CN112562151B - An Access Control System Based on Bloom Filter - Google Patents

Abstract

The invention provides an access control system based on a bloom filter, which belongs to the technical field of software engineering/system software, and the invention directly intercepts unauthorized personnel by arranging the bloom filter at the access control end, thereby accelerating the identification speed of the unauthorized personnel, reducing the access to a rear-end database, being capable of being used in combination with a mobile phone NFC identification technology or a face recognition technology, improving the interception efficiency of the access control system, reducing the false identification rate caused by false triggering, and being more suitable for the automatic identification scene with high mobility and dense access of personnel.

Description

An Access Control System Based on Bloom Filter

technical field

The invention relates to the technical field of software engineering/system software, in particular to an access control system based on a Bloom filter.

Background technique

The access control system is a concept in the field of intelligent buildings, which refers to the prohibition authority of the "door", and is the guard against the "door". The "door" here, in a broad sense, includes all kinds of passages that can pass, including doors for people and vehicles. Therefore, access control also includes vehicle access control.

Entrance and exit access control safety management system is a new modern safety management system, which integrates microcomputer automatic identification technology and modern safety management measures. It involves many new technologies such as electronics, machinery, optics, computer technology, communication technology, and biotechnology. It is an effective measure to solve the security management of the entrance and exit of important departments. Applicable to various confidential departments, such as banks, hotels, parking lot management, computer rooms, armories, confidential rooms, offices, intelligent communities, factories, etc.

The access control system has already surpassed the simple doorway and key management, and it has gradually developed into a complete access management system. It plays an important role in administrative management such as working environment safety and personnel attendance management.

The Bloom filter was proposed by Bloom in 1970. It's actually a long binary vector and a series of random mapping functions. Bloom filters can be used to retrieve whether an element is in a set. Its advantage is that the space efficiency and query time are much better than the general algorithm, but the disadvantage is that there is a certain rate of misrecognition and difficulty in deletion.

Before the Bloom filter appeared, if you wanted to determine whether an element was in a collection, the general approach was to save all the elements and then determine through comparison. However, as the number of elements in the collection increases, the storage space required becomes larger and larger, and the retrieval speed becomes slower (O(n), O(logn)). The underlying principle of the Bloom filter is the hash (also called hash, Hash) algorithm. Hash algorithm (Hash, generally translated as hash, hash, or transliterated as hash), is to transform an input of any length (also called pre-mapped pre-image) into a fixed-length output through a hash algorithm, and the output is the hash value. This conversion is a compression map, that is, the space of the hash value is usually much smaller than the space of the input, and different inputs may hash to the same output, so it is impossible to determine the unique input value from the hash value. Simply put, it is a function to compress a message of any length into a fixed-length message digest. [3] A hash table (also called a hash table, Hash table) is a data structure that maps an element into one or several points in a bit array (Bit array) through a Hash function. Whether the element does not exist in the known hash table can be judged by comparing whether the value (0 or 1) on the point of the bit array in the hash table is consistent with the corresponding bit of the bit array after the element to be judged is hashed by the hash function. This is the basic idea of Bloom filter.

Compared with other data structures, Bloom filters have huge advantages in space and time. Both Bloom filter storage space and insert/query time are constant. In addition, Hash functions have no relationship with each other, which is convenient for parallel implementation by hardware. The Bloom filter does not need to store the element itself, which has advantages in some occasions where confidentiality requirements are very strict.

The characteristic of the Bloom filter is that when the Bloom filter judges that a certain value exists, the value may not exist; when the Bloom filter judges that a certain value does not exist, it must not exist.

Contents of the invention

Based on the above problems, the present invention provides a Bloom filter-based access control system, by introducing a Bloom filter to verify the identity code of the person requesting to pass through the access control system, so as to realize faster identification of unauthorized personnel and prevent them from passing through the access control system, and reduce the false recognition rate caused by false triggering.

Based on the above characteristics of the Bloom filter, an access control system is invented, which inputs the ID code of the internal personnel of the community or unit into the Bloom filter, and judges the ID code of the person requesting to pass through the access control system through the Bloom filter, prevents unauthorized personnel from passing through the access control system, and performs operations such as identity registration and visitor registration through the software system to maintain the ID code of the personnel, and regularly refreshes the Bloom filter through a scheduled task to realize the update and maintenance of system authorized personnel.

