Self-service equipment identity information verification system, method, equipment and medium

Abstract

The invention discloses a self-service equipment identity information verification system, method, equipment and medium, and the system comprises an identity verification and authorization module which is used for ensuring that only an authorized user can access an identity card reader; the self-adaptive access control module is used for dynamically adjusting the access authority according to the access history, the geographic position and the equipment safety of the user; the encryption and decryption module is used for encrypting and decrypting the sensitive data during data transmission; the log recording and monitoring module is used for determining events needing to be recorded and log information; related events and operation results are monitored in real time, and any abnormal behavior or unauthorized access is found in time; the security of the identity card information can be improved; leakage and tampering of the data in the transmission and storage process are prevented; the equipment safety is enhanced, and illegal disassembly and tampering are prevented; potential security threats are found and responded in time through real-time monitoring and abnormal behavior detection, and the security and reliability of the system are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of self-service device identity information security, and in particular to a self-service device identity information verification system, method, device and medium. Background Art

[0002] With the development of information technology, ID card readers are widely used in various scenarios, such as banks, airports, hotels, etc. Traditional ID card readers mainly read ID card information through RFID technology and OCR technology, and then decode and verify it. However, these technologies have deficiencies in security, such as information leakage, identity forgery, and unauthorized access, as follows: First, the traditional method lacks effective encryption measures during information transmission, which makes it easy for malicious attackers to intercept and tamper with it, and lacks security. Secondly, the traditional method mainly relies on the ID card information itself, lacks multi-factor authentication, is difficult to effectively prevent identity forgery, and has a single identity authentication method; Third, the verification equipment itself lacks sufficient physical and logical security protection and is vulnerable to illegal disassembly and tampering, resulting in low security. Fourthly, traditional methods lack effective real-time monitoring and abnormal behavior detection mechanisms, making it difficult to detect and respond to security threats in a timely manner. Summary of the invention

[0003] The object of the present invention is to provide a self-service device identity information verification system, method, device and medium, thereby solving all or one of the above-mentioned problems existing in the prior art.

[0004] In order to solve the above technical problems, the specific technical solutions of the present invention are as follows: In one aspect, the present invention provides a self-service device identity information verification system, comprising: An identity authentication and authorization module is used to ensure that only authorized users can access the ID card reader; the identity authentication and authorization module integrates multi-dimensional identity authentication of digital certificates, biometrics and behavioral analysis; the identity authentication and authorization module relies on static biometric features and combines the user's behavior pattern for verification; the behavior pattern includes: dynamic factors of operating habits and login time preference; An adaptive access control module is used to: dynamically adjust access rights based on the user's access history, geographic location, and device security; the adaptive access control module maintains an access control list to define the terminal or application's right to access specific data or perform specific operations; the adaptive access control module learns in real time and dynamically updates access rights based on the behavior patterns and security events of the terminal or application; when a terminal or application exhibits continuous compliance behavior, the adaptive access control module increases its access rights or extends the validity period of the access rights; when the adaptive access control module detects suspicious behavior or security events, the adaptive access control module immediately restricts or revokes the access rights of the terminal or application; the adaptive access control module also establishes a user feedback mechanism, which allows security administrators to manually review and adjust updates to the access control list through the user feedback mechanism; the adaptive access control module learns the administrator's manual update operations on the access control list based on security policies and organizational needs; After the application connects to the ID card reader device, it initiates a request to obtain a verification code. After receiving the request, the ID card reader first determines whether the application is in the access control list. If it is, it returns a verification code; if it is not, it returns an error message. Subsequent requests to interact with the ID card reader require this verification code to ensure that the request comes from a legitimate client device and application.

[0005] The encryption and decryption module is used to: encrypt and decrypt sensitive data during data transmission; The log recording and monitoring module is used to: determine the events and log information that need to be recorded; the events that need to be recorded include the reading and verification of identity card information, user login attempts and system errors; the log information includes: timestamp, event type, user identification and operation results; the log recording and monitoring module monitors relevant events and operation results in real time, and promptly detects any abnormal behavior or unauthorized access.

[0006] In one embodiment, the identity authentication and authorization module includes: a digital certificate verification unit; The digital certificate verification unit is used to manage digital certificates using blockchain technology; the digital certificate verification unit records each certificate update or verification on the blockchain; the digital certificate verification unit builds a private blockchain network, only allowing authorized nodes to join, and each block contains the user's digital certificate information; The digital certificate information includes: user ID, certificate validity period, authority level and hash value of biometric data.

