Method and system for encrypting and verifying non-contact smart card

Abstract

The invention discloses a non-contact intelligent card encryption verification method and a non-contact intelligent card encryption verification system, and aims to improve the safety of communication between an intelligent card and a card reader. The method comprises the steps of random number generation, cyclic redundancy check, user identity data generation and XOR operation, combined data encryption, token generation and verification and the like, and by simulating interaction of a card reader and a non-contact intelligent card, early verification in the design stage of the card reader and the intelligent card is achieved. The verification period is effectively shortened; and the manufacturing cost is reduced.

Description

Technical Field

[0001] The invention relates to a method for contactless smart card encryption verification and also to a system for implementing the method, belonging to the technical field of secure communications. Background Art

[0002] Contactless smart card technology is mainly divided into three categories: the first is the radio frequency encryption (RFID) card, also known as the ID card, which is characterized by the access of information completely completed through radio waves; the second is the radio frequency memory card (RF IC), which is the currently commonly used contactless IC card, which also uses radio waves to read and write information; the last is the radio frequency CPU card (RF CPU), also known as the active card, which adds a radio frequency transceiver circuit to the CPU card. These smart cards are widely used in many occasions such as school meal cards, access control cards, bus cards and financial IC cards.

[0003] Mifare card belongs to the category of radio frequency memory card (RF IC) and is developed by NXP Semiconductors. It is widely favored by users for its convenience and high security. Mifare card is very easy to operate, no need to plug and unplug, not restricted by the direction of use, and has a fast reading and writing speed, each operation takes only 0.1 second. They also have strong anti-interference ability and can process data from multiple cards at the same time without interfering with each other. Mifare card also provides advanced security features, including data stream encryption transmission and two-way verification mechanism to ensure the security of transactions. The EEPROM in the card is divided into 16 sectors, each sector contains 4 blocks, each block is 16 bytes, supports multiple key protections, and realizes the function of one card for multiple uses.

[0004] In Chinese invention patent ZL 202110300339.3, an authentication platform based on Mifare cards is disclosed. The platform consists of an authentication module, a pseudo-random number module and an encryption module. The authentication module is responsible for receiving external signals and sending control signals to the pseudo-random number module and the encryption module. After receiving the control signal, the pseudo-random number module generates a pseudo-random data signal and sends it to the encryption module. After receiving the control signal, the encryption module generates a key based on the data signal and the pseudo-random data signal in the external signal. Although this platform can verify Mifare cards, it cannot verify Mifare card readers, nor can it realize the joint verification of Mifare cards and Mifare card readers. Summary of the invention

[0005] The primary technical problem to be solved by the present invention is to provide a method for contactless smart card encryption verification.

[0006] Another technical problem to be solved by the present invention is to provide a contactless smart card encryption verification system.

[0007] In order to achieve the above technical objectives, the present invention adopts the following technical solutions:

[0008] According to a first aspect of an embodiment of the present invention, a method for contactless smart card encryption verification is provided, comprising the following steps:

[0009] S1: The contactless smart card generates a first random number and a cyclic redundancy check and sends them to the card reader;

[0010] S2: The card reader receives the first random number and cyclic redundancy check sent by the contactless smart card, checks the number of data and verifies whether the cyclic redundancy check is correct; if correct, proceeds to step S3; if incorrect, ends the verification;

[0011] S3: The card reader generates user identity data of the contactless smart card using the first random number according to the linear feedback shift register of the encryption algorithm;

[0012] S4: The card reader performs an XOR operation on the first random number and the user identity of the contactless smart card to generate XORed user identity data;

[0013] S5: The card reader combines the XORed user identity data and the key according to the encryption algorithm to generate first combined data;

[0014] S6: The card reader generates a second random number, and uses the second random number to generate second combined data according to an encryption algorithm;

[0015] S7: Combine the first combined data and the second combined data to generate a first token and send it to the contactless smart card;

[0016] S8: The contactless smart card verifies the correctness of the first token according to the encryption algorithm; if correct, proceed to step S9; if incorrect, generate an error report and end the verification;

[0017] S9: The contactless smart card converts the first token into a second token according to an encryption algorithm, and sends the second token to the card reader;

[0018] S10: The card reader receives the second token, decodes the second token according to the encryption algorithm, and verifies whether the second random number is correct; if correct, the card reader starts the built-in encryption module and encrypts all subsequent data according to the encryption algorithm; if incorrect, the verification ends.

