Personnel passing verification method and system based on space-time rule dynamic matching

Abstract

The invention provides a personnel passing verification method and system based on space-time rule dynamic matching. The method comprises the following steps: identifying the identity of a passing person to obtain an identity label; acquiring current spatio-temporal information including current time and current position; according to the current spatio-temporal information, dynamic matching is carried out from a preset spatio-temporal rule set, a dynamic permission group is generated, and the rule set comprises a permission group template formed by combining authorization rules of a time dimension and authorization rules of a space dimension; and judging the passing authority according to the identity label and the dynamic authority group and outputting a decision result. The system comprises an identity recognition module, a spatio-temporal information acquisition module, an authority verification and decision module and an execution module which are used for executing the method. The invention relates to the technical field of personnel access verification, and in addition, the invention also relates to the field of Internet, cloud computing and big data service.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of personnel access verification, in particular to a personnel access verification method and system based on dynamic matching of space-time rules. In addition, the present application also relates to the field of Internet and cloud computing, big data services. BACKGROUND

[0002] With the continuous improvement of security management needs, personnel access verification technology has developed from the early simple access card recognition to the intelligent stage combined with biometric recognition. In the prior art, the management of access rights is mostly dependent on the fixed permission list or grouping set for personnel in advance, and is controlled in combination with a time table. Some advanced systems begin to try to introduce single-dimensional rules based on time or location to achieve access control under certain conditions, thereby improving the convenience and security of the access control system.

[0003] However, the existing permission management method usually configures and manages the time rules and space rules statically and independently, and the validity of the permission depends on the fixed combination defined by human beings in advance, lacking a mechanism for dynamically synthesizing permissions according to real-time scenarios. This leads to the fact that the system is extremely cumbersome to configure and maintain when facing complex and variable access needs, and the permission granularity is often not fine enough to achieve flexible control from a building to a specific room. At the same time, traditional security analysis mostly focuses on post-log auditing, and cannot perform real-time, quantitative risk assessment and active intervention based on multi-dimensional behavior data when an access event occurs, so that the security protection is lagging behind and it is difficult to deal with internal security risks and abnormal behaviors.

[0004] In recent years, with the rapid development of new generation information technologies such as cloud computing and big data, personnel access verification systems have gradually combined with Internet data services, cloud database services, etc., and with the help of data mining software and cloud fusion application running support platform software, the system can realize intelligent analysis and real-time processing of massive access logs, providing a more efficient and scalable technical foundation for dynamic permission matching based on space-time rules.

[0005] Therefore, the present application needs a personnel access verification method and system based on dynamic matching of space-time rules to solve the above problems. SUMMARY

[0006] In view of the defects of the prior art, the present application provides a personnel access verification method and system based on dynamic matching of space-time rules, aiming to solve the problems of insufficient flexibility, coarse permission control granularity, and lagging security risk assessment in the prior art of personnel access verification technology due to static and independent permission management and cumbersome configuration.

[0007] In order to achieve the above object, the technical scheme adopted by the present application is: a personnel access verification method based on dynamic matching of space-time rules, comprising the following steps: S1. Identity recognition is performed on the access personnel to obtain the identity identifier corresponding to the access personnel; S2. Current space-time information is obtained, which includes the current time and the current location of the access personnel; S3. According to the current space-time information, dynamic matching is performed from a preset space-time rule set to generate a dynamic permission group suitable for the current scene; the space-time rule set contains at least one permission group template composed of a time-dimension authorization rule and a space-dimension authorization rule; S4. According to the identity identifier and the dynamic permission group, it is judged whether the access personnel has the current access permission, and the authorization decision result is output.

[0008] Based on the above, the personnel access verification method and system based on dynamic matching of space-time rules have the beneficial effects of solving the problems of insufficient flexibility, coarse-grained permission control, and lagging security risk assessment in the prior art personnel access verification technology due to static isolation of permission management and complicated configuration. The main effects are: 1. The present application converts the originally static and pre-bound permission judgment into a process of dynamically synthesizing a permission group according to real-time time and location information by executing steps S2 and S3, realizes automatic and real-time adaptation of permission allocation to the current scene, and solves the problem of insufficient system flexibility caused by fixed configuration; 2. The space-time rule set of step S3 of the present application contains a permission group template composed of a time-dimension authorization rule and a space-dimension authorization rule, so that the system can support multi-dimensional and multi-level permission condition combination from macro time period to micro geographic location based on the same rule engine, realize fine and three-dimensional control of personnel access permission from time to space, and solve the problem of coarse-grained traditional permission control; 3. The present application forms a complete and recordable core verification process by executing steps S1 to S4. The authorization decision result output by the process, together with the identity identifier and current space-time information that generated the result, provides a structured and traceable data basis for subsequent real-time security analysis, so that the system can perform instant risk assessment and recording based on each specific verification event, lays a core data foundation for realizing the transition from passive audit to active and real-time early warning, and thus provides a prerequisite for solving the problem of lagging security risk assessment.

[0009] Furthermore, in step S2, the time-dimensional authorization rules include rules that limit the passage time period and / or rules that limit the passage status on a specific date. The rules that limit the passage time period include fixed working time period rules configured for weekdays and / or special overtime period rules. The rules that limit the passage status on a specific date include prohibition rules configured for holidays.

[0010] Based on the above, the beneficial effects of the rule limiting access time periods are that it refines the control of the time dimension to the authorization management of specific time periods, enabling the system to flexibly determine access permissions based on different hours within each day, providing a basic time unit for dynamic matching; the beneficial effects of the rule limiting access status on specific dates are that it extends the control of the time dimension to directly define the access status of specific date types, enabling the system to implement access policies different from daily routines on special dates such as holidays, enhancing the adaptability and control of permission rules in the date dimension; the beneficial effects of the rule limiting fixed working hours are that it provides a basic time range configuration for allowing access during working days, achieving stable coverage and protection of access needs during regular office hours; the beneficial effects of the rule limiting special overtime hours are that it provides configurable additional access time periods outside of fixed working hours, achieving flexible support for temporary access needs such as flexible work or overtime during working days; the beneficial effects of the rule limiting access for holidays are that it clearly stipulates the control policy of prohibiting access on specific dates such as holidays, achieving strict control over specific areas on non-working days, and improving the level of security protection during special periods.

[0011] Furthermore, in step S2, the authorization rules for the spatial dimension include authorization rules for different levels of areas, including building-level areas, floor or functional area-level areas and / or specific access control point-level areas.

[0012] Based on the above, the beneficial effects of authorization rules at different levels of areas are: systematically organizing spatial access control into a hierarchical set of rules, enabling flexible definition and allocation of permissions across different coverage areas (such as the entire building, specific floors, or specific rooms) according to management needs, providing a structured spatial model foundation for fine-grained access control; the beneficial effects of building-level areas are: defining the maximum spatial unit of access control, achieving basic control over whether personnel can enter the entire building, and meeting the needs of security management for setting unified access strategies for large areas; the beneficial effects of floor or functional area-level areas are: providing intermediate-level spatial control units within the building, enabling differentiated access management for different floors or functional areas (such as office areas and R&D areas) within the same building, allowing access allocation to align with the actual organizational structure and work area division; the beneficial effects of specific access control point-level areas are: defining the finest spatial unit of access control, achieving precise access control for specific rooms, passageways, or independent access control points, and meeting the security needs for the highest level of control over key or sensitive areas (such as computer rooms and archives).

[0013] Furthermore, in step S3, when performing the authorization rule matching for the spatial dimension, the authorization rules for the specific access control point level area are matched first. If there is no matching authorization rule for the specific access control point level area, the floor or functional area level area is matched upwards. If there is no matching floor or functional area level area, the authorization rules for the building level area are matched upwards.

[0014] Based on the above, the beneficial effects of prioritizing the matching of authorization rules for specific access control point-level areas are that the authorization rules for the most granular spatial unit are retrieved first in the permission matching process. This ensures that the highest precision control basis is sought first during permission verification, maximizing the security control within the possible range and providing a guarantee for implementing the most granular permission control. The beneficial effects of matching the floor or functional area-level areas upwards are that when there are no matching rules at the most granular level, the system automatically backtracks to the next higher spatial level for permission retrieval, realizing hierarchical inheritance of permissions and avoiding repeated authorization configuration for all sub-areas under the parent area. This simplifies the complexity of permission management and improves system flexibility. The beneficial effects of matching the authorization rules for building-level areas upwards are that when there are no matching rules at intermediate levels, the system further backtracks to the top-level building area for permission retrieval. This ensures that even in the absence of more granular authorization, the system can still make a final judgment based on the basic permissions of personnel accessing the entire building, ensuring the completeness of the permission matching logic and the certainty of the final decision. This forms a complete permission backtracking path from specific to general, ensuring the rigor and efficiency of the authorization model.

[0015] Furthermore, the personnel access verification method also includes step S5: recording an access log containing the identity identifier, the current spatiotemporal information and the authorization decision result, and calculating the security risk score of the personnel based on the access log.

[0016] Based on the above, the beneficial effects of step S5 are as follows: after completing a single access verification, the subsequent processing flow of log recording and risk assessment is systematically executed, realizing the closed-loop linkage between the verification process and security analysis, and transforming discrete access events into data assets for sustainable analysis; the beneficial effect of recording access logs containing the identity identifier, the current spatiotemporal information, and the authorization decision results is that the core elements of each verification (who, when, where, and result) are stored in a structured manner, realizing complete and traceable data retention for all access behaviors, and providing a unique and reliable data source for subsequent auditing, analysis, and risk calculation; the beneficial effect of calculating the security risk score of the personnel based on the access logs is that by using the accumulated access log data, the personnel's access behavior is dynamically evaluated through a quantitative model, realizing an objective and digital measurement of personnel access security risks, and transforming subjective security judgments into comparable and traceable scoring indicators.

[0017] Furthermore, the security risk score is obtained by weighted summation of several predefined security risk indicators, including abnormal time access frequency, abnormal area access frequency, repeated failed attempts frequency, frequent cross-regional movement frequency, and / or non-working period passage frequency.

[0018] Based on the above, the beneficial effects of obtaining the security risk score by weighted summation of several predefined security risk indicators are as follows: Firstly, it integrates multi-dimensional abnormal behavior characteristics into a single quantitative value, achieving an objective and comprehensive reflection of personnel's security risk level through a unified and computable mathematical model, thus standardizing the risk assessment process and ensuring comparable results. Secondly, the predefined security risk indicators provide clear and quantifiable observation dimensions and calculation basis for the risk assessment model, decomposing the abstract concept of abnormal behavior into multiple specific and statistically significant metrics, laying a data foundation for scientific analysis. Thirdly, the abnormal time access frequency measures the frequency with which personnel attempt to pass through unauthorized time periods, achieving a quantitative assessment of the specific risk dimension of violating time rules, and effectively identifying behavioral patterns that disregard or test time control boundaries. Fourthly, the abnormal area access frequency measures the frequency with which personnel attempt to pass through unauthorized areas. The frequency of passage allows for a quantitative assessment of the specific risk dimension of violating spatial rules, effectively identifying tendencies toward unauthorized access or accidental entry into restricted areas. The frequency of repeated failed attempts measures the frequency of multiple authentication failures at the same location within a short period, enabling a quantitative assessment of potential anomalies such as tailing, brute-force attacks, or equipment malfunctions, enhancing the ability to perceive immediate security threats. The frequency of frequent cross-regional movement measures the frequency of rapid switching between different authorized areas within a short period, enabling a quantitative assessment of unnecessary high mobility or loitering behavior, and helping to discover possible abnormal activity trajectories of internal personnel. The frequency of passage during non-working hours measures the frequency of attempts to pass outside of regular working hours (such as late at night), enabling a quantitative assessment of passage behavior under abnormal working conditions, providing a temporal characteristic basis for identifying potential internal violations or external intrusion risks.

[0019] Furthermore, the personnel access verification method also includes step S6: comparing the calculated security risk score with a predetermined risk level threshold, and triggering a corresponding risk handling mechanism based on the comparison result. The risk handling mechanism includes automatic recording, sending alarm notifications, and / or locking accounts.

[0020] Based on the above, the beneficial effects of step S6 are as follows: after calculating the security risk score, the subsequent decision-making and response processes are executed, realizing the automatic transformation of risk assessment results into specific security actions and completing closed-loop management from risk perception to risk handling; the beneficial effects of the risk handling mechanism are that it automatically associates and initiates preset handling processes based on risk levels, realizing accurate matching between risk response and risk level, as well as automated and hierarchical handling of security incidents; the beneficial effects of automatic recording are that it archives the risk assessment events themselves without intervention, realizing complete traceability of all risk events (including low-risk events), and accumulating data for long-term security audits and strategy optimization; the beneficial effects of sending alarm notifications are that it pushes medium- and high-risk events to security management personnel in real time, realizing proactive and immediate reporting of security threat information, shortening the response time from risk occurrence to manual intervention, and improving the initiative of security supervision; the beneficial effects of locking accounts are that it immediately terminates the access rights of identified high-risk personnel, realizing the immediate blocking of confirmed or highly suspected security threats, preventing the spread of risks, and is the highest level of automated protection measure in the system.

[0021] Furthermore, the present invention provides a personnel access verification system based on spatiotemporal rule dynamic matching, used to execute a personnel access verification method based on spatiotemporal rule dynamic matching, the personnel access verification system comprising: The identity recognition module is used to identify the passers-by and output the identity identifier; The spatiotemporal information acquisition module is used to acquire the current time and the current location of the passing personnel to constitute the current spatiotemporal information; The permission verification and decision module is communicatively connected to the identity recognition module and the spatiotemporal information acquisition module. It is used to receive the identity identifier and the current spatiotemporal information. The permission verification and decision module internally stores the spatiotemporal rule set. The spatiotemporal rule set includes at least one permission group template composed of authorization rules in the time dimension and authorization rules in the space dimension. The permission verification and decision module dynamically matches and generates the dynamic permission group from the spatiotemporal rule set according to the current spatiotemporal information, and then makes an authorization decision in combination with the identity identifier. The execution module is communicatively connected to the permission verification and decision-making module and is used to receive and execute the authorization decision.

[0022] Based on the above, the beneficial effects of the identity recognition module are that it authenticates the identity of personnel and extracts unique identifiers, transforming physical personnel into data objects that the system can recognize and process, providing an accurate input starting point for all subsequent identity-based permission verification and security analysis; the beneficial effects of the spatiotemporal information acquisition module are that it acquires accurate time information and personnel location information in real time and integrates them into structured current spatiotemporal information, providing core decision parameters reflecting the real-time scenario for dynamic permission matching; the beneficial effects of the permission verification and decision module are that, as the core processing unit of the system, it receives identity and spatiotemporal information, performs dynamic matching and logical decision-making based on the internally stored spatiotemporal rule set, realizes the intelligent fusion of preset permission rules, real-time scenario and personnel identity, and outputs the final authorization decision result; the beneficial effects of the execution module are that it receives authorization decision instructions from the permission verification and decision module and transforms them into control signals for physical access control devices or trigger commands for other alarm components, realizing the transformation of the system's digital decision results into actual security control actions, completing the closed loop from information processing to physical control.

[0023] Furthermore, the personnel access verification system also includes a data recording and analysis module that is communicatively connected to the permission verification and decision-making module. This module stores access logs containing the identity identifier, the current spatiotemporal information, and the authorization decision results, and calculates a security risk score based on the access logs.

[0024] Based on the above, the beneficial effects of the data recording and analysis module are that, as the system's persistent storage and intelligent analysis unit, it continuously receives and saves access process data from the permission verification and decision-making module, and executes preset risk assessment algorithms. This enables centralized management of massive access logs and automated, routine analysis and quantitative output of personnel security risks, giving the system continuous security situation awareness and assessment capabilities.

[0025] Furthermore, the identity recognition module includes a sensor for collecting biometric features and a processing unit for extracting feature vectors, and the execution module includes an interface unit that is communicatively connected to the access control controller.

