System and method for dynamically generating identity code authority verification

Abstract

The invention provides a system and a method for dynamically generating identity code authority verification, and relates to the technical field of dynamic authority management. The system for dynamically generating identity code permission verification comprises a basic support module, an identity code generation module, a permission management module, a verification terminal module and a system management module. Identity code parameters are updated per minute, biological feature hash and timestamps are combined, screenshot / forgery risks are eradicated, authority strategies are pushed in real time through an MQTT protocol, strategy effective delay is smaller than 50 ms, million-level terminal concurrent verification is supported, dynamic codes are automatically generated after visitors scan codes / make appointments, passing efficiency is improved, and the authority expires and automatically fails without manual intervention. The system supports SM4 encryption of national cipher, GDPR data desensitization and automatic archiving of audit logs, meets financial-level security requirements, reduces 70% of cloud load by edge computing, is compatible with protocols such as TCP / I P / RS485 and the like by hardware, and reduces deployment cost.

Description

Technical Field

[0001] This invention relates to the field of dynamic access control technology, specifically to a system and method for dynamically generating identity code access verification. Background Technology

[0002] Access control and visitor systems are important components of modern security management. Working together, they enable efficient and secure access control. These intelligent management systems use technology to control the entry and exit of personnel or vehicles into specific areas. Core functions include identity verification, access control, and real-time monitoring, supporting fingerprint, facial, and iris recognition methods. Visitor systems are dedicated digital platforms for managing the entry and exit processes of external personnel, replacing traditional paper registration and improving efficiency and security. Access control systems focus on access control, while visitor systems focus on process management. The two systems build a complete security loop through data interoperability.

[0003] Existing access control and visitor systems still have some problems. Traditional physical credentials are easy to forge and leak. Biometric identification has vulnerabilities in liveness detection, leading to the risk of unauthorized entry. There are data silos between multiple systems, policy updates require manual synchronization, visitor approval requires multiple manual verifications, visitors need to register their identity information multiple times, permissions take a long time to take effect, and cross-scenario access requires switching credentials. Therefore, those skilled in the art provide a system and method for dynamically generating identity codes for permission verification to solve the problems mentioned in the background. Summary of the Invention

[0004] (a) Technical problems to be solved

[0005] To address the shortcomings of existing technologies, this invention provides a system and method for dynamically generating identity codes for permission verification. It solves the problems of traditional physical credentials being easily forged and leaked, biometric identification having vulnerabilities in liveness detection leading to the risk of unauthorized entry, data silos in multiple systems for permission access, the need for manual synchronization of policy updates, the need for multiple manual verification steps for visitor approval, the need for visitors to register their identity information multiple times, delayed permission activation, and the need to switch credentials for cross-scenario access.

[0006] (II) Technical Solution

[0007] To achieve the above objectives, the present invention provides the following technical solution: a system for dynamically generating identity code authorization verification, comprising:

[0008] The basic support module includes a biometric database and security encryption services;

[0009] An identity code generation module, which includes a biometric processing unit, a dynamic parameter generator, and an encoding generation engine;

[0010] The permission management module includes a permission policy center, a permission synchronization engine, and an audit log module.

[0011] The verification terminal module includes a multimodal recognition terminal, an edge computing unit, and an instruction execution unit.

[0012] The system management module includes an operation and maintenance monitoring center, a policy configuration center, and a certificate management system.

[0013] Preferably, the biometric database is used to store biometric templates of the user's iris, face and fingerprint, is encrypted using the national cryptographic SM4 algorithm, supports multimodal biometric fusion, provides a feature comparison interface, the security encryption service dynamically generates keys, supports the SM2 / SM4 national cryptographic algorithm system, and monitors abnormal encryption behavior in real time.

[0014] Preferably, the biometric processing unit collects biometric data in real time, performs face detection and liveness detection, and generates biometric hash values. The dynamic parameter generator includes timestamps, random numbers, and device ID bindings. The encoding generation engine includes Base64+URL secure encoding, QR Code / Hanxin Code dual-mode generation, and QR code anti-tampering verification.