[0007] When an application calls a device, it first signs the information message using a digital certificate, and the reader parses and verifies the signature content. Similarly, when the reader returns the read message, it also signs the relevant data, and the application parses and verifies it, ensuring the security and tamper-proofing of the data message.

[0008] In one embodiment, the identity authentication and authorization module includes: a biometric recognition unit; The biometric identification unit is used to perform identity authentication in combination with fingerprint identification, vein identification or voiceprint identification.

[0009] In one embodiment, the biometric recognition unit includes: a fingerprint recognition unit, a vein recognition unit and a voiceprint recognition unit; The fingerprint recognition unit is used to capture the user's fingerprint image using a high-resolution optical or capacitive sensor; the fingerprint recognition unit uses an image processing algorithm to improve the quality of the fingerprint image, including denoising, enhancement and feature extraction; The vein recognition unit is used to capture the image of the user's finger vein using infrared imaging technology, analyze the vein pattern using an algorithm, and extract the biometric feature; The voiceprint recognition unit is used to capture the user's voice sample by using a microphone array; the voiceprint recognition unit uses speech recognition technology to analyze the frequency characteristics, rhythm characteristics and tone characteristics of the sound.

[0010] In one embodiment, the biometric recognition unit further includes: a feature fusion unit; The feature fusion unit is used to fuse the three biometric features in a weighted summation manner to obtain a comprehensive identity authentication feature value; the calculation formula is S=w1⋅S1+w2⋅S2+w3⋅S3, where S1, S2, S3 are fingerprint feature values, vein feature values ​​and voiceprint feature values ​​respectively, and w1, w2, w3 are corresponding weights.

[0011] In one embodiment, the encryption and decryption module includes: an encryption unit; The encryption unit is used to generate a symmetric key using a secure random number generator; the encryption and decryption module encrypts the sensitive data to be transmitted using a symmetric encryption algorithm and a symmetric key to obtain encrypted data; The encryption unit is further used to encrypt the symmetric key using an asymmetric encryption algorithm and a public key of the recipient to obtain an encryption key; The encryption unit is further used to exchange a symmetric key using asymmetric encryption and then encrypt data using the symmetric key; The encryption unit is also used to send the encrypted data and the encryption key together to the application party.

[0012] In one embodiment, the encryption and decryption module includes: a decryption unit; The decryption unit is used to decrypt the encryption key using the private key to recover the symmetric key; The decryption unit is used to decrypt the encrypted data using the recovered symmetric key and the symmetric decryption algorithm to obtain the original data.

[0013] On the other hand, the present invention also provides a method for verifying identity information of a self-service device, comprising the following steps: Integrate digital certificates, biometrics and behavioral analysis for multi-dimensional identity authentication; rely on static biometrics and combine them with the user's behavioral patterns for verification; the behavioral patterns include: dynamic factors such as operating habits and login time preferences; Dynamically adjust access rights based on user access history, geographic location, and device security; maintain access control lists that define which terminals or applications have the right to access specific data or perform specific operations; learn in real time and dynamically update access rights based on the behavior patterns and security events of terminals or applications; increase access rights or extend the validity period of access rights when a terminal or application exhibits continuous compliance behavior; immediately restrict or revoke the access rights of the terminal or application when suspicious behavior or security events are detected; establish a user feedback mechanism that allows security administrators to manually review and adjust updates to access control lists; learn administrators' manual updates to access control lists based on security policies and organizational needs; Encrypt and decrypt sensitive data during data transmission; Determine the events and log information that need to be recorded; the events that need to be recorded include the reading and verification of identity card information, user login attempts and system errors; the log information includes: timestamp, event type, user identification and operation results; monitor related events and operation results in real time to promptly detect any abnormal behavior or unauthorized access.

[0014] On the other hand, the present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the self-service device identity information verification method are implemented.

[0015] On the other hand, the present invention further provides a computer device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; wherein: The memory is used to store computer programs; The processor is used to execute the steps of the self-service device identity information verification method by running the program stored in the memory.

