Entrance guard attendance system and method based on biological recognition

Abstract

The invention relates to an access control attendance system and an access control attendance method based on biological recognition, which solve the problems of accuracy and reliability of identity recognition through a palm print and palm vein recognition technology and effectively avoid potential safety hazards caused by identity misjudgment. And the national secret CPU unit prevents data transmission from being stolen or tampered in a data transmission process through dynamic password authentication and an encrypted communication protocol, so that the safety of the access control system is guaranteed. In terms of key management, a key updating mechanism solves the problem of security risks caused by increase of the number of times of use of the key, and security threats caused by key leakage are prevented. The key backup mechanism ensures the recoverability of the key, and avoids the situation that the system cannot operate normally due to the loss or damage of the key. According to the access control system, transaction records are stored and managed through the block chain technology, the problems of data integrity, traceability and high efficiency in the management process of the access control system are solved, automatic management is achieved, and the safety and stability of the whole access control system are improved.

Description

Technical Field

[0001] The invention belongs to the technical field of access control systems, and relates to an access control attendance system and method based on biometrics. Background Art

[0002] In today's era of rapid development of digitalization and intelligence, the importance of the security field has become increasingly prominent. Access control equipment, as a key facility for protecting the safety of various places, regulating the entry and exit management of personnel, and assisting in attendance statistics, has attracted much attention for its technical application. At present, access control equipment on the market generally uses face recognition technology and M1 encryption card technology to achieve related functions.

[0003] With its non-contact, convenient and efficient characteristics, face recognition technology can quickly capture and identify facial features of people, thereby achieving accurate identity verification, greatly improving the efficiency of access control, and has been widely used in many public institutions, offices and communities. At the same time, M1 encryption card technology, with its good encryption performance, relatively stable data storage, and easy to carry and use, has added a strong line of defense to the security of the access control system. It completes identity confirmation through encrypted data interaction between the card and the card reader, becoming a reliable choice for access control management in many places.

[0004] However, with the continuous iteration of technology and the increasing complexity of actual application scenarios, the problems of these two mainstream technologies have gradually surfaced. Although face recognition technology is convenient and fast, it is affected by many factors such as lighting conditions, posture changes, facial occlusion, and makeup, which may lead to reduced recognition accuracy, misidentification or rejection, which in turn has an adverse effect on security effects. In addition, the face recognition system may be deceived by photos or videos. A high-definition photo or video may be used to obtain facial information to impersonate others. In terms of M1 encryption card technology, it also faces security risks such as the risk of card duplication and the possibility of encryption algorithms being cracked, which poses challenges to the reliability of access control systems and even the entire security field.

[0005] In view of the existence of these problems, exploring safer, more efficient and stable access control technology alternatives or optimizing and improving existing technologies has become an important issue that needs to be urgently addressed in the current security field. This has far-reaching significance for further ensuring the safety and stability of various social places and improving the scientific nature of personnel management. Summary of the invention

[0006] The present invention provides an access control and attendance system and method based on biometrics, aiming to enhance the anti-copying capability and automatic warning capability by using a national secret CPU card; improve the efficiency and accuracy of identity recognition by using palm print and palm vein multimodal biometrics technology, and call the national secret CPU unit and the palm print and palm vein unit in combination with different usage scenarios to improve the flexibility of the access control device.

[0007] The purpose of the present invention can be achieved by the following technical solutions:

[0008] In the first aspect, the present application provides an access control and attendance system based on biometrics, including a national secret CPU unit and a palm print and palm vein unit; the system calls the national secret CPU unit and the palm print and palm vein unit according to different usage scenarios; the national secret CPU unit includes a key management module, a key update module and a key backup module; the palm print and palm vein unit includes a palm print coarse screening module and a palm vein recognition module, wherein:

[0009] The key management module is used to establish a multi-level key architecture, wherein the multi-level key architecture includes a root key, a working key and a session key;

[0010] The key update module is used for the access control device to automatically generate the Secret for the next card swipe of the device at the access control device according to the number of times the access card is swiped each time after the user swipes the card, and synchronize the Secret to other access control devices to which the user has permission;

[0011] The key backup module is used to establish a reliable key backup and recovery mechanism and store the key backup in a safe place;

[0012] The palm print coarse screening module is used to perform a 1:N search through the palm prints to obtain multiple palm vein feature values;

[0013] The palm vein recognition module is used to perform 1:N matching of the user's palm vein feature values ​​in the above 1:N search result set.

