RFID digital information read-write tag security control method and system

Abstract

This invention discloses a security control method and system for RFID digital information reading and writing tags, relating to the field of Internet of Things (IoT) information security technology. The method includes: receiving a user authentication request; generating a communication random number using a trusted tag archive backend program; encapsulating these numbers together to obtain an authentication task package; sending the authentication task package to the RFID digital information reading and writing tag; obtaining a reconstructed stable key and real-time environmental parameters; calculating a tag encrypted response credential using cryptographic signature; performing cryptographic verification of the backend program based on the tag encrypted response credential to identify trusted physical state data; and performing business policy verification of the backend program based on the trusted physical state data to obtain authorization decision results and perform dynamic data reading and writing. This invention ensures the authenticity and immutability of the physical state data in subsequent verification by binding the tag's physical identity with real-time environmental parameters at the cryptographic level.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) information security technology, and in particular to a method and system for security control of RFID digital information reading and writing tags. Background Technology

[0002] RFID digital information reading and writing tag security control technology occupies a crucial position in today's IoT asset tracking and access control field, focusing on identity authentication and data anti-tampering mechanisms. Current mainstream solutions are mainly based on pre-shared key systems and static access control policies, achieving basic encrypted communication by binding the factory master key to the tag's unique identifier, while relying on a backend database for policy matching. Traditional systems have formed mature application paradigms in fixed environment deployments, especially in logistics warehousing and smart manufacturing, where basic data security interaction is achieved through AES-128 encryption engines and the EPCglobal C1G2 protocol.

[0003] In the field of RFID digital information reading and writing tag security control, traditional solutions face limitations in two dimensions. First, pre-set key mechanisms struggle to dynamically adapt to changes in multimodal business scenarios, and the lack of deep coupling between static policies and real-time environmental parameters limits flexible control capabilities. Second, key generation and business policy execution are separated, requiring multiple independent verifications between the encryption layer and the application layer, leading to overall response delays. Especially in industrial IoT scenarios requiring high-frequency scheduling, this vertically fragmented system struggles to effectively balance security and real-time requirements. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides a security control method for RFID digital information reading and writing tags to solve the problems of lack of flexible control and delays caused by vertically fragmented architecture.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0007] In a first aspect, the present invention provides a security control method for RFID digital information reading and writing tags, which includes stimulating RFID digital information reading and writing tags, obtaining a unique identifier of the tag, and generating a stable key and tag auxiliary data after processing the physical response.

[0008] Bind the tag auxiliary data with the tag unique identifier and register it to the backend. At the same time, configure the context-aware access policy according to the tag usage scenario to obtain the trusted tag profile.

[0009] Receive user authentication requests, combine them with the trusted tag archive backend program to generate communication random numbers, and then encapsulate them together to obtain the authentication task package;

[0010] The authentication task package is sent to the RFID digital information reader / writer tag to obtain the reconstructed stable key and real-time environmental parameters. Combined with cryptographic signature calculation, the tag's encrypted response credential is obtained.

[0011] Based on the encrypted response credentials of the tag, perform cryptographic verification of the backend program to identify trusted physical state data;

[0012] Based on trusted physical state data, the backend program performs business policy verification, obtains authorization decision results, and performs dynamic data reading and writing.

[0013] As a preferred embodiment of the RFID digital information reading and writing tag security control method of the present invention, the steps of activating the RFID digital information reading and writing tag, obtaining the tag's unique identifier, processing the physical response, and generating a stable key and tag auxiliary data are as follows.

[0014] A binary digital sequence challenge is applied to the physical non-cloning function unit built into the RFID digital information reading and writing tag to obtain the physical response of microscopic difference, and at the same time, an identification command is sent to generate a unique identifier for the tag;

[0015] Based on the physical response of microscopic differences, a generation algorithm using a fuzzy extractor is employed to generate stable keys and tag auxiliary data within the RFID digital information reading and writing tag.

[0016] As a preferred embodiment of the RFID digital information reading and writing tag security control method of the present invention, the steps of binding tag auxiliary data with the tag's unique identifier and registering it to the backend, and configuring a context-aware access strategy according to the tag's usage scenario to obtain a trusted tag file are as follows.

[0017] The unique identifier of the tag is associated and paired with the tag auxiliary data through the factory calibration terminal to generate a binding relationship data packet;

[0018] The binding relationship data packet is uploaded to the key management center for storage through an encrypted channel to obtain the basic tag file and configure the context-aware access policy according to the application scenario of the tag.

[0019] After integrating the context-aware access strategy data through the cloud-based central database, a trusted tag profile is obtained.

[0020] As a preferred embodiment of the RFID digital information reading and writing tag security control method of the present invention, the steps of receiving the user authentication request, generating a communication random number in conjunction with the trusted tag file backend program, and then encapsulating them together to obtain the authentication task package are as follows.

[0021] The system uses an RFID digital information reader to identify user tag requests, obtain authentication request data, and send it to the backend program.

[0022] Based on the unique identifier of the tag in the authentication request data, the backend program retrieves and obtains the corresponding trusted tag file from the cloud central database;

[0023] Tag auxiliary data is parsed from the trusted tag archive, and the backend program generates communication random numbers through a cryptographically secure random number generator. The two are then packaged together to obtain the authentication task package.

