Dynamic encryption algorithm of NFC chip

Abstract

In the practical application of the NFC technology, the security problem is always a key factor restricting the wide application of the NFC technology, the traditional NFC communication is low in security, and the data is easy to copy or tamper. Therefore, the invention provides a dynamic encryption algorithm of an NFC chip, a counter is designed in an NFC nonvolatile sector to ensure the randomness and authenticity of a dynamic ciphertext, and meanwhile, a key 1 and a key Ckey 2 are written into the chip and are stored in a confidential verification end, so that the security of the chip is ensured. A chip UID, a key1, a Ckey2 and a counter number obtained when a chip is sensed and a random number generated by a random number algorithm are used as input parameters, a group of dynamic ciphertexts are generated through an encryption algorithm and are compared with a verification end for verification, each verification is executed only by depending on the dynamic ciphertexts, the dynamic ciphertexts are immediately invalid after verification, meanwhile, a flexible key generation mode is provided, and the verification efficiency is improved. And it is ensured that the UID can be reversely deduced through the ciphertext, and the dual requirements for data safety and traceability are met.

Description

Technical Field

[0001] The present invention relates to the technical field of near field communication (NFC), and in particular to an NFC chip dynamic encryption algorithm based on a unique identifier (UID), a key 1 (key1) and a key 2 (Ckey2), which is suitable for various commodity anti-counterfeiting traceability and NFC application scenarios with high requirements on data security and traceability. Background Art

[0002] In the practical application of NFC technology, security issues have always been a key factor restricting its widespread application. Traditional NFC communication has low security, and data can be easily copied or tampered with. For example, in the anti-counterfeiting and traceability field, once the verification data is copied or cracked, the attacker can perform illegal operations and make the data look real by copying the UID and other means; at the same time, when security issues arise, it is impossible to quickly and accurately locate the data sender through the ciphertext. Therefore, it is urgent to develop a dynamic encryption algorithm that can ensure data transmission security and achieve data source tracing. Summary of the invention

[0003] The present invention aims to provide a dynamic encryption algorithm for an NFC chip. An auto-increment counter with an initial value of 00 and a bit number of 2 is designed in the NFC chip. When the NFC chip is powered on, the auto-increment counter can be called to generate an incrementing counter number counter. The incrementing counter number counter means that each time the chip is powered on, the value of the counter number counter will increase by one value, and the counter number after the increase by one value is stored in a non-volatile sector to ensure the randomness and authenticity of the dynamic ciphertext. The chip power-on means that after the NFC chip is sensed by a wireless radio frequency device (the NFC chip is passive and has no power supply itself), the NFC chip can obtain energy through a wireless radio frequency field to start working.

[0004] Furthermore, the key key1 and the key Ckey2 are written into the chip (the key has a read-write protection effect and cannot be read and written again), and the key1 and Ckey2 are saved to a confidential verification end.

[0005] Furthermore, a random number generation algorithm is built into the chip, and a random number rand can be generated for each operation to ensure the randomness of the dynamic ciphertext.

[0006] Furthermore, the dynamic ciphertext generation algorithm: using the UID, key1, Ckey2 and 2-bit counter counter obtained when sensing the chip and the 4-bit random number rand generated by the random number algorithm as input parameters, concatenate rand, counter and Ckey2 to obtain dyna_str1; concatenate UID and dyna_str1 through a special concatenation algorithm (for example, cross-connecting the strings by bit in sequence) to obtain a 34-bit string linked_str1; then encrypt linked_str1 and key1 (for example, AES advanced symmetric encryption) to generate a 34-bit encrypted string dynamic_ciphertext, i.e., dynamic ciphertext.

[0007] Furthermore, when the NFC chip is powered on for reading, the chip's UID, key1, Ckey2, rand and counter are encrypted and used to generate a set of dynamic ciphertext dynamic_ciphertext as the reading result and output to the verification end. At the same time, the verification end uses the corresponding key1 and Ckey2 that have been saved to verify the dynamic ciphertext dynamic_ciphertext. At the same time, each verification is performed only relying on the dynamic ciphertext and the ciphertext becomes invalid immediately after verification. At the same time, it is ensured that the original value of the UID can be restored through the dynamic ciphertext, meeting the dual requirements of data security and traceability.

[0008] Furthermore, encryption algorithm: AES symmetric encryption algorithm and initialization vector (IV) are used to ensure data security.

