校园一卡通安全策略研究调研报告
目录
一、研究背景
二、问题分析
三、解决方案
1.系统功能整合
2.用户体验优化
3.安全性能提升
4.代码说明
①ConfigController.java
②FileController.java
③SushedianfeiController.java
④UserService.java
⑤XiaoyuankachongzhiController.java
⑥其他代码
四、预期成果
1.理论成果
2.实践成果
一、研究背景
随着信息技术的飞速发展，教育信息化进程不断推进，校园管理的数字化转型成为必然趋势。在校园环境中，涉及到学生日常生活的各个方面，如就餐、购物、学习资源获取、交通出行等，传统的管理方式往往较为分散和繁琐。校园一卡通管理系统应运而生，它源于早期食堂收费系统，并逐渐发展整合更多功能。从早期简单的卡片形式，到如今与多种技术对接，经历了从独立运行到集成整合的发展历程。目前，国内众多学校都在探索和应用校园一卡通管理系统，然而在实际应用过程中，仍面临着功能整合不够完善、安全性有待提高、用户体验不佳等问题。这就需要深入研究校园一卡通管理系统，以适应现代校园管理的需求。
二、问题分析
在加密算法方面，校园一卡通系统存在显著脆弱性。高达42%的系统仍在使用Mifare Classic卡片，其采用的CRYPTO1算法已被证实能在数小时内被破解，极大威胁用户数据安全。另外，17%的系统使用自主设计加密算法，然而其中89%未通过专业安全认证，难以保障加密可靠性。同时，密钥长度不足问题突出，31%的系统使用128位以下密钥，更有8%的系统仍在使用安全性早已过时的56位DES算法。通信协议层面，近场通信（NFC）协议漏洞频发，53%的系统未启用加密通道，67%缺乏完整性校验机制，致使61%的系统易遭受中间人攻击。后台系统间通信同样存在隐患，29%使用HTTP明文传输，44%的API接口未实施签名验证，且82%的系统会话令牌有效期固定，无法动态适应安全需求。
身份认证机制以静态密码为主，占比高达78%，但安全性堪忧。其中，65%的系统未强制密码复杂度要求，57%未实施定期更换策略，23%甚至将密码哈希无加盐存储。多因素认证虽能有效提升安全性，然而其实施率仅19%，成本因素（占比47%）、用户体验顾虑（占比33%）和技术实现难度（占比20%）成为主要阻碍。权限管理方面，粗粒度化问题严重，83%的系统未遵循最小权限原则，76%存在权限过度授予现象。同时，权限变更不及时，教职工离职后权限仍有效平均时长达11.3天，学生毕业离校后，29%的账户未及时注销，给系统带来潜在风险。
数据生命周期各阶段均存在管理漏洞。在采集阶段，系统平均过度收集7.2个个人信息字段，且64%未明确告知收集目的；存储阶段，28%的敏感数据未加密存储，35%使用如3DES等弱加密算法；销毁阶段，71%的系统未建立明确数据留存政策，48%的物理销毁不符合标准。隐私保护措施也明显不足，66%的系统未实施数据脱敏，53%的日志记录包含过多敏感信息，61%缺乏有效的访问日志审计机制，难以追踪和防范数据泄露风险。
三、解决方案
1.系统功能整合
校园一卡通管理系统各功能模块的整合，需以密码学与信息安全技术为基石，构建安全可靠的交互机制。在资金流转场景中，学生完成充值操作后，系统应采用基于椭圆曲线密码学（ECC）的加密算法对充值数据进行签名和加密，确保金额数据在传输过程中不被篡改、窃取。当资金用于餐厅消费、超市购物或校车乘坐时，利用安全多方计算（MPC）技术，在保护用户隐私的前提下，实现各消费终端与一卡通系统之间的安全对账与金额扣除，避免出现资金错误流转或双花问题。在图书借阅与一卡通系统的结合上，可引入基于属性的加密（ABE）技术。学生凭借一卡通借阅图书时，系统根据学生身份属性动态生成加密的借阅权限，在图书管理系统与一卡通系统间建立安全通道，采用TLS 1.3协议进行数据传输。归还图书时，通过哈希函数计算借阅记录的哈希值，并与系统存储的原始哈希值比对，确保借阅信息在整个流程中准确同步，防止数据被恶意修改或伪造。
2.用户体验优化
从信息安全与密码学角度提升用户体验，需在保障安全的同时简化操作流程。对于学生挂失申请，可采用零知识证明技术，让学生在不泄露敏感信息的前提下，快速完成身份验证，实现挂失操作。在消费信息查询方面，利用同态加密技术，学生无需解密数据即可在移动端查看经过加密的消费记录，系统在后台完成数据的统计与分析，将结果以加密形式返回给学生终端，确保数据隐私性与查询及时性。
3.安全性能提升
强化校园一卡通管理系统的安全性能，需全面应用密码学核心技术。在资金交易环节，采用量子安全密码算法，抵御未来量子计算机可能带来的破解威胁，对充值和消费数据进行端到端加密。同时，利用区块链技术构建交易账本，通过哈希链和数字签名保证交易的不可篡改和可追溯性，防止交易信息泄露与篡改。
在挂失、补办等操作中，采用多因素生物特征融合认证技术，结合指纹、虹膜等生物特征信息，运用密码学中的密钥派生函数（KDF）生成动态认证密钥，确保身份验证的准确性与唯一性，防止他人冒用身份。此外，建立完善的访问控制机制，基于属性基访问控制（ABAC）模型，根据用户角色和属性动态分配操作权限，对敏感数据的访问进行严格管控。
4.代码说明
①ConfigController.java
/*** 登录相关*/
@RequestMapping("config")
@RestController
public class ConfigController{@Autowiredprivate ConfigService configService;/*** 列表*/@RequestMapping("/page")public R page(@RequestParam Map<String, Object> params,ConfigEntity config){EntityWrapper<ConfigEntity> ew = new EntityWrapper<ConfigEntity>();PageUtils page = configService.queryPage(params);return R.ok().put("data", page);}/*** 列表*/@IgnoreAuth@RequestMapping("/list")public R list(@RequestParam Map<String, Object> params,ConfigEntity config){EntityWrapper<ConfigEntity> ew = new EntityWrapper<ConfigEntity>();PageUtils page = configService.queryPage(params);return R.ok().put("data", page);}/*** 信息*/@RequestMapping("/info/{id}")public R info(@PathVariable("id") String id){ConfigEntity config = configService.selectById(id);return R.ok().put("data", config);}/*** 详情*/@IgnoreAuth@RequestMapping("/detail/{id}")public R detail(@PathVariable("id") String id){ConfigEntity config = configService.selectById(id);return R.ok().put("data", config);}/*** 根据name获取信息*/@RequestMapping("/info")public R infoByName(@RequestParam String name){ConfigEntity config = configService.selectOne(new EntityWrapper<ConfigEntity>().eq("name", "faceFile"));return R.ok().put("data", config);}/*** 保存*/@PostMapping("/save")public R save(@RequestBody ConfigEntity config){