[0024] As a preferred embodiment of the RFID digital information read / write tag security control method of the present invention, the steps of sending the authentication task package to the RFID digital information read / write tag, obtaining the reconstructed stable key and real-time environmental parameters, and obtaining the tag's encrypted response credential through cryptographic signature calculation are as follows.

[0025] The authentication task package is sent via the radio frequency communication interface through the RFID digital information reader / writer, and received by the RFID digital information reader / writer tag through radio frequency signals.

[0026] Based on the tag auxiliary data in the authentication task package, the reconstruction algorithm of the fuzz extractor is invoked, and the noisy response generated in real time by the PUF unit is combined to obtain the reconstruction stable key;

[0027] Based on the reconstructed stable key and real-time environmental parameters, combined with communication random numbers, a hash-based message authentication code algorithm is used to generate a tag-encrypted response credential.

[0028] As a preferred embodiment of the RFID digital information reading and writing tag security control method of the present invention, the steps of performing cryptographic verification of the backend program based on the tag's encrypted response credential to identify trusted physical state data are as follows:

[0029] The RFID digital information reader uploads the encrypted response certificate of the tag to the backend program, and the fuzz extractor reconstructs the algorithm to generate a stable key for the tag.

[0030] Based on the tag-based stable key, a hash-based message authentication code algorithm is executed by the backend program to generate backend-computed credentials;

[0031] By comparing the encrypted response credentials of the tag with the backend calculated credentials, trusted physical state data can be obtained while ensuring consistency and passing cryptographic verification.

[0032] As a preferred embodiment of the RFID digital information reading and writing tag security control method of the present invention, the steps of performing business policy verification based on trusted physical state data, obtaining authorization decision results, and performing dynamic data reading and writing are as follows:

[0033] The executable rule set is obtained by parsing the rule logic in the context-aware access strategy through the backend program;

[0034] The matching degree between the executable rule set and the trusted physical state data is calculated by the rule engine and compared with the adjudication threshold;

[0035] Based on the comparison results, the backend program executes the authorization decision, obtains the authorization decision result, and performs dynamic data reading and writing through an RFID digital information reader.

[0036] Secondly, this invention provides an RFID digital information reading and writing tag security control system, comprising: a data acquisition module for stimulating RFID digital information reading and writing tags, obtaining a unique tag identifier, and generating a stable key and tag auxiliary data after processing the physical response; a file generation module for binding the tag auxiliary data and the tag unique identifier and registering them to the backend, and configuring a context-aware access policy according to the tag usage scenario to obtain a trusted tag file; a user authentication module for receiving user authentication requests, generating communication random numbers in conjunction with the trusted tag file backend program, and encapsulating them together to obtain an authentication task package; a credential generation module for sending the authentication task package to the RFID digital information reading and writing tag, obtaining a reconstructed stable key and real-time environmental parameters, and obtaining a tag encrypted response credential by combining cryptographic signature calculation; a credential authentication module for performing cryptographic verification of the backend program based on the tag encrypted response credential to identify trusted physical state data; and an authorization decision module for performing business policy verification of the backend program based on the trusted physical state data, obtaining authorization decision results, and performing dynamic data reading and writing.

[0037] Thirdly, the present invention provides a computer device including a memory and a processor, wherein the memory stores a computer program, wherein when the computer program is executed by the processor, it implements any step of the RFID digital information reading and writing tag security control method as described in the first aspect of the present invention.

[0038] Fourthly, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the RFID digital information reading and writing tag security control method as described in the first aspect of the present invention.

[0039] The beneficial effects of this invention are as follows: by binding the physical identity of the tag with real-time environmental parameters at the cryptographic level, the authenticity and immutability of the physical state data in subsequent verification are guaranteed. It can be widely used in asset management and process control fields with strict requirements on environmental state, and achieves the effect of expanding the authentication dimension from simple digital identity to trusted physical state data. Attached Figure Description

[0040] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0041] Figure 1 A flowchart for a security control method for reading and writing RFID digital information tags.

[0042] Figure 2 This is a schematic diagram of an RFID digital information reading and writing tag security control system.

[0043] Figure 3 This is the core flowchart for RFID security control.

[0044] Figure 4 Flowchart for generating and verifying encrypted response credentials for tags. Detailed Implementation

[0045] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0046] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0047] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0048] Reference Figures 1-4 This is one embodiment of the present invention, which provides a security control method for RFID digital information reading and writing tags, including the following steps:

[0049] S1. Excite RFID digital information to read and write tags, obtain the unique identifier of the tag, process the physical response through the generation algorithm of the fuzzy extractor, and generate a stable key and tag auxiliary data;

[0050] A binary digital sequence challenge is applied to the physical non-cloning function unit built into the RFID digital information reading and writing tag to obtain the physical response of microscopic difference, and at the same time, an identification command is sent to generate a unique identifier for the tag;

[0051] It should be noted that the physically non-cloning function unit (PTF) is a semiconductor hardware structure embedded within the RFID digital information read / write tag chip. It relies on uncontrollable microscopic process deviations during integrated circuit manufacturing, including intrinsic random characteristics such as random discrete distribution of transistor voltages, non-uniformity of metal interconnect linewidth etching, and space fluctuations in doping concentration. The hardware entity of the PTF consists of a nanoscale array of circuit elements, forming an uncopyable physical topology on a silicon substrate. It achieves hardware-level authentication by transforming an externally input binary digital sequence challenge into a unique physical characteristic response.

[0052] The binary digital sequence challenge, used as an electrical excitation signal, activates the entropy source characteristics of physically non-cloning function (PCF) cells. Its core functions include: controlling the on-state of the CMOS switch array to select signal transmission paths; modulating carrier migration behavior within transistor channels; and stimulating path delay differences caused by process variations. Different combinations of binary digital sequence challenges can access thousands of response modes within PCF cells.

[0053] Furthermore, a binary digital sequence challenge with a specific encoding format is applied to the physically non-cloning function (PCF) unit built into the RFID digital information reader / writer tag. This binary digital sequence is injected as an electrical excitation signal into the integrated circuit structure within the PCF unit. The injection triggers inherent process deviation effects in the PCF unit's semiconductor substrate material, causing random fluctuations in charge carrier mobility and discrete distributions in transistor voltage. This drives the PCF unit to output a unique and unpredictable analog characteristic signal, i.e., a microscopic difference physical response. Simultaneously, an identification command conforming to the ISO / IEC 18000-63 standard is sent to the RFID digital information reader / writer tag. The RFID digital information reader / writer tag's baseband processor parses the identification command and activates the EPC encoding block stored in memory. A unique tag identifier conforming to the EPCglobal Gen2 V2 specification is generated by modulating the radio frequency carrier signal.

[0054] It should be noted that the microscopic difference physical response is the physical characteristic signal output by a physically non-cloning function (PCF) unit after being challenged and excited by a binary digital sequence. It is determined by the intrinsic randomness of the nanoscale circuit elements within the PCF unit and depends on the atomic-level irregularities during the manufacturing process. It is the combined result of phenomena such as the random thermal motion of charge carriers in the doped region, the quantum tunneling effect of the gate dielectric layer, and the random fluctuations in electromigration of the metal interconnect. The response types of the microscopic difference physical response include voltage domain response, time domain response, frequency domain response, current domain response, and digital quantization response. The analog characteristic signal output by the PCF unit belongs to the voltage domain response within the microscopic difference physical response.

[0055] Based on the physical response of microscopic differences, a generation algorithm using a fuzzy extractor is employed to generate stable keys and tag auxiliary data within the RFID digital information reading and writing tag.

[0056] Furthermore, within the RFID digital information reading and writing tag, based on the microscopic difference physical response, the fuzzy extractor's generation algorithm first extracts entropy source features. This involves filtering high-frequency thermal noise and capturing steady-state DC offset components through a synchronous sampling window. Subsequently, non-uniform quantization grading processing is performed, employing differential bit precision encoding for different fluctuation ranges. For example, in strong deviation regions (such as voltage fluctuations > ±150mV), each sample has 1 bit, while in weak deviation regions (such as voltage fluctuations between ±50 and 150mV), each sample has 2 bits, generating an original entropy sequence that meets the ISO / IEC 19790 standard. Then, a security sketch protocol is executed, using a BCH(255,131) error correction code processor to calculate redundant check bits. XOR operations are used to generate tag auxiliary data that does not reveal entropy source information. Simultaneously, the original entropy sequence is input into a Keccak-256 hash function, combined with an anti-replay identifier for irreversible diffusion processing, generating a stable key. Finally, a triple tag auxiliary data structure containing security sketch data, error correction code type identifier, and hash function identifier is encapsulated. The entire process is completed within an integrated dedicated security coprocessor. Through dynamic compression storage and logic gate optimization, the gate size (e.g., 1.2K) and static power consumption (e.g., achieving 36 microamps of static power consumption at a 1.8-volt operating voltage) are controlled. This ensures that stable keys are stored in volatile memory to achieve physical anti-extraction, while also guaranteeing the secure storage characteristics of tag auxiliary data in the public cloud and the verifiable hardware fingerprint traceability capability.

[0057] S2. Bind the tag auxiliary data with the tag unique identifier and register it to the backend. At the same time, configure the context-aware access strategy according to the tag usage scenario to obtain the trusted tag profile.

[0058] The factory calibration terminal associates and pairs the tag's unique identifier with the tag's auxiliary data to generate a binding relationship data packet.

[0059] Furthermore, during the factory production testing phase, the factory calibration terminal reads the unique tag identifier compliant with the EPCglobal Gen2 V2 specification stored in the RFID digital information read / write tag via a dedicated radio frequency interface. Simultaneously, it acquires the tag auxiliary data (including security sketch data, error correction code type identifier, and hash function identifier) ​​output by the fuzz extractor algorithm via physical probe contacts. Subsequently, it executes a cryptographic binding protocol, encrypts the tag auxiliary data with the factory master key using the AES-GCM algorithm, generates a ciphertext payload, and performs SHA-256 hash fusion calculation with the tag unique identifier to output a binding digest value. Finally, it constructs a triple binding relationship data packet, including the plaintext tag unique identifier, the encrypted tag auxiliary data ciphertext, and the binding digest value, and adds a digital signature and timestamp based on an X.509 certificate to form a binding relationship data packet with integrity and non-repudiation.

[0060] It should be noted that the factory master key is a key managed at a higher level. Typically, there is only one, generated by the factory and the brand, and securely stored in tamper-proof devices such as a Hardware Security Module (HSM). It does not change with individual tag differences; all tags produced in the same batch use the same factory master key. The factory master key represents the trustworthiness of the production environment. During the tag production testing phase, when auxiliary tag data is encrypted, the factory master key ensures that only trusted factory equipment can generate legitimate and protected tag data.

[0061] The binding relationship data packet is uploaded to the key management center for storage through an encrypted channel to obtain the basic tag file, and a context-aware access policy is configured according to the tag's application scenario.

[0062] Furthermore, after the binding relationship data packet is generated, the factory calibration terminal uploads a structured data packet containing the plaintext tag unique identifier, AES-GCM encrypted tag auxiliary data ciphertext, and SHA-256 binding digest to the hardware security module of the key management center through a two-way authentication encrypted channel established based on the TLS 1.3 protocol (such as using ECDHE-ECDSA key exchange and AES-256-GCM encryption suite). After decrypting the tag auxiliary data inside the HSM, the key management center associates the tag auxiliary data with the tag unique identifier and stores it in an encrypted database resistant to side-channel attacks. This generates a tag basic file consisting of tag basic attributes (such as storage address and access permission flags) and physical fingerprint features (such as micro-difference response hash values). At the same time, it initializes the context-aware access policy template based on the environmental constraint data of the tag deployment scenario (such as temperature control values ​​for medical equipment transportation and geofence coordinates for military storage) based on RFID digital information reading and writing. The policy engine parses the multi-dimensional rule logic in the template to generate an executable policy rule set and binds it to the tag basic file.

[0063] After integrating the context-aware access strategy data through the cloud-based central database, a trusted tag profile is obtained.

[0064] It should be noted that the cloud-based central database employs a distributed and quantum-resistant storage architecture, deeply integrated with a policy integration engine and blockchain consensus mechanism. This serves as the core data infrastructure for unified storage, secure processing, and persistent preservation of the data, from basic tag files and access policy rule sets to the final trusted tag file entity. The cloud-based central database receives and stores basic tag files, loads and configures corresponding context-aware access policies for them, and ultimately, through collaboration with the policy integration engine, transforms these two separate static data sets into a securely enhanced, directly executable trusted tag file entity that can be executed by the backend system.

[0065] Furthermore, in the cloud-based central database operation, the tag base file and context-aware access policy rule set from the key management center are input into the policy integration engine. The policy integration engine performs a three-stage process. First, it uses an ontology reasoning algorithm (such as one based on the OWL 2DL semantic framework) to resolve rule conflicts (such as logical contradictions between spatial coordinates and temperature constraints) and generate a conflict-free policy decision tree. Then, it uses the physical fingerprint features in the tag base file as the primary index key to deeply associate and bind them with the policy decision tree. Finally, it adds a data integrity protection layer, calculates the SHA-384 digest values ​​of the tag base file and the policy decision tree, and executes an ECDSA-SHA512 digital signature using the root certificate private key of the cloud key management center to form a trusted metadata block containing a version number, effective timestamp, and distributed storage path. After integration, it is encapsulated into a four-dimensional trusted tag file entity, including a tag base file data area, a policy decision tree code area, a digital signature certificate chain area, and a trusted metadata area. After being verified by blockchain node consensus, it is written into a quantum-resistant multi-replica distributed storage array. At the same time, hot data replicas are cached on near-field edge computing nodes to support low-latency access.

[0066] S3. Receive user authentication requests, combine them with the trusted tag archive backend program to generate communication random numbers, and encapsulate them together to obtain the authentication task package.

[0067] The system uses an RFID digital information reader to identify user tag requests, obtain authentication request data, and send it to the backend program.

[0068] It should be noted that a user tag request refers to a business intent and physical action initiated by a user that requires interaction with an RFID tag. When a user initiates an authentication interaction, this intent is generated. The RFID digital information reader recognizes the user request, and the carrier signal emitted by the RFID digital information reader antenna successfully activates an RFID digital information reader tag in the field and successfully receives the initial response frame returned by the RFID digital information reader tag.

[0069] The authentication request data is a binary data packet processed and encapsulated internally by the RFID digital information reader. It is formed after the user's tag request is identified and the initial response of the tag is successfully received. First, the core tag unique identifier is extracted from the response frame. Then, the tag unique identifier is triple-checked with CRC, time window and signal strength to ensure the reliability of physical communication. Finally, the verified tag unique identifier is encapsulated with the RFID digital information reader's own additional information (including RFID digital information reader device ID, timestamp and random session identifier) ​​and an HMAC-SHA256 message authentication code calculated based on the reader's own private key is attached to ensure the integrity and authenticity of the data packet.

[0070] Furthermore, when a user initiates an authentication interaction, the RFID digital information reader transmits a carrier signal conforming to the ISO / IEC 18000-63 standard through its antenna array, activating the target RFID digital information reader tag within the effective radiation field. After capturing radio frequency energy through a coupled resonant circuit, the RFID digital information reader tag returns an EPCglobalGen2 string containing the tag's unique identifier to the RFID digital information reader. The V2 protocol response frame (such as a 96-bit EPC code + 8-bit access password) is parsed by the RFID digital information reader's baseband processor, which executes a physical layer collision avoidance algorithm to extract the payload data. Simultaneously, the built-in security coprocessor performs triple verification on the original response, including CRC-16 cyclic redundancy check, tag response time window verification, and carrier signal strength judgment. Upon successful verification, the original user tag request data and supplementary authentication fields (including the RFID digital information reader device ID, timestamp, and random session identifier) ​​are encapsulated into a binary structured authentication request data packet. This packet contains the tag's unique identifier, the RFID digital information reader device ID, timestamp, and random session identifier, along with an HMAC-SHA256 message authentication code based on the reader's private key. This data packet is then sent to the backend program via Ethernet and a TLS encrypted channel, completing identity verification and secure data transmission.

[0071] Based on the unique identifier of the tag in the authentication request data, the backend program retrieves and obtains the corresponding trusted tag file from the cloud central database.

[0072] Furthermore, after the backend program receives the authentication request data packet, it extracts the unique tag identifier embedded in the authentication request data packet as the main retrieval key value. It converts the key value into a hash index value using the SHA-3 algorithm to hide the original EPC code. The distributed query engine of the cloud central database traverses the encrypted index tree resistant to side-channel attacks based on the hash index value to locate the physical block address of the trusted tag file stored in the quantum attack resistant storage cluster. Then, it initiates a ciphertext retrieval protocol and uses the hardware security module of the key management center to dynamically decrypt the stored ciphertext. It performs integrity verification of the trusted tag file in the memory security isolation area (verifying the integrity of the data including the trusted tag file version number, digital signature certificate chain, and SHA-384 digest value). After passing the verification, it loads the four-dimensional trusted tag file, including the tag basic file data area (containing tag auxiliary data and physical fingerprint features), the policy decision tree code area (executable logic of context-aware access policy), the digital signature certificate chain area (X.509 certificate chain and ECDSA signature), and the trusted metadata area (distributed storage path and expiration mark). The trusted tag file is then injected into the trusted execution environment of the backend program, completing the entire process of encrypted mapping from identifier to file.

[0073] Tag auxiliary data is parsed from the trusted tag archive, and the backend program generates communication random numbers through a cryptographically secure random number generator. The two are then packaged together to obtain the authentication task package.

[0074] Furthermore, within the backend program's memory-secure isolation zone, the tag auxiliary data structure (including security sketch data, error correction code type identifier, and hash function identifier) ​​is extracted from the tag basic file data area based on the trusted tag file. Simultaneously, a cryptographically secure random number generator (NIST SP800-90A standard CTR_DRBG algorithm) is invoked to generate communication random numbers. Next, the data joint encapsulation protocol is executed: the tag auxiliary data structure and communication random numbers are merged into a SEQUENCE data structure using the ASN.1DER encoding rule, and necessary encryption channel parameters (including RFID reader device ID, session timestamp, and key identifier) ​​are injected and encapsulated. Finally, the RSA-OAEP algorithm is used for encryption encapsulation to generate a three-part authentication task packet containing a header version identifier, a payload ciphertext block, and a tail digest value, thus completing the construction of a dynamic transmission primitive that combines data confidentiality and integrity.

[0075] S4. Send the authentication task package to the RFID digital information reading and writing tag, obtain the reconstruction stable key and real-time environmental parameters through the reconstruction algorithm of the fuzzy extractor, and obtain the tag's encrypted response credential by combining the cryptographic signature calculation.

[0076] The authentication task package is sent via the radio frequency communication interface through the RFID digital information reader, and received by the RFID digital information reader tag through radio frequency signals.

[0077] Furthermore, upon receiving the authentication task package from the backend, the baseband processor of the RFID digital information reader first encodes the binary data stream of the authentication task package. Using a pulse interval encoding scheme conforming to the ISO / IEC 18000-63 standard, the logical bit sequence is converted into a specific radio frequency pulse timing sequence. Subsequently, the encoded baseband signal is up-converted and modulated onto an ultra-high frequency carrier signal. The signal is then amplified by a radio frequency front-end power amplifier, and the modulated radio frequency energy is radiated into space in the form of electromagnetic waves through the radio frequency communication interface by the antenna array, forming an effective communication field that accurately covers the target area. When the target RFID digital information reading and writing tag enters the effective communication field, the built-in coupled resonant antenna circuit captures rectified microwave energy from the continuous carrier signal and receives the radio frequency signal, providing a stable power supply for the logic circuit (including the security coprocessor) inside the target RFID digital information reading and writing tag. At the same time, the tag's radio frequency front-end circuit demodulates the received modulated signal and restores the radio frequency pulse timing to the original binary data stream through accurate detection of the signal envelope. Thus, the authentication task packet is completely reconstructed in the tag's internal buffer, providing data input for subsequent security calculations and responses.

[0078] Based on the tag auxiliary data in the authentication task package, the reconstruction algorithm of the fuzz extractor is invoked, and combined with the noisy response generated in real time by the PUF unit, a stable reconstruction key is obtained.