[0016] The beneficial effects of the technical solution of the present invention are: 1. The self-service device identity information verification system described in the present invention can achieve multi-factor authentication and encryption technology through the mutual cooperation of system modules, thereby significantly improving the security of identity card information; adopting advanced encryption technology, effectively preventing data leakage and tampering during transmission and storage; through physical and logical security measures, enhancing the security of the equipment to prevent illegal disassembly and tampering; real-time monitoring and abnormal behavior detection mechanism can timely discover and respond to potential security threats, thereby improving the security and reliability of the system.

[0017] 2. The self-service device identity information verification method described in the present invention can call the system modules in an orderly manner, thereby realizing the system logic of the self-service device identity information verification system described in the present invention.

[0018] 3. The computer-readable storage medium described in the present invention can realize the cooperation of the guiding system module, thereby realizing the self-service device identity information verification method described in the present invention, and the computer-readable storage medium described in the present invention also effectively improves the operability of the self-service device identity information verification method.

[0019] 4. The computer device described in the present invention can store and execute the computer-readable storage medium, thereby realizing the self-service device identity information verification method described in the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0021] Figure 1 It is a schematic diagram of the architecture of the self-service device identity information verification system according to Embodiment 1 of the present invention; Figure 2 It is a schematic diagram of the logical architecture of the self-service device identity information verification system according to Embodiment 1 of the present invention; Figure 3 It is a flowchart of the self-service device identity information verification method described in Example 2 of the present invention; Figure 4 is a schematic diagram of the structure of the computer device described in Example 4 of the present invention; The symbols in the accompanying drawings are explained as follows: 1501, processor; 1502, communication interface; 1503, memory; 1504, communication bus. DETAILED DESCRIPTION

[0022] The preferred embodiments of the present invention are described in detail below in conjunction with the accompanying drawings so that the advantages and features of the present invention can be more easily understood by those skilled in the art, thereby making a clearer and more definite definition of the protection scope of the present invention.

[0023] In the description of the present invention, it should be noted that the embodiments described in the present invention are only part of the embodiments of the present invention, rather than all of the embodiments; based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present invention.

[0024] The terms "first", "second", etc. in the specification and claims of this article and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of this article described here can be implemented in an order other than those illustrated or described here. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, device, product or equipment that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or equipment. Example 1

[0025] This embodiment provides a self-service device identity information verification system, such as Figure 1 and Figure 2 As shown, including: An identity authentication and authorization module is used to ensure that only authorized users can access the ID card reader; the identity authentication and authorization module integrates multi-dimensional identity authentication of digital certificates, biometrics and behavioral analysis; the identity authentication and authorization module relies on static biometric features and combines the user's behavior pattern for verification; the behavior pattern includes: dynamic factors of operating habits and login time preference; An adaptive access control module is used to: dynamically adjust access rights based on the user's access history, geographic location, and device security; the adaptive access control module maintains an access control list to define the terminal or application's right to access specific data or perform specific operations; the adaptive access control module learns in real time and dynamically updates access rights based on the behavior patterns and security events of the terminal or application; when a terminal or application exhibits continuous compliance behavior, the adaptive access control module increases its access rights or extends the validity period of the access rights; when the adaptive access control module detects suspicious behavior or security events, the adaptive access control module immediately restricts or revokes the access rights of the terminal or application; the adaptive access control module also establishes a user feedback mechanism, which allows security administrators to manually review and adjust updates to the access control list through the user feedback mechanism; the adaptive access control module learns the administrator's manual update operations on the access control list based on security policies and organizational needs; After the application connects to the ID card reader device, it initiates a request to obtain a verification code. After receiving the request, the ID card reader first determines whether the application is in the access control list. If it is, it returns a verification code; if it is not, it returns an error message. Subsequent requests to interact with the ID card reader require this verification code to ensure that the request comes from a legitimate client device and application.

[0026] The encryption and decryption module is used to: encrypt and decrypt sensitive data during data transmission; The log recording and monitoring module is used to: determine the events and log information that need to be recorded; the events that need to be recorded include the reading and verification of identity card information, user login attempts and system errors; the log information includes: timestamp, event type, user identification and operation results; the log recording and monitoring module monitors relevant events and operation results in real time, and promptly detects any abnormal behavior or unauthorized access.