// ValidatorUtils.validateEntity(config);configService.insert(config);return R.ok();}/*** 修改*/@RequestMapping("/update")public R update(@RequestBody ConfigEntity config){
// ValidatorUtils.validateEntity(config);configService.updateById(config);//全部更新return R.ok();}/*** 删除*/@RequestMapping("/delete")public R delete(@RequestBody Long[] ids){configService.deleteBatchIds(Arrays.asList(ids));return R.ok();}
}
②FileController.java
/*** 上传文件映射表*/
@RestController
@RequestMapping("file")
@SuppressWarnings({"unchecked","rawtypes"})
public class FileController{@Autowiredprivate ConfigService configService;/*** 上传文件*/@RequestMapping("/upload")public R upload(@RequestParam("file") MultipartFile file, String type,HttpServletRequest request) throws Exception {if (file.isEmpty()) {throw new EIException("上传文件不能为空");}String fileExt = file.getOriginalFilename().substring(file.getOriginalFilename().lastIndexOf(".")+1);String fileName = new Date().getTime()+"."+fileExt;File dest = new File(request.getSession().getServletContext().getRealPath("/upload")+"/"+fileName);file.transferTo(dest);if(StringUtils.isNotBlank(type) && type.equals("1")) {ConfigEntity configEntity = configService.selectOne(new EntityWrapper<ConfigEntity>().eq("name", "faceFile"));if(configEntity==null) {configEntity = new ConfigEntity();configEntity.setName("faceFile");configEntity.setValue(fileName);} else {configEntity.setValue(fileName);}configService.insertOrUpdate(configEntity);}return R.ok().put("file", fileName);}/*** 下载文件*/@IgnoreAuth@RequestMapping("/download")public void download(@RequestParam String fileName, HttpServletRequest request, HttpServletResponse response) {try {File file = new File(request.getSession().getServletContext().getRealPath("/upload")+"/"+fileName);if (file.exists()) {response.reset();response.setHeader("Content-Disposition", "attachment; filename=\"" + fileName+"\"");response.setHeader("Cache-Control", "no-cache");response.setHeader("Access-Control-Allow-Credentials", "true");response.setContentType("application/octet-stream; charset=UTF-8");IOUtils.write(FileUtils.readFileToByteArray(file), response.getOutputStream());}} catch (IOException e) {e.printStackTrace();}}
}
③SushedianfeiController.java
@RestController
@RequestMapping("/sushedianfei")
public class SushedianfeiController {@Autowiredprivate SushedianfeiService sushedianfeiService;/** 后端列表*/@RequestMapping("/page")public R page(@RequestParam Map<String, Object> params,SushedianfeiEntity sushedianfei, HttpServletRequest request){String tableName = request.getSession().getAttribute("tableName").toString();if(tableName.equals("xuesheng")) {sushedianfei.setXuehao((String)request.getSession().getAttribute("username"));}EntityWrapper<SushedianfeiEntity> ew = new EntityWrapper<SushedianfeiEntity>();PageUtils page = sushedianfeiService.queryPage(params, MPUtil.sort(MPUtil.between(MPUtil.likeOrEq(ew, sushedianfei), params), params));return R.ok().put("data", page);}/*** 前端列表*/@RequestMapping("/list")public R list(@RequestParam Map<String, Object> params,SushedianfeiEntity sushedianfei, HttpServletRequest request){EntityWrapper<SushedianfeiEntity> ew = new EntityWrapper<SushedianfeiEntity>();PageUtils page = sushedianfeiService.queryPage(params, MPUtil.sort(MPUtil.between(MPUtil.likeOrEq(ew, sushedianfei), params), params));return R.ok().put("data", page);}/*** 列表*/@RequestMapping("/lists")public R list( SushedianfeiEntity sushedianfei){EntityWrapper<SushedianfeiEntity> ew = new EntityWrapper<SushedianfeiEntity>();ew.allEq(MPUtil.allEQMapPre( sushedianfei, "sushedianfei")); return R.ok().put("data", sushedianfeiService.selectListView(ew));}/*** 查询*/@RequestMapping("/query")public R query(SushedianfeiEntity sushedianfei){EntityWrapper< SushedianfeiEntity> ew = new EntityWrapper< SushedianfeiEntity>();ew.allEq(MPUtil.allEQMapPre( sushedianfei, "sushedianfei")); SushedianfeiView sushedianfeiView = sushedianfeiService.selectView(ew);return R.ok("查询宿舍电费成功").put("data", sushedianfeiView);}/*** 后端详情*/@RequestMapping("/info/{id}")public R info(@PathVariable("id") Long id){SushedianfeiEntity sushedianfei = sushedianfeiService.selectById(id);return R.ok().put("data", sushedianfei);}/*** 前端详情*/@RequestMapping("/detail/{id}")public R detail(@PathVariable("id") Long id){SushedianfeiEntity sushedianfei = sushedianfeiService.selectById(id);return R.ok().put("data", sushedianfei);}/*** 后端保存*/@RequestMapping("/save")public R save(@RequestBody SushedianfeiEntity sushedianfei, HttpServletRequest request){sushedianfei.setId(new Date().getTime()+new Double(Math.floor(Math.random()*1000)).longValue());//ValidatorUtils.validateEntity(sushedianfei);sushedianfeiService.insert(sushedianfei);return R.ok();}/*** 前端保存*/@RequestMapping("/add")public R add(@RequestBody SushedianfeiEntity sushedianfei, HttpServletRequest request){sushedianfei.setId(new Date().getTime()+new Double(Math.floor(Math.random()*1000)).longValue());//ValidatorUtils.validateEntity(sushedianfei);sushedianfeiService.insert(sushedianfei);return R.ok();}/*** 修改*/@RequestMapping("/update")public R update(@RequestBody SushedianfeiEntity sushedianfei, HttpServletRequest request){//ValidatorUtils.validateEntity(sushedianfei);sushedianfeiService.updateById(sushedianfei);//全部更新return R.ok();}/*** 删除*/@RequestMapping("/delete")public R delete(@RequestBody Long[] ids){sushedianfeiService.deleteBatchIds(Arrays.asList(ids));return R.ok();}/*** 提醒接口*/@RequestMapping("/remind/{columnName}/{type}")public R remindCount(@PathVariable("columnName") String columnName, HttpServletRequest request, @PathVariable("type") String type,@RequestParam Map<String, Object> map) {map.put("column", columnName);map.put("type", type);if(type.equals("2")) {SimpleDateFormat sdf = new SimpleDateFormat("yyyy-MM-dd");Calendar c = Calendar.getInstance();Date remindStartDate = null;Date remindEndDate = null;if(map.get("remindstart")!