An electronic passport information reading method, device and electronic passport reading tool

Abstract

This application provides a method, apparatus, and tool for reading electronic passport information, applied in the field of electronic passport technology. The method includes obtaining user information and a first random number; generating a second and third random number; generating an access key based on the user information; processing the first, second, and third random numbers using the access key to obtain an external authentication command; and sending the external authentication command to the electronic passport. It also includes receiving an external authentication response and obtaining a fourth random number from the response; generating a session key based on the third and fourth random numbers; generating a verification counter based on the first and second random numbers; encrypting identification information based on the session key and the verification counter to obtain a target file retrieval command; and sending the target file retrieval command to the electronic passport. Receiving and parsing the target file retrieval response to obtain the target file improves the security and accuracy of the electronic passport information reading process.

Description

Technical Field

[0001] This application relates to the field of electronic passport technology, and in particular to an electronic passport information reading method, device and electronic passport reading tool. Background Technology

[0002] Electronic passports are primary documents proving personal identity and nationality. To improve customs clearance efficiency and enhance security, a machine-readable zone (MRZ) is embedded in the electronic passport. The MRZ is an encoding technology that can be quickly read by specialized equipment. The MRZ typically contains basic information about the electronic passport holder, such as name, electronic passport number, nationality, and date of birth. This technology is widely used in airports, border checkpoints, and other settings requiring rapid processing of large volumes of passenger information. In addition, electronic passports also contain other information about the holder, such as only their facial image, fingerprints, basic information, and issuance details.

[0003] Traditional manual inspection methods are not only time-consuming but also prone to human error, while the use of electronic passports has greatly improved the accuracy and speed of information processing. However, with the increasing frequency of international travel, higher demands are being placed on the accuracy and security of electronic passport information reading technology. Summary of the Invention

[0004] The purpose of this application is to provide a method, device, and tool for reading electronic passport information, in order to improve the security and accuracy of the electronic passport information reading process.

[0005] In a first aspect, embodiments of this application provide a method for reading electronic passport information. The method includes: an electronic passport reading tool obtaining user information and a first random number from an electronic passport, generating a second random number and a third random number, generating an access key based on the user information, processing the first, second, and third random numbers using the access key to obtain an external authentication instruction, and sending the external authentication instruction to the electronic passport. The electronic passport reading tool receives an external authentication response from the electronic passport and obtains a fourth random number from the external authentication response. The electronic passport reading tool generates a session key based on the third and fourth random numbers, generates a verification counter based on the first and second random numbers, encrypts the identification information of a target file to be obtained based on the session key and the verification counter to obtain a target file acquisition instruction, and sends the target file acquisition instruction to the electronic passport. The electronic passport reading tool receives a target file acquisition response from the electronic passport, parses the target file acquisition response, and obtains the target file.

[0006] The electronic passport information reading method provided in this application significantly enhances the security of the electronic passport information reading process by using multiple random numbers, access keys, session keys, and verification counters between the electronic passport and the electronic passport reading tool, effectively preventing replay attacks and man-in-the-middle attacks. Simultaneously, rapid authentication and optimized data transmission improve the efficiency of electronic passport information reading and reduce user waiting time. Furthermore, the verification counter and session key ensure the integrity and confidentiality of data during transmission, complying with international standards and laws and regulations, and enhancing the system's compliance and credibility.

[0007] One possible implementation, involving the steps of generating an access key based on user information and processing a first random number, a second random number, and a third random number using the access key to obtain an external authentication command, includes: generating a first access key and a second access key based on user information; encrypting the first random number, the second random number, and the third random number using the first access key to obtain a first ciphertext; calculating a message digest of the first ciphertext based on the second access key to obtain a first digest value; and generating an external authentication command based on the first ciphertext and the first digest value.

[0008] One possible implementation involves an external authentication response including a second ciphertext and a second digest value. Obtaining a fourth random number from the external authentication response includes: calculating a third digest value by performing a message digest calculation on the second ciphertext based on a second access key; verifying the third digest value using the second digest value; if the verification passes, decrypting the second ciphertext using a first access key to obtain a first random number, a second random number, and a fourth random number; if the decrypted second random number matches the generated second random number, obtaining the fourth random number.

[0009] One possible implementation involves generating a session key based on a third random number and a fourth random number, and generating a verification counter based on a first random number and a second random number. The implementation includes: an electronic passport reader generating a first session key and a second session key based on the generated third random number and the decrypted fourth random number; obtaining a first preset byte of data from the first random number; obtaining a second preset byte of data from the second random number; and generating a verification counter based on the first preset byte of data and the second preset byte of data.

[0010] One possible implementation involves encrypting the identification information of the target file to be acquired using a session key and a checksum counter to obtain an instruction to acquire the target file. This includes: encrypting the identification information of the target file using a first session key to obtain ciphertext of the target file's identification information; calculating a digest of the checksum counter and the ciphertext of the target file's identification information using a second session key to obtain a fourth digest value; and organizing the ciphertext of the target file's identification information and the fourth digest value according to a preset format to obtain the acquisition instruction.

[0011] One possible implementation involves obtaining the target file response, which includes the ciphertext of the target file. Parsing the target file response to obtain the target file includes: updating the value of the checksum counter, and decrypting the ciphertext of the target file using the first session key and the updated checksum counter to obtain the target file.

[0012] One possible implementation involves parsing the target file retrieval response to obtain the target file, including: if the target file in the target file retrieval response is complete, using the data obtained from the parsed response as the target file; or, if the target file in the target file retrieval response is incomplete, continuing to send the target file retrieval instruction to the electronic passport.

