Electronic passport information reading method and device and electronic passport reading tool

Abstract

The invention provides an electronic passport information reading method and device and an electronic passport reading tool, which are applied to the technical field of electronic passports, and the method comprises the following steps: obtaining user information and a first random number, generating a second random number and a third random number, generating an access key based on the user information, and reading the access key. And processing the first random number, the second random number and the third random number by using the access key to obtain an external authentication instruction, and sending the external authentication instruction to the electronic passport. And receiving an external authentication response, and obtaining a fourth random number from the external authentication response. And generating a session key based on the third random number and the fourth random number, generating a check counter based on the first random number and the second random number, encrypting the identification information based on the session key and the check counter to obtain a target file acquisition instruction, and sending the target file acquisition instruction to the electronic passport. And receiving and analyzing the response to obtain the target file to obtain the target file. The security and accuracy in the electronic passport information reading process can be improved.

Description

Technical Field

[0001] The present application relates to the technical field of electronic passports, and in particular to an electronic passport information reading method, device and electronic passport reading tool. Background Art

[0002] An e-passport is the main document that proves a person's identity and nationality. In order to improve customs clearance efficiency and enhance security, a machine-readable zone (MRZ) is embedded in the e-passport. The MRZ is a coding technology that can be quickly read by special equipment. The MRZ usually contains the basic information of the e-passport holder, such as name, e-passport number, nationality and date of birth. This technology is widely used in airports, border checkpoints and other places where a large amount of passenger information needs to be processed quickly. At the same time, the e-passport will also contain other information of the e-passport holder, such as only the face of the person, fingerprints, basic information and issuance information.

[0003] Traditional manual inspection is not only time-consuming but also prone to human error, while the use of electronic passports has greatly improved the accuracy and speed of information processing. However, with the increasing frequency of international travel, higher requirements are placed on the accuracy and security of electronic passport information reading technology. Summary of the invention

[0004] The purpose of this application is to provide an electronic passport information reading method, device and electronic passport reading tool, so as to improve the security and accuracy of the electronic passport information reading process.

[0005] In a first aspect, an embodiment of the present application provides an electronic passport information reading method, the method comprising: an electronic passport reading tool obtains user information and a first random number from an electronic passport, generates a second random number and a third random number, generates an access key based on the user information, uses the access key to process the first random number, the second random number and the third random number to obtain an external authentication instruction, and sends the external authentication instruction to the electronic passport. The electronic passport reading tool receives an external authentication response sent by the electronic passport, and obtains a fourth random number from the external authentication response. The electronic passport reading tool generates a session key based on the third random number and the fourth random number, generates a check counter based on the first random number and the second random number, encrypts the identification information of the target file to be obtained based on the session key and the check counter to obtain an instruction to obtain the target file, and sends the instruction to obtain the target file to the electronic passport. The electronic passport reading tool receives the response to obtain the target file sent by the electronic passport, and parses the response to obtain the target file to obtain the target file.

[0006] The electronic passport information reading method provided in the embodiment of the present application significantly enhances the security of the electronic passport information reading process by using multiple random numbers, access keys, session keys and verification counters between the electronic passport and the electronic passport reading tool, and effectively prevents replay attacks and man-in-the-middle attacks. At the same time, fast authentication and optimized data transmission improve the efficiency of electronic passport information reading and reduce the user's waiting time. In addition, by verifying the counter and session key, the integrity and confidentiality of the data during the transmission process are ensured, which complies with international standards and laws and regulations, and improves the compliance and credibility of the system.

[0007] In a possible implementation, the steps of generating an access key based on user information and using the access key to process a first random number, a second random number, and a third random number to obtain an external authentication instruction include: generating a first access key and a second access key based on the user information. Encrypting the first random number, the second random number, and the third random number using the first access key to obtain a first ciphertext. Performing message digest calculation on the first ciphertext based on the second access key to obtain a first digest value, and generating an external authentication instruction based on the first ciphertext and the first digest value.

[0008] In a possible implementation, the external authentication response includes the second ciphertext and the second digest value. Obtaining the fourth random number from the external authentication response includes: performing message digest calculation on the second ciphertext based on the second access key to obtain the third digest value. Verifying the third digest value using the second digest value, and after the verification passes, decrypting the second ciphertext using the first access key to obtain the first random number, the second random number, and the fourth random number. If the decrypted second random number is consistent with the generated second random number, the fourth random number is obtained.

[0009] A possible implementation method generates a session key based on a third random number and a fourth random number, and generates a verification counter based on a first random number and a second random number, including: an electronic passport reading tool generates a first session key and a second session key based on the generated third random number and a fourth random number obtained by decryption, obtains a first preset byte data from the first random number, obtains a second preset byte data from the second random number, and generates a verification counter based on the first preset byte data and the second preset byte data.

[0010] In a possible implementation, the identification information of the target file to be obtained is encrypted based on the session key and the verification counter to obtain the instruction for obtaining the target file, including: using the first session key to encrypt the identification information of the target file to be obtained to obtain the ciphertext of the identification information of the target file. Using the second session key to perform a digest calculation on the verification counter and the ciphertext of the identification information of the target file to obtain a fourth digest value. Organizing the ciphertext of the identification information of the target file and the fourth digest value according to a preset format to obtain the acquisition instruction.

[0011] In a possible implementation, the target file acquisition response includes the target file ciphertext. Parsing the target file acquisition response to acquire the target file includes: updating the value of the verification counter, decrypting the target file ciphertext using the first session key and the updated verification counter, and acquiring the target file.

[0012] A possible implementation manner is to parse the target file acquisition response to acquire the target file, including: if the target file in the target file acquisition response is complete, using the data acquired by parsing the target file acquisition response as the target file. Or, if the target file in the target file acquisition response is incomplete, continuing to send the target file acquisition instruction to the electronic passport.

