID smart card is within the effective coverage range of a certain card reader. In this way, the RFID smart card is divided into different initial positioning areas. Based on the initial positioning area, the coverage range of the entire RFID system is grid-divided to obtain a set of candidate locations. The overall area covered by the system is divided into several equally spaced small areas, each of which represents an RFID smart card location. Each candidate location has a unique coordinate representation, such as (x, y), where x and y represent the horizontal and vertical coordinates of the grid unit, respectively. The signal feature vector is input into the K-means clustering algorithm to cluster the candidate location set. The K-means clustering algorithm divides a given data set into K clusters, each of which has a center point (i.e., the cluster center). The signal characteristics (such as RSSI value) of each candidate location are used as input data to divide them into several clusters. For example, suppose the candidate location set is divided into 5 clusters, each cluster has a cluster center, and these cluster centers reflect the average characteristics of all locations in each cluster. Calculate the Euclidean distance between the signal feature vector and each cluster center:

[0065] ;

[0066] in, represents the Euclidean distance between the signal feature vector and the cluster center, is the coordinate of the signal eigenvector, are the coordinates of the cluster center. By calculating the Euclidean distance, determine which cluster center the signal feature vector is closest to, and then select the N cluster centers with the smallest distance as the coarse-grained search results. In the cluster corresponding to the coarse-grained search results, calculate the weighted Euclidean distance between the signal feature vector and each location fingerprint. Location fingerprint is a data structure that contains all signal feature information at a certain location, including RSSI, phase information, etc. Weighted Euclidean distance is an extension of ordinary Euclidean distance, taking into account the importance of each feature. The calculation formula of weighted Euclidean distance is as follows:

[0067] ;

[0068] in, represents the weighted Euclidean distance, and are the weights of each feature, indicating the degree of influence of different features on the distance calculation. In this way, the distance between the RFID smart card and each location fingerprint is judged more accurately, and M target location fingerprints are obtained. Multi-reader information fusion is performed on the M target location fingerprints to construct a fused feature vector. The signal feature data from different readers are processed comprehensively to eliminate the limitations of the positioning accuracy of a single reader. Based on the fused feature vector, a candidate location set is generated, which contains all possible locations of the RFID smart card. The similarity between the signal feature vector and each fused feature vector in the candidate location set is calculated by the Mahalanobis distance. The Mahalanobis distance is a distance measurement method that takes into account data correlation and distribution characteristics, and can effectively reflect the similarity between signal features. The calculation formula of the Mahalanobis distance is as follows:

[0069] ;

[0070] in, represents the Mahalanobis distance, is the signal eigenvector, is the mean of a fused feature vector in the candidate position set, is the covariance matrix of the fused eigenvectors, Represents the transpose operation of the matrix. By calculating the Mahalanobis distance, it is determined which fusion feature vector in the candidate position set is closest to the signal feature vector to obtain the final positioning result. In order to eliminate the influence of environmental noise and instantaneous fluctuations on positioning accuracy, the final positioning result is smoothed by Kalman filtering. Kalman filtering is a filtering algorithm commonly used for time series data. It can predict the state of the next moment based on the current state, and correct it through observation data to achieve smooth estimation of the state data. The state update formula of Kalman filtering is:

[0071] ;

[0072] in, is the estimated value of the state at the kth moment, is the estimated value of the state at the previous moment, is the Kalman gain at the kth moment, is the observed value at the current moment, is the observation matrix. Through Kalman filtering, the random noise in the positioning result is filtered out to obtain more stable and continuous real-time location data of the RFID smart card.

[0073] In a specific embodiment, the process of executing step S3 may specifically include the following steps:

[0074] The key length and block size of the lightweight cryptographic algorithm are set based on the hardware constraints of the RFID smart card to obtain a basic parameter set;

[0075] A nonlinear substitution box S-box is constructed based on the basic parameter set to obtain a key expansion function, and a round key sequence is generated according to the key expansion function and a preset round constant to obtain an encryption round function;

[0076] Acquire communication data through the configured RFID system, divide the communication data into left and right halves, apply the encryption round function to the right half to obtain an updated right half, and perform an XOR operation on the left half and the updated right half to obtain an updated left half;

[0077] Repeat the encryption round function application and XOR operation multiple times to obtain an encryption module, and perform reverse round key processing on the encryption module to obtain a decryption module;

[0078] The communication data is encrypted and decrypted based on the encryption module and the decryption module to obtain secure communication data.