[0079] Furthermore, within the RFID digital information read / write tag, the decoding engine corresponding to the error correction code type identifier is matched based on the tag auxiliary data structure obtained from the authentication task package parsing. Then, the noisy response output in real time from the physical non-cloning function unit is input to the ADC sampling circuit to generate the original entropy sequence containing environmental interference. The reconstruction algorithm of the fuzzy extractor is called, and error correction is performed based on the security sketch data to recover the noisy error correction code. Subsequently, a hard-decision decoder eliminates bit errors (such as noise shifts caused by temperature drift and electromagnetic interference) due to bit error rate (e.g., ≤19.6%, determined by the 18-bit error correction capability of the decoding engine's error correction code combined with multiple engineering security redundancy). The original entropy sequence E is reconstructed, and finally, E is input into the Keccak-256 hash engine. Combined with the salt value parameter specified by the hash function identifier in the tag auxiliary data, a key diffusion operation is performed, outputting a 256-bit noise-resistant reconstruction stable key. The core cryptographic transformation formula for reconstructing the stable key in the RFID digital information read / write tag is...

[0080] K′=Keccak256(E||s);

[0081] Where K′ represents the reconstructed stable key, which is the 256-bit cryptographic key finally generated by the RFID digital information reading and writing tag; E represents the original entropy sequence; and s represents the salt value parameter, which is the anti-replay salt value, a 128-bit random fixed value pre-stored in the tag.

[0082] Based on the reconstructed stable key and real-time environmental parameters, combined with communication random numbers, a hash-based message authentication code algorithm is used to generate a tag-encrypted response credential.

[0083] Furthermore, within the secure coprocessor for RFID digital information reading and writing tags, based on the reconstructed stable key and real-time environmental parameters, the communication random number is used as a dynamic entropy source for key derivation processing with the reconstructed stable key. Specifically, the HKDF-SHA256 algorithm is used, with the reconstructed stable key as the input key material and the communication random number as the salt value, to generate a session-derived key. Subsequently, the timestamp encoding of the environmental parameters is used as the header, the environmental parameters are used as the middle, and the communication random number is appended to the tail to construct the message structure to be authenticated. Then, the HMAC-SHA-384 algorithm is called, with the session-derived key as the authentication key, to perform a keyed hash operation on the message structure to be authenticated. Finally, a tag encrypted response credential containing the message authentication code, a copy of the communication random number, and an integrity flag is output.

[0084] S5. Based on the encrypted response credentials of the tag, perform cryptographic verification of the backend program to identify trusted physical state data;

[0085] The RFID digital information reader uploads the encrypted response certificate of the tag to the backend program, and the fuzz extractor reconstructs the algorithm to generate a stable key for the tag.

[0086] Furthermore, after the RFID digital information reader transmits the encrypted response certificate of the tag to the backend program through a secure channel, the backend program first extracts the message authentication code, communication random number copy, and integrity flag from the certificate. After verifying the data integrity, it separates the physical state ciphertext payload. Then, it calls the fuzzy extractor reconstruction algorithm's dedicated engine. Based on the tag auxiliary data in the trusted tag file and the physical non-cloning function unit registration response benchmark value stored in the backend, it performs noise-tolerant reconstruction calculation. That is, it recovers the initial error correction code by XORing the secure sketch data with the benchmark value, and then compares it with the noisy response sequence after the real-time physical state ciphertext payload is decrypted to correct the error. After eliminating environmental noise interference, it reconstructs the original entropy sequence E. Finally, E is input into the Keccak-256 hash engine, and the tag stable key derivation operation is performed in combination with the communication random number copy and the pre-stored salt value parameter.

[0087] K2 = Keccak256(E||s||r);

[0088] Where K2 represents the tag stable key, E represents the original entropy sequence, s represents the salt value parameter (i.e., the replay protection salt value), and r represents the communication random number copy.

[0089] Based on the tag-based stable key, a hash-based message authentication code algorithm is executed by the backend program to generate backend-computed credentials;

[0090] Furthermore, within the trusted execution environment of the backend program, based on the tag stable key and trusted physical state data, the system first collects a timestamp of the physical state in the header, the physical state in the middle, and appends the communication random number of the current session to the tail to form a standardized input for constructing the message body to be authenticated. Then, the hardware-accelerated HMAC-SHA-384 algorithm engine is called to perform a keyed hash operation on the message body to be authenticated using the tag stable key as the authentication key. That is, the key and message block are iteratively processed through the SHA-384 sponge structure, and intermediate state values ​​are generated through nonlinear transformation (such as 24 rounds). Finally, the message authentication code is output as the backend calculation credential.

[0091] By comparing the encrypted response credentials of the tag with the backend calculated credentials, trusted physical state data can be obtained while ensuring consistency and passing cryptographic verification.

[0092] Furthermore, in the backend program's security verification engine, a binary-level string comparison is first performed between the tag-encrypted response credential and the backend computation credential. This involves verifying the Hamming distance of the message authentication code field bit by bit using a hardware-accelerated bit-parallel comparison circuit. When the difference in the number of bits is less than or equal to the fault tolerance threshold (e.g., a 6-bit difference, determined jointly by the avalanche effect security boundary of the HMAC-SHA-384 algorithm, the memory hardware bit error rate, and the radio frequency transmission bit error rate), it is considered consistent. Simultaneously, the cryptographic verification coprocessor is activated to verify the timing consistency between the communication random number copy and the original value in the authentication task packet, verify the CRC-16 cyclic redundancy check value of the integrity flag, and check the validity of the digital signature certificate chain. Under the condition that both string consistency and cryptographic verification are passed, the physical state ciphertext payload is extracted and decrypted from the tag-encrypted response credential, and structured trusted physical state data is output.