Technical scheme of the present invention is:

An access control system based on Bloom filter, consisting of 1) access control terminal, 2) access control management terminal, 3) access control core system and 4) database;

1) The access control terminal is composed of an identifier, a Bloom filter and an access control controller; where

Among them, the identifier is used to identify the identity information of the person requesting to pass through the access control; the identity information of the access control personnel includes face recognition, fingerprint recognition or NFC card reader;

If it is face recognition, the function of this component is to extract the feature code (face id) from the face information, and if it is an NFC card reader, it is to read the card ID information.

Bloom filter is used to verify the absence of personal identity information and intercept invalid requests;

The controller is used to control the opening and closing of the door, and feedback the identity verification result to the personnel;

2) The access control management terminal is composed of three functional modules: access rule maintenance, token maintenance and personnel maintenance;

Use the access rule maintenance function to set and modify the access rules of the access control system;

Enter the list of personnel who can pass through the access control through personnel maintenance;

Apply for and cancel tokens for personnel through the token maintenance function;

3) The access control core system consists of four services: access control, token management, personnel management and filter maintenance;

The access control service is used to maintain the access rules, verify the identity of the personnel according to the access rules, and send a release or refusal signal to the access control terminal controller;

The token management service is used to apply for tokens or cancel tokens for personnel, and maintain the validity period of tokens;

The personnel management service is used to maintain the personnel information of the access control system;

The filter maintenance service is used to load token information into the filter after generating the token or reset the filter periodically;

4) The database is used to save access rules, personnel tokens and personnel information.

Further, the access rule is set through the access rule maintenance function of the access control management terminal, and the access control management terminal invokes the access control service to update the set access rule information to the database.

Further, by summarizing personnel information offline, and using the personnel maintenance function of the access control management terminal to input and update personnel information, the access control management terminal calls the personnel management service of the access control core system to update the personnel information in the database.

further,

After the administrator of the access control system receives the request to pass the offline application of the personnel in the access control system, he applies the token maintenance function for the personnel who have passed the review through the token maintenance function of the access control management terminal. The token maintenance function calls the token management service of the access control core system to generate a token and stores it in the database, then updates the token attribute of the personnel information, calls the filter maintenance service to load the token information into the Bloom filter of the access control terminal, and finally persists the personnel information after updating the token information to the database.

When personnel no longer need to pass through the access control system, the administrator of the access control system will cancel the token through the token maintenance function of the access control management terminal. The token maintenance function calls the token management service of the access control core system to update the token information as invalid, and save the token information to the database.

further,

After the access control system administrator applies for a token, the token management service of the access control core system calls the filter maintenance service to add the token information to the Bloom filter. When the access control system administrator cancels the token or the token expires, the Bloom filter will not update the token information immediately. It is necessary to clear the Bloom filter through the nightly scheduled task and then reload the token into the filter.

When a person applies for access control, the token authentication is first performed through the identifier of the access control terminal, and after the identifier obtains the token information, it is first sent to the Bloom filter for comparison and verification;

If the Bloom filter determines that the token does not exist, the access controller prompts that the person is not authorized and refuses the person to pass through;

If the Bloom filter determines that the token may exist, the recognizer sends the token information to the admission control service of the access control core system and applies for admission;

After the admission control service receives the admission request from the identifier, it will query whether the token exists and has not expired through token management. If the token does not exist or has expired, the access control controller will prompt the personnel that the token does not exist or has expired, and refuse the personnel to pass.

If the token verification is valid, the access control service calls the token management service to query personnel information through the token, calls the access control service to query the access rules, and determines whether the type of person and the current time meet the access rules. If the rules are met, the access controller returns an access command to the access control terminal controller, and the access control controller opens the door and prompts welcome information. Otherwise, the access control controller prompts that the user has insufficient authority and refuses entry.

The present invention uses a Bloom filter to judge whether a person's identity exists in a known data set. With the help of the Bloom filter's characteristics of easy implementation and high recognition efficiency, it is applied to the identification end of the access control system and provides an access control management end system. It can be used in conjunction with various technical implementation methods (face recognition, near-field communication, etc.) to solve the problem of personnel identification in communities or enterprises and institutions.

