Decentralized access control card anti-copying method, device and system

Abstract

The invention discloses a decentralized access control card anti-copying method, device and system, and the method comprises the steps: detecting that an access control card is swiped on access control equipment, progressively increasing the card swiping frequency of the access control card, and generating a digital signature; writing the digital signature into the access control card and broadcasting the digital signature to all access control equipment in the same network for synchronization; when any access control device collects the card swiping instruction of the access control card again, the digital signature of the access control card is extracted, legality verification is carried out in the current access control device, and a verification result is obtained; when it is judged that the verification result passes, the number of card swiping times is updated, the digital signature is updated based on the current access control equipment and the updated number of card swiping times, the updated digital signature is written into the access control card, and broadcast synchronization is carried out. The security of the access control system is enhanced, the risk of illegal invasion is reduced, meanwhile, the dependence on a centralized platform is reduced, and the reliability and efficiency of the system are improved.

Description

Technical Field

[0001] The present invention relates to the field of access control security technology, and in particular to a decentralized access control card anti-copying method, device and system. Background Art

[0002] In access control systems for smart communities and office parks, IC cards (such as M1 cards) are widely used due to their public structure and read / write content. However, due to their convenience, they are easily copied by low-cost devices, creating "cloned cards." These copied cards can be illegally used on multiple access control devices. Existing access control devices mostly only verify the card number or static key, making it difficult to identify authenticity.

[0003] Although some high-end access control systems have introduced centralized cloud verification mechanisms, such as whitelist and blacklist synchronization and permission updates, duplicate cards may still be successfully swiped on unsynchronized access control devices due to the lack of status sharing between devices, unstable networks, or dispersed device deployment.

[0004] Traditional anti-copying solutions rely primarily on encryption chips, costly security cards, or real-time verification via a centralized platform. However, these approaches have numerous limitations, including failure if the platform is disconnected, data synchronization between multiple devices, and the ability to use a duplicate card to open the door on another device. These solutions struggle to effectively address access control system security risks and fail to meet today's high security requirements. Summary of the Invention

[0005] In view of this, the purpose of the present invention is to propose a decentralized access card anti-copying method, device, system, smart community platform and computer program product, aiming to solve the problems of access cards being easily copied, status asynchrony between devices and verification dependence on a central platform in traditional access control systems, resulting in insufficient security and poor robustness.

[0006] To achieve the above objectives, the present invention provides a decentralized access card anti-copying method, the method comprising:

[0007] When the access card is detected to be swiped at the access control device, the number of swipes of the access card is incremented and a digital signature is generated;

[0008] Writing the digital signature into the access control card and broadcasting it to all access control devices in the same network for synchronization;

[0009] When any access control device collects the card swiping instruction of the access control card again, the digital signature of the access control card is extracted and the legitimacy is verified in the current access control device to obtain a verification result;

[0010] When it is determined that the verification result passes, the number of card swipes is updated, the digital signature is updated based on the current access control device and the updated number of card swipes, and the updated digital signature is written into the access control card and broadcast synchronized.

[0011] Preferably, the generation of the digital signature includes:

[0012] Constructing a signature context based on the access card number, the device number of the access control device, and the dynamic card swiping data, wherein the dynamic card swiping data includes the number of card swipes and a timestamp;

[0013] After calculating the hash value of the signature context, the device private key is used to encrypt it through the ECDSA algorithm to generate the digital signature.

[0014] Preferably, writing the digital signature into the access control card and broadcasting it to all access control devices in the same network for synchronization includes:

[0015] The digital signature is broadcast to all access control devices via the local area network using the UDP multicast protocol or the multicast protocol, and a signature record is generated at each access control device, wherein each access control device stores the signature record in a corresponding signature cache queue and adopts a first-in-first-out strategy to retain the signature records within the most recent preset time or a preset number of entries.

[0016] Preferably, extracting the digital signature of the access card and performing a validity verification in the current access control device includes:

[0017] The digital signature is searched in the signature cache queue of the current access control device to see if there is a matching signature record.

[0018] Preferably, searching for a matching signature record in a signature cache queue of a current access control device for the digital signature includes:

[0019] If there is a matching signature record and the digital signature is verified to be valid using the device public key, then determine whether the number of card swipes in the digital signature is greater than or equal to the maximum number in the signature record;

[0020] If so, the verification result indicates that the access card is a legitimate card; otherwise, the verification result indicates that the access card is a duplicate card or an illegal card.

[0021] Preferably, the method further comprises:

[0022] When the digital signatures of the same card number are detected on multiple access control devices within a preset time window, it is determined to be a double-spending attack and triggers the server platform to lock the access card.

[0023] To achieve the above objectives, the present invention further provides a decentralized access card anti-copying device, comprising:

[0024] The signature generation unit is used to detect that when the access card is swiped on the access control device, increment the number of times the access card is swiped and generate a digital signature;

[0025] A signature broadcast unit, used to write the digital signature into the access control card and broadcast it to all access control devices in the same network for synchronization;

[0026] The signature verification unit is used to extract the digital signature of the access card and perform a legitimacy verification in the current access control device when any access control device collects the card swiping instruction of the access control card again to obtain a verification result;

[0027] The signature updating unit is used to update the card swipe times when judging that the verification result is passed, update the digital signature based on the current access control device and the updated card swipe times, write the updated digital signature into the access control card and perform broadcast synchronization.

[0028] In order to achieve the above object, the present invention further provides an access control system, comprising:

[0029] Access card, used to store dynamically updated card swipe times and the most recent digital signature;

[0030] Multiple access control devices are used to receive access card swipe instructions and perform legitimacy verification, generate digital signatures and write them into the access card, and broadcast the digital signatures to all access control devices in the same local area network;

[0031] The server platform is connected to the access control device and is used to initialize the access control card, handle double-spending attack events, and resend unsynchronized digital signatures to the access control device.

[0032] In order to achieve the above-mentioned objectives, the present invention also proposes a decentralized access card anti-copying device, comprising a processor, a memory, and a computer program stored in the memory, wherein the computer program is executed by the processor to implement the steps of a decentralized access card anti-copying method as described in the above-mentioned embodiment.

[0033] In order to achieve the above-mentioned objectives, the present invention also proposes a smart community platform, including a server and an access control device, wherein the server is communicatively connected to the access control device, and the server includes a processor, a memory, and a computer program stored in the memory. The computer program is executed by the processor to implement the steps of a decentralized access card anti-copying method as described in the above embodiment.

[0034] In order to achieve the above objectives, the present invention also proposes a computer-readable storage medium, on which a computer program is stored. The computer program is executed by a processor to implement the steps of a decentralized access card anti-copying method as described in the above embodiment.

[0035] In order to achieve the above objectives, the present invention also proposes a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of a decentralized access card anti-copying method as described in the above embodiment.

[0036] Beneficial effects:

[0037] The above solution dynamically records and verifies access card swipes by decentralized synchronization of digital signatures across access control devices. Each time a card is swiped, the swipe count is updated and a digital signature is generated, ensuring the uniqueness and traceability of each swipe. A broadcast mechanism enables access control devices on the same network to synchronize swipe information in real time, enabling subsequent swipes to be authenticated and effectively preventing the use of duplicate cards. This approach enhances the security of the access control system, reduces the risk of unauthorized intrusion, and reduces reliance on centralized platforms, improving system reliability and efficiency.

[0038] By introducing the card number, card swipe times, timestamp and device number to build a signature context and using the ECDSA algorithm to encrypt and generate a digital signature, each card swipe behavior is unique and unforgeable, effectively resisting various potential attacks such as card copying, card swipe data replay, information forgery, etc., thereby improving the security and reliability of the signature.

[0039] Broadcasting using the LAN UDP multicast protocol or multicast protocol enables distributed state synchronization, ensuring efficient synchronization of digital signatures across access control devices. This allows each device to perform local signature comparison and verification even when the platform is offline or the network is unstable, ensuring a high degree of autonomy and reliability. Other access control devices that receive the broadcast will store the received signature records in a signature cache queue and use a first-in-first-out strategy to retain the most recent signature records. This helps maintain a limited and effective signature cache, facilitating quick search and verification, and improving system response speed and verification efficiency.

[0040] By searching for a matching signature record in the current access control device's signature cache, the device can complete verification locally and autonomously, eliminating the need for a remote server or centralized platform. This improves verification efficiency and system responsiveness. This local verification mechanism also enhances system robustness, ensuring that the access control device remains operational even when the network is unstable or the centralized platform is unavailable, ensuring the reliability and security of the access control system. Furthermore, by checking whether the number of card swipes is greater than or equal to the maximum number in the signature record, duplicate or illegitimate cards can be effectively identified, as the number of swipes for duplicate cards often lags behind the number of valid cards known in the system. This simple yet effective verification logic improves the security and accuracy of the access control system without compromising system performance, effectively identifying duplicate or illegitimate cards.

[0041] By detecting card swiping conflicts between multiple devices using the same card number within a short period of time, it is possible to promptly discover and determine double-spending attacks and record anomalies or trigger early warnings, thereby quickly preventing potential illegal intrusions and providing the access control system with a higher level of behavioral security prevention and control capabilities. This effectively resists attacks in which malicious users attempt to use the same access control card to gain illegal access on multiple devices within the same time period, further improving the security and reliability of the system.

[0042] This access control system creates a fully functional, secure, and reliable access control management environment through the collaborative work of access control cards, access control devices, and a server platform. Access control cards store dynamically updated card swipe times and the most recent digital signature, allowing the card itself to carry the key information required for verification. Access control devices are responsible for receiving swipe instructions, verifying their legitimacy, and generating and broadcasting digital signatures, thus achieving decentralized verification and synchronization. The server platform plays a key role in initializing access control cards, handling double-spending attacks, and reissuing unsynchronized digital signatures, ensuring overall system coordination and ultimate data consistency. This system architecture not only ensures the autonomy and efficiency of access control devices in daily operations, but also provides the necessary management and support functions through the server platform, enabling the access control system to adapt to various complex usage scenarios and meet high security requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0044] Figure 1 A flowchart of a decentralized access card anti-copying method provided by one embodiment of the present invention.

[0045] Figure 2 A schematic diagram of the overall architecture of an access control system provided by one embodiment of the present invention.

[0046] Figure 3 A schematic structural diagram of a decentralized access card anti-copying device provided by one embodiment of the present invention.

[0047] The realization of the objectives of the invention, the functional features and advantages will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the invention for which protection is sought, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0049] The present invention is described in detail below with reference to the embodiments.

[0050] Reference Figure 1 The figure is a flow chart of a decentralized access card anti-copying method provided by one embodiment of the present invention.

[0051] In this embodiment, the method is implemented based on an access control system; wherein the system includes:

[0052] Access card, used to store dynamically updated card swipe times and the most recent digital signature;

[0053] Multiple access control devices are used to receive access card swipe instructions and perform legitimacy verification, generate digital signatures and write them into the access card, and broadcast the digital signatures to all access control devices in the same local area network;

[0054] The server platform is connected to the access control device and is used to initialize the access control card, handle double-spending attack events, and resend unsynchronized digital signatures to the access control device.

[0055] Reference Figure 2As shown, the system architecture includes a server platform (referred to as the platform system in the figure), access control devices, and access cards. This architecture features decentralization, anti-copying, and traceability, making it suitable for deployments with multiple access control devices and operating in weak or disconnected network environments, ensuring the security and independence of the access control system at the edge. The platform is primarily responsible for access control card initialization, card swipe record archiving, broadcast failure compensation (by receiving data reported by access control devices and serving as a broadcast failure compensation path), and exception conflict arbitration. As the central coordinator of the entire system, the platform provides non-real-time global security functions, assisting with state synchronization and permission control between access control devices, but does not participate in the real-time signature verification process for each card swipe. Access control cards store user credentials, including the card number, current swipe count, and most recent digital signature. A signature mechanism ensures uniqueness and unforgeability. After each swipe, the digital signature and swipe count are updated by the access control device to ensure that the card information remains consistent with the most recent swipe. Access control cards are passive media, and their security is guaranteed by the system's digital signature mechanism.

[0056] Furthermore, in an actual deployment environment, the access control device may be temporarily offline due to network fluctuations, power failures, etc., resulting in the inability to receive the signature data broadcast by other access control devices in a timely manner. To ensure the ultimate consistency of digital signatures between access control devices, this embodiment designs a synchronization mechanism based on the server platform to implement broadcast failure compensation. Specifically: taking access control device A swiping the card as an example, after it generates the digital signature, it will immediately broadcast the digital signature to other access control devices via the local area network, and at the same time report the digital signature to the server platform via MQTT for archiving; if access control device B is offline at this time and fails to receive the digital signature data broadcast by access control device A, the server platform will temporarily cache the digital signature and record the reception failure status; after access control device B is back online and resumes communication with the server platform, the server platform will detect the online status of access control device B and resend the digital signature data that has not yet been synchronized to access control device B. The recorded information during the offline period is sent to access control device B, which writes it into the local cache to complete the data completion. Through the above mechanism, even if the broadcast of some access control devices is lost or temporarily offline, the access control system can still perform delayed signature synchronization through the server platform, thereby ensuring the eventual consistency of the status between access control devices and effectively avoiding the risk of duplicate cards not being recognized or verification failing due to broadcast failure.

[0057] Access control devices are key nodes in this system. Each access control device has the capabilities of card swipe verification, autonomous signature, signature broadcasting, and receiving cache. Digital signatures are broadcast and shared between access control devices through the local area network to implement a decentralized anti-copying mechanism. Each card swipe is verified locally on the access control device, and the access control device independently makes an open / reject decision. Access control devices have complete card swipe verification, autonomous signature, broadcasting, and caching capabilities. Access control devices include a broadcast module, which serves as a communication bridge between access control devices. It uses the UDP multicast protocol or multicast protocol of the local area network to achieve real-time transmission of card swipe signatures among multiple access control devices. This mechanism is one of the core components of the system, allowing access control devices to share verification information without going through a platform, achieving highly autonomous verification capabilities. Furthermore, each access control device has modules such as a card writing module, a signature generator, a signature broadcast module, a signature receiver, a signature cache queue, and a signature verifier. Access control devices differ only in their roles at runtime. For example, during a card swipe operation, one access control device acts as the initiator, responsible for signature generation and broadcasting; other access control devices act as broadcast receivers, responsible for signature reception and caching. All access control devices are structurally fully capable and can dynamically participate in the card swipe or monitoring process, enabling distributed autonomy and collaborative anti-duplication capabilities among access control devices.

[0058] Reference Figure 1 As shown, the method includes:

[0059] S11, when it is detected that the access card is swiped on the access control device, the number of times the access card is swiped is incremented and a digital signature is generated.

[0060] The generation of the digital signature includes:

[0061] Constructing a signature context based on the access card number, the device number of the access control device, and the dynamic card swiping data, wherein the dynamic card swiping data includes the number of card swipes and a timestamp;

[0062] After calculating the hash value of the signature context, it is encrypted using the device private key through the ECDSA algorithm to generate the digital signature.

[0063] In this embodiment, the method is applicable to access control management scenarios with multiple access control devices and distributed deployments, such as smart communities, office parks, enterprises, and government agencies, and has broad application value and promotion prospects. When a user swipes an access control card, the access control device constructs a signature context based on the current access control card number (CardID), the access control device's device number (CardID), the number of card swipes (Counter), and the timestamp (Timestamp). The signature context is constructed by constructing a plaintext payload: Payload = CardID || Counter || Timestamp || DeviceID. After calculating the hash value, the device's private key is used to generate a digital signature using the ECDSA algorithm: Signature = Sign(SK_Device, Hash(Payload)). The signature result, along with the number of card swipes, is written to the access control card and broadcasted simultaneously. That is, after a successful card swipe, the card swipe count = Counter + 1 and the digital signature = Signature are written to the card. Based on this digital signature, the current card swipe action is uniquely bound to "timestamp + number of card swipes + device ID," making it unforgeable and irreversible.

[0064] in,

[0065] Card number (CardID): The unique identifier of the access control card, used to distinguish different users or credentials, which is the fundamental basis for identifying the signature owner;

[0066] Card swipe count (Counter): The current card swipe count, which is used to record the number of times the current card has been used, plays a role in preventing rollback and duplication. If the number of swipes of a duplicate card is less than the known number (maximum number) in the system, it will be identified as an abnormal card.

[0067] Timestamp: The current time of the access control device, accurate to the second. This field is used to accurately record the time of each card swipe. The introduction of the timestamp has two purposes: first, to ensure the time uniqueness of the digital signature and prevent replay attacks; second, to support the platform or access control device to determine "double spending behavior", that is, to determine whether the same card number has been swiped on two access control devices within a short period of time;

[0068] Device ID: The unique ID of the card swiping device. This field identifies which access control device generated the digital signature. In the broadcast synchronization mechanism, different access control devices may generate multiple digital signatures, and the source of the digital signature must be retained each time. The Device ID can be used to verify whether the signature comes from a trusted access control device during verification and support subsequent traceability.

[0069] Private key (SK_Device): Asymmetric encryption private key stored locally on the device; digital signatures are performed using the device private key and cannot be forged from outside; this ensures that the system still has local anti-counterfeiting capabilities even when the network is unstable or the platform is unavailable, significantly improving the security and anti-attack capabilities of the access control system.

[0070] S12, writing the digital signature into the access control card and broadcasting it to all access control devices in the same network for synchronization.

[0071] Furthermore, in step S12, the digital signature is written into the access card and broadcast to all access control devices in the same network for synchronization, including:

[0072] The digital signature is broadcast to all access control devices via the local area network using the UDP multicast protocol or the multicast protocol, and a signature record is generated at each access control device, wherein each access control device stores the signature record in a corresponding signature cache queue and adopts a first-in-first-out strategy to retain the signature records within the most recent preset time or a preset number of entries.

[0073] In this embodiment, after the current access control device completes writing the digital signature, it broadcasts the digital signature information to all access control devices on the same network via the UDP multicast protocol or multicast protocol. The other access control devices that receive the broadcast then generate a signature record and store it in the signature cache queue. The broadcast content includes the digital signature, card number, card swipe count, timestamp, and device ID. This broadcast uses a non-response push method, which does not require a response from the recipient, improving broadcast efficiency and system performance.

[0074] S13, when any access control device collects the card swiping instruction of the access control card again, extracts the digital signature of the access control card and performs a validity verification in the current access control device to obtain a verification result.

[0075] Furthermore, in step S13, extracting the digital signature of the access card and performing a validity verification in the current access control device includes:

[0076] The digital signature is searched in the signature cache queue of the current access control device to see if there is a matching signature record.

[0077] Furthermore, searching for a matching signature record in a signature cache queue of a current access control device for the digital signature includes:

[0078] If there is a matching signature record and the digital signature is verified to be valid using the device public key, then determine whether the number of card swipes in the digital signature is greater than or equal to the maximum number in the signature record;

[0079] If so, the verification result indicates that the access card is a legitimate card; otherwise, the verification result indicates that the access card is a duplicate card or an illegal card.

[0080] S14, when it is determined that the verification result passes, the card swipe times are updated, the digital signature is updated based on the current access control device and the updated card swipe times, and the updated digital signature is written into the access control card and broadcast synchronized.

[0081] In this embodiment, after receiving the broadcast, other access control devices cache the digital signature (i.e., each access control device has a built-in signature receiving module (signature receiver) that continuously monitors the LAN broadcast port. When another access control device completes a card swipe operation and broadcasts the digital signature, the access control device can receive and cache the digital signature in real time). By parsing the digital signature packet and performing verification, it can be used to subsequently verify the legitimacy of the card and detect card duplication. Each access control device maintains a recent signature cache queue, using a preset time window caching strategy (e.g., caching the last 5 minutes or 500 digital signatures) and retaining signature records in a FIFO (first-in-first-out) manner. The cached content may include the original digital signature (i.e., the plaintext payload before signing, such as the card number, card swipe count, timestamp, and device ID), the signature result value (i.e., the digital signature itself, encrypted data signed by the device's private key), the signature timestamp, the corresponding card number, the original device ID, etc. The cached data structure is Map<card number, List<signature record>> to support multiple signature caching and fast retrieval for the same card. The signature result value refers to the encrypted output value (such as the ECDSA signature result) generated after the device uses the private key to sign the Payload constructed by a specific card swiping behavior, which is used in the subsequent signature verification logic.

[0082] When an access control device reads the same access card again, it extracts the digital signature from the card and searches its local cache for a record of the signature. Specifically, it parses the card content, extracting fields such as the card number, swipe count, timestamp, and digital signature. It calculates the plaintext payload corresponding to the digital signature and verifies it using the corresponding device public key from the broadcast record. It then determines whether the digital signature exists in the device's signature cache and whether the signature is valid by comparing the swipe count in the digital signature to see if it is greater than or equal to the maximum number of swipes previously recorded locally. If the digital signature verification passes and the swipe count is valid, the card is deemed legitimate and the door is allowed to open. If there is no matching digital signature or the time or count corresponding to the signature is out of date, the card is deemed a duplicate or old card, and the door is denied and reported to the platform. This enables the identification and real-time blocking of duplicate cards in a multi-access control device environment, effectively enhancing the security and anti-attack capabilities of the access control system. This ensures that all access control devices can independently complete signature verification and duplicate card identification based on the broadcast cache, even when offline, with a weak network connection, or when the platform is unavailable, effectively improving the system's anti-counterfeiting capabilities and autonomous security.

[0083] Furthermore, the method further comprises:

[0084] S15: When the digital signatures generated by the same card number on multiple access control devices are detected within a preset time window, it is determined to be a double-spending attack event and the server platform is triggered to lock the access card.

[0085] In this embodiment, the system can also support a double-spending (an attack behavior in which the same access control card is used on different access control devices at approximately the same time) detection mechanism. That is, if digital signatures of the same card number but from multiple different access control devices are detected within a short period of time, the platform can mark the card swiping behavior as a "double-spending attack" by combining the timestamp and the device ID, thereby triggering a card lock, early warning, or audit mechanism.

[0086] Reference Figure 3 FIG2 is a schematic structural diagram of a decentralized access card anti-copying device provided by an embodiment of the present invention.

[0087] In this embodiment, the device 20 includes:

[0088] The signature generation unit 21 is used to detect that when the access card is swiped at the access control device, increment the number of times the access card is swiped and generate a digital signature;

[0089] The signature broadcast unit 22 is used to write the digital signature into the access control card and broadcast it to all access control devices in the same network for synchronization;

[0090] The signature verification unit 23 is used to extract the digital signature of the access card and perform a legitimacy verification in the current access control device when any access control device collects the card swipe instruction of the access control card again to obtain a verification result;

[0091] The signature updating unit 24 is used to update the card swipe times when judging that the verification result is passed, update the digital signature based on the current access control device and the updated card swipe times, write the updated digital signature into the access control card and perform broadcast synchronization.

[0092] In another embodiment, the apparatus 20 further comprises:

[0093] The double-spending detection unit is used to detect the digital signatures of the same card number generated by multiple access control devices within a preset time window, determine it as a double-spending attack event and trigger the server platform to lock the access control card.

[0094] Each unit module of the device 20 can respectively execute the corresponding steps in the above method embodiment, so each unit module will not be described in detail here. Please refer to the description of the corresponding steps above for details.

[0095] The embodiment of the present invention further provides a decentralized access card anti-copying device, which includes the decentralized access card anti-copying device as described above, wherein the decentralized access card anti-copying device can be used Figure 3 The structure of the embodiment can be executed accordingly. Figure 1 The technical solution of the method embodiment shown has similar implementation principles and technical effects. For details, please refer to the relevant records in the above embodiments and will not be repeated here.

[0096] The device includes: a mobile phone, digital camera, tablet computer, or other device with a camera function, or a device with an image processing function, or a device with an image display function. The device may include components such as a memory, a processor, an input unit, a display unit, and a power supply.

[0097] Among them, the memory can be used to store software programs and modules, and the processor executes various functional applications and data processing by running the software programs and modules stored in the memory. The memory may mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as an image playback function, etc.), etc.; the data storage area can store data created according to the use of the device, etc. In addition, the memory may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage device. Accordingly, the memory may also include a memory controller to provide the processor and the input unit with access to the memory.

[0098] The input unit can be used to receive input digital, character, or image information, and generate keyboard, mouse, joystick, optical, or trackball signal input related to user settings and function control. Specifically, the input unit of this embodiment includes not only a camera, but also a touch-sensitive surface (such as a touch display) and other input devices.

[0099] The display unit can be used to display information input by the user or information provided to the user and various graphical user interfaces of the device, which can be composed of graphics, text, icons, videos and any combination thereof. The display unit may include a display panel. Optionally, the display panel can be configured in the form of an LCD (Liquid Crystal Display), an OLED (Organic Light-Emitting Diode), etc. Furthermore, the touch-sensitive surface can cover the display panel. When the touch-sensitive surface detects a touch operation on or near it, it is transmitted to the processor to determine the type of touch event. The processor then provides a corresponding visual output on the display panel based on the type of touch event.

[0100] The embodiment of the present invention further provides a computer-readable storage medium, which may be a computer-readable storage medium included in the memory in the above embodiment; or a computer-readable storage medium that exists independently and is not assembled into a device. The computer-readable storage medium stores at least one instruction, which is loaded and executed by a processor to implement Figure 1 The decentralized access card anti-copying method shown in the figure. The computer-readable storage medium can be a read-only memory, a disk or an optical disk, etc.

[0101] The embodiment of the present invention also provides a smart community platform, including a server and an access control device, wherein the server is in communication with the access control device, the server includes a processor, a memory, and a computer program stored in the memory, and the computer program is loaded and executed by the processor to implement Figure 1 A decentralized access card anti-copying method is shown.

[0102] The embodiment of the present invention further provides a computer program product, including a computer program / instruction, which is loaded and executed by a processor to implement Figure 1 A decentralized access card anti-copying method is shown.

[0103] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. For similar or identical parts between the various embodiments, reference can be made to each other. For the apparatus embodiments, device embodiments, and storage medium embodiments, since they are generally similar to the method embodiments, their descriptions are relatively simple. For relevant parts, reference can be made to the descriptions of the method embodiments.

[0104] Furthermore, in this document, the terms "comprises," "comprising," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not preclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0105] While the foregoing description shows and describes preferred embodiments of the present invention, it should be understood that the present invention is not limited to the forms disclosed herein and should not be construed as excluding other embodiments. Rather, the present invention can be used in various other combinations, modifications, and environments, and can be modified within the scope of the present invention by the teachings herein or by techniques or knowledge in the relevant art. Modifications and variations made by those skilled in the art without departing from the spirit and scope of the present invention are intended to be within the scope of the appended claims.

Claims

1. A decentralized access card anti-copying method, characterized in that: The method comprises: When the access card is detected to be swiped at the access control device, the number of swipes of the access card is incremented and a digital signature is generated; Writing the digital signature into the access control card and broadcasting it to all access control devices in the same network for synchronization; When any access control device collects the card swiping instruction of the access control card again, the digital signature of the access control card is extracted and the legitimacy is verified in the current access control device to obtain a verification result; When it is determined that the verification result passes, the number of card swipes is updated, the digital signature is updated based on the current access control device and the updated number of card swipes, and the updated digital signature is written into the access control card and broadcast synchronized.

2. A decentralized access card anti-copying method according to claim 1, characterized in that: The generation of the digital signature includes: Constructing a signature context based on the access card number, the device number of the access control device, and the dynamic card swiping data, wherein the dynamic card swiping data includes the number of card swipes and a timestamp; After calculating the hash value of the signature context, it is encrypted using the device private key through the ECDSA algorithm to generate the digital signature.

3. A decentralized access card anti-copying method according to claim 1, characterized in that: Writing the digital signature into the access control card and broadcasting it to all access control devices in the same network for synchronization includes: The digital signature is broadcast to all access control devices via the local area network using the UDP multicast protocol or the multicast protocol, and a signature record is generated at each access control device, wherein each access control device stores the signature record in a corresponding signature cache queue and adopts a first-in-first-out strategy to retain the signature records within the most recent preset time or a preset number of entries.

4. A decentralized access card anti-copying method according to claim 1, characterized in that: Extracting the digital signature of the access card and performing a validity verification in the current access control device includes: The digital signature is searched in the signature cache queue of the current access control device to see if there is a matching signature record.

5. A decentralized access card anti-copying method according to claim 4, characterized in that: The step of searching for a matching signature record in a signature cache queue of a current access control device includes: If there is a matching signature record and the digital signature is verified to be valid using the device public key, then determine whether the number of card swipes in the digital signature is greater than or equal to the maximum number in the signature record; If so, the verification result indicates that the access card is a legitimate card; otherwise, the verification result indicates that the access card is a duplicate card or an illegal card.

6. A decentralized access card anti-copying method according to claim 1, characterized in that: The method further comprises: When the digital signatures of the same card number are detected on multiple access control devices within a preset time window, it is determined to be a double-spending attack and triggers the server platform to lock the access card.

7. A decentralized access card anti-copying device, characterized in that: The device comprises: The signature generation unit is used to detect that when the access card is swiped on the access control device, increment the number of times the access card is swiped and generate a digital signature; A signature broadcast unit, used to write the digital signature into the access control card and broadcast it to all access control devices in the same network for synchronization; The signature verification unit is used to extract the digital signature of the access card and perform a legitimacy verification in the current access control device when any access control device collects the card swiping instruction of the access control card again to obtain a verification result; The signature updating unit is used to update the card swipe times when judging that the verification result is passed, update the digital signature based on the current access control device and the updated card swipe times, write the updated digital signature into the access control card and perform broadcast synchronization.

8. An access control system, characterized in that: The system comprises: Access card, used to store dynamically updated card swipe times and the most recent digital signature; Multiple access control devices are used to receive access card swipe instructions and perform legitimacy verification, generate digital signatures and write them into the access card, and broadcast the digital signatures to all access control devices in the same local area network; The server platform is connected to the access control device and is used to initialize the access control card, handle double-spending attack events, and resend unsynchronized digital signatures to the access control device.

9. A smart community platform, characterized by: It includes a server and an access control device, the server is communicatively connected to the access control device, the server includes a processor, a memory and a computer program stored in the memory, and the computer program is executed by the processor to implement the steps of a decentralized access control card anti-copying method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that The method comprises a computer program / instruction, which, when executed by a processor, implements the steps of a decentralized access card anti-copying method as described in any one of claims 1 to 6.

Images