[0026] Based on the above, the beneficial effects of the sensor are that it directly acquires the physiological characteristic information of the people passing through, realizing the live, non-contact acquisition of the person's identity, providing a reliable data source for high-security identity recognition, and effectively preventing the risk of identity credential misuse; the beneficial effects of the processing unit are that it processes and transforms the raw biometric data collected by the sensor to generate standardized feature vectors, realizing the abstraction of complex biometric features into digital identifiers that can be efficiently compared and processed by algorithms, providing a core data foundation for accurate identity authentication; the beneficial effects of the interface unit are that it establishes a standardized communication link between the execution module and the physical access control device, realizing the accurate and reliable transmission of the authorization decision instructions (such as unlocking, alarm) generated by the system and driving the controlled access control controller to perform corresponding actions, completing the control closed loop from the information system to the physical security facility.

[0027] To make the above features of the present invention and the objectives to be achieved clearer, the present invention will be further described below in conjunction with the accompanying drawings and specific embodiments. Attached Figure Description

[0028] Figure 1 : This is a flowchart illustrating the personnel access verification method of the present invention; Figure 2 : This is a signal connection diagram of the personnel access verification system of the present invention.

[0029] The diagram numbers are explained as follows: 1-Identity recognition module, 2-Spatiotemporal information acquisition module, 3-Permission verification and decision-making module, 4-Execution module, 5-Data recording and analysis module. Detailed Implementation

[0030] See Figure 1 and Figure 2 As shown, This invention discloses a personnel access verification method based on spatiotemporal rule dynamic matching, comprising the following steps: S1. Identify the passersby and obtain their corresponding identity identifiers; S2. Obtain current spatiotemporal information, including the current time and the current location of the person passing through; S3. Based on the current spatiotemporal information, dynamically match from a preset spatiotemporal rule set to generate a dynamic permission group suitable for the current scenario; the spatiotemporal rule set includes at least one permission group template composed of a combination of time-dimensional authorization rules and space-dimensional authorization rules; S4. Based on the identity identifier and the dynamic permission group, determine whether the person passing through has the current access permission, and output the authorization decision result.

[0031] In this embodiment, in step S2, the time-dimensional authorization rules include rules that limit the passage time period and / or rules that limit the passage status on a specific date. The rules that limit the passage time period include fixed working time period rules configured for weekdays and / or special overtime period rules. The rules that limit the passage status on a specific date include prohibition rules configured for holidays.

[0032] In this embodiment, the fixed working time period rule can be configured as "08:00-18:00", and the special overtime period rule can be configured as "19:00-22:00". The system automatically determines whether it belongs to a weekday, weekend or specific holiday by parsing the current timestamp, and matches the corresponding rule. For example, a "no entry rule" can be configured for National Day, in which case the relevant area will be closed to traffic all day on that holiday.

[0033] In this embodiment, in step S2, the authorization rules for the spatial dimension include authorization rules for different levels of areas, including building-level areas, floor or functional area-level areas and / or specific access control point-level areas.

[0034] In this embodiment, the spatial areas are organized in a tree structure. For example, the "R&D building" is a building-level area, which includes multiple floor-level areas such as "3rd floor - R&D area" and "5th floor - conference room". The "3rd floor - R&D area" can also include specific access control point-level areas such as "Room 301" and "A-003 access control point". Spatial permissions for personnel can be granted at any level, and the system will match them according to this hierarchical structure.

[0035] In this embodiment, in step S3, when performing the authorization rule matching for the spatial dimension, the authorization rules for the specific access control point level area are matched first. If there is no matching authorization rule for the specific access control point level area, the floor or functional area level area is matched upwards. If there is no matching floor or functional area level area, the authorization rules for the building level area are matched upwards.

[0036] In this embodiment, the matching process in step S3 implements implicit inheritance of permissions. For example, if employee Zhang San is only granted permission for "R&D Building - 3rd Floor" but not permission for "Room 301" separately, when he tries to enter "Room 301", the system first searches for the rule for "Room 301" (no match), and then matches the rule for "3rd Floor" (match successful), so the system authorizes him to enter. This mechanism avoids duplicate authorization for all child areas under the same parent area, simplifying configuration and management. At the same time, if a stricter access restriction rule is configured separately for "Room 301", the system will prioritize matching that specific rule, thereby achieving special control.

[0037] In this embodiment, the personnel access verification method further includes step S5: recording an access log containing the identity identifier, the current spatiotemporal information and the authorization decision result, and calculating the security risk score of the personnel based on the access log.