[0013] In a second aspect, an embodiment of the present application provides an electronic passport information reading method, the method comprising: the electronic passport generates a first random number based on user information, and sends the user information and the first random number to the electronic passport reading tool. The electronic passport receives an external authentication instruction sent by the electronic passport reading tool, and obtains a second random number and a third random number from the external authentication instruction. The electronic passport generates a fourth random number based on the user information, generates an access key based on the user information, uses the access key to process the first random number, the second random number and the fourth random number to obtain an external authentication response, and sends the external authentication response to the electronic passport reading tool. The electronic passport receives an instruction to obtain a target file sent by the electronic passport reading tool, generates a check counter based on the first random number and the second random number, generates a session key based on the third random number and the fourth random number, decrypts the instruction to obtain the target file based on the check counter and the session key, and obtains identification information of the target file. The electronic passport encrypts the target file corresponding to the identification information based on the session key to obtain an obtain target file response, and sends the obtain target file response to the electronic passport reading tool.

[0014] The electronic passport information reading method provided in the embodiment of the present application significantly enhances the security of the electronic passport information reading process by using multiple random numbers, access keys, session keys and verification counters between the electronic passport and the electronic passport reading tool, and effectively prevents replay attacks and man-in-the-middle attacks. At the same time, fast authentication and optimized data transmission improve the efficiency of electronic passport information reading and reduce the user's waiting time. In addition, by verifying the counter and session key, the integrity and confidentiality of the data during the transmission process are ensured, which complies with international standards and laws and regulations, and improves the compliance and credibility of the system.

[0015] In a possible implementation, the external authentication instruction includes a first ciphertext and a first digest value. Obtaining a second random number and a third random number from the external authentication instruction includes: generating a third access key and a fourth access key based on user information. Performing message digest calculation on the first ciphertext based on the fourth access key to obtain a fifth digest value. Using the fifth digest value to verify the first digest value, after the verification passes, decrypting the first ciphertext using the third access key to obtain the first random number, the second random number, and the third random number. If the first random number obtained by decryption is consistent with the generated first random number, obtaining the second random number and the third random number.

[0016] In a possible implementation, an access key is generated based on user information, and the access key is used to process the first random number, the second random number, and the fourth random number to obtain an external authentication response, including: generating a third access key and a fourth access key based on the user information. The first random number, the second random number, and the fourth random number are encrypted using the third access key to obtain a second ciphertext. A message digest is calculated on the second ciphertext based on the fourth access key to obtain a second digest value, and an external authentication response is generated based on the second ciphertext and the second digest value.

[0017] A possible implementation method is to generate a check counter based on a first random number and a second random number, and to generate a session key based on a third random number and a fourth random number, including: obtaining first preset byte data from the first random number, obtaining second preset byte data from the second random number, generating a check counter based on the first preset byte data and the second preset byte data, and generating a third session key and a fourth session key based on the decrypted third random number and the generated third random number.

[0018] In a possible implementation, the instruction to obtain the target file includes the identification information ciphertext of the target file and the fourth digest value. The instruction to obtain the target file is decrypted based on the verification counter and the session key to obtain the identification information of the target file, including: using the fourth session key to perform message digest calculation on the identification information ciphertext and the verification counter to obtain a sixth digest value. If the sixth digest value verifies the fourth digest value and the verification passes, the identification information ciphertext is decrypted using the third session key to obtain the identification information of the target file.

[0019] In a third aspect, an embodiment of the present application provides an electronic passport information reading method, the method comprising: the electronic passport generates a first random number based on user information, and sends the user information and the first random number to an electronic passport reading tool. The electronic passport reading tool obtains the user information and the first random number from the electronic passport, generates a second random number and a third random number, generates an access key based on the user information, uses the access key to process the first random number, the second random number and the third random number to obtain an external authentication instruction, and sends the external authentication instruction to the electronic passport. The electronic passport receives the external authentication instruction sent by the electronic passport reading tool, and obtains the second random number and the third random number from the external authentication instruction. The electronic passport generates a fourth random number based on the user information, generates an access key based on the user information, uses the access key to process the first random number, the second random number and the fourth random number to obtain an external authentication response, and sends the external authentication response to the electronic passport reading tool. The electronic passport reading tool receives the external authentication response sent by the electronic passport, and obtains the fourth random number from the external authentication response. The electronic passport reading tool generates a session key based on the third random number and the fourth random number, generates a check counter based on the first random number and the second random number, encrypts the identification information of the target file to be obtained based on the session key and the check counter to obtain an instruction to obtain the target file, and sends the instruction to obtain the target file to the electronic passport. The electronic passport receives the instruction to obtain the target file sent by the electronic passport reading tool, generates a check counter based on the first random number and the second random number, generates a session key based on the third random number and the fourth random number, decrypts the instruction to obtain the target file based on the check counter and the session key to obtain the identification information of the target file. The electronic passport encrypts the target file corresponding to the identification information based on the session key to obtain an obtain target file response, and sends the obtain target file response to the electronic passport reading tool. The electronic passport reading tool receives the obtain target file response sent by the electronic passport, and parses the obtain target file response to obtain the target file.

[0020] The electronic passport information reading method provided in the embodiment of the present application significantly enhances the security of the electronic passport information reading process by using multiple random numbers, access keys, session keys and verification counters between the electronic passport and the electronic passport reading tool, and effectively prevents replay attacks and man-in-the-middle attacks. At the same time, fast authentication and optimized data transmission improve the efficiency of electronic passport information reading and reduce the user's waiting time. In addition, by verifying the counter and session key, the integrity and confidentiality of the data during the transmission process are ensured, which complies with international standards and laws and regulations, and improves the compliance and credibility of the system.

[0021] In a fourth aspect, an embodiment of the present application provides an electronic passport information reading device, which includes: a sending module, a receiving module, and a processing module.

[0022] Among them, the sending module is used to obtain user information and a first random number from the electronic passport, generate a second random number and a third random number, generate an access key based on the user information, use the access key to process the first random number, the second random number and the third random number to obtain an external authentication instruction, and send the external authentication instruction to the electronic passport.

[0023] The receiving module is used to receive an external authentication response sent by the electronic passport, and obtain a fourth random number from the external authentication response.

[0024] The processing module is used for the electronic passport reading tool to generate a session key based on the third random number and the fourth random number, generate a verification counter based on the first random number and the second random number, encrypt the identification information of the target file to be obtained based on the session key and the verification counter to obtain an instruction for obtaining the target file, and send the instruction for obtaining the target file to the electronic passport.

[0025] In a fifth aspect, an embodiment of the present invention provides an electronic passport information reading device, which includes: a sending module and a receiving module.

[0026] The sending module is used to generate a first random number based on user information, and send the user information and the first random number to an electronic passport reading tool.

[0027] The receiving module is used to receive an external authentication instruction sent by an electronic passport reading tool, and obtain a second random number and a third random number from the external authentication instruction.

[0028] The sending module is also used to generate a fourth random number based on the user information, generate an access key based on the user information, use the access key to process the first random number, the second random number and the fourth random number to obtain an external authentication response, and send the external authentication response to the electronic passport reading tool.

[0029] The receiving module is also used to receive an instruction for obtaining a target file sent by an electronic passport reading tool, generate a verification counter based on the first random number and the second random number, generate a session key based on the third random number and the fourth random number, and decrypt the instruction for obtaining the target file based on the verification counter and the session key to obtain identification information of the target file.

[0030] The sending module is also used to encrypt the target file corresponding to the identification information based on the session key to obtain a target file acquisition response, and send the target file acquisition response to the electronic passport reading tool.

[0031] In a sixth aspect, an embodiment of the present application provides an electronic passport reading tool, which has the function of implementing the electronic passport information reading method of the first aspect or any possible implementation method. The function can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions.

[0032] In a seventh aspect, an embodiment of the present application provides a computer-readable storage medium, which stores instructions. When the computer-readable storage medium is run on a computer, the computer can execute the electronic passport information reading method of the above-mentioned first aspect or any possible implementation method.

[0033] In an eighth aspect, an embodiment of the present application provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the electronic passport information reading method of the first aspect or any possible implementation method.

[0034] Among them, the technical effects brought about by any design method in the fourth to eighth aspects can refer to the technical effects brought about by different possible implementation methods in the first aspect or different possible implementation methods in the second aspect or different possible implementation methods in the third aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the specific implementation methods of the present application or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0036] Figure 1 A schematic diagram of the structure of an electronic passport reading tool provided in an embodiment of the present application;

[0037] Figure 2 A schematic diagram of the structure of an electronic passport information reading system provided in an embodiment of the present application;

[0038] Figure 3 A flowchart of a method for reading electronic passport information provided in an embodiment of the present application;

[0039] Figure 4 A schematic diagram of the structure of an electronic passport information reading device provided in an embodiment of the present application;

[0040] Figure 5 Another structural schematic diagram of an electronic passport information reading device provided in an embodiment of the present application;

[0041] Figure 6 This is another structural schematic diagram of an electronic passport information reading system according to an embodiment of the present application. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various different configurations.

[0043] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for which protection is sought, but merely represents selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0044] First, the terms provided in the embodiments of the present application are explained.

[0045] The passport machine readable zone (MRZ code) is a machine readable area on an electronic passport, which is used for automatic machine reading and identification of the passport holder's personal information. The MRZ code encoding rules refer to the layout and encoding method of each field in the electronic passport MRZ code. The following is a detailed introduction to the electronic passport MRZ code encoding rules.

[0046] The first line has 30 characters from the 1st to the 30th, including information such as passport model, code and passport number.

[0047] Among them, the first and second digits are the country code, which represents the international code for passport issuance.

[0048] The third digit is the passport model, usually the letter P for an ordinary passport.

[0049] The 4th to 13th digits are your passport number, which is a unique number consisting of letters and numbers.

[0050] The 14th digit is the check digit, which is used to verify the correctness of the first 13 digits.

[0051] Positions 15 to 29 are optional and left blank.

[0052] The second line contains 44 characters from the 1st to the 44th, including information such as the passport holder's name, nationality, date of birth and gender.

[0053] The first digit represents the first letter of the last name.

[0054] Positions 2 to 6 are the subsequent letters of the last name, and if the last name has fewer than five letters, they are padded with a < symbol.

[0055] The 7th character is the first letter of the name.

[0056] Positions 8 to 11 are the subsequent letters of the name, and if the name has fewer than four letters, they are filled with a < symbol.

[0057] The 12th and 13th digits are the nationality code, which represents the nationality of the passport holder.

[0058] The 14th to 19th digits are the date of birth in the format of YYMMDD.

[0059] The 20th digit is the check digit of the date of birth.

[0060] The 21st digit is gender, which is used to indicate the gender of the passport holder, usually M for male and F for female.

[0061] Positions 22 to 28 are optional and left blank.

[0062] Digits 29 to 44 are the passport holder's code and check digit.

[0063] In the MRZ code, the encoding method of letters and numbers is also specified. Letters A to Z are represented by numbers 10 to 35 respectively, and numbers 0 to 9 remain unchanged. The calculation method of the check digit also has certain rules. Usually, each character is weighted and summed according to the specified weight, and then the modulus is taken to obtain the check digit.

[0064] At present, the traditional manual passport inspection method is not only time-consuming but also prone to human errors, while the use of electronic passports has greatly improved the accuracy and speed of information processing. However, with the increasing frequency of international travel, higher requirements are placed on the accuracy and security of electronic passport information reading technology.

[0065] Based on this, an embodiment of the present application provides an electronic passport information reading method, the method comprising: the electronic passport generates a first random number based on user information, and sends the user information and the first random number to an electronic passport reading tool.

[0066] The electronic passport reading tool obtains user information and a first random number from the electronic passport, generates a second random number and a third random number, generates an access key based on the user information, uses the access key to process the first random number, the second random number and the third random number to obtain an external authentication instruction, and sends the external authentication instruction to the electronic passport.

[0067] The electronic passport receives the external authentication instruction sent by the electronic passport reading tool, and obtains the second random number and the third random number from the external authentication instruction.

[0068] The electronic passport generates a fourth random number based on the user information, generates an access key based on the user information, uses the access key to process the first random number, the second random number and the fourth random number to obtain an external authentication response, and sends the external authentication response to the electronic passport reading tool.

[0069] The electronic passport reading tool receives the external authentication response sent by the electronic passport, and obtains a fourth random number from the external authentication response.

[0070] The electronic passport reading tool generates a session key based on the third random number and the fourth random number, generates a verification counter based on the first random number and the second random number, encrypts the identification information of the target file to be obtained based on the session key and the verification counter to obtain an instruction for obtaining the target file, and sends the instruction for obtaining the target file to the electronic passport.

[0071] The electronic passport receives an instruction for obtaining a target file sent by an electronic passport reading tool, generates a verification counter based on a first random number and a second random number, generates a session key based on a third random number and a fourth random number, decrypts the instruction for obtaining a target file based on the verification counter and the session key, and obtains identification information of the target file.

[0072] The electronic passport encrypts the target file corresponding to the identification information based on the session key to obtain a target file acquisition response, and sends the target file acquisition response to the electronic passport reading tool.

[0073] The electronic passport reading tool receives a target file acquisition response sent by the electronic passport, and parses the target file acquisition response to acquire the target file.

[0074] The electronic passport information reading method provided in the embodiment of the present application significantly enhances the security of the electronic passport information reading process by using random numbers, access keys, session keys and verification counters between the electronic passport and the electronic passport reading tool, and effectively prevents replay attacks and man-in-the-middle attacks. At the same time, fast authentication and optimized data transmission improve the efficiency of electronic passport information reading and reduce the user's waiting time. In addition, by verifying the counter and session key, the integrity and confidentiality of the data during the transmission process are ensured, which complies with international standards and laws and regulations and improves the credibility of the system.

[0075] The solution provided by the embodiment of the present application will be described in detail below with reference to specific drawings.

[0076] On the one hand, the solution shown in the embodiment of the present application can be executed by an electronic passport reading tool. Figure 1As shown, the electronic passport reading tool 100 may include: a reading module 101 , a communication module 102 , a display module 103 , an input module 104 , a storage module 105 and a power module 106 .

[0077] The reading module 101 is used to read the machine-readable code information and other data information in the electronic passport, for example, the machine-readable code information can be obtained by optical character recognition (OCR) or visual reading.

[0078] The communication module 102 is used for data transmission with a computer or other terminal device. The communication module 102 can be a wired communication module, such as USB or Ethernet, etc. The communication module 102 can also be a wireless communication module, such as Wi-Fi, Bluetooth, etc.

[0079] The display module 103 is used to display the read information, authentication results, user interface, etc.

[0080] The input module 104 is used to support input of user information or password, etc.

[0081] The storage module 105 is used to store temporary data and cache, and may be, for example, a memory or a storage card.

[0082] The power module 106 is used to provide power to the electronic passport reading tool 100 .

[0083] On the one hand, the solution shown in the embodiment of the present application can be executed by an electronic passport information reading system. Figure 2 As shown, the electronic passport information reading system 200 may include: an electronic passport reading tool 100 and an electronic passport 201 .

[0084] The electronic passport reading tool 100 is used to communicate and interact with the electronic passport. During the interaction, random numbers, access keys, session keys and verification counters are generated to ensure the security of the electronic passport information reading process.

[0085] The electronic passport 201 is used to interact with the electronic passport reading tool 100. During the interaction, multiple random numbers, access keys, session keys and verification counters are generated to ensure the security of the electronic passport information reading process.

[0086] On the one hand, the embodiment of the present application provides a method for reading electronic passport information, which can be deployed Figure 1 The electronic passport reading tool shown Figure 2 The electronic passport reading system shown is executed. Figure 3 As shown, the method may include the following steps.

[0087] S301, the electronic passport generates a first random number based on user information, and sends the user information and the first random number to an electronic passport reading tool.

[0088] Exemplarily, the user information may include passport number information, date of birth information, passport validity period information, etc. After the electronic passport obtains the user information including passport number information, date of birth information, and passport validity period information from the machine-readable code information, it generates a first random number RND.IC based on the user information, and sends the user information and RND.IC to the electronic passport reading tool.

[0089] S302, the electronic passport reading tool obtains user information and a first random number from the electronic passport, generates a second random number and a third random number, generates an access key based on the user information, uses the access key to process the first random number, the second random number and the third random number to obtain an external authentication instruction, and sends the external authentication instruction to the electronic passport.

[0090] In a possible implementation, the electronic passport reading tool obtains user information including passport number information, date of birth information and passport validity information and the first random number RND.IC from the electronic passport by OCR or visual reading, and generates the second random number RND.IFD and the third random number KIFD.

[0091] In a possible implementation, after receiving the user information sent by the electronic passport, the electronic passport reading tool generates a first access key and a second access key based on the user information. The first random number, the second random number and the third random number are encrypted using the first access key to obtain a first ciphertext. A message digest is calculated on the first ciphertext based on the second access key to obtain a first digest value, and an external authentication instruction is generated based on the first ciphertext and the first digest value.

[0092] Exemplarily, after receiving the user information sent by the electronic passport, the electronic passport reading tool uses the encryption algorithm SHA1 to obtain the K seed based on the first 16 bits of the passport number information, date of birth information and passport validity period information in the user information, encrypts K||00000001 and K||00000002 by SHA1 respectively, takes the first 16 bytes, and obtains the first access key KEnc and the second access key KMAC after parity check, and uses KEnc to encrypt RND.IC, RND.IFD and KIFD to obtain the first ciphertext EIFD=E(KENC, (RND.IFD||RND.IC||KIFD)). Then, based on KMAC, the message digest of EIFD is calculated to obtain the first digest value MIFD=MAC(KMAC, EIFD). Finally, based on EIFD and MIFD, an external authentication instruction external Authenticate(EIFD||MIFD) is generated.

[0093] S303, the electronic passport receives the external authentication instruction sent by the electronic passport reading tool, and obtains the second random number and the third random number from the external authentication instruction.

[0094] In a possible implementation, after receiving the external authentication instruction sent by the electronic passport reading tool, the electronic passport generates a third access key and a fourth access key based on the user information. The message digest of the first ciphertext is calculated based on the fourth access key to obtain a fifth digest value. The first digest value is verified using the fifth digest value. After the verification passes, the first ciphertext is decrypted using the third access key to obtain a first random number, a second random number, and a third random number. If the first random number obtained by decryption is consistent with the generated first random number, the second random number and the third random number are obtained.

[0095] S304, the electronic passport generates a fourth random number based on the user information, generates an access key based on the user information, uses the access key to process the first random number, the second random number and the fourth random number to obtain an external authentication response, and sends the external authentication response to the electronic passport reading tool.

[0096] Exemplarily, the electronic passport generates a fourth random number based on the user information.

[0097] In a possible implementation, a third access key and a fourth access key are generated based on user information. The first random number, the second random number, and the fourth random number are encrypted using the third access key to obtain a second ciphertext. A message digest is calculated on the second ciphertext based on the fourth access key to obtain a second digest value, and an external authentication response is generated based on the second ciphertext and the second digest value.

[0098] Exemplarily, a fourth access key KENC and a fourth access key EMAC are generated based on user information. RND.IC, RDN.IFD and K.IC are encrypted using KENC to obtain a second ciphertext EIC=E(KENC, RND.IC||RDN.IFD||K.IC). A message digest calculation is performed on EIC based on EMAC to obtain a second digest value MIC=MAC(EMAC, EIC). Further, an external authentication response external Authenticate(EIC||MIC) is generated based on EIC and MIC, and external Authenticate(EIC||MIC) is sent to the electronic passport reading tool.

[0099] S305: The electronic passport reading tool receives the external authentication response sent by the electronic passport, and obtains a fourth random number from the external authentication response.

[0100] In a possible implementation, after receiving the external authentication response sent by the electronic passport, the electronic passport reading tool performs message digest calculation on the second ciphertext based on the second access key to obtain a third digest value. The third digest value is verified using the second digest value. After the verification passes, the second ciphertext is decrypted using the first access key to obtain the first random number, the second random number, and the fourth random number. If the decrypted second random number is consistent with the generated second random number, the fourth random number is obtained.

[0101] S306, the electronic passport reading tool generates a session key based on the third random number and the fourth random number, generates a verification counter based on the first random number and the second random number, encrypts the identification information of the target file to be obtained based on the session key and the verification counter to obtain an instruction for obtaining the target file, and sends the instruction for obtaining the target file to the electronic passport.

[0102] In a possible implementation, the electronic passport reading tool generates a first session key and a second session key based on the generated third random number and the fourth random number obtained by decryption, obtains a first preset byte data from the first random number, obtains a second preset byte data from the second random number, and generates a verification counter based on the first preset byte data and the second preset byte data.

[0103] Exemplarily, the electronic passport reading tool generates the first session key KSEnc and the second session key KSMAC based on KIFD and the decrypted K.IC. The last four bytes of data are obtained from RND.IC, and the last four bytes of data are obtained from RND.IFD to obtain the verification counter SSC=(last four bytes of RND.IC||last four bytes of RND.IFD).

[0104] In a possible implementation, the electronic passport reading tool encrypts the identification information of the target file to be obtained using the first session key to obtain the ciphertext of the identification information of the target file. The second session key is used to perform a digest calculation on the verification counter and the ciphertext of the identification information of the target file to obtain a fourth digest value. The ciphertext of the identification information of the target file and the fourth digest value are organized according to a preset format to obtain an acquisition instruction.

[0105] Exemplarily, the electronic passport reading tool first adds 1 to SSC, and then uses KSEnc to encrypt the identification information SFI of the target file to be obtained, and obtains the identification information ciphertext TLV=(tag=87, value=encrypted identification information SFI of the target file).

[0106] Then use KSMAC to calculate the message digest of SSC and TLV, and obtain the fourth digest value MAC=SSC+0CA4020C80000000+87 (TLV format), assemble the fourth digest value MAC, and obtain TLV=(tag=8E, value=fourth digest value MAC). Finally, organize TLV(tag=87, value=identification information SFI of the encrypted target file) and TLV(tag=8E, value=fourth digest value MAC) according to the preset format, and obtain the acquisition instruction (TLV(tag=87, value=identification information SFI of the encrypted target file)+TLV(tag=8E, value=fourth digest value MAC)).

[0107] The electronic passport reading tool sends an acquisition instruction to the electronic passport.