[0014] Furthermore, the root key is used to protect the security of the working key, the working key is used for daily authentication and data encryption of the access card, and the session key is dynamically generated during each communication process.

[0015] Furthermore, the key update module verifies the number of card swipes and the corresponding Secret when the user checks the card next time. If the number does not exist, the card is considered illegal and the MFA password needs to be obtained through the supporting APP to continue updating the Secret. When the copied card cannot obtain a valid MFA password, the Secret cannot be updated and the card cannot be used. When the card is swiped again and the MFA password cannot be verified, the system will automatically capture the person's portrait through the face recognition camera and upload it to the server, and send an alarm message to the property and the owner at the same time.

[0016] Furthermore, the national secret CPU unit is used to introduce dynamic password authentication and encrypted communication protocol. The dynamic password authentication generates a one-time dynamic password each time the access card is authenticated, and matches it with the verification information on the server side. The generation of the dynamic password is based on time synchronization, event synchronization or challenge / response mechanism, which can prevent replay attacks and man-in-the-middle attacks. The encrypted communication protocol adopts the national secret version of the transport layer security protocol to encrypt data transmission between the access card and the card reader, the card reader and the access controller, and the access controller and the access system server.

[0017] Furthermore, the usage scenarios include high-traffic fast-pass scenarios, high-security level verification scenarios, emergency handling scenarios, remote access scenarios, and temporary authority granting scenarios, where:

[0018] The high-traffic fast-pass scenario only calls the palm print and palm vein unit to authenticate and unlock the door;

[0019] The high-security level verification scenario requires the simultaneous invocation of the national secret CPU unit and the palm print and palm vein unit to unlock the door;

[0020] The emergency processing scenario: when the access card is lost or forgotten, or the system identifies a security risk, the palm print and palm vein unit is used first to confirm the user's identity; when key-related issues are involved, the national secret CPU unit is used to handle access key issues;

[0021] In the remote access scenario, when there is a need for remote access control, the encrypted communication protocol of the national secret CPU unit is called to encrypt and transmit the remote instructions, and the palm print and palm vein unit is used to verify the identity of the actual entrants on site;

[0022] In the temporary authority granting scenario, when it is necessary to grant short-term authority to temporary personnel, the system first calls the palm print and palm vein unit to collect their palm features and grants the corresponding authority range; at the same time, the national secret CPU unit is used to be responsible for data interaction and authority management during the authorization period.

[0023] Furthermore, the system also uses blockchain technology to store and manage transaction records, and provides smart contract functions to achieve automated management. Specifically, blockchain technology converts user information into transaction records and stores them on the blockchain, using the blockchain's chain structure and encryption algorithm to ensure data integrity and security; smart contracts are codes on the blockchain that are used to specify the business logic and rules of the access control system, and achieve automated management of the access control system by automatically processing user verification requests.

[0024] In a second aspect, the present application provides a biometric access control and attendance method, which is applied to a biometric access control and attendance system as described above, and includes the following steps:

[0025] S1. User registration: The user first takes a photo of the palm print and uploads it to the access control system server. The server extracts the palm print feature value and sends it to other access control controllers with control authority; the user goes to the access control device with control authority to open the door for the first time, enters the last digit of the mobile phone number as prompted to complete identity authentication, and then places the hand in front of the palm vein camera for about 3 seconds to collect the palm vein feature value, which is uploaded to the server and distributed to other related access control controllers; at the same time, a dynamic password is set to complete the registration;

[0026] S2, daily access: before the user reaches the access control device, the palm print and palm vein unit first performs a rough screening of the palm print, performs a 1:N search, and obtains multiple palm vein feature values; the palm vein recognition module performs a 1:N precise match among the palm vein feature values; after a successful match, the national secret CPU unit verifies the key, generates a dynamic password and matches it with the server-side information, transmits data through an encrypted communication protocol, and the access control actuator opens the door;

[0027] S3, key update: After each card swipe, the key update module generates the device's next card swipe secret based on the number of card swipes, and synchronizes it to other authorized access control devices; the card swipe count and secret are verified during card verification. If they do not exist, the card is considered illegal and the MFA password needs to be obtained through the supporting APP to update the secret; if the copied card cannot obtain a valid MFA password, the card cannot update the secret;

[0028] S4, Data backup: The key backup module regularly stores the key to a secure hardware security module or a dedicated key management server; when the card is lost, damaged or the key is leaked, the key is restored in time;

[0029] S5. Exception handling: If palm print and palm vein recognition fails multiple times or the national secret CPU unit verification is abnormal, the system prompts the user to re-operate; after multiple unsuccessful attempts, the user is restricted from re-verifying within a short period of time and the administrator is notified to intervene.