[0079] Specifically, the key length and group size of the lightweight cryptographic algorithm are determined according to the hardware constraints of the RFID smart card to obtain a basic parameter set. Lightweight cryptographic algorithms such as PRESENT and LED usually use a key length of 64 or 80 bits. Assume that a key length of 80 bits and a group size of 64 bits are selected as the basic parameter set. It can meet the limited storage and computing capabilities of the RFID smart card while ensuring security. A nonlinear permutation box S-box is constructed based on the basic parameter set. S-box is the core nonlinear component in the cryptographic algorithm. By mapping the combination of input bits to the combination of output bits, it breaks the linear relationship between input and output and increases the complexity of the encryption process. When constructing an S-box, it is necessary to ensure that its nonlinearity is high enough to resist common cryptanalysis methods such as linear attacks and differential attacks. The construction of an S-box is usually based on a specific mathematical structure, such as algebraic operations on a finite field. Assume that a 4×4 S-box is constructed, which can map a 4-bit input to a 4-bit output. For example, for the input value "1101", the S-box may map it to "0010". Based on the S-box, a key expansion function is constructed. The key expansion function is used to expand the input original key into multiple round keys so that different keys can be used in each round of encryption operation. The purpose of key expansion is to expand the shorter original key into multiple independent subkey sequences, thereby increasing the difficulty for attackers to crack the key. The specific implementation of the key expansion function usually depends on the combination of the initial key and the S-box. Assume that the original key is 80 bits and is divided into five 16-bit subkeys. Each subkey generates a new round key after the replacement of the S-box and the addition of the preset round constant. The preset round constant is some predetermined constant values. They are XORed with the current subkey in each round of key expansion, thereby breaking the linear relationship of the key. In this way, the round key sequence required for each round of encryption operation is generated. After completing the round key sequence generation, the encryption round function is constructed. The encryption round function is the core of each round of encryption operation. It uses the current round key to perform a series of nonlinear and linear transformations on the input data to confuse the relationship between the data and the key. Assume that the 64-bit packet data is divided into left and right halves, namely the left half L0 and the right half R0. The encryption round function performs S-box replacement and linear transformation on the right half R0 and the current round key to obtain an intermediate value, and then performs XOR operation on the intermediate value and the left half L0 to obtain the updated left half L1. The updated right half directly passes the left half of the previous round, that is:

[0080] ;

[0081] ;

[0082] in, and Respectively represent The left and right half of the wheel data, The right half of the data With Round Key The function that performs encryption operation, the result is XORed with the left half to obtain . In this process, the right half of the data is used as the input of the encryption function in each round, while the left half of the data is updated in each round. Through the design of the round function, the relationship between the data and the initial key after multiple rounds of transformation is complicated, thereby improving the security of encryption. When the encryption round function is applied to the entire data block, the communication data is divided into left and right halves, and the encryption round function is applied to the right half to obtain the updated right half of the data. The left half is XORed with the updated right half to obtain the new left half of the data. This process of applying the encryption round function and XORing is repeated until all round keys are executed. The encryption module is processed with the reverse round keys to obtain the decryption module. The decryption module applies the round keys in the opposite order of the encryption module to restore the encrypted data to plaintext data. Reverse round key processing means that in the decryption process, the order of using round keys is opposite to that of encryption. That is, if the encryption module uses the first round key in the first round and the second round key in the second round, then the decryption module needs to use the tenth round key in the first round and the ninth round key in the second round, and so on. Through reverse processing, the decryption module gradually restores the data before encryption. The communication data is encrypted and decrypted based on the encryption module and the decryption module to obtain secure communication data.

[0083] In a specific embodiment, the execution step encrypts and decrypts the communication data based on the encryption module and the decryption module to obtain the secure communication data, which may specifically include the following steps:

[0084] The communication data is processed in groups to obtain a fixed-length data block sequence, and the first data block is XORed based on a preset initial vector to obtain an initial encryption input;

[0085] Send the initial encrypted input to the encryption module for encryption processing to obtain the first ciphertext block, and perform an XOR operation on the first ciphertext block and the next data block to obtain the next encrypted input;

[0086] Repeat the encryption process and XOR operation until all data blocks are processed to obtain a complete ciphertext sequence, and send the complete ciphertext sequence as input to the decryption module for decryption processing to obtain a decrypted data block sequence;

[0087] The decrypted data block sequence is verified and integrity checked to obtain a verification result, and multiple valid data are determined based on the verification result, and the multiple valid data are combined into secure communication data.

[0088] Specifically, the communication data is processed in groups and divided into a sequence of data blocks of fixed length. The first data block is XORed based on a preset initial vector. The initial vector is a piece of random data with the same length as the data block, which is used to introduce randomness in the first step of encryption to prevent the same plaintext data from generating the same ciphertext in different encryption operations. Perform bit-by-bit XOR operation with the initial vector to obtain the initial encrypted input The formula for the XOR operation is as follows:

[0089]

[0090] in, is the initial encrypted input, is the first data block, is the initial vector, symbol Represents a bitwise XOR operation. The XOR operation results for each bit are as follows: If One of the bits of is 1, and If the same bit of the two is 0, the XOR result is 1; if the same bit of the two is the same, the result is 0. After the XOR operation, an obfuscated data block is obtained, which can effectively avoid the appearance of plaintext mode during the encryption process. After being sent to the encryption module for encryption processing, the first ciphertext block is obtained The encryption module uses a preset key and encryption algorithm (such as AES, DES, etc.) to encrypt the input data block and generate irreversible ciphertext data. Assume that the AES-128 encryption algorithm is used and the key length is 128 bits. The encryption algorithm performs a series of substitution and replacement operations on the input data block to convert it into a complex ciphertext that has nothing to do with the original data. The encryption process of the encryption module is expressed as:

[0091] ;

[0092] in, is the first ciphertext block, represents the encryption function, is the initial encrypted input, is the encryption key. After encryption, we get the first ciphertext block . The first ciphertext block With the next data block Perform XOR operation to get the next encrypted input The same XOR operation formula is as follows:

[0093] ;

[0094] in, is the second encrypted input, is the second data block, is the first ciphertext block. Through the chain structure, the current data block is mixed with the previous ciphertext block to ensure that the encryption result of each data block depends not only on itself but also on the previous data block, thereby improving the strength and security of encryption. Send it to the encryption module for encryption to get the second ciphertext block . Then With the next data block Perform XOR operation to get the third encrypted input The above encryption process and XOR operation are repeated until all data blocks are processed and the complete ciphertext sequence is finally obtained. The complete ciphertext sequence is used as input and sent to the decryption module for decryption processing. The decryption module uses the same key and decryption algorithm as the encryption module to decrypt each ciphertext block one by one into the initial encryption input. For example, the first ciphertext block The decrypted result is the initial encrypted input

[0095] ;

[0096] in, represents the decryption function, is the first ciphertext block, is the decryption key. The decryption function Is the encryption function The inverse operation of can restore the data block before encryption. With the initial vector Perform XOR operation to restore the first data block

[0097] ;

[0098] Similarly, decrypt the other ciphertext blocks in turn, obtain each encrypted input, and restore the original data block by XOR operation with the previous ciphertext block. For the second data block, decrypt the ciphertext block Get encrypted input , and then compare it with the first ciphertext block XOR, restore the original data block

[0099] ;

[0100] Repeat the process of decryption and XOR operation to restore all the original data blocks and obtain the decrypted data block sequence. Verify and check the integrity of the decrypted data block sequence. The verification process usually uses checksums (such as CRC, MAC) or digital signatures to ensure that the data has not been tampered with during transmission and encryption and decryption. Assuming that a message authentication code (MAC) is used for verification, all data blocks are calculated through a preset hash function to obtain an authentication code, and then compared with the authentication code before decryption. If the authentication codes are consistent, the verification is passed, indicating that the integrity of the data is guaranteed; otherwise, it means that the data has been tampered with or an error has occurred during the transmission process. According to the verification results, multiple data blocks are marked as valid data, and the valid data is combined into secure communication data.

[0101] In a specific embodiment, the process of executing step S4 may specifically include the following steps:

[0102] Generate a random challenge and a current timestamp based on the secure communication data, obtain authentication request data, send the authentication request data to the RFID smart card, and receive authentication response data returned by the RFID smart card;

[0103] Decrypt the authentication response data to obtain the unique identifier, random number and timestamp information of the RFID smart card, and query the background database based on the unique identifier of the RFID smart card to obtain the historical authentication information of the RFID smart card;

[0104] Compare the real-time location data with the last authentication location in the historical authentication information to obtain the location deviation value, and verify the validity of the timestamp information to obtain the timestamp verification result;

[0105] A comprehensive analysis is performed based on the location deviation value and timestamp verification results to obtain the multi-factor verification results, and an authentication process model is generated based on the multi-factor verification results. The authentication process model includes the processing logic of key verification, location verification and timestamp verification.

[0106] Specifically, a random challenge and a current timestamp are generated based on secure communication data to ensure the uniqueness and timeliness of each authentication. The random challenge is a digital sequence with sufficient randomness generated by a random number generator, which is used to prevent replay attacks and ensure that each authentication request is different. The current timestamp is the precise time stamp when the system initiates the authentication request. It is used to verify the timeliness of the authentication response and prevent the authentication response from being delayed or forged. The random challenge and timestamp are combined with the secure communication data to form the authentication request data. The authentication request data is sent to the target RFID smart card, and the smart card is waited for to return the authentication response data. After receiving the authentication request data, the RFID smart card extracts the random challenge and timestamp information, and encrypts the information based on the preset encryption key. The smart card uses a symmetric key encryption algorithm (such as AES, DES) to combine the random challenge and timestamp with its own unique identifier (UID), and generates authentication response data after encryption. The authentication response data includes the encrypted information and other verification information, such as the status information of the smart card, the remaining power, etc. The smart card sends the encrypted authentication response data back to the authentication system. The authentication response data is decrypted. The decryption process uses the same key and algorithm as used for encryption to restore the encrypted authentication response data to plain text information. The decrypted information includes the unique identifier of the RFID smart card, random number, and timestamp. Based on the unique identifier of the RFID smart card, the backend database is queried to retrieve the historical authentication information related to the smart card, including the time, location, status, and other data of the smart card during past authentication. The historical authentication information is compared and analyzed with the information in the current authentication request. The real-time location data of the smart card is compared with the last authentication location in the historical authentication information to calculate the position deviation value. The position deviation value reflects the displacement of the RFID smart card between two authentications, and the calculation formula is expressed as:

[0107] ;

[0108] in, Indicates the position deviation value, is the current authenticated real-time location, is the location of the last authentication. The position deviation value helps the system determine whether the movement of the smart card is in line with expectations. If the position deviation value is too large, it means that the smart card has been illegally moved or there are other abnormal conditions. At the same time, the timestamp information in the authentication response data is verified to ensure that the authentication response is generated immediately and has not been tampered with. Compare the timestamp in the authentication response data with the current time and calculate the time difference:

[0109] ;

[0110] in, Indicates the time difference, is the current system time, is the timestamp in the authentication response data. Set a tolerance range for the time difference, for example, a valid timestamp is within 5 seconds. If the time difference exceeds this range, the timestamp verification fails, indicating that the authentication response data may be replayed or delayed. Perform a comprehensive analysis of the position deviation value and the timestamp verification result to generate a multi-factor authentication result. Set some rules to judge the multi-factor authentication result. For example, if the position deviation value is less than a preset threshold (for example, 0.1) and the timestamp verification result is passed, the multi-factor authentication result is successful; otherwise, it is a failure. Generate an authentication process model based on the multi-factor authentication result. The authentication process model is a logical flow chart that includes key authentication, position authentication, and timestamp authentication, which defines the processing logic of the system under different authentication results. For example, if the multi-factor authentication result shows that the position deviation value is too large, but the timestamp verification is passed, then a warning state is set in the authentication process model, that is, although the authentication is passed, the behavior of the smart card needs to be further monitored; if both fail, the authentication request is directly rejected. The authentication process model helps the system to achieve dynamic and multi-dimensional authentication decisions, and can also continuously accumulate and optimize authentication strategies to improve the security and responsiveness of the system. For example, based on the analysis results of historical authentication data and current authentication requests, the thresholds of position deviation and time difference are dynamically adjusted, making the authentication model more flexible and intelligent.

[0111] In a specific embodiment, the process of executing step S5 may specifically include the following steps:

[0112] Based on the authentication process model, the coverage area of ​​the RFID system is divided into multiple authentication domains, and a local authentication server is configured in each authentication domain as a local authentication node;

[0113] Performing public key infrastructure configuration on the local authentication node and the central authentication node to obtain a secure communication key between nodes, and establishing a secure communication channel between the local authentication node and the central authentication node based on the secure communication key between nodes to obtain a distributed authentication network;

[0114] Forward the authentication request of the RFID smart card to the local authentication node of the authentication domain to which it belongs, obtain a local authentication processing task, and execute a multi-factor authentication protocol based on the local authentication processing task to obtain a local authentication result;

[0115] Conduct credibility evaluation on the local authentication result to obtain a credibility score. When the credibility score is lower than the preset threshold, forward the authentication request to the central authentication node for further verification to obtain the verification result of the central authentication node.

[0116] A comprehensive authentication decision is made based on the verification result of the central authentication node and the local authentication result to obtain the security authentication result of the RFID smart card. At the same time, the security authentication result is sent to the card reader requesting authentication, and the authentication information database in the distributed authentication network is updated to complete the distributed authentication process.

[0117] Specifically, the coverage area of ​​the RFID system is divided based on the authentication process model to obtain multiple authentication domains. Each authentication domain is an independent authentication management area, which contains multiple card readers and a local authentication node (i.e., local authentication server). The division of authentication domains takes into account factors such as the coverage of the card reader, device density, and communication load to ensure that the authentication work in each authentication domain can be completed efficiently and reliably. A local authentication server is configured in each authentication domain as a local authentication node. The local authentication node processes the authentication requests of all RFID smart cards in the authentication domain, executes the multi-factor authentication protocol, and generates local authentication results. The configuration of these nodes needs to have sufficient computing power and storage resources to process a large number of authentication requests in real time. The public key infrastructure (PKI) is configured for all local authentication nodes and central authentication nodes to establish a secure and reliable communication environment. The public key infrastructure is a security management mechanism that assigns a pair of public and private keys to each node and uses digital certificates for identity authentication. A key pair is generated for each local authentication node and central authentication node, and the public key is registered with a trusted certificate authority. By configuring the public key infrastructure between nodes, a secure communication key is generated for each node. The generation formula of the session key is expressed as:

[0118] ;

