NFC label data protection method and system

Abstract

The invention relates to the technical field of data security processing, in particular to an NFC tag data protection method and system, and the method comprises the steps: obtaining storage data and historical access data of each sector in NFC tag data; dividing all sectors to obtain each global sector set according to the relevance between accessed information in the historical access data of each sector and the historical access data of other sectors and the distribution condition of the accessed information at the same time; sorting all sectors in each global sector set according to the distribution condition and complexity of service data in accessed data of each sector in each global sector set to obtain a cascade encryption path corresponding to each global sector set; and according to the encryption result of the service data and the key data of each sector, updating the key data of the next sector in each cascade encryption path to obtain a protection scheme of the NFC tag data. According to the method, the key is dynamically updated along with content change, and the tampering resistance of the authentication process is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data security processing, and in particular to a method and system for protecting NFC tag data. Background Art

[0002] NFC tags, with their contactless communication, low power consumption, and easy deployment, have become a crucial component in building lightweight data exchange systems. At the application level, an increasing number of systems are using NFC tags as user identifiers, device status indicators, or key data carriers. Their value in industrial automation, retail management, and as personal information carriers is becoming increasingly prominent. As the breadth and depth of their applications continue to expand, the refined management and intelligent processing of data stored in NFC tags has become a key focus of the industry.

[0003] Existing NFC tag data protection methods mostly use a static key mechanism, setting fixed access control parameters for each sector. Once the key of a sector is cracked, an attacker may infer the structure of other sectors, resulting in insufficient overall tag security. Summary of the Invention

[0004] In order to solve the technical problem that the existing tag data protection method uses a static key mechanism with insufficient security, the purpose of the present invention is to provide an NFC tag data protection method and system. The technical solution adopted is as follows: In a first aspect, the present invention provides an NFC tag data protection method, comprising: Obtaining storage data of each sector in the NFC tag data, as well as historical access data of each sector; wherein the storage data includes business data and key data; Based on the correlation between the historical access data of each sector and the accessed information in the historical access data of other sectors and the distribution of the information accessed simultaneously, all sectors are divided to obtain each global sector set; According to the distribution and complexity of the business data in the accessed data of each sector in each global sector set, all sectors in each global sector set are sorted to obtain the cascade encryption path corresponding to each global sector set; According to the encryption results of the business data and key data of each sector, the key data of the next sector in each cascade encryption path is updated to obtain a protection scheme for NFC tag data.

[0005] Preferably, the method of dividing all sectors according to the correlation between the historical access data of each sector and the accessed information in the historical access data of other sectors and the distribution of the information accessed simultaneously to obtain each global sector set specifically includes: The historical access data includes the number of times a sector is accessed and the number of times different sectors are accessed simultaneously; According to the number of times each sector is accessed and the number of times each sector and other sectors are accessed simultaneously, the authentication correlation index between each two different sectors is obtained; Dividing all sectors according to the authentication association index to obtain each initial sector set and undivided sectors; According to the correlation of historical access data between the unpartitioned sectors and each sector in each initial sector set, combined with the proportion of the number of times each sector is accessed, the unpartitioned sectors are divided to obtain a global sector set.

[0006] Preferably, obtaining the authentication association index between each two different sectors based on the number of times each sector is accessed and the number of times each sector and other sectors are accessed simultaneously specifically includes: Take any two different sectors as the first sector and the second sector respectively; The ratio between the number of times the first sector and the second sector are accessed simultaneously and the number of times the first sector is accessed is used as the relative dependence of the second sector on the first sector; The average of the relative dependence degree of the second sector on the first sector and the relative dependence degree of the first sector on the second sector is used as the authentication association index between the first sector and the second sector.

[0007] Preferably, dividing all sectors according to the authentication association index to obtain each initial sector set and undivided sectors specifically includes: Two different sectors corresponding to authentication association indicators greater than or equal to a preset association threshold are divided into the same initial sector set, and sectors that do not belong to any initial sector set are undivided sectors.

[0008] Preferably, the undivided sectors are divided according to the correlation of historical access data between the undivided sectors and each sector in each initial sector set, combined with the proportion of the number of times each sector is accessed, to obtain the global sector set, specifically including: Any sector in the initial sector set is used as the third sector, and any undivided sector is used as the fourth sector; The ratio of the number of times the third sector is accessed to the cumulative sum of the number of times the third sector is accessed and the number of times the fourth sector is accessed is used as the weight corresponding to the relative dependence of the third sector on the fourth sector; The ratio of the number of times the fourth sector is accessed to the cumulative sum of the number of times the third and fourth sectors are accessed is used as the weight corresponding to the relative dependence of the fourth sector on the third sector; Using the weight proportions, the relative dependence of the third sector on the fourth sector and the relative dependence of the fourth sector on the three sectors are weighted and summed to obtain the modified correlation index between the third and fourth sectors; For all undivided sectors, two sectors corresponding to the modified correlation index being greater than or equal to a preset correlation threshold are divided into the same set to obtain a global sector set.