[0013] Secondly, embodiments of this application provide a method for reading electronic passport information. The method includes: the electronic passport generating a first random number based on user information and sending the user information and the first random number to an electronic passport reading tool. The electronic passport receives an external authentication command sent by the electronic passport reading tool and obtains a second and a third random number from the external authentication command. The electronic passport generates a fourth random number based on user information, generates an access key based on user information, processes the first, second, and fourth random numbers using the access key to obtain an external authentication response, and sends the external authentication response to the electronic passport reading tool. The electronic passport receives a command to obtain a target file sent by the electronic passport reading tool, generates a check counter based on the first and second random numbers, generates a session key based on the third and fourth random numbers, decrypts the command to obtain the target file's identification information based on the check counter and the session key, and obtains the target file's identification information. The electronic passport encrypts the target file corresponding to the identification information using the session key to obtain a target file retrieval response, and sends the target file retrieval response to the electronic passport reading tool.

[0014] The electronic passport information reading method provided in this application significantly enhances the security of the electronic passport information reading process by using multiple random numbers, access keys, session keys, and verification counters between the electronic passport and the electronic passport reading tool, effectively preventing replay attacks and man-in-the-middle attacks. Simultaneously, rapid authentication and optimized data transmission improve the efficiency of electronic passport information reading and reduce user waiting time. Furthermore, the verification counter and session key ensure the integrity and confidentiality of data during transmission, complying with international standards and laws and regulations, and enhancing the system's compliance and credibility.

[0015] One possible implementation involves an external authentication command that includes a first ciphertext and a first digest value. Obtaining a second and third random number from the external authentication command includes: generating a third and a fourth access key based on user information; calculating a message digest on the first ciphertext using the fourth access key to obtain a fifth digest value; verifying the first digest value using the fifth digest value; if the verification passes, decrypting the first ciphertext using the third access key to obtain the first, second, and third random numbers; and if the decrypted first random number matches the generated first random number, obtaining the second and third random numbers.

[0016] One possible implementation involves generating an access key based on user information, and using this access key to process a first random number, a second random number, and a fourth random number to obtain an external authentication response. This includes: generating a third access key and a fourth access key based on user information; encrypting the first, second, and fourth random numbers using the third access key to obtain a second ciphertext; calculating a message digest of the second ciphertext using the fourth access key to obtain a second digest value; and generating an external authentication response based on the second ciphertext and the second digest value.

[0017] One possible implementation involves generating a check counter based on a first random number and a second random number, and generating a session key based on a third random number and a fourth random number, including: obtaining a first preset byte of data from the first random number, obtaining a second preset byte of data from the second random number, generating a check counter based on the first preset byte of data and the second preset byte of data, and generating a third session key and a fourth session key based on the decrypted third random number and the generated third random number.

[0018] One possible implementation involves obtaining a target file instruction that includes ciphertext of the target file's identification information and a fourth digest value. The instruction is then decrypted using a checksum counter and a session key to obtain the target file's identification information. This process includes calculating a sixth digest value using the fourth session key on the ciphertext and checksum counter. If the sixth digest value is verified against the fourth digest value, and the verification passes, the ciphertext is decrypted using the third session key to obtain the target file's identification information.

[0019] Thirdly, embodiments of this application provide a method for reading electronic passport information. The method includes: the electronic passport generating a first random number based on user information, and sending the user information and the first random number to an electronic passport reading tool. The electronic passport reading tool obtains the user information and the first random number from the electronic passport, generates a second random number and a third random number, generates an access key based on the user information, processes the first, second, and third random numbers using the access key to obtain an external authentication instruction, and sends the external authentication instruction to the electronic passport. The electronic passport receives the external authentication instruction sent by the electronic passport reading tool and obtains the second and third random numbers from the external authentication instruction. The electronic passport generates a fourth random number based on the user information, generates an access key based on the user information, processes the first, second, and fourth random numbers using the access key to obtain an external authentication response, and sends the external authentication response to the electronic passport reading tool. The electronic passport reading tool receives the external authentication response sent by the electronic passport and obtains the fourth random number from the external authentication response. The electronic passport reader generates a session key based on a third and fourth random number, and a verification counter based on a first and second random number. It then encrypts the identification information of the target file using the session key and the verification counter to obtain a target file retrieval command, which is sent to the electronic passport. The electronic passport receives the target file retrieval command from the electronic passport reader, generates a verification counter based on the first and second random numbers, and generates a session key based on the third and fourth random numbers. It then decrypts the target file retrieval command using the verification counter and the session key to obtain the target file's identification information. The electronic passport encrypts the target file corresponding to the identification information using the session key to obtain a target file retrieval response, which is sent to the electronic passport reader. The electronic passport reader receives the target file retrieval response from the electronic passport, parses the response, and retrieves the target file.

[0020] The electronic passport information reading method provided in this application significantly enhances the security of the electronic passport information reading process by using multiple random numbers, access keys, session keys, and verification counters between the electronic passport and the electronic passport reading tool, effectively preventing replay attacks and man-in-the-middle attacks. Simultaneously, rapid authentication and optimized data transmission improve the efficiency of electronic passport information reading and reduce user waiting time. Furthermore, the verification counter and session key ensure the integrity and confidentiality of data during transmission, complying with international standards and laws and regulations, and enhancing the system's compliance and credibility.

[0021] Fourthly, embodiments of this application provide an electronic passport information reading device, which includes: a sending module, a receiving module, and a processing module.

[0022] The sending module is used to obtain user information and a first random number from the electronic passport, generate a second random number and a third random number, generate an access key based on the user information, process the first random number, the second random number and the third random number using the access key to obtain an external authentication instruction, and send the external authentication instruction to the electronic passport.

[0023] The receiving module is used to receive the external authentication response sent by the electronic passport and obtain the fourth random number from the external authentication response.