[0015] Preferably, the permission measurement center includes permission tree management based on the RBAC model, supports 1024 levels of fine-grained permission control, and a policy version rollback mechanism. The permission synchronization engine includes real-time push via MQTT protocol, offline mode caching, conflict detection, and automatic arbitration.

[0016] Preferably, the multimodal recognition terminal includes a QR code scanner, an NFC card reader, and a 3D structured light camera; the edge computing unit includes a lightweight TensorFlow Lite model, local biometric comparison, and abnormal data caching; and the instruction execution unit includes relay control, TCP / IP / RS485 protocol conversion, and operation result feedback.

[0017] Preferably, the operation and maintenance monitoring center includes a system operation status visualization dashboard, real-time monitoring of device online rate and performance indicators; the policy configuration center includes a visual drag-and-drop configuration of permission rules, time period / region / person combination policies and policy effectiveness simulation; and the certificate management system includes digital certificate full lifecycle management, CRL / OCSP online verification and rapid response to certificate revocation.

[0018] A method for dynamically generating identity code authorization verification includes the following steps:

[0019] S1. Identity initialization phase: biometric data collection and registration;

[0020] S1.1. Users can enter biometric features through a multimodal acquisition terminal, which supports face, iris and fingerprint entry. Face recognition uses a 3D structured light camera to collect the coordinates of 50 facial key points. Iris recognition uses infrared imaging to obtain iris texture data with a diameter ≥11mm. Fingerprint recognition uses a capacitive sensor with a resolution of 500dpi.

[0021] S1.2. Data preprocessing, noise reduction filtering, median filtering plus Gaussian filtering combination, normalization processing, and size uniform to 256x256 pixels;

[0022] S1.3. Biometric Hash Calculation:

[0023]

[0024] S1.4. Digital Identity Generation: A unique identity ID is generated in the cloud, and the biometric hash value is stored in an encrypted manner.

[0025] Finally, the identity credentials are returned, including the encrypted biometric hash and the initial permission level;

[0026] S2. Dynamic identity code generation stage, dynamic parameter combination;

[0027] S2.1. Timestamp generation, UTC time millisecond precision, random number generation, hardware random number generator (TRNG) collects 256-bit random numbers, combined with software entropy source, keyboard key press interval and mouse movement trajectory;

[0028] S2.2. Device binding information, terminal device MAC address, GPS geographic location, accuracy ≤10 meters;

[0029] S2.3. Identification code encoding, parameter concatenation:

[0030] base_str=time_stamp+random_num+device_info+feature_hash;

[0031] S2.4. Dynamic Signature:

[0032]

[0033] S2.5. Multimodal encoding, QR code generation supports QR Code V4, NFC tags write encrypted data in NDEF format, barcode generation uses Code 128 encoding, and data capacity is ≤48 characters;

[0034] S3. Dynamic permission management phase: Permission policy configuration;

[0035] S3.1. Strategy Tree Construction:

[0036]

[0037]

[0038] S3.2. Policy distribution via MQTT protocol for real-time push, QoS=2 to guarantee delivery, offline mode via local caching;

[0039] S3.3. Permission activation mechanism, permission version number management, dynamic activation window, a 5-second buffer period is set after the new policy is pushed, during which the old policy remains valid;

[0040] S3.4. Conflict Detection;

[0041] S4. Multimodal verification stage, identity code parsing;

[0042] S4.1. Terminal scanning, card swiping and NFC reading, QR code parsing, Zxing library decoding, NFC parsing ISO14443 Type A / B protocol parsing;

[0043] S4.2. Data verification: timestamp validity ±5-minute error window; signature verification SM3 hash comparison.

[0044] S4.3. Real-time biometric comparison, terminal collects real-time biometric features, face detection and iris localization;

[0045] S4.4. Feature Comparison:

[0046] def biometric_verify(live_feature,stored_hash):

[0047] computed_hash=bio_hash(live_feature)

[0048] return hmac.compare_digest(computed_hash, stored_hash);

[0049] S4.5. Real-time permission verification and permission tree traversal;

[0050] S4.6. Dynamic permission updates: When permissions change, the terminal cache is immediately invalidated, and a 5-second policy synchronization timeout window is set.

