A method and system for directional information transmission of a reader-writer based on wireless communication

Abstract

The application discloses a kind of reader-writer directional information transmission method and system based on wireless communication, it is related to wireless communication and information security technical field, including: reader-writer terminal reads identity information in data carrier, and identity information, terminal identification and operator identity certificate are sent to strategy engine;Strategy engine carries out verification and determines service category, determines output field and transmission protection mode according to access control rule decision data field;According to the differential processing of transmission protection mode to output field;Establish secure transmission channel, and forward processing result to corresponding authorized organization unit.Solve the technical problems that data transmission content and service demand matching degree are insufficient in prior art, unnecessary information transmission is prone to be generated and transmission process traceability is poor.

Description

Technical Field

[0001] This invention relates to the fields of wireless communication and information security technology, specifically to a method and system for directional information transmission of a reader / writer based on wireless communication. Background Technology

[0002] With the informatization of government services, medical services, and other businesses, data carriers such as ID cards, social security cards, and medical cards are increasingly being used in scenarios such as window service processing, identity verification, and information inquiry. During the business processing, reader terminals typically read relevant information from the data carriers via wireless communication and transmit the reading results to the back-end business system to complete the corresponding business processing.

[0003] In practical applications, the same data carrier may be associated with multiple types of information, and the scope of data involved varies across different business scenarios. After the reader terminal completes data reading, the backend business system typically needs to process the relevant information in conjunction with the current business process. When the business system involves multiple business modules, multiple positions, and multiple information systems, the information corresponding to the same data carrier may be accessed or processed in different business stages, making the data access process complex in terms of the scope of data, processing stages, and transfer objects.

[0004] On the other hand, during window service processing, data access is usually accompanied by information such as operators, terminal devices, and specific business matters. When the same data carrier is used by different business terminals or different business personnel, the related access behaviors will generate different data processing records. Due to the highly dynamic nature of actual business processes, the data access process involves many information sources and processing links. In the case of frequent data interaction, it is easy to encounter situations such as difficulty in accurately distinguishing data access processes, difficulty in tracking data flow, and inconvenience in querying historical access records.

[0005] Furthermore, during data transmission via wireless communication and networks, data may pass through reader terminals, back-end business systems, and other business processing nodes. Different business stages have different data processing requirements. When data processing involves multiple systems and transmission stages, ensuring the consistency and security of business data during normal flow, and mitigating information security risks arising during data interaction, become issues that need to be addressed in relevant information technology business applications.

[0006] Therefore, in the existing data interaction and business processing of readers, there are still problems such as complex data processing, difficulty in tracking data flow, and the need to improve data interaction security. Summary of the Invention

[0007] This invention provides a reader-writer directional information transmission method and system based on wireless communication to solve the technical problems in the prior art where the data transmission content of the reader terminal and the back-end business system do not match the actual business needs, easily resulting in information transmission that exceeds business requirements, and the traceability of the data transmission process is poor.

[0008] The technical solution of the present invention to solve the above-mentioned technical problems is as follows: In a first aspect, the present invention provides a reader-writer directional information transmission method based on wireless communication, comprising: S1. The reader terminal reads the identity information stored in the data carrier through the wireless communication interface, and sends the identity information together with the terminal identifier of the reader terminal and the identity certificate of the operator to the policy engine. S2. The policy engine verifies the identity information, terminal identifier, and identity credentials, automatically determines the current business category, and adjudicates each data field associated with the data carrier according to the pre-configured access control rules, determining the output field set and the transmission protection method of each field; S3. Perform differential processing on each field in the output field set according to the transmission protection method; S4. Establish a secure transmission channel and forward the differentiated processing results output in step S3 to the authorized organizational unit corresponding to the current business category via the secure transmission channel.

[0009] Secondly, the present invention provides a reader-writer directional information transmission system based on wireless communication, comprising: The identity information submission module is used to read the identity information stored in the data carrier through the wireless communication interface, and send the identity information together with the terminal identifier of the reader terminal and the identity certificate of the operator to the policy engine. The business category and field adjudication module is used to verify the identity information, terminal identifier and identity certificate, automatically determine the current business category, and adjudicate each data field associated with the data carrier according to the pre-configured access control rules, and determine the output field set and the transmission protection method of each field. The field differentiation processing module is used to perform differentiation processing on each field in the output field set according to the transmission protection method; The secure transmission module is used to establish a secure transmission channel and forward the differentiated processing result output in step S3 to the authorized organizational unit corresponding to the current business category via the secure transmission channel.

[0010] One or more technical solutions provided in this invention have at least the following technical effects or advantages: By verifying the identity information, terminal identifier, and operator identity credentials obtained by the reader terminal, and making targeted decisions on data fields based on business categories, the system achieves matching of data fields with current business needs. By adopting corresponding transmission protection methods and performing differentiated processing for different data fields, the system reduces the transmission of unnecessary data. By establishing a secure transmission channel for transmitting processed data, the system improves the security of the data interaction process. At the same time, by generating and storing audit logs corresponding to the business access process, the system achieves the recording and traceability of the data access process. Attached Figure Description

[0011] Figure 1 This is a schematic flowchart of a reader-writer directional information transmission method based on wireless communication provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of the secure transmission process between the data carrier and the reader / writer provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of a reader-writer directional information transmission system based on wireless communication, provided in an embodiment of the present invention.

[0012] In the attached diagram, the components represented by each number are as follows: Identity information submission module 11, business category and field adjudication module 12, field differentiation processing module 13, secure transmission module 14. Detailed Implementation

[0013] This invention provides a reader-writer directional information transmission method and system based on wireless communication, which specifically solves the technical problems in the prior art where the data transmission content of the reader terminal and the back-end business system do not match the actual business needs, easily resulting in information transmission that exceeds business requirements, and the traceability of the data transmission process is poor.

[0014] It should be noted that the terms "comprising" and "having" are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or modules that are not explicitly listed or that are inherent to these processes, methods, products, or devices.

[0015] Example 1, as Figure 1 As shown, the present invention provides a reader-writer directional information transmission method based on wireless communication, comprising: S1. The reader terminal reads the identity information stored in the data carrier through the wireless communication interface and sends the identity information, along with the terminal identifier of the reader terminal and the identity certificate of the operator, to the policy engine. Step S1 in the method provided in this embodiment of the invention includes: The reader terminal reads the identity information and public key certificate of the data carrier stored in the data carrier through the wireless communication interface; The reader terminal verifies the validity of the public key certificate; If the verification is successful, the reader terminal receives the identity information output by the data carrier; The reader terminal assembles a submission packet containing identity information, terminal identifier, and identity credentials, and then sends the submission packet to the policy engine.