[0027] In one embodiment, the identity authentication and authorization module includes: a digital certificate verification unit; The digital certificate verification unit is used to manage digital certificates using blockchain technology; the digital certificate verification unit records each certificate update or verification on the blockchain; the digital certificate verification unit builds a private blockchain network, only allowing authorized nodes to join, and each block contains the user's digital certificate information; The digital certificate information includes: user ID, certificate validity period, authority level and hash value of biometric data.

[0028] When an application calls a device, it first signs the information message using a digital certificate, and the reader parses and verifies the signature content. Similarly, when the reader returns the read message, it also signs the relevant data, and the application parses and verifies it, ensuring the security and tamper-proofing of the data message.

[0029] In one embodiment, the identity authentication and authorization module includes: a biometric recognition unit; The biometric identification unit is used to perform identity authentication in combination with fingerprint identification, vein identification or voiceprint identification.

[0030] In one embodiment, the biometric recognition unit includes: a fingerprint recognition unit, a vein recognition unit and a voiceprint recognition unit; The fingerprint recognition unit is used to capture the user's fingerprint image using a high-resolution optical or capacitive sensor; the fingerprint recognition unit uses an image processing algorithm to improve the quality of the fingerprint image, including denoising, enhancement and feature extraction; The vein recognition unit is used to capture the image of the user's finger vein using infrared imaging technology, analyze the vein pattern using an algorithm, and extract the biometric feature; The voiceprint recognition unit is used to capture the user's voice sample by using a microphone array; the voiceprint recognition unit uses speech recognition technology to analyze the frequency characteristics, rhythm characteristics and tone characteristics of the sound.

[0031] In one embodiment, the biometric recognition unit further includes: a feature fusion unit; The feature fusion unit is used to fuse the three biometric features in a weighted summation manner to obtain a comprehensive identity authentication feature value; the calculation formula is S=w1⋅S1+w2⋅S2+w3⋅S3, where S1, S2, S3 are fingerprint feature values, vein feature values ​​and voiceprint feature values ​​respectively, and w1, w2, w3 are corresponding weights.

[0032] In one embodiment, the encryption and decryption module includes: an encryption unit; The encryption unit is used to generate a symmetric key using a secure random number generator; the encryption and decryption module encrypts the sensitive data to be transmitted using a symmetric encryption algorithm and a symmetric key to obtain encrypted data; The encryption unit is further used to encrypt the symmetric key using an asymmetric encryption algorithm and a public key of the recipient to obtain an encryption key; The encryption unit is further used to exchange a symmetric key using asymmetric encryption and then encrypt data using the symmetric key; The encryption unit is also used to send the encrypted data and the encryption key together to the application party.

[0033] In one embodiment, the encryption and decryption module includes: a decryption unit; The decryption unit is used to decrypt the encryption key using the private key to recover the symmetric key; The decryption unit is used to decrypt the encrypted data using the recovered symmetric key and the symmetric decryption algorithm to obtain the original data.

[0034] It should be noted that the examples here are only for explaining the present invention and cannot limit the scope of protection of the present invention. Example 2

[0035] This embodiment is based on the same inventive concept as the self-service device identity information verification system described in Embodiment 1, and provides a self-service device identity information verification method, such as Figure 3 As shown, the following steps are included: S100 integrates digital certificates, biometrics and behavioral analysis for multi-dimensional identity authentication; relies on static biometrics and combines the user's behavioral patterns for verification; the behavioral patterns include: dynamic factors such as operating habits and login time preferences; S200. Dynamically adjust access rights based on user access history, geographic location, and device security; maintain access control lists that define the rights of terminals or applications to access specific data or perform specific operations; learn in real time and dynamically update access rights based on the behavior patterns and security events of terminals or applications; increase access rights or extend the validity period of access rights when a terminal or application exhibits continuous compliance behavior; immediately restrict or revoke the access rights of the terminal or application when suspicious behavior or security events are detected; establish a user feedback mechanism that allows security administrators to manually review and adjust updates to access control lists; learn administrators' manual updates to access control lists based on security policies and organizational needs; S300, encrypting and decrypting sensitive data during data transmission; S400, determine the events and log information that need to be recorded; the events that need to be recorded include reading and verification of identity card information, user login attempts and system errors; the log information includes: timestamp, event type, user identification and operation results; monitor related events and operation results in real time to promptly detect any abnormal behavior or unauthorized access. Example 3

[0036] This embodiment provides a computer-readable storage medium, including: The storage medium is used to store computer software instructions used to implement the self-service device identity information verification method described in the above-mentioned embodiment 2, which includes a program for executing the above-mentioned program set for the self-service device identity information verification method; specifically, the executable program can be built into the self-service device identity information verification system described in embodiment 1, so that the self-service device identity information verification system can implement the self-service device identity information verification method described in embodiment 2 by executing the built-in executable program.