[0038] In this embodiment, the security risk score is obtained by weighted summation of several predefined security risk indicators, including abnormal time access frequency, abnormal area access frequency, repeated failed attempts frequency, frequent cross-regional movement frequency, and / or non-working period passage frequency.

[0039] In this embodiment, weights can be configured for each security risk indicator. For example, abnormal time access accounts for 30%, abnormal area access accounts for 25%, repeated failed attempts account for 20%, frequent cross-regional movement accounts for 15%, and access during non-working hours accounts for 10%. The system periodically collects access data within a specified time window, calculates the score for each dimension according to the indicator formula, and then performs a weighted summation to finally obtain a security risk score of 0-100. For example, if an employee attempts to enter a restricted computer room area during non-working hours, the system will calculate the score of this behavior on the "abnormal time access" and "abnormal area access" indicators, and combine it with historical data to obtain the comprehensive risk score after this access.

[0040] In this embodiment, the personnel access verification method further includes step S6: comparing the calculated security risk score with a predetermined risk level threshold, and triggering a corresponding risk handling mechanism based on the comparison result. The risk handling mechanism includes automatic recording, sending alarm notifications, and / or locking accounts.

[0041] In this embodiment, the predetermined risk level threshold can be set as follows: 0-30 points are low risk, 31-70 points are medium risk, and 71-100 points are high risk. For low risk, the system will only automatically record logs. For medium risk, in addition to recording, it will also trigger SMS or application notifications to the security manager. For high risk, the system will immediately and automatically lock the person's account and send an emergency alarm to the security team. In addition, the system also has an anomaly handling process. If more than 3 consecutive failed attempts are made at the same access control point in one day, a medium-to-high risk alarm will be triggered immediately and the verification function of that point will be temporarily locked.

[0042] This invention also discloses a personnel access verification system based on spatiotemporal rule dynamic matching, used to execute a personnel access verification method based on spatiotemporal rule dynamic matching. The personnel access verification system includes: Identity recognition module 1 is used to identify the passers-by and output the identity identifier; The spatiotemporal information acquisition module 2 is used to acquire the current time and the current location of the passing personnel to form the current spatiotemporal information; The permission verification and decision module 3 is communicatively connected to the identity recognition module 1 and the spatiotemporal information acquisition module 2. It is used to receive the identity identifier and the current spatiotemporal information. The permission verification and decision module 3 internally stores the spatiotemporal rule set. The spatiotemporal rule set includes at least one permission group template composed of authorization rules in the time dimension and authorization rules in the space dimension. The permission verification and decision module 3 dynamically matches and generates the dynamic permission group from the spatiotemporal rule set according to the current spatiotemporal information, and then makes an authorization decision in combination with the identity identifier. The execution module 4 is communicatively connected to the permission verification and decision-making module 3 and is used to receive and execute the authorization decision.

[0043] In this embodiment, the spatiotemporal rule set in the permission verification and decision module 3 is stored in the form of a configuration file. The identifier of the permission group template can be automatically generated according to the combination rules, and the format is, for example, "TIME_SPATIAL_[Time Rule ID]_[Spatial Rule ID]". The identity recognition module 1 can receive a 128-dimensional facial feature vector from the front-end binocular camera through the REST API interface and return the personnel ID. The execution module 4 can send "unlock" or "keep locked" instructions to the designated access controller through the MQTT message queue.

[0044] In this embodiment, the personnel access verification system further includes a data recording and analysis module 5 that is communicatively connected to the permission verification and decision module 3. This module is used to store access logs containing the identity identifier, the current spatiotemporal information, and the authorization decision results, and to calculate a security risk score based on the access logs.

[0045] In this embodiment, the identity recognition module 1 includes a sensor for collecting biometric features and a processing unit for extracting feature vectors, and the execution module 4 includes an interface unit that is communicatively connected to the access control controller.

[0046] The above description is merely the optimal embodiment of the present invention and is not intended to limit the present invention. Any modifications or substitutions made by those skilled in the art without departing from the essence and scope of protection of the present invention should also be within the scope of protection of the present invention.