[0016] In this embodiment, the reader terminal sends a read request to the data carrier through a wireless communication interface. In response to the read request, the data carrier outputs the stored identity information and public key certificate, and the reader terminal receives the identity information and public key certificate.

[0017] The identity information is used to identify the object corresponding to the data carrier, and the public key certificate is used to provide the public key and certificate information corresponding to the data carrier. After receiving the public key certificate, the reader terminal verifies its validity.

[0018] Specifically, the reader terminal obtains the effective and expiration times of the public key certificate, and obtains the current time, determining whether the current time falls between the effective and expiration times. If the current time is greater than or equal to the effective time and less than or equal to the expiration time, the certificate validity period verification is considered successful; otherwise, the certificate validity period verification is considered unsuccessful.

[0019] For example, if a public key certificate for a data carrier is valid from January 1, 2026 to January 1, 2027, and the current time is August 19, 2026, the current time is between the validity period and the expiration period, so the certificate validity period verification is successful.

[0020] Furthermore, the reader terminal verifies the digital signature of the public key certificate. The reader terminal obtains the parent certificate corresponding to the public key certificate and uses the public key in the parent certificate to verify the digital signature of the public key certificate. If the digital signature verification is successful, the certificate signature verification is considered successful; if the digital signature verification fails, the certificate signature verification is considered unsuccessful.

[0021] Furthermore, the reader terminal verifies the certificate chain of the public key certificate. Based on the issuer information in the public key certificate and its parent certificate, the reader terminal verifies the hierarchical relationship between certificates at each level, tracing upwards along the certificate issuance chain. If the public key certificate can be traced back to the pre-configured trusted root certificate in the reader terminal's certificate issuance chain, the certificate chain verification is considered successful; otherwise, the certificate chain verification is considered unsuccessful.

[0022] Among them, certificate signature verification is used to determine whether the digital signature of the public key certificate can be verified by the public key in the corresponding higher-level certificate, and certificate chain verification is used to determine whether the public key certificate can be traced back to the pre-configured trusted root certificate through the signing relationship between certificates at all levels.

[0023] In this embodiment, the validity of the public key certificate is determined using a combined method of necessary conditions. Specifically, passing the certificate validity period verification, certificate signature verification, and certificate chain verification are each recorded as 1, and failing the corresponding verification is recorded as 0. Then: The result of public key certificate validity determination = certificate validity period verification result × certificate signature verification result × certificate chain verification result.

[0024] When all three verification results are 1, the public key certificate validity determination result is 1×1×1=1, indicating that the public key certificate is valid; when any verification result is 0, the public key certificate validity determination result is 0, indicating that the public key certificate is invalid.

[0025] For example, when a data carrier's public key certificate is valid, the digital signature verification passes, and the certificate chain can be traced back to the trusted root certificate pre-configured on the reader terminal, the public key certificate validity determination result is 1 × 1 × 1 = 1, and the public key certificate is determined to be valid. When a data carrier's public key certificate has expired, but the digital signature verification passes and the certificate chain can be traced back to the trusted root certificate, the public key certificate validity determination result is 0 × 1 × 1 = 0, and the public key certificate is determined to be invalid. When a public key certificate is valid, the certificate chain verification passes, but the digital signature verification fails, the public key certificate validity determination result is 1 × 0 × 1 = 0, and the public key certificate is also determined to be invalid.

[0026] Once the public key certificate is verified to be valid, the reader terminal receives the identity information output by the data carrier. Specifically, the reader terminal sends an identity information retrieval command to the data carrier, the data carrier responds to the identity information retrieval command by outputting its stored identity information, and the reader terminal receives the identity information.

[0027] When the public key certificate is determined to be invalid, the reader terminal will not accept the identity information output by the data carrier and will end the current identity information acquisition process.

[0028] Upon receiving the identity information, the reader terminal obtains its own terminal identifier and the operator's identity credentials, and assembles a submission packet. The submission packet contains the identity information, terminal identifier, and identity credentials.

[0029] For example, if the identity information output by the data carrier is EMP-2026-0158, the terminal identifier of the reader terminal is RDR-0032, and the identity credential of the operator is OP-028, then the reader terminal will assemble the submission packet according to the preset data format as EMP-2026-0158 + RDR-0032 + OP-028.

[0030] The plus sign indicates that the identity information, terminal identifier, and identity credential are combined according to a preset field order, rather than performing numerical calculations on the field content.

[0031] After completing the submission packet assembly, the reader terminal sends the submission packet to the policy engine.

[0032] For example, in a government service platform or hospital information platform, when a citizen or patient swipes their card at a window terminal using their identification medium, the reader terminal reads the identity information and public key certificate from the data carrier. After confirming the validity of the public key certificate, it receives the identity information and obtains the terminal identifier of the current reader terminal and the operator's identity credential. If the identity information received by the reader terminal is EMP-2026-0158, the terminal identifier is RDR-0032, and the operator's identity credential is OP-028, then the submission packet is EMP-2026-0158 + RDR-0032 + OP-028. Subsequently, the reader terminal sends the submission packet to the policy engine, which then performs subsequent processing based on the identity information, terminal identifier, and identity credential.

[0033] In summary, this step verifies the validity of the public key certificate of the data carrier, obtains the identity information after successful verification, and assembles the identity information, terminal identifier, and operator identity credentials into a submission packet and sends it to the policy engine. This completes the initial information collection and submission of the current data access request, providing a basis for subsequent business category determination and data access adjudication.

[0034] The S2 policy engine verifies identity information, terminal identifiers, and identity credentials, automatically determines the current business category, and adjudicates each data field associated with the data carrier according to the pre-configured access control rules, determining the output field set and the transmission protection method for each field. Step S2 in the method provided in this embodiment of the invention includes: The strategy engine receives identity information, terminal identifier, and identity credentials, and performs four-factor verification based on the current business process node, terminal identifier, operator role, and time constraints. The strategy engine generates a valid business category identifier based on the corresponding valid conditions if and only if all four elements meet the preset legal conditions. When any element does not meet the preset legal conditions, the policy engine rejects the access request and generates an alarm log.

[0035] In this embodiment, the policy engine receives the submission packet sent by the reader terminal and extracts identity information, terminal identifier, and identity credentials from the submission packet. The policy engine determines the corresponding operator role based on the identity credentials, obtains the current business process node and the current time, and performs four-factor verification based on the current business process node, terminal identifier, operator role, and time constraints.

[0036] Among them, the current business process node represents the business process stage in which the current access request is located; the terminal identifier represents the reader / writer terminal that initiated the current access request; the operator role is determined based on identity credentials; and the time constraint limits the allowed access time range corresponding to the current business category. These four elements correspond to preset legal conditions, and the policy engine matches the four elements actually acquired with their respective legal conditions.