[0009] Furthermore, the algorithm core parameter setting: Each NFC chip is initialized with a unique UID, which consists of hexadecimal characters. The written hexadecimal string key1 is used as the encryption key (cannot be modified or read again), and the written hexadecimal string Ckey2 is used as the verification fingerprint data (also cannot be modified or read again). Both key1 and Ckey2 consist of hexadecimal characters.

[0010] Furthermore, the verification mechanism is as follows: after receiving the ciphertext, the receiving end first checks whether the ciphertext is 34 bits. If the number of bits is 34 bits, the next step of verification is performed. If the number of bits for verification is not 34 bits, the verification fails.

[0011] Furthermore, Ckey2 is compared and verified with Ckey2 stored confidentially on the verification end. If the two are consistent, the verification is successful. Regardless of whether the verification result is successful or not, the group of dynamic ciphertexts is immediately marked as invalid after the verification is completed and stored in a special invalid ciphertext recording area to prevent the ciphertext from being replayed.

[0012] Furthermore, the keys key1 and Ckey2 support two modes: random generation and custom generation.

[0013] Furthermore, the key is randomly generated: using a cryptographically secure pseudo-random number generator (CSPRNG), randomly select characters from hexadecimal characters to generate key1 and Ckey2 respectively. For example, the SecureRandom class can be used in Java to implement it.

[0014] Furthermore, custom key generation is performed: users or system administrators manually edit key1 and Ckey2 composed of hexadecimal characters according to specific security policies and requirements to meet the needs of special security scenarios.

[0015] Furthermore, the algorithm for deducing the original value of dynamic ciphertext is as follows: first, the ciphertext dynamic_ciphertext is reversely decrypted with the help of key1 to restore linked_str1; then, UID and dyna_str1 are deduced according to the cross-splicing rule.

[0016] Furthermore, Ckey2, random number, and counter number are reversely parsed through dyna_str1.

[0017] Beneficial effects: High security: Dynamic ciphertext is generated through complex combination operations. The ciphertext for each communication is unique and becomes invalid after verification, effectively resisting cracking and replay attacks and ensuring data transmission security.

[0018] Flexible key generation: supports customized and random generation of key1 and Ckey2 to meet the security requirements of different users and scenarios and enhance the applicability of the algorithm.

[0019] Traceability: The original value can be inferred through dynamic ciphertext. When security issues occur, the data source can be quickly obtained, which is convenient for security management and responsibility tracing. This is mainly reflected in the fact that when the NFC chip is out of the sensing range, the original value of the UID can be inferred through the known ciphertext. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 : Schematic diagram of dynamic ciphertext generation and verification logic.

[0021] Figure 2 : Schematic diagram of the invalidation of dynamic ciphertext after verification.

[0022] Figure 3 : Schematic diagram of custom key generation method.

[0023] Figure 4 :Schematic diagram of random key generation method.

[0024] Figure 5 : Logic diagram of the principle of reverse deducing UID from dynamic ciphertext. DETAILED DESCRIPTION

[0025] like Figure 1 As shown, an auto-increment counter with an initial value of 00 and a digit of 2 is designed in the NFC chip. When the NFC chip is powered on, the auto-increment counter can be called to generate an increment counter. The increment counter means that each time the chip is powered on, the value of the counter will increase by one value, and the counter after the increase is stored in the non-volatile sector to ensure the randomness and authenticity of the dynamic ciphertext. The key key1 and the key Ckey2 are written into the chip (the key has a read-write protection effect and cannot be read and written again), and the key1 and Ckey2 are saved to the confidential verification end. The UID, key1, Ckey2 and the 2-digit counter counter obtained when the chip is sensed and the 4-digit random number rand generated by the random number algorithm are used as input parameters, and rand, counter and Ckey2 are spliced ​​to obtain dyna_str1; the UID and dyna_str1 is concatenated with a special concatenation algorithm (for example, selecting strings bit by bit for cross-connection) to obtain a 34-bit string linked_str1; linked_str1 and key1 are then encrypted (for example, AES advanced symmetric encryption) to generate a 34-bit encrypted string dynamic_ciphertext, i.e., dynamic ciphertext. When the NFC chip is powered on and read, the chip's UID, key1, Ckey2, rand and counter are encrypted with the algorithm to generate a set of dynamic ciphertext dynamic_ciphertext as the reading result and output to the verification end. At the same time, the verification end uses the corresponding key1 and Ckey2 that have been saved to verify the dynamic ciphertext dynamic_ciphertext. At the same time, each verification is performed only relying on the dynamic ciphertext, and after the verification, whether the verification is passed or not, the dynamic ciphertext is immediately invalid.

