A high-security RFID system, method and application of wireless radio frequency identification

Abstract

The application belongs to the technical field of high-security RFID, and discloses a high-security RFID system, method and application of wireless radio frequency identification, which comprises an active high-security RFID system of wireless radio frequency identification and a passive high-security RFID system of wireless radio frequency identification.For the active system, the background only stores the root key and ID of the tag and the root key index.The root key index corresponding to each ID is not stored in the background, is randomly generated when the tag is written for the first time, and is written into the tag, so that the tag can be prevented from being activated by an illegal exciter, and the existing wireless network architecture design can be maintained.For the passive system, the background only stores the root key and ID of the tag and the root key index.TLS security identification: the reader and the background are authenticated by using TLS, and data is encrypted by using SM4, so that the security and reliability of the equipment are guaranteed;the existing passive system security design is improved, and the tag can be prevented from being activated by an illegal exciter.

Description

Technical Field

[0001] This invention belongs to the field of high-security RFID technology, and particularly relates to a high-security RFID system, method and application of radio frequency identification. Background Technology

[0002] RFID is an abbreviation for Radio Frequency Identification, a type of automatic identification technology. It uses radio frequency to conduct non-contact two-way data communication and reads and writes recording media (electronic tags or RFID cards) to achieve the purpose of identifying targets and exchanging data. It is considered one of the most promising information technologies of the 21st century.

[0003] RFID is divided into passive and active types. Currently, most ordinary passive and active RFID systems do not have two-way authentication and communication encryption functions, which poses security risks to data transmission between RFID tags, readers and back-end systems.

[0004] Based on the above analysis, the problems and shortcomings of the existing technology are as follows:

[0005] (1) Due to the lack of a highly reliable two-way authentication mechanism between passive or active RFID tags and readers, attackers may forge RFID tags and readers, thereby illegally intruding into the RFID system, stealing or tampering with information, or even attacking the system and causing system paralysis.

[0006] (2) Due to the lack of high-security data encryption function in the communication between RFID tags and readers, the authenticity, timeliness, integrity, availability and confidentiality of the data are threatened.

[0007] (3) Active RFID tags also have physical security risks. Once an active RFID tag is forcibly removed by an attacker, the attacker can read the data stored in the active RFID tag, which will lead to data leakage. Summary of the Invention

[0008] To address the problems existing in the prior art, this invention provides a high-security RFID system, method, and application for radio frequency identification.

[0009] This invention is implemented as follows: a high-security RFID system includes:

[0010] High-security RFID systems with active radio frequency identification and high-security RFID systems with passive radio frequency identification;

[0011] The active wireless radio frequency identification high security RFID system comprises an active gateway, an active locator and an active tag.

[0012] The active gateway is connected with the active locator through a network cable.

[0013] The active gateway comprises a main control system, a power supply system, an Ethernet system, a USB-to-serial system, a buzzer and an SM7 algorithm module.

[0014] The main control system is connected with the power supply system, the Ethernet system, the USB-to-serial system, the buzzer, the SM7 algorithm module and the passive reader through circuit lines.

[0015] The passive wireless radio frequency identification high security RFID system comprises a reader and a tag.

[0016] The reader is connected with the tag through a wireless induction field.

[0017] Further, the active gateway security authentication method comprises the following steps:

[0018] The security authentication of the active gateway is consistent with that of the passive reader, and the Ethernet and the server are used for communication.

[0019] Further, the security authentication method between the active locator and the active tag comprises the following steps:

[0020] 1) The tag can authenticate the legality of the locator;

[0021] 2) The background can authenticate the legality of the tag;

[0022] The authentication process is as follows:

[0023] The locator is provided with a 125KHz exciter, and the locator sends excitation information every 1 second.

[0024] When the excitation information is sent, the 4-byte ID1 is first encrypted by using AES, and then the ID is encrypted by using the SM7 algorithm to obtain ID2, and ID1 and ID2 are sent to the tag together; after the tag receives the ID, the tag calculates the root key RK of the locator encryption key AK according to the ID; the tag further calculates the locator encryption key AK according to the tag ID and the RK; finally, the tag judges whether ID1 and ID2 are equal by using aes decryption ID1 and SM7 decryption ID2, if ID1 and ID2 are equal, the locator is legal, and if ID1 and ID2 are not equal, the locator is not legal.

[0025] After the tag authenticates the locator, the tag sends the following three values to the locator, and the locator forwards the data to the server.

[0026] The tag ID: Tid, 4 bytes;

[0027] Reader ID: Rid, 4 bytes;

[0028] Encryption ID: 8 bytes of Tid and Rid combined, encrypted using SM7 encryption algorithm, encryption key AK2;

[0029] The tag uses the encryption key AK2 itself byte to encrypt the two combined IDs and sends them to the locator, which then forwards them to the server. After receiving the data, the server uses SM7 to decrypt it. If the decrypted ID and the plaintext ID are equal, the tag is judged to be legal.