Claims

1. A personnel access verification method based on spatiotemporal rule dynamic matching, characterized in that, Includes the following steps: S1. Identify the passersby and obtain their corresponding identity identifiers; S2. Obtain current spatiotemporal information, including the current time and the current location of the person passing through; S3. Based on the current spatiotemporal information, dynamically match from a preset spatiotemporal rule set to generate a dynamic permission group suitable for the current scenario; the spatiotemporal rule set includes at least one permission group template composed of a combination of time-dimensional authorization rules and space-dimensional authorization rules; S4. Based on the identity identifier and the dynamic permission group, determine whether the person passing through has the current access permission, and output the authorization decision result.

2. The personnel access verification method based on spatiotemporal rule dynamic matching according to claim 1, characterized in that, In step S2, the time-dimensional authorization rules include rules that limit the passage time period and / or rules that limit the passage status on a specific date. The rules that limit the passage time period include fixed working time period rules configured for weekdays and / or special overtime period rules. The rules that limit the passage status on a specific date include prohibition rules configured for holidays.

3. The personnel access verification method based on spatiotemporal rule dynamic matching according to claim 1, characterized in that, In step S2, the authorization rules for the spatial dimension include authorization rules for different levels of areas, including building-level areas, floor or functional area-level areas and / or specific access control point-level areas.

4. The personnel access verification method based on spatiotemporal rule dynamic matching according to claim 3, characterized in that, In step S3, when performing the authorization rule matching for the spatial dimension, the authorization rules for the specific access control point level area are matched first. If there is no matching authorization rule for the specific access control point level area, the floor or functional area level area is matched upwards. If there is no matching floor or functional area level area, the authorization rules for the building level area are matched upwards.

5. The personnel access verification method based on spatiotemporal rule dynamic matching according to claim 1, characterized in that, The personnel access verification method further includes step S5: recording an access log containing the identity identifier, the current spatiotemporal information and the authorization decision result, and calculating the security risk score of the personnel based on the access log.

6. The personnel access verification method based on spatiotemporal rule dynamic matching according to claim 5, characterized in that, The security risk score is obtained by weighted summation of several predefined security risk indicators, including abnormal time access frequency, abnormal area access frequency, repeated failed attempts frequency, frequent cross-regional movement frequency, and / or non-working period passage frequency.

7. The personnel access verification method based on spatiotemporal rule dynamic matching according to claim 6, characterized in that, The personnel access verification method further includes step S6: comparing the calculated security risk score with a predetermined risk level threshold, and triggering a corresponding risk handling mechanism based on the comparison result. The risk handling mechanism includes automatic recording, sending alarm notifications, and / or locking accounts.

8. A personnel access verification system based on spatiotemporal rule dynamic matching, characterized in that, The personnel access verification system is used to execute the personnel access verification method based on spatiotemporal rule dynamic matching as described in claim 1, and the personnel access verification system includes: The identity recognition module (1) is used to identify the passers-by and output the identity identifier; The spatiotemporal information acquisition module (2) is used to acquire the current time and the current location of the passing personnel to form the current spatiotemporal information; The permission verification and decision module (3) is communicatively connected to the identity recognition module (1) and the spatiotemporal information acquisition module (2) and is used to receive the identity identifier and the current spatiotemporal information. The permission verification and decision module (3) internally stores the spatiotemporal rule set. The spatiotemporal rule set contains at least one permission group template composed of the authorization rules of the time dimension and the authorization rules of the space dimension. The permission verification and decision module (3) dynamically matches and generates the dynamic permission group from the spatiotemporal rule set according to the current spatiotemporal information, and then makes an authorization decision in combination with the identity identifier. The execution module (4) is communicatively connected to the permission verification and decision module (3) and is used to receive and execute the authorization decision.

9. The personnel access verification system based on spatiotemporal rule dynamic matching according to claim 8, characterized in that, The personnel access verification system also includes a data recording and analysis module (5) that is communicatively connected to the permission verification and decision module (3), for storing access logs containing the identity identifier, the current spatiotemporal information and the authorization decision results, and calculating a security risk score based on the access logs.

10. The personnel access verification system based on spatiotemporal rule dynamic matching according to claim 8, characterized in that, The identity recognition module (1) includes a sensor for collecting biometric features and a processing unit for extracting feature vectors, and the execution module (4) includes an interface unit that is communicatively connected to the access control controller.

Images