[0024] The processing module is used by the electronic passport reader to generate a session key based on a third and fourth random number, generate a verification counter based on a first and second random number, encrypt the identification information of the target file to be acquired based on the session key and the verification counter to obtain the target file acquisition instruction, and send the target file acquisition instruction to the electronic passport.

[0025] Fifthly, the embodiment itself provides an electronic passport information reading device, which includes: a sending module and a receiving module.

[0026] The sending module is used to generate a first random number based on user information and send the user information and the first random number to the electronic passport reader.

[0027] The receiving module is used to receive external authentication commands sent by the electronic passport reader and to obtain a second random number and a third random number from the external authentication commands.

[0028] The sending module is also used to generate a fourth random number based on user information, generate an access key based on user information, process the first, second, and fourth random numbers using the access key to obtain an external authentication response, and send the external authentication response to the electronic passport reader.

[0029] The receiving module is also used to receive the target file acquisition instruction sent by the electronic passport reader, generate a verification counter based on the first and second random numbers, generate a session key based on the third and fourth random numbers, and decrypt the target file acquisition instruction based on the verification counter and the session key to obtain the identification information of the target file.

[0030] The sending module is also used to encrypt the target file corresponding to the identification information based on the session key to obtain the target file acquisition response, and send the target file acquisition response to the electronic passport reading tool.

[0031] Sixthly, embodiments of this application provide an electronic passport reader that has the function of implementing the electronic passport information reading method of the first aspect or any possible implementation described above. This function can be implemented by hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above-described function.

[0032] In a seventh aspect, embodiments of this application provide a computer-readable storage medium storing instructions that, when executed on a computer, enable the computer to perform the electronic passport information reading method described in the first aspect or any possible implementation thereof.

[0033] Eighthly, embodiments of this application provide a computer program product containing instructions that, when run on a computer, enable the computer to execute the electronic passport information reading method described in the first aspect or any possible implementation thereof.

[0034] The technical effects of any of the design methods in aspects four through eight can be found in the technical effects of different possible implementation methods in aspect one, aspect two, or aspect three, and will not be repeated here. Attached Figure Description

[0035] To more clearly illustrate the technical solutions in the specific embodiments of this application or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0036] Figure 1 A schematic diagram of the structure of an electronic passport reading tool provided in an embodiment of this application;

[0037] Figure 2 A schematic diagram of an electronic passport information reading system provided in this application embodiment;

[0038] Figure 3 A flowchart illustrating an electronic passport information reading method provided in this application embodiment;

[0039] Figure 4 A schematic diagram of an electronic passport information reading device provided in this application embodiment;

[0040] Figure 5 Another schematic diagram of an electronic passport information reading device provided in this application embodiment;

[0041] Figure 6 This is another structural schematic diagram of an electronic passport information reading system according to an embodiment of this application. Detailed Implementation

[0042] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0043] Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0044] First, the terms used in the embodiments of this application will be explained.

[0045] The Machine Readable Zone (MRZ) code is a machine-readable area on an electronic passport, used by machines to automatically read and identify the passport holder's personal information. The MRZ code encoding rules refer to the layout and encoding method of each field in the electronic passport's MRZ code. Below is a detailed introduction to the electronic passport MRZ code encoding rules.

[0046] The first line contains 30 characters, from the 1st to the 30th position, including information such as passport type, code, and passport number.

[0047] The first two digits are the country code, representing the international code for which the passport was issued.

[0048] The third character is the passport type, usually represented by the character P, indicating a regular passport.

[0049] The 4th to 13th digits are the passport number, a unique identifier consisting of letters and numbers.

[0050] The 14th bit is a check bit, used to verify the correctness of the first 13 bits.

[0051] Positions 15 through 29 are optional blank areas.

[0052] The second line contains 44 characters, from the first to the 44th position, including information such as the passport holder's name, nationality, date of birth, and gender.

[0053] The first position represents the first letter of the surname.

[0054] The 2nd to 6th letters are the following letters of the surname. If the surname has fewer than five letters, fill them with the < symbol.

[0055] The 7th character is the first letter of the name.

[0056] The 8th to 11th letters are the following letters of the name. If the name has fewer than four letters, they are filled with the < symbol.

[0057] The 12th and 13th digits are the nationality code, representing the nationality of the passport holder.

[0058] The 14th to 19th digits represent the date of birth, in the format YYMMDD.

[0059] The 20th digit is the check digit for the birth date.

[0060] The 21st digit is gender, used to indicate the gender of the passport holder. It is usually M for male and F for female.

[0061] Positions 22 to 28 are optional blank areas.

[0062] The 29th to 44th digits are the passport holder's code and check digit.

[0063] In MRZ code, the encoding methods for letters and numbers are also specified. Letters A to Z are represented by numbers 10 to 35 respectively, while numbers 0 to 9 remain unchanged. The calculation method for the check digit also follows certain rules, usually by weighting each character according to a specified weight, and then taking the modulo to obtain the check digit.

[0064] Currently, traditional manual passport checks are not only time-consuming but also prone to human error, while the use of e-passports has greatly improved the accuracy and speed of information processing. However, with the increasing frequency of international travel, higher demands are being placed on the accuracy and security of e-passport information reading technology.

[0065] Based on this, embodiments of this application provide an electronic passport information reading method, the method comprising: generating a first random number based on user information, and sending the user information and the first random number to an electronic passport reading tool.

[0066] The electronic passport reader obtains user information and a first random number from the electronic passport, generates a second random number and a third random number, generates an access key based on the user information, processes the first random number, the second random number and the third random number using the access key to obtain an external authentication instruction, and sends the external authentication instruction to the electronic passport.

[0067] The electronic passport receives an external authentication command sent by the electronic passport reader and obtains a second and a third random number from the external authentication command.