[0030] Further, the active tag has an additional security design:

[0031] To prevent the tag from being maliciously disassembled, the tag board has a micro switch inside. Once the tag shell is disassembled by force, the key information and root key information stored inside the tag are automatically erased.

[0032] Further, the reader comprises:

[0033] 1) Master: stm32H743IIT6, master memory 1M, flash 2M;

[0034] 2) Extended memory: 32MB;

[0035] 3) Extended storage: use SPI flash W25Q128, 16MB;

[0036] 4) Ethernet:

[0037] Chip: use LAN8720A as PHY chip;

[0038] Function: provide 100M Ethernet;

[0039] Interface form: RJ455;

[0040] 5) RS232 interface:

[0041] Chip: SP3232;

[0042] Function: provide 232 serial interface, used for parameter configuration;

[0043] Interface form: DB9;

[0044] 6) LED indicator:

[0045] Provide power indication, system running indication, card scanning state prompt, and antenna working state prompt;

[0046] 7) Beeper:

[0047] For providing alarm, card scanning prompt, initialization completion, etc.

[0048] 8) 2.54mm plug-in socket: for IO output, IO input control, etc.; can be used to drive alarm, infrared trigger, etc.

[0049] 9) Power module:

[0050] The input power of the whole machine is designed as DC 12V / 5A input; and is reduced to 5V / 5A by LMR14050SDDAR;

[0051] Then 5V directly powers the RFID radio frequency module, and the other way powers the core board by reducing the voltage of CAT6219;

[0052] The other way is reduced to 3.3V by 1117-3.3 to power the peripheral equipment;

[0053] Index: DC-DC switching frequency > 500KHz

[0054] 10) SM7 algorithm module;

[0055] 11) IO output, IO input interface;

[0056] For controlling external relay output, external wake-up input; such as using infrared to detect whether there is an article passing, if so, starting card scanning, reducing radio frequency output;

[0057] 12) Radio frequency interface;

[0058] Through the flat cable and the radio frequency module, the main control and the radio frequency module communicate in a serial way, with a communication baud rate of 460800bps; then the maximum rate is 460800 / 8 = 57600B / s;

[0059] 13) Antenna interface.

[0060] Further, the main control uses STM32H743IIT6, with a main frequency of 400MHz; on-chip memory of 1MB, on-chip flash of 2MB; mainly responsible for the control of the whole system.

[0061] Further, the SM7 algorithm module uses the SM7 algorithm chip module of Fudan Microelectronics, with a chip of SOP8 interface.

[0062] Further, the antenna uses SMA (inner needle inner screw) to TNC interface (inner screw inner hole).

[0063] Further, the high security RFID system design method of passive wireless radio frequency identification:

[0064] (1) Tag and reader identification mechanism;

[0065] The passive RFID tag and the RFID reader use SM7 to achieve two-way authentication; to achieve two-way authentication, the tag and reader need to meet the following functions;

[0066] Tag: Stores the authentication key AK (auth key), which is 128 bits long (16 bytes). This key is obtained by distributing the root key stored on the server. The root key index is 2 bytes. When the tag uploads security parameters to the reader, the reader reads the two bytes of security parameters, finds the root key through the security parameters, and then calculates the AK by combining the root key with the tag TID.

[0067] The process of two-way authentication between the reader and the tag is described below:

[0068] Get_SeePara: The reader initiates a command to retrieve security parameters; the security parameters include whether two-way authentication is supported, encryption method, encryption algorithm, root key index parameters, etc.

[0069] The tag returns the security parameter SecPara[111:0], which contains a total of 14 bytes; the reader finds the root key through the root key index in the security parameter, and then uses RK (root key) + TID (tag ID) to disperse the authentication key AK;

[0070] The reader initiates an authentication request command Req_SAuth;

[0071] The tag generates a 32-bit random number RT and sends RT to the reader;

[0072] The reader generates a 32-bit random number RR, then combines RR and RT into a 64-bit random number, totaling 8 bytes, and encrypts it using AK based on the SM7 encryption algorithm to obtain token1; then it sends token1 to the tag and initiates a two-way authentication request;

[0073] After receiving the two-way authentication command, the tag uses the authentication key AK inside the tag to decrypt token1 using the SM7 algorithm to obtain RR` and RT`, and then determines whether RT` and RT are the same;

[0074] RT` is the same as RT: After the tag successfully authenticates the reader, the tag regenerates a random number RT``, uses the SM7 algorithm to encrypt RT``||RR` (combined into a 64-bit number) with AK to obtain token2, and then sends token2 to the reader;

[0075] RT` differs from RT: the tag fails to be authenticated by the reader. The tag sends an authentication failure error code back to the reader;

[0076] After the reader receives Token2, the reader decrypts Token2 based on the SM7 algorithm using the authentication key AK; RT``` and RR`` are obtained. The reader judges whether RR`` and RR are the same. If yes, the authentication of the reader to the tag is passed; if not, the authentication of the reader to the tag fails.

[0077] (2) A security authentication mechanism of the reader and the background management system;

[0078] The bidirectional authentication of the reader and the background is based on TLS bidirectional authentication; after authentication, SM4 is used to encrypt the transmitted data.

[0079] (3) A reader root key storage mechanism.

[0080] Further, the reader root key storage mechanism comprises the following steps:

[0081] Different tag AKs are different, and the AK is dispersed from the root key; in order to ensure security, the root key cannot be only one; the root key is generated by a server random number. In order to improve the identification speed of the tag, the root key needs to be cached on the reader.

[0082] In combination with the technical scheme and the solved technical problems, the advantages and positive effects of the technical scheme to be protected by the present application are analyzed from the following aspects:

[0083] Firstly, in view of the technical problems existing in the prior art and the difficulty in solving the problems, the technical scheme to be protected by the present application and the results and data in the research and development process are closely combined, and how the technical scheme solves the technical problems and brings some creative technical effects after solving the problems are analyzed in detail and profoundly. The specific description is as follows:

[0084] In view of the bidirectional identity authentication problem between devices in the active and passive systems, a protection mechanism is designed for the identity ID and the session key. The background only stores the root key and the ID of the tag, and the root key index. The root key index corresponding to each ID is not stored in the background, but is randomly generated when the tag is written for the first time and is written into the tag. In this way, even if the root key and the ID are known, the authentication key AK cannot be hashed without the root key index;

[0085] TLS security authentication: the active gateway and the background, and the reader and the background adopt TLS for authentication, so as to guarantee the security and reliability of the devices; data is encrypted by SM4, so as to guarantee the security of the data.

[0086] The security design of the existing active wireless system is improved, so that the illegal exciter can be avoided to activate the tag; and the existing wireless network architecture (2.4G only receives but does not transmit) design can be maintained.

[0087] Prevent the label from being maliciously disassembled by violence, the label board has a micro switch inside, once the label shell is disassembled by violence, the key information and root key information stored in the label are automatically erased.

[0088] Second, the technical solution is regarded as a whole or from the product point of view, the technical effect and advantage of the technical solution to be protected by the application are described as follows:

[0089] The high security RFID system of the application integrates active RFID system, passive RFID system and unified management background, and has identity authentication mechanism and data transmission encryption function among active RFID tags, active locators and active gateways in the active RFID system, between the gateway and the background server, among passive RFID tags and readers in the passive RFID system, between the reader and the background server, so that the identity of the communication parties is real and reliable, and the data transmission is safe and reliable. BRIEF DESCRIPTION OF DRAWINGS

[0090] Figure 1 It is the high security RFID system structure block diagram of wireless radio frequency identification provided by the embodiment of the application.

[0091] Figure 2 It is the overall flow chart of the high security RFID system of active wireless radio frequency identification provided by the embodiment of the application.

[0092] Figure 3 It is the hardware design diagram of the active gateway provided by the embodiment of the application.

[0093] Figure 4 It is the hardware design diagram of the active locator provided by the embodiment of the application.

[0094] Figure 5 It is the active tag design diagram provided by the embodiment of the application.

[0095] Figure 6 It is the security identification diagram between the active locator and the active tag provided by the embodiment of the application.

[0096] Figure 7 It is the reader structure diagram provided by the embodiment of the application.

[0097] Figure 8 It is the appearance design diagram of the reader provided by the embodiment of the application.

[0098] Figure 9 It is the reader computing tag identification key AK diagram provided by the embodiment of the application.

[0099] Figure 10 It is the bidirectional identification diagram of the tag and the reader provided by the embodiment of the application.

[0100] Figure 11 is a TLS authentication schematic diagram provided by the embodiment of the present application.

[0101] Figure 1 In the present application, 1 is an active high-security RFID system of wireless radio frequency identification, and 2 is a passive high-security RFID system of wireless radio frequency identification. DETAILED DESCRIPTION

[0102] In order to make the purpose, technical scheme and advantages of the present application more clear, the present application is further described in detail below in combination with embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application, and are not used to limit the present application.

[0103] I. Explanation of embodiments. In order to enable those skilled in the art to fully understand how the present application is specifically implemented, this part is an explanation of embodiments for expanding the description of the technical scheme of the claims.

[0104] As shown in Figures 1-3 The high-security RFID system of wireless radio frequency identification provided by the embodiment of the present application comprises:

[0105] The high-security RFID system of wireless radio frequency identification provided by the embodiment of the present application comprises:

[0106] The high-security RFID system of wireless radio frequency identification provided by the embodiment of the present application comprises:

[0107] The high-security RFID system of wireless radio frequency identification provided by the embodiment of the present application comprises:

[0108] The high-security RFID system of wireless radio frequency identification provided by the embodiment of the present application comprises:

[0109] The high-security RFID system of wireless radio frequency identification provided by the embodiment of the present application comprises:

[0110] The high-security RFID system of wireless radio frequency identification provided by the embodiment of the present application comprises:

[0111] The high-security RFID system of wireless radio frequency identification provided by the embodiment of the present application comprises:

[0112] The high-security RFID system of wireless radio frequency identification provided by the embodiment of the present application comprises:

[0113] The high-security RFID system of wireless radio frequency identification provided by the embodiment of the present application comprises:

[0114] The security authentication of the active tag and the passive reader is consistent with the Ethernet and server communication.