[0093] It should be noted that the trusted physical state data includes ambient temperature data, three-dimensional acceleration data, geographic location coordinate timestamps, and motion state markers, providing multi-dimensional physical world state input for the context-aware access strategy.

[0094] S6. Based on trusted physical state data, perform business policy verification of the backend program, obtain authorization decision results, and perform dynamic data reading and writing.

[0095] The executable rule set is obtained by parsing the rule logic in the context-aware access strategy through the backend program;

[0096] It should be noted that in the context-aware access strategy of the RFID security control system, rule logic refers to the medium that transforms human-readable security policies into machine-executable mathematical and logical operations. The core includes atomic predicate expressions generated based on natural language processing, a composite decision tree structure composed of Boolean, temporal and spatial logic operators, a priority encoding mechanism for resolving policy conflicts, and fuzzy tolerance parameters for handling boundary conditions. Through a semantic parser, ontology inference engine and LLVM compilation toolchain, it is transformed into a binary instruction sequence that can be directly loaded and executed by the security coprocessor.

[0097] Furthermore, in the policy engine of the backend program, the context-aware access policy based on the trusted tag archive storage performs semantic parsing and logical transformation. That is, the context-aware access policy text is decomposed into atomic logical expressions by the natural language processing unit based on the BERT model. Then, the ontology inference engine based on OWL 2DL is used to resolve rule conflicts (such as prioritizing the retention of security policies when spatial constraints and temporal conditions conflict), generating a conflict-free decision tree structure. The LLVM intermediate code generator is called to compile the conflict-free decision tree structure into an IR instruction sequence (including conditional jumps, threshold comparisons, and logic gate operations), generating a decision tree instruction sequence. Finally, the target hardware adaptation layer generates an executable rule set that can be directly loaded and executed by the security coprocessor.

[0098] The matching degree between the executable rule set and the trusted physical state data is calculated by the rule engine and compared with the adjudication threshold;

[0099] It should be noted that the decision threshold is set based on a triple constraint: in accordance with the ISO / IEC 27001 safety standard, construction operations must maintain a safety margin (e.g., 15%), and a minimum matching degree (e.g., 85% matching degree ≥ 0.85) is determined; through ROC curve analysis of test samples, an optimal balance is achieved (e.g., false rejection rate < 0.1% and false acceptance rate < 0.01% Pareto), while integrating a dynamic risk control mechanism, which is adjusted in real time through quantitative risk control methods to form a verifiable benchmark value that takes into account both mandatory safety and scenario adaptability.

[0100] Furthermore, during the security policy execution phase, the backend program's rule engine loads the executable rule set, parses the trusted physical state data into environmental parameter vectors such as temperature, acceleration, and location according to the field offsets defined in the rules, and then traverses the decision tree instruction sequence. For each rule, hardware-accelerated matching degree calculation is performed, using a dynamic weight model (e.g., temperature rule weight 0.3, location rule weight 0.5) to calculate Boolean condition satisfaction (e.g., true = 1.0, false = 0.0). Weighted scores are aggregated using a floating-point multiply-accumulate unit (FMA). For spatial fencing, the geometric coprocessor is invoked to perform ray-based point inclusion determination, outputting a matching degree scalar (e.g., 0.0–1.0). Finally, all rule scores are summarized to generate a comprehensive matching degree value, which is compared in real-time with the adjudication threshold (e.g., 0.85) in the comparator circuit.

[0101] If the overall matching degree value is greater than or equal to the adjudication threshold, the authorization decision flag will be triggered.

[0102] If the overall matching score is less than the adjudication threshold, a rejection flag is triggered.

[0103] Based on the comparison results, the backend program executes the authorization decision, obtains the authorization decision result, and performs dynamic data reading and writing through an RFID digital information reader.

[0104] Furthermore, in the authorization adjudication unit of the backend program, based on the comparison result of the comprehensive matching degree value output by the rule engine and the adjudication threshold, a binary authorization decision result is generated through the hardware state machine. The first byte is the operation instruction code, the second byte is the permission level, and the last byte is the security checksum. Then, the authorization decision result and the data to be read and written are encapsulated together into an instruction frame, which is encrypted using the AES-256-GCM algorithm (the initial vector is a communication random number) to generate a ciphertext payload. The RFID digital information reader modulates the encrypted instruction frame onto a 915MHz carrier through the radio frequency interface and sends a write command to the RFID digital information reader tag. After receiving the command, the RFID digital information reader tag decrypts and verifies the CRC checksum. If the verification passes, the data read / write is executed; if the verification fails, the data read / write is rejected.

[0105] This embodiment also provides an RFID digital information reading and writing tag security control system, including: a data acquisition module, used to stimulate RFID digital information reading and writing tags, obtain the tag's unique identifier, process the physical response, and generate a stable key and tag auxiliary data; a file generation module, used to bind the tag auxiliary data and the tag's unique identifier and register them to the backend, and configure a context-aware access policy according to the tag's usage scenario to obtain a trusted tag file; a user authentication module, used to receive user authentication requests, combine the trusted tag file backend program to generate communication random numbers, and encapsulate them together to obtain an authentication task package; a credential generation module, used to send the authentication task package to the RFID digital information reading and writing tag, obtain the reconstructed stable key and real-time environmental parameters, and combine cryptographic signature calculation to obtain the tag's encrypted response credential; a credential authentication module, used to perform cryptographic verification of the backend program based on the tag's encrypted response credential to identify trusted physical state data; and an authorization decision module, used to perform business policy verification of the backend program based on trusted physical state data, obtain authorization decision results, and perform dynamic data reading and writing.