[0051] S5. Results Feedback and Audit Phase: Verification of Results Processing

[0052] A successful path generates an access token to control the access control mechanism.

[0053] A failed path triggers a local alarm and reports it to the audit log, including the operation time, location, and terminal ID.

[0054] S6. Data synchronization and archiving: Real-time synchronization and verification results are written to the big data platform in real time via Kafka, and archived asynchronously. Logs are compressed into Snappy format at midnight every day and stored in object storage for 180 days.

[0055] S7. Exception handling mechanism;

[0056] S7.1. Biometric failure scenario: If the biometrics fails 3 times in a row, the account will be locked for 30 minutes, triggering the biometrics update process, which requires re-collection and registration.

[0057] S7.2. In the event of a permission conflict, when multiple policies are applied simultaneously, the principle of least privilege shall be adopted, and a manual review process shall be triggered.

[0058] S7.3. In the scenario of network interruption, the terminal enables local policy caching, and operation records during the network outage are cached locally and re-uploaded after the network is connected.

[0059] (III) Beneficial Effects

[0060] This invention provides a system and method for dynamically generating identity code authorization verification. It has the following beneficial effects:

[0061] 1. In this invention, the system updates the identity code parameters every minute, combining biometric hashes and timestamps to eliminate the risk of screenshots / forgery. The permission policy is pushed in real time via the MQTT protocol, with a policy effective delay of <50ms. It supports concurrent verification by millions of terminals. After a visitor scans the code / makes an appointment, a dynamic code is automatically generated, improving access efficiency. Permissions expire automatically without manual intervention.

[0062] 2. This invention supports SM4 encryption (China's national cryptographic standard), GDPR data anonymization, and automatic archiving of audit logs, meeting financial-grade security requirements. Edge computing reduces cloud load by 70%, and the hardware is compatible with protocols such as TCP / IP / RS485, thus reducing deployment costs. Attached Figure Description

[0063] Figure 1 This is a diagram showing the inter-module collaboration relationships of the present invention;

[0064] Figure 2 This is a schematic diagram of the collision detection method of the present invention;

[0065] Figure 3 This is a schematic diagram of the permission tree traversal of the present invention. Detailed Implementation

[0066] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0067] Example 1:

[0068] like Figure 1-3 As shown, this embodiment of the invention provides a system for dynamically generating identity code authorization verification, comprising:

[0069] The basic support module includes a biometric database and security encryption services;

[0070] The identity code generation module includes a biometric processing unit, a dynamic parameter generator, and a coding generation engine.

[0071] The permission management module includes a permission policy center, a permission synchronization engine, and an audit log module.

[0072] The verification terminal module includes a multimodal recognition terminal, an edge computing unit, and an instruction execution unit.

[0073] The system management module includes an operations and maintenance monitoring center, a policy configuration center, and a certificate management system.

[0074] Preferably, the biometric database is used to store biometric templates of users' iris, face and fingerprint, is encrypted using the national cryptographic SM4 algorithm, supports multimodal biometric fusion, provides a feature comparison interface, provides dynamic key generation for secure encryption services, supports the SM2 / SM4 national cryptographic algorithm system, and monitors abnormal encryption behavior in real time.

[0075] Preferably, the biometric processing unit collects biometric data in real time, performs face detection and liveness detection, generates biometric hash values, and the dynamic parameter generator includes binding timestamps, random numbers and device IDs. The encoding generation engine includes Base64+URL secure encoding, QR Code / Hanxin Code dual-mode generation and QR code anti-tampering verification.

[0076] Preferably, the permission measurement center includes permission tree management based on the RBAC model, supports 1024 levels of fine-grained permission control, a policy version rollback mechanism, and a permission synchronization engine including real-time push via MQTT protocol, offline mode caching, conflict detection, and automatic arbitration. When multiple policies are triggered simultaneously, such as "engineer roles are allowed to enter area A" and "temporary visitors are prohibited from entering area A," the system uses the following priority rules for arbitration:

[0077] Role priority > temporal and spatial constraints > operation type. For example, administrator privileges override ordinary user privileges, the most recently updated policy takes precedence, and newly pushed policy versions automatically override old versions. Manual arbitration is a fallback measure. When the algorithm cannot determine a conflict, an approval ticket is triggered for the security administrator to make a manual decision. For example, if a visitor arrives 1 minute before the approval deadline, the system will automatically lock permissions due to the conflict between the old and new policies until the administrator confirms remotely.

