A method and system for contactless smart card cryptographic verification

Abstract

The application discloses a non-contact smart card encryption verification method and system, aiming at improving the security of communication between a smart card and a card reader. The method comprises the steps of generating a random number, performing a cyclic redundancy check, generating and performing an exclusive OR operation on user identity data, encrypting combined data, generating and verifying a token, and the like. Through simulation of interaction between the card reader and the non-contact smart card, early verification in the design stage of the card reader and the smart card is realized, and the verification period is effectively shortened and the manufacturing cost is reduced.

Description

Technical Field

[0001] This invention relates to a method for contactless smart card encryption verification, and also to a system for implementing the method, belonging to the field of secure communication technology. Background Technology

[0002] Contactless smart card technology is mainly divided into three categories: First, there are radio frequency encryption (RFID) cards, also known as ID cards, whose characteristic is that information storage and retrieval are completed entirely through radio waves; second, there are radio frequency memory cards (RF ICs), which are the currently widely used contactless IC cards, and which also use radio waves for reading and writing information; and finally, there are radio frequency CPU cards (RF CPUs), also known as active cards, which add radio frequency transceiver circuitry to the CPU card. These smart cards are widely used in various applications such as school meal cards, access control cards, public transportation cards, and financial IC cards.

[0003] Mifare cards belong to the category of radio frequency memory cards (RF ICs) and are developed by NXP Semiconductors. They are widely favored by users for their convenience and high security. Mifare cards are very easy to operate, requiring no insertion or removal, are not restricted by orientation, and have fast read and write speeds, with each operation taking only 0.1 seconds. They also possess strong anti-interference capabilities, capable of processing data from multiple cards simultaneously without interference. Mifare cards also offer advanced security features, including encrypted data stream transmission and two-way authentication mechanisms to ensure transaction security. The card's internal EEPROM is divided into 16 sectors, each sector containing 4 blocks, each block being 16 bytes, supporting multiple key protections and enabling multi-purpose functionality.

[0004] Chinese invention patent ZL 202110300339.3 discloses an authentication platform based on Mifare cards. This platform consists of an authentication module, a pseudo-random number module, and an encryption module. The authentication module receives external signals and sends control signals to the pseudo-random number module and the encryption module. Upon receiving the control signals, the pseudo-random number module generates pseudo-random data signals and sends them to the encryption module. Upon receiving the control signals, the encryption module generates a key based on the data signals from the external signals and the pseudo-random data signals. While this platform can verify Mifare cards, it cannot verify Mifare card readers, nor can it perform joint verification of both Mifare cards and Mifare card readers. Summary of the Invention

[0005] The primary technical problem to be solved by this invention is to provide a method for contactless smart card encryption verification.

[0006] Another technical problem to be solved by the present invention is to provide a contactless smart card encryption verification system.

[0007] To achieve the above-mentioned technical objectives, the present invention adopts the following technical solution:

[0008] According to a first aspect of the present invention, a method for contactless smart card encryption verification is provided, comprising the following steps:

[0009] S1: The contactless smart card generates a first random number and a cyclic redundancy check, and sends it to the card reader;

[0010] S2: The card reader receives the first random number and cyclic redundancy check (CR) data sent by the contactless smart card, checks the data quantity, and verifies whether the CR is correct; if correct, proceed to step S3; if incorrect, end the verification.

[0011] S3: The card reader generates the user identity data of the contactless smart card using the first random number based on the linear feedback shift register of the encryption algorithm;

[0012] S4: The card reader performs an XOR operation between the first random number and the user identity of the contactless smart card to generate the XORed user identity data.

[0013] S5: The card reader combines the XORed user identity data and the key according to the encryption algorithm to generate the first combination of data;

[0014] S6: The card reader generates a second random number and uses the second random number to generate a second combination of data according to the encryption algorithm;

[0015] S7: Combine the first combination data and the second combination data to generate a first token and send it to the contactless smart card;

[0016] S8: The contactless smart card verifies the correctness of the first token according to the encryption algorithm; if correct, proceed to step S9; if incorrect, generate an error report and end the verification.

[0017] S9: The contactless smart card converts the first token into a second token according to the encryption algorithm and sends the second token to the card reader;

[0018] S10: The card reader receives the second token, decodes the second token according to the encryption algorithm, and verifies whether the second random number is correct; if correct, the card reader starts the built-in encryption module and encrypts all subsequent data according to the encryption algorithm; if incorrect, the verification ends.