[0037] Specifically, the strategy engine obtains the current business process node and matches it with preset valid business process nodes. If the current business process node matches the preset valid business process node, the business process node is deemed to have passed verification; otherwise, the business process node is deemed to have failed verification.

[0038] Furthermore, the policy engine matches the terminal identifier in the submission packet with a preset set of valid terminal identifiers. If the terminal identifier belongs to the preset set of valid terminal identifiers, the terminal identifier verification is deemed successful; otherwise, the terminal identifier verification is deemed unsuccessful.

[0039] Furthermore, the policy engine determines the operator's role based on the identity credentials and matches the operator's role with preset legitimate operator roles. If the operator's role matches a preset legitimate operator role, the operator's role verification is considered successful; otherwise, the operator's role verification is considered unsuccessful.

[0040] Furthermore, the policy engine obtains the current time and verifies it according to preset time constraints. If the current time is within the preset allowed access time range, the time constraint verification is deemed successful; otherwise, the time constraint verification is deemed unsuccessful.

[0041] The allowed access time range is determined based on the actual running time of the corresponding business process.

[0042] For example, if a business process is configured to allow access from 08:00 to 18:00 daily, then 08:00 is the starting boundary of the allowed access time, and 18:00 is the ending boundary. If the current time is greater than or equal to 08:00 and less than or equal to 18:00, the time constraint verification is considered successful; otherwise, the time constraint verification is considered unsuccessful.

[0043] In this embodiment, the four elements are determined using a joint determination method based on necessary conditions. Specifically, passing the verification of the business process node, the terminal identifier, the operator's role, and the time constraint is recorded as 1, and failing the corresponding verification is recorded as 0. The four-factor verification result = business process node verification result × terminal identifier verification result × operator role verification result × time constraint verification result.

[0044] When all four verification results are 1, the four-element verification result = 1 × 1 × 1 × 1 = 1, indicating that all four elements meet the preset legal conditions. When any verification result is 0, the four-element verification result is 0.

[0045] The strategy engine generates a valid business category identifier based on the corresponding valid conditions if and only if the four-factor authentication result is 1. Specifically, the strategy engine determines the business category corresponding to the current access request based on the valid conditions matched by the current business process node, terminal identifier, operator role, and time constraint, and generates a business category identifier corresponding to the business category.

[0046] For example, the policy engine pre-configures the legal conditions for a certain business category as follows: the business process node is information verification, the legitimate terminal identifiers are RDR-001, RDR-002, and RDR-003, the legitimate operator role is business processing personnel, and the allowed access time is from 08:00 to 18:00 daily. When the policy engine receives a submission packet corresponding to the current business process node of information verification, the terminal identifier is RDR-002, the operator role corresponding to the identity credential is business processing personnel, and the current time is 10:30, all four elements meet the corresponding legal conditions. Therefore, the four-element verification result = 1 × 1 × 1 × 1 = 1. At this time, the policy engine determines the business category corresponding to the current access request based on the above-mentioned satisfied legal conditions and generates a valid business category identifier, such as BC-001.

[0047] In practical applications, such as in government service platforms or hospital information platforms, when citizens or patients swipe their identity cards at a window terminal, if the current business process node, the window terminal used for swiping the card, the current operator's role, and the current business processing time all meet the preset legal conditions of the corresponding business, the policy engine generates the corresponding business category identifier so that subsequent access control rules can determine the access scope of the data fields corresponding to that business.

[0048] When any element fails to meet the preset legal conditions, the policy engine determines that the four-element verification result is 0, rejects the current access request, and generates an alarm log.

[0049] For example, if the current business process node, terminal identifier, and time constraint all meet the preset legal conditions, but the operator role corresponding to the identity credential does not belong to the operator roles allowed by the current business, the four-factor verification result = 1 × 1 × 0 × 1 = 0. At this time, the policy engine rejects the current access request, does not generate a valid business category identifier, and generates a corresponding alarm log.

[0050] Step S2 in the method provided in this embodiment of the invention further includes: Construct query vectors based on organizational units, business categories, and data fields; Based on the query vector, the access control rules are traversed, and each data field associated with the data carrier is adjudicated based on matching. Based on the adjudication results, a data access token containing business category and field access permissions is generated. Send the data access token to the reader terminal; The reader terminal, in conjunction with the data carrier, verifies the legitimacy of the data access token; After verifying the validity, the intersection of the field access permissions with the access control list pre-stored in the data carrier is taken to determine the output field set and the transmission protection method of each field.

[0051] In this embodiment, the strategy engine receives the organizational unit information and business category identifier corresponding to the aforementioned access request, and obtains the data carrier associated field corresponding to the business category, and constructs a query vector with organizational unit, business category and data field as dimensions.

[0052] Specifically, the query vector consists of organizational unit, business category, and identification information corresponding to the data field, arranged in a preset field order, and can be represented as: Query vector = Organizational unit identifier + Business category identifier + Data field identifier.

[0053] The plus sign indicates that the fields are combined according to a preset order, rather than performing numerical calculations on each identifier.

[0054] For each data field associated with a data carrier, a corresponding query vector is formed.

[0055] For example, a data carrier is associated with four data fields: identity name, contact information, diagnosis information, and payment information. After the current organizational unit and business category are determined, four query vectors are formed for the above four data fields respectively.

[0056] Based on the query vector, the policy engine traverses the access control rules and makes matching-based decisions for each data field associated with the data carrier. Specifically, the policy engine matches the organizational unit identifier, business category identifier, and data field identifier in the query vector with the corresponding matching conditions in the access control rules, and determines the decision result for each data field based on the matching results.

[0057] For any data field, if its corresponding organizational unit, business category, and data field all match the corresponding conditions in the access control rule, the decision for that data field is to allow access; if any matching condition is not met, the decision for that data field is to disallow access.

[0058] Specifically, the matching of organizational unit, business category, and data field for a certain data field are respectively recorded as 1 or 0, where 1 is recorded when the corresponding matching condition is met and 0 is recorded when the corresponding matching condition is not met. Data field matching result = Organizational unit matching result × Business category matching result × Data field matching result.

[0059] When all three matching results are 1, the data field matching result = 1 × 1 × 1 = 1, indicating that the data field meets the corresponding access control rule; when any matching result is 0, the data field matching result = 0, indicating that the data field does not meet the corresponding access control rule.

[0060] After the policy engine completes the adjudication of each data field, it generates a data access token based on the adjudication results for each data field. The data access token contains the business category and field access permissions, which are used to represent the business category corresponding to the current access request and the field access permissions formed by the access control rules.

[0061] Specifically, the policy engine writes the field access permissions corresponding to the data fields that meet the corresponding access control rules into the data access token, and combines the business category identifier with the field access permissions.

[0062] For example, a business category identifier corresponding to an access request is BC-001. The data fields associated with the data carrier include identity name, contact information, diagnostic information, and payment information. After item-by-item matching and adjudication, if the identity name and contact information meet the corresponding access control rules, while the diagnostic information and payment information do not, the policy engine will generate a corresponding data access token based on the adjudication result. Data access token = Business category identifier BC-001 + Field access permissions {identity name, contact information}.

[0063] Here, + indicates a combination of different information fields.

[0064] After the data access token is generated, the policy engine sends the data access token to the reader terminal.

[0065] After receiving the data access token, the reader terminal verifies its legitimacy by combining it with the data carrier. Specifically, the reader terminal obtains the currently interacting data carrier and verifies the correspondence between the business category and field access permissions contained in the data access token and the current data carrier. If the data access token can establish a correspondence with the current data carrier, and the business category and field access permission information of the data access token passes the preset token verification conditions, the data access token is determined to be legitimate; otherwise, the data access token is determined to be illegitimate.

[0066] For example, in the hospital's medical information platform, when a patient swipes their medical card at the registration window, the strategy engine forms a query vector based on the organizational unit to which the registration window belongs, the current medical registration service category, and the data fields associated with the medical card. It then matches and adjudicates each field, including the patient's name, contact information, diagnosis information, and historical medical records. If the current service only matches the name and contact information fields, a data access token containing the medical registration service category and access permissions for the aforementioned two fields is generated and sent to the registration window reader terminal.

[0067] After receiving the data access token, the reader terminal verifies its correspondence with the patient's current medical card. If the verification is successful, the reader terminal takes the intersection of the field access permissions in the data access token with the access control list pre-stored on the medical card to determine the final set of output fields.

[0068] Specifically, the intersection operation of the set of data fields corresponding to the field access permissions and the set of allowed fields corresponding to the access control list pre-stored in the data carrier can be represented as: Output field set = Field access permission set ∩ Allowed field set corresponding to the data carrier access control list.

[0069] For example, the set of field access permissions in the data access token is {identity name, contact information, diagnostic information}, and the set of allowed fields corresponding to the access control list pre-stored in the current data carrier is {identity name, contact information, payment information}. Then the output field set = {identity name, contact information, diagnostic information} ∩ {identity name, contact information, payment information} = {identity name, contact information}.

[0070] Therefore, only data fields that exist simultaneously in both the field access permission set and the allowed field set pre-stored in the data carrier can enter the final output field set.

[0071] After determining the output field set, the reader terminal determines the corresponding data field from the data carrier and the data associated with the cardholder identified by the data carrier, and uses the data field that belongs to the output field set as the output field corresponding to this access request; data fields that do not belong to the output field set are not used as the output field of this access request.

[0072] Step S2 in the method provided in this embodiment of the invention further includes: An access control tensor is constructed using three dimensions: organizational unit, business category, and data field. Each element takes one of three decision results: allow plaintext transmission, de-identify transmission, or deny transmission. The data field dimension includes the fields stored within the data carrier and all fields in the information management system connected to the reader terminal that are associated with the cardholder identified by the data carrier.

[0073] In this embodiment, the policy engine constructs an access control tensor with three dimensions: organizational unit, business category, and data field. This tensor is used to represent the transmission decision results of different organizational units for different data fields under different business categories.

[0074] The access control tensor consists of three dimensions: the organizational unit dimension, the business category dimension, and the data field dimension. The organizational unit dimension represents the unit to which the organization or position initiating the data access request belongs; the business category dimension represents the business type corresponding to the current access request; and the data field dimension represents the data field to be adjudicated. These three dimensions together determine one element in the access control tensor, with each element corresponding to a data field adjudication result.

[0075] Each element in the access control tensor takes one of three values: allow plaintext transmission, transmit anonymously, or deny transmission. The result represents the access permission of the corresponding organizational unit to the corresponding data field under the corresponding business category.

[0076] In this embodiment, the three decision results are represented using discrete states.

[0077] For example, the values ​​1, 2, and 0 can be used to represent allowing plaintext transmission, de-identifying transmission, and rejecting transmission, respectively. The values ​​are only used for state storage and retrieval in the computer system and do not represent a numerical relationship between the three decision results.

[0078] Specifically, for any organizational unit, any business category, and any data field, the decision result for the corresponding element is determined based on pre-configured access control conditions, and this decision result is written to the corresponding position in the access control tensor. This process can be represented as: Access control tensor element = the adjudication result of the data fields under the corresponding organizational unit and business category.

[0079] When the corresponding data field meets the access control conditions for allowing plaintext transmission, the corresponding element record is set to allow plaintext transmission; when the corresponding data field meets the access control conditions for de-identified transmission, the corresponding element record is set to de-identified transmission; when the corresponding data field meets the access control conditions for denying transmission, the corresponding element record is set to deny transmission.

[0080] In this embodiment, the dimensional range and element states of the access control tensor are derived from the actual business configuration. The organizational unit dimension is determined based on the actual organizational structure and data access responsibilities, the business category dimension is determined based on the actual business process, the data field dimension is determined based on the data carrier and the field set in the information management system, and the adjudication result of the specific element is determined based on the data access permission configuration in the corresponding business scenario.

[0081] Furthermore, the data field dimension includes the fields stored within the data carrier, as well as all fields in the information management system connected to the reader terminal that are associated with the cardholder identified by the data carrier.

[0082] Among them, the fields stored in the data carrier are those that are stored in the data carrier and can be read; the fields associated with the cardholder in the information management system are the data fields that the information management system establishes association with based on the cardholder's identity identified by the data carrier.

[0083] Specifically, the strategy engine obtains the set of fields corresponding to the data carrier, and based on the cardholder identity identified by the data carrier, queries the information management system connected to the reader terminal for data fields associated with that cardholder. The two sets of fields are then merged, and duplicate fields are removed to obtain the data field dimension. The data field dimension can be represented as: Data field dimension = Data carrier field set ∪ Cardholder associated field set.

[0084] For example, if the fields stored in a data carrier include name, ID number, and card number, and the fields associated with the cardholder in the information management system include name, ID number, contact information, address, and historical transaction records, then the data field dimension = {name, ID number, card number} ∪ {name, ID number, contact information, address, historical transaction records} = {name, ID number, card number, contact information, address, historical transaction records}.

[0085] After obtaining the dimensions of the data fields, the policy engine configures the corresponding transmission adjudication results for each data field for each organizational unit and each business category, and forms an access control tensor.

[0086] For example, for window service processing organizational units and identity information verification service categories, the following field decisions can be generated:

[0087] At this point, each element in the access control tensor corresponding to the organizational unit and the business category records one of the three adjudication results.

[0088] Furthermore, for the same data field, different rulings can be made under different business categories.

[0089] For example, the name field can be configured to allow plaintext transmission under the identity verification business category, to be configured for anonymized transmission under the information query business category, and to be configured to deny transmission under other business categories that do not involve name information. Thus, through a joint index of organizational units, business categories, and data fields, differentiated access control results can be generated for the same data field under different business scenarios.

[0090] Step S2 in the method provided in this embodiment of the invention further includes: The first permission type corresponds to allowing plaintext transmission; The second permission type corresponds to transmission after data anonymization; The third permission type corresponds to denying transmission.

[0091] In this embodiment, after determining the field access permissions in the data access token, the policy engine identifies the field access permissions according to preset permission types. Field access permissions include a first permission type, a second permission type, and a third permission type, corresponding to allowing plaintext transmission, transmitting after anonymization, and denying transmission, respectively.

[0092] Specifically, when a data field corresponds to the first permission type, it is determined that the data field is allowed to be transmitted in plaintext, that is, the original content of the data field is preserved during transmission.

[0093] When a data field corresponds to the second permission type, it is determined that the data field is allowed to be transmitted, but the data field is de-identified before transmission, and the de-identified data field is transmitted.

[0094] When a data field corresponds to a third permission type, the data field is determined to be rejected for transmission and will not be used as the data output content of this access request.

[0095] In this embodiment, the three permission types correspond to three determined transmission processing results. No weights are set between the three permission types, nor are the permission types determined through numerical calculations. Field access permissions are determined based on the aforementioned access control decision results and are directly identified using the corresponding permission type.

[0096] For example, in the hospital's medical information platform, when a patient uses their medical card to conduct business at the registration window, if the patient's name field corresponds to the first permission type, then the patient's name is allowed to be transmitted in plaintext; if the contact information field corresponds to the second permission type, then the contact information is transmitted after being de-identified; if the historical diagnosis record field corresponds to the third permission type, then the transmission of historical diagnosis records is rejected.

[0097] In summary, this step verifies the access request using the four elements and determines the business category. It then combines the organizational unit, business category, and data fields to form an access control result. Each data field is adjudicated item by item, generating a data access token containing field access permissions. Finally, the set of output fields and the corresponding transmission protection method are determined through joint verification of the token and the data carrier access control list, thus providing a basis for the subsequent differentiated processing of data fields.

[0098] S3. Perform differential processing on each field in the output field set according to the transmission protection method; Step S3 in the method provided in this embodiment of the invention includes: For fields whose transmission protection mode is set to allow plaintext transmission, output them directly; Fields with transmission protection mode set to "Reject Transmission" will not be output. For fields whose transmission protection method is de-identification transmission, the output is processed according to the data type of the field. The de-identification process includes: For identifier fields, tokenization is performed, retaining some characters and replacing the rest. For address fields, perform fuzzy processing that generalizes to the preset administrative division level; For numeric fields, apply noise perturbation. For date fields, perform generalization processing to blur to a preset time granularity; For proprietary text fields, truncation is performed, returning only the default standard encoding.

[0099] In this embodiment, after determining the set of output fields, the reader terminal processes the output fields accordingly based on the transmission protection method corresponding to each output field.

[0100] For fields whose transmission protection mode allows plaintext transmission, the reader terminal directly outputs the original content of the field.

[0101] For fields whose transmission protection mode is set to refuse transmission, the reader terminal will not output the field.

[0102] For fields protected by de-identified transmission, the reader terminal performs corresponding de-identification processing based on the field's data type before outputting the data. De-identification processing employs tokenization, obfuscation, perturbation, generalization, or truncation depending on the data field type.

[0103] Specifically, for identifier fields, tokenization processing is performed, where some characters are retained and the rest are replaced. The reader terminal retains some characters according to the preset retention rules corresponding to the identifier field, and replaces the unretained characters with preset substitute characters to obtain the processed field content.

[0104] For example, for the identity name field Zhang Xiaoming, if the processing rule of keeping the first character and replacing the rest of the characters with * is adopted, the result is Zhang**; for the ID number field 110101199001010123, if the processing rule of keeping the first four and last four characters and replacing the rest of the characters with * is adopted, the result is 1101**********0123.

[0105] For address fields, a generalization to a preset administrative division level is performed for fuzzification. The reader terminal identifies the administrative division level corresponding to the address field and retains the corresponding administrative division information according to the preset administrative division level, while fuzzing specific address information below the administrative division level.

[0106] For example, if the original address is a street address in Xihu District, Hangzhou City, Zhejiang Province, and the preset administrative division level is district / county level, then Xihu District, Hangzhou City, Zhejiang Province will be retained, and the specific street and address information will not be output.

[0107] For numeric fields, noise perturbation is performed. The reader terminal adds a perturbation value within a preset range to the original numeric field to obtain the processed numeric field. The calculation process can be represented as follows: Desensitized value = original value + perturbation value.

[0108] The range of disturbance values ​​is determined based on the data range of the corresponding numerical field and the data precision allowed by the business.

[0109] For example, if the original value of a numeric field is 100 and the current perturbation value configured for the field is 3, then the desensitized value = 100 + 3 = 103.

[0110] For date fields, a generalization process is performed to blur the date to a preset time granularity. The reader terminal reduces the time precision of the date field according to the preset time granularity and outputs the generalized date information.

[0111] For example, if the original date is August 19, 2026, the date will be generalized to August 2026 when the preset time granularity is month, and to 2026 when the preset time granularity is year.

[0112] For proprietary text fields, truncation processing is performed, returning only the preset standard encoding. The reader terminal maps the original proprietary text to the corresponding standard encoding according to the preset standard encoding table for the proprietary text field, and only outputs the standard encoding, without outputting the original proprietary text content.

[0113] For example, if the original content of a proprietary text field is "hypertension" and its corresponding preset standard code is DIAG-001, then only DIAG-001 will be output after processing.

[0114] In summary, this step performs differentiated processing based on the transmission protection method corresponding to each data field. Fields that are allowed to be transmitted in plaintext are output directly, while fields that are denied transmission are not output. Fields that are de-identified for transmission are output after being tokenized, obfuscated, perturbed, generalized, or truncated according to their data type, thus forming data processing results corresponding to the transmission protection method of each field.

[0115] S4. Establish a secure transmission channel and forward the differentiated processing results output in step S3 to the authorized organizational unit corresponding to the current business category via the secure transmission channel.

[0116] Step S4 in the method provided in this embodiment of the invention includes: The data carrier and the reader terminal each generate temporary random numbers. Based on the pre-stored public and private keys, they calculate the shared secret through key negotiation and generate a session key by combining the temporary random numbers and session identifier. Using the session key, each field in the output field set output in step S3 is symmetrically encrypted and its integrity is authenticated, and then transmitted to the reader terminal via a secure transmission channel. The reader terminal forwards the decrypted fields to the authorized organizational unit corresponding to the current business category; After the transmission is complete, the session key and temporary random number will be physically erased from the secure storage area.

[0117] like Figure 2 As shown in this embodiment, after determining the set of output fields and the transmission protection method corresponding to each field, the data carrier and the reader terminal establish a session key for this data transmission, and use the session key to protect the transmission of each field in the set of output fields.

[0118] Specifically, the data carrier and the reader terminal each generate temporary random numbers and perform key negotiation based on their pre-held public and private keys to calculate a shared secret. The shared secret is calculated separately by the data carrier and the reader terminal; the two parties do not directly transmit the shared secret.

[0119] Furthermore, the data carrier and the reader / writer terminal respectively input the shared secret, the temporary random number, and the session identifier corresponding to this data transmission into the key derivation function to generate the session key corresponding to this data transmission. The session key is generated separately by the data carrier and the reader / writer terminal and is used for data protection during subsequent data transmissions.

[0120] For example, the data carrier generates a temporary random number RN-C, and the reader terminal generates a temporary random number RN-R. Both parties perform key negotiation based on their pre-held public and private keys, obtaining a shared secret SS-001. The session identifier corresponding to the current data transmission is SID-001. The data carrier and the reader terminal input the shared secret SS-001, the temporary random numbers RN-C and RN-R, and the session identifier SID-001 into the same key derivation function to generate the same session key corresponding to this data transmission.

[0121] After obtaining the session key, the data carrier uses the session key to perform symmetric encryption and integrity authentication on each field in the output field set determined in step S3.

[0122] Specifically, the data carrier acquires the content of each field in the output field set, and uses the session key as the key for symmetric encryption to encrypt the content of each field separately. Simultaneously, it generates authentication information to verify the integrity of the corresponding encrypted data. The processed encrypted fields and corresponding authentication information are then transmitted to the reader terminal through a secure transmission channel.

[0123] For any field to be transmitted, its protected data can be represented as: Secure data transmission = symmetric encryption (field content, session key) + integrity authentication information.

[0124] The plus sign indicates that the encryption result and integrity authentication information are combined according to a preset data structure, rather than being numerically added together.

[0125] For example, the set of output fields determined in step S3 includes identity name and contact information. The data carrier obtains the field content corresponding to the identity name field and the contact information field, and performs symmetric encryption and integrity authentication using the session key corresponding to this session. After forming the corresponding secure transmission data, it is sent to the reader terminal through the secure transmission channel.

[0126] After receiving securely transmitted data, the reader terminal decrypts each field using the session key corresponding to this session and verifies the integrity of the received data based on the corresponding integrity authentication information. When the integrity verification passes, the corresponding field data is determined to be valid, and the decrypted field content is obtained.

[0127] After the fields are decrypted, the reader terminal forwards the decrypted fields to the authorized organizational unit corresponding to the current business category.

[0128] Specifically, the reader terminal determines the corresponding authorized organization unit based on the current business category and sends the decrypted and integrity-verified field content to the authorized organization unit.

[0129] For example, the current business category is medical appointment registration, and the corresponding authorized organizational unit is the outpatient registration unit. After the reader terminal completes the decryption and integrity verification of the identity name and contact information fields, it forwards the field content to the outpatient registration unit.

[0130] After the transmission is completed, the data carrier and the reader terminal clear the session key and temporary random number used in this data transmission process, and physically erase the session key and temporary random number from the secure storage area.

[0131] Specifically, after all fields in the output field set have been transmitted, the data carrier and the reader terminal trigger a clearing operation to physically erase the session key and temporary random number corresponding to this session stored in the secure storage area, so that the session key and temporary random number are no longer retained in the corresponding secure storage area.

[0132] For example, during a business interaction, the data carrier and the reader terminal each generate a temporary random number and complete key negotiation based on the pre-held public and private keys. After obtaining the shared secret, they generate a session key through a key derivation function. The data carrier uses the session key to perform symmetric encryption and integrity authentication on the fields in the output field set determined in step S3, and sends them to the reader terminal through a secure transmission channel. After the reader terminal decrypts the fields, it forwards the decrypted fields to the authorized organizational unit corresponding to the current business category. After the field transmission is completed, the data carrier and the reader terminal physically erase the session key and temporary random number used in this session from the secure storage area.

[0133] In summary, this step involves the data carrier and the reader terminal negotiating to generate a session key corresponding to this transmission, and using the session key to perform symmetric encryption and integrity authentication on the output field, which is then transmitted to the reader terminal via a secure transmission channel. After the reader terminal completes the decryption and integrity verification, it forwards the field to the corresponding authorized organization unit and physically erases the session key and temporary random number after the transmission is completed, thereby completing this data transmission.

[0134] After step S4, the following also includes: According to the execution process of steps S1 to S4, an audit log is generated and stored. The audit log includes session identifier, operator identifier, organizational unit identifier, business category code, request field set, output field set, de-identification processing field set, rejected transmission field set, and timestamp. Among them, the operator identifier is generated based on the operator's identity certificate in step S1, the business category code is generated based on the business category determined in step S2, the request field set is each data field that is adjudicated in step S2, the desensitization processing field set is the field output after desensitization processing in step S3, the rejection transmission field set is the field output that is rejected in step S3, and the organizational unit identifier is generated based on the authorized organizational unit in step S4. Cardholders of data carriers can view audit logs for their own data through at least one of the following methods: self-service terminals or client applications.

[0135] In this embodiment, audit logs are generated and stored based on the execution results of steps S1 to S4. After the current business access process ends, the policy engine or reader terminal obtains the corresponding processing results formed in steps S1 to S4, and combines them according to the preset audit log field structure to generate an audit log corresponding to the current business access process.

[0136] The audit log includes session identifier, operator identifier, organizational unit identifier, business category code, request field set, output field set, de-identified field set, rejected transmission field set, and timestamp.

[0137] In this context, each field directly adopts the results already determined in the corresponding step: the operator identifier adopts the identifier corresponding to the operator's identity certificate in step S1; the business category code adopts the code corresponding to the business category determined in step S2; the request field set adopts the data fields involved in the adjudication in step S2; the output field set adopts the final output fields determined in step S3; the desensitization processing field set adopts the fields actually desensitized in step S3; the rejected transmission field set adopts the fields determined to be rejected for transmission in step S3; the organizational unit identifier adopts the identifier corresponding to the authorized organizational unit determined in step S4; and the timestamp adopts the time information corresponding to the current business access process.

[0138] Audit logs can be represented as: Audit log = Session identifier + Operator identifier + Organizational unit identifier + Business category code + Request field set + Output field set + De-identified field set + Rejected transmission field set + Timestamp.

[0139] The plus sign indicates that the log fields are combined according to a preset order, and is not a numerical operation.