[0009] Preferably, the process of sorting all sectors in each global sector set according to the distribution and complexity of service data in the accessed data of each sector in each global sector set to obtain the cascade encryption path corresponding to each global sector set specifically includes: Obtaining the data complexity of each sector in each global sector set according to the data volume and complexity of non-null data contained in the service data in the accessed data of each sector in each global sector set; All sectors in each global sector set are arranged in descending order of data complexity to obtain the cascade encryption path corresponding to the global sector set.

[0010] Preferably, obtaining the data complexity of each sector in each global sector set according to the amount and complexity of non-null data contained in the service data in the accessed data of each sector in each global sector set specifically includes: For any sector in any global sector set, the number of bytes of non-null data in the service data of the sector accessed each time is obtained as the first characteristic coefficient of each access of the sector; the information entropy of the non-null data in the service data of the sector accessed each time is used as the second characteristic coefficient of each access of the sector; The average value of the product of the first characteristic coefficient and the second characteristic coefficient of the sector accessed each time is used as the data complexity of the arbitrary sector.

[0011] Preferably, the key data includes a read permission verification key and a write permission verification key.

[0012] Preferably, the key data of the next sector in each cascade encryption path is updated according to the business data and key data of each sector to obtain a protection scheme for NFC tag data, which specifically includes: For any cascade encryption path, the concatenated data between the business data of each sector and each key is encrypted separately to obtain the encrypted data corresponding to each key. The read permission verification key of the next sector adjacent to each sector is determined based on the encrypted data of the read permission verification key. The write permission verification key of the next sector adjacent to each sector is determined based on the encrypted data of the write permission verification key to obtain the encryption scheme of the NFC tag data.

[0013] In a second aspect, the present invention provides an NFC tag data protection system, which is used to implement the steps of an NFC tag data protection method. The NFC tag data protection system specifically includes: A data acquisition module is used to acquire the storage data of each sector in the NFC tag data, as well as the historical access data of each sector; wherein the storage data includes business data and key data; A sector partitioning module is used to partition all sectors according to the correlation between the historical access data of each sector and the accessed information in the historical access data of other sectors and the distribution of the information accessed simultaneously, so as to obtain each global sector set; A path analysis module is used to sort all sectors in each global sector set according to the distribution and complexity of the business data in the accessed data of each sector in each global sector set, and obtain the cascade encryption path corresponding to each global sector set; The security encryption module is used to update the key data of the next sector in each cascade encryption path according to the encryption results of the business data and key data of each sector, so as to obtain the protection scheme of the NFC tag data.

[0014] The embodiments of the present invention have at least the following beneficial effects: The present invention divides and reorders sectors in NFC tags by introducing historical access data, which can dynamically identify high-frequency sensitive data and prioritize protection, thereby achieving more reasonable data organization and security priority control. Combined with the cascade encryption mechanism, a key dependency chain is constructed between sectors, effectively preventing attackers from obtaining the entire data by cracking a single sector. A derivation strategy based on data content and key is used to generate the key for the next sector, so that the key is dynamically updated as the content changes, further improving the system's tamper resistance. It has high security, good scalability, and versatility suitable for a variety of NFC application scenarios, effectively improving the security protection level of NFC tags in areas such as identity authentication, access control, and data storage. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions and advantages of the embodiments of the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0016] Figure 1 This is a flowchart of the steps of an NFC tag data protection method provided by the present invention; Figure 2 This is a schematic diagram of sector data storage provided by the present invention; Figure 3 is a flowchart of the steps of the method for obtaining a global sector set provided by the present invention; Figure 4 This is a flowchart of the steps of the method for obtaining the cascade encryption path provided by the present invention; Figure 5 This is a structural diagram of an NFC tag data protection system provided by the present invention. DETAILED DESCRIPTION

[0017] To further illustrate the technical means and effectiveness of the present invention to achieve its intended purpose, the following, in conjunction with the accompanying drawings and preferred embodiments, describes in detail the specific implementation, structure, features, and effectiveness of an NFC tag data protection method and system proposed in accordance with the present invention. In the following description, different references to "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics of one or more embodiments may be combined in any suitable manner.

[0018] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0019] The following describes in detail a method and system for protecting NFC tag data provided by the present invention with reference to the accompanying drawings.

[0020] See also Figure 1 , which shows a flowchart of a method for protecting NFC tag data provided by an embodiment of the present invention, the method comprising the following steps: Step S100: acquiring storage data of each sector of the NFC tag and historical access data of each sector; wherein the storage data includes business data and key data.

[0021] In practical applications, NFC tags are usually bound to system platforms, such as access control systems, mobile ticketing systems, or warehousing and logistics systems. These systems have complete background communication recording capabilities and can automatically record data such as the sector number, operation time, and read and write behavior of each access when a card reading operation occurs.

[0022] In this embodiment, using an NFC tag as an example, historical data from the NFC tag is obtained. This data includes, but is not limited to, the number of accesses to each sector, access timestamps, access instruction type (read / write), and access device identification information. Historical data can be collected and extracted through communication logs recorded by the card reader, interaction records in a backend database, or intelligent NFC tag chips with recording capabilities. Upon completing a tag read operation, the system records access behavior in real time. In other embodiments, access behavior models can be constructed over multiple interactions to provide a data foundation for subsequent sector sensitivity classification and cascade encryption strategies.

