A Method for Integrity Protection of Access Control Records Based on Commercial Cryptographic Algorithms

Abstract

This invention discloses a method for protecting the integrity of access control record storage based on commercial cryptographic algorithms, comprising: collecting access control records and concatenating them into complete record data A1 according to a predetermined format; calling a PCI-E cryptographic card and calculating the MAC value M1 of A1 using HMAC technology based on the SM3 national cryptographic algorithm, and storing A1 and M1 together in a background database; when it is necessary to verify the integrity of the access control record, reading the current record data A2 and the originally stored MAC value M1 from the background database; calling a PCI-E cryptographic card and calculating the MAC value M2 of A2 using the same algorithm; comparing M1 and M2, if they match, the record is determined to be complete; if they do not match, the record is determined to have been tampered with and an alarm message is generated. This invention has the advantages of high security, strong compliance, superior performance, and good economy, and can be widely used in access control systems with security levels of Level 3 and above.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, and in particular relates to a method for protecting the integrity of access control record storage based on commercial cryptographic algorithms. Background Technology

[0002] Traditional access control systems mostly use IC card / M1 card solutions with chips such as S50 and F11RF08 as carriers. Their encryption mechanism was cracked in 2008, resulting in serious security risks such as card duplication, authorization forgery, and easy tampering of access control records.

[0003] According to relevant regulations, access control systems at or above Level 3 of the Information Security Protection System must use cryptographic technology to achieve identity authentication and data integrity protection for access control records.

[0004] In existing technologies, the protection methods for access control records do not employ commercial cryptographic algorithms approved by the State Cryptography Administration, making it difficult to meet the requirements of Level 3 or above of the Information Security Protection Standard.

[0005] Therefore, how to provide a method for protecting the integrity of access control records that meets national cryptographic compliance requirements while possessing high security and performance has become a pressing technical problem to be solved in this field. Summary of the Invention

[0006] In view of this, the present invention aims to overcome the shortcomings of the above-mentioned problems in the prior art and proposes a method for protecting the integrity of access control record storage based on commercial cryptographic algorithms.

[0007] To achieve the above objectives, the technical solution of the present invention is implemented as follows:

[0008] In a first aspect, the present invention provides a method for protecting the integrity of access control record storage based on commercial cryptographic algorithms, comprising the following steps:

[0009] Step S1: The access control system collects user operation records and concatenates them according to a preset format to generate plaintext access control record A1;

[0010] Step S2: Call the built-in PCI-E cryptographic card, use HMAC technology based on the SM3 national cryptographic algorithm to calculate the MAC value M1 of the plaintext A1, and save the plaintext A1 and the MAC value M1 to the background database;

[0011] Step S3: When viewing access control records, read the current record plaintext A2 and the original stored MAC value M1 from the backend database;

[0012] Step S4: Invoke the PCI-E cryptographic card and use the same HMAC technology based on the SM3 national cryptographic algorithm to calculate the MAC value M2 of the current plaintext A2;

[0013] Step S5: Compare the MAC value M1 with the MAC value M2. If they match, the record is considered complete. If they do not match, the record is considered to have been tampered with.

[0014] Furthermore, the access control records are generated by the access control system and uploaded to the log auditing system, which then completes the interaction with the PCI-E password card and data storage.

[0015] Furthermore, the access control record plaintext A1 includes at least one of the following: personnel ID, entry / exit time, device number, verification method, and entry / exit direction.

[0016] Furthermore, the PCI-E cryptographic card is built into the back-end management host and is used to execute the SM3 algorithm and HMAC calculation.

[0017] Furthermore, in step S5, if it is determined that the record has been tampered with, the system generates a tampering alarm message and marks the device number and time information of the tampered record for security personnel to trace and verify.

[0018] Furthermore, the access control records originate from access control systems that employ facial recognition and / or national cryptographic CPU card verification methods.

[0019] Furthermore, the background database is an encrypted database used to bind and store the plaintext record A1 and the MAC value M1.

[0020] Secondly, the present invention provides an access control record storage integrity protection system based on commercial cryptographic algorithms, comprising:

[0021] The access control system module is used to collect user operation records through the access control system and generate access control record plaintext A1 by splicing them together according to a preset format;

[0022] The PCI-E cryptographic card module is used to call the built-in PCI-E cryptographic card, and uses HMAC technology based on the SM3 national cryptographic algorithm to calculate the MAC value M1 of the plaintext A1, and save the plaintext A1 and the MAC value M1 to the background database.