=null) {Integer remindStart = Integer.parseInt(map.get("remindstart").toString());c.setTime(new Date()); c.add(Calendar.DAY_OF_MONTH,remindStart);remindStartDate = c.getTime();map.put("remindstart", sdf.format(remindStartDate));}if(map.get("remindend")!=null) {Integer remindEnd = Integer.parseInt(map.get("remindend").toString());c.setTime(new Date());c.add(Calendar.DAY_OF_MONTH,remindEnd);remindEndDate = c.getTime();map.put("remindend", sdf.format(remindEndDate));}}Wrapper<SushedianfeiEntity> wrapper = new EntityWrapper<SushedianfeiEntity>();if(map.get("remindstart")!=null) {wrapper.ge(columnName, map.get("remindstart"));}if(map.get("remindend")!=null) {wrapper.le(columnName, map.get("remindend"));}String tableName = request.getSession().getAttribute("tableName").toString();if(tableName.equals("xuesheng")) {wrapper.eq("xuehao", (String)request.getSession().getAttribute("username"));}int count = sushedianfeiService.selectCount(wrapper);return R.ok().put("count", count);}
}
④UserService.java
public class UserController{@Autowiredprivate UserService userService;@Autowiredprivate TokenService tokenService;/*** 登录*/@IgnoreAuth@PostMapping(value = "/login")public R login(String username, String password, String captcha, HttpServletRequest request) {UserEntity user = userService.selectOne(new EntityWrapper<UserEntity>().eq("username", username));if(user==null || !user.getPassword().equals(password)) {return R.error("账号或密码不正确");}String token = tokenService.generateToken(user.getId(),username, "users", user.getRole());return R.ok().put("token", token);}/*** 注册*/@IgnoreAuth@PostMapping(value = "/register")public R register(@RequestBody UserEntity user){
// ValidatorUtils.validateEntity(user);if(userService.selectOne(new EntityWrapper<UserEntity>().eq("username", user.getUsername())) !=null) {return R.error("用户已存在");}userService.insert(user);return R.ok();}/**退出*/@GetMapping(value = "logout")public R logout(HttpServletRequest request) {request.getSession().invalidate();return R.ok("退出成功");}/*** 密码重置*/@IgnoreAuth@RequestMapping(value = "/resetPass")public R resetPass(String username, HttpServletRequest request){UserEntity user = userService.selectOne(new EntityWrapper<UserEntity>().eq("username", username));if(user==null) {return R.error("账号不存在");}user.setPassword("123456");userService.update(user,null);return R.ok("密码已重置为：123456");}/*** 列表*/@RequestMapping("/page")public R page(@RequestParam Map<String, Object> params,UserEntity user){EntityWrapper<UserEntity> ew = new EntityWrapper<UserEntity>();PageUtils page = userService.queryPage(params, MPUtil.sort(MPUtil.between(MPUtil.allLike(ew, user), params), params));return R.ok().put("data", page);}/*** 列表*/@RequestMapping("/list")public R list( UserEntity user){EntityWrapper<UserEntity> ew = new EntityWrapper<UserEntity>();ew.allEq(MPUtil.allEQMapPre( user, "user")); return R.ok().put("data", userService.selectListView(ew));}/*** 信息*/@RequestMapping("/info/{id}")public R info(@PathVariable("id") String id){UserEntity user = userService.selectById(id);return R.ok().put("data", user);}/*** 获取用户的session用户信息*/@RequestMapping("/session")public R getCurrUser(HttpServletRequest request){Long id = (Long)request.getSession().getAttribute("userId");UserEntity user = userService.selectById(id);return R.ok().put("data", user);}/*** 保存*/@PostMapping("/save")public R save(@RequestBody UserEntity user){