[0023] It should be noted that the sector division of NFC tags is a well-known technology and is only briefly introduced here. Specifically, common NFC cards based on Mifare Classic technology, such as the M1 card, have 16 sectors. Each sector consists of 4 blocks, each with 16 bytes. The first three blocks of a sector are used to store service data, and the fourth block is used to store keys for read and write permission management. For example, Figure 2 As shown, a block includes block 0, block 1, block 2 and block 3. Block 0, block 1 and block 2 are used to store business data, such as manufacturer information, etc. Block 3 includes key A, access control information, backup information and key B.

[0024] In actual applications, for the convenience of deployment and maintenance, there are usually the following key configuration strategies for the keys corresponding to different sectors: bus cards, access control cards, etc., all sectors use the same key, which is easy to manage and has low deployment costs. Once the key is leaked, all cards will become invalid; membership cards, campus cards, and the first few sectors use a unified key, and the subsequent sectors use different keys. Data is classified and properly isolated, but there is still a risk of high-sensitivity sectors being accessed by force; high-security systems, each sector is independently configured with key A and key B, which has strong security and can be fine-grained for authorization. However, the operation and maintenance are complex, and the key database is prone to loss of control.

[0025] Under the traditional key configuration strategy, the more dispersed the keys are, the better the security is, but the more complicated the key management and authentication process becomes, and the lower the card reading efficiency is. Conversely, it will lead to weak security. Therefore, based on the traditional key configuration, the encryption strategy is dynamically determined through the historical access behavior of the NFC tag to ensure that the security of the NFC card is improved without increasing the number of keys required to store in the system too much.

[0026] At this point, the stored data of each sector of the NFC tag can be obtained. In this embodiment, the data in the first three blocks of each sector is collectively referred to as business data. That is, the stored data of each sector includes the business data of the first three blocks and the key data of the fourth block. The key data includes the read permission verification key (Key A, also known as KeyA) and the write permission verification key (Key B, also known as KeyB). At the same time, the historical access data of each sector includes the number of times the corresponding sector has been accessed and the number of times different sectors have been accessed simultaneously.

[0027] It should be understood that historical access data for each sector can be directly obtained from the NFC tag's historical data. For example, if sectors 0 and 1 are accessed simultaneously during an access operation, the number of times these two sectors were accessed simultaneously is recorded, providing a data basis for subsequent analysis of data associations between different sectors. It should be noted that implementers can also set the access operation data collection time period based on specific implementation scenarios, for example, obtaining access operation data for all sectors within a month.

[0028] Step S200 : dividing all sectors according to the correlation between the historical access data of each sector and the accessed information in the historical access data of other sectors and the distribution of the information accessed simultaneously to obtain each global sector set.

[0029] Considering that the data stored in some sectors of an NFC card is relatively similar, for example, in enterprise access control NFC cards, sector 0 is used to store the UID (unique identifier) ​​and manufacturer information, sector 1 is used to store employee IDs, sector 2 is used to store department numbers, and sectors 3 to 15 are reserved for access records, data signature information, and other expansion areas. Based on this, in order to avoid the security issues of the same key for all cards or fixed partition keys, differentiated sector division can be used to provide a precise basis for subsequent encryption strategies.

[0030] Specifically, the value of data stored in different sectors varies significantly, and the access frequency and connectivity of data stored in different sectors also show certain differences and similarities. By categorizing all sectors based on the correlation between sector data, sectors with high sensitivity, frequent access, and strong connectivity can be grouped together, concentrating resources on strengthening protection. Meanwhile, sectors with low sensitivity and low access frequency can be grouped together, streamlining protection strategies to balance security and efficiency.

[0031] As a specific example, Figure 3 As shown, the method for obtaining the global sector set can be implemented by steps S201 to S203.

[0032] Step S201: Obtain an authentication association index between every two different sectors based on the number of times each sector is accessed and the number of times each sector and other sectors are accessed simultaneously.

[0033] During multiple accesses to the historical data of NFC tags, we first analyze the similarity of the access frequencies of different sectors. Secondly, we analyze the frequency of simultaneous accesses of two different sectors, and comprehensively evaluate the association between two different sectors in the NFC tag.

[0034] Specifically, any two different sectors in an NFC tag are taken as an example for description, and the any two different sectors are respectively referred to as a first sector and a second sector.

[0035] In the first step, the ratio of the number of times the first sector and the second sector are accessed simultaneously to the number of times the first sector is accessed is used as the relative dependence of the second sector on the first sector.

[0036] As a specific example, let sector a be the first sector and sector b be the second sector. The relative dependence of sector b on sector a, that is, the relative dependence of the second sector on the first sector, can be expressed as: ,in Indicates the relative dependence of the second sector on the first sector, a represents sector a, and b represents sector b; Indicates the number of times sector b and sector a are accessed simultaneously in all access records. Indicates the number of times sector a is accessed in all access records.

[0037] When the ratio The larger the value is and the closer it is to 1, it means that sector b is accessed almost every time sector a is accessed, which means that sector b is highly dependent on sector a. The smaller the value, the closer it is to 0, it means that sector b is rarely accessed when sector a is accessed, which further indicates that sector b is less dependent on sector a.

[0038] The relative dependence of sector b on sector a reflects the probability of accessing sector b when accessing sector a, that is, the probability of conditional dependence of sector b on sector a, which can objectively reflect the dependence strength between sectors a and b.

[0039] At this point, the relative dependence of each sector on other sectors can be obtained using the same method.

[0040] In the second step, the average of the relative dependence of the second sector on the first sector and the relative dependence of the first sector on the second sector is used as the authentication association index between the first sector and the second sector.

[0041] For two different sectors, the analysis objects are different, and there are two calculation results of relative dependence. Specifically, the number of times the first sector and the second sector are accessed at the same time and the number of times the second sector is accessed are calculated. The ratio between , the relative dependence of the first sector on the second sector can be obtained.

[0042] The relative dependence of the second sector on the first sector reflects the probability of accessing the second sector when accessing the first sector. The relative dependence of the first sector on the second sector reflects the probability of accessing the first sector when accessing the second sector. When quantifying the access association relationship between the first sector and the second sector, it is necessary to comprehensively evaluate the relative dependence strength analysis results of these two aspects.

[0043] Thus, the authentication association index between the first sector and the second sector represents the synchronization and association of the access operations between the first sector and the second sector.

[0044] Step S202: Divide all sectors according to the authentication association index to obtain each initial sector set and undivided sectors.

[0045] The larger the value of the authentication association index between the first sector and the second sector, the more synchronized the access operations between the first sector and the second sector are and the greater the correlation is. At this time, classifying the two sectors into the same category for cascade encryption can avoid multiple key authentication operations during the same access process.

[0046] Specifically, two different sectors corresponding to authentication association indicators greater than or equal to a preset association threshold are divided into the same initial sector set, and sectors that do not belong to any initial sector set are undivided sectors.

[0047] In this embodiment, the correlation threshold is set to 0.9, and the implementer can set it according to the specific implementation scenario.

[0048] When the authentication association index between the first sector and the second sector is greater than or equal to the association threshold, it means that the access operation information of the first sector and the second sector is highly correlated, and it is better to classify them into the same category for unified management. Therefore, the first sector and the second sector are divided into the same initial sector set.

[0049] When the authentication correlation index between the first and second sectors is less than the correlation threshold, the access operation information of the two sectors is less correlated and does not need to be classified into the same category for unified management. If the authentication correlation index between the first sector and all other sectors is less than the correlation threshold, it means that there are no other sectors with a strong correlation with the first sector. The first sector will be treated as an unclassified sector for further feature analysis.

[0050] Step S203 : Based on the correlation of historical access data between the undivided sectors and each sector in each initial sector set and the proportion of access times of each sector, the undivided sectors are divided to obtain a global sector set.

[0051] For undivided sectors, if the access frequency of an undivided sector is too low, then in the subsequent authentication process, the number of times the undivided sector is accessed will be much smaller than the number of times other sectors are accessed, which will lead to an extremely small value for the relative degree of dependence on a single aspect. As a result, the value of the authentication correlation index after the undivided sector and other sectors are combined will be extremely small, resulting in the isolation of the undivided sector.

[0052] Furthermore, in order to eliminate the interference of the self-access information of the undivided sector, the proportion of the self-access information of the undivided sector and the proportion of the self-access information of other sectors are added to perform a secondary division operation on the undivided sector.

[0053] Specifically, any unpartitioned sector and any other different sector are taken as examples for description. Specifically, any sector in the initial sector set is used as the third sector, and any unpartitioned sector is used as the fourth sector.

[0054] In the first step, the ratio of the number of times the third sector is accessed to the cumulative sum of the number of times the third sector is accessed and the fourth sector is accessed is used as the weight corresponding to the relative dependence of the third sector on the fourth sector. As a specific example, in this embodiment, sector c is used as the third sector and sector r is used as the fourth sector. The relative dependence of the third sector on the fourth sector is expressed as follows: , where r represents sector r and c represents sector c; Indicates the number of times sector c is accessed in all access records. Indicates the number of times sector r is accessed in all access records.

[0055] The larger the weight value is, the greater the proportion is, indicating that when analyzing the correlation relationship between two different sectors, the third sector's own access information accounts for a larger proportion, and the actual correlation relationship is amplified by the relative dependence of the third sector on the fourth sector. That is, the data analysis result in terms of the relative dependence of the third sector on the fourth sector should be larger.

[0056] Step 2: The ratio of the number of visits to the fourth sector to the cumulative sum of the number of visits to the third and fourth sectors is used as the weight corresponding to the relative dependence of the fourth sector on the third sector. As a specific example, the relative dependence of the fourth sector on the third sector can be expressed as , where r represents sector r, i.e., the unpartitioned sector, and c represents sector c; Indicates the number of times sector c is accessed in all access records. Indicates the number of times sector r is accessed in all access records.

[0057] The smaller the weight value is, the smaller the proportion of the fourth sector's own access information is when analyzing the correlation relationship between two different sectors. At this time, the analysis result of the relative dependence on the small proportion of access information should be weakened to avoid the influence of the correlation analysis result on the small proportion of self-access information.