[0037] In addition, the computer-readable storage medium of this embodiment may adopt any combination of one or more computer-readable storage media, wherein the computer-readable storage medium includes electrical, optical, electromagnetic, infrared or semiconductor systems, devices or components, or any combination thereof. Example 4

[0038] This embodiment provides an electronic device, such as Figure 4 As shown, the electronic device may include: a processor 1501 , a communication interface 1502 , a memory 1503 and a communication bus 1504 , wherein the processor 1501 , the communication interface 1502 , and the memory 1503 communicate with each other via the communication bus 1504 .

[0039] Memory 1503, used for storing computer programs; The processor 1501 is used to implement the steps of the self-service device identity information verification method described in the above embodiment 1 when executing the computer program stored in the memory 1503.

[0040] As an embodiment of the present invention, the communication bus mentioned in the above terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0041] As an implementation mode of the present invention, the communication interface is used for communication between the above-mentioned terminal and other devices.

[0042] As an embodiment of the present invention, the memory may include a random access memory (RAM) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0043] As an embodiment of the present invention, the above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.

[0044] Different from the existing technology, the self-service device identity information verification system, method, device and medium of the present application can significantly improve the security of identity card information through multi-factor authentication and encryption technology; adopt advanced encryption technology to effectively prevent data leakage and tampering during transmission and storage; enhance the security of equipment through physical and logical security measures to prevent illegal disassembly and tampering; real-time monitoring and abnormal behavior detection mechanism can promptly discover and respond to potential security threats, thereby improving the security and reliability of the system.

[0045] It should be understood that in the various embodiments of this document, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this document.

[0046] It should also be understood that in the embodiments of this article, the term "and / or" is only a description of the association relationship of the associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0047] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this article.

[0048] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific logical process of the method described above can refer to the corresponding working processes of the systems, devices and units in the aforementioned method embodiments, and will not be repeated here.

[0049] In the several embodiments provided herein, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of the units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, or can be electrical, mechanical or other forms of connection.

[0050] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of this article.

[0051] In addition, each functional unit in each embodiment of this invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit may be implemented in the form of hardware or in the form of software functional unit.

[0052] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this article is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of this article. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0053] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A self-service device identity information verification system, characterized in that: include: An identity authentication and authorization module is used to ensure that only authorized users can access the ID card reader; the identity authentication and authorization module integrates multi-dimensional identity authentication of digital certificates, biometrics and behavioral analysis; the identity authentication and authorization module relies on static biometric features and combines the user's behavioral pattern for verification; The behavior pattern includes: dynamic factors of operating habits and login time preferences; An adaptive access control module is used to: dynamically adjust access rights based on the user's access history, geographic location, and device security; the adaptive access control module maintains an access control list to define the terminal or application's right to access specific data or perform specific operations; the adaptive access control module learns in real time and dynamically updates access rights based on the behavior patterns and security events of the terminal or application; when a terminal or application exhibits continuous compliance behavior, the adaptive access control module increases its access rights or extends the validity period of the access rights; when the adaptive access control module detects suspicious behavior or security events, the adaptive access control module immediately restricts or revokes the access rights of the terminal or application; the adaptive access control module also establishes a user feedback mechanism, which allows security administrators to manually review and adjust updates to the access control list through the user feedback mechanism; the adaptive access control module learns the administrator's manual update operations on the access control list based on security policies and organizational needs; The encryption and decryption module is used to: encrypt and decrypt sensitive data during data transmission; The log recording and monitoring module is used to: determine the events and log information that need to be recorded; the events that need to be recorded include the reading and verification of identity card information, user login attempts and system errors; the log information includes: timestamp, event type, user identification and operation results; the log recording and monitoring module monitors relevant events and operation results in real time, and promptly detects any abnormal behavior or unauthorized access.