[0140] For example, during a business access process, if the session identifier is SID-001, the operator identifier is OP-028, the organizational unit identifier is ORG-003, the business category code is BC-001, the request field set is {name, contact information, diagnostic information, payment information}, the output field set is {name, contact information}, the de-identification processing field set is {contact information}, the rejected transmission field set is {diagnostic information, payment information}, and the timestamp is 10:30:25 on August 19, 2026, then the corresponding audit log will be generated and stored based on the above information.

[0141] Furthermore, the cardholder corresponding to the data carrier initiates an audit log query request through at least one of the self-service terminal or client application. Based on the cardholder's identity verification result, the audit log corresponding to that cardholder is obtained and displayed to the cardholder.

[0142] For example, after completing identity verification through the client application, the patient can query their own data access records, retrieve the stored audit logs based on the corresponding identity information, and display the corresponding access time, operator identifier, organizational unit identifier, business category code, request field set, output field set, de-identification processing field set, and rejected transmission field set, so that the patient can view the access records generated for their own data.

[0143] In summary, this step generates and stores audit logs based on the business processing results formed in steps S1 to S4. It associates and records session identifiers, operator identifiers, organizational unit identifiers, business category codes, request field sets, output field sets, de-identification processing field sets, rejected transmission field sets, and timestamps. It also allows cardholders corresponding to the data carriers to query their own data access records through self-service terminals or client applications, thereby achieving complete traceability of the data access process.

[0144] Example 2, as Figure 3 As shown, the present invention provides a reader-writer directional information transmission system based on wireless communication, comprising: The identity information submission module 11 is used to read the identity information stored in the data carrier through the wireless communication interface and send the identity information together with the terminal identifier of the reader terminal and the identity certificate of the operator to the policy engine. The business category and field adjudication module 12 is used to verify identity information, terminal identifier and identity credentials, automatically determine the current business category, and adjudicate each data field associated with the data carrier according to the pre-configured access control rules, and determine the output field set and the transmission protection method of each field. The field differentiation processing module 13 is used to perform differentiation processing on each field in the output field set according to the transmission protection method; The secure transmission module 14 is used to establish a secure transmission channel and forward the differentiated processing results output in step S3 to the authorized organizational unit corresponding to the current business category via the secure transmission channel.

[0145] In this embodiment of the invention, the identity information submission module 11 is further configured to: The reader terminal reads the identity information and public key certificate of the data carrier stored in the data carrier through the wireless communication interface; The reader terminal verifies the validity of the public key certificate; If the verification is successful, the reader terminal receives the identity information output by the data carrier; The reader terminal assembles a submission packet containing identity information, terminal identifier, and identity credentials, and then sends the submission packet to the policy engine.

[0146] In this embodiment of the invention, the business category and field adjudication module 12 is further used for: The strategy engine receives identity information, terminal identifier, and identity credentials, and performs four-factor verification based on the current business process node, terminal identifier, operator role, and time constraints. The strategy engine generates a valid business category identifier based on the corresponding valid conditions if and only if all four elements meet the preset legal conditions. When any element does not meet the preset legal conditions, the policy engine rejects the access request and generates an alarm log.

[0147] Specifically, based on pre-configured access control rules, the data fields associated with the data carrier are adjudicated to determine the output field set and the transmission protection method for each field, including: Construct query vectors based on organizational units, business categories, and data fields; Based on the query vector, the access control rules are traversed, and each data field associated with the data carrier is adjudicated based on matching. Based on the adjudication results, a data access token containing business category and field access permissions is generated. Send the data access token to the reader terminal; The reader terminal, in conjunction with the data carrier, verifies the legitimacy of the data access token; After verifying the validity, the intersection of the field access permissions with the access control list pre-stored in the data carrier is taken to determine the output field set and the transmission protection method of each field.

[0148] The access control rules include: An access control tensor is constructed using three dimensions: organizational unit, business category, and data field. Each element takes one of three decision results: allow plaintext transmission, de-identify transmission, or deny transmission. The data field dimension includes the fields stored within the data carrier and all fields in the information management system connected to the reader terminal that are associated with the cardholder identified by the data carrier.

[0149] The field access permissions include: The first permission type corresponds to allowing plaintext transmission; The second permission type corresponds to transmission after data anonymization; The third permission type corresponds to denying transmission.

[0150] In this embodiment of the invention, the field differentiation processing module 13 is further configured to: For fields whose transmission protection mode is set to allow plaintext transmission, output them directly; Fields with transmission protection mode set to "Reject Transmission" will not be output. For fields whose transmission protection method is de-identification transmission, the output is processed according to the data type of the field. The de-identification process includes: For identifier fields, tokenization is performed, retaining some characters and replacing the rest. For address fields, perform fuzzy processing that generalizes to the preset administrative division level; For numeric fields, apply noise perturbation. For date fields, perform generalization processing to blur to a preset time granularity; For proprietary text fields, truncation is performed, returning only the default standard encoding.

[0151] In this embodiment of the invention, the secure transmission module 14 is further configured to: The data carrier and the reader terminal each generate temporary random numbers. Based on the pre-stored public and private keys, they calculate the shared secret through key negotiation and generate a session key by combining the temporary random numbers and session identifier. Using the session key, each field in the output field set of module 13 is symmetrically encrypted and its integrity is authenticated, and then transmitted to the reader terminal via a secure transmission channel. The reader terminal forwards the decrypted fields to the authorized organizational unit corresponding to the current business category; After the transmission is complete, the session key and temporary random number will be physically erased from the secure storage area.

[0152] Following module 14, it also includes: Based on the execution process of modules 11 to 14, an audit log is generated and stored. The audit log includes session identifier, operator identifier, organizational unit identifier, business category code, request field set, output field set, de-identification processing field set, rejected transmission field set, and timestamp. Among them, the operator identifier is generated based on the operator's identity certificate in module 11, the business category code is generated based on the business category determined in module 12, the request field set is the data fields that are adjudicated in module 12, the desensitization processing field set is the fields output after desensitization processing in module 13, the rejection transmission field set is the fields that are rejected output in module 13, and the organizational unit identifier is generated based on the authorized organizational unit in module 14. Cardholders of data carriers can view audit logs for their own data through at least one of the following methods: self-service terminals or client applications.

[0153] In summary, this invention, through the coordinated operation of an identity information submission module, a business category and field adjudication module, a field differentiation processing module, and a secure transmission module, verifies the identity and business conditions of data access requests, determines the corresponding access and transmission processing methods based on the business category and data fields, performs appropriate data processing on different fields before secure transmission, and simultaneously generates audit records for the data access process, thereby achieving targeted data transmission between the reader terminal and the back-end business system.

[0154] It should be noted that the processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired result. In some implementations, multitasking and parallel processing are possible or may be advantageous.