[0058] In the third step, using the weight ratio, the relative dependence of the third sector on the fourth sector and the relative dependence of the fourth sector on the three sectors are weighted and summed to obtain the modified correlation index between the third sector and the fourth sector.

[0059] As a specific example, the modified correlation index can be formulated as:

[0060] in, represents the modified correlation index between the third sector and the fourth sector, r represents sector r, which is also the fourth sector; c represents sector c, which is also the third sector; Indicates the relative dependence of sector r on sector c, Indicates the relative dependence of sector c on sector r.

[0061] Proportion weight The larger the value, the greater the weight The smaller the value of , the more likely the third sector is a high-frequency access sector and the fourth sector is a low-frequency access sector. The access behavior of the third sector is more stable and can better reflect the actual service association situation. Therefore, the dependency corresponding to the third sector, which is a high-frequency access sector, is given a dominant position in the association evaluation, making the association analysis results more realistic and accurate.

[0062] At this point, according to the same calculation method, the modified correlation index between each undivided sector and each other different sector can be obtained. The modified correlation index can more accurately reflect the access correlation characteristics between two different sectors.

[0063] It should be noted that the purpose of calculating the modified correlation index is to perform a secondary partitioning operation on all unpartitioned sectors. Considering that unpartitioned sectors may have strong correlations with each other, while unpartitioned sectors may have weak correlations with sectors in the already partitioned initial sector set, it is necessary to calculate the modified correlation index for two different unpartitioned sectors. This step is merely an example of a sector in an initial sector set.

[0064] In the fourth step, for all undivided sectors, two sectors corresponding to the modified correlation index being greater than or equal to a preset correlation threshold are divided into the same set to obtain a global sector set.

[0065] As a specific example, taking the third sector and the fourth sector as an example, if the modified association index between the fourth sector and the third sector is greater than or equal to the association threshold, the fourth sector is divided into the initial sector set where the third sector is located.

[0066] It should be noted that if the fourth sector meets the conditions for multiple sets, it will be assigned to the set containing the sector with the maximum value of the modified association index. For example, if the modified association indexes between the fourth sector and the first, second, and third sectors are all greater than or equal to the association threshold, and the modified association index between the fourth sector and the first sector is the maximum of these three values, the fourth sector will be assigned to the set containing the first sector.

[0067] When the modified correlation index between the fourth sector and the other unpartitioned sectors is greater than or equal to the correlation threshold, the two unpartitioned sectors form a new set. All unpartitioned sectors are traversed and a secondary partitioning operation is performed. Unpartitioned sectors that do not meet the threshold are treated as isolated sectors and do not undergo the subsequent cascaded encryption analysis of this embodiment.

[0068] At this point, all the sets obtained in this step are recorded as global sector sets. It should be understood that even if the initial sector set is not updated, the set name is changed.

[0069] Step S300 , sorting all sectors in each global sector set according to the distribution and complexity of service data in accessed data of each sector in each global sector set, and obtaining the cascade encryption path corresponding to each global sector set.

[0070] In a cascaded encryption structure, sectors with higher rankings are accessed and decrypted first, so sectors with high access frequency and complex and sensitive data should be prioritized. The access information between different sectors in the same global sector set is relatively similar, so it is necessary to further evaluate the complexity and sensitivity of the data in each sector within the same global sector set. The more sensitive or structured information a sector contains, such as accounts, balances, permissions, and so on, the higher the risk of information leakage in that sector. The order of sectors in the cascaded encryption structure within the same global sector set is arranged by the complexity characteristics of the data stored in the sector.

[0071] As a specific example, Figure 4 As shown, the method for obtaining the cascade encryption path can be implemented by steps S301 and S302.

[0072] Step S301 : obtaining the data complexity of each sector in each global sector set according to the amount and complexity of non-null data contained in the service data in the accessed data of each sector in each global sector set.

[0073] Specifically, any sector in any global sector set is taken as an example for description. In the first step, the number of bytes of non-null data in the service data of each accessed sector is obtained as the first characteristic coefficient of each accessed sector.

[0074] For easier description, any sector in any global sector set is described as a target sector.

[0075] In the storage data of the target sector, each time the target sector is accessed, the card reader will read in real time the number of bytes of non-empty data actually stored in the first three data blocks of the target sector each time it is accessed, and collect the number of bytes of non-empty data as the first characteristic coefficient each time the target sector is accessed. It can exclude empty values ​​or filled 0 bytes, reflecting the richness of the data stored in the target sector each time it is accessed.

[0076] In the second step, the information entropy of non-empty data in the business data of each sector accessed is used as the second characteristic coefficient of each sector accessed.

[0077] The service data refers to the data stored in the first three blocks of the target sector. It should be noted that the method for calculating information entropy is well-known and will not be elaborated on here. Information entropy is calculated by the probability of each byte of non-null data in the service data of the target sector being accessed each time, measuring the data complexity of the target sector during a single access. The more possible values ​​for different bytes in the data, the greater the uncertainty, the larger the information entropy value, and the corresponding higher structural complexity.