[0078] Preferably, the multimodal recognition terminal includes a QR code scanner, an NFC card reader, and a 3D structured light camera; the edge computing unit includes a lightweight TensorFlow Lite model, local biometric comparison, and abnormal data caching; and the instruction execution unit includes relay control, TCP / IP / RS485 protocol conversion, and operation result feedback.

[0079] Preferably, the operation and maintenance monitoring center includes a system operation status visualization dashboard, real-time monitoring of device online rate and performance indicators; the policy configuration center includes a visual drag-and-drop configuration of permission rules, time period / region / person combination policies and policy effect simulation; and the certificate management system includes digital certificate full lifecycle management, CRL / OCSP online verification and rapid response to certificate revocation.

[0080] A method for dynamically generating identity code authorization verification includes the following steps:

[0081] S1. Identity initialization phase: biometric data collection and registration;

[0082] S1.1. Users can enter biometric features through a multimodal acquisition terminal, which supports face, iris and fingerprint entry. Face recognition uses a 3D structured light camera to collect the coordinates of 50 facial key points. Iris recognition uses infrared imaging to obtain iris texture data with a diameter ≥11mm. Fingerprint recognition uses a capacitive sensor with a resolution of 500dpi.

[0083] S1.2. Data preprocessing, noise reduction filtering, median filtering plus Gaussian filtering combination, normalization processing, and size uniform to 256x256 pixels;

[0084] S1.3. Biometric Hash Calculation:

[0085]

[0086]

[0087] S1.4. Digital Identity Generation: A unique identity ID is generated in the cloud, and the biometric hash value is stored in an encrypted manner.

[0088] Finally, the identity credentials are returned, including the encrypted biometric hash and the initial permission level;

[0089] S2. Dynamic identity code generation stage, dynamic parameter combination;

[0090] S2.1. Timestamp generation, UTC time millisecond precision, random number generation, hardware random number generator (TRNG) collects 256-bit random numbers, combined with software entropy source, keyboard key press interval and mouse movement trajectory;

[0091] S2.2. Device binding information, terminal device MAC address, GPS geographic location, accuracy ≤10 meters;

[0092] S2.3. Identification code encoding, parameter concatenation:

[0093] base_str=time_stamp+random_num+device_info+feature_hash;

[0094] S2.4. Dynamic Signature:

[0095]

[0096] S2.5. Multimodal encoding: QR code generation supports QR Code V4; NFC tags write encrypted data in NDEF format; barcode generation uses Code 128 encoding with a data capacity of ≤48 characters; the dynamic identity code anti-replay attack mechanism is designed to prevent attackers from intercepting and reusing the dynamic identity code. The system needs to add multiple protection mechanisms, including timeliness control, a strict 5-second validity period for the dynamic code, automatic expiration after the timeout, serial number uniqueness (each dynamic code comes with an incrementing serial number), server-side verification of serial number continuity, spatiotemporal correlation, and binding of the dynamic code to the location information and timestamp of the generating device. If cross-regional / cross-time period usage is detected, it is judged as abnormal. For example, in an attack, an attacker intercepts an employee's dynamic code and attempts to reuse it after 5 seconds; the system directly blocks it due to the timeliness verification failure.

[0097] S3. Dynamic permission management phase: Permission policy configuration;

[0098] S3.1. Strategy Tree Construction:

[0099]

[0100] S3.2. Policy distribution via MQTT protocol for real-time push, QoS=2 to guarantee delivery, offline mode via local caching;

[0101] S3.3. Permission activation mechanism, permission version number management, dynamic activation window, a 5-second buffer period is set after the new policy is pushed, during which the old policy remains valid;

[0102] S3.4. Conflict Detection;

[0103] S4. Multimodal verification stage, identity code parsing;

[0104] S4.1. Terminal scanning, card swiping and NFC reading, QR code parsing, Zxing library decoding, NFC parsing ISO14443 Type A / B protocol parsing;

[0105] S4.2. Data verification: timestamp validity ±5-minute error window; signature verification SM3 hash comparison.

