NFC tag data protection method and system

Abstract

This invention relates to the field of data security processing technology, specifically to an NFC tag data protection method and system, comprising: acquiring the stored data and historical access data of each sector in the NFC tag data; dividing all sectors into global sector sets based on the correlation between the accessed information in the historical access data of each sector and the distribution of simultaneously accessed information; sorting all sectors in each global sector set according to the distribution and complexity of business data in the accessed data of each sector in each global sector set to obtain the cascading encryption path corresponding to each global sector set; updating the key data of the next sector in each cascading encryption path according to the encryption results of the business data and key data of each sector, thereby obtaining the NFC tag data protection scheme. This invention enables the key to be dynamically updated as the content changes, improving the tamper resistance of the authentication process.

Description

Technical Field

[0001] This invention relates to the field of data security processing technology, specifically to an NFC tag data protection method and system. Background Technology

[0002] NFC tags, due to their contactless communication, low power consumption, and easy deployment, have become an important component in building lightweight data interaction systems. At the application level, an increasing number of systems are using NFC tags as user identification, device status indicators, or key data carriers, highlighting their growing value in industrial automation, retail management, and personal information storage. As the depth and breadth of applications continue to expand, how to achieve refined management and intelligent processing of data within NFC tags has become a key focus for the industry.

[0003] Existing NFC tag data protection methods mostly adopt static key mechanisms, which set fixed access control parameters for each sector. Once the key of a certain sector is cracked, attackers may be able to deduce the structure of other sectors, resulting in insufficient overall security of the tag. Summary of the Invention

[0004] To address the insufficient security of existing tag data protection methods employing static key mechanisms, this invention aims to provide an NFC tag data protection method and system, the specific technical solution of which is as follows:

[0005] In a first aspect, the present invention provides an NFC tag data protection method, comprising:

[0006] The system acquires the stored data of each sector in the NFC tag data, as well as the historical access data of each sector; wherein the stored data includes business data and key data.

[0007] Based on the correlation between the accessed information in the historical access data of each sector and the accessed information in the historical access data of other sectors, as well as the distribution of information accessed at the same time, all sectors are divided to obtain a global sector set.

[0008] Based on the distribution and complexity of the business data in the accessed data of each sector in each global sector set, all sectors in each global sector set are sorted to obtain the cascaded encryption path corresponding to each global sector set;

[0009] Based on the encryption results of the business data and key data of each sector, the key data of the next sector in each cascade encryption path is updated to obtain the protection scheme for NFC tag data.

[0010] Preferably, the step of dividing all sectors into a global sector set based on the correlation between the accessed information in the historical access data of each sector and the accessed information in the historical access data of other sectors, as well as the distribution of information accessed simultaneously, specifically includes:

[0011] The historical access data includes the number of times a sector was accessed and the number of times different sectors were accessed simultaneously.

[0012] Based on the number of times each sector is accessed and the number of times each sector is accessed simultaneously with other sectors, the authentication correlation index between each pair of different sectors is obtained.

[0013] Based on the authentication association indicators, all sectors are divided to obtain each initial sector set and undivided sectors;

[0014] Based on the correlation between the historical access data of undivided sectors and each sector in each initial sector set, and combined with the proportion of access times of each sector, the undivided sectors are divided to obtain a global sector set.

[0015] Preferably, the step of obtaining the authentication association index between any two different sectors based on the number of times each sector is accessed and the number of times each sector is accessed simultaneously with other sectors specifically includes:

[0016] Use any two different sectors as the first sector and the second sector, respectively.

[0017] The ratio between the number of times the first and second sectors are accessed simultaneously and the number of times the first sector is accessed is used as the relative dependence of the second sector on the first sector.

[0018] The average of the relative dependence of the second sector on the first sector and the relative dependence of the first sector on the second sector is used as the authentication association index between the first sector and the second sector.

[0019] Preferably, the step of dividing all sectors according to the authentication association index to obtain each initial sector set and undivided sectors specifically includes:

[0020] Two different sectors whose authentication association index is greater than or equal to the preset association threshold are assigned to the same initial sector set. Sectors that do not belong to any initial sector set are unassigned sectors.

[0021] Preferably, the step of dividing the undivided sectors into a global sector set based on the correlation between historical access data between the undivided sectors and each sector in each initial sector set, combined with the proportion of accesses to each sector, specifically includes:

[0022] Take any sector from the initial sector set as the third sector, and any undivided sector as the fourth sector;

[0023] The ratio between the number of times the third sector is accessed and the sum of the number of times the third and fourth sectors are accessed is used as the weight corresponding to the relative dependence of the third sector on the fourth sector.

[0024] The ratio between the number of times the fourth sector is accessed and the sum of the number of times the third and fourth sectors are accessed is used as the weight corresponding to the relative dependence of the fourth sector on the third sector.

[0025] By using weighted proportions, the relative dependence of the third sector on the fourth sector and the relative dependence of the fourth sector on the third sector are weighted and summed to obtain the corrected correlation index between the third sector and the fourth sector.

[0026] For all undivided sectors, the two sectors corresponding to the corrected correlation index being greater than or equal to the preset correlation threshold are divided into the same set to obtain the global sector set.