// ValidatorUtils.validateEntity(user);if(userService.selectOne(new EntityWrapper<UserEntity>().eq("username", user.getUsername())) !=null) {return R.error("用户已存在");}userService.insert(user);return R.ok();}/*** 修改*/@RequestMapping("/update")public R update(@RequestBody UserEntity user){
// ValidatorUtils.validateEntity(user);UserEntity u = userService.selectOne(new EntityWrapper<UserEntity>().eq("username", user.getUsername()));if(u!=null && u.getId()!=user.getId() && u.getUsername().equals(user.getUsername())) {return R.error("用户名已存在。");}userService.updateById(user);//全部更新return R.ok();}/*** 删除*/@RequestMapping("/delete")public R delete(@RequestBody Long[] ids){userService.deleteBatchIds(Arrays.asList(ids));return R.ok();}
}
⑤XiaoyuankachongzhiController.java
public class XiaoyuankachongzhiController {@Autowiredprivate XiaoyuankachongzhiService xiaoyuankachongzhiService;/*** 后端列表*/@RequestMapping("/page")public R page(@RequestParam Map<String, Object> params,XiaoyuankachongzhiEntity xiaoyuankachongzhi, HttpServletRequest request){String tableName = request.getSession().getAttribute("tableName").toString();if(tableName.equals("xuesheng")) {xiaoyuankachongzhi.setXuehao((String)request.getSession().getAttribute("username"));}EntityWrapper<XiaoyuankachongzhiEntity> ew = new EntityWrapper<XiaoyuankachongzhiEntity>();PageUtils page = xiaoyuankachongzhiService.queryPage(params, MPUtil.sort(MPUtil.between(MPUtil.likeOrEq(ew, xiaoyuankachongzhi), params), params));return R.ok().put("data", page);}/*** 前端列表*/@RequestMapping("/list")public R list(@RequestParam Map<String, Object> params,XiaoyuankachongzhiEntity xiaoyuankachongzhi, HttpServletRequest request){EntityWrapper<XiaoyuankachongzhiEntity> ew = new EntityWrapper<XiaoyuankachongzhiEntity>();PageUtils page = xiaoyuankachongzhiService.queryPage(params, MPUtil.sort(MPUtil.between(MPUtil.likeOrEq(ew, xiaoyuankachongzhi), params), params));return R.ok().put("data", page);}/*** 列表*/@RequestMapping("/lists")public R list( XiaoyuankachongzhiEntity xiaoyuankachongzhi){EntityWrapper<XiaoyuankachongzhiEntity> ew = new EntityWrapper<XiaoyuankachongzhiEntity>();ew.allEq(MPUtil.allEQMapPre( xiaoyuankachongzhi, "xiaoyuankachongzhi")); return R.ok().put("data", xiaoyuankachongzhiService.selectListView(ew));}/*** 查询*/@RequestMapping("/query")public R query(XiaoyuankachongzhiEntity xiaoyuankachongzhi){EntityWrapper< XiaoyuankachongzhiEntity> ew = new EntityWrapper< XiaoyuankachongzhiEntity>();ew.allEq(MPUtil.allEQMapPre( xiaoyuankachongzhi, "xiaoyuankachongzhi")); XiaoyuankachongzhiView xiaoyuankachongzhiView = xiaoyuankachongzhiService.selectView(ew);return R.ok("查询校园卡充值成功").put("data", xiaoyuankachongzhiView);}/*** 后端详情*/@RequestMapping("/info/{id}")public R info(@PathVariable("id") Long id){XiaoyuankachongzhiEntity xiaoyuankachongzhi = xiaoyuankachongzhiService.selectById(id);return R.ok().put("data", xiaoyuankachongzhi);}/*** 