[0019] Preferably, the contactless smart card is a Mi fare card, and the encryption algorithm is the CRYPTO 1 algorithm.

[0020] Preferably, the contactless smart card and the card reader employ a two-way authentication process involving three-factor authentication tokens.

[0021] Preferably, the user identity data of the contactless smart card contains 32 bits of information.

[0022] Preferably, the bit width of the user identity data of the contactless smart card is 96 bits.

[0023] Preferably, the information content of the first combination of data is 32 bits.

[0024] Preferably, the information content of the second combination data is 32 bits.

[0025] According to a second aspect of the present invention, a system for contactless smart card encryption verification is provided, comprising: a processor and a memory; wherein the memory is coupled to the processor and is used to store a computer program, which, when executed by the processor, causes the processor to implement the above-described method.

[0026] Compared to existing technologies, this invention significantly enhances the security of the communication process by implementing two-way authentication and data encryption between the card reader and the contactless smart card. By simulating the interaction between the card reader and the contactless smart card, this invention enables effective verification during the product development phase, allowing for the timely identification and resolution of potential problems. This method not only improves product reliability but also helps reduce production costs and increase product yield. Furthermore, this invention considers compatibility with existing contactless smart card protocols, ensuring the security of user identity data and the overall stability of the system. Through this innovative encryption and verification mechanism, the smart card system meets current security requirements and possesses the potential to adapt to future technological developments. Attached Figure Description

[0027] Figure 1 This is a flowchart of a contactless smart card encryption verification method provided in the first embodiment of the present invention;

[0028] Figure 2 This is a schematic diagram illustrating the interaction process of three verification tokens in an embodiment of the present invention;

[0029] Figure 3 This is a schematic diagram of a linear feedback shift register in an embodiment of the present invention;

[0030] Figure 4 This is a schematic diagram of the CRYPTO 1 algorithm in an embodiment of the present invention;

[0031] Figure 5 This is a flowchart illustrating the implementation of the tested logic by a simulated card reader in an embodiment of the present invention;

[0032] Figure 6 This is a flowchart illustrating the implementation of the tested logic using a simulated contactless smart card in an embodiment of the present invention.

[0033] Figure 7 This is a schematic diagram of a contactless smart card encryption verification system provided in the second embodiment of the present invention. Detailed Implementation

[0034] The technical content of the present invention will now be described in detail with reference to the accompanying drawings and specific embodiments.

[0035] First Embodiment

[0036] like Figure 1 As shown, the first embodiment of the present invention provides a method for contactless smart card encryption verification, which includes at least the following steps:

[0037] S1: The contactless smart card generates a first random number and a cyclic redundancy check (CRC) and sends it to the card reader.

[0038] S2: The card reader receives the first random number and cyclic redundancy check (CR) data sent by the contactless smart card, checks the data quantity, and verifies the CR for correctness. If correct, proceed to step S3. If incorrect, the verification ends.

[0039] S3: The card reader uses a linear feedback shift register (LFSR) and a first random number to generate the user identity data for the contactless smart card.

[0040] S4: The card reader performs an XOR operation between the first random number and the user identity of the contactless smart card to generate the XORed user identity data.

[0041] S5: The card reader combines the XORed user identity data and the key according to the encryption algorithm to generate the first combination of data.

[0042] S6: The card reader generates a second random number and uses the second random number to generate a second combination of data according to the encryption algorithm.

[0043] S7: Combine the first combination data and the second combination data to generate a first token and send it to the contactless smart card.

[0044] S8: The contactless smart card verifies the correctness of the first token using the encryption algorithm. If correct, proceed to step S9. If incorrect, generate an error report and end the verification process.

[0045] S9: The contactless smart card converts the first token into a second token according to the encryption algorithm and sends the second token to the card reader.

[0046] S10: The card reader receives the second token, decodes it according to the encryption algorithm, and verifies the correctness of the second random number. If correct, the card reader activates its built-in encryption module to encrypt all subsequent data according to the encryption algorithm. If incorrect, the verification ends.

[0047] It should be noted that the contactless smart card mentioned in the embodiments of this invention includes not only Mi fare cards but also other types of contactless smart cards. When the contactless smart card is a Mi fare card, the encryption algorithm used is the CRYPTO 1 algorithm; while when the contactless smart card is a Felicia card, the encryption algorithm used is the TripleDES algorithm. For ease of description, the following description will only focus on the CRYPTO 1 algorithm used when the contactless smart card is a Mi fare card. However, the contactless smart card encryption and verification method provided in the embodiments of this invention is also applicable to other types of contactless smart cards, including Felicia cards.