[0115] As shown in Figure 4 、 5 , 6, the application provides a security authentication method between the active locator and the active tag:

[0116] 1) The tag can authenticate the legality of the locator;

[0117] 2) The background can authenticate the legality of the tag;

[0118] The authentication process is as follows:

[0119] The locator is provided with a 125KHz exciter; the locator sends excitation information every 1 second;

[0120] When the excitation information is sent, first, 4 bytes of ID1 are encrypted by using AES, then ID is encrypted by using the SM7 algorithm to obtain ID2, and ID1 and ID2 are sent to the tag together; after the tag receives it, the root key RK of the locator encryption key AK is calculated according to the ID; the tag further calculates the locator encryption key AK by using the tag ID and RK; finally, ID1 is decrypted by using aes, and ID2 is decrypted by using SM7, and the tag judges whether ID1 and ID2 are equal; if they are equal, the locator is legal, and if they are not equal, the locator is not legal;

[0121] After the tag authenticates the locator, the tag sends the following three values to the locator, and the locator forwards the data to the server;

[0122] Tag ID: Tid, 4 bytes;

[0123] Reader ID: Rid, 4 bytes;

[0124] Encrypted ID: 8 bytes of Tid and Rid after merging, encrypted by using the SM7 encryption algorithm, and the encryption key is AK2;

[0125] The tag uses the encryption key AK2 of the tag itself to encrypt the two merged IDs and sends them to the locator, and the locator forwards them to the server; after the server receives the data, the server decrypts them by using SM7, and if the decrypted ID is equal to the plaintext ID, it is judged that the tag is legal.

[0126] The active tag provided by the application has an additional security design:

[0127] The tag is prevented from being maliciously disassembled; the tag board is internally provided with a micro switch, and once the tag shell is disassembled by force, the key information and the root key information stored in the tag are automatically erased.

[0128] As shown in Figure 7 、 8As shown, the reader provided by the application comprises:

[0129] 1) Master control: stm32H743IIT6, master memory 1M, flash 2M;

[0130] 2) External memory: 32MB;

[0131] 3) External storage: use SPI flash W25Q128, 16MB;

[0132] 4) Ethernet:

[0133] Chip: use LAN8720A as PHY chip;

[0134] Function: provide 100M Ethernet;

[0135] Interface form: RJ45;

[0136] 5) RS232 interface:

[0137] Chip: SP3232;

[0138] Function: provide 232 serial interface, used for parameter configuration;

[0139] Interface form: DB9;

[0140] 6) LED indicator:

[0141] Provide power indication, system running indication, card scanning state prompt, and antenna working state prompt;

[0142] 7) Beeper:

[0143] Used for providing alarm, card scanning prompt, initialization completion, etc.

[0144] 8) 2.54mm plug-in socket: used for IO output, IO input control, etc. can be used for driving alarm, infrared triggering, etc.

[0145] 9) Power module:

[0146] The whole machine input power is designed as DC12V / 5A input; reduced to 5V / 5A by LMR14050SDDAR;

[0147] Then 5V directly powers the RFID radio frequency module, and the other way powers the core board by reducing the voltage of CAT6219;

[0148] The other way is reduced to 3.3V by 1117-3.3 to power the peripheral equipment;

[0149] Index: DC-DC switching frequency > 500KHz

[0150] 10) SM7 algorithm module;

[0151] 11) IO output, IO input interface;

[0152] For controlling external relay output, external wake-up input; such as using infrared to detect whether there is an article passing, if so, starting to scan card, reducing radio frequency output;

[0153] 12) Radio frequency interface;

[0154] Through the flat cable and the radio frequency module are connected, the main control and radio frequency module communication adopts the serial port communication, the communication baud rate is 460800bps; then the maximum rate is 460800 / 8=57600B / s;

[0155] 13) Antenna interface.

[0156] The main control provided by the application adopts STM32H743IIT6, the main frequency is 400MHz; the on-chip memory is 1MB, and the on-chip flash is 2MB; mainly responsible for the control of the whole system.

[0157] The SM7 algorithm module provided by the application uses the SM7 algorithm chip module of Fudan Microelectronics, and the chip is a SOP8 interface.

[0158] The antenna provided by the application adopts SMA (inner needle inner screw) to TNC interface (inner screw inner hole).