[0027] Preferably, the step of sorting all sectors in each global sector set according to the distribution and complexity of the business data in the accessed data of each sector in each global sector set to obtain the cascading encryption path corresponding to each global sector set specifically includes:

[0028] The data complexity of each sector in each global sector set is obtained based on the amount and complexity of non-empty data contained in the accessed business data of each sector in each global sector set.

[0029] Arrange all sectors in each global sector set in descending order of data complexity to obtain the cascaded encryption path corresponding to the global sector set.

[0030] Preferably, the step of determining the data complexity of each sector in each global sector set based on the amount and complexity of non-empty data contained in the accessed business data of each sector in each global sector set specifically includes:

[0031] For any sector in any global sector set, the number of bytes of non-empty data in the business data accessed each time the sector is accessed is taken as the first feature coefficient of the sector accessed each time; the information entropy of the non-empty data in the business data accessed each time the sector is accessed is taken as the second feature coefficient of the sector accessed each time.

[0032] The average of the product of the first and second characteristic coefficients of a sector each time it is accessed is taken as the data complexity of any given sector.

[0033] Preferably, the key data includes a read permission verification key and a write permission verification key.

[0034] Preferably, the step of updating the key data of the next sector in each cascading encryption path based on the business data and key data of each sector to obtain the NFC tag data protection scheme specifically includes:

[0035] For any cascading encryption path, the concatenated data between the business data of each sector and each key is encrypted to obtain the encrypted data corresponding to each key. The read permission verification key of the next adjacent sector is determined based on the encrypted data of the read permission verification key, and the write permission verification key of the next adjacent sector is determined based on the encrypted data of the write permission verification key, thus obtaining the encryption scheme for NFC tag data.

[0036] Secondly, the present invention provides an NFC tag data protection system, which implements the steps of an NFC tag data protection method, the NFC tag data protection system specifically including:

[0037] The data acquisition module is used to acquire the stored data of each sector in the NFC tag data, as well as the historical access data of each sector; wherein, the stored data includes business data and key data;

[0038] The sector partitioning module is used to partition all sectors based on the correlation between the accessed information in the historical access data of each sector and the accessed information in the historical access data of other sectors, as well as the distribution of information accessed at the same time, to obtain a global sector set.

[0039] The path analysis module is used to sort all sectors in each global sector set according to the distribution and complexity of the business data in the accessed data of each sector in each global sector set, and obtain the cascaded encryption path corresponding to each global sector set;

[0040] The security encryption module is used to update the key data of the next sector in each cascade encryption path based on the encryption results of the business data and key data of each sector, thereby obtaining a protection scheme for NFC tag data.

[0041] The embodiments of the present invention have at least the following beneficial effects:

[0042] This invention divides and reorders sectors in NFC tags by introducing historical access data, dynamically identifying and prioritizing the protection of high-frequency sensitive data, thus achieving more rational data organization and security priority control. Combined with a cascading encryption mechanism, a key dependency chain is built between sectors, effectively preventing attackers from obtaining the entire data by cracking a single sector. A derivation strategy based on data content and the key is used to generate the key for the next sector, allowing the key to be dynamically updated as the content changes, further improving the system's tamper resistance. It possesses high security, good scalability, and versatility applicable to various NFC application scenarios, effectively enhancing the security level of NFC tags in areas such as identity authentication, access control, and data storage. Attached Figure Description

[0043] To more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0044] Figure 1 This is a flowchart of the steps of an NFC tag data protection method provided by the present invention;

[0045] Figure 2 This is a schematic diagram of sector data storage provided by the present invention;

[0046] Figure 3 This is a flowchart of the steps of the method for obtaining the global sector set provided by the present invention;

[0047] Figure 4 This is a flowchart of the steps of the method for obtaining the cascaded encryption path provided by the present invention;

[0048] Figure 5 This is a schematic diagram of the structure of an NFC tag data protection system provided by the present invention. Detailed Implementation

[0049] To further illustrate the technical means and effects adopted by the present invention to achieve its intended purpose, the following, in conjunction with the accompanying drawings and preferred embodiments, details the specific implementation, structure, features, and effects of an NFC tag data protection method and system proposed according to the present invention. In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics in one or more embodiments can be combined in any suitable form.

[0050] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0051] The following description, in conjunction with the accompanying drawings, details the specific solution of the NFC tag data protection method and system provided by this invention.

[0052] Please see Figure 1 The diagram illustrates a flowchart of an NFC tag data protection method according to an embodiment of the present invention, which includes the following steps:

[0053] Step S100: Obtain the storage data of each sector of the NFC tag, as well as the historical access data of each sector; wherein, the storage data includes business data and key data.

[0054] In practical applications, NFC tags are usually bound to a system platform, such as access control systems, mobile ticketing systems, or warehousing and logistics systems. These systems have complete background communication recording capabilities, which can automatically record data such as the sector number, operation time, and read / write behavior of each access when a card reading operation occurs.

[0055] In this embodiment, an NFC tag is used as an example to illustrate the acquisition of historical data from the NFC tag. This historical data includes, but is not limited to, the number of accesses to each sector, access timestamps, access command types (read / write), and access device identification information. Historical data can be collected and extracted through communication logs recorded on the reader side, interaction records in the background database, or from a smart NFC tag chip with recording capabilities. The system records the access behavior in real time when completing a tag reading operation. In other embodiments, an access behavior model can be built during multiple interactions, providing a data foundation for subsequent sector sensitivity classification and cascading encryption strategies.

[0056] It should be noted that the sector division of NFC tags is a well-known technology, and will only be briefly introduced here. Specifically, common NFC cards based on Mifare Classic technology, such as the M1 card, have 16 sectors. Each sector consists of 4 blocks, and each block has 16 bytes. Access is done in blocks; the first three blocks of a sector are used to store business data, and the fourth block is used to store the key for managing read and write permissions. For example, ... Figure 2 As shown, a block includes block 0, block 1, block 2 and block 3. Blocks 0, 1 and 2 are used to store business data, such as vendor information, etc. Block 3 includes key A, access control information, backup information and key B.

[0057] In practical applications, for ease of deployment and maintenance, the keys corresponding to different sectors typically employ the following key configuration strategies: For public transport cards and access control cards, all sectors use the same key, which is convenient to manage and has low deployment costs; however, if the key is leaked, all cards become invalid. For membership cards and campus cards, the first few sectors use a unified key, while subsequent sectors use different keys, providing data hierarchy and appropriate isolation; however, there is still a risk of brute-force access to highly sensitive sectors. In high-security systems, each sector is independently configured with key A and key B, offering strong security and fine-grained authorization, but this is complex to maintain and the key database is prone to loss of control.

[0058] Under traditional key configuration strategies, the more dispersed the keys are, the more secure they become, but the more complex the key management and authentication process becomes, and the lower the card reading efficiency. Conversely, a more dispersed key configuration will lead to weaker security. Therefore, we consider dynamically determining the encryption strategy based on the historical access behavior of NFC tags, in order to improve the security of NFC cards without increasing the number of keys that the system needs to store.

[0059] At this point, the stored data for each sector of the NFC tag can be obtained. In this embodiment, the data in the first three blocks of each sector is collectively referred to as business data. That is, the stored data of each sector includes the business data of the first three blocks and the key data of the fourth block. The key data includes the read permission verification key (Key A, also known as KeyA) and the write permission verification key (Key B, also known as KeyB). At the same time, the historical access data of each sector includes the number of times the corresponding sector has been accessed and the number of times different sectors have been accessed simultaneously.

[0060] It should be understood that the historical access data for each sector can be directly obtained from the historical data of the NFC tag. For example, if sector 0 and sector 1 are accessed simultaneously in a single access operation, the number of times these two different sectors are accessed at the same time is recorded, providing a data foundation for subsequent analysis of the data correlation between different sectors. It should be noted that implementers can also set the data collection time period for access operations according to the specific implementation scenario, such as obtaining access operation data for all sectors within a historical month.

[0061] Step S200: Based on the correlation between the historical access data of each sector and the accessed information in the historical access data of other sectors, as well as the distribution of information accessed simultaneously, all sectors are divided to obtain a global sector set.

[0062] Considering the similarity of data stored in some sectors of an NFC card—for example, in an enterprise access control NFC card, sector 0 stores the UID (Unique Identifier) ​​and manufacturer information, sector 1 stores the employee ID, sector 2 stores the department number, and sectors 3-15 are reserved for access records, data signature information, and other extended areas—to avoid the security issues of a single key for the entire card or a fixed partition key, a differentiated sector partitioning operation can be performed to provide a precise basis for subsequent encryption strategies.

[0063] Specifically, the value of data stored in different sectors varies significantly, and the access frequency and interconnectivity of data stored within different sectors also exhibit certain differences and similarities. By classifying all sectors based on the correlation between sector data, sectors with high sensitivity, frequent access, and strong interconnectivity can be grouped into one category for concentrated resource protection; while sectors with low sensitivity and low access frequency can be grouped into another category to simplify protection strategies and balance security and efficiency.

[0064] As a concrete example, such as Figure 3 As shown, the method for obtaining the global sector set can be implemented by steps S201 to S203.

[0065] Step S201: Based on the number of times each sector is accessed and the number of times each sector is accessed simultaneously with other sectors, obtain the authentication association index between every two different sectors.

[0066] During multiple accesses to the historical data of the NFC tag, firstly, the frequency similarity of access to different sectors is analyzed, and secondly, the frequency performance of simultaneous access to every two different sectors is analyzed, so as to comprehensively evaluate the correlation between every two different sectors in the NFC tag.

[0067] Specifically, taking any two different sectors in an NFC tag as an example, we will refer to these two different sectors as the first sector and the second sector, respectively.

[0068] The first step is to use the ratio between the number of times the first and second sectors are accessed simultaneously and the number of times the first sector is accessed as the relative dependence of the second sector on the first sector.

[0069] As a concrete example, let sector a be the first sector and sector b be the second sector. The relative dependence of sector b on sector a, that is, the relative dependence of the second sector on the first sector, can be expressed by the formula: ,in This indicates the relative dependence of the second sector on the first sector, where 'a' represents sector a and 'b' represents sector b. This indicates the number of times sector b and sector a were accessed simultaneously across all access records. This indicates the number of times sector a was accessed across all access records.

[0070] When the ratio A larger value, closer to 1, indicates that sector b is accessed almost every time sector a is accessed, thus suggesting that sector b is more dependent on sector a. When the ratio... The smaller the value, the closer it is to 0, the less often sector b needs to be accessed when accessing sector a, which means that sector b has a weaker dependence on sector a.

[0071] The relative dependence of sector b on sector a reflects the probability that accessing sector a will also access sector b, that is, the probability of conditional dependence of sector b on sector a, and can objectively reflect the strength of the dependency between sector a and sector b.

[0072] By following the same method, we can obtain the relative dependence of each sector on other sectors.

[0073] The second step is to use the average of the relative dependence of the second sector on the first sector and the relative dependence of the first sector on the second sector as the authentication association index between the first sector and the second sector.

[0074] For two different sectors, the analysis objects are different, resulting in two calculation results of relative dependency. Specifically, the calculation includes the number of times the first and second sectors are accessed simultaneously and the number of times the second sector is accessed. The ratio between This allows us to obtain the relative dependence of the first sector on the second sector.

[0075] The relative dependence of the second sector on the first sector reflects the probability of accessing the second sector along with accessing the first sector, and the relative dependence of the first sector on the second sector reflects the probability of accessing the first sector along with accessing the second sector. Therefore, when quantifying the access relationship between the first and second sectors, it is necessary to comprehensively evaluate the results of the relative dependence strength analysis of these two aspects.

[0076] Thus, the authentication correlation index between the first sector and the second sector characterizes the synchronization and correlation of access operations between the first sector and the second sector.

[0077] Step S202: Based on the authentication association index, all sectors are divided to obtain each initial sector set and undivided sectors.

[0078] The larger the value of the authentication correlation index between the first sector and the second sector, the more synchronous the access operations between the first sector and the second sector are, and the greater the correlation. In this case, classifying these two sectors into the same category for cascade encryption can avoid a large number of key authentication operations during the same access process.

[0079] Specifically, two different sectors corresponding to authentication association indicators greater than or equal to a preset association threshold are assigned to the same initial sector set, and sectors that do not belong to any initial sector set are unassigned sectors.

[0080] In this embodiment, the association threshold is set to 0.9, which can be set by the implementer according to the specific implementation scenario. The first and second sectors will be used as examples for further explanation.

[0081] When the authentication correlation index between the first sector and the second sector is greater than or equal to the correlation threshold, it indicates that the access operation information of the first sector and the second sector is highly correlated. It is better to classify them into the same category for unified management. Therefore, the first sector and the second sector are classified into the same initial sector set.

[0082] When the authentication correlation index between the first sector and the second sector is less than the correlation threshold, it indicates that the access operation information of these two sectors is not closely related and does not need to be classified into the same category for unified management. If the authentication correlation index between the first sector and all other sectors is less than the correlation threshold, it indicates that there are currently no other sectors with a strong correlation to the first sector, and the first sector will be treated as an unclassified sector for further feature analysis.

[0083] Step S203: Based on the correlation between the historical access data of the undivided sectors and each sector in each initial sector set, and combined with the proportion of access times of each sector, the undivided sectors are divided to obtain a global sector set.

[0084] For unclassified sectors, if the access frequency of a certain unclassified sector is too low, in the subsequent authentication process, the number of times the unclassified sector is accessed is much less than the number of times other sectors are accessed, resulting in a very small relative dependence value for a single aspect. Consequently, the authentication correlation index of the unclassified sector combined with other sectors is very small, leading to the phenomenon of unclassified sectors becoming isolated.

[0085] Furthermore, in order to eliminate the interference of the undivided sector's own access information, the proportion of the undivided sector's own access information and the proportion of the other sector's own access information are added, and a second division operation is performed on the undivided sector.

[0086] Specifically, taking any undivided sector and any other different sector as examples, we will take any sector in the initial sector set as the third sector and any undivided sector as the fourth sector.

[0087] The first step is to use the ratio between the number of times the third sector is accessed and the sum of the number of times the third and fourth sectors are accessed as the weight corresponding to the relative dependence of the third sector on the fourth sector.

[0088] As a specific example, this embodiment uses sector c as the third sector and sector r as the fourth sector. The relative dependence of the third sector on the fourth sector can be expressed by the formula: Where r represents sector r and c represents sector c; This indicates the number of times sector c was accessed across all access records. This indicates the number of times sector r was accessed across all access records.

[0089] The larger the weighting value, the greater the proportion of the third sector's own access information when analyzing the relationship between two different sectors. The actual relationship is amplified by the relative dependence of the third sector on the fourth sector. In other words, the data analysis result regarding the relative dependence of the third sector on the fourth sector should have a larger value.

[0090] The second step is to use the ratio between the number of times the fourth sector is accessed and the sum of the number of times the third and fourth sectors are accessed as the weight of the relative dependence of the fourth sector on the third sector.

[0091] As a concrete example, the relative dependence of the fourth sector on the third sector can be expressed as follows: , where r represents sector r, which is also an undivided sector, and c represents sector c; This indicates the number of times sector c was accessed across all access records. This indicates the number of times sector r was accessed across all access records.

[0092] The smaller the weighting value, the smaller the proportion of the fourth sector's own access information when analyzing the correlation between two different sectors. In this case, the analysis results of the relative dependence of the aspect with a small proportion of access information should be weakened to avoid the influence of the correlation analysis results on the small proportion of its own access information.

[0093] The third step is to use the weighted proportions to perform a weighted summation of the relative dependence of the third sector on the fourth sector and the relative dependence of the fourth sector on the third sector, so as to obtain the corrected correlation index between the third sector and the fourth sector.

[0094] As a concrete example, the corrected correlation index can be expressed by the formula:

[0095]

[0096] in, This represents the corrected correlation index between the third and fourth sectors, where r represents sector r, which is the fourth sector, and c represents sector c, which is the third sector. This indicates the relative dependence of sector r on sector c. This indicates the degree of relative dependence of sector c on sector r.

[0097] Percentage weight The larger the value, the higher the weight percentage. The smaller the value, the more likely the third sector is a high-frequency access sector and the fourth sector is a low-frequency access sector. The access behavior of the third sector is more stable and can better reflect the real business relationship. Therefore, in this case, the dependency situation corresponding to the third sector, which is a high-frequency access sector, should dominate the relationship assessment, so that the relationship analysis results are more consistent with reality and more accurate.

[0098] By using the same calculation method, we can obtain the corrected correlation index between each undivided sector and each other different sector. The corrected correlation index can more accurately reflect the access correlation characteristics between two different sectors.

[0099] It should be noted that the purpose of calculating the corrected correlation index is to perform a secondary partitioning operation on all unpartitioned sectors. Considering that there may be strong correlations between unpartitioned sectors, while there are weak correlations between unpartitioned sectors and sectors in the initial partitioned sector set, the corrected correlation index also needs to be calculated for two different unpartitioned sectors. This step is only illustrated using any sector in an initial sector set as an example.

[0100] The fourth step is to group the two sectors that correspond to a modified correlation index that is greater than or equal to a preset correlation threshold into the same set to obtain the global sector set.

[0101] As a specific example, taking the third and fourth sectors as examples, if the corrected correlation index between the fourth and third sectors is greater than or equal to the correlation threshold, then the fourth sector will be assigned to the initial sector set where the third sector is located.

[0102] It should be noted that if the fourth sector simultaneously meets the partitioning conditions of multiple sets, then the fourth sector will be assigned to the set containing the sector with the maximum value of the modified correlation index. For example, if the modified correlation index between the fourth sector and the first, second, and third sectors is all greater than or equal to the correlation threshold, and the modified correlation index between the fourth sector and the first sector is the maximum of these three, then the fourth sector will be assigned to the set containing the first sector.

[0103] If the corrected correlation index between the fourth sector and other undivided sectors is greater than or equal to the correlation threshold, then these two undivided sectors form a new set. A secondary partitioning operation is performed on all undivided sectors. Undivided sectors that do not meet the threshold are treated as isolated sectors and are not subject to the subsequent cascading encryption analysis operations in this embodiment.

[0104] At this point, all the sets obtained in this step are referred to as the global sector set. It should be understood that even the initial sector set, which has not been updated, has had its set name changed.

[0105] Step S300: Based on the distribution and complexity of the business data in the accessed data of each sector in each global sector set, sort all sectors in each global sector set to obtain the cascading encryption path corresponding to each global sector set.

[0106] In a cascaded encryption structure, sectors that appear earlier in the sequence are accessed and decrypted first. Therefore, sectors with high access frequency and complex, sensitive data should be prioritized. Since access information between different sectors within the same global sector set is relatively similar, it's necessary to further evaluate the data complexity and sensitivity of each sector within the same global sector set. The more sensitive or structured information a sector contains, such as account details, balances, and permissions, the higher the risk of information leakage. The order of sectors in the cascaded encryption structure within the same global sector set should be determined by analyzing the complexity characteristics of the data stored within each sector.

[0107] As a concrete example, such as Figure 4 As shown, the method for obtaining the cascaded encryption path can be implemented by steps S301 and S302.

[0108] Step S301: Based on the amount and complexity of non-empty data contained in the accessed business data of each sector in each global sector set, obtain the data complexity of each sector in each global sector set.

[0109] Specifically, let's take any sector in any global sector set as an example. The first step is to obtain the number of bytes of non-empty data in the business data of each access to the sector as the first characteristic coefficient of each access to the sector.

[0110] For easier description, any sector from any global sector set will be used as the target sector.

[0111] In the stored data of the target sector, when the target sector is accessed each time, the card reader will read in real time the number of bytes of non-empty data actually stored in the first 3 data blocks of the target sector at each access time. The number of bytes of non-empty data is collected as the first characteristic coefficient of the target sector each time it is accessed. It can exclude null values ​​or padding 0 bytes, and reflect the richness of the stored data in the target sector each time it is accessed.

[0112] The second step is to use the information entropy of the non-empty data in the business data of each accessed sector as the second feature coefficient of each accessed sector.

[0113] The business data refers to the data stored in the first three blocks of the target sector. It should be noted that the method for calculating information entropy is a well-known technique and will not be elaborated upon here. Information entropy is calculated by considering the probability of each non-empty byte in the business data of the target sector during each access, thus measuring the data complexity of the target sector in a single access. The more possible values ​​of different bytes in the data, the greater the uncertainty, the higher the value of information entropy, and the higher the corresponding structural complexity.

[0114] The third step is to take the average of the product of the first and second characteristic coefficients of a sector each time it is accessed as the data complexity of any given sector.

[0115] It should be understood that for a target sector, each access corresponds to the product of a first feature coefficient and a second feature coefficient. Therefore, the average of the products corresponding to all access operations of the target sector is the data complexity of the target sector.

[0116] In each access operation, the more non-empty data the target sector has accessed, the larger the value of the first feature coefficient. At the same time, the more different values ​​the non-empty data has, the larger the value of the second feature coefficient. This indicates that the target sector updates data frequently and has high randomness during each access operation. In this case, the value of the data complexity of the target sector is greater.

[0117] Data complexity characterizes the degree of complexity of the business data stored in each sector of the global sector set. When the data complexity of the target sector in the global sector set is high, the amount of information stored in the target sector by the current NFC card is generally large, and the data format is complex. In this case, the target sector should be placed earlier in the encryption process. Conversely, when the data complexity of the target sector in the global sector set is low, the amount of information stored in the target sector by the current NFC card is generally small, and the data format is relatively simple. In this case, the target sector should be placed later in the encryption process.

[0118] Step S302: Arrange all sectors in each global sector set in descending order of data complexity to obtain the cascaded encryption path corresponding to the global sector set.

[0119] It should be understood that each global sector set corresponds to a cascaded encryption path. For example, the cascaded encryption path of a global sector set can be represented as [sector 3, sector 1, sector 2, sector 5, sector 4]. Encrypting according to the order of sectors in the cascaded encryption path has a better encryption effect and improves data security.

[0120] Step S400: Based on the encryption results of the business data and key data of each sector, update the key data of the next sector in each cascade encryption path to obtain the protection scheme for NFC tag data.

[0121] This embodiment employs a cascading encryption mechanism, constructing a key dependency chain between sectors to effectively prevent attackers from obtaining the entire data by cracking a single sector. A derivation strategy based on data content and the key is used to generate the key for the next sector, allowing the key to be dynamically updated as the content changes, further enhancing the system's tamper resistance.

[0122] Based on this, for any cascaded encryption path, the concatenated data between the business data of each sector and each key is encrypted to obtain the encrypted data corresponding to each key. The read permission verification key of the next adjacent sector is determined based on the encrypted data of the read permission verification key, and the write permission verification key of the next adjacent sector is determined based on the encrypted data of the write permission verification key, thus obtaining the encryption scheme for NFC tag data.

[0123] More specifically, in a traditional NFC tag, the first three blocks of a sector are data storage blocks, each 16 bytes in size. The last block is the key storage block, including a 6-byte KeyA, four bytes for access control and backup, and a 6-byte KeyB. KeyA is the read permission verification key, and KeyB is the write permission verification key.

[0124] Under any cascading encryption path corresponding to a global sector set, after obtaining the business data and its key stored in the first sector, the key of the second sector is calculated. The KeyA / KeyB of each sector depends on the content and key of the previous sector, and the key of the later sector cannot be used to deduce the key of the previous sector.

[0125] As a concrete example, let's take the first and second sectors in the cascading encryption path of the global sector set as an example. First, extract the business data from the first sector and denote it as... This means all the data in the first three blocks (3 × 16 = 48 bytes in total), and the read permission verification key for the first sector is extracted and denoted as... (6 bytes), extract the write permission verification key for the first sector and record it as... (6 bytes).

[0126] The business data of the first sector is compared with the read permission verification key. Write permission verification key The initial input data corresponding to the two keys obtained by concatenation can be represented as follows: , , for The corresponding initial input data, for The corresponding initial input data, This indicates a concatenation operation. It should be understood that the initial input data is 54 bytes.

[0127] The initial input data corresponding to the two keys in the first sector is encrypted. In this embodiment, a hash function is used for processing, which makes the key of the next sector completely dependent on the business data (Data) and original key (KeyA / KeyB) of the previous sector. Due to the one-way nature of SHA256, it is impossible to deduce the data or key stored in the previous sector from the key of the next sector.

[0128] More specifically, using hash functions right , Perform hash transformations separately to obtain the encrypted data corresponding to the two keys. and Its output length is 256 bits, or 32 bytes.

[0129] Furthermore, the encrypted data corresponding to the read permission verification key. Six bytes are selected as KeyA (read permission verification key) for the next sector, and the encrypted data corresponding to the write permission verification key is then written. Six bytes are selected as the KeyB (write permission verification key) for the next sector. As a specific example, the first six bytes of the encrypted data can be selected as the corresponding key, and the implementer can set it according to the specific implementation scenario.

[0130] Following the same method, the business data of the second sector and the updated key are concatenated and encrypted. KeyA / KeyB of the third sector can be selected, and so on, until the last sector in the cascading encryption path corresponding to the current global sector set is obtained, thus realizing the key update operation for all sectors. At this point, the encryption scheme for NFC tag data is determined.

[0131] Finally, regarding the key update encryption process in this embodiment, the card reader's reading process is as follows:

[0132] When the card reader reads content, it initiates an authentication request. The NFC card generates a random number and sends it to the reader. The reader uses its own key and the random number to encrypt and calculate the response, obtaining the result, and sends it back to the NFC card. The NFC card compares the result of the calculation using KeyA and the random number with the received response. If the key is correct, the reader can read the content stored in that sector. Based on the read content and the corresponding sector's KeyA, the reader calculates and authenticates the key for subsequent sectors, allowing the NFC card to read subsequent sector content. When the reader needs to modify the content, it simply changes KeyA to the corresponding KeyB. After modifying the content, the key KeyB needs to be modified again based on the content information to ensure the feasibility of subsequent modifications.

[0133] More specifically, the first step is that when the card reader needs to access a sector of the NFC tag to read data, it sends an authentication request to the NFC card, specifying the sector to be accessed and the operation type. Read operations require verification of KeyA, and write operations require verification of KeyB. After receiving the authentication request, the NFC card automatically generates a random number. This random number is dynamically generated by the card's built-in chip, ensuring randomness and preventing repetition or prediction, and then sends this random number to the card reader.

[0134] The second step involves the reader receiving the random number sent by the NFC card. It then retrieves the corresponding operation type key stored in its own sector. The reader uses this key to encrypt the received random number, generating an encrypted result. In practical NFC scenarios, symmetric encryption algorithms, such as DES, are commonly used for this encryption process. A brief explanation of the encryption process using KeyA is provided below. During encryption, the reader uses KeyA as the key for the DES algorithm to perform DES encryption on the random number. The specific encryption process is a well-known technique and will not be elaborated upon further here.

[0135] The third step is that after the NFC card receives the encryption result from the reader, it uses its own KeyA (which is exactly the same as the KeyA in the reader's sector) to perform the same DES encryption operation on the same random number to obtain the encryption result of the NFC card. It then compares the result with the encryption result received from the reader. If the two are exactly the same, the authentication is successful, and the reader is allowed to access the sector content; if the two are not the same, the authentication fails, and access is denied.

[0136] Therefore, when the card reader decrypts, it only needs to use the valid content and key of the previous sector, and re-perform the hash calculation according to the same rules to generate the key for the next sector, thus completing the content reading. By encrypting the same plaintext with the same key and comparing the encryption results, the legitimacy of the key is verified. In other words, through two-way authentication of the key and the random number, secure control over NFC sector access permissions is achieved.

[0137] In summary, the NFC tag data protection scheme of this invention possesses multiple security advantages and practical value. By introducing historical access data to divide and reorder sectors, it can dynamically identify and prioritize the protection of high-frequency sensitive data, achieving more reasonable data organization and security priority control. Combined with a cascading encryption mechanism, a key dependency chain is constructed between sectors, effectively preventing attackers from obtaining the entire data by cracking a single sector. A derivation strategy based on data content and key is used to generate the key for the next sector, allowing the key to be dynamically updated as the content changes, further improving the system's tamper resistance. A two-way authentication process between the reader and the NFC tag based on random numbers and keys enables fine-grained read / write permission management, ensuring the legality and security of read / write operations. It possesses high security, good scalability, and universality applicable to various NFC application scenarios, effectively improving the security protection level of NFC tags in areas such as identity authentication, access control, and data storage.

[0138] like Figure 5 As shown, this embodiment of the invention also provides an NFC tag data protection system, which is used to implement the steps of an NFC tag data protection method. The NFC tag data protection system specifically includes:

[0139] The data acquisition module is used to acquire the stored data of each sector in the NFC tag data, as well as the historical access data of each sector; wherein, the stored data includes business data and key data;

[0140] The sector partitioning module is used to partition all sectors based on the correlation between the accessed information in the historical access data of each sector and the accessed information in the historical access data of other sectors, as well as the distribution of information accessed at the same time, to obtain a global sector set.

[0141] The path analysis module is used to sort all sectors in each global sector set according to the distribution and complexity of the business data in the accessed data of each sector in each global sector set, and obtain the cascaded encryption path corresponding to each global sector set;

[0142] The security encryption module is used to update the key data of the next sector in each cascade encryption path based on the encryption results of the business data and key data of each sector, thereby obtaining a protection scheme for NFC tag data.

[0143] Since an embodiment of an NFC tag data protection method has already been described in detail, it will not be repeated here.

[0144] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A method for protecting NFC tag data, characterized in that, The method includes the following steps: The system acquires the stored data of each sector in the NFC tag data, as well as the historical access data of each sector; wherein the stored data includes business data and key data. Based on the correlation between the accessed information in the historical access data of each sector and the accessed information in the historical access data of other sectors, as well as the distribution of information accessed at the same time, all sectors are divided to obtain a global sector set. Based on the distribution and complexity of the business data in the accessed data of each sector in each global sector set, all sectors in each global sector set are sorted to obtain the cascaded encryption path corresponding to each global sector set; Based on the encryption results of the business data and key data of each sector, the key data of the next sector in each cascade encryption path is updated to obtain the protection scheme for NFC tag data.