[0023] The backend database module is used to read the plaintext A2 of the current record and the original stored MAC value M1 from the backend database when viewing access control records.

[0024] The interaction module is used to call the PCI-E cryptographic card and use the same HMAC technology based on the SM3 national cryptographic algorithm to calculate the MAC value M2 of the current plaintext A2.

[0025] The verification alarm module is used to compare the MAC value M1 with the MAC value M2. If they match, the record is determined to be complete; if they do not match, the record is determined to have been tampered with.

[0026] Thirdly, the present invention provides an electronic device, including a processor and a memory communicatively connected to the processor and used to store executable instructions of the processor, wherein the processor is used to execute the above-described method for protecting the integrity of access control record storage based on a commercial cryptographic algorithm.

[0027] Fourthly, the present invention provides a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, it implements the above-mentioned method for protecting the storage integrity of access control records based on commercial cryptographic algorithms.

[0028] Compared with existing technologies, the access control record storage integrity protection method based on commercial cryptographic algorithms described in this invention has the following advantages:

[0029] This invention applies national cryptographic algorithms to encrypt access control records, providing high security and ensuring that the records are not tampered with or accessed. Through a closed-loop mechanism of "write-bind storage - read-compare-verify," any tampering with access control records can be detected and discovered in a timely manner.

[0030] The access control record storage integrity protection method of the present invention is implemented by using a PCI-E cryptographic card in conjunction with a log auditing system, reducing the investment in large-scale encryption equipment.

[0031] The method of this invention automatically alarms and marks the equipment, time, and personnel information when the record is tampered with, which facilitates security auditing and tracing of violations. Attached Figure Description

[0032] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an undue limitation of the invention. In the drawings:

[0033] Figure 1 This is a schematic diagram of the method of the present invention;

[0034] Figure 2 This is a schematic flowchart of the method of the present invention. Detailed Implementation

[0035] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other.

[0036] The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0037] Example 1

[0038] refer to Figure 1-2 This invention provides a method for protecting the integrity of access control record storage based on commercial cryptographic algorithms, including the following:

[0039] User operation records are transmitted to the log auditing system on the backend management host. The log auditing system uses the built-in PCI-E cryptographic card and the SM3 algorithm to perform MAC value calculation and verification operations on the log records in order to achieve integrity protection of the log records.

[0040] The collected access control records are processed to a standardized format. Specifically, information such as personnel ID, entry / exit time, and access control device number are concatenated into a complete record (denoted as A1) according to a specific format for subsequent HMAC calculation.

[0041] The built-in PCI-E cryptographic card is invoked, and HMAC technology based on the SM3 national cryptographic algorithm is used to calculate the MAC value of A1 (denoted as M1), and the plaintext A1 and M1 are saved to the background database.

[0042] When a user views this log record in the log auditing system, the log auditing system reads the current plaintext value from the backend database, calculates A2, and sends A2 and M1 to the PCI-E cryptographic card;

[0043] The PCI-E cryptographic card uses its own key and employs HMAC technology based on SM3 to calculate the MAC value of A2 (denoted as M2). It then compares M1 with M2. If they match, the log record is considered normal; otherwise, it indicates that the log record has been tampered with.

[0044] Example 2

[0045] This embodiment uses access control management of a company's core data center as an example. This data center is a Level 1 protected area for the company, and access control records must meet Level 3 security protection requirements to prevent internal maintenance personnel or external personnel from tampering with access records to cover up unauthorized operations. This embodiment employs HMAC technology based on the SM3 national cryptographic algorithm combined with a PCI-E cryptographic card integrity protection method throughout the process.

[0046] I. System Deployment

[0047] A log auditing system is deployed on the backend management host of the enterprise's core data center, with a built-in PCI-E cryptographic card. The PCI-E cryptographic card has pre-installed SM3 algorithm and HMAC calculation functions, and the key is stored securely within the card, not exposed externally. The access control system uses a two-factor authentication method combining facial recognition and a national cryptographic CPU card.