[0106] S4.3. Real-time biometric comparison, terminal collects real-time biometric features, face detection and iris localization;

[0107] S4.4. Feature Comparison:

[0108] def biometric_verify(live_feature,stored_hash):

[0109] computed_hash=bio_hash(live_feature)

[0110] return hmac.compare_digest(computed_hash,stored_hash);

[0111] S4.5. Real-time permission verification and permission tree traversal;

[0112] S4.6. Dynamic permission updates: When permissions change, the terminal cache is immediately invalidated, and a 5-second policy synchronization timeout window is set.

[0113] S5. Results Feedback and Audit Phase: Verification of Results Processing

[0114] A successful path generates an access token to control the access control mechanism.

[0115] A failed path triggers a local alarm and reports it to the audit log, including the operation time, location, and terminal ID.

[0116] S6. Data synchronization and archiving: Real-time synchronization and verification results are written to the big data platform in real time via Kafka, and archived asynchronously. Logs are compressed into Snappy format at midnight every day and stored in object storage for 180 days.

[0117] S7. Exception handling mechanism;

[0118] S7.1. Biometric failure scenario: If the biometrics fails 3 times in a row, the account will be locked for 30 minutes, triggering the biometrics update process, which requires re-collection and registration.

[0119] S7.2. In the event of a permission conflict, when multiple policies are applied simultaneously, the principle of least privilege shall be adopted, and a manual review process shall be triggered.

[0120] S7.3. In the scenario of network interruption, the terminal enables local policy caching, and operation records during the network outage are cached locally and re-uploaded after the network is connected.

[0121] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A system for dynamically generating identity code authorization verification, characterized in that: include: The basic support module includes a biometric database and security encryption services; An identity code generation module, which includes a biometric processing unit, a dynamic parameter generator, and a coding generation engine; The permission management module includes a permission policy center, a permission synchronization engine, and an audit log module. The verification terminal module includes a multimodal recognition terminal, an edge computing unit, and an instruction execution unit. The system management module includes an operation and maintenance monitoring center, a policy configuration center, and a certificate management system.

2. The system for dynamically generating identity code authorization verification according to claim 1, characterized in that: The biometric database is used to store biometric templates of users' iris, face and fingerprint, and is encrypted using the national cryptographic SM4 algorithm. It supports multimodal biometric fusion, provides a feature comparison interface, and the security encryption service dynamically generates keys, supports the SM2 / SM4 national cryptographic algorithm system, and monitors abnormal encryption behavior in real time.

3. The system for dynamically generating identity code authorization verification according to claim 1, characterized in that: The biometric processing unit collects biometric data in real time, performs face detection and liveness detection, and generates biometric hash values. The dynamic parameter generator includes timestamps, random numbers, and device ID binding. The encoding generation engine includes Base64+URL secure encoding, QR Code / Hanxin Code dual-mode generation, and QR code anti-tampering verification.

4. The system for dynamically generating identity code authorization verification according to claim 1, characterized in that: The permission measurement center includes permission tree management based on the RBAC model, supports 1024 levels of fine-grained permission control, and a policy version rollback mechanism. The permission synchronization engine includes real-time push via MQTT protocol, offline mode caching, conflict detection, and automatic arbitration.

5. The system for dynamically generating identity code authorization verification according to claim 1, characterized in that: The multimodal recognition terminal includes a QR code scanner, an NFC card reader, and a 3D structured light camera. The edge computing unit includes a lightweight TensorFlow Lite model, local biometric comparison, and abnormal data caching. The instruction execution unit includes relay control, TCP / IP / RS485 protocol conversion, and operation result feedback.