[0078] In the third step, the average value of the product of the first characteristic coefficient and the second characteristic coefficient of the sector accessed each time is used as the data complexity of the arbitrary sector.

[0079] It should be understood that for the target sector, each access corresponds to a product calculation result between the first characteristic coefficient and the second characteristic coefficient, and then the average of the products corresponding to all access operations of the target sector is the data complexity of the target sector.

[0080] In each access operation, the more non-empty data in the business data accessed by the target sector, that is, the larger the value of the first characteristic coefficient. At the same time, the more different value data in the non-empty data, the larger the value of the second characteristic coefficient. This means that the target sector updates data frequently and has high randomness in word access. At this time, the data complexity of the target sector is greater.

[0081] The data complexity level represents the complexity of the service data stored in each sector of the global sector set. When the data complexity level of the target sector in the global sector set is high, the amount of information stored by the current NFC card in the target sector is generally large and the data format is complex. In this case, the target sector should be ranked higher during the encryption process. When the data complexity level of the target sector in the global sector set is low, the amount of information stored by the current NFC card in the target sector is generally small and the data format is simple. In this case, the target sector should be ranked lower during the encryption process.

[0082] Step S302 : Arrange all sectors in each global sector set in descending order of data complexity to obtain the cascade encryption path corresponding to the global sector set.

[0083] It should be understood that each global sector set corresponds to a cascade encryption path. For example, the cascade encryption path of a global sector set can be expressed as [sector 3, sector 1, sector 2, sector 5, sector 4]. Encryption according to the arrangement order of sectors in the cascade encryption path has a better encryption effect and improves data security.

[0084] Step S400: Based on the encryption results of the service data and key data of each sector, the key data of the next sector in each cascade encryption path is updated to obtain a protection scheme for the NFC tag data.

[0085] This embodiment uses a cascaded encryption mechanism to build a key dependency chain between sectors, effectively preventing attackers from gaining access to the entire data by cracking a single sector. A derivation strategy based on data content and key is used to generate the key for the next sector, allowing the key to be dynamically updated as the content changes, further improving the system's tamper resistance.

[0086] Based on this, for any cascade encryption path, the spliced ​​data between the business data of each sector and each key is encrypted separately to obtain the encrypted data corresponding to each key. The read permission verification key of the next sector adjacent to each sector is determined based on the encrypted data of the read permission verification key. The write permission verification key of the next sector adjacent to each sector is determined based on the encrypted data of the write permission verification key, and the encryption scheme of the NFC tag data is obtained.

[0087] More specifically, in a traditional NFC tag, the first three blocks of a sector are 16-byte blocks for data storage, and the last block is a key storage block, which includes a 6-byte KeyA, a 4-byte access control and backup key, and a 6-byte KeyB. KeyA is the read permission verification key, and KeyB is the write permission verification key.

[0088] Under the cascade encryption path corresponding to any global sector set, after obtaining the business data and its key stored in the first sector, the key of the second sector is calculated. The KeyA / KeyB of each sector depends on the content and key of the previous sector. The key of the latter sector cannot be reversed to the key of the previous sector.

[0089] As a specific example, take the first sector and the second sector in the cascade encryption path of the global sector set as an example to illustrate, first extract the business data of the first sector and record it as , that is, all the data in the first three blocks (3×16=48 bytes in total), and the read permission verification key of the first sector is extracted and recorded as (6 bytes), extract the write permission verification key of the first sector and record it as (6 bytes).

[0090] The business data of the first sector is respectively compared with the read permission verification key , write permission verification key The initial input data corresponding to the two keys are obtained by splicing, which can be expressed as , , for The corresponding initial input data, for The corresponding initial input data, It should be understood that the initial input data is 54 bytes of data.

[0091] The initial input data corresponding to the two keys of the first sector is encrypted. This embodiment uses a hash function for processing, which can make the key of the next sector completely dependent on the business data (Data) and original key (KeyA / KeyB) of the previous sector. Due to the one-way nature of SHA256, the data or key stored in the previous sector cannot be reversed using the key of the next sector.

[0092] More specifically, using a hash function right 、 Perform hash transformations respectively to obtain the encrypted data corresponding to the two keys and , its output length is 256 bits, 32 bytes.

[0093] Furthermore, the encrypted data corresponding to the read permission verification key Select 6 bytes as the KeyA (read permission verification key) of the next sector, and write the encrypted data corresponding to the permission verification key. 6 bytes are selected as KeyB (write permission verification key) for the next sector. As a specific example, the first 6 bytes of the encrypted data can be selected as the corresponding key. The implementer can set it according to the specific implementation scenario.

[0094] Following the same method, the second sector's service data and the updated key are concatenated and encrypted. KeyA / KeyB from the third sector can then be selected, and so on, until the final sector in the cascaded encryption path corresponding to the current global sector set is obtained, completing the key update operation for all sectors. This completes the encryption scheme for NFC tag data.