The beneficial effect of the present invention is

Compared with the traditional access control system that directly compares the authorized personnel identification code or facial feature code with the back-end database, this system directly intercepts unauthorized personnel through the front-end Bloom filter at the access control end, speeding up the identification speed of unauthorized personnel and reducing access to the back-end database. It can be used with mobile phone NFC identification technology or face recognition technology to improve the interception efficiency of the access control system and reduce the false recognition rate caused by false triggers. It is more suitable for automated identification scenarios with high mobility and intensive access.

In addition to being an independent access control system, the access control system can also cooperate with the company's attendance system for attendance statistics and community property system for property management by expanding the external interface.

Description of drawings

Figure 1 is a schematic diagram of the principle of a Bloom filter;

Figure 2 is a schematic diagram of the system architecture;

Figure 3 is a schematic diagram of access rule maintenance;

Figure 4 is a diagram of access rule maintenance activities;

Fig. 5 is a schematic diagram of personnel maintenance;

Fig. 6 is a personnel maintenance activity diagram;

Figure 7 is a schematic diagram of token maintenance;

Figure 8 is an activity diagram for applying for a token;

Figure 9 is a logout token activity diagram;

Figure 10 is a schematic diagram of filter maintenance;

Figure 11 is a write filter activity diagram;

Figure 12 is an activity diagram for emptying the filter;

Figure 13 is a schematic diagram of admission control;

Figure 14 is an admission control activity diagram;

Figure 15 is a schematic diagram of the company's access control;

Figure 16 is a schematic diagram of community access control.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the protection scope of the present invention.

As shown in Figure 1: the data structure of the Bloom filter is an extremely large bit array (the bottom of the figure), where each bit can store binary 0 or 1. element1 and element2 are two elements that need to be stored in the bit array using a hash (hereinafter referred to as hash) algorithm. f(e), g(e) and h(e) are three hash functions (henceforth referred to as hash functions). The elements to be hashed are provided as input parameters to the hash function. Through unreasonable hash algorithms, different values will be obtained, which are finally mapped to different bits in the bit array. Setting the corresponding position to 1 means that the element is calculated by the hash function. When the bit array is extremely large, the points located in the bit array obtained after different elements are mapped by the hash function will be very sparse, so that the probability of different elements being hashed and mapped to the same point will be greatly reduced.

When adding elements to the Bloom filter, multiple hash functions are used to hash the elements to calculate an integer index value, and then a modulo operation is performed on the length of the bit array to obtain a position. Each hash function will calculate a different position. Then set these bits of the bit array to 1, and the addition operation is completed.

When querying the Bloom filter for the existence of an element, like adding, it will also calculate several positions of the hash to see if these positions in the bit array are all 1. As long as one bit is 0, it means that the element does not exist in the Bloom filter. If these positions are all 1, it does not mean that this element must exist, but it is very likely to exist, because these bits are set to 1 may be caused by the existence of other keys. If the bit array is large enough and the stored bits are relatively sparse, the probability of correct judgment will be very high, otherwise it will be relatively low.

System working principle:

The system administrator sets the access rules through the management terminal of the access control system (the access time period or the type of the access personnel, for the sake of simplification, this article omits the relevant content of the personnel role, which can be added in actual operation) and enters the access personnel (collecting personnel information offline), and then applies for and issues tokens (fingerprint, facial recognition entry or IC card printing) for the access personnel. After the token management module generates and distributes the token, it transmits the token to the Bloom filter integrated in the access control terminal through the filter maintenance module, and the Bloom filter maps the corresponding token to each bit of the bit array through a hash function. When a person accesses the access control system to apply for access (punching card/swiping fingerprint/swiping face), the identifier reads the token information and transmits the token information to the Bloom filter. The filter uses the same hash function for mapping, and compares the mapped result with each bit in the bit array. If any bit is different, it is considered that the person requesting access holds an invalid token, and the access request is directly rejected. Otherwise, the token is sent to the access control module of the access control core system. The access rules maintained by the administrator determine whether to pass through, and if it is possible to pass through, send a pass instruction to the controller of the access control terminal to allow personnel to pass.

1. System Architecture

The system architecture is shown in Figure 2. The access control system consists of an access control terminal, an access control management terminal, an access control core system and a database.

The access control terminal consists of an identifier, a Bloom filter and an access control controller. Among them, the recognizer is used to identify the identity information of the person requesting to pass through the access control. The specific implementation can be face recognition, fingerprint recognition or NFC card reader (if it is face recognition, the function of this component is to extract the feature code (face id) from the face information, if it is an NFC card reader, it is to read the card ID information); Bloom filter is used to verify whether the identity information of the person does not exist, and intercept invalid requests; the controller is used to control the opening and closing of the door, and feedback the identity verification result to the personnel.

The access control management terminal consists of three functional modules: access rule maintenance, token maintenance and personnel maintenance, and is a web application or client application. The administrator of the access control system sets and modifies the access rules of the access control system through the access rule maintenance function (such as curfew, time period control for the entry and exit of persons with specific identities, etc.); through the personnel maintenance, enters the list of personnel who can pass the access control (personnel within the unit, visitor registration, etc.); through the token maintenance function, apply for and cancel tokens for personnel.

The access control core system consists of four services: admission control, token management, personnel management and filter maintenance, which are one or more back-end service applications. The access control service is used to maintain access rules, authenticate personnel according to the access rules, and send a release or deny release signal to the access control terminal controller; token management service is used to apply for tokens or cancel tokens for personnel, and maintain the validity period of tokens; personnel management services are used to maintain personnel information in the access control system; filter maintenance services are used to load token information into filters after generating tokens or reset filters periodically.

The database is used to save access rules, personnel tokens and personnel information.

2. Maintenance of access rules

As shown in Figure 3, the administrator of the access control system sets access rules through the access rule maintenance function of the access control management terminal, and the access control management terminal calls the access control service to update the set access rule information to the database. The activity diagram is shown in Figure 4.

3. Personnel maintenance

As shown in Figure 5, the access control system administrator summarizes personnel information offline, and uses the personnel maintenance function of the access control management terminal to enter and update personnel information, and the access control management terminal calls the personnel management service of the access control core system to update the personnel information in the database. The activity diagram is shown in Figure 4.

4. Token Maintenance

As shown in Figure 7, after the administrator of the access control system receives the request to pass the offline application of the access control system personnel, the token maintenance function of the access control management terminal applies for a token for the person who has passed the review. The token maintenance function calls the token management service of the access control core system to generate a token and stores it in the database. Then, the token attribute of the personnel information is updated, and the filter maintenance service is called to load the token information into the Bloom filter of the access control terminal. Finally, the personnel information after updating the token information is persisted to the database. The activity flow is shown in Figure 8.

When personnel no longer need to pass through the access control system (personnel resignation or migration), the administrator will cancel the token through the token maintenance function of the access control management terminal. The token maintenance function calls the token management service of the access control core system to update the token information as invalid, and save the token information to the database. The activity flow is shown in Figure 9.

5. Filter maintenance

As shown in Figure 10, when the access control system administrator applies for a token, the token management service of the access control core system calls the filter maintenance service to add the token information to the Bloom filter, and the activity process is shown in Figure 11; when the access control system administrator cancels the token or the token expires, the Bloom filter will not update the token information immediately, and the Bloom filter needs to be cleared through the nightly scheduled task, and then the token is reloaded into the filter, and the clearing activity process is shown in Figure 12.

6. Access control

As shown in Figure 13, when a person applies for access control, the token authentication (swiping face, swiping fingerprint, punching card) is first performed through the identifier of the access control terminal. After the identifier obtains the token information, it first transmits it to the Bloom filter for comparison and verification. If the Bloom filter determines that the token does not exist, the access control controller prompts that the person is not authorized and refuses the person to pass through. If the Bloom filter determines that the token may exist, the recognizer sends the token information to the admission control service of the access control core system and applies for admission.

After the admission control service receives the admission request from the identifier, it will query whether the token exists (and has not expired) through token management. If the token does not exist (or has expired), the access control controller will prompt the personnel that the token does not exist (or has expired), and refuse the personnel to pass.

If the token verification is valid, the access control service calls the token management service to query personnel information through the token, calls the access control service to query the access rules, and determines whether the type of person and the current time meet the access rules. If the rules are met, the access controller returns an access command to the access control terminal controller, and the access control controller opens the door and prompts welcome information. Otherwise, the access control controller prompts that the user has insufficient authority and refuses entry.

In addition to being an independent access control system, the access control system can also cooperate with the company's attendance system for attendance statistics and community property system for property management by expanding the external interface.

As shown in Figure 15, this system can be used for company access control. In this scenario, the attendance management interface can be extended to call the attendance registration service of the company's attendance system to manage and monitor personnel attendance and activities.