[0159] The high-security RFID system design method provided by the application of passive wireless radio frequency identification:

[0160] (1) Tag and reader identification mechanism;

[0161] Passive and RFID reader adopt SM7 to realize bidirectional identification; the tag and the reader need to meet the following functions to realize bidirectional identification;

[0162] As shown in the figure, the tag: store the identification key AK (auth key), the key length is 128bit, 16 bytes; the key is obtained by using the root key stored in the server; root key index, 2 bytes, when the tag uploads the security parameter to the reader, the reader reads two bytes of security parameter, finds the root key through the security parameter, and then calculates AK from the root key and the tag TID; Figure 9

[0163] As shown in the figure, the reader and the tag bidirectional identification flow, the process description is as follows: Figure 10

[0164] ​​Get_SeePara: The reader initiates a command to retrieve security parameters; the security parameters include whether two-way authentication is supported, encryption method, encryption algorithm, root key index parameters, etc.

[0165] The tag returns the security parameter SecPara[111:0], which contains a total of 14 bytes; the reader finds the root key through the root key index in the security parameter, and then uses RK (root key) + TID (tag ID) to disperse the authentication key AK;

[0166] The reader initiates an authentication request command Req_SAuth;

[0167] The tag generates a 32-bit random number RT and sends RT to the reader;

[0168] The reader generates a 32-bit random number RR, then combines RR and RT into a 64-bit random number, totaling 8 bytes, and encrypts it using AK based on the SM7 encryption algorithm to obtain token1; then it sends token1 to the tag and initiates a two-way authentication request;

[0169] After receiving the two-way authentication command, the tag uses the authentication key AK inside the tag to decrypt token1 using the SM7 algorithm to obtain RR` and RT`, and then determines whether RT` and RT are the same;

[0170] RT` is the same as RT: After the tag successfully authenticates the reader, the tag regenerates a random number RT``, uses the SM7 algorithm to encrypt RT``||RR` (combined into a 64-bit number) with AK to obtain token2, and then sends token2 to the reader;

[0171] RT` differs from RT: the tag fails to be authenticated by the reader. The tag sends an authentication failure error code back to the reader;

[0172] After receiving Token2, the reader decrypts it using the authentication key AK based on the SM7 algorithm, obtaining RT``` and RR``. The reader determines whether the tag authentication is successful if RR`` and RR are the same, or if they are different.

[0173] like Figure 11 As shown, (2) the security authentication mechanism between the reader and the background management system;

[0174] The reader and backend perform mutual authentication based on TLS; after authentication, SM4 is used to encrypt the transmitted data.

[0175] (3) Reader root key storage mechanism.

[0176] The reader root key storage mechanism provided by this invention:

[0177] Different labels AK are different, AK is distributed by root key, in order to ensure security, root key cannot have only one; Root key is generated by server random number. In order to improve the identification speed of label, root key needs to be cached on the reader.

[0178] For active system, the background only stores the root key and ID of the label, and the root key index. The specific root key index corresponding to each ID is not stored in the background, but is randomly generated when writing the label for the first time and is written into the label. In this way, even if the root key and ID are known, without the root key index, the authentication key AK cannot be hashed out; TLS security authentication: the active reader and the background use TLS for authentication, and the data uses SM4 encryption. Ensure the security and reliability of the device; Improve the security design of the existing active system, so that illegal activators can activate the label; And can not change the existing wireless network architecture (2.4G only receives but does not send) design. For passive system, the background only stores the root key and ID of the label, and the root key index. The specific root key index corresponding to each ID is not stored in the background, but is randomly generated when writing the label for the first time and is written into the label. In this way, even if the root key and ID are known, without the root key index, the authentication key AK cannot be hashed out; TLS security authentication: the reader and the background use TLS for authentication, and the data uses SM4 encryption, ensuring the security and reliability of the device; Improve the security design of the existing passive system, so that illegal activators can activate the label; And can not change the existing wireless network architecture (2.4G only receives but does not send) design.

[0179] For active system, the background only stores the root key and ID of the label, and the root key index. The specific root key index corresponding to each ID is not stored in the background, but is randomly generated when writing the label for the first time and is written into the label. In this way, even if the root key and ID are known, without the root key index, the authentication key AK cannot be hashed out; TLS security authentication: the active reader and the background use TLS for authentication, and the data uses SM4 encryption. Ensure the security and reliability of the device; Improve the security design of the existing active system, so that illegal activators can activate the label; And can not change the existing wireless network architecture (2.4G only receives but does not send) design. For passive system, the background only stores the root key and ID of the label, and the root key index. The specific root key index corresponding to each ID is not stored in the background, but is randomly generated when writing the label for the first time and is written into the label. In this way, even if the root key and ID are known, without the root key index, the authentication key AK cannot be hashed out; TLS security authentication: the reader and the background use TLS for authentication, and the data uses SM4 encryption, ensuring the security and reliability of the device; Improve the security design of the existing passive system, so that illegal activators can activate the label; And can not change the existing wireless network architecture (2.4G only receives but does not send) design.