[0119] in, represents the session key, is a public generator, is a large prime number, and They are the private key fragments of the local authentication node and the central authentication node respectively. Based on the inter-node secure communication key, a secure communication channel is established between the local authentication node and the central authentication node to form a distributed authentication network. The distributed authentication network can work independently in multiple authentication domains, and the central authentication node can provide support and further verification when the local authentication node has insufficient processing capacity or the authentication request is complex. The establishment of a distributed authentication network improves the scalability and security of the system, and can effectively share the authentication load and prevent single point failures. When the RFID smart card issues an authentication request, the request is forwarded to the local authentication node of the authentication domain to which it belongs. After receiving the request, the local authentication node analyzes the authentication request according to the authentication process model and executes the multi-factor authentication protocol. The multi-factor authentication protocol includes key verification, location verification and timestamp verification of the RFID smart card. The local authentication node uses the preset authentication logic to verify whether the identity information of the smart card matches the data stored in the local database, and detects whether the real-time location of the smart card is within a reasonable range and whether the timestamp is within the valid time window. Through the verification steps, the local authentication node generates a local authentication result. In order to ensure the reliability of the local authentication result, the credibility of the result is evaluated. Credibility evaluation is a scoring operation based on the verification status of the local authentication node during the authentication process, historical authentication records, and the system's preset credibility model. The credibility score is expressed by the following formula:

[0120] ;

[0121] in, represents the credibility score, Indicates The scores of the verification factors (such as key verification score, location verification score, etc.), Indicates The weight of the verification factor, Represents the total number of all verification factors. The credibility score range is usually between 0 and 1. If a verification factor fails, the score is 0, and if all verification factors pass, the score is 1. Assuming that in an authentication, the key verification score is 1 (weight 0.5), the location verification score is 0.8 (weight 0.3), and the timestamp verification score is 0.9 (weight 0.2), then the credibility score of the authentication is:

[0122] ;

[0123] When the credibility score is higher than the system preset threshold (such as 0.7), the local authentication result is considered credible and is directly used as the final authentication result; if the credibility score is lower than the threshold, it means that the local authentication node may not be able to independently determine the legitimacy of the authentication request. At this time, the authentication request is forwarded to the central authentication node for further verification. After receiving the forwarded authentication request, the central authentication node reviews the authentication process of the local authentication node and conducts a deeper analysis based on historical data and more verification factors in the global database. For example, the central authentication node checks the historical activity records of the smart card in other authentication domains, or verifies whether the current behavior of the smart card is reasonable in combination with other external data sources (such as video surveillance systems). The central authentication node will integrate all information, generate a verification result and return it to the local authentication node. A comprehensive authentication decision is made based on the verification result of the central authentication node and the local authentication result to generate a security authentication result of the RFID smart card. The logic of the comprehensive authentication decision is carried out according to the preset rules. For example, if the verification result of the central authentication node is consistent with that of the local authentication node, the security authentication result is passed; if the two are inconsistent, it is set to fail or requires further manual intervention. After the authentication is completed, the security authentication result is sent to the card reader that initiated the authentication request, so that the card reader can authorize or deny access to the RFID smart card based on the result. At the same time, the authentication result is updated to the authentication information database in the distributed authentication network to complete the distributed authentication process.

[0124] In a specific embodiment, the execution step forwards the authentication request of the RFID smart card to the local authentication node of the authentication domain to which it belongs, obtains a local authentication processing task, and executes a multi-factor authentication protocol based on the local authentication processing task. The process of obtaining a local authentication result may specifically include the following steps:

[0125] Parse the authentication request of the RFID smart card to obtain the unique identifier and current location information of the RFID smart card;

[0126] Based on the unique identifier and current location information, the cache database of the local authentication node is queried to obtain the historical authentication record of the RFID smart card;

[0127] Compare and analyze the historical authentication records with the current authentication request to obtain the time interval and position change, and calculate the moving speed of the RFID smart card based on the time interval and position change to obtain the speed rationality evaluation result;

[0128] Decrypt and verify the integrity of the authentication response data returned by the RFID smart card to obtain the decrypted authentication information, and compare the decrypted authentication information with the locally stored RFID smart card key information to obtain the key verification result;

[0129] A multi-factor comprehensive evaluation is performed based on the speed rationality evaluation results and key verification results to obtain the local authentication result.

[0130] Specifically, the authentication request of the RFID smart card is parsed. The authentication request contains the unique identifier (UID) and current location information of the RFID smart card. The unique identifier is the unique identity mark of the RFID smart card, usually composed of a group of letters and numbers, to ensure that the system can uniquely identify each smart card. The current location information is the geographical location data of the RFID smart card, usually obtained by the card reader in the RFID system and stored in the form of coordinates, such as (x, y). Based on the unique identifier and current location information of the RFID smart card, the cache database of the local authentication node is queried. The cache database stores the historical authentication records of the RFID smart card, including the time, location and status of the last authentication. By querying the cache database, the historical authentication information of the smart card is obtained. The historical authentication records are compared and analyzed with the current authentication request. The time interval between the last authentication and the current authentication of the RFID smart card is calculated. The displacement between the current position of the RFID smart card and the last authentication position, that is, the position change, is calculated. The position change is obtained by calculating the Euclidean distance between the two authentication positions, and the formula is as follows:

[0131] ;

[0132] in, represents the position change, are the coordinates of the current authentication location, are the coordinates of the last authenticated location. Based on the time interval and position change , calculate the moving speed of the RFID smart card, the formula is as follows:

[0133] ;

[0134] The moving speed is compared with the preset reasonable moving speed range. If the moving speed is within the reasonable range, the moving behavior of the RFID smart card is considered normal, and a positive speed rationality assessment result is obtained; otherwise, if the speed is too fast or too slow, the smart card is warned that there may be abnormal behavior. After completing the speed rationality assessment, the authentication response data returned by the RFID smart card is decrypted and integrity checked. The authentication response data usually contains encrypted information of the smart card, such as a unique identifier, a random number, and a timestamp. Decryption is performed using a symmetric key shared with the RFID smart card, and the decryption process is completed by the inverse operation of the encryption algorithm. After decryption, the plaintext information is restored. The decrypted authentication information needs to be compared with the RFID smart card key information stored locally in the system to ensure the integrity and consistency of the information. Check whether the decrypted unique identifier matches the real identifier of the smart card, whether the random number is the same as the challenge sent by the system, and whether the timestamp is within a reasonable time range. These checks help prevent the authentication data from being tampered with or replayed. A multi-factor comprehensive assessment is performed based on the speed rationality assessment result and the key verification result to generate a local authentication result. Multi-factor comprehensive evaluation ensures the accuracy and security of authentication by combining the results of multiple verification dimensions. For example, a weight model is set to comprehensively calculate the speed rationality and key verification results according to different weights:

[0135] ;

[0136] in, is the local authentication result. is the speed reasonableness assessment score, is the score of key verification, and Represents the weights of the two verification dimensions. For example, assuming the speed rationality evaluation result is 0.9, the key verification result is 1.0, and the weights are 0.4 and 0.6 respectively, then the local authentication result is:

[0137] ;

[0138] Assuming that the local authentication result is greater than a preset threshold (e.g. 0.8), the authentication is considered to be successful, otherwise the authentication fails. Through a multi-factor comprehensive evaluation method, it is determined whether the authentication request of the RFID smart card is legal, effectively improving the security and accuracy of the authentication process.

[0139] The above describes the RFID smart card security authentication method in the embodiment of the present invention. The following describes the RFID smart card security authentication system in the embodiment of the present invention. Figure 2 In one embodiment of the present invention, an RFID smart card security authentication system includes:

[0140] A configuration module is used to initialize and configure the RFID system, and extract the signal characteristics of the RFID smart card through the configured RFID system to obtain a signal characteristic vector;

[0141] An analysis module is used to input the signal feature vector into a multi-level positioning algorithm for analysis to obtain the real-time location data of the RFID smart card;

[0142] A creation module is used to create an encryption module and a decryption module of a lightweight cryptographic algorithm according to the hardware constraints of the RFID smart card, and generate secure communication data according to the encryption module and the decryption module;

[0143] An integration module is used to analyze the multi-factor authentication protocol based on real-time location data and secure communication data to obtain an authentication process model, which integrates the processing logic of key verification, location verification and timestamp verification;

[0144] The generation module is used to generate a distributed authentication network according to the authentication process model, and generate a security authentication result of the RFID smart card according to the distributed authentication network. The distributed authentication network includes multiple local authentication nodes and one central authentication node.

[0145] Through the cooperation of the above components, the positioning accuracy of RFID smart cards is improved through multi-level positioning algorithms, combined with signal feature vector analysis and multi-reader information fusion, providing a reliable foundation for subsequent location verification. The encryption module and decryption module are designed using lightweight cryptographic algorithms, which not only meet the hardware constraints of RFID smart cards, but also ensure the security of communication data, effectively balancing security and performance. The multi-factor authentication protocol integrating key verification, location verification and timestamp verification significantly improves the reliability of authentication and effectively prevents security threats such as replay attacks and man-in-the-middle attacks. Based on the design of distributed authentication network, the communication overhead and performance problems in large-scale RFID systems are solved, and the scalability and cross-regional access efficiency of the system are improved. Through the collaborative work of local authentication nodes and central authentication nodes, decentralized processing and dynamic load balancing of authentication tasks are realized, which improves the authentication efficiency and robustness of the overall system. The credibility evaluation mechanism is introduced to dynamically determine whether the central node needs further verification through the credibility score of the local authentication result, optimize the authentication process, and reduce system resource consumption.

[0146] The present invention also provides a computer device, which includes a memory and a processor. The memory stores computer-readable instructions. When the computer-readable instructions are executed by the processor, the processor executes the steps of the RFID smart card security authentication method in the above embodiments.

[0147] The present invention also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium. Instructions are stored in the computer-readable storage medium. When the instructions are executed on a computer, the computer executes the steps of the RFID smart card security authentication method.