2. The self-service device identity information verification system according to claim 1, characterized in that: The identity authentication and authorization module includes: a digital certificate verification unit; The digital certificate verification unit is used to manage digital certificates using blockchain technology; the digital certificate verification unit records each certificate update or verification on the blockchain; the digital certificate verification unit builds a private blockchain network, only allowing authorized nodes to join, and each block contains the user's digital certificate information; The digital certificate information includes: user ID, certificate validity period, authority level and hash value of biometric data.

3. The self-service device identity information verification system according to claim 1, characterized in that: The identity authentication and authorization module includes: a biometric recognition unit; The biometric identification unit is used to perform identity authentication in combination with fingerprint identification, vein identification or voiceprint identification.

4. The self-service device identity information verification system according to claim 3, characterized in that: The biometric recognition unit includes: a fingerprint recognition unit, a vein recognition unit and a voiceprint recognition unit; The fingerprint recognition unit is used to capture the user's fingerprint image using a high-resolution optical or capacitive sensor; the fingerprint recognition unit uses an image processing algorithm to improve the quality of the fingerprint image, including denoising, enhancement and feature extraction; The vein recognition unit is used to capture the image of the user's finger vein using infrared imaging technology, analyze the vein pattern using an algorithm, and extract the biometric feature; The voiceprint recognition unit is used to capture the user's voice sample by using a microphone array; the voiceprint recognition unit uses speech recognition technology to analyze the frequency characteristics, rhythm characteristics and tone characteristics of the sound.

5. The self-service device identity information verification system according to claim 4, characterized in that: The biometric recognition unit further includes: a feature fusion unit; The feature fusion unit is used to fuse the three biometric features in a weighted summation manner to obtain a comprehensive identity authentication feature value; the calculation formula is S=w1⋅S1+w2⋅S2+w3⋅S3, where S1, S2, S3 are fingerprint feature values, vein feature values ​​and voiceprint feature values ​​respectively, and w1, w2, w3 are corresponding weights.

6. The self-service device identity information verification system according to claim 1, characterized in that: The encryption and decryption module comprises: an encryption unit; The encryption unit is used to generate a symmetric key using a secure random number generator; the encryption and decryption module encrypts the sensitive data to be transmitted using a symmetric encryption algorithm and a symmetric key to obtain encrypted data; The encryption unit is further used to encrypt the symmetric key using an asymmetric encryption algorithm and a public key of the recipient to obtain an encryption key; The encryption unit is further used to exchange a symmetric key using asymmetric encryption and then encrypt data using the symmetric key; The encryption unit is also used to send the encrypted data and the encryption key together to the application party.

7. The self-service device identity information verification system according to claim 6, characterized in that: The encryption and decryption module comprises: a decryption unit; The decryption unit is used to decrypt the encryption key using the private key to recover the symmetric key; The decryption unit is used to decrypt the encrypted data using the recovered symmetric key and the symmetric decryption algorithm to obtain the original data.

8. A self-service device identity information verification method, characterized in that: The following steps are involved: Integrate digital certificates, biometrics, and behavioral analysis for multi-dimensional identity authentication; Rely on static biometrics and combine them with the user's behavior patterns for verification; The behavior pattern includes: dynamic factors of operating habits and login time preferences; Dynamically adjust access rights based on user access history, geographic location, and device security; maintain access control lists that define which terminals or applications have the right to access specific data or perform specific operations; learn in real time and dynamically update access rights based on the behavior patterns and security events of terminals or applications; increase access rights or extend the validity period of access rights when a terminal or application exhibits continuous compliance behavior; immediately restrict or revoke the access rights of the terminal or application when suspicious behavior or security events are detected; establish a user feedback mechanism that allows security administrators to manually review and adjust updates to access control lists; learn administrators' manual updates to access control lists based on security policies and organizational needs; Encrypt and decrypt sensitive data during data transmission; Determine the events and log information that need to be recorded; the events that need to be recorded include the reading and verification of identity card information, user login attempts and system errors; the log information includes: timestamp, event type, user identification and operation results; monitor related events and operation results in real time to promptly detect any abnormal behavior or unauthorized access.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by the processor, the steps of the self-service device identity information verification method described in claim 8 are implemented.

10. A computer device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; wherein: The memory is used to store computer programs; The processor is used to execute the steps of the self-service device identity information verification method described in claim 8 by running the program stored in the memory.

Images