[0048] In one embodiment of the present invention, the two-way authentication process between the contactless smart card and the card reader (referred to as three-way authentication token) is an important mechanism to ensure the security of both parties' identities and prevent unauthorized access. Figure 2 As shown, the interaction process of the three-factor authentication token includes the following steps:

[0049] Step 1: The contactless smart card generates and sends the first random number on the card.

[0050] The contactless smart card first generates a random number, which is used in the subsequent authentication process to ensure secure communication. This random number is called the "first card-side random number" and is sent to the card reader.

[0051] Step 2: The card reader generates and sends the first token and a random number from the card reader end.

[0052] After receiving the first random number from the card, the card reader generates its own random number, called the "reader-side random number." Simultaneously, the card reader creates a "first token," which may contain an encrypted version of the reader-side random number or other authentication information. The card reader then sends the first token and the reader-side random number together to the contactless smart card.

[0053] Step 3: Decrypt the first token and verify the random number using the contactless smart card.

[0054] After receiving the first token and the random number from the reader, the contactless smart card attempts to decrypt the first token. Upon successful decryption, the smart card extracts the random number from the reader and compares it with the random number sent by the reader to verify their similarity. If they match, it indicates that the reader has successfully received and correctly processed the first random number sent by the smart card.

[0055] Step 4: The contactless smart card generates and sends a second token and a random number from the reader.

[0056] If the first token is successfully verified, the contactless smart card generates a "second token," which may contain an encrypted version of the reader's random number or other information used for authentication. The smart card then sends the second token back to the reader along with the previously received reader-side random number.

[0057] Step 5: The card reader decrypts the second token and verifies the random number.

[0058] After receiving the second token and its own random number, the card reader attempts to decrypt the second token. Upon successful decryption, the card reader extracts the random number and compares it with the random number previously sent to the smart card to verify their similarity. If they match, this indicates that the contactless smart card has successfully received and correctly processed the first token and its random number sent by the card reader.

[0059] Through these five steps, the contactless smart card and the card reader complete a two-way authentication process involving three verification tokens, ensuring the security of both parties' identities and laying the foundation for subsequent secure communication.

[0060] In one embodiment of the present invention, a linear feedback shift register (LFSR) is used in step S3. Figure 3 This paper demonstrates the structure and working principle of a linear feedback shift register (LFSR). An LFSR is a digital circuit used to generate pseudo-random number sequences and is widely used in fields such as encryption, error detection, and error correction. Figure 3 The vertical lines represent storage cells in the register, each storing one binary bit. The slashes and plus signs indicate a feedback function, which performs an XOR operation on the outputs of certain cells in the register using a specific polynomial and feeds the result back to the leftmost cell of the register. The sequence of numbers at the bottom may represent the initial state of the register, while... Figure 3 The numerical sequence (such as 9, 27, 61, etc.) represents the output of the LFSR in each clock cycle, which is obtained by converting the binary numbers in the register to decimal numbers. The cycle length of the LFSR is determined by the feedback polynomial and the initial state. Ideally, it should produce the longest cycle of 2^n - 1 states, where n is the number of units in the register. Figure 3The numbers “X^48, X^43, ..., X^5” in the code describe the coefficients of the feedback polynomial. “X” represents a cell in the register, and the numbers represent the coefficients of that cell in the feedback polynomial.

[0061] In one embodiment of the invention, the encryption algorithm used in step S5 is the CRYPTO 1 algorithm. The CRYPTO 1 algorithm is an encryption algorithm used in RFID systems, particularly in MiFare cards. This algorithm is designed to provide a secure communication channel between the card and the reader. The following is a combination of... Figure 4 Detailed description of the CRYPTO 1 algorithm:

[0062] Initialization phase:

[0063] At the start of the CRYPTO1 algorithm, the smart card and the reader share a key, which is not shown in the diagram but is the core of the algorithm's security. At the start of the algorithm, the reader provides an initialization vector (IV), which... Figure 4 The input is provided in the form of a variable to begin the encryption process.

[0064] Linear Feedback Shift Register (LFSR):

[0065] The CRYPTO1 algorithm uses one or more linear feedback shift registers to generate pseudo-random sequences. Figure 4 The diagram shows the structure of an LFSR, which consists of multiple flip-flops (or register units), each storing one bit. The LFSR works by using a feedback function to XOR certain bits in the register and feeding the result back to the register's input. Figure 4 In this context, Fb = 0x0dd3, Fa = 0x25c7, