RFID electronic tag data issuing system and method

Abstract

The invention discloses an RFID electronic tag data issuing system and method. The system comprises a cipher machine used for generating a label key ciphertext based on a label issuing key and a key dispersion factor transmitted by a cipher machine interface, an upper computer used for obtaining issuing data information and sending the label key ciphertext, the issuing data information and a writing instruction to a label reader-writer, and the label reader-writer used for reading the label key ciphertext when the writing instruction meets a preset first rule. Decrypting the tag key ciphertext based on the decryption key, writing the decrypted tag key ciphertext into a tag key area, and writing the issuing data information into a user area based on a preset second rule after the security authentication is passed; and the label issuing module performs first integrity inspection, and the label inspection module performs second integrity inspection, and determines an issuing result based on the first integrity inspection and the second integrity inspection. According to the technical scheme, the security of high-security electronic tag key data writing and personalized data issuing can be guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of radio frequency identification technology, and in particular to an RFID electronic tag data issuing system and method. Background Art

[0002] RFID is the abbreviation of radio frequency identification technology. RFID electronic tags use chips as carriers to store electronic identification codes and other application information, and can communicate wirelessly through RFID readers. At present, RFID electronic tags have been used in shopping, logistics and other fields, providing great convenience for life and work. In the actual use of tags, there are many demands for writing personalized data into tags. Some application fields of tags have high requirements for the security of tags. In the existing technology, the security protection of the issuance of tag data usually sends the data to the tag reader and then writes it into the electronic tag by the reader. In this case, it is easy to intercept the key data in the production process through the computer port monitoring tool, resulting in leakage, and the data is at risk of being illegally tampered with. Summary of the invention

[0003] In view of this, the present invention provides an RFID electronic tag data issuance system and method, which can prevent the data stored in the electronic tag from being illegally tampered with, and ensure the security of high-security electronic tag key data writing and personalized data issuance.

[0004] According to one aspect of the present invention, an embodiment of the present invention provides an RFID electronic tag data issuance system, the RFID electronic tag data issuance system comprising: a cryptographic machine, a host computer, a tag reader / writer, a target RFID electronic tag, a tag issuance module, and a tag inspection module;

[0005] Wherein, the cryptographic machine is used to generate a label key ciphertext based on a label issuance key in the cryptographic machine and a key dispersion factor transmitted by a cryptographic machine interface;

[0006] The host computer is used to obtain the corresponding issuance data information from the preset database based on the label issuance requirements, and transmit the label key ciphertext, the issuance data information and the pre-configured write instruction to the label reader through the serial port transmission;

[0007] The tag reader is used to decrypt the tag key ciphertext based on a pre-configured decryption key to obtain a decryption result when the write instruction satisfies a preset first rule, write the decryption result into the tag key area of ​​the RFID electronic tag, and write the issuance data information into the user area of ​​the RFID electronic tag based on a preset second rule corresponding to the write instruction after the security authentication of the decryption result passes, so as to obtain a target RFID electronic tag after the data is written;

[0008] The host computer is also used to call the label issuing station interface and the label inspection station interface after receiving the data writing completion instruction, and transmit the written issuing data information and decryption result in the target RFID electronic tag to the label issuing module and the label inspection module;

[0009] The label issuing module is used to perform a first integrity check on the issuing data information and decryption result written into the target RFID electronic tag based on the label issuing inspection library;

[0010] The tag verification module is used to perform a second integrity check on the issuance data information and decryption result written in the target RFID electronic tag based on the tag verification library, and determine the issuance result based on the first integrity check and the second integrity check.

[0011] According to another aspect of the present invention, an embodiment of the present invention further provides a method for issuing RFID electronic tag data, the method comprising:

[0012] The RFID electronic tag data issuance method comprises:

[0013] The cryptographic machine generates a label key ciphertext based on the label issuance key in the cryptographic machine and the key dispersion factor transmitted by the cryptographic machine interface;

[0014] The host computer obtains the corresponding issuance data information from the preset database based on the label issuance requirement, and transmits the label key ciphertext, the issuance data information and the pre-configured write instruction to the label reader through the serial port transmission;

[0015] When the write instruction satisfies the preset first rule, the tag reader / writer decrypts the tag key ciphertext based on the pre-configured decryption key to obtain a decryption result, writes the decryption result into the tag key area of ​​the RFID electronic tag, and after the security authentication of the decryption result passes, writes the issuance data information into the user area of ​​the RFID electronic tag based on the preset second rule corresponding to the write instruction, and obtains the target RFID electronic tag after the data is written;

[0016] After receiving the data writing completion instruction, the host computer calls the label issuing station interface and the label inspection station interface to transmit the written issuing data information and decryption result in the target RFID electronic tag to the label issuing module and the label inspection module for inspection;

[0017] The label issuance module performs a first integrity check on the issuance data information and decryption result written into the target RFID electronic tag based on the label issuance inspection library;

[0018] The tag verification module performs a second integrity check on the issuance data information and the decryption result written into the target RFID electronic tag based on the tag verification library, and determines the issuance result based on the first integrity check and the second integrity check.

[0019] The technical solution of the embodiment of the present invention uses a cryptographic machine to generate a label issuance key, and generates a label key ciphertext based on the label issuance key and a key dispersion factor, so as to prevent leakage during key transmission; uses a host computer to obtain issuance data information from a preset database and obtains label key ciphertext, and sends the label key ciphertext, issuance data information and write instructions to a label reader, and the label reader is used to decrypt the label key ciphertext based on a decryption key and write it into the label key area when the write instruction meets a preset first rule, and write the issuance data information into the user area based on a preset second rule after the security authentication is passed, so as to ensure that the key data of the electronic tag cannot be easily cracked even if it is intercepted by a port monitoring tool; performs a first integrity check by a label issuance module, and performs a second integrity check by a label inspection module, and determines the issuance result based on the first integrity check and the second integrity check, so as to further prevent the data stored in the electronic tag from being illegally tampered with, and ensure the security of high-security electronic tag key data writing and personalized data issuance.

[0020] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 A schematic diagram of the structure of an RFID electronic tag data issuance system provided by one embodiment of the present invention;

[0023] Figure 2 A structural diagram of another RFID electronic tag data issuance system provided by an embodiment of the present invention;

[0024] Figure 3 A structural diagram of another RFID electronic tag data issuance system provided by an embodiment of the present invention;

[0025] Figure 4A schematic diagram of a process for issuing a tag key of an RFID electronic tag provided by an embodiment of the present invention;

[0026] Figure 5 The present invention provides a flowchart of a method for issuing RFID electronic tag data according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] In one embodiment, Figure 1 This is a schematic diagram of the structure of an RFID electronic tag data issuance system provided by an embodiment of the present invention. This embodiment is applicable to the situation when data is written and issued to the RFID electronic tag.

[0030] like Figure 1 As shown, the RFID electronic tag data issuance system in this embodiment includes the following specific steps:

[0031] It includes: a cryptographic machine 110, a host computer 120, a tag reader 130, a target RFID electronic tag 140, a tag issuing module 150, and a tag checking module 160;

[0032] The cryptographic machine 110 is used to generate a label key ciphertext based on the label issuance key in the cryptographic machine and the key dispersion factor transmitted by the cryptographic machine interface;

[0033] The host computer 120 is used to obtain the corresponding issuance data information from the preset database based on the label issuance requirement, and transmit the label key ciphertext, issuance data information and pre-configured write instructions to the label reader 130 through the serial port transmission;

[0034] The tag reader / writer 130 is used to decrypt the tag key ciphertext based on the pre-configured decryption key to obtain a decryption result when the write instruction satisfies the preset first rule, write the decryption result into the tag key area of ​​the RFID electronic tag, and write the issuance data information into the user area of ​​the RFID electronic tag based on the preset second rule corresponding to the write instruction after the security authentication of the decryption result passes, so as to obtain the target RFID electronic tag 140 after the data is written;

[0035] The host computer 120 is also used to call the label issuing station interface and the label inspection station interface after receiving the data writing completion instruction, and transmit the written issuing data information and decryption result in the target RFID electronic tag 140 to the label issuing module 150 and the label inspection module 160 for inspection;

[0036] The label issuing module 150 is used to perform a first integrity check on the issued data information and the decryption result written in the target RFID electronic tag 140 based on the label issuing verification library;

[0037] The tag verification module 160 is used to perform a second integrity check on the written issuance data information and decryption result in the target RFID electronic tag 140 based on the tag verification library, and determine the issuance result based on the first integrity check and the second integrity check.

[0038] Among them, the tag issuance key can be understood as the tag issuance key of the RFID electronic tag generated by the cipher machine when receiving the key generation instruction, and the tag issuance key includes the issuance root key and the protection key. The key dispersion factor is a dispersion factor generated based on the unique identification code of the RFID electronic tag, or a custom identification code accessed by third-party software, which can be used to generate the tag key ciphertext. The target RFID electronic tag is the high-security RFID electronic tag obtained after writing both the issuance data information and the tag key ciphertext.

[0039] In this embodiment, the cryptographic machine 110 is connected to the host computer through the TCP / IP protocol, and is used to respond to the label issuance instruction of the RFID electronic tag 110 issued by the host computer 120, generate a label issuance key randomly or in a specified manner according to the label issuance instruction, and generate a label key ciphertext based on the label issuance key and the key dispersion factor. It can be understood that the host computer 120 calls the key export interface of the cryptographic machine, the cryptographic machine 110 uses the label issuance root key KeyR and the pre-configured key dispersion factor to disperse and generate the label key KeyT, the cryptographic machine 110 uses the protection key KeyP to encrypt KeyT to generate the label key ciphertext KeyTEnc, and then obtains the label key ciphertext KeyTEnc through the key export interface. Specifically, the process of generating a tag key ciphertext based on the tag issuance key and a pre-configured key dispersion factor may include: dispersing the root key in the tag issuance key through the pre-configured key dispersion factor to generate a tag key, and encrypting the tag key using the protection key in the tag issuance key to generate a tag key ciphertext. It should be noted that the protection key corresponding to each RFID electronic tag is different. In order to ensure security, the key dispersion factor is used to disperse the tag issuance root key KeyR to generate the tag key KeyT.

[0040] In this embodiment, the preset database communicates with the host computer 120 through a preset WebService interface, wherein the preset WebService interface includes at least: an order number retrieval interface, a configuration information download interface, a distribution library download interface, an inspection library download interface, a production status update interface, and a label backtracking interface. Thus, the corresponding distribution data information can be obtained from the preset database based on the label issuance requirements of the RFID electronic tag, wherein the distribution data information includes at least: a DLL dependency library, order asset number data, personalized data, and device configuration information; wherein personalized data is personalized data that needs to be written according to user requirements. The DLL dependency library includes at least: a label issuance dependency library, a label issuance inspection dependency library, and a label inspection dependency library. The label issuance requirements can be customized and personalized according to user requirements.

[0041] In this embodiment, the host computer 120 is connected to the cryptographic machine 110 and the tag reader 130, respectively, and is used to obtain the corresponding issuance data information from the preset database based on the tag issuance requirements of the RFID electronic tag, and obtain the tag key ciphertext through the DLL library interface encapsulated by the cryptographic machine 110, and transmit the tag key ciphertext, issuance data information and pre-configured write instructions to the tag reader 130 through the serial port. In this embodiment, the pre-configured write instructions include: instruction code, write area, offset address, write byte length, write data type; wherein, the write data type includes: writing tag key ciphertext, or writing personalized data in the issuance data information, the write area may include the tag key area, or the user area; the offset address may include the starting address for writing personalized data, or the starting address for writing tag key ciphertext.

[0042] In this embodiment, the preset first rule corresponding to the write instruction includes: the instruction code in the write instruction is a write key instruction, the area is the security area of ​​the electronic tag, the offset address is the starting address of the key data storage, and the write data is the write tag key ciphertext; the preset second rule includes: the instruction code in the write instruction is a write personalized data instruction, the area is the security area of ​​the electronic tag, the offset address is the starting address of the personalized data storage, and the write data is write personalized data.

[0043] In this embodiment, the pre-configured decryption key refers to a decryption key consistent with KeyP in the cipher machine embedded in the security chip in the tag reader 130. It can be used to decrypt the tag key ciphertext based on the pre-configured decryption key when the write instruction meets the preset first rule.

[0044] In this embodiment, the tag reader 130 is connected to the host computer 120 via a serial port or USB port, and is used to decrypt the tag key ciphertext based on the pre-configured decryption key to obtain a decryption result when the write instruction meets the preset first rule. The decryption result is the plaintext key, and the decryption result is written into the tag key area of ​​the RFID electronic tag, and the written plaintext key is securely authenticated. After the security authentication is passed, the release data information is written into the user area of ​​the RFID electronic tag based on the preset second rule corresponding to the write instruction, and the target RFID electronic tag 140 after the data is written is obtained. It can be understood that the tag reader 130 internally decrypts the ciphertext key Ke into the plaintext key Kd, and the host computer 120 calls the DLL interface to write the key Kd into the tag key area. The plaintext key Kd is used inside the tag for security authentication. After the authentication is passed, the release data information is written into the user area of ​​the tag, that is, the plaintext key is written first, and then the plaintext key is authenticated. After the authentication is passed, the release data information is written. Specifically, the security authentication method can be to perform security authentication on the plaintext key through the SM7 algorithm.

[0045] In this embodiment, the label issuing station interface and the label inspection station interface are called to transmit the written issuing data information and the decryption result in the target RFID electronic tag 140 to the label issuing module 150 and the label inspection module 160; the label issuing module 150 is used to perform a first integrity check on the written issuing data information and the decryption result in the target RFID electronic tag 140 based on the label issuing inspection library; the label inspection module 160 is used to perform a second integrity check on the written issuing data information and the decryption result in the target RFID electronic tag 140 based on the label inspection inspection library, and confirm whether the RFID electronic tag can be issued based on the first inspection result and the second inspection result. If the RFID electronic tag can be issued, read the TID of the RFID electronic tag. In this embodiment, the TID of the electronic tag is readable but not writable. It has been written at the factory and is the unique identifier of the tag, the product category identification number of the electronic tag, and the TID number of each manufacturer will be different. .

[0046] In this embodiment, the host computer 120 includes at least label issuing software, label inspection software, and label printing software, and the corresponding interfaces include at least: label issuing station interface, label inspection station interface, key export interface and label printing interface. The label issuing station interface is connected to the label issuing module (which can be understood as the label issuing station), the label inspection station is connected to the label inspection module (which can also be called the label inspection station), the key export interface is connected to the cipher machine, and the label printing interface is connected to the printer. It should be noted that the label issuing station interface connected to the label issuing module also includes an integrity check, which can be understood as the issuance data information and decryption result after writing will be subjected to the first integrity check at the label issuing station, and then the label inspection interface is connected to the label inspection module for another integrity check, that is, the second integrity check. Through the two integrity checks, the security and integrity of the writing are further guaranteed, and then based on the first integrity check and the second integrity check, it is confirmed whether the RFID electronic tag can be issued. If the RFID electronic tag can be issued, the TID of the RFID electronic tag is read and sent back to the label data management subsystem for storage.

[0047] The technical solution of the embodiment of the present invention is to use a cryptographic machine to generate a label issuance key, and to generate a label key ciphertext based on the label issuance key and a key dispersion factor, so as to prevent leakage during key transmission; to use a host computer to obtain issuance data information from a preset database, and to send the label key ciphertext, issuance data information and write instructions to a label reader, and the label reader is used to decrypt the label key ciphertext based on a decryption key and write it into the label key area when the write instruction meets a preset first rule, and to write the issuance data information into the user area based on a preset second rule after the security authentication is passed, so as to ensure that the key data of the electronic tag cannot be easily cracked even if it is intercepted by a port monitoring tool; and to use a host computer to select a first inspection library and a second inspection library from a preset database, and to inspect the written data content based on the first inspection library and the second inspection library to determine the issuance result, so as to further prevent the data stored in the electronic tag from being illegally tampered with, and to ensure the security of high-security electronic tag key data writing and personalized data issuance.

[0048] In one embodiment, the preset database is deployed on the server side, and the system further includes: a tag data management subsystem;

[0049] The tag data management subsystem is connected to the preset database and the host computer through the TCP / IP protocol. It is used to receive the tag identification of the issued RFID electronic tag sent back by the host computer and store the tag identification to facilitate the tracking and management of the issued RFID electronic tag.

[0050] The tag data management subsystem can also be called a unified information centralized management system, that is, a background tag management system. The tag identifier is a unique identifier of an RFID electronic tag, which can also be called a tag's TID. In this embodiment, each tag has a unique TID. After the issuance is completed, the identifier of the issued tag is recorded, and then the issuance status is recorded, so that the subsequent tag can be traced if there is a problem on the site.

[0051] In this embodiment, the tag data management subsystem is connected to the preset database and the host computer through the TCP / IP protocol, and is used to receive the tag identification of the issued RFID electronic tag sent back by the host computer and store the tag identification to facilitate the tracking and management of the issued RFID electronic tag.

[0052] In one embodiment, the tag data management subsystem is also used to classify and store RFID electronic tags of the same type; wherein the dynamic link library DLL library called by the RFID electronic tags of the same type is consistent, and the format of the personalized data written is universal.

[0053] In this embodiment, the RFID electronic tag corresponds to multiple types of tags, exemplarily, electric meter tags and meter box tags. In the tag data management subsystem, users can classify and store the types of RFID electronic tags. The dynamic link library DLL library called by the same type of RFID electronic tags is consistent, and the format of the written personalized data is universal. It can be understood that the issuance library, dll dynamic library, and some inspection libraries corresponding to each type of tag are not completely consistent. For convenience, the tags are first classified. The dll library corresponding to the tag is completely consistent and divided into one category. The format of the personalized data used by the tag is universal. First, classify it and make it into a universal dll library, put it in the background, and then the front end can obtain the data through the Webservice interface, and then issue it. That is, different types correspond to the issuance library and inspection library. Different types of tags, such as selecting one of the types, the parameters of the card reader corresponding to this type, and the parameters of the device are directly obtained.

[0054] In this embodiment, through the back-end storage of the tag data management subsystem, a front-end and back-end separation structure is adopted. The front-end software obtains the written data information, equipment parameter information, etc. from the back-end through the interface, controls the equipment to perform corresponding mechanical actions to complete production, and the back-end integrated management system uniformly manages the production data, parameter configuration and other information, and stores them in the Mysql database. This design enables rapid deployment and production when issuing different types of tags, and greatly improves production efficiency.

[0055] In one embodiment, the host computer includes label printing software;

[0056] The label printing software is used to call the label printing interface to transmit the order asset number data in the issuance data information to the printer, so that the printer prints the order asset number data on the surface of the RFID electronic label.

[0057] In this embodiment, the order asset number data can be a multi-digit asset number, for example, 21 digits or 23 digits, etc., and the online application enterprise number, label type, label number, label check digit number, etc. can be reflected in the asset number; in this embodiment, the label printing software in the host computer is used to call the label printing interface to transmit the order asset number data in the issuance data information to the printer, so that the printer prints the order asset number data on the surface of the RFID electronic tag.

[0058] In one embodiment, the host computer is also connected to a preset machine device to receive customized parameter information of the RFID electronic tag input by the user, so as to control the preset machine device to customize the RFID electronic tag according to the customized parameter information; wherein the customized parameter information includes at least: the customized length and width, thickness, label color of the label, and the power, frequency, and communication rate of the card reader.

[0059] Among them, the preset machine equipment may include PLC, robotic arms and other machine equipment. The upper computer also includes an interface for controlling the machine equipment. The PLC, robotic arms and other machine equipment are controlled by the control interface to perform operations. The operation is the customized parameter information of the RFID electronic tag input by the user. The size and thickness of each label are different, so the corresponding operations of the robotic arm and PLC are also different.

[0060] In one embodiment, the tag reader includes an MCU unit, a security chip and a radio frequency module; a pre-configured decryption key is deployed in the security chip;

[0061] The MCU unit is connected to the host computer and the security chip respectively, and is used to receive the write instruction and the tag key ciphertext transmitted by the host computer, and when the write instruction meets the preset first rule, obtain the pre-configured decryption key from the security chip, use the decryption key to parse the write instruction and the tag key ciphertext to obtain the key plaintext and the executed write instruction, and transmit them to the RF module;

[0062] The radio frequency module is connected to the MCU unit and the RFID electronic tag respectively, and is used to write the key plain text into the tag key area in the RFID electronic tag according to the offset address in the write instruction, and use the key plain text to perform security authentication. After the security authentication is passed, the personalized data is obtained, and when the write instruction meets the preset second rule, the personalized data is written into the user area of ​​the RFID electronic tag.

[0063] In this embodiment, the MCU unit is connected to the host computer and the security chip respectively, and is used to receive the write instruction and the tag key ciphertext transmitted by the host computer, and when the write instruction meets the preset first rule, obtains the pre-configured decryption key from the security chip, uses the decryption key to parse the write instruction and the tag key ciphertext to obtain the key plaintext and the executed write instruction, and transmits them to the radio frequency module. The radio frequency module is connected to the MCU unit and the RFID electronic tag respectively, and is used to write the key plaintext into the tag key area in the RFID electronic tag according to the offset address in the write instruction, and uses the key plaintext to perform security authentication. After the security authentication is passed, personalized data is obtained, and when the write instruction meets the preset second rule, the personalized data is written into the user area of ​​the RFID electronic tag to obtain the target RFID electronic tag after the data is written.

[0064] Specifically, when the key is written in plain text to the tag key area in the RFID electronic tag, the MCU control unit of the reader / writer performs rule judgment after receiving the instruction. When the instruction code is a write instruction, the area is the security area of ​​the electronic tag, and the offset address is the starting address of the key data storage, it is determined that the key data write operation of the electronic tag is currently being performed, and then the decryption interface of the security chip is called to decrypt KeyTEnc through the key KeyP built into the security chip to obtain the key plain text KeyT, and write it into the electronic tag. In this embodiment, a decryption key consistent with the protection key in the production cipher machine is built into the security chip inside the reader / writer, and the cipher machine performs the encryption operation, and the key data is transmitted to the reader / writer in the form of ciphertext, and then the reader / writer performs the decryption operation, so as to ensure that the key data of the electronic tag cannot be easily cracked even if it is intercepted by the port monitoring tool. If the reader / writer wants to change the application data of the electronic tag, it must first obtain the change permission after the key data and the electronic tag are authenticated by the national secret. This proposal ensures that the application data in the electronic tag cannot be illegally tampered with or deleted by protecting the key data. Although the existing method ensures that the plain text of application data cannot be obtained through the storage method of ciphertext, once the key data is leaked, the application data is at risk of being tampered with and deleted.

[0065] In one embodiment, security authentication is to perform security authentication on the key plaintext written in the RFID electronic tag and the key plaintext obtained by decrypting the security chip in the tag reader; the method of security authentication includes: the RFID electronic tag generates a first random number and transmits it to the security chip in the tag reader; the security chip generates a second random number, encrypts the first random number and the second random number to obtain a first ciphertext random number, and transmits the first ciphertext random number to the RFID electronic tag so that the RFID electronic tag decrypts the first ciphertext random number to obtain the first plaintext random number and the second plaintext random number; the RFID electronic tag compares the first plaintext random number with the first random number, and after the comparison result of the first plaintext random number and the first random number is consistent, the RFID electronic tag generates a third random number, encrypts the second plaintext random number and the third random number to obtain a second ciphertext random number, and transmits the second ciphertext random number to the security chip; the security chip decrypts the second ciphertext random number to obtain a second plaintext random number, and compares the second plaintext random number with the second random number, and when the comparison is consistent, it is determined that the security authentication has been passed.

[0066] In one embodiment, the integrity check method includes: reading personalized data from an offset address in an RFID electronic tag, and obtaining the personalized data transmitted by calling a tag issuing station interface for comparison to obtain a first comparison result, and after the first comparison result is consistent, determining that the verification result of the integrity check passes.

[0067] In this embodiment, personalized data is read from the offset address in the RFID electronic tag. Since the personalized data is written after the tag key authentication is passed, after the first comparison result is consistent, the verification result of the integrity check is determined to be passed. In some embodiments, the personalized data transmitted by calling the tag issuing station interface can also be obtained for comparison to obtain the first comparison result; the tag key ciphertext is read from the offset address in the RFID electronic tag, and the MAC check value corresponding to the tag key ciphertext is calculated to determine whether the MAC check value is a null value; if the first comparison result is consistent and the MAC check value is a null value, it is determined that the verification result of the integrity check is passed.

[0068] In one embodiment, in order to better understand the RFID electronic tag data issuance system, Figure 2 A structural diagram of another RFID electronic tag data distribution system provided by an embodiment of the present invention is as follows: Figure 2 As shown, the RFID electronic tag data issuance system includes: a cryptographic machine 210, a host computer software 220, a tag reader / writer 230, a target RFID electronic tag 240 (also called a high-security RFID electronic tag), a tag issuance module 250, a tag inspection module 260, and a tag data management subsystem 270; wherein, the host computer 220 includes: label printing software, label issuance software, label inspection software, and label customization software for controlling PLC, robotic arms and other equipment; the tag reader / writer 230 includes an MCU unit, a security chip and a radio frequency module, and a server interface is included between the host computer 230 and the tag data management subsystem 270.

[0069] In this embodiment, the cryptographic machine generates a label issuance key, and generates a label key ciphertext based on the label issuance key and a pre-configured key dispersion factor, and gives it to the host computer. The host computer obtains the issuance data information from the database through the preset WebService interface, calls the label printing interface, and transmits the order asset number data in the issuance data information to the printer, so that the printer prints the order asset number data on the surface of the RFID electronic tag, and obtains the label key ciphertext from the cryptographic machine, and transmits the label key ciphertext, the issuance data information and the pre-configured write instruction to the label reader through the serial port. The label reader is used to decrypt the label key ciphertext based on the pre-configured decryption key to obtain a decryption result when the write instruction meets the preset first rule, write the decryption result into the label key area of ​​the RFID electronic tag, and write the decryption result to the label key area of ​​the RFID electronic tag. After the security authentication is passed, the issuance data information is written into the user area of ​​the RFID electronic tag based on the preset second rule corresponding to the write instruction, and the target RFID electronic tag after the data is written is obtained. The host computer is also used to select the first inspection library and the second inspection library from the preset database through the preset WebService interface after receiving the data writing completion instruction, and perform a first integrity check on the issuance data information and the decryption result written in the target RFID electronic tag based on the first inspection library, and perform a second integrity check on the issuance data information and the decryption result written in the target RFID electronic tag based on the second inspection library, and determine the issuance result based on the first integrity check and the second integrity check. After the inspection is completed, the TID of the tag is read and transmitted back to the data management system for storage, so as to facilitate subsequent tag tracking and management.

[0070] For example, to better understand the RFID electronic tag data issuance system and the specific issuance process of the tag key, Figure 3 A structural diagram of another RFID electronic tag data issuance system provided by an embodiment of the present invention, Figure 4 A schematic diagram of the process of issuing a tag key for an RFID electronic tag provided in an embodiment of the present invention. The unified centralized management system for background information is the tag data management subsystem in the above embodiment, the production cipher machine is the cipher machine in the above embodiment, the high-security RFID electronic tag is the target RFID electronic tag in the above embodiment, and the production software is the host computer in the above embodiment.

[0071] like Figure 3As shown, the RFID electronic tag data issuance system includes: a production cipher machine, production software, and the production software includes: label printing software, label issuance software and label inspection software, label reading and writing, high-security RFID electronic tags, and a unified centralized management system for background information. Similarly, the label reader is connected to the PC via a serial port or USB port, and contains an MCU control unit, a security chip, and a radio frequency module. In this embodiment, the production software downloads the DLL dependency library, order asset number data, personalized information, device configuration information, etc. from the database through the WebService interface, and calls the printer interface to realize the real-time printing of the order asset number data. At the same time, the production software uses the TCP / IP protocol to obtain the label key ciphertext Ke from the production cipher machine, transmits the ciphertext data to the label reader through the serial port, and the reader decrypts the ciphertext key Ke into a plaintext key Kd. The upper computer software calls the DLL interface at the issuing station to write the key Kd into the label key area. The plaintext key Kd is used inside the label for SM7 security authentication. After the authentication is passed, the personalized information is written into the user area of ​​the label. The personalized data inside the label is inspected at the equipment inspection station to determine the integrity of the data written. After the inspection is completed, the TID of the tag is read and sent back to the data management system for storage to facilitate subsequent tag tracking and management.

[0072] like Figure 4As shown, the production host computer software takes the key dispersion factor, which can be taken from the identification code of the electronic tag or the external system. The host computer calls the key export interface of the production cipher machine, and the cipher machine uses the tag issuance root key KeyR to disperse and generate the tag key KeyT. The cipher machine uses the protection key KeyP to encrypt KeyT to generate the tag key ciphertext KeyTEnc, and the host computer software obtains KeyTEnc. The host computer software sends the write instruction and KeyTEnc to the tag reader. The tag reader is connected to the PC via a serial port or USB port, and contains an MCU control unit, a security chip, and a radio frequency module. The MCU control unit is responsible for parsing the instructions and data sent by the host computer software (that is, parsing the encrypted tag key ciphertext KeyTEnc, specifically by pre-embedding a decryption key consistent with KeyP in the cipher machine, decrypting KeyTEnc to obtain the plaintext key, and then writing the plaintext key into the tag), controlling the security chip to perform encryption and decryption, and operating the radio frequency module to read and write the electronic tag. A decryption key consistent with KeyP in the cipher machine is pre-embedded in the security chip. The radio frequency module is responsible for communicating with the electronic tag. In this embodiment, a complete write instruction includes at least the following factors: instruction code, write area, offset address (starting address), number of words to be written, and write data; wherein, the write data is the ciphertext of KeyTEnc. After receiving the instruction, the MCU control unit of the reader / writer performs rule judgment. When the instruction code is a write instruction, the area is the security area of ​​the electronic tag, and the offset address is the starting address of the key data storage, it is determined that the key data write operation of the electronic tag is currently being performed, and then the decryption interface of the security chip is called to decrypt KeyTEnc through the key KeyP built into the security chip, and the key plaintext KeyT is obtained, and written into the electronic tag, and then security authentication is performed. After the security authentication is passed, the personalized data is written into the electronic tag in the same way to obtain the target electronic tag, that is, a high-security electronic tag.

[0073] In one embodiment, Figure 5 A flow chart of a method for issuing RFID electronic tag data provided by an embodiment of the present invention is shown as follows: Figure 5 As shown, the method is applied to an RFID electronic tag data issuance system, and the method specifically comprises the following steps:

[0074] S510. The cryptographic machine generates a label key ciphertext based on the label issuance key in the cryptographic machine and the key dispersion factor transmitted by the cryptographic machine interface.

[0075] S520, the host computer obtains the corresponding issuance data information from the preset database based on the label issuance requirement, and transmits the label key ciphertext, the issuance data information and the pre-configured write instruction to the label reader through the serial port transmission.

[0076] S530. When the write instruction of the tag reader / writer satisfies the preset first rule, the tag reader / writer decrypts the tag key ciphertext based on the pre-configured decryption key to obtain a decryption result, writes the decryption result into the tag key area of ​​the RFID electronic tag, and after the security authentication of the decryption result is passed, writes the issuance data information into the user area of ​​the RFID electronic tag based on the preset second rule corresponding to the write instruction, and obtains the target RFID electronic tag after the data is written.

[0077] S540, after receiving the data writing completion instruction, the host computer calls the label issuing station interface and the label inspection station interface to transmit the written issuing data information and decryption result in the target RFID electronic tag to the label issuing module and the label inspection module for inspection.

[0078] S550: The label issuance module performs a first integrity check on the issuance data information and decryption result written into the target RFID electronic tag based on the label issuance verification library.

[0079] S560, the tag inspection module performs a second integrity check on the issuance data information and decryption result written in the target RFID electronic tag based on the tag inspection library, and determines the issuance result based on the first integrity check and the second integrity check.

[0080] In one embodiment, the preset database is deployed on a server side, and the method further includes:

[0081] The tag data management subsystem receives the tag identification of the issued RFID electronic tag sent back by the tag reader and stores the tag identification, so as to facilitate the tracking and management of the issued RFID electronic tag.

[0082] In one embodiment, the method further includes: classifying and storing RFID electronic tags of the same type through the tag data management subsystem; wherein the dynamic link library DLL library called by the RFID electronic tags of the same type is consistent, and the format of the personalized data written is universal.

[0083] In one embodiment, the label issuance key includes an issuance root key and a protection key; accordingly, the cryptographic machine generates a label key ciphertext based on the label issuance key in the cryptographic machine and a key dispersion factor transmitted by the cryptographic machine interface, including:

[0084] The root key in the tag issuance key is dispersed to generate a tag key through the key dispersion factor transmitted by the cryptographic machine interface; wherein the key dispersion factor includes: the identification code of the RFID electronic tag, or the custom identification code input through a third-party system;

[0085] The label key is encrypted using the protection key in the label issuance key to generate a label key ciphertext.

[0086] In one embodiment, the pre-configured write instruction includes: instruction code, write area, offset address, write byte length, write data type; wherein the write data type includes: write tag key ciphertext, or write personalized data in release data information.

[0087] In one embodiment, the method further includes calling a label printing interface through label printing software in a host computer to transmit the order asset number data in the issuance data information to a printer, so that the printer prints the order asset number data on the surface of the RFID electronic tag.

[0088] In one embodiment, the tag reader includes an MCU unit, a security chip and a radio frequency module; a pre-configured decryption key is deployed in the security chip;

[0089] The method comprises: receiving the write instruction and the tag key ciphertext transmitted by the host computer through the MCU unit, and when the write instruction meets the preset first rule, obtaining the pre-configured decryption key from the security chip, using the decryption key to parse the write instruction and the tag key ciphertext to obtain the key plaintext and the executed write instruction, and transmitting them to the radio frequency module;

[0090] The key plaintext is written into the tag key area in the RFID electronic tag through the radio frequency module according to the offset address in the write instruction, and the key plaintext is used for security authentication. After the security authentication is passed, the personalized data is obtained from the upper computer software, and when the write instruction meets the preset second rule, the personalized data is written into the user area of ​​the RFID electronic tag.

[0091] In one embodiment, the preset first rule includes: the instruction code in the write instruction is a write key instruction, the area is a security area of ​​the electronic tag, the offset address is a starting address for storing the key data, and the write data is a write tag key ciphertext;

[0092] The preset second rule includes: the instruction code in the write instruction is a write personalized data instruction, the area is the user area of ​​the electronic tag, the offset address is the starting address of the personalized data storage, and the write data is write personalized data.

[0093] In one embodiment, the issuance data information includes at least: DLL dependency library, order asset number data, personalized data, and device configuration information; the DLL dependency library includes at least: label issuance dependency library, label issuance verification dependency library, and label verification dependency library.

[0094] In one embodiment, the preset database communicates with the host computer through a preset WebService interface; the preset WebService interface includes: an order number retrieval interface, a configuration information download interface, a distribution library download interface, an inspection library download interface, a production status update interface, and a label backtracking interface.

[0095] In one embodiment, the host computer is used to receive customized parameter information of the RFID electronic tag input by the user to control the preset machine equipment to customize the RFID electronic tag according to the customized parameter information; wherein the customized parameter information includes at least: the customized length, width, thickness, and color of the label.

[0096] In one embodiment, the security authentication is to perform security authentication on the key plaintext written in the RFID electronic tag and the key plaintext decrypted by the security chip in the tag reader; the security authentication method includes:

[0097] The RFID electronic tag generates a first random number and transmits it to the security chip in the tag reader;

[0098] The security chip generates a second random number, encrypts the first random number and the second random number to obtain a first ciphertext random number, and transmits the first ciphertext random number to the RFID electronic tag so that the RFID electronic tag decrypts the first ciphertext random number to obtain a first plaintext random number and a second plaintext random number;

[0099] The RFID electronic tag compares the first plaintext random number with the first random number, and after the comparison result of the first plaintext random number and the first random number is consistent, the RFID electronic tag generates a third random number, encrypts the second plaintext random number and the third random number to obtain a second ciphertext random number, and transmits the second ciphertext random number to the security chip;

[0100] The security chip decrypts the second ciphertext random number to obtain a second plaintext random number, and compares the second plaintext random number with the second random number, and determines that the security authentication is passed when the comparison is consistent.

[0101] In one embodiment, the integrity check method includes:

[0102] The personalized data is read from the offset address in the RFID electronic tag, and the personalized data transmitted by calling the tag issuing station interface is obtained for comparison to obtain a first comparison result, and after the first comparison result is consistent, it is determined that the verification result of the integrity check passes.

[0103] In one embodiment, the system further includes: the cryptographic machine is connected to the host computer via TCP / IP protocol; the host computer is connected to the cryptographic machine and the tag reader respectively; the tag reader is connected to the host computer via a serial port or a USB port.

[0104] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0105] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. An RFID electronic tag data distribution system, characterized in that: The RFID electronic tag data issuance system includes: a cryptographic machine, a host computer, a tag reader / writer, a target RFID electronic tag, a tag issuance module, and a tag inspection module; Wherein, the cryptographic machine is used to generate a label key ciphertext based on a label issuance key in the cryptographic machine and a key dispersion factor transmitted by a cryptographic machine interface; The host computer is used to obtain the corresponding issuance data information from the preset database based on the label issuance requirements, and transmit the label key ciphertext, the issuance data information and the pre-configured write instruction to the label reader through the serial port transmission; The tag reader is used to decrypt the tag key ciphertext based on a pre-configured decryption key to obtain a decryption result when the write instruction satisfies a preset first rule, write the decryption result into the tag key area of ​​the RFID electronic tag, and write the issuance data information into the user area of ​​the RFID electronic tag based on a preset second rule corresponding to the write instruction after the security authentication of the decryption result passes, so as to obtain a target RFID electronic tag after the data is written; The host computer is also used to call the label issuing station interface and the label inspection station interface after receiving the data writing completion instruction, and transmit the written issuing data information and decryption result in the target RFID electronic tag to the label issuing module and the label inspection module for inspection; The label issuing module is used to perform a first integrity check on the issuing data information and decryption result written into the target RFID electronic tag based on the label issuing inspection library; The tag verification module is used to perform a second integrity check on the issuance data information and decryption result written in the target RFID electronic tag based on the tag verification library, and determine the issuance result based on the first integrity check and the second integrity check.

2. The system according to claim 1, characterized in that The preset database is deployed on the server side. The system further includes: a label data management subsystem; The tag data management subsystem is connected to the preset database and the host computer via the TCP / IP protocol, and is used to receive the tag identification of the issued RFID electronic tag sent back by the host computer, and store the tag identification to facilitate the tracking and management of the issued RFID electronic tag.

3. The system according to claim 2, characterized in that The tag data management subsystem is also used to classify and store RFID electronic tags of the same type; wherein the dynamic link library DLL library called by the RFID electronic tags of the same type is consistent, and the format of the written personalized data is universal.

4. The system according to claim 1, characterized in that The label issuance key includes an issuance root key and a protection key; accordingly, the process of the cipher machine generating the label key ciphertext includes: The root key in the tag issuance key is dispersed to generate a tag key through the key dispersion factor transmitted by the cryptographic machine interface; wherein the key dispersion factor includes: the identification code of the RFID electronic tag, or the custom identification code input through a third-party system; The label key is encrypted using the protection key in the label issuance key to generate a label key ciphertext.