[0095] Finally, for the key update encryption process of this embodiment, the reading process of the card reader is as follows: When the card reader reads content, after the card reader initiates an authentication request, the NFC card generates a random number and sends it to the card reader. The card reader uses its own key and the random number to encrypt and calculate the response, obtains the calculation result, and sends the result back to the NFC card. The NFC card uses KeyA and the result of the random number calculation to compare with the received response. If the key is correct, the card reader can read the content stored in the sector. The card reader calculates and authenticates the subsequent sector key based on the read content and the KeyA of the corresponding sector, allowing the NFC card to read the subsequent sector content. When the card reader needs to modify the content, it can modify the above KeyA to the corresponding KeyB. After the content is modified, the key KeyB needs to be modified again based on the content information to ensure the feasibility of subsequent modifications.

[0096] More specifically, in the first step, when the card reader needs to access a sector of the NFC tag to read data, it initiates an authentication request to the NFC card, specifying the sector to be accessed and the type of operation. Read operations require verification of KeyA, while write operations require verification of KeyB. Upon receiving the authentication request, the NFC card automatically generates a random number. This random number is dynamically generated by the card's built-in chip and is random, avoiding duplication or prediction. The card then sends this random number to the reader.

[0097] In the second step, after receiving the random number sent by the NFC card, the card reader uses the key corresponding to the operation type stored in its own sector to perform encryption calculations on the received random number, generating an encrypted result. In actual NFC scenarios, the encryption process often uses symmetric encryption algorithms, such as the DES algorithm. The process of encrypting the random number using KeyA is briefly described below. During the encryption process, the card reader uses KeyA as the DES algorithm key and performs DES encryption on the random number. The specific encryption process is well known and will not be detailed here.

[0098] In the third step, after the NFC card receives the encryption result of the card reader's response, it uses its own KeyA (which is exactly the same as the KeyA in the card reader's sector) to perform the same DES encryption operation on the same random number to obtain the encryption result of the NFC card. It then compares it with the encryption result received from the card reader. If the two are exactly the same, the authentication is successful and the card reader is allowed to access the sector content; if the two are inconsistent, the authentication fails and access is denied.

[0099] At this point, when decrypting, the card reader only needs to use the legitimate content and key of the previous sector and re-perform the hash calculation according to the same rules to generate the key for the next sector and complete the content reading. By encrypting the same plaintext with the same key and comparing the encrypted results, the legitimacy of the key is verified. In other words, through the two-way authentication of the key and the random number, the security control of NFC sector access rights is achieved.

[0100] In summary, the NFC tag data protection scheme of the embodiment of the present invention has multiple security advantages and practical value. By introducing historical access data to divide and reorder sectors, high-frequency sensitive data can be dynamically identified and protected with priority, achieving more reasonable data organization and security priority control. Combined with the cascade encryption mechanism, a key dependency chain is constructed between sectors, effectively preventing attackers from obtaining the entire data by cracking a single sector. A derivation strategy based on data content and key is adopted to generate the key for the next sector, so that the key is dynamically updated as the content changes, further improving the system's tamper resistance. The two-way authentication process between the card reader and the NFC tag based on random numbers and keys realizes fine-grained read and write permission management to ensure the legality and security of read and write operations. It has high security, good scalability and versatility applicable to a variety of NFC application scenarios, effectively improving the security protection level of NFC tags in areas such as identity authentication, access control and data storage.

[0101] like Figure 5 As shown, an embodiment of the present invention further provides an NFC tag data protection system, which is used to implement the steps of an NFC tag data protection method. The NFC tag data protection system specifically includes: A data acquisition module is used to acquire the storage data of each sector in the NFC tag data, as well as the historical access data of each sector; wherein the storage data includes business data and key data; A sector partitioning module is used to partition all sectors according to the correlation between the historical access data of each sector and the accessed information in the historical access data of other sectors and the distribution of the information accessed simultaneously, so as to obtain each global sector set; A path analysis module is used to sort all sectors in each global sector set according to the distribution and complexity of the business data in the accessed data of each sector in each global sector set, and obtain the cascade encryption path corresponding to each global sector set; The security encryption module is used to update the key data of the next sector in each cascade encryption path according to the encryption results of the business data and key data of each sector, so as to obtain the protection scheme of the NFC tag data.

[0102] Since an embodiment of an NFC tag data protection method has been described in detail, it will not be repeated here.

[0103] The above-described embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application, and should all be included in the scope of protection of the present application.

Claims

1. A method for protecting NFC tag data, characterized in that: The method comprises the following steps: Obtaining storage data of each sector in the NFC tag data, as well as historical access data of each sector; wherein the storage data includes business data and key data; Based on the correlation between the historical access data of each sector and the accessed information in the historical access data of other sectors and the distribution of the information accessed simultaneously, all sectors are divided to obtain each global sector set; According to the distribution and complexity of the business data in the accessed data of each sector in each global sector set, all sectors in each global sector set are sorted to obtain the cascade encryption path corresponding to each global sector set; According to the encryption results of the business data and key data of each sector, the key data of the next sector in each cascade encryption path is updated to obtain a protection scheme for NFC tag data.