[0108] S307, the electronic passport receives the instruction to obtain the target file sent by the electronic passport reading tool, generates a verification counter based on the first random number and the second random number, generates a session key based on the third random number and the fourth random number, and decrypts the instruction to obtain the target file based on the verification counter and the session key to obtain identification information of the target file.

[0109] In one possible implementation, the electronic passport obtains first preset byte data from the first random number, obtains second preset byte data from the second random number, generates a verification counter based on the first preset byte data and the second preset byte data, and generates a third session key and a fourth session key based on the decrypted third random number and the generated third random number.

[0110] In a possible implementation, the instruction to obtain the target file includes the identification information ciphertext of the target file and the fourth digest value. The electronic passport uses the fourth session key to perform message digest calculation on the identification information ciphertext and the verification counter to obtain a sixth digest value. If the sixth digest value verifies the fourth digest value and the verification passes, the identification information ciphertext is decrypted using the third session key to obtain the identification information of the target file.

[0111] S308, the electronic passport encrypts the target file corresponding to the identification information based on the session key to obtain a target file acquisition response, and sends the target file acquisition response to the electronic passport reading tool.

[0112] Exemplarily, the electronic passport generates SSC using the first random number and the second random number, and adds 1 to the SSC to assemble TLV (tag=99, value=response code 9000). The sixth digest value MAC=SSC+99 (TLV format) is calculated using the fourth session key KSMAC, and TLV (tag=99, value=response code 9000) and TLV (tag=8E, value=fourth digest value MAC) are organized according to the preset format, and the target file response is (TLV (tag=99, value=response code 9000) and TLV (tag=8E, value=fourth digest value MAC)).

[0113] The e-passport sends the target document response to the e-passport reading tool.

[0114] S309, the electronic passport reading tool receives a target file acquisition response sent by the electronic passport, and parses the target file acquisition response to acquire the target file.

[0115] In a possible implementation, the electronic passport reading tool updates the value of the verification counter, and uses the first session key and the updated verification counter to decrypt the target file ciphertext to obtain the target file.

[0116] Another possible implementation is that if the target file in the Get Target File Response is complete, the electronic passport reading tool will parse the data obtained in the Get Target File Response as the target file. Alternatively, if the target file in the Get Target File Response is incomplete, the electronic passport reading tool continues to send the Get Target File instruction to the electronic passport.

[0117] Exemplarily, after receiving the response for obtaining the target file, the electronic passport reading tool adds 1 to the SSC, assembles TLV (tag = 97, value = 04), uses the fourth session key KSMAC to calculate the summary value MAC = (SSC + 0CB0000080000000 + 97 (TLV format)), organizes TLV (tag = 97, value = 04) and TLV (tag = 8E, value = fourth summary value MAC) according to the preset format, and sends (TLV (tag = 97, value = 04) and TLV (tag = 8E, value = fourth summary value MAC)) to the electronic passport to read the first four bytes of the file to obtain the file length.

[0118] After receiving (TLV (tag = 97, value = 04) and TLV (tag = 8E, value = fourth summary value MAC)), the electronic passport adds 1 to the SSC, uses the fourth session key KSMAC to encrypt the first four bytes of the target file, assembles TLV (tag = 87, value = 01 + the first four bytes of the encrypted target file), and assembles TLV (tag = 99, value = response code 9000), calculates the summary value MAC = (SSC + 87 (TLV format) + 99 (TLV format)), assembles TLV (tag = 8E, value = MAC) according to the preset format, and sends (87 (TLV format) + 99 (TLV format) + 8E (TLV format)) to the electronic passport reading tool.

[0119] After receiving (87 (TLV format) + 99 (TLV format) + 8E (TLV format)), the electronic passport reading tool decrypts 87 (TLV format) after verifying the MAC, and obtains the first four bytes of the target file to obtain the length of the target file.

[0120] The electronic passport reading tool adds 1 to the SSC, assembles TLV (tag=97, value=read length of the target file), calculates the digest value MAC=(SSC+0CB0+offset+80000000+97(TLV format)), assembles TLV (tag=8E, value=MAC), and sends the first four bytes of the read file (97(TLV format)+8E(TLV format)) to the electronic passport.

[0121] After receiving (97 (TLV format) + 8E (TLV format)), the electronic passport adds 1 to the SSC, uses the fourth session key KSMAC to encrypt the file starting from the offset, reads the file content of the reading length set by 97 (TLV format), assembles TLV (tag = 87, value = 01 + encrypted file content), assembles TLV (tag = 99, value = response code 9000), calculates the summary value MAC = (SSC + 87 (TLV format) + 99 (TLV format)), assembles TLV (tag = 8E value = MAC), assembles and sends (87 (TLV format) + 99 (TLV format) + 8E (TLV format)) to the electronic passport reading tool according to the preset format.

[0122] The electronic passport reading tool reads (87 (TLV format) + 99 (TLV format) + 8E (TLV format)) and reads the target file content from TLV (87 format). If the file has a remaining length that has not been read, the offset will continue to increase by the length that needs to be read this time, and continue reading until all the contents in the target file are read.

[0123] Finally, the electronic passport reading tool connects all the file contents read each time in the reading order to obtain the target file.

[0124] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the working principle of the device. It can be understood that in order to realize the above functions, the electronic passport reading tool includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the algorithm steps of each example described in the embodiments disclosed in this article, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0125] The embodiment of the present application can divide the electronic passport reading tool into functional modules according to the above method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or software functional modules.

[0126] It should be noted that the division of modules in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. Figure 4FIG. 2 shows a possible schematic diagram of the composition of the electronic passport information reading device involved in the above-mentioned embodiment. Figure 4 As shown, the electronic passport information reading device 400 may include: a sending module 401 , a receiving module 402 , and a processing module 403 .

[0127] The sending module 401 is used to support the electronic passport information reading device 400 to execute Figure 3 S302 in the illustrated electronic passport information reading method.

[0128] Receiving module 402, used to support electronic passport information reading device 400 to execute Figure 3 S305 in the illustrated electronic passport information reading method.

[0129] Processing module 403, used to support the electronic passport information reading device 400 to execute Figure 3 S306 in the illustrated electronic passport information reading method.

[0130] In a possible implementation, the device may also be used to generate a first access key and a second access key based on user information. The first random number, the second random number, and the third random number are encrypted using the first access key to obtain a first ciphertext. A message digest is calculated on the first ciphertext based on the second access key to obtain a first digest value, and an external authentication instruction is generated based on the first ciphertext and the first digest value.

[0131] In a possible implementation, the device can also be used to calculate a message digest of the second ciphertext based on the second access key to obtain a third digest value. The third digest value is verified using the second digest value. After the verification passes, the second ciphertext is decrypted using the first access key to obtain a first random number, a second random number, and a fourth random number. If the decrypted second random number is consistent with the generated second random number, the fourth random number is obtained.

[0132] In a possible implementation, the device can also be used to generate a first session key and a second session key based on the generated third random number and the fourth random number obtained by decryption, obtain first preset byte data from the first random number, obtain second preset byte data from the second random number, and generate a check counter based on the first preset byte data and the second preset byte data.

[0133] In a possible implementation, the device can also be used to encrypt the identification information of the target file to be obtained using the first session key to obtain the identification information ciphertext of the target file. The second session key is used to perform a digest calculation on the verification counter and the identification information ciphertext of the target file to obtain a fourth digest value. The identification information ciphertext of the target file and the fourth digest value are organized according to a preset format to obtain an acquisition instruction.

[0134] In a possible implementation, the device can also be used to update the value of the verification counter, and use the first session key and the updated verification counter to decrypt the target file ciphertext to obtain the target file.

[0135] In a possible implementation, the device can also be used to, if the target file in the get target file response is complete, use the data obtained by parsing the get target file response as the target file. Or, if the target file in the get target file response is incomplete, continue to send a get target file instruction to the electronic passport.

[0136] Figure 5 FIG. 2 shows another possible composition diagram of the electronic passport information reading device involved in the above-mentioned embodiment. Figure 5 As shown, the electronic passport information reading device 500 may include: a receiving module 501 and a sending module 502 .

[0137] The receiving module 501 is used to support the electronic passport information reading device 500 to execute Figure 3 S301 or S304 in the illustrated electronic passport information reading method.

[0138] The sending module 502 is used to support the electronic passport information reading device 500 to execute Figure 3 S303 or S307 in the illustrated electronic passport information reading method.

[0139] In a possible implementation, the device can also be used to generate a third access key and a fourth access key based on user information. A message digest is calculated on the first ciphertext based on the fourth access key to obtain a fifth digest value. The first digest value is verified using the fifth digest value. After the verification passes, the first ciphertext is decrypted using the third access key to obtain a first random number, a second random number, and a third random number. If the first random number obtained by decryption is consistent with the generated first random number, the second random number and the third random number are obtained.

[0140] In a possible implementation, the device may also be used to generate a third access key and a fourth access key based on user information. The first random number, the second random number, and the fourth random number are encrypted using the third access key to obtain a second ciphertext. A message digest is calculated on the second ciphertext based on the fourth access key to obtain a second digest value, and an external authentication response is generated based on the second ciphertext and the second digest value.

[0141] In a possible implementation, the device can also be used to obtain first preset byte data from a first random number, obtain second preset byte data from a second random number, generate a check counter based on the first preset byte data and the second preset byte data, and generate a third session key and a fourth session key based on a third random number obtained by decryption and the generated third random number.

[0142] In a possible implementation, the device can also be used to use the fourth session key to perform message digest calculation on the identification information ciphertext and the verification counter to obtain a sixth digest value. If the sixth digest value verifies the fourth digest value and the verification passes, the identification information ciphertext is decrypted using the third session key to obtain the identification information of the target file.

[0143] It should be noted that all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module and will not be repeated here.

[0144] The electronic passport information reading device 400 and the electronic passport information reading device 500 provided in the embodiment of the present application are used to perform the above Figure 3 The electronic passport information reading method shown can therefore achieve the same effect as the above-mentioned electronic passport information reading method.

[0145] The present application also provides an electronic passport reading tool, which can be the electronic passport reading tool described in the above embodiment. Figure 1 The electronic passport reading tool 100 shown can execute the electronic passport information reading method and related steps in the above method embodiment.

[0146] The embodiment of the present application also provides a computer-readable storage medium on which instructions are stored. When the instructions are executed, the electronic passport information reading method and related steps in the above method embodiment are executed.

[0147] The embodiment of the present application also provides a computer program product. When the computer program product is run on a computer, the computer executes the electronic passport information reading method and related steps in the above method embodiment.

[0148] In some embodiments, the methods described herein may be implemented as computer program instructions encoded in a machine-readable format on a computer-readable storage medium or encoded on other non-transitory media or articles of manufacture.

[0149] The present application also provides an electronic passport information reading system 600. Figure 6 As shown, the electronic passport information reading system 600 includes at least one processor 601 and at least one interface circuit 602 .

[0150] As an example, when the electronic passport information reading system 600 includes a processor and an interface circuit, the processor may be Figure 6 The processor 601 shown in the solid line frame (or the processor 601 shown in the dotted line frame) may be Figure 6 The interface circuit 602 shown in the solid line frame (or the interface circuit 602 shown in the dotted line frame) is shown in the solid line frame. When the chip system 600 includes two processors and two interface circuits, the two processors include Figure 6 The processor 601 shown in the solid line frame and the processor 601 shown in the dotted line frame, the two interface circuits include Figure 6 The interface circuit 602 shown in the solid line frame and the interface circuit 602 shown in the dotted line frame are not limited to this.

[0151] The processor 601 and the interface circuit 602 can be interconnected via a line. For example, the interface circuit 602 can be used to receive a signal. For another example, the interface circuit 602 can be used to send a signal to another device (such as the processor 601). For example, the interface circuit 602 can read a computer instruction stored in a memory and send the computer instruction to the processor 601. The processor 601 executes the instruction and implements the various steps in the above embodiments in combination with the input and output devices, such as implementing Figure 3 The various steps performed in the method embodiment shown. Of course, the chip system may also include other discrete devices, which are not specifically limited in the embodiment of the present application.

[0152] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0153] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0154] The units described as separate components may or may not be physically separated, and the components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place or distributed in multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0155] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0156] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0157] The above contents are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application shall be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

1. A method for reading electronic passport information, characterized in that: The method comprises: The electronic passport reading tool obtains user information and a first random number from the electronic passport, generates a second random number and a third random number, generates an access key based on the user information, uses the access key to process the first random number, the second random number and the third random number to obtain an external authentication instruction, and sends the external authentication instruction to the electronic passport; The electronic passport reading tool receives an external authentication response sent by the electronic passport, and obtains a fourth random number from the external authentication response; The electronic passport reading tool generates a session key based on the third random number and the fourth random number, generates a verification counter based on the first random number and the second random number, encrypts the identification information of the target file to be obtained based on the session key and the verification counter to obtain an instruction for obtaining the target file, and sends the instruction for obtaining the target file to the electronic passport; The electronic passport reading tool receives a target file acquisition response sent by the electronic passport, and parses the target file acquisition response to acquire the target file.

2. The method according to claim 1, characterized in that: The step of generating an access key based on user information and using the access key to process the first random number, the second random number and the third random number to obtain an external authentication instruction includes: generating a first access key and a second access key based on the user information; A first ciphertext obtained by encrypting the first random number, the second random number, and the third random number using the first access key; A message digest calculation is performed on the first ciphertext based on the second access key to obtain a first digest value, and an external authentication instruction is generated based on the first ciphertext and the first digest value.

3. The method according to claim 1, characterized in that The external authentication response includes a second ciphertext and a second digest value; The obtaining a fourth random number from the external authentication response comprises: Performing message digest calculation on the second ciphertext based on the second access key to obtain a third digest value; Using the second digest value to verify the third digest value, after the verification passes, using the first access key to decrypt the second ciphertext to obtain a first random number, a second random number, and a fourth random number; If the second random number obtained by decryption is consistent with the generated second random number, the fourth random number is obtained.

4. The method according to claim 1, characterized in that: The step of generating a session key based on the third random number and the fourth random number, and generating a check counter based on the first random number and the second random number comprises: The electronic passport reading tool generates a first session key and a second session key based on the generated third random number and the fourth random number obtained by decryption, obtains a first preset byte data from the first random number, obtains a second preset byte data from the second random number, and generates a verification counter based on the first preset byte data and the second preset byte data.

5. The method according to claim 1, characterized in that The step of encrypting the identification information of the target file to be acquired based on the session key and the verification counter to obtain the instruction for acquiring the target file includes: Encrypting the identification information of the target file to be obtained by using the first session key to obtain the ciphertext of the identification information of the target file; Using the second session key, performing digest calculation on the verification counter and the ciphertext of the identification information of the target file to obtain a fourth digest value; The identification information ciphertext of the target file and the fourth digest value are organized according to a preset format to obtain the instruction for obtaining the target file.

6. The method according to claim 1, characterized in that The target file acquisition response includes a target file ciphertext; and the parsing of the target file acquisition response to acquire the target file includes: The value of the check counter is updated, and the target file ciphertext is decrypted using the first session key and the updated check counter to obtain the target file.

7. The method according to claim 1, characterized in that The step of parsing the target file acquisition response to acquire the target file includes: If the target file in the target file acquisition response is complete, using the data acquired by parsing the target file acquisition response as the target file; Or, if the target file in the obtain target file response is incomplete, continue to send an obtain target file instruction to the electronic passport.

8. An electronic passport information reading device, characterized in that: The device comprises: A sending module, used to send a first authentication instruction to the electronic passport by using the user information and the first random number obtained from the electronic passport, and the second random number and the third random number generated by the electronic passport reading tool; the first random number is generated by the electronic passport and sent to the electronic passport reading tool; a receiving module, configured to receive a second authentication instruction sent by the electronic passport, wherein the second authentication instruction is generated by the electronic passport using the user information and a fourth random number, and the fourth random number is generated by the electronic passport; a processing module, configured to encrypt the file information of the target file to be acquired through the second authentication instruction and the first verification counter, and obtain an acquisition instruction of the target file to be sent to the electronic passport; the first verification counter is generated by the electronic passport reading tool through the first random number and the second random number; The receiving module is further configured to receive a target file returned by the electronic passport in response to the acquisition instruction after sending the acquisition instruction to the electronic passport.

9. An electronic passport reading tool, characterized in that: The electronic passport reading tool comprises a processor and a memory, wherein the memory stores machine executable instructions that can be executed by the processor, and the processor executes the machine executable instructions to implement the electronic passport information reading method according to any one of claims 1 to 7.

10. A machine-readable storage medium, characterized in that: The machine-readable storage medium stores machine-executable instructions. When the machine-executable instructions are called and executed by the processor, the machine-executable instructions prompt the processor to implement the electronic passport information reading method according to any one of claims 1 to 7.

Images