[0068] The electronic passport generates a fourth random number based on user information, generates an access key based on user information, processes the first, second, and fourth random numbers using the access key to obtain an external authentication response, and sends the external authentication response to the electronic passport reader.

[0069] The electronic passport reader receives the external authentication response sent by the electronic passport and obtains the fourth random number from the external authentication response.

[0070] The electronic passport reader generates a session key based on a third and a fourth random number, generates a verification counter based on a first and a second random number, encrypts the identification information of the target file to be acquired based on the session key and the verification counter to obtain the target file acquisition instruction, and sends the target file acquisition instruction to the electronic passport.

[0071] The electronic passport receives the instruction to obtain the target file sent by the electronic passport reading tool, generates a verification counter based on the first and second random numbers, generates a session key based on the third and fourth random numbers, and decrypts the instruction to obtain the target file based on the verification counter and the session key to obtain the identification information of the target file.

[0072] The electronic passport encrypts the target file corresponding to the identification information based on the session key to obtain the target file retrieval response, and sends the target file retrieval response to the electronic passport reading tool.

[0073] The electronic passport reader receives the "retrieve target file" response sent by the electronic passport, parses the "retrieve target file" response, and retrieves the target file.

[0074] The electronic passport information reading method provided in this application significantly enhances the security of the electronic passport information reading process by using random numbers, access keys, session keys, and verification counters between the electronic passport and the electronic passport reading tool, effectively preventing replay attacks and man-in-the-middle attacks. Simultaneously, rapid authentication and optimized data transmission improve the efficiency of electronic passport information reading and reduce user waiting time. Furthermore, the verification counter and session key ensure the integrity and confidentiality of data during transmission, complying with international standards and laws and regulations, and enhancing the system's credibility.

[0075] The solutions provided in the embodiments of this application will be described in detail below with reference to the specific accompanying drawings.

[0076] On the one hand, the solution shown in the embodiments of this application can be executed by an electronic passport reader. For example... Figure 1As shown, the electronic passport reader 100 may include: a reader module 101, a communication module 102, a display module 103, an input module 104, a storage module 105, and a power module 106.

[0077] The reading module 101 is used to read the machine-readable code information and other data information from the electronic passport. For example, the machine-readable code information can be obtained through optical character recognition (OCR) or visual reading.

[0078] The communication module 102 is used for data transmission with a computer or other terminal devices. The communication module 102 can be a wired communication module, such as USB or Ethernet. It can also be a wireless communication module, such as Wi-Fi or Bluetooth.

[0079] Display module 103 is used to display the read information, authentication results, and user interface, etc.

[0080] Input module 104 is used to support the input of user information or password, etc.

[0081] Storage module 105 is used to store temporary data and cache, such as memory or memory card.

[0082] Power module 106 is used to provide power to electronic passport reader 100.

[0083] On the one hand, the solution shown in the embodiments of this application can be executed by an electronic passport information reading system. For example... Figure 2 As shown, the electronic passport information reading system 200 may include: an electronic passport reading tool 100 and an electronic passport 201.

[0084] Among them, the electronic passport reading tool 100 is used to communicate and interact with the electronic passport. During the interaction, the security of the electronic passport information reading process can be ensured by generating random numbers, access keys, session keys and verification counters.

[0085] The electronic passport 201 is used to interact with the electronic passport reader 100. During the interaction, the security of the electronic passport information reading process can be ensured by generating multiple random numbers, access keys, session keys and verification counters.

[0086] On the one hand, embodiments of this application provide a method for reading electronic passport information, which can be implemented by deploying... Figure 1 The electronic passport reader shown Figure 2 The electronic passport reading system shown is in operation. Figure 3 As shown, the method may include the following steps.

[0087] S301, the electronic passport generates a first random number based on user information and sends the user information and the first random number to the electronic passport reading tool.

[0088] For example, user information may include passport number information, date of birth information, and passport validity period information. After obtaining user information including passport number information, date of birth information, and passport validity period information from the machine-readable code information, the electronic passport generates a first random number RND.IC based on the user information, and sends the user information and RND.IC to the electronic passport reader.

[0089] S302, the electronic passport reader obtains user information and a first random number from the electronic passport, generates a second random number and a third random number, generates an access key based on the user information, processes the first random number, the second random number and the third random number using the access key to obtain an external authentication instruction, and sends the external authentication instruction to the electronic passport.

[0090] One possible implementation involves the electronic passport reader obtaining user information, including passport number, date of birth, and passport validity period, and a first random number RND.IC, from the electronic passport via OCR or visual reading. The electronic passport reader then generates a second random number RND.IFD and a third random number KIFD.

[0091] One possible implementation involves the electronic passport reader receiving user information from an electronic passport. Based on this information, the reader generates a first access key and a second access key. The first access key is used to encrypt a first random number, a second random number, and a third random number to obtain first ciphertext. The second access key is then used to calculate a message digest of the first ciphertext, yielding a first digest value. Finally, an external authentication command is generated based on the first ciphertext and the first digest value.

[0092] For example, after receiving user information from an electronic passport, the electronic passport reader uses the SHA1 encryption algorithm to obtain a K-seed based on the first 16 bits of the passport number, date of birth, and passport validity information in the user information. It then encrypts K||00000001 and K||00000002 using SHA1, takes the first 16 bytes, and performs parity checking to obtain a first access key KEnc and a second access key KMAC. KEnc is used to encrypt RND.IC, RND.IFD, and KIFD to obtain the first ciphertext EIFD = E(KENC, (RND.IFD||RND.IC||KIFD)). A message digest is then calculated based on KMAC for EIFD to obtain the first digest value MIFD = MAC(KMAC, EIFD). Finally, based on EIFD and MIFD, an external authentication command external Authenticate(EIFD||MIFD) is generated.