[0019] Preferably, the contactless smart card is a Mi fare card, and the encryption algorithm is the CRYPTO 1 algorithm.

[0020] Preferably, a two-way authentication process of three verification tokens is adopted between the contactless smart card and the card reader.

[0021] Preferably, the information volume of the user identity data of the contactless smart card is 32 bits.

[0022] Preferably, the bit width of the user identity data of the contactless smart card is 96 bits.

[0023] Preferably, the information amount of the first combined data is 32 bits.

[0024] Preferably, the information amount of the second combined data is 32 bits.

[0025] According to a second aspect of an embodiment of the present invention, a system for contactless smart card encryption verification is provided, comprising: a processor and a memory; wherein the memory is coupled to the processor and is used to store a computer program, and when the computer program is executed by the processor, the processor implements the above method.

[0026] Compared with the prior art, the present invention significantly improves the security of the communication process by realizing two-way authentication and data encryption between the card reader and the contactless smart card. By simulating the interaction between the card reader and the contactless smart card, the present invention can effectively verify in the product development stage, so as to timely discover and solve potential problems. This method not only improves the reliability of the product, but also helps to reduce production costs and improve product qualification rate. In addition, the present invention takes into account the compatibility with the existing contactless smart card protocol, ensuring the security of user identity data and the overall stability of the system. Through this innovative encryption verification mechanism, the smart card system can meet current security needs and has the potential to adapt to future technological developments. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 A flow chart of a method for contactless smart card encryption verification provided by the first embodiment of the present invention;

[0028] Figure 2 A schematic diagram of the interaction process of three verification tokens in an embodiment of the present invention;

[0029] Figure 3 A schematic diagram of a linear feedback shift register in an embodiment of the present invention;

[0030] Figure 4 This is a schematic diagram of the CRYPTO 1 algorithm in an embodiment of the present invention;

[0031] Figure 5 This is a flow chart of simulating a card reader to implement the logic under test in an embodiment of the present invention;

[0032] Figure 6 This is a flow chart of simulating a contactless smart card to implement the tested logic in an embodiment of the present invention;

[0033] Figure 7 A schematic diagram of a contactless smart card encryption authentication system provided by a second embodiment of the present invention. DETAILED DESCRIPTION

[0034] The technical content of the present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0035] First embodiment

[0036] like Figure 1 As shown, the first embodiment of the present invention provides a method for contactless smart card encryption verification, which at least includes the following steps:

[0037] S1: The contactless smart card generates a first random number and a cyclic redundancy check (CRC), and sends them to the card reader.

[0038] S2: The card reader receives the first random number and cyclic redundancy check sent by the contactless smart card, checks the data quantity and verifies whether the cyclic redundancy check is correct. If correct, proceed to step S3. If not correct, end verification.

[0039] S3: The card reader generates user identification data of the contactless smart card using a linear feedback shift register (LFSR) and a first random number.

[0040] S4: The card reader performs an XOR operation on the first random number and the user identity of the contactless smart card to generate XORed user identity data.

[0041] S5: The card reader combines the XORed user identity data and the key according to an encryption algorithm to generate first combined data.

[0042] S6: The card reader generates a second random number, and uses the second random number to generate second combined data according to an encryption algorithm.

[0043] S7: Combine the first combined data and the second combined data to generate a first token and send it to the contactless smart card.

[0044] S8: The contactless smart card verifies the correctness of the first token according to the encryption algorithm. If correct, proceed to step S9. If incorrect, generate an error report and end the verification.

[0045] S9: The contactless smart card converts the first token into a second token according to an encryption algorithm, and sends the second token to the card reader.

[0046] S10: The card reader receives the second token, decodes the second token according to the encryption algorithm, and verifies whether the second random number is correct. If it is correct, the card reader starts the built-in encryption module and encrypts all subsequent data according to the encryption algorithm. If it is incorrect, the verification ends.