[0155] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

[0156] This specification and accompanying drawings are merely illustrative examples of the invention and are intended to cover any and all modifications, variations, combinations, or equivalents within the scope of the invention. Clearly, those skilled in the art can make various alterations and modifications to the invention without departing from its scope. Therefore, if such modifications and modifications fall within the scope of the invention and its equivalents, the invention is intended to include these modifications and modifications.

Claims

1. A method for directional information transmission in a reader / writer based on wireless communication, characterized in that, include: S1. The reader terminal reads the identity information stored in the data carrier through the wireless communication interface, and sends the identity information together with the terminal identifier of the reader terminal and the identity certificate of the operator to the policy engine. S2. The policy engine verifies the identity information, terminal identifier, and identity credentials, automatically determines the current business category, and adjudicates each data field associated with the data carrier according to the pre-configured access control rules, determining the output field set and the transmission protection method of each field; S3. Perform differential processing on each field in the output field set according to the transmission protection method; S4. Establish a secure transmission channel and forward the differentiated processing results output in step S3 to the authorized organizational unit corresponding to the current business category via the secure transmission channel.

2. The reader-writer directional information transmission method based on wireless communication as described in claim 1, characterized in that, The reader terminal reads the identity information stored in the data carrier through the wireless communication interface, and sends the identity information, along with the terminal identifier of the reader terminal and the identity certificate of the operator, to the policy engine, including: The reader terminal reads the identity information and the public key certificate of the data carrier stored in the data carrier through the wireless communication interface; The reader terminal verifies the validity of the public key certificate; If the verification is successful, the reader terminal receives the identity information output by the data carrier; The reader terminal assembles a submission packet containing the identity information, the terminal identifier, and the identity credential, and sends the submission packet to the policy engine.

3. The reader-writer directional information transmission method based on wireless communication as described in claim 1, characterized in that, The policy engine verifies the identity information, terminal identifier, and identity credentials, and automatically determines the current service category, including: The strategy engine receives the identity information, the terminal identifier, and the identity credential, and performs four-factor verification based on the current business process node, the terminal identifier, the operator's role, and time constraints. The strategy engine generates a valid business category identifier based on the corresponding valid conditions if and only if all four elements meet the preset legal conditions. When any element fails to meet the preset legal conditions, the policy engine rejects the access request and generates an alarm log.

4. The reader-writer directional information transmission method based on wireless communication as described in claim 3, characterized in that, Based on pre-configured access control rules, the data fields associated with the data carrier are adjudicated to determine the output field set and the transmission protection method for each field, including: Construct a query vector using organizational units, business categories, and data fields as dimensions; Based on the query vector, the access control rules are traversed, and each data field associated with the data carrier is adjudicated based on matching. Based on the adjudication results, a data access token containing the business category and field access permissions is generated. Send the data access token to the reader terminal; The reader terminal, in conjunction with the data carrier, verifies the legitimacy of the data access token; After verification, the field access permissions are intersected with the access control list pre-stored in the data carrier to determine the output field set and the transmission protection method of each field.

5. The reader-writer directional information transmission method based on wireless communication as described in claim 1, characterized in that, According to the transmission protection method, differential processing is performed on each field in the output field set, including: For fields whose transmission protection mode is set to allow plaintext transmission, output them directly; Fields with transmission protection mode set to "Reject Transmission" will not be output. For fields whose transmission protection method is de-identification transmission, the de-identification process is performed according to the data type of the field before output. The de-identification process includes: For identifier fields, tokenization is performed, retaining some characters and replacing the rest. For address fields, perform fuzzy processing that generalizes to the preset administrative division level; For numeric fields, apply noise perturbation. For date fields, perform generalization processing to blur to a preset time granularity; For proprietary text fields, truncation is performed, returning only the default standard encoding.

6. The reader-writer directional information transmission method based on wireless communication as described in claim 1, characterized in that, Establish a secure transmission channel, and forward the differentiated processing result output in step S3 to the authorized organizational unit corresponding to the current business category via the secure transmission channel, including: The data carrier and the reader terminal each generate a temporary random number. Based on the pre-stored public and private keys, they calculate a shared secret through key negotiation and generate a session key by combining the temporary random number and the session identifier. Using the session key, each field in the output field set output in step S3 is symmetrically encrypted and its integrity is authenticated, and then transmitted to the reader terminal via the secure transmission channel. The reader terminal forwards the decrypted fields to the authorized organization unit corresponding to the current business category; After the transmission is complete, the session key and the temporary random number are physically erased from the secure storage area.

7. The reader-writer directional information transmission method based on wireless communication as described in claim 1, characterized in that, The access control rules include: An access control tensor is constructed using three dimensions: organizational unit, business category, and data field. Each element takes one of three decision results: allow plaintext transmission, de-identify transmission, or deny transmission. The data field dimension includes the fields stored in the data carrier and all fields in the information management system connected to the reader terminal that are associated with the cardholder identified by the data carrier.

8. The reader-writer directional information transmission method based on wireless communication as described in claim 4, characterized in that, The field access permissions include: The first permission type corresponds to allowing plaintext transmission; The second permission type corresponds to transmission after data anonymization; The third permission type corresponds to denying transmission.

9. The reader-writer directional information transmission method based on wireless communication as described in claim 1, characterized in that, After step S4, the following also includes: According to the execution process of steps S1 to S4, an audit log is generated and stored. The audit log includes a session identifier, an operator identifier, an organizational unit identifier, a business category code, a set of request fields, a set of output fields, a set of de-identification fields, a set of rejected transmission fields, and a timestamp. Wherein, the operator identifier is generated based on the operator's identity certificate in step S1, the business category code is generated based on the business category determined in step S2, the request field set is each data field that is adjudicated in step S2, the de-identification processing field set is the field output after de-identification processing in step S3, the rejection transmission field set is the field output that is rejected in step S3, and the organizational unit identifier is generated based on the authorized organizational unit in step S4; Cardholders of the data carrier can view the audit logs for their own data through at least one of the following: a self-service terminal or a client application.

10. A reader-writer directional information transmission system based on wireless communication, characterized in that, A reader-writer directional information transmission method based on wireless communication, as described in any one of claims 1 to 9, comprises: The identity information submission module is used to read the identity information stored in the data carrier through the wireless communication interface, and send the identity information together with the terminal identifier of the reader terminal and the identity certificate of the operator to the policy engine. The business category and field adjudication module is used to verify the identity information, terminal identifier and identity certificate, automatically determine the current business category, and adjudicate each data field associated with the data carrier according to the pre-configured access control rules, and determine the output field set and the transmission protection method of each field. The field differentiation processing module is used to perform differentiation processing on each field in the output field set according to the transmission protection method; The secure transmission module is used to establish a secure transmission channel and forward the differentiated processing result output in step S3 to the authorized organizational unit corresponding to the current business category via the secure transmission channel.

Images