[0093] S303, the electronic passport receives an external authentication command sent by the electronic passport reader and obtains a second random number and a third random number from the external authentication command.

[0094] One possible implementation involves the electronic passport generating a third and fourth access key based on user information after receiving an external authentication command from an electronic passport reader. A message digest is calculated on the first ciphertext using the fourth access key to obtain a fifth digest value. The first digest value is then verified using the fifth digest value. If the verification passes, the first ciphertext is decrypted using the third access key to obtain a first, second, and third random number. If the decrypted first random number matches the generated first random number, the second and third random numbers are then obtained.

[0095] S304, the electronic passport generates a fourth random number based on user information, generates an access key based on user information, processes the first, second, and fourth random numbers using the access key to obtain an external authentication response, and sends the external authentication response to the electronic passport reader.

[0096] For example, the electronic passport generates a fourth random number based on user information.

[0097] One possible implementation involves generating a third and fourth access key based on user information. The third access key is then used to encrypt a first, second, and fourth random number to obtain a second ciphertext. A message digest is then calculated on the second ciphertext using the fourth access key to obtain a second digest value. Finally, an external authentication response is generated based on the second ciphertext and the second digest value.

[0098] For example, a fourth access key KENC and a fourth access key EMAC are generated based on user information. KENC is used to encrypt RND.IC, RDN.IFD, and K.IC to obtain a second ciphertext EIC = E(KENC, RND.IC||RDN.IFD||K.IC). A message digest is calculated on EIC based on EMAC to obtain a second digest value MIC = MAC(EMAC, EIC). Then, an external authentication response external Authenticate(EIC||MIC) is generated based on EIC and MIC and sent to the electronic passport reader.

[0099] S305, the electronic passport reader receives the external authentication response sent by the electronic passport and obtains the fourth random number from the external authentication response.

[0100] One possible implementation involves the electronic passport reader, upon receiving an external authentication response from the electronic passport, calculating a message digest of the second ciphertext based on a second access key to obtain a third digest value. The third digest value is then verified using the second digest value. If the verification passes, the second ciphertext is decrypted using the first access key to obtain a first random number, a second random number, and a fourth random number. If the decrypted second random number matches the generated second random number, the fourth random number is obtained.

[0101] S306, the electronic passport reader generates a session key based on a third random number and a fourth random number, generates a verification counter based on a first random number and a second random number, encrypts the identification information of the target file to be acquired based on the session key and the verification counter to obtain the target file acquisition instruction, and sends the target file acquisition instruction to the electronic passport.

[0102] One possible implementation is that the electronic passport reader generates a first session key and a second session key based on a generated third random number and a decrypted fourth random number, obtains a first preset byte of data from the first random number, obtains a second preset byte of data from the second random number, and generates a verification counter based on the first preset byte of data and the second preset byte of data.

[0103] For example, the electronic passport reader generates a first session key KSEnc and a second session key KSMAC based on KIFD and the decrypted K.IC. The last four bytes of data are obtained from RND.IC and RND.IFD, resulting in a verification counter SSC = (last four bytes of RND.IC || last four bytes of RND.IFD).

[0104] One possible implementation involves the electronic passport reader encrypting the identification information of the target file using a first session key, resulting in ciphertext of the target file's identification information. A second session key is then used to calculate a digest of the verification counter and the ciphertext of the target file's identification information, yielding a fourth digest value. Finally, the ciphertext of the target file's identification information and the fourth digest value are organized according to a preset format to generate the acquisition instruction.

[0105] For example, the electronic passport reader first increments SSC by 1, and then uses KSEnc to encrypt the identification information SFI of the target file to be obtained, resulting in the encrypted identification information TLV of the target file = (tag = 87, value = encrypted identification information SFI of the target file).

[0106] Next, KSMAC is used to calculate the message digest of SSC and TLV, resulting in the fourth digest value MAC = SSC + 0CA4020C80000000 + 87 (TLV format). This fourth digest value MAC is then assembled to obtain TLV = (tag = 8E, value = fourth digest value MAC). Finally, TLV(tag = 87, value = encrypted target file identifier SFI) and TLV(tag = 8E, value = fourth digest value MAC) are organized according to a preset format, resulting in the retrieval instruction (TLV(tag = 87, value = encrypted target file identifier SFI) + TLV(tag = 8E, value = fourth digest value MAC)).

[0107] The electronic passport reader will send the acquisition instruction to the electronic passport.

[0108] S307, the electronic passport receives the instruction to obtain the target file sent by the electronic passport reading tool, generates a verification counter based on the first random number and the second random number, generates a session key based on the third random number and the fourth random number, and decrypts the instruction to obtain the target file based on the verification counter and the session key to obtain the identification information of the target file.

[0109] One possible implementation is that the electronic passport obtains a first preset byte of data from a first random number, obtains a second preset byte of data from a second random number, generates a verification counter based on the first and second preset byte of data, and generates a third session key and a fourth session key based on the decrypted third random number and the generated third random number.

[0110] One possible implementation involves obtaining the target file instruction, which includes ciphertext of the target file's identification information and a fourth digest value. The electronic passport uses a fourth session key to calculate a message digest using the ciphertext and a checksum counter, resulting in a sixth digest value. If the sixth digest value is used to verify the fourth digest value, and the verification passes, the ciphertext is decrypted using a third session key to obtain the target file's identification information.

[0111] S308, the electronic passport encrypts the target file corresponding to the identification information based on the session key to obtain the target file acquisition response, and sends the target file acquisition response to the electronic passport reading tool.

[0112] For example, the electronic passport generates an SSC using a first random number and a second random number, increments the SSC by 1, and assembles a TLV (tag=99, value=response code 9000). The sixth digest value MAC = SSC+99 (TLV format) is calculated using the fourth session key KSMAC. TLV (tag=99, value=response code 9000) and TLV (tag=8E, value=fourth digest value MAC)) are then organized according to a preset format, resulting in the target file response as (TLV(tag=99, value=response code 9000 and TLV(tag=8E, value=fourth digest value MAC)).

[0113] The electronic passport sends the target document response to the electronic passport reader.

[0114] S309, The electronic passport reader receives the "Get Target File" response sent by the electronic passport, parses the "Get Target File" response, and obtains the target file.

[0115] One possible implementation is that the electronic passport reader updates the value of the verification counter, uses the first session key and the updated verification counter to decrypt the target file ciphertext, and obtains the target file.

[0116] Another possible implementation is that if the target file in the response to obtain the target file is complete, the electronic passport reader will parse the data obtained from the response and use it as the target file. Alternatively, if the target file in the response is incomplete, the electronic passport reader will continue to send instructions to the electronic passport to obtain the target file.

[0117] For example, after receiving the response to obtain the target file, the electronic passport reading tool increments the SSC by 1, assembles the TLV (tag=97, value=04), calculates the digest value MAC = (SSC+0CB0000080000000+97 (TLV format)) using the fourth session key KSMAC, organizes the TLV (tag=97, value=04) and TLV (tag=8E, value=fourth digest value MAC) according to the preset format, and sends (TLV(tag=97, value=04) and TLV(tag=8E, value=fourth digest value MAC)) to the electronic passport to read the first four bytes of the file to obtain the file length.

[0118] After receiving (TLV(tag=97, value=04) and TLV(tag=8E, value=4th digest value MAC)), the electronic passport increments SSC by 1, encrypts the first four bytes of the target file using the fourth session key KSMAC, assembles TLV(tag=87, value=01 + the first four bytes of the encrypted target file), and assembles TLV(tag=99, value=response code 9000), calculates the digest value MAC = (SSC + 87 (TLV format) + 99 (TLV format)), assembles TLV(tag=8E, value=MAC) according to the preset format, and sends (87 (TLV format) + 99 (TLV format) + 8E (TLV format)) to the electronic passport reader.

[0119] After receiving (87 (TLV format) + 99 (TLV format) + 8E (TLV format)) and verifying the MAC, the electronic passport reader decrypts 87 (TLV format) to obtain the first four bytes of the target file, thus determining the length of the target file.

[0120] The electronic passport reading tool increments SSC by 1, assembles TLV (tag = 97, value = length of target file to read), calculates the digest value MAC = (SSC + 0CB0 + offset + 80000000 + 97 (TLV format)), assembles TLV (tag = 8E, value = MAC), and sends the first four bytes of the read file (97 (TLV format) + 8E (TLV format)) to the electronic passport.

[0121] After receiving (97 (TLV format) + 8E (TLV format)), the electronic passport increments SSC by 1, encrypts the file using the fourth session key KSMAC, reads the file content of the length set by 97 (TLV format), assembles the TLV (tag = 87, value = 01 + encrypted file content), assembles the TLV (tag = 99, value = response code 9000), calculates the digest value MAC = (SSC + 87 (TLV format) + 99 (TLV format)), assembles the TLV (tag = 8E, value = MAC), and sends (87 (TLV format) + 99 (TLV format) + 8E (TLV format)) to the electronic passport reader according to the preset format.

[0122] The electronic passport reader reads (87 (TLV format) + 99 (TLV format) + 8E (TLV format)) and reads the target file content from the TLV (87 format). If there is remaining length in the file, the offset is increased by the length to be read, and reading continues until all the content in the target file is read.

[0123] Finally, the electronic passport reader concatenates all the file contents read each time in the order they were read to obtain the target file.

[0124] The above primarily describes the solutions provided in this application from the perspective of the device's working principle. It is understood that, to achieve the aforementioned functions, the electronic passport reader includes corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, based on the algorithmic steps of the examples described in conjunction with the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0125] This application embodiment can divide the electronic passport reader into functional modules according to the above method example. For example, each function can be divided into a separate functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module.

[0126] It should be noted that the module division in this embodiment is illustrative and represents only one logical functional division; in actual implementation, other division methods may be used. When dividing functional modules according to their respective functions, Figure 4A schematic diagram illustrating a possible configuration of the electronic passport information reading device described above and in the embodiments is shown. Figure 4 As shown, the electronic passport information reading device 400 may include: a sending module 401, a receiving module 402, and a processing module 403.

[0127] The sending module 401 is used to support the electronic passport information reading device 400 in performing its functions. Figure 3 S302 in the illustrated method for reading electronic passport information.

[0128] Receiver module 402 is used to support the electronic passport information reader 400 in performing its functions. Figure 3 S305 in the illustrated method for reading electronic passport information.

[0129] Processing module 403 is used to support the execution of electronic passport information reading device 400. Figure 3 S306 in the illustrated method for reading electronic passport information.

[0130] In one possible implementation, the device can also be used to generate a first access key and a second access key based on user information. A first ciphertext is obtained by encrypting a first random number, a second random number, and a third random number using the first access key. A message digest is calculated on the first ciphertext based on the second access key to obtain a first digest value. An external authentication command is then generated based on the first ciphertext and the first digest value.

[0131] In one possible implementation, the device can also be used to calculate a message digest of the second ciphertext based on the second access key to obtain a third digest value. The third digest value is then verified using the second digest value. If the verification passes, the second ciphertext is decrypted using the first access key to obtain a first random number, a second random number, and a fourth random number. If the decrypted second random number matches the generated second random number, the fourth random number is obtained.

[0132] In one possible implementation, the device can also be used to generate a first session key and a second session key based on a generated third random number and a decrypted fourth random number, obtain a first preset byte of data from the first random number, obtain a second preset byte of data from the second random number, and generate a verification counter based on the first preset byte of data and the second preset byte of data.

[0133] In one possible implementation, the device can also be used to encrypt the identification information of the target file to be acquired using a first session key, obtaining ciphertext of the target file's identification information. A digest calculation is then performed using a second session key on the check counter and the ciphertext of the target file's identification information to obtain a fourth digest value. Finally, the ciphertext of the target file's identification information and the fourth digest value are organized according to a preset format to obtain an acquisition instruction.

[0134] In one possible implementation, the device can also be used to update the value of the verification counter, and then use the first session key and the updated verification counter to decrypt the target file ciphertext to obtain the target file.

[0135] In one possible implementation, the device can also be used to, if the target file in the target file retrieval response is complete, use the data obtained from the target file retrieval response as the target file; or, if the target file in the target file retrieval response is incomplete, continue sending the target file retrieval instruction to the electronic passport.

[0136] Figure 5 A schematic diagram illustrating another possible configuration of the electronic passport information reading device involved in the above and embodiment examples is shown. For example... Figure 5 As shown, the electronic passport information reading device 500 may include: a receiving module 501 and a sending module 502.

[0137] The receiving module 501 is used to support the electronic passport information reading device 500 in performing its functions. Figure 3 S301 or S304 in the illustrated electronic passport information reading method.

[0138] The sending module 502 is used to support the electronic passport information reading device 500 in performing its functions. Figure 3 S303 or S307 in the illustrated electronic passport information reading method.

[0139] In one possible implementation, the device can also be used to generate a third access key and a fourth access key based on user information. A message digest is calculated on the first ciphertext using the fourth access key to obtain a fifth digest value. The first digest value is then verified using the fifth digest value. If the verification passes, the first ciphertext is decrypted using the third access key to obtain a first random number, a second random number, and a third random number. If the decrypted first random number matches the generated first random number, the second and third random numbers are obtained.

[0140] In one possible implementation, the device can also be used to generate a third access key and a fourth access key based on user information. The third access key is used to encrypt a first random number, a second random number, and a fourth random number to obtain a second ciphertext. A message digest is calculated on the second ciphertext based on the fourth access key to obtain a second digest value. An external authentication response is then generated based on the second ciphertext and the second digest value.

[0141] In one possible implementation, the device can also be used to obtain a first preset byte of data from a first random number, obtain a second preset byte of data from a second random number, generate a verification counter based on the first preset byte of data and the second preset byte of data, and generate a third session key and a fourth session key based on the decrypted third random number and the generated third random number.

[0142] In one possible implementation, the device can also be used to calculate a message digest using a fourth session key on the ciphertext of the identification information and a check counter to obtain a sixth digest value. If the sixth digest value is used to verify the fourth digest value, and the verification passes, the ciphertext of the identification information is decrypted using a third session key to obtain the identification information of the target file.

[0143] It should be noted that all relevant content of each step involved in the above method embodiments can be referenced from the functional description of the corresponding functional module, and will not be repeated here.

[0144] The electronic passport information reading device 400 and electronic passport information reading device 500 provided in this application embodiment are used to perform the above-mentioned... Figure 3 The method for reading electronic passport information shown can achieve the same effect as the method described above.

[0145] This application also provides an electronic passport reading tool, which can be the type described in the foregoing embodiments. Figure 1 The electronic passport reader 100 shown can perform the electronic passport information reading method and related steps in the above method embodiments.

[0146] This application also provides a computer-readable storage medium storing instructions thereon, which, when executed, perform the electronic passport information reading method and related steps in the above method embodiments.

[0147] This application also provides a computer program product that, when run on a computer, causes the computer to execute the electronic passport information reading method and related steps described in the above method embodiments.

[0148] In some embodiments, the methods shown in this application can be implemented as computer program instructions encoded in a machine-readable format on a computer-readable storage medium or on other non-transitory media or articles of art.

[0149] This application also provides an electronic passport information reading system 600, such as... Figure 6 As shown, the electronic passport information reading system 600 includes at least one processor 601 and at least one interface circuit 602.

[0150] As an example, when the electronic passport information reading system 600 includes a processor and an interface circuit, the processor can be... Figure 6 The processor 601 shown in the solid box (or the processor 601 shown in the dashed box) can be an interface circuit. Figure 6 The interface circuit 602 is shown in the solid box (or the dashed box). When the chip system 600 includes two processors and two interface circuits, the two processors include... Figure 6 The processor 601 shown in the solid box and the processor 601 shown in the dashed box, these two interface circuits include Figure 6 Interface circuit 602 is shown in both solid and dashed boxes. No limitations are imposed on this.

[0151] Processor 601 and interface circuit 602 can be interconnected via a line. For example, interface circuit 602 can be used to receive signals. Alternatively, interface circuit 602 can be used to send signals to other devices (e.g., processor 601). For instance, interface circuit 602 can read computer instructions stored in memory and send those instructions to processor 601. Processor 601 executes the instructions and, in conjunction with input / output devices, implements the various steps in the above embodiments, such as implementing... Figure 3 The illustrated method embodiments represent the various steps performed. Of course, this chip system may also include other discrete components, and this application embodiment does not specifically limit this.