[0148] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described systems, systems and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0149] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or the whole or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0150] As described above, the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features thereof may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A RFID smart card security authentication method, characterized in that: The RFID smart card security authentication method comprises: Initialize and configure the RFID system, and extract the signal features of the RFID smart card through the configured RFID system to obtain a signal feature vector; The signal feature vector is input into a multi-level positioning algorithm for analysis to obtain the real-time location data of the RFID smart card; specifically, the method includes: performing threshold comparison on the received signal strength indicator value in the signal feature vector to obtain the initial positioning area of ​​the RFID smart card, and gridding the system coverage range based on the initial positioning area to obtain a candidate location set; the signal feature vector is input into a K-means clustering algorithm, clustering the candidate location set to obtain a cluster center set, and calculating the Euclidean distance between the signal feature vector and each cluster center, selecting N cluster centers with the smallest distance, and obtaining a coarse-grained search result; within the cluster corresponding to the coarse-grained search result, calculating the weighted Euclidean distance between the signal feature vector and each location fingerprint to obtain M target location fingerprints; performing multi-card reader information fusion on the M target location fingerprints to construct a fused feature vector to obtain a candidate location set, and calculating the similarity between the signal feature vector and each fused feature vector in the candidate location set by Mahalanobis distance to obtain a final positioning result; performing Kalman filter smoothing on the final positioning result to obtain the real-time location data of the RFID smart card; Creating an encryption module and a decryption module of a lightweight cryptographic algorithm according to the hardware constraints of the RFID smart card, and generating secure communication data according to the encryption module and the decryption module; Performing a multi-factor authentication protocol analysis based on the real-time location data and the secure communication data to obtain an authentication process model, wherein the authentication process model integrates processing logics of key verification, location verification, and timestamp verification; A distributed authentication network is generated according to the authentication process model, and a security authentication result of the RFID smart card is generated according to the distributed authentication network. The distributed authentication network includes a plurality of local authentication nodes and a central authentication node.

2. The RFID smart card security authentication method according to claim 1, characterized in that: The RFID system is initialized and configured, and the signal feature of the RFID smart card is extracted through the configured RFID system to obtain a signal feature vector, including: Set security parameters for the RFID system to obtain encryption key length, hash function type, and random number generator seed; Establishing an RFID tag information database based on the encryption key length, the hash function type and the random number generator seed, and obtaining a tag information set including a unique identifier, an initial key and a last authentication time; The card reader network is configured to obtain the physical location coordinates and coverage data of each card reader, and the RFID tag is initialized to obtain an initialized RFID tag with a globally unique unique identifier and an initial key; Arrange reference tags in the system deployment area, periodically scan the reference tags to obtain received signal strength indications and phase information, and input the received signal strength indications and phase information into an environmental parameter model to obtain an initial positioning model; The initial positioning model and the tag information set are processed to obtain a multi-factor verification rule, and the signal feature of the RFID smart card is extracted through the configured RFID system to obtain a signal feature vector.

3. The RFID smart card security authentication method according to claim 2, characterized in that: The configured RFID system extracts the signal features of the RFID smart card to obtain a signal feature vector, including: The card reader inquiry signal sending interval is set by using the card reader physical position coordinates and coverage data in the configured RFID system to obtain the inquiry signal sending time series; Based on the query signal sending time sequence, the RFID smart card is subjected to signal collection to obtain a response signal including a unique identifier; Recording the time of receiving the response signal to obtain a signal receiving timestamp, and measuring the signal strength based on the response signal to obtain a received signal strength indicator value; Performing phase analysis on the response signal to obtain a signal phase value, and combining the received signal strength indicator value, the signal phase value and the signal reception timestamp to obtain an original feature vector; The original feature vectors collected multiple times are processed by weighted average to obtain a stable feature vector, and the stable feature vector is associated with the card reader identifier and the RFID smart card unique identifier to obtain a signal feature vector.

4. The RFID smart card security authentication method according to claim 1, characterized in that: The step of creating an encryption module and a decryption module of a lightweight cryptographic algorithm according to the hardware constraints of the RFID smart card, and generating secure communication data according to the encryption module and the decryption module, comprises: The key length and the packet size of the lightweight cryptographic algorithm are set based on the hardware constraints of the RFID smart card to obtain a basic parameter set; Constructing a nonlinear substitution box S-box based on the basic parameter set to obtain a key expansion function, and generating a round key sequence according to the key expansion function and a preset round constant to obtain an encryption round function; Acquire communication data through the configured RFID system, and divide the communication data into left and right halves, apply the encryption round function to the right half to obtain an updated right half, and perform an XOR operation on the left half and the updated right half to obtain an updated left half; Repeat the encryption round function application and XOR operation for multiple times to obtain an encryption module, and perform reverse round key processing on the encryption module to obtain a decryption module; The communication data is encrypted and decrypted based on the encryption module and the decryption module to obtain secure communication data.