2. The NFC tag data protection method according to claim 1, characterized in that, The process of dividing all sectors into global sector sets based on the correlation between the accessed information in the historical access data of each sector and the accessed information in the historical access data of other sectors, as well as the distribution of simultaneously accessed information, specifically includes: The historical access data includes the number of times a sector was accessed and the number of times different sectors were accessed simultaneously. Based on the number of times each sector is accessed and the number of times each sector is accessed simultaneously with other sectors, the authentication correlation index between each pair of different sectors is obtained. Based on the authentication association indicators, all sectors are divided to obtain each initial sector set and undivided sectors; Based on the correlation between the historical access data of undivided sectors and each sector in each initial sector set, and combined with the proportion of access times of each sector, the undivided sectors are divided to obtain a global sector set.

3. The NFC tag data protection method according to claim 2, characterized in that, The authentication correlation index between any two different sectors is obtained based on the number of times each sector is accessed and the number of times each sector is accessed simultaneously with other sectors. Specifically, this includes: Use any two different sectors as the first sector and the second sector, respectively. The ratio between the number of times the first and second sectors are accessed simultaneously and the number of times the first sector is accessed is used as the relative dependence of the second sector on the first sector. The average of the relative dependence of the second sector on the first sector and the relative dependence of the first sector on the second sector is used as the authentication association index between the first sector and the second sector.

4. The NFC tag data protection method according to claim 2, characterized in that, The step of dividing all sectors according to the authentication association index to obtain each initial sector set and undivided sectors specifically includes: Two different sectors whose authentication association index is greater than or equal to the preset association threshold are assigned to the same initial sector set. Sectors that do not belong to any initial sector set are unassigned sectors.

5. The NFC tag data protection method according to claim 3, characterized in that, The process involves dividing the undivided sectors based on the correlation between historical access data between the undivided sectors and each sector in each initial sector set, combined with the proportion of accesses to each sector, to obtain a global sector set. Specifically, this includes: Take any sector from the initial sector set as the third sector, and any undivided sector as the fourth sector; The ratio between the number of times the third sector is accessed and the sum of the number of times the third and fourth sectors are accessed is used as the weight corresponding to the relative dependence of the third sector on the fourth sector. The ratio between the number of times the fourth sector is accessed and the sum of the number of times the third and fourth sectors are accessed is used as the weight corresponding to the relative dependence of the fourth sector on the third sector. By using weighted proportions, the relative dependence of the third sector on the fourth sector and the relative dependence of the fourth sector on the third sector are weighted and summed to obtain the corrected correlation index between the third sector and the fourth sector. For all undivided sectors, the two sectors corresponding to the corrected correlation index being greater than or equal to the preset correlation threshold are divided into the same set to obtain the global sector set.

6. The NFC tag data protection method according to claim 1, characterized in that, The step involves sorting all sectors in each global sector set based on the distribution and complexity of the accessed business data in each sector, to obtain the cascading encryption path corresponding to each global sector set. Specifically, this includes: The data complexity of each sector in each global sector set is obtained based on the amount and complexity of non-empty data contained in the accessed business data of each sector in each global sector set. Arrange all sectors in each global sector set in descending order of data complexity to obtain the cascaded encryption path corresponding to the global sector set.

7. The NFC tag data protection method according to claim 6, characterized in that, The step of determining the data complexity of each sector in each global sector set based on the amount and complexity of non-empty data contained in the accessed business data of each sector specifically includes: For any sector in any global sector set, the number of bytes of non-empty data in the business data accessed each time the sector is accessed is taken as the first feature coefficient of the sector accessed each time; the information entropy of the non-empty data in the business data accessed each time the sector is accessed is taken as the second feature coefficient of the sector accessed each time. The average of the product of the first and second characteristic coefficients of a sector each time it is accessed is taken as the data complexity of any given sector.

8. The NFC tag data protection method according to claim 1, characterized in that, The key data includes a read permission verification key and a write permission verification key.

9. The NFC tag data protection method according to claim 8, characterized in that, The method involves updating the key data of the next sector in each cascaded encryption path based on the business data and key data of each sector to obtain a protection scheme for NFC tag data, specifically including: For any cascading encryption path, the concatenated data between the business data of each sector and each key is encrypted to obtain the encrypted data corresponding to each key. The read permission verification key of the next adjacent sector is determined based on the encrypted data of the read permission verification key, and the write permission verification key of the next adjacent sector is determined based on the encrypted data of the write permission verification key, thus obtaining the encryption scheme for NFC tag data.

10. An NFC tag data protection system, characterized in that, This system is used to implement the steps of an NFC tag data protection method as described in any one of claims 1-9, wherein the NFC tag data protection system specifically includes: The data acquisition module is used to acquire the stored data of each sector in the NFC tag data, as well as the historical access data of each sector; wherein, the stored data includes business data and key data; The sector partitioning module is used to partition all sectors based on the correlation between the accessed information in the historical access data of each sector and the accessed information in the historical access data of other sectors, as well as the distribution of information accessed at the same time, to obtain a global sector set. The path analysis module is used to sort all sectors in each global sector set according to the distribution and complexity of the business data in the accessed data of each sector in each global sector set, and obtain the cascaded encryption path corresponding to each global sector set; The security encryption module is used to update the key data of the next sector in each cascade encryption path based on the encryption results of the business data and key data of each sector, thereby obtaining a protection scheme for NFC tag data.

Images