[0030] Beneficial effects of the present invention:

[0031] (1) The use of palm print and palm vein recognition technology has greatly improved the security and reliability of the access control system: The uniqueness and stability of palm prints and palm veins make them a highly accurate basis for identity recognition. In the access control system, the palm print screening module and palm vein recognition module can quickly and accurately identify the user's identity, reducing the security risks caused by password leakage or key loss in traditional access control systems, providing users with a safer and more reliable access control experience.

[0032] (2) The National Secret CPU unit introduces dynamic password authentication and encrypted communication protocols, further enhancing the security of the access control system. Dynamic password authentication generates a one-time dynamic password based on time synchronization, event synchronization or challenge / response mechanism, effectively preventing replay attacks and man-in-the-middle attacks. In the access control system, when a user authenticates their identity, the National Secret CPU unit generates a dynamic password and matches it with the verification information on the server. This process ensures that only legitimate users can pass through the access control system, greatly improving the security of the system. The encrypted communication protocol uses the National Secret version of the transport layer security protocol to encrypt data transmission between the access control card and the card reader, the card reader and the access control controller, and the access control controller and the access control system server, ensuring the security and integrity of the data.

[0033] (3) Blockchain technology stores and manages transaction records and provides smart contract functions for automated management. The distributed ledger feature of blockchain makes data storage more secure and reliable and less susceptible to tampering. In the access control system, transaction records include user identity information, access control pass records, permission changes, etc. These records are stored on the blockchain and managed through smart contracts. Smart contracts can automatically perform access control operations according to preset rules, such as granting and revoking access control permissions. This technology not only improves the management efficiency of the access control system, but also enhances the transparency and traceability of the system.

[0034] (4) The organic combination of biometric technology, national secret CPU unit and blockchain technology has realized the intelligence and efficiency of the access control system. The synergy of multiple technologies enables the access control system to adapt to different scenarios and user needs. The combination of these technologies provides users with more convenient, safe and efficient access control services. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to facilitate understanding by those skilled in the art, the present invention is further described below with reference to the accompanying drawings.

[0036] Figure 1 The figure is a structural diagram of a biometric-based access control and attendance system in the present invention.

[0037] Figure 2 The present invention is a flow chart of a biometric-based access control and attendance method. DETAILED DESCRIPTION

[0038] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the specific implementation mode, structure, characteristics and effects of the present invention are described in detail below in combination with the accompanying drawings and preferred embodiments.

[0039] See also Figure 1-Figure 2In the first aspect, the present application provides a biometric access control and attendance system, including a national secret CPU unit and a palm print and palm vein unit, wherein the national secret CPU unit includes a key management module, a key update module and a key backup module; the palm print and palm vein unit includes a palm print coarse screening module and a palm vein identification module, wherein,

[0040] The key management module is used to establish a multi-level key architecture, wherein the multi-level key architecture includes a root key, a working key and a session key;

[0041] Furthermore, the root key is used to protect the security of the working key, the working key is used for daily authentication and data encryption of the access card, and the session key is dynamically generated during each communication process.

[0042] In this embodiment, the root key, working key and session key each play an important role in the multi-level key architecture. The root key, as the core of the entire key system, provides security for the working key. It ensures the integrity and security of the working key by encrypting and protecting the working key. The working key is responsible for the daily authentication and data encryption of the access control card. In the access control system, the working key is used to verify the user identity, encrypt user data and protect the security of the access control system.

[0043] The session key is dynamically generated during each communication process, which further enhances the security of the key. Since the session key is generated in real time during the communication process, it can prevent the key from being stolen or cracked. At the same time, the dynamic generation of the session key also enables each communication to have an independent key, further enhancing the security of the data.

[0044] In practical applications, the synergy between the root key, working key and session key can improve the security and reliability of the access control system. The root key can ensure the security of the working key by regularly updating the working key. The working key can protect the security of the access control system by authenticating and encrypting the access card. The session key can be dynamically generated during each communication process, thereby improving the security of communication. The establishment of a multi-level key architecture provides a more secure and reliable guarantee for the access control system. The synergy of the root key, working key and session key enables the access control system to effectively protect user data and security.

[0045] The key update module is used for the access control device to automatically generate the Secret for the next card swipe of the device at the access control device according to the number of times the access card is swiped each time after the user swipes the card, and synchronize the Secret to other access control devices to which the user has permission;

[0046] Furthermore, the key update module verifies the number of card swipes and the corresponding Secret when the user checks the card next time. If the number does not exist, the card is considered illegal and the MFA password needs to be obtained through the supporting APP to continue updating the Secret. When the copied card cannot obtain a valid MFA password, the Secret cannot be updated and the card cannot be used. When the card is swiped again and the MFA password cannot be verified, the system will automatically capture the person's portrait through the face recognition camera and upload it to the server, and send an alarm message to the property and the owner at the same time.

[0047] In this embodiment, the key update module plays a key role in the access control system. Every time a user swipes the card, the access control device will automatically generate a Secret based on the number of times the access card is swiped. The generation of this Secret is not random, but based on a certain algorithm, which provides a basis for security verification for the next card swipe.

[0048] Subsequently, the key update module synchronizes the generated Secret to other access control devices that the user has permission to use. This synchronization mechanism ensures that all relevant access control devices can maintain consistent security verification standards during subsequent card swiping operations. When the user checks the card next time, the access control device will verify the number of card swipes and the corresponding Secret. If the corresponding Secret does not exist, the system will determine that the card is illegal. At this time, the user needs to obtain the MFA password through the supporting APP. Only when a valid MFA password is obtained can the Secret be updated.

[0049] Once the copied card cannot obtain the legal MFA password, the card cannot update the Secret and cannot be used. When the card is swiped again and the MFA password cannot be verified, the system will automatically capture the head portrait through the face recognition camera and upload it to the server. At the same time, an alarm message will be sent to the property and the owner.

[0050] The setting of this key update module greatly improves the security of the access control system. On the one hand, it prevents the use of illegal cards and avoids possible security loopholes. On the other hand, through timely alarm notifications, the property and owners can immediately understand the abnormal situation of the access control system and take corresponding measures to ensure safety.

[0051] The key backup module is used to establish a reliable key backup and recovery mechanism, and store the key backup in a safe place, such as a hardware security module (HSM) or a dedicated key management server. In the event of card loss, damage or key leakage, the key can be restored in time to ensure the normal operation of the access control system;

[0052] In this embodiment, the key backup module is a key component to ensure the safe and stable operation of the access control system. In the access control system, various situations may cause the key to be lost, damaged or leaked. Once these situations occur, the key backup module plays an important role. When the card is lost, damaged or the key is leaked, the key backup module can restore the key to the access control system from a secure storage location, such as a hardware security module (HSM) or a dedicated key management server. This process requires strict security verification and operation procedures to ensure the integrity and security of the key.

[0053] As a specialized security device, the Hardware Security Module (HSM) provides highly reliable key storage and management capabilities. It uses advanced encryption technology and security mechanisms to protect keys from various security threats. A dedicated key management server can centrally manage and back up keys, making it easy for users to restore them when needed.

[0054] In order to ensure the security and reliability of key backup, the key backup module can also adopt multiple backup strategies. For example, regularly back up keys to different storage media to prevent key loss due to failure of a single storage medium. At the same time, encrypt the backup keys to ensure the security of the keys. In practical applications, the role of the key backup module is not only reflected in ensuring the normal operation of the access control system. It can also improve the security and reliability of the system and protect the privacy and data security of users. For example, when the user replaces the access control card or upgrades the access control system, the key backup module can ensure the safe migration of the key to avoid security problems caused by key loss or leakage.

[0055] Furthermore, the national secret CPU unit is used to introduce dynamic password authentication and encrypted communication protocol. The dynamic password authentication generates a one-time dynamic password each time the access card is authenticated, and matches it with the verification information on the server side. The generation of the dynamic password is based on time synchronization, event synchronization or challenge / response mechanism, which can prevent replay attacks and man-in-the-middle attacks. The encrypted communication protocol adopts the national secret version of the transport layer security protocol to encrypt data transmission between the access card and the card reader, the card reader and the access controller, and the access controller and the access system server.

[0056] In this embodiment, the dynamic password authentication mechanism provides additional security for the authentication of the access card by generating a one-time dynamic password. The dynamic password generated each time the access card is authenticated is based on time synchronization, event synchronization, or a challenge / response mechanism. This means that the generation method of the dynamic password is different in different scenarios. For example, a dynamic password based on time synchronization will generate a corresponding password according to the change of time, ensuring that each password is unique and cannot be reused.

[0057] This dynamic password authentication method can effectively prevent replay attacks and man-in-the-middle attacks. A replay attack is when an attacker intercepts and repeatedly sends legitimate authentication information to illegally obtain permissions. The one-time nature of a dynamic password makes it impossible for an attacker to obtain valid authentication information through a replay attack. A man-in-the-middle attack is when an attacker intercepts and tampers with data during communication to obtain information or damage the system. The dynamic password authentication mechanism matches the verification information on the server side to ensure that only legitimate users can pass authentication, greatly reducing the risk of man-in-the-middle attacks.

[0058] The encrypted communication protocol uses the national secret version of the transport layer security protocol to encrypt data transmission between the access card and the card reader, the card reader and the access controller, and the access controller and the access system server. This protocol ensures the security of data during transmission and prevents data from being stolen or tampered with. The national secret version of the encrypted communication protocol uses an advanced encryption algorithm that can encrypt data, making it difficult to crack data during transmission.

[0059] The introduction of the National Secret CPU unit has greatly improved the security of the access control system. The combination of dynamic password authentication and encrypted communication protocol provides a more secure and reliable guarantee for the access control system. Whether in preventing replay attacks, man-in-the-middle attacks, or protecting data transmission security, the National Secret CPU unit plays an important role. In the future development, the National Secret CPU unit will continue to optimize and improve, providing more powerful support for the safe operation of the access control system.

[0060] The palm print coarse screening module is used to perform a 1:N search through the palm prints to obtain multiple palm vein feature values;

[0061] The palm vein recognition module is used to perform 1:N matching of the user's palm vein feature values ​​in the above 1:N search result set;

[0062] In this embodiment, the palmprint coarse screening module is mainly based on the extraction and matching technology of palmprint features. It collects palmprint images and uses a special algorithm to analyze and extract the features of the palmprint. When performing a 1:N search, the system will compare the collected palmprints with the palmprint templates stored in the database. These templates are pre-collected and stored, and contain the palmprint feature information of different users.

[0063] The palm print screening module algorithm will quickly select palm prints with similar features from numerous palm print templates, thereby obtaining multiple palm vein feature values. This process is like a quick search in a huge database, narrowing the scope through the matching of palm print features and determining possible palm vein feature values.

[0064] The palm vein recognition module further performs fine matching on the 1:N search result set obtained by the palm print screening module. It uses the characteristic information of palm veins to extract and analyze the characteristics of palm veins. Different from the palm print screening module, the palm vein recognition module focuses more on the characteristics of palm veins.

[0065] When performing 1:N matching, the palm vein recognition module will compare the collected palm vein features with the palm vein feature templates stored in the database. This process requires accurate calculation of the similarity between the palm vein features to determine whether they match. The palm vein recognition module algorithm will perform more detailed analysis and judgment based on the characteristics of the palm vein features to ensure the accuracy of recognition.

[0066] The palm print screening module and the palm vein recognition module work together to enable the access control system to efficiently identify palm veins. The palm print screening module first selects possible palm vein feature values ​​from the palm prints, and then the palm vein recognition module further matches and verifies these feature values. The combination of these two modules improves the security and reliability of the access control system.

[0067] The system calls the national secret CPU unit and the palm print and vein unit according to different usage scenarios.

[0068] Here are some examples of usage scenarios for different dimensions:

[0069] (1) High-traffic fast-pass scenarios: When there are a large number of people and they need to pass through the gate quickly, such as when a large event venue is over or during rush hour in a factory, the system mainly uses the palm print and palm vein unit. People only need to quickly place their palms on the recognition device, and the palm print and palm vein unit will quickly complete identity authentication through palm print coarse screening and palm vein precise recognition, achieving efficient passage and avoiding congestion.

[0070] (2) High-security level verification scenario: When it comes to operations or accesses with extremely high security requirements, such as logging into important system backgrounds, reading confidential documents, etc., the system will call the national secret CPU unit and the palm print and palm vein unit at the same time. The national secret CPU unit ensures the security of data interaction through dynamic password authentication and encrypted communication protocols, and the palm print and palm vein unit accurately verifies the identity of personnel. The dual protection ensures that only personnel with legal authority can perform corresponding operations, preventing information leakage and illegal access.

[0071] (3) Emergency handling scenarios: If an emergency occurs, such as when the access card is lost or forgotten, or the system suspects that there is a security risk, the system will first call the palm print and palm vein unit to confirm the user's identity, using its unique palm print and palm vein characteristics for comparison. If it involves key-related issues, such as suspected key leakage, the key backup module and key update module of the national secret CPU unit will be immediately activated to restore the key through backup or update related security parameters to ensure the normal and safe operation of the system.

[0072] (4) Remote access scenario: When there is a need for remote access control, such as remotely authorizing visitors to open the door through a mobile phone, the national secret CPU unit plays an important role. The remote command is encrypted and transmitted with the help of an encrypted communication protocol to ensure that the command reaches the access control system safely. At the same time, the palm print and palm vein unit is used to verify the identity of the actual entrants on site, ensuring the security and compliance of the entire remote access process.

[0073] (5) Temporary authority granting scenario: When it is necessary to grant short-term authority to temporary personnel, such as temporary staff and external maintenance personnel, the system first calls the palm print and palm vein unit to collect their palm features and grants the corresponding authority range. These personnel then enter and exit the restricted area based on palm print and palm vein recognition. During this period, the national secret CPU unit is responsible for encrypting the data interaction and authority management involving them to prevent problems such as abuse of authority.

[0074] It should be noted that the biggest problem with palm print and palm vein technology is the user input problem. Mobile phones and ordinary cameras cannot directly input data, so a device with a palm vein module is required to normally input the characteristic value. In order to make it as convenient as possible for users, this input process is optimized as follows:

[0075] First, enter the palm print: the user spreads out his palm, takes a photo and uploads it to the access control system server. At this time, the user's palm print feature value will be sent to other access control controllers that he has the authority to control.

[0076] Re-enter palm vein: When the user opens the door for the first time on any access control device with control authority, he only needs to wave his palm, and the access control controller will automatically prompt the user to enter the last digit of his mobile phone number for identity verification. After the verification is passed, the user can place his hand in front of the palm vein camera for about 3 seconds, and the access control controller will automatically collect the user's palm vein feature value and upload it to the access control system server, which will then distribute it to other access control controllers that the user has authority to access.

[0077] After the above two steps, users can perform palm vein entry independently. In addition, the collected palm print feature values ​​and palm vein feature values ​​will be immediately used to train the algorithm. The access control system server automatically trains the model once a day. After generating the inference model, it regularly (once every 3 days) pushes the new inference model to the access control controller for update.

[0078] Furthermore, the system also uses blockchain technology to store and manage transaction records, and provides smart contract functions to achieve automated management.

[0079] In this embodiment, blockchain technology implements the storage, management and automated smart contract functions of transaction records in the following ways:

[0080] Storage and management: The blockchain stores transaction records in the form of blocks. Each block contains a timestamp, transaction data, and the hash value of the previous block. In the access control system, the user's registration information, access records, permission changes, etc. are all converted into transaction records. These records are stored in the blockchain network in a chain structure through encryption algorithms to ensure the integrity and security of the data. For example, when a user registers, his or her identity information, palm prints, and palm vein feature values ​​are encrypted and stored as a transaction record on the blockchain.

[0081] Smart contract: A smart contract is a piece of code on the blockchain that specifies the business logic and rules of the access control system. When a user performs access control verification, the smart contract is triggered. For example, the contract stipulates that the user has access rights at a specific time and place, and determines whether the permission requirements are met by verifying the user's biometrics, identity information, etc. If they are met, the access control opening operation is automatically executed and the transaction is recorded. Smart contracts can also realize dynamic management of the access control system, such as adjusting user permissions and updating keys.