5. The RFID smart card security authentication method according to claim 4, characterized in that: The step of encrypting and decrypting the communication data based on the encryption module and the decryption module to obtain secure communication data includes: The communication data is processed in groups to obtain a data block sequence of a fixed length, and an XOR operation is performed on the first data block based on a preset initial vector to obtain an initial encryption input; Sending the initial encrypted input to the encryption module for encryption processing to obtain a first ciphertext block, and performing an XOR operation on the first ciphertext block and a next data block to obtain a next encrypted input; Repeat the encryption process and XOR operation until all data blocks are processed to obtain a complete ciphertext sequence, and send the complete ciphertext sequence as input to the decryption module for decryption processing to obtain a decrypted data block sequence; The decrypted data block sequence is verified and integrity checked to obtain a verification result, and multiple valid data are determined according to the verification result, and the multiple valid data are combined into secure communication data.

6. The RFID smart card security authentication method according to claim 1, characterized in that: The multi-factor authentication protocol analysis is performed based on the real-time location data and the secure communication data to obtain an authentication process model, wherein the authentication process model integrates the processing logic of key verification, location verification, and timestamp verification, including: Generate a random challenge and a current timestamp based on the secure communication data, obtain authentication request data, send the authentication request data to the RFID smart card, and receive authentication response data returned by the RFID smart card; Decrypting the authentication response data to obtain a unique identifier, a random number, and timestamp information of the RFID smart card, and querying a backend database based on the unique identifier of the RFID smart card to obtain historical authentication information of the RFID smart card; Compare the real-time location data with the last authentication location in the historical authentication information to obtain a location deviation value, and verify the validity of the timestamp information to obtain a timestamp verification result; A comprehensive analysis is performed based on the position deviation value and the timestamp verification result to obtain a multi-factor verification result, and an authentication process model is generated according to the multi-factor verification result. The authentication process model includes processing logic for key verification, position verification and timestamp verification.

7. The RFID smart card security authentication method according to claim 1, characterized in that: The distributed authentication network is generated according to the authentication process model, and the security authentication result of the RFID smart card is generated according to the distributed authentication network, wherein the distributed authentication network includes a plurality of local authentication nodes and a central authentication node, including: Based on the authentication process model, the coverage area of ​​the RFID system is divided to obtain multiple authentication domains, and a local authentication server is configured in each authentication domain as a local authentication node; Performing public key infrastructure configuration on the local authentication node and the central authentication node to obtain an inter-node secure communication key, and establishing a secure communication channel between the local authentication node and the central authentication node based on the inter-node secure communication key to obtain a distributed authentication network; Forwarding the authentication request of the RFID smart card to the local authentication node of the authentication domain to which it belongs, obtaining a local authentication processing task, and executing a multi-factor authentication protocol based on the local authentication processing task to obtain a local authentication result; Performing a credibility evaluation on the local authentication result to obtain a credibility score, and when the credibility score is lower than a preset threshold, forwarding the authentication request to a central authentication node for further verification to obtain a verification result of the central authentication node; A comprehensive authentication decision is made based on the verification result of the central authentication node and the local authentication result to obtain a security authentication result of the RFID smart card. At the same time, the security authentication result is sent to the card reader requesting authentication, and the authentication information database in the distributed authentication network is updated to complete the distributed authentication process.

8. The RFID smart card security authentication method according to claim 7, characterized in that: The step of forwarding the authentication request of the RFID smart card to a local authentication node of the authentication domain to which it belongs, obtaining a local authentication processing task, and executing a multi-factor authentication protocol based on the local authentication processing task to obtain a local authentication result includes: Parsing the authentication request of the RFID smart card to obtain the unique identifier and current location information of the RFID smart card; Based on the unique identifier and the current location information, query the cache database of the local authentication node to obtain the historical authentication record of the RFID smart card; Compare and analyze the historical authentication record with the current authentication request to obtain the time interval and the position change, and calculate the moving speed of the RFID smart card based on the time interval and the position change to obtain a speed rationality evaluation result; Decrypt and verify the integrity of the authentication response data returned by the RFID smart card to obtain decrypted authentication information, and compare the decrypted authentication information with the locally stored RFID smart card key information to obtain a key verification result; A multi-factor comprehensive evaluation is performed based on the speed rationality evaluation result and the key verification result to obtain a local authentication result.

9. An RFID smart card security authentication system, characterized in that: Used to execute the RFID smart card security authentication method according to any one of claims 1 to 8, the RFID smart card security authentication system comprises: A configuration module is used to initialize and configure the RFID system, and extract the signal characteristics of the RFID smart card through the configured RFID system to obtain a signal characteristic vector; An analysis module, used for inputting the signal feature vector into a multi-level positioning algorithm for analysis to obtain real-time location data of the RFID smart card; A creation module, used to create an encryption module and a decryption module of a lightweight cryptographic algorithm according to the hardware constraints of the RFID smart card, and generate secure communication data according to the encryption module and the decryption module; An integration module, configured to perform a multi-factor authentication protocol analysis based on the real-time location data and the secure communication data to obtain an authentication process model, wherein the authentication process model integrates processing logics of key verification, location verification, and timestamp verification; A generation module is used to generate a distributed authentication network according to the authentication process model, and generate a security authentication result of the RFID smart card according to the distributed authentication network, wherein the distributed authentication network includes multiple local authentication nodes and one central authentication node.

Images