[0048] II. Access Control Record Generation and Protection

[0049] When maintenance personnel enter the data center using a combination of facial recognition and a national cryptographic CPU card, the access control system automatically collects the following information:

[0050] Employee ID: Y008

[0051] Entry / Exit Time: March 4, 2026, 09:25:16

[0052] Access control device number: JF01

[0053] Verification method: Face recognition + national cryptographic CPU card

[0054] Direction of entry and exit: Enter

[0055] The access control system concatenates this information into a unique access control record plaintext A1 according to a predetermined format:

[0056] “Y008-20260304092516-JF01-Face Recognition + National Cryptographic CPU Card-Entry”

[0057] The access control system immediately invokes the PCI-E cryptographic card deployed on the backend server, sending the plaintext A1 to the card. The cryptographic card uses its internally stored key and an SM3-based HMAC algorithm to calculate the corresponding MAC value M1. Subsequently, the system binds the plaintext A1 with the MAC value M1 and synchronously stores it in a dedicated encrypted database in the computer room.

[0058] III. Access Control Record Viewing and Integrity Verification

[0059] The company's information security department audits the data center access control records weekly. When security personnel view a maintenance personnel's entry / exit record in the log auditing system, the system automatically performs the following operations:

[0060] Read the current access control record plaintext A2 and the original stored MAC value M1 from the encrypted database;

[0061] The PCI-E cryptographic card is invoked again, A2 is passed in, and the MAC value M2 is calculated using the same SM3-based HMAC algorithm;

[0062] The system automatically compares M1 and M2.

[0063] IV. Result Determination and Alarm

[0064] If M1 and M2 are the same, the system determines that the record has not been tampered with, is stored intact, and displays the record content normally.

[0065] If M1 and M2 are inconsistent, the system determines that the record has been tampered with, immediately displays a tampering alarm message, and marks key information such as the device number and time of the tampered record for security personnel to trace and verify.

[0066] V. Practical Application Results

[0067] In the actual operation of this embodiment, the system successfully detected an operations and maintenance personnel attempting to modify the time record of entering the data center. Because the plaintext of this record was modified, the recalculated MAC value M2 was inconsistent with the original stored M1. The system promptly triggered a tampering alarm and recorded the relevant information. Security personnel then took appropriate action to handle the violation, effectively preventing further escalation of the security incident.

[0068] The method of this invention is low in cost, flexible in deployment, and highly compatible, and has broad prospects for industrial application.

[0069] Example 3

[0070] An access control record storage integrity protection system based on commercial cryptographic algorithms includes:

[0071] The access control system module is used to collect user operation records through the access control system and generate access control record plaintext A1 by splicing them together according to a preset format;

[0072] The PCI-E cryptographic card module is used to call the built-in PCI-E cryptographic card, and uses HMAC technology based on the SM3 national cryptographic algorithm to calculate the MAC value M1 of the plaintext record A1, and save the plaintext record A1 and the MAC value M1 to the background database.

[0073] The backend database module is used to read the plaintext A2 of the current record and the original stored MAC value M1 from the backend database when viewing access control records.

[0074] The interaction module is used to call the PCI-E cryptographic card and use the same HMAC technology based on the SM3 national cryptographic algorithm to calculate the MAC value M2 of the current plaintext A2.

[0075] The verification alarm module is used to compare the MAC value M1 with the MAC value M2. If they match, the record is determined to be complete; if they do not match, the record is determined to have been tampered with.

[0076] Example 4

[0077] Thirdly, the present invention provides an electronic device, including a processor and a memory communicatively connected to the processor and used to store executable instructions of the processor, wherein the processor is used to execute the above-described method for protecting the integrity of access control record storage based on a commercial cryptographic algorithm.

[0078] Example 5

[0079] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the aforementioned method for protecting the integrity of access control record storage based on commercial cryptographic algorithms.

[0080] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in this disclosure all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0081] It should be noted that personal information collected from users should be used for legitimate and reasonable purposes and should not be shared or sold outside of these legitimate uses. Furthermore, such collection / sharing should only be conducted after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign an agreement / authorization that includes authorization of relevant user information before the user uses the function. In addition, any necessary steps must be taken to protect and safeguard access to such personal information data and ensure that others with access to personal information data comply with their privacy and procedures.

[0082] This disclosure is intended to provide implementation schemes for users to selectively prevent the use or access to their personal information data. Specifically, this disclosure is intended to provide hardware and / or software to prevent or block access to such personal information data. Once personal information data is no longer needed, risks can be minimized by restricting data collection and deleting data. Furthermore, where applicable, such personal information is de-identified to protect user privacy.

[0083] The acquisition, transmission, storage, use, and processing of data in this disclosed technical solution all comply with the relevant provisions of national laws and regulations.