[0047] It should be noted that the contactless smart card mentioned in the embodiment of the present invention includes not only Mi fare cards, but also other types of contactless smart cards. When the contactless smart card is a Mi fare card, the encryption algorithm used is the CRYPTO 1 algorithm; and when the contactless smart card is a Felica card, the encryption algorithm used is the TripleDES algorithm. For the convenience of description, the following content will only describe in detail the CRYPTO 1 algorithm used when the contactless smart card is a Mi fare card. However, the contactless smart card encryption verification method provided in the embodiment of the present invention is also applicable to other types of contactless smart cards including Felica cards.

[0048] In one embodiment of the present invention, the two-way authentication process between the contactless smart card and the card reader (referred to as a three-way authentication token) is an important mechanism to ensure the identity security of both parties and prevent unauthorized access. Figure 2 As shown, the three-way verification token interaction process includes the following steps:

[0049] Step 1: The contactless smart card generates and sends the first card-side random number

[0050] The contactless smart card first generates a random number, which is used in the subsequent authentication process to ensure the security of communication. This random number is called the "first card-side random number" and is sent to the card reader.

[0051] Step 2: The card reader generates and sends the first token and the random number on the card reader side

[0052] After receiving the first card-side random number, the card reader generates its own random number, called the "card reader-side random number". At the same time, the card reader creates a "first token", which may contain an encrypted version of the card reader-side random number or other information used for authentication. The card reader sends the first token and the card reader-side random number together to the contactless smart card.

[0053] Step 3: The contactless smart card decrypts the first token and verifies the random number

[0054] After receiving the first token and the random number on the card reader side, the contactless smart card will try to decrypt the first token. After the decryption is successful, the smart card will take out the random number on the card reader side and compare it with the random number on the card reader side sent by the card reader to verify whether the two are the same. If they are the same, it means that the card reader has successfully received and correctly processed the first random number on the card side sent by the smart card.

[0055] Step 4: The contactless smart card generates and sends the second token and random number to the reader

[0056] If the first token is successfully authenticated, the contactless smart card generates a "second token" that may contain an encrypted version of the reader-side random number or other information used for authentication. The smart card sends the second token back to the reader along with the previously received reader-side random number.

[0057] Step 5: The reader decrypts the second token and verifies the random number

[0058] After receiving the second token and the reader-side random number, the card reader will try to decrypt the second token. After successful decryption, the card reader will take out the reader-side random number and compare it with the reader-side random number previously sent to the smart card to verify whether the two are the same. If they are the same, this indicates that the contactless smart card has successfully received and correctly processed the first token and reader-side random number sent by the reader.

[0059] Through these five steps, the contactless smart card and the card reader complete the two-way authentication process of the three-verification token, ensuring the identity security of both parties and laying the foundation for subsequent secure communications.

[0060] In one embodiment of the present invention, a linear feedback shift register (LFSR) is used in step S3. Figure 3 The structure and working principle of a linear feedback shift register (LFSR) are shown. LFSR is a digital circuit used to generate pseudo-random number sequences and is widely used in encryption, error detection and correction, etc. Figure 3 The vertical lines in the diagram represent the memory cells in the register, each storing a single bit. The slash and plus sign represent the feedback function, which XORs the outputs of some cells in the register with a specific polynomial and feeds the result back to the leftmost cell in the register. The sequence of numbers at the bottom may represent the initial state of the register, while Figure 3 The sequence of numbers in (such as 9, 27, 61, etc.) represents the output of the LFSR in each clock cycle, which is obtained by converting the binary number in the register to decimal. The cycle length of the LFSR is determined by the feedback polynomial and the initial state. Ideally, it should produce the longest cycle of 2^n-1 states, where n is the number of cells in the register. Figure 3The "X^48, X^43...X^5" in the figure describe the coefficients of the feedback polynomial, where "X" represents a unit in the register and the number represents the coefficient of the unit in the feedback polynomial.

[0061] In one embodiment of the present invention, the encryption algorithm used in step S5 is the CRYPTO 1 algorithm. The CRYPTO 1 algorithm is an encryption algorithm used in RFID systems, especially in Mi fare cards. The purpose of this algorithm is to provide a secure communication channel between the card and the card reader. Figure 4 Detailed description of the CRYPTO 1 algorithm:

[0062] Initialization phase:

[0063] At the beginning of the CRYPTO1 algorithm, the smart card and the card reader share a key, which is not shown in the figure, but is the core of the algorithm security. At the beginning of the algorithm, the card reader provides an initialization vector (IV), which is Figure 4 is given as input to start the encryption process.

[0064] Linear Feedback Shift Register (LFSR):

[0065] The CRYPTO1 algorithm uses one or more linear feedback shift registers to generate a pseudo-random sequence. Figure 4 In Figure 1, you can see the structure of an LFSR, which consists of multiple flip-flops (or register cells), each of which stores one bit. The working principle of the LFSR is to perform an XOR operation on certain bits in the register through a feedback function and feed the result back to the input of the register. Figure 4 Fb=0x0dd3, Fa=0x25c7, etc. represent the polynomial coefficients of the feedback function, which determine the state transition of the LFSR.

[0066] Encryption process:

[0067] During the encryption process, the output of the LFSR is used to encrypt the communication between the reader and the smart card. Figure 4 Figure 1 shows the multiple states of the LFSR, each state corresponding to a specific bit sequence. These states are transformed by a feedback function to generate new bit sequences. This process is deterministic, meaning that given the same initial state and feedback function, the LFSR will always produce the same bit sequence.

[0068] Authentication and session key generation:

[0069] The CRYPTO1 algorithm also includes an authentication process, in which the reader and smart card exchange encrypted random numbers to verify each other's identity. Figure 4 In , the process is driven by the output of the LFSR, where the bit sequence of each state is used as a random number for encryption. Once both parties have successfully exchanged and verified the random numbers, they can use this information to generate a session key for subsequent encrypted communications.

[0070] Figure 5 The process of simulating and fully verifying the contactless smart card's logic under test through a simulated card reader in a verification environment is described in detail. The process begins with the simulated card reader receiving a random number and performing a CRC check on it, which is the first step to ensure data integrity. If the CRC check passes, the simulated card reader will collect the reader's random number and generate an expected value using the CRYPT01 algorithm. This expected value is a key reference in the subsequent verification process.

[0071] Next, the simulated reader compares the data sent by the reader with the expected value generated previously. If the data matches, this indicates that the reader's response meets the expectations of the CRYPT01 algorithm. The simulated reader will then receive the data from the smart card and confirm its correctness. This step is a key step in verifying the accuracy of communication between the reader and the smart card. Once the data is confirmed to be correct, the simulated reader will start encryption to ensure that subsequent data transmission is carried out in an encrypted state, thereby enhancing data security.

[0072] exist Figure 5 In the card reader part, the process starts with the card reader receiving the random number and performing a cyclic redundancy check. If the check is correct, the card reader will generate the first token according to the CRYPT01 algorithm and send it to the smart card. Subsequently, the card reader receives the data from the smart card, decrypts it and verifies whether the received data is the expected data. If the data is correct, the card reader will also start encryption to ensure communication security.

[0073] The contactless smart card also plays an important role in the process. It first generates random number logic and cyclic redundancy check, and then receives the data from the card reader. The smart card decrypts and verifies whether the received data is the expected data. If the data is correct, the smart card will generate a second token based on the CRYPT01 algorithm and send it to the card reader, while starting the encryption enable.

[0074] pass Figure 5 The process shown in the figure, the present invention can simulate the interaction between the card reader and the smart card in the verification environment, and realize the comprehensive verification of the tested logic of the smart card. This method can not only ensure the security and reliability of the smart card, but also can timely discover and correct potential problems in the development stage, thereby improving the overall performance of the smart card.

[0075] Figure 6A comprehensive verification process is presented, which allows to simulate the behavior of contactless smart cards in a controlled test environment to verify the logic and performance of the card reader. The process starts with simulating the random number generation and cyclic redundancy check of the contactless smart card, which is the initial step of the communication between the smart card and the card reader in a real scenario.

[0076] Next, the simulated contactless smart card receives the data from the card reader and decrypts and verifies it to ensure the integrity and correctness of the data. If the data verification fails, the simulated smart card will identify and prepare the corresponding error message, which may include length error or cyclic redundancy check error. This step is critical to ensure the accuracy and reliability of data transmission.

[0077] After successfully verifying the data, the simulated contactless smart card generates a second token based on the CRYPT01 algorithm and sends it back to the card reader. This token is a key component in the verification process and is used to ensure the identity and security of both parties' communications. Subsequently, the simulated smart card will start encryption enablement, which means that all subsequent data transmission will be encrypted to prevent unauthorized access and data leakage.

[0078] pass Figure 6 According to the process shown, the embodiment of the present invention can simulate the complete interaction process between the contactless smart card and the card reader in a verification environment. This includes not only the generation, transmission and verification of data, but also error handling and the initiation of encrypted communication. Such simulation verification is crucial to ensure the security and reliability of the smart card system. It can discover and correct potential problems in the product development stage, thereby improving the performance of the final product and the user's trust. By simulating the feedback of the smart card, the developer can verify whether the logic of the card reader can correctly handle the response of the smart card, and whether it can correctly identify and handle errors when they occur. This comprehensive testing method helps to ensure the stability and security of smart cards and card readers in actual applications.

[0079] In one embodiment of the present invention, the user identity data information volume of the contactless smart card is 32 bits, which conforms to the relevant protocols of the contactless smart card and ensures compatibility and interoperability with existing systems. The 32-bit information volume is sufficient to provide a unique identification for each user, which is essential for the verification and differentiation of user identities. In addition, the bit width is set to 96 bits, which not only includes 32 bits of user identity data, but also provides space for additional verification and security features, thereby enhancing the reliability and security of data transmission.

[0080] In addition, the information volume of the first combined data and the second combined data is also 32 bits, which means that in the communication process between the smart card and the card reader, additional information can be transmitted, which can be used to enhance the security of the authentication process or for other security-related functions. This design allows more flexibility and scalability for the smart card system while maintaining compatibility with existing standards.

[0081] It should be noted that 32 bits of information provide users with sufficient unique identification space, and also provide possibilities for future technology upgrades and functional expansion. In addition, the 96-bit bit width design provides additional verification and encryption capabilities for the data transmission of the smart card, which plays an important role in preventing data from being tampered with or intercepted during transmission. However, the present invention is not limited to this. For example, the use of 48 bits or 64 bits of information can also provide effective user identity identification, and can be adjusted according to the specific requirements of the system. In addition, the bit width design can also be expanded to 128 bits or 160 bits to support larger amounts of information and more complex security features, such as enhanced encryption and error detection mechanisms. This design flexibility enables the present invention to adapt to a wider range of application scenarios, including those environments with higher requirements for data security and system performance.

[0082] In one embodiment of the present invention, the verification of the card reader and the contactless smart card is performed in the context of the unified verification methodology. This is because the methodology can cope with a variety of verification components and verification environments, and is convenient for porting between different projects. At the same time, the methodology has a standardized database, and the object-oriented programming feature supports class inheritance polymorphism and encapsulation, and is simple, standard and universal in application.

[0083] Compared with the prior art, the present invention significantly improves the security of the communication process by realizing two-way authentication and data encryption between the card reader and the contactless smart card. By simulating the interaction between the card reader and the contactless smart card, the present invention can effectively verify in the product development stage, so as to timely discover and solve potential problems. This method not only improves the reliability of the product, but also helps to reduce production costs and improve product qualification rate. In addition, the present invention takes into account the compatibility with the existing contactless smart card protocol, ensuring the security of user identity data and the overall stability of the system. Through this innovative encryption verification mechanism, the smart card system can meet current security needs and has the potential to adapt to future technological developments.

[0084] Second embodiment

[0085] Based on the above method, the second embodiment of the present invention provides a system for contactless smart card encryption verification. Figure 7As shown, the system includes a processor and a memory; wherein the memory is coupled to the processor and is used to store a computer program, and when the computer program is executed by the processor, the processor implements the method in the above embodiment.

[0086] Wherein, the processor is used to control the overall operation of the system to complete all or part of the steps of the above method. The processor can be a central processing unit (CPU), a graphics processing unit (GPU), a field programmable gate array (FPGA), an application-specific integrated circuit (ASIC), a digital signal processing (DSP) chip, etc. The memory is used to store various types of data to support operations in the system, and these data may include, for example, instructions for any application or method for operating on the system, and application-related data. The memory can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as a static random access memory (SRAM), an electrically erasable programmable read-only memory (EEPROM), an erasable programmable read-only memory (EPROM), a programmable read-only memory (PROM), a read-only memory (ROM), a magnetic memory, a flash memory, etc.

[0087] In an exemplary embodiment, the system can be implemented by a computer or processor entity, or by a product with a certain function, for executing the above method and achieving the same technical effect as the above method. Specifically, the computer can be, for example, a personal computer, a laptop computer, a vehicle-mounted human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0088] In another exemplary embodiment, the present invention further provides a computer-readable storage medium including program instructions, which, when executed by a processor, implements the steps of the method in any of the above embodiments. For example, the computer-readable storage medium may be the above-mentioned memory including program instructions, which may be executed by a processor to complete the above-mentioned method and achieve the same technical effect as the above-mentioned method.

[0089] It should be noted that the above embodiments are only examples, and the technical solutions of the various embodiments can be combined, all within the protection scope of the present invention.

[0090] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0091] The above is a detailed description of the contactless smart card encryption verification method and system provided by the present invention. For those skilled in the art, any obvious changes made to it without departing from the essence of the present invention will constitute an infringement of the patent right of the present invention and will bear corresponding legal responsibilities.

Claims

1. A method for contactless smart card encryption verification, characterized in that include: S1: The contactless smart card generates a first random number and a cyclic redundancy check and sends them to the card reader; S2: The card reader receives the first random number and cyclic redundancy check sent by the contactless smart card, checks the data quantity and verifies whether the cyclic redundancy check is correct; if correct, proceeds to step S3; If it is incorrect, the verification ends; S3: The card reader generates user identity data of the contactless smart card using the first random number according to the linear feedback shift register of the encryption algorithm; S4: The card reader performs an XOR operation on the first random number and the user identity of the contactless smart card to generate XORed user identity data; S5: The card reader combines the XORed user identity data and the key according to the encryption algorithm to generate first combined data; S6: The card reader generates a second random number, and uses the second random number to generate second combined data according to an encryption algorithm; S7: Combine the first combined data and the second combined data to generate a first token and send it to the contactless smart card; S8: The contactless smart card verifies the correctness of the first token according to the encryption algorithm; If correct, proceed to step S9; if incorrect, generate an error report and end the verification; S9: The contactless smart card converts the first token into a second token according to an encryption algorithm, and sends the second token to the card reader; S10: The card reader receives the second token, decodes the second token according to the encryption algorithm, and verifies whether the second random number is correct; if correct, the card reader starts the built-in encryption module and encrypts all subsequent data according to the encryption algorithm; if incorrect, the verification ends.

2. The method according to claim 1, characterized in that: The contactless smart card is a Mifare card, and the encryption algorithm is the CRYPTO1 algorithm.

3. The method according to claim 2, characterized in that: A two-way authentication process using three verification tokens is adopted between the contactless smart card and the card reader.

4. The method according to claim 1, characterized in that The information volume of the user identity data of the contactless smart card is 32 bits.

5. The method according to claim 4, characterized in that The bit width of the user identity data of the contactless smart card is 96 bits.

6. The method according to claim 1, characterized in that The information amount of the first combined data is 32 bits.

7. The method according to claim 5, characterized in that The information amount of the second combined data is 32 bits.

8. A contactless smart card encryption verification system, characterized in that It comprises a processor and a memory; wherein the memory is coupled to the processor and is used to store a computer program, and when the computer program is executed by the processor, the processor implements the method described in any one of claims 1 to 7.

Images