2. The NFC tag data protection method according to claim 1, wherein: The method of dividing all sectors according to the correlation between the historical access data of each sector and the accessed information in the historical access data of other sectors and the distribution of the information accessed simultaneously to obtain each global sector set specifically includes: The historical access data includes the number of times a sector is accessed and the number of times different sectors are accessed simultaneously; According to the number of times each sector is accessed and the number of times each sector and other sectors are accessed simultaneously, the authentication correlation index between each two different sectors is obtained; Dividing all sectors according to the authentication association index to obtain each initial sector set and undivided sectors; According to the correlation of historical access data between the unpartitioned sectors and each sector in each initial sector set, combined with the proportion of the number of times each sector is accessed, the unpartitioned sectors are divided to obtain a global sector set.

3. The NFC tag data protection method according to claim 2, wherein: The authentication association index between each two different sectors is obtained based on the number of times each sector is accessed and the number of times each sector and other sectors are accessed simultaneously, specifically including: Take any two different sectors as the first sector and the second sector respectively; The ratio between the number of times the first sector and the second sector are accessed simultaneously and the number of times the first sector is accessed is used as the relative dependence of the second sector on the first sector; The average of the relative dependence degree of the second sector on the first sector and the relative dependence degree of the first sector on the second sector is used as the authentication association index between the first sector and the second sector.

4. The NFC tag data protection method according to claim 2, wherein: The step of dividing all sectors according to the authentication association index to obtain each initial sector set and undivided sectors specifically includes: Two different sectors corresponding to authentication association indicators greater than or equal to a preset association threshold are divided into the same initial sector set, and sectors that do not belong to any initial sector set are undivided sectors.

5. The NFC tag data protection method according to claim 3, wherein: The unpartitioned sectors are divided according to the correlation of historical access data between the unpartitioned sectors and each sector in each initial sector set, combined with the proportion of the number of times each sector is accessed, to obtain a global sector set, specifically including: Any sector in the initial sector set is used as the third sector, and any undivided sector is used as the fourth sector; The ratio of the number of times the third sector is accessed to the cumulative sum of the number of times the third sector is accessed and the number of times the fourth sector is accessed is used as the weight corresponding to the relative dependence of the third sector on the fourth sector; The ratio of the number of times the fourth sector is accessed to the cumulative sum of the number of times the third and fourth sectors are accessed is used as the weight corresponding to the relative dependence of the fourth sector on the third sector; Using the weight proportions, the relative dependence of the third sector on the fourth sector and the relative dependence of the fourth sector on the three sectors are weighted and summed to obtain the modified correlation index between the third and fourth sectors; For all undivided sectors, two sectors corresponding to the modified correlation index being greater than or equal to a preset correlation threshold are divided into the same set to obtain a global sector set.

6. The NFC tag data protection method according to claim 1, characterized in that: The method of sorting all sectors in each global sector set according to the distribution and complexity of the service data in the accessed data of each sector in each global sector set to obtain the cascade encryption path corresponding to each global sector set specifically includes: Obtaining the data complexity of each sector in each global sector set according to the data volume and complexity of non-null data contained in the service data in the accessed data of each sector in each global sector set; All sectors in each global sector set are arranged in descending order of data complexity to obtain the cascade encryption path corresponding to the global sector set.

7. The NFC tag data protection method according to claim 1, characterized in that: The step of obtaining the data complexity of each sector in each global sector set according to the amount and complexity of non-null data contained in the service data in the accessed data of each sector in each global sector set specifically includes: For any sector in any global sector set, the number of bytes of non-null data in the service data of the sector accessed each time is obtained as the first characteristic coefficient of each access of the sector; the information entropy of the non-null data in the service data of the sector accessed each time is used as the second characteristic coefficient of each access of the sector; The average value of the product of the first characteristic coefficient and the second characteristic coefficient of the sector accessed each time is used as the data complexity of the arbitrary sector.

8. The NFC tag data protection method according to claim 1, wherein: The key data includes a read permission verification key and a write permission verification key.

9. The NFC tag data protection method according to claim 8, characterized in that: The key data of the next sector in each cascade encryption path is updated according to the business data and key data of each sector to obtain a protection scheme for NFC tag data, specifically including: For any cascade encryption path, the concatenated data between the business data of each sector and each key is encrypted separately to obtain the encrypted data corresponding to each key. The read permission verification key of the next sector adjacent to each sector is determined based on the encrypted data of the read permission verification key. The write permission verification key of the next sector adjacent to each sector is determined based on the encrypted data of the write permission verification key to obtain the encryption scheme of the NFC tag data.

10. An NFC tag data protection system, characterized in that: The system is used to implement the steps of an NFC tag data protection method according to any one of claims 1 to 9, and the NFC tag data protection system specifically includes: A data acquisition module is used to acquire the storage data of each sector in the NFC tag data, as well as the historical access data of each sector; wherein the storage data includes business data and key data; A sector partitioning module is used to partition all sectors according to the correlation between the historical access data of each sector and the accessed information in the historical access data of other sectors and the distribution of the information accessed simultaneously, so as to obtain each global sector set; A path analysis module is used to sort all sectors in each global sector set according to the distribution and complexity of the business data in the accessed data of each sector in each global sector set, and obtain the cascade encryption path corresponding to each global sector set; The security encryption module is used to update the key data of the next sector in each cascade encryption path according to the encryption results of the business data and key data of each sector, so as to obtain the protection scheme of the NFC tag data.

Images