[0026] like Figure 2 As shown in the figure, the principle of dynamic ciphertext verification failure is: the NFC chip is powered on, and the dynamic ciphertext dynamic_ciphertext-N is calculated, where "N" represents the number of times the chip is powered on and the number of ciphertext changes. The dynamic ciphertext dynamic_ciphertext-N is then transmitted to the verification end. Regardless of whether the verification end passes or fails the verification, this set of dynamic ciphertext dynamic_ciphertext-N will be marked as invalid. The chip will be sensed again for the next verification, and the aforementioned logic will be repeated.

[0027] like Figure 3 ,4 As shown in the figure, keys key1 and Ckey2 support two modes of random generation and custom generation. The first mode is random key generation: using a cryptographically secure pseudo-random number generator (CSPRNG), randomly select characters from hexadecimal characters to generate key1 and Ckey2 respectively. The second mode is custom key generation: users or system administrators manually edit key1 and Ckey2 composed of hexadecimal characters according to specific security policies and requirements to meet the needs of special security scenarios.

[0028] like Figure 5 As shown in the figure, the principle of reversing the original value of dynamic ciphertext is to first use key1 to reversely decrypt the ciphertext dynamic_ciphertext to restore linked_str1; then, according to the cross-splicing rule, UID and dyna_str1 are reversed, and then dyna_str1 is reversely parsed to obtain Ckey2, random number, and counter number, so as to obtain the original value data.

[0029] The above example code of a specific embodiment of the dynamic encryption algorithm of an NFC chip of the present invention only shows the basic implementation logic of the algorithm. In practical applications, it is necessary to perform in-depth optimization and security reinforcement according to specific security requirements and hardware environment, such as enhancing the security of key generation, optimizing hash inverse operations and reversible transformation algorithms, etc., to ensure that the encryption algorithm can meet the high security and traceability requirements in practical applications. The description is only used to help understand the method of the present invention and its core idea. It should be pointed out that for ordinary technicians in this technical field, without departing from the principle of the present invention, the present invention can also be improved and modified in several ways, and these improvements and modifications also fall within the scope of protection of the claims of the present invention.

Claims

1. A dynamic encryption algorithm for an NFC chip, characterized in that: An auto-increment counter with an initial value of 00 and a digit of 2 is designed in the NFC chip. When the NFC chip is powered on, the auto-increment counter can be called to generate an increment counter. The increment counter means that each time the chip is powered on, the value of the counter will increase by one value, and the counter number after the increase is stored in the non-volatile sector. The key key1 and the key Ckey2 are written in the chip, and the key1 and Ckey2 are saved to the confidential verification end. The UID, key1, Ckey2 and the 2-digit counter counter obtained when the chip is sensed and the 4-digit random number rand generated by the random number algorithm are used as input parameters, and rand, counter and Ckey2 are spliced ​​to get dyna_str1, and the UID and dyna _str1 is concatenated with a special concatenation algorithm to obtain a 34-bit string linked_str1, and then linked_str1 and key1 are symmetric encrypted to generate a 34-bit encrypted string dynamic_ciphertext, which is the dynamic ciphertext. When the NFC chip is powered on and read, the chip's UID, key1, Ckey2, rand and counter are encrypted with the algorithm to generate a set of dynamic ciphertext dynamic_ciphertext as the reading result and output to the verification end. At the same time, the verification end uses the corresponding key1 and Ckey2 that have been saved to verify the dynamic ciphertext dynamic_ciphertext. At the same time, each verification only relies on the dynamic ciphertext and the dynamic ciphertext becomes invalid immediately after verification. The original value can also be restored through the dynamic ciphertext.

2. The dynamic encryption algorithm of an NFC chip according to claim 1, characterized in that: The encryption algorithm uses the AES symmetric encryption algorithm with an initialization vector (IV).

3. The dynamic encryption algorithm of an NFC chip according to claim 1, characterized in that: The key1 and Ckey2 are both composed of hexadecimal characters.

4. The dynamic encryption algorithm of an NFC chip according to claim 1, characterized in that: The keys key1 and Ckey2 support two modes: random generation and custom generation.

5. The dynamic encryption algorithm of an NFC chip according to claim 1, characterized in that: The original values ​​of UID and Ckey2 can be restored through dynamic ciphertext.

Images