[0152] Through the above description of the embodiments, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0153] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0154] The units described as separate components may or may not be physically separate. A component shown as a unit can be one or more physical units; that is, it can be located in one place or distributed in multiple different locations. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0155] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0156] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, in essence, or the part that contributes, or all or part of the technical solution, can be embodied in the form of a software product. This software product is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0157] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for reading electronic passport information, characterized in that, The method includes: The electronic passport reader obtains user information and a first random number from the electronic passport, generates a second random number and a third random number, generates an access key based on the user information, processes the first random number, the second random number and the third random number using the access key to obtain an external authentication command, and sends the external authentication command to the electronic passport. The electronic passport receives an external authentication command sent by the electronic passport reader and obtains a second and a third random number from the external authentication command. The electronic passport generates a fourth random number based on user information and generates an access key based on user information. It then uses the access key to process the first, second, and fourth random numbers to obtain an external authentication response and sends the external authentication response to the electronic passport reader. The electronic passport reader receives the external authentication response sent by the electronic passport and obtains a fourth random number from the external authentication response; The electronic passport reading tool generates a session key based on the third random number and the fourth random number, generates a verification counter based on the first random number and the second random number, encrypts the identification information of the target file to be acquired based on the session key and the verification counter to obtain the target file acquisition instruction, and sends the target file acquisition instruction to the electronic passport. The electronic passport receives the target file acquisition instruction sent by the electronic passport reading tool, generates a verification counter based on the first and second random numbers, generates a session key based on the third and fourth random numbers, and decrypts the target file acquisition instruction based on the verification counter and the session key to obtain the identification information of the target file; the electronic passport encrypts the target file corresponding to the identification information based on the session key to obtain the target file acquisition response, and sends the target file acquisition response to the electronic passport reading tool. The electronic passport reader receives the "Get Target File" response sent by the electronic passport and parses the "Get Target File" response to obtain the target file.

2. The method according to claim 1, characterized in that, The step of generating an access key based on user information and using the access key to process the first random number, the second random number, and the third random number to obtain an external authentication instruction includes: Generate a first access key and a second access key based on user information; The first ciphertext is obtained by encrypting the first random number, the second random number, and the third random number using the first access key. Based on the second access key, a message digest is calculated on the first ciphertext to obtain a first digest value. An external authentication instruction is then generated based on the first ciphertext and the first digest value.

3. The method according to claim 1, characterized in that, The external authentication response includes a second ciphertext and a second digest value; Obtaining the fourth random number from the external authentication response includes: Based on the second access key, a message digest is calculated on the second ciphertext to obtain a third digest value; The third digest value is verified using the second digest value. After the verification is successful, the second ciphertext is decrypted using the first access key to obtain the first random number, the second random number, and the fourth random number. If the second random number obtained by decryption is the same as the second random number generated, then obtain the fourth random number.

4. The method according to claim 1, characterized in that, The process of generating a session key based on the third and fourth random numbers, and generating a verification counter based on the first and second random numbers, includes: The electronic passport reader generates a first session key and a second session key based on a third random number and a fourth random number obtained from decryption. It obtains a first preset byte of data from the first random number and a second preset byte of data from the second random number. It then generates a verification counter based on the first preset byte of data and the second preset byte of data.

5. The method according to claim 1, characterized in that, The step of encrypting the identification information of the target file to be obtained based on the session key and the verification counter to obtain the target file acquisition instruction includes: The identification information of the target file to be obtained is encrypted using the first session key to obtain the ciphertext of the identification information of the target file; A fourth digest value is obtained by using the second session key to perform a digest calculation on the ciphertext of the verification counter and the identification information of the target file; The target file identification information ciphertext and the fourth digest value are organized according to a preset format to obtain the target file acquisition instruction.

6. The method according to claim 1, characterized in that, The response to obtain the target file includes the encrypted target file; parsing the response to obtain the target file to obtain the target file includes: The value of the verification counter is updated, and the target file ciphertext is decrypted using the first session key and the updated verification counter to obtain the target file.

7. The method according to claim 1, characterized in that, The process of parsing the response to obtain the target file to obtain the target file includes: If the target file in the response to obtain the target file is complete, the data obtained by parsing the response to obtain the target file will be used as the target file. Alternatively, if the target file in the response to obtain the target file is incomplete, continue to send the instruction to obtain the target file to the electronic passport.

8. An electronic passport information reading device, characterized in that, The device includes: The sending module is used to obtain user information and a first random number from the electronic passport, generate a second random number and a third random number, generate an access key based on the user information, process the first random number, the second random number and the third random number using the access key to obtain an external authentication instruction, and send the external authentication instruction to the electronic passport. The receiving module is used to receive external authentication instructions sent by the electronic passport reader, obtain a second random number and a third random number from the external authentication instructions; the electronic passport generates a fourth random number based on user information, generates an access key based on user information, processes the first random number, the second random number and the fourth random number using the access key to obtain an external authentication response, and sends the external authentication response to the electronic passport reader; and receives the external authentication response sent by the electronic passport and obtains the fourth random number from the external authentication response. The processing module is configured to generate a session key based on the third random number and the fourth random number, generate a verification counter based on the first random number and the second random number, encrypt the identification information of the target file to be acquired based on the session key and the verification counter to obtain an instruction to acquire the target file, and send the instruction to acquire the target file to the electronic passport. The receiving module is further configured to receive a target file acquisition instruction sent by the electronic passport reader, generate a verification counter based on a first random number and a second random number, generate a session key based on a third random number and a fourth random number, decrypt the target file acquisition instruction based on the verification counter and the session key to obtain the identification information of the target file; the electronic passport encrypts the target file corresponding to the identification information based on the session key to obtain a target file acquisition response, and sends the target file acquisition response to the electronic passport reader; receive the target file acquisition response sent by the electronic passport, parse the target file acquisition response to obtain the target file.

9. An electronic passport reader, characterized in that, The electronic passport reading tool includes a processor and a memory, the memory storing machine-executable instructions that can be executed by the processor, and the processor executing the machine-executable instructions to implement the electronic passport information reading method according to any one of claims 1-7.

10. A machine-readable storage medium, characterized in that, The machine-readable storage medium stores machine-executable instructions, which, when invoked and executed by a processor, cause the processor to implement the electronic passport information reading method according to any one of claims 1-7.

Images