[0106] This embodiment also provides a computer device applicable to the RFID digital information reading and writing tag security control method, including: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the RFID digital information reading and writing tag security control method proposed in the above embodiment.

[0107] The computer device can be a terminal, comprising a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0108] This embodiment also provides a storage medium storing a computer program. When executed by a processor, the program implements the RFID digital information reading and writing tag security control method proposed in the above embodiments. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0109] In summary, this invention binds the physical identity of a tag to real-time environmental parameters at the cryptographic level, ensuring the authenticity and immutability of physical state data in subsequent verification. It can be widely applied in asset management and process control fields with strict requirements for environmental status, achieving the effect of expanding the authentication dimension from simple digital identity to trusted physical state data.

[0110] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A security control method for RFID digital information reading and writing tags, characterized in that: The application relates to a method for generating a stable key and label auxiliary data based on a micro-difference physical response of an RFID digital information read-write label. The method comprises the following steps of: A binary digital sequence challenge is applied to a physically unclonable function unit built in the RFID digital information read-write label to obtain a micro-difference physical response, and an identity identification instruction is sent to generate a label unique identifier. Based on the micro-difference physical response, a stable key and label auxiliary data are generated in the RFID digital information read-write label by using a generation algorithm of a fuzzy extractor. The label auxiliary data comprises security sketch data, error correction code type identification and hash function identification. The label auxiliary data and the label unique identifier are bound and registered to a backend, and a scenario-aware access strategy is configured according to a label use scene to obtain a trusted label profile. The label unique identifier and the label auxiliary data are associated and paired to generate a binding relationship data packet. The binding relationship data packet is uploaded to a key management center for storage to obtain a label basic profile. The cloud center database is used to configure a corresponding scenario-aware access strategy for the label basic profile. The label basic profile and the scenario-aware access strategy are integrated to obtain the trusted label profile. The trusted label profile comprises the label auxiliary data, the label unique identifier and the scenario-aware access strategy. A user authentication request is received, a communication random number is generated by combining a trusted label profile backend program, and an authentication task packet is obtained after encapsulation. A user label request is identified by an RFID digital information read-write device, authentication request data is obtained and sent to a backend program. Based on the label unique identifier in the authentication request data, the backend program retrieves and obtains the corresponding trusted label profile from the cloud center database. The label auxiliary data is parsed from the trusted label profile, and a communication random number is generated by the backend program through a cryptographically secure random number generator, and an authentication task packet is obtained after encapsulation. The authentication task packet is sent to the RFID digital information read-write label to obtain a reconstructed stable key and real-time environmental parameters, and a label encrypted response credential is obtained by combining a cryptographically signed calculation. According to the label encrypted response credential, the cryptographically verified backend program is executed to identify the trusted physical state data. Based on the trusted physical state data, the business strategy verification of the backend program is executed to obtain an authorization decision result and perform data dynamic reading and writing.

2. The RFID digital information read-write tag security control method of claim 1, wherein: The label auxiliary data and the label unique identifier are bound and registered to the backend, and the scenario-aware access strategy is configured according to the label use scene to obtain the trusted label profile. The label unique identifier and the label auxiliary data are associated and paired by a factory calibration terminal to generate a binding relationship data packet. The binding relationship data packet is uploaded to the key management center through an encrypted channel for storage to obtain the label basic profile, and the scenario-aware access strategy is configured according to the application scene of the label. The trusted label profile is obtained after the data integration of the scenario-aware access strategy by the cloud center database.

3. The RFID digital information read-write tag security control method of claim 1, wherein: The authentication task package is sent to the RFID digital information read-write label to obtain a reconstructed stable key and real-time environment parameters, and a label encrypted response credential is obtained through cryptographic signature calculation, and the steps are as follows, The authentication task package is sent to the RFID digital information read-write label to obtain a reconstructed stable key and real-time environment parameters, and a label encrypted response credential is obtained through cryptographic signature calculation, and the steps are as follows, According to the label auxiliary data in the authentication task package, the reconstruction algorithm of the fuzzy extractor is called, and the reconstructed stable key is obtained in combination with the real-time noise response generated by the PUF unit; Based on the reconstructed stable key and the real-time environment parameters, a label encrypted response credential is generated through the hash message authentication code algorithm in combination with the communication random number.

4. The RFID digital information read-write tag security control method of claim 1, wherein: The processor executes the computer program to realize the steps of the RFID digital information read-write label security control method in any one of claims 1-5. The processor executes the computer program to realize the steps of the RFID digital information read-write label security control method in any one of claims 1-5. ​ ​ 5. The RFID digital information read-write tag security control method of claim 1, wherein: ​ ​ ​ ​ 6. An RFID digital information read-write tag security control system based on the RFID digital information read-write tag security control method according to any one of claims 1 to 5, characterized in that: ​ ​ ​ ​ ​ ​ ​ 7.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is characterized in that: ​ 8. A computer readable storage medium having stored thereon a computer program, characterized in that: The computer program is executed by a processor to realize the steps of the RFID digital information read-write tag security control method according to any one of claims 1-5.

Images