[0180] II. Application Examples. In order to prove the creativity and technical value of the technical solutions of the present application, this part is the application examples of the technical solutions of the claims in specific products or related technologies.

[0181] The present application is applied to the asset management business scene of manufacturing enterprises, and the specific application scheme is as follows:

[0182] RFID system management

[0183] Firstly, the RFID tags and reader devices need to be managed throughout the life cycle. In the system design, the RFID application system manages the life cycle from the following aspects.

[0184] 1) Tag and device procurement: each time of procurement, the RFID application system records the information such as the number, specification, protocol type, and procurement person of the purchased tags, so as to facilitate subsequent management and reconciliation;

[0185] 2) Tag and device warehousing: after each purchase, the RFID application system manages the warehousing of tags and devices. The warehousing information should include the corresponding procurement number, the number of various types of tags, the number of various types of readers, the manufacturer information, the delivery person information, the logistics company information, and the warehousing person information. All tag ID numbers are batched into the system, and the tags are marked as "unused" before use. The ID numbers of the reader devices are also read and uniformly recorded into the system, and the "unused" status is recorded.

[0186] 3) Tag and device installation and warehousing: each time of tag and device use should be clearly recorded in the RFID application system. The main information of the tag includes the tag warehousing use time, photo, binding asset information, tag binding person, and binding device ID number. After the warehousing of the reader device, the detailed information such as the warehousing person, warehousing time, installation location, assigned IP address, and MAC address should be recorded.

[0187] 4) Tag use process: after the binding of the tag is completed, the tag should be recorded in the RFID application system during the flow process of the bound asset, including the passage of which readers and whether it has left the factory.

[0188] 5) Tag binding information updating: the tag can be recycled. When the tag needs to be replaced and bound to an asset, the log record of the tag binding should be recorded, including the detailed information of all the bound assets, the binding and unbinding time, and the personnel information of the person who updates the binding.

[0189] 6) Tag destruction: when the tag is not used, the tag should be destroyed by using the tag destruction instruction. The destroyed tag cannot be used again. When the tag is destroyed, the ID of the destroyed device, the destruction personnel, the destruction location, and the destruction time should be recorded.

[0190] Deployment design

[0191] For the business application of supporting materials, tooling, tools, personnel management, it is necessary to design and deploy RFID readers in different locations. The selection of active and passive electronic tags and the deployment design of readers need to fully consider security and confidentiality. The system includes material transfer deployment, workstation deployment, access deployment, and stereoscopic warehouse deployment.

[0192] Material transfer deployment

[0193] Material transfer deployment in fixed positions in each workshop, such as material transfer from warehouse to warehouse, material transfer from warehouse to workstation, etc.

[0194] Workstation deployment

[0195] The main purpose of workstation deployment is to determine the entry / exit of goods into the workstation and the detection of personnel in place.

[0196] For material management, when the object enters the workstation area, the reader in the field area excites the active tag on the transport trolley or transport personnel through the emission of low-frequency excitation pulses. The active tag sends feedback instructions to the reader through the Internet of Things sensing network. The reader receives the instructions and reads the RFID tag on the material through RFID, thereby achieving the purpose of accurately reading the material.

[0197] For personnel management, through the base station of workstation deployment, online on-duty detection of personnel can be achieved, thereby realizing the management of on-duty duration statistics and evaluation of personnel.

[0198] Access deployment

[0199] For readers in key positions such as access doors in production workshops.

[0200] For production materials and objects, when they enter the range of the RFID system deployed at the access, automatic identification and inventory of the targets in the access area can be achieved, such as completing material transfer quickly. In addition, regional control of goods can be achieved.

[0201] Stereoscopic warehouse deployment

[0202] Materials from raw parts in upstream production to finished products can enter the stereoscopic warehouse. The readers in the stereoscopic warehouse inventory the material carriers. Combined with the readers at the warehouse entrance and exit, real-time monitoring of warehouse entry and exit and on-demand inventory in the warehouse can be achieved.

[0203] It should be noted that embodiments of the present application can be realized by hardware, software, or a combination of software and hardware. The hardware portion can be realized by a special logic; the software portion can be stored in a memory and executed by a proper instruction execution system, such as a microprocessor or a specially designed hardware. A person of ordinary skill in the art can understand that the above-mentioned apparatus and method can be realized by computer executable instructions and / or included in processor control codes, such as a carrier medium, such as a magnetic disk, CD or DVD-ROM, a programmable memory, such as a read-only memory (firmware), or a data carrier, such as an optical or electronic signal carrier. The apparatus of the present application and its modules can be realized by a hardware circuit, such as a very large scale integrated circuit or a gate array, a semiconductor, such as a logic chip, a transistor, or a programmable hardware device, such as a field programmable gate array, a programmable logic device, or the like, by software executed by various types of processors, or by a combination of the above-mentioned hardware circuit and software, such as firmware.

[0204] The above description is merely a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any modification, equivalent replacement, and improvement within the technical range disclosed by the present application, and within the spirit and principle of the present application, should be included in the protection scope of the present application.