As shown in Figure 16, this system can be used for community access control. In this scenario, a property payment query interface can be expanded to control the time limit of the access control token by querying the property payment information.

By introducing the Bloom filter, this system greatly improves the anti-interference ability of the system. Compared with the traditional access control system, it can filter out most of the interference signals (such as IC card misreading, face mis-swiping, or fingerprint mis-touching) and reduce the burden of database query.

The above descriptions are only preferred embodiments of the present invention, and are only used to illustrate the technical solution of the present invention, and are not used to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present invention are included in the protection scope of the present invention.

Claims (1)

1. An access control system based on a bloom filter is characterized in that,

the system consists of an access control terminal, an access control management terminal, an access control core system and a database;

the access control terminal consists of an identifier, a bloom filter and an access control controller; wherein the method comprises the steps of

The identifier is used for identifying identity information of the person requesting to pass through the entrance guard;

the bloom filter is used for verifying whether personnel identity information does not exist or not and intercepting invalid requests;

the controller is used for controlling the opening and closing of the door and feeding back an identity verification result to the personnel;

the access control management end consists of three functional modules, namely access rule maintenance, token maintenance and personnel maintenance; wherein the method comprises the steps of

Setting and modifying the access rule of the access control system through an access rule maintenance function;

a personnel list which can pass through the entrance guard is maintained and input by personnel;

applying for and logging out tokens by the personnel through a token maintenance function;

the access control core system consists of four services, namely access control, token management, personnel management and filter maintenance; wherein the method comprises the steps of

The access control service is used for maintaining access rules, carrying out identity verification on personnel according to the access rules, and sending a release or release rejection signal to the access control terminal controller;

the token management service is used for applying for the token or logging out the token for personnel, and the validity period of the token is maintained;

the personnel management service is used for maintaining personnel information of the access control system;

the filter maintenance service is used for loading token information into the filter or periodically resetting the filter after generating the token;

the database is used for storing admission rules, personnel tokens and personnel information;

the identity information of the access control personnel comprises face recognition, fingerprint recognition or NFC card reading recognition;

if the identification is face recognition, the function of the identifier is to extract feature codes from face information, and if the identification is NFC card reading identification, the identification is card ID information;

setting an admission rule through an admission rule maintenance function of the access control terminal, and calling an admission control service by the access control terminal to update the set admission rule information to a database;

the personnel information is summarized offline, and the personnel information is input and updated by using the personnel maintenance function of the access control management end, and the access control management end invokes the personnel management service of the access control core system to update the personnel information in the database;

after receiving an off-line application of a request passing through an access control system personnel, an access control system administrator applies a token for the personnel passing through the audit through a token maintenance function of an access control management end, the token maintenance function calls a token management service of an access control core system to generate a token and stores the token into a database, then updates the token attribute of personnel information, calls a filter maintenance service to load the token information into a bloom filter of an access control terminal, and finally persists the personnel information after updating the token information to the database;

when personnel no longer need to pass through the access control system, an access control system manager carries out cancellation processing on the token through a token maintenance function of an access control management end, the token maintenance function calls a token management service of an access control core system to update token information to be invalid, and the token information is stored in a database;

when an access control system manager applies for a token, the token management service of the access control core system calls a filter maintenance service to add token information into the bloom filter, when the access control system manager logs out the token or the token expires, the bloom filter cannot update the token information immediately, and after the bloom filter is emptied through a night timing task, the token is loaded into the filter again;

when a person applies to pass through the access control, token authentication is performed through an identifier of the access control terminal, and the identifier obtains token information and then transmits the token information to a bloom filter for comparison and verification;

if the bloom filter judges that the token does not exist, the access controller prompts personnel to be unauthorized and refuses the personnel to pass through;

if the bloom filter judges that the token is possible to exist, the identifier sends token information to an access control service of the access control core system and applies for access;

after receiving the admission request of the identifier, the admission control service inquires whether the token exists and is not expired through token management, and if the token does not exist or is expired, the access controller prompts personnel that the token does not exist or is expired, and the personnel is refused to pass;

if the token is verified to be effective, the access control service calls the token management service to inquire personnel information through the token, calls the access control service to inquire the access rule, judges whether the personnel type and the current time meet the access rule, if so, the access controller returns an access instruction to the access terminal controller, the access controller opens the door and prompts welcome information, otherwise, the access controller prompts that the user permission is insufficient, and the personnel is refused to enter.