[0084] It should be noted that in the embodiments disclosed herein, certain software, components, models, and other existing solutions in the industry may be mentioned. These should be considered as exemplary and are intended only to illustrate the feasibility of implementing the technical solution of this application. However, they do not mean that the applicant has used or necessarily used such solutions.

[0085] In the foregoing descriptions of the embodiments, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this disclosure. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0086] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this disclosure, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0087] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing custom logic functions or processes, and the scope of preferred embodiments of this disclosure includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as will be understood by those skilled in the art to which embodiments of this disclosure pertain.

[0088] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which programs can be printed, because programs can be obtained electronically, for example, by optically scanning the paper or other media, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0089] It should be understood that various parts of this disclosure can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. If implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0090] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0091] Furthermore, the functional units in the various embodiments of this disclosure can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0092] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of the present disclosure have been shown and described above, it is to be understood that the above embodiments are exemplary and should not be construed as limiting the present disclosure. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present disclosure.

Claims

1. A method for access record storage integrity protection based on commercial cipher algorithm, characterized in that: Includes the following steps: Step S1: The access control system collects user operation records and concatenates them according to a preset format to generate plaintext access control record A1; Step S2: Call the built-in PCI-E cryptographic card, use HMAC technology based on the SM3 national cryptographic algorithm to calculate the MAC value M1 of the plaintext A1, and save the plaintext A1 and the MAC value M1 to the background database; Step S3: When viewing access control records, read the current record plaintext A2 and the original stored MAC value M1 from the backend database; Step S4: Invoke the PCI-E cryptographic card and use the same HMAC technology based on the SM3 national cryptographic algorithm to calculate the MAC value M2 of the current plaintext A2; Step S5: Compare the MAC value M1 with the MAC value M2. If they match, the record is considered complete. If they do not match, the record is considered to have been tampered with.

2. The access record storage integrity protection method based on a commercial cipher algorithm according to claim 1, characterized in that: The access control records are generated by the access control system and uploaded to the log auditing system, which then handles the interaction with the PCI-E password card and the data storage.

3. The method for protecting the integrity of access control record storage based on commercial cryptographic algorithms according to claim 1, characterized in that: The access control record plaintext A1 includes at least one of the following: personnel ID, entry / exit time, device number, verification method, and entry / exit direction.

4. The method for protecting the integrity of access control record storage based on commercial cryptographic algorithms according to claim 1, characterized in that: The PCI-E cryptographic card is built into the back-end management host and is used to execute the SM3 algorithm and HMAC calculation.

5. The method for protecting the integrity of access control record storage based on commercial cryptographic algorithms according to claim 1, characterized in that: In step S5, if it is determined that the record has been tampered with, the system generates a tampering alarm message and marks the device number and time information of the tampered record for security personnel to trace and verify.

6. The method for protecting the integrity of access control record storage based on commercial cryptographic algorithms according to claim 1, characterized in that: The access control records are sourced from access control systems that use facial recognition and / or national cryptographic CPU card verification methods.

7. The method for protecting the integrity of access control record storage based on commercial cryptographic algorithms according to claim 1, characterized in that: The background database is an encrypted database used to bind and store the plaintext record A1 and the MAC value M1.

8. A system for protecting the integrity of access control record storage based on commercial cryptographic algorithms, characterized in that: include: The access control system module is used to collect user operation records through the access control system and generate access control record plaintext A1 by splicing them together according to a preset format; The PCI-E cryptographic card module is used to call the built-in PCI-E cryptographic card, and uses HMAC technology based on the SM3 national cryptographic algorithm to calculate the MAC value M1 of the plaintext A1, and save the plaintext A1 and the MAC value M1 to the background database. The backend database module is used to read the plaintext A2 of the current record and the original stored MAC value M1 from the backend database when viewing access control records. The interaction module is used to call the PCI-E cryptographic card and use the same HMAC technology based on the SM3 national cryptographic algorithm to calculate the MAC value M2 of the current plaintext A2. The verification alarm module is used to compare the MAC value M1 with the MAC value M2. If they match, the record is determined to be complete; if they do not match, the record is determined to have been tampered with.

9. An electronic device comprising a processor and a memory communicatively connected to the processor and used for storing processor-executable instructions, characterized in that: The processor is used to execute the method described in any one of claims 1-7.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, it implements the method described in any one of claims 1-7.

Images