Claims

1. A high security RFID system for wireless radio frequency identification, characterized in that The high-security RFID system of wireless radio frequency identification comprises: The high-security RFID system of wireless radio frequency identification comprises: The high-security RFID system of wireless radio frequency identification comprises: The active gateway is connected with the active locator and the active tag through a network cable respectively; The active gateway comprises a main control system, a power supply system, an Ethernet system, a USB-to-serial system, a buzzer, an SM7 algorithm module and a passive reader; The main control system is connected with the power supply system, the Ethernet system, the USB-to-serial system, the buzzer, the SM7 algorithm module and the passive reader through a circuit line respectively; The high-security RFID system of wireless radio frequency identification comprises: The reader is connected with the tag through a network cable; The security identification method of the active gateway comprises: The security identification method of the passive reader is consistent with the communication of the Ethernet and the server; The security identification method between the active locator and the active tag comprises: 1) The tag can identify the legality of the locator; 2) The background can identify the legality of the tag; The identification process is as follows: The locator is provided with a 125KHz exciter; When the excitation information is sent, the 4-byte ID1 is first encrypted by using AES, and then the ID is encrypted by using the SM7 algorithm to obtain ID2, and ID1 and ID2 are sent to the tag together; the tag receives the ID, calculates the root key RK of the encryption key AK of the locator according to the ID, calculates the encryption key AK of the locator by using the tag ID and RK, and finally decrypts ID1 by using aes and decrypts ID2 by using SM7, and the tag judges whether ID1 and ID2 are equal, if yes, the locator is legal, and if not, the locator is illegal; After the tag is identified by the locator, the tag sends the following three values to the locator, and the locator forwards the data to the server; Tag ID: Tid, 4 bytes; Reader ID: Rid, 4 bytes; Encrypted ID: 8 bytes of Tid and Rid are merged, encrypted by using the SM7 encryption algorithm, and the encryption key is AK2; The tag sends the merged encrypted ID to the locator by using the encryption key AK2 of the tag itself, the locator forwards the data to the server, and the server decrypts the data by using SM7, and if the decrypted ID is equal to the plaintext ID, the tag is judged to be legal; The reader comprises: 1) main control: stm32H743IIT6, main control memory 1M, flash 2M; 2) external memory: 32MB; 3) external storage: SPI flash W25Q128, 16MB; 4) Ethernet: chip: LAN8720A as PHY chip; provide 100M Ethernet; interface form: RJ455; 5) RS232 interface: chip: SP3232; provide 232 serial interface, used for parameter configuration; interface form: DB9; 6) LED indicator: provide power indication, system running indication, card scanning state prompt, antenna working state prompt; 7) Beeper: used to provide alarm, card scanning prompt, initialization completion; 8) 2.54mm plug-in socket: used for IO output, IO input control; used for driving alarm, infrared triggering; 9) Power module: the whole machine input power is designed as DC 12V / 5A input; reduced to 5V / 5A by LMR14050SDDAR; then 5V directly powers the RFID radio frequency module, another one reduces the voltage to the core board; another one reduces the voltage to 3.3V to power the peripheral equipment; index: DC-DC switching frequency > 500KHz; 10) SM7 algorithm module; 11) IO output, IO input interface; used to control external relay output, external wake-up input; use infrared to detect whether there is an article passing, if so, start card scanning, reduce radio frequency output; 12) Radio frequency interface; connected with radio frequency module through flat cable, master control and radio frequency module communicate in serial mode, communication baud rate is 460800bps; then the maximum rate is 460800 / 8=57600B / s; 13) Antenna interface; The antenna uses SMA to TNC interface; The high security RFID system design method of passive wireless radio frequency identification: (1) Tag and reader identification mechanism; Passive and RFID reader use SM7 to realize bidirectional identification; to realize bidirectional identification, the tag and the reader need to meet the following functions; Tag: store authentication key AK (auth key), key length is 128bit, 16 bytes; the key is obtained by dispersing the root key stored by the server; root key index, 2 bytes, when the tag uploads the security parameter to the reader, the reader reads the two bytes of the security parameter, finds the root key through the security parameter, and then calculates the AK from the root key and the tag TID; The flow of bidirectional identification of the reader and the tag is described as follows: Get_SeePara: the reader initiates the acquisition of security parameter command; the security parameter includes whether to support bidirectional identification, encryption mode, encryption algorithm, root key index parameter; The tag returns the security parameter SecPara[111:0], which contains a total of 14 bytes; the reader finds the root key through the root key index in the security parameter, and then disperses the authentication key AK from the root key RK+TID; The reader initiates the identification request command Req_SAuth; The tag generates a 32-bit random number RT and sends it to the reader; The reader generates a 32-bit random number RR, then combines RR and RT into a 64-bit random number, a total of 8 bytes, and uses AK to encrypt it based on SM7 encryption algorithm to get token1; then sends token1 to the tag and initiates the bidirectional authentication request; After receiving the bidirectional identification command, the tag uses the internal authentication key AK of the tag to decrypt token1 using SM7 algorithm to get RR` and RT`, and then judges whether RT` and RT are the same. RT' is the same as RT: the identification of the tag to the reader passes, the tag regenerates a random number RT'', uses the SM7 algorithm to encrypt RT''||RR' with AK to obtain token2, and then sends token2 to the reader; RT' is different from RT: the identification of the tag to the reader fails; the tag sends an identification failure error code to the reader; After the reader receives Token2, the reader decrypts token2 based on the SM7 algorithm using the identification key AK; RT`` and RR`` are obtained; the reader judges whether RR`` and RR are the same, and if so, the identification of the reader to the tag passes, and if not, the identification of the reader to the tag fails; (2) Reader and background management system security identification mechanism; The reader and the background are bidirectionally authenticated based on TLS bidirectional authentication; after authentication, the transmitted data is encrypted using SM4; (3) Reader root key storage mechanism.