5. The system according to claim 1, characterized in that The pre-configured write instruction includes: an instruction code, a write area, an offset address, a write byte length, and a write data type; wherein the write data type includes: a write tag key ciphertext, or personalized data in write distribution data information.

6. The system according to claim 1, characterized in that The host computer includes label printing software; The label printing software is used to call the label printing interface to transmit the order asset number data in the issuance data information to the printer, so that the printer prints the order asset number data on the surface of the RFID electronic label.

7. The system according to claim 1, characterized in that The tag reader / writer includes an MCU unit, a security chip and a radio frequency module; a pre-configured decryption key is deployed in the security chip; The MCU unit is connected to the host computer and the security chip respectively, and is used to receive the write instruction and the tag key ciphertext transmitted by the host computer, and when the write instruction meets the preset first rule, obtain the pre-configured decryption key from the security chip, use the decryption key to parse the write instruction and the tag key ciphertext to obtain the key plaintext and the executed write instruction, and transmit them to the RF module; The radio frequency module is connected to the MCU unit and the RFID electronic tag, respectively, and is used to write the key plaintext into the tag key area in the RFID electronic tag according to the offset address in the write instruction, and use the key plaintext to perform security authentication. After the security authentication is passed, personalized data is obtained from the upper computer software, and when the write instruction meets the preset second rule, the personalized data is written into the user area of ​​the RFID electronic tag.

8. The system according to any one of claims 1 or 7, characterized in that: The preset first rule includes: the instruction code in the write instruction is a write key instruction, the area is a security area of ​​the electronic tag, the offset address is the starting address of the key data storage, and the write data is the write tag key ciphertext; The preset second rule includes: the instruction code in the write instruction is a write personalized data instruction, the area is the user area of ​​the electronic tag, the offset address is the starting address of the personalized data storage, and the write data is write personalized data.

9. The system according to claim 1, characterized in that The release data information includes at least: DLL dependency library, order asset number data, personalized data, and device configuration information; the DLL dependency library includes at least: label release dependency library, label release verification dependency library, and label verification dependency library.

10. The system according to claim 1, characterized in that The preset database communicates with the host computer via a preset WebService interface; The preset WebService interface includes: an order number acquisition interface, a configuration information download interface, a distribution library download interface, an inspection library download interface, a production status update interface, and a label backtracking interface.

11. The system according to claim 1, characterized in that The host computer is also connected to a preset machine device to receive customized parameter information of the RFID electronic tag input by a user, so as to control the preset machine device to customize the RFID electronic tag according to the customized parameter information; wherein the customized parameter information includes at least: the customized length, width, thickness, label color of the label, and the power, frequency, and communication rate of the card reader.

12. The system according to any one of claims 1 or 7, characterized in that: The security authentication is to perform security authentication on the key plaintext written in the RFID electronic tag and the key plaintext decrypted by the security chip in the tag reader; The security authentication method includes: The RFID electronic tag generates a first random number and transmits it to the security chip in the tag reader; The security chip generates a second random number, encrypts the first random number and the second random number to obtain a first ciphertext random number, and transmits the first ciphertext random number to the RFID electronic tag so that the RFID electronic tag decrypts the first ciphertext random number to obtain a first plaintext random number and a second plaintext random number; The RFID electronic tag compares the first plaintext random number with the first random number, and after the comparison result of the first plaintext random number and the first random number is consistent, the RFID electronic tag generates a third random number, encrypts the second plaintext random number and the third random number to obtain a second ciphertext random number, and transmits the second ciphertext random number to the security chip; The security chip decrypts the second ciphertext random number to obtain a second plaintext random number, and compares the second plaintext random number with the second random number, and determines that the security authentication is passed when the comparison is consistent.

13. The system according to any one of claims 1 or 7, characterized in that: The integrity verification method includes: The personalized data is read from the offset address in the RFID electronic tag, and the personalized data transmitted by calling the tag issuing station interface is obtained for comparison to obtain a first comparison result, and after the first comparison result is consistent, it is determined that the verification result of the integrity check passes.

14. The system according to claim 1, characterized in that The cryptographic machine is connected to the host computer via TCP / IP protocol; the host computer is connected to the cryptographic machine and the tag reader / writer respectively; the tag reader / writer is connected to the host computer via a serial port or a USB port.

15. A method for issuing RFID electronic tag data, characterized in that: The RFID electronic tag data issuance method comprises: The cryptographic machine generates a label key ciphertext based on the label issuance key in the cryptographic machine and the key dispersion factor transmitted by the cryptographic machine interface; The host computer obtains the corresponding issuance data information from the preset database based on the label issuance requirement, and transmits the label key ciphertext, the issuance data information and the pre-configured write instruction to the label reader through the serial port transmission; When the write instruction satisfies the preset first rule, the tag reader / writer decrypts the tag key ciphertext based on the pre-configured decryption key to obtain a decryption result, writes the decryption result into the tag key area of ​​the RFID electronic tag, and after the security authentication of the decryption result passes, writes the issuance data information into the user area of ​​the RFID electronic tag based on the preset second rule corresponding to the write instruction, and obtains the target RFID electronic tag after the data is written; After receiving the data writing completion instruction, the host computer calls the label issuing station interface and the label inspection station interface to transmit the written issuing data information and decryption result in the target RFID electronic tag to the label issuing module and the label inspection module for inspection; The label issuance module performs a first integrity check on the issuance data information and decryption result written into the target RFID electronic tag based on the label issuance inspection library; The tag verification module performs a second integrity check on the issuance data information and the decryption result written into the target RFID electronic tag based on the tag verification library, and determines the issuance result based on the first integrity check and the second integrity check.

Images