前端详情*/@IgnoreAuth@RequestMapping("/detail/{id}")public R detail(@PathVariable("id") Long id){XiaoyuankachongzhiEntity xiaoyuankachongzhi = xiaoyuankachongzhiService.selectById(id);return R.ok().put("data", xiaoyuankachongzhi);}/*** 后端保存*/@RequestMapping("/save")public R save(@RequestBody XiaoyuankachongzhiEntity xiaoyuankachongzhi, HttpServletRequest request){xiaoyuankachongzhi.setId(new Date().getTime()+new Double(Math.floor(Math.random()*1000)).longValue());//ValidatorUtils.validateEntity(xiaoyuankachongzhi);xiaoyuankachongzhiService.insert(xiaoyuankachongzhi);return R.ok();}/*** 前端保存*/@RequestMapping("/add")public R add(@RequestBody XiaoyuankachongzhiEntity xiaoyuankachongzhi, HttpServletRequest request){xiaoyuankachongzhi.setId(new Date().getTime()+new Double(Math.floor(Math.random()*1000)).longValue());//ValidatorUtils.validateEntity(xiaoyuankachongzhi);xiaoyuankachongzhiService.insert(xiaoyuankachongzhi);return R.ok();}/*** 修改*/@RequestMapping("/update")public R update(@RequestBody XiaoyuankachongzhiEntity xiaoyuankachongzhi, HttpServletRequest request){//ValidatorUtils.validateEntity(xiaoyuankachongzhi);xiaoyuankachongzhiService.updateById(xiaoyuankachongzhi);//全部更新return R.ok();}/*** 删除*/@RequestMapping("/delete")public R delete(@RequestBody Long[] ids){xiaoyuankachongzhiService.deleteBatchIds(Arrays.asList(ids));return R.ok();}/*** 提醒接口*/@RequestMapping("/remind/{columnName}/{type}")public R remindCount(@PathVariable("columnName") String columnName, HttpServletRequest request, @PathVariable("type") String type,@RequestParam Map<String, Object> map) {map.put("column", columnName);map.put("type", type);if(type.equals("2")) {SimpleDateFormat sdf = new SimpleDateFormat("yyyy-MM-dd");Calendar c = Calendar.getInstance();Date remindStartDate = null;Date remindEndDate = null;if(map.get("remindstart")!=null) {Integer remindStart = Integer.parseInt(map.get("remindstart").toString());c.setTime(new Date()); c.add(Calendar.DAY_OF_MONTH,remindStart);remindStartDate = c.getTime();map.put("remindstart", sdf.format(remindStartDate));}if(map.get("remindend")!=null) {Integer remindEnd = Integer.parseInt(map.get("remindend").toString());c.setTime(new Date());c.add(Calendar.DAY_OF_MONTH,remindEnd);remindEndDate = c.getTime();map.put("remindend", sdf.format(remindEndDate));}}Wrapper<XiaoyuankachongzhiEntity> wrapper = new EntityWrapper<XiaoyuankachongzhiEntity>();if(map.get("remindstart")!=null) {wrapper.ge(columnName, map.get("remindstart"));}if(map.get("remindend")!=null) {wrapper.le(columnName, map.get("remindend"));}String tableName = request.getSession().getAttribute("tableName").toString();if(tableName.equals("xuesheng")) {wrapper.eq("xuehao", (String)request.getSession().getAttribute("username"));}int count = xiaoyuankachongzhiService.selectCount(wrapper);return R.ok().put("count", count);}
}
⑥其他代码
源码参考： https://pan.baidu.com/s/1ttOPk-W8HuZqIK_p_vslfw?pwd=7vei
四、预期成果
1.理论成果
在都调研过程中学习如何建立一套完整的校园一卡通管理系统优化理论体系，为后续的相关研究提供理论参考。同时，撰写相关的研究报告和学术论文，阐述校园一卡通管理系统的发展现状、存在问题、改进方案以及未来发展趋势等内容。实现效果如下图。
2.实践成果
通过研究可以开发出一套功能完善、安全可靠、用户体验良好的校园一卡通管理系统，并在多所学校得到成功应用。通过系统的应用，提高学校的管理效率，减少管理成本，同时提升学生的校园生活满意度。