2. The high security RFID system of claim 1, wherein the RFID reader comprises a plurality of antennas, and the RFID tag comprises a plurality of antennas. The additional security design of the active tag: Prevent the tag from being maliciously disassembled, the tag board has a micro switch inside, once the tag shell is disassembled by force, the key information and root key information stored in the tag are automatically erased.

3. The high security RFID system of claim 1, wherein the RFID reader comprises a wireless communication module for communicating with the RFID tag. The main control uses STM32H743IIT6, with a main frequency of 400MHz; the on-chip memory is 1MB, and the on-chip flash is 2MB; responsible for the control of the whole system; The SM7 algorithm module uses the SM7 algorithm chip module of Fudan Microelectronics, and the chip is SOP8 interface.

4. The high security RFID system of claim 1, wherein the RFID reader is configured to transmit the first signal and the second signal in a time division duplex (TDD) manner. The reader root key storage mechanism: Different tags have different AKs, which are derived from the root key; the security root key cannot be only one; the root key is generated by the server random number.

5. A control method of a high-security RFID system of a wireless radio frequency identification according to any one of claims 1 to 4, characterized by, The control method comprises: the whole life cycle management of the RFID tag and the reader device is required; 1) Tag and device procurement: each time the tag and device are purchased, the RFID application system records the purchased tag quantity, specification, protocol type, and procurement person information in detail, facilitating subsequent management and reconciliation; 2) Tag and device warehousing: after each purchase, the RFID application system is used to manage the warehousing of the tags and devices, and the warehousing information should include the corresponding procurement number, various types of actual quantity, various reader actual quantity, manufacturer information, delivery person information, logistics company information, and warehousing person information; and all tag ID numbers are batched into the system, and the tags are marked as "unused" before use; the reader device also reads the surface ID number, and is uniformly recorded into the system and marked as "unused"; 3) Tag and device installation and warehousing: each time the tag and device are used, the use information of the tag should be clearly recorded in the RFID application system, including the tag warehousing use time, photo, binding asset information, tag binding person, and binding device ID number; after the reader device is warehoused, the warehousing person, warehousing time, installation location, allocated IP address, and MAC address detailed information should be recorded in detail; 4) Tag use process: after the tag binding is completed, the tag passes through which reader during the asset flow process, and whether there is a factory building should be recorded in the RFID application system; 5) Tag update binding information: the label considers recycling, when the label needs to replace the bound assets, it is necessary to record the log record of the label binding, detailed record of all the label binding asset information, and record the binding and unbinding time, and it is necessary to record the personnel information of the update binding; 6) Label destruction: when the label is not used, the label should be destroyed by using the label destruction instruction, the destroyed label cannot be used again, and the ID of the destruction equipment, the destruction personnel, the destruction place and the destruction time should be recorded when the label is destroyed.

6. A high security RFID system for supporting material, tool, cutter, personnel management according to any one of claims 1 to 4, characterized in that, Design and deploy RFID readers in different positions, including material transfer deployment, workstation deployment, entrance and exit deployment, and stereoscopic library deployment; Material transfer deployment, deployment in the material transfer area of the fixed position in each workshop; Workstation deployment, determine the entry / exit of the object and the in-situ detection of the personnel; for object management, when the object enters the workstation area, the active tag of the transport trolley or the transport personnel is excited by the low-frequency excitation pulse emitted by the reader in the field area, and the active tag sends feedback instructions to the reader through the Internet of Things sensing network. The reader receives the instructions and reads the RFID tag on the material through RFID, achieving the purpose of accurately reading the material; Entrance and exit deployment, for the key position reader of the production workshop entrance and exit door; Stereoscopic library deployment, materials from upstream production blanks to finished products can enter the stereoscopic library, and the reader in the stereoscopic library counts the material carrier, and combines with the reader at the warehouse entrance and exit to realize real-time monitoring of the warehouse entrance and exit and on-demand inventory function in the warehouse.

Images