6. The system for dynamically generating identity code authorization verification according to claim 1, characterized in that: The operation and maintenance monitoring center includes a system operation status visualization dashboard, real-time monitoring of device online rate and performance indicators; the policy configuration center includes a visual drag-and-drop configuration of permission rules, time period / region / person combination policies and policy effect simulation; and the certificate management system includes digital certificate full lifecycle management, CRL / OCSP online verification and rapid response to certificate revocation.

7. A method for dynamically generating identity code authorization verification, and a system for dynamically generating identity code authorization verification according to any one of claims 1 to 6, characterized in that: Includes the following steps: S1. Identity initialization phase: biometric data collection and registration; S1.

1. Users can enter biometric features through a multimodal acquisition terminal, which supports face, iris and fingerprint entry. Face recognition uses a 3D structured light camera to collect the coordinates of 50 facial key points. Iris recognition uses infrared imaging to obtain iris texture data with a diameter ≥11mm. Fingerprint recognition uses a capacitive sensor with a resolution of 500dpi. S1.

2. Data preprocessing, noise reduction filtering, median filtering plus Gaussian filtering combination, normalization processing, and size uniform to 256x256 pixels; S1.

3. Biometric Hash Calculation: S1.

4. Digital Identity Generation: A unique identity ID is generated in the cloud, and the biometric hash value is stored in an encrypted manner. Finally, the identity credentials are returned, including the encrypted biometric hash and the initial permission level; S2. Dynamic identity code generation stage, dynamic parameter combination; S2.

1. Timestamp generation, UTC time millisecond precision, random number generation, hardware random number generator (TRNG) collects 256-bit random numbers, combined with software entropy source, keyboard key press interval and mouse movement trajectory; S2.

2. Device binding information, terminal device MAC address, GPS geographic location, accuracy ≤10 meters; S2.

3. Identification code encoding, parameter concatenation: base_str=time_stamp+random_num+device_info+feature_hash; S2.

4. Dynamic Signature: S2.

5. Multimodal encoding, QR code generation supports QR Code V4, NFC tags write encrypted data in NDEF format, barcode generation uses Code 128 encoding, and data capacity is ≤48 characters; S3. Dynamic permission management phase: Permission policy configuration; S3.

1. Strategy Tree Construction: S3.

2. Policy distribution via MQTT protocol for real-time push, QoS=2 to guarantee delivery, offline mode via local caching; S3.

3. Permission activation mechanism, permission version number management, dynamic activation window, a 5-second buffer period is set after the new policy is pushed, during which the old policy remains valid; S3.

4. Conflict Detection; S4. Multimodal verification stage, identity code parsing; S4.

1. Terminal scanning, card swiping and NFC reading, QR code parsing, Zxing library decoding, NFC parsing ISO14443 Type A / B protocol parsing; S4.

2. Data verification: timestamp validity ±5-minute error window; signature verification SM3 hash comparison. S4.

3. Real-time biometric comparison, terminal collects real-time biometric features, face detection and iris localization; S4.

4. Feature Comparison: def biometric_verify(live_feature,stored_hash): computed_hash=bio_hash(live_feature) return hmac.compare_digest(computed_hash,stored_hash); S4.

5. Real-time permission verification and permission tree traversal; S4.

6. Dynamic permission updates: When permissions change, the terminal cache is immediately invalidated, and a 5-second policy synchronization timeout window is set. S5. Results Feedback and Audit Phase: Verification of Results Processing A successful path generates an access token to control the access control mechanism. A failed path triggers a local alarm and reports it to the audit log, including the operation time, location, and terminal ID. S6. Data synchronization and archiving: Real-time synchronization and verification results are written to the big data platform in real time via Kafka, and archived asynchronously. Logs are compressed into Snappy format at midnight every day and stored in object storage for 180 days. S7. Exception handling mechanism; S7.

1. Biometric failure scenario: If the biometrics fails 3 times in a row, the account will be locked for 30 minutes, triggering the biometrics update process, which requires re-collection and registration. S7.

2. In the event of a conflict of permissions, when multiple policies are applied simultaneously, the principle of least privilege shall be adopted, and a manual review process shall be triggered. S7.

3. In the scenario of network interruption, the terminal enables local policy caching, and operation records during the network outage are cached locally and re-uploaded after the network is connected.

Images