[0082] Automated management: The blockchain’s smart contracts automate the management process of the access control system. For example, in the access control system, when the user’s permissions change, the smart contract automatically updates the relevant information without manual intervention. In terms of key management, the smart contract can automatically perform key update operations to ensure system security. At the same time, the distributed nature of the blockchain ensures data synchronization between nodes, improving the reliability and stability of the system.

[0083] In a second aspect, the present application provides a biometric access control and attendance method, which is applied to a biometric access control and attendance system as described above, and includes the following steps:

[0084] S1. User registration: The user first takes a photo of the palm print and uploads it to the access control system server. The server extracts the palm print feature value and sends it to other access control controllers with control authority. Then go to the access control device with control authority to open the door for the first time, enter the last digit of the mobile phone number as prompted to complete the identity verification, and then place the hand in front of the palm vein camera for about 3 seconds to collect the palm vein feature value, upload it to the server and distribute it to other related access control controllers. At the same time, set security parameters such as dynamic passwords to complete the registration.

[0085] S2. Daily access: Before the user reaches the access control device, the palm print and palm vein unit first performs a rough screening of the palm print, performs a 1:N search, and obtains multiple palm vein feature values. The palm vein recognition module performs a 1:N precise match among these feature values. After the match is successful, the national secret CPU unit verifies the key, generates a dynamic password and matches it with the server-side information, and ensures the security of data transmission through an encrypted communication protocol. The access control actuator opens the door, and the system records the attendance information.

[0086] S3, key update: After each card swipe, the key update module generates the device's next card swipe secret based on the number of card swipes, and synchronizes it to other authorized access control devices. When checking the card, the number of card swipes and the secret are verified. If they do not exist, the card is considered illegal and the MFA password must be obtained through the supporting APP to update the secret. If the copied card cannot obtain a valid MFA password, the card cannot update the secret.

[0087] S4. Data backup: The key backup module regularly stores the key in a secure hardware security module or a dedicated key management server. When the card is lost, damaged, or the key is leaked, the key is restored in time.

[0088] S5. Exception handling: If the palm print and palm vein recognition fails multiple times or the national secret CPU unit verification is abnormal, the system prompts the user to re-operate. After multiple unsuccessful attempts, the user is restricted to re-verify within a short period of time and the administrator is notified to intervene.

[0089] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Although the present invention has been disclosed as a preferred embodiment as above, it is not used to limit the present invention. Any technical personnel in this field can make some changes or modify the technical contents disclosed above into equivalent embodiments without departing from the scope of the technical solution of the present invention. However, any brief modifications, equivalent changes and modifications made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention are still within the scope of the technical solution of the present invention.

Claims

1. A biometric access control and attendance system, characterized by: It includes a national secret CPU unit and a palm print and palm vein unit; the system calls the national secret CPU unit and the palm print and palm vein unit according to different usage scenarios; the national secret CPU unit includes a key management module, a key update module and a key backup module; the palm print and palm vein unit includes a palm print coarse screening module and a palm vein identification module, wherein, The key management module is used to establish a multi-level key architecture, wherein the multi-level key architecture includes a root key, a working key and a session key; The key update module is used for the access control device to automatically generate the Secret for the next card swipe of the device at the access control device according to the number of times the access card is swiped each time after the user swipes the card, and synchronize the Secret to other access control devices to which the user has permission; The key backup module is used to establish a reliable key backup and recovery mechanism and store the key backup in a safe place; The palm print coarse screening module is used to perform a 1:N search through the palm prints to obtain multiple palm vein feature values; The palm vein recognition module is used to perform 1:N matching of the user's palm vein feature values ​​in the above 1:N search result set.

2. The biometric access control and attendance system according to claim 1, characterized in that: The root key is used to protect the security of the working key, the working key is used for daily authentication and data encryption of the access card, and the session key is dynamically generated during each communication process.

3. The access control and attendance system based on biometrics according to claim 1, characterized in that: The key update module is used to perform the following steps: When the user checks the card next time, the device will verify the number of times the card is swiped and the corresponding Secret. If the number does not exist, the card is considered illegal and the MFA password needs to be obtained through the supporting APP to continue to update the Secret. When the copied card cannot obtain a valid MFA password, the Secret cannot be updated and the card will become unusable. When the card is swiped again and the MFA password cannot be verified, the system will automatically capture the person's portrait through the face recognition camera and upload it to the server, and send an alarm message to the property and the owner at the same time.

4. The access control and attendance system based on biometrics according to claim 1 is characterized by: The national secret CPU unit is used to introduce dynamic password authentication and encryption communication protocol. The dynamic password authentication generates a one-time dynamic password each time the access card is authenticated, and matches it with the verification information on the server. The generation of the dynamic password is based on time synchronization, event synchronization or challenge / response mechanism to prevent replay attacks and man-in-the-middle attacks; The encrypted communication protocol adopts the national secret version of the transport layer security protocol to encrypt data transmission between the access card and the card reader, the card reader and the access controller, and the access controller and the access system server.

5. The access control and attendance system based on biometrics according to claim 1 is characterized by: The usage scenarios include high-traffic fast-pass scenarios, high-security level verification scenarios, emergency handling scenarios, remote access scenarios, and temporary permission granting scenarios, among which: The high-traffic fast-pass scenario only calls the palm print and palm vein unit to authenticate and unlock the door; The high-security level verification scenario requires the simultaneous invocation of the national secret CPU unit and the palm print and palm vein unit to unlock the door; The emergency processing scenario: when the access card is lost or forgotten, or the system identifies a security risk, the palm print and palm vein unit is used first to confirm the user's identity; when key-related issues are involved, the national secret CPU unit is used to handle access key issues; In the remote access scenario, when there is a need for remote access control, the encrypted communication protocol of the national secret CPU unit is called to encrypt and transmit the remote instructions, and the palm print and palm vein unit is used to verify the identity of the actual entrants on site; In the temporary authority granting scenario, when it is necessary to grant short-term authority to temporary personnel, the system first calls the palm print and palm vein unit to collect their palm features and grants the corresponding authority range; at the same time, the national secret CPU unit is used to be responsible for data interaction and authority management during the authorization period.

6. The access control and attendance system based on biometrics according to claim 1, characterized in that: The system also uses blockchain technology to store and manage transaction records, and provides smart contract functions to achieve automated management. Specifically, blockchain technology converts user information into transaction records and stores them on the blockchain, using the blockchain's chain structure and encryption algorithm to ensure data integrity and security; smart contracts are codes on the blockchain that are used to specify the business logic and rules of the access control system, and achieve automated management of the access control system by automatically processing user verification requests.

7. A biometric access control and attendance method, characterized by: A biometric access control and attendance system according to any one of claims 1 to 6, comprising the following steps: S1. User registration: The user first takes a photo of the palm print and uploads it to the access control system server. The server extracts the palm print feature value and sends it to other access control controllers with control authority; the user goes to the access control device with control authority to open the door for the first time, enters the last digit of the mobile phone number as prompted to complete identity authentication, and then places the hand in front of the palm vein camera for about 3 seconds to collect the palm vein feature value, which is uploaded to the server and distributed to other related access control controllers; at the same time, a dynamic password is set to complete the registration; S2, daily access: before the user reaches the access control device, the palm print and palm vein unit first performs a rough screening of the palm print, performs a 1:N search, and obtains multiple palm vein feature values; the palm vein recognition module performs a 1:N precise match among the palm vein feature values; after a successful match, the national secret CPU unit verifies the key, generates a dynamic password and matches it with the server-side information, transmits data through an encrypted communication protocol, and the access control actuator opens the door; S3, key update: After each card swipe, the key update module generates the device's next card swipe secret based on the number of card swipes, and synchronizes it to other authorized access control devices; the card swipe count and secret are verified during card verification. If they do not exist, the card is considered illegal and the MFA password needs to be obtained through the supporting APP to update the secret; if the copied card cannot obtain a valid MFA password, the card cannot update the secret; S4, Data backup: The key backup module regularly stores the key to a secure hardware security module or a dedicated key management server; when the card is lost, damaged or the key is leaked, the key is restored in time; S5. Exception handling: If palm print and palm vein recognition fails multiple times or the national secret CPU unit verification is abnormal, the system prompts the user to re-operate; after multiple unsuccessful attempts, the user is restricted from re-verifying within a short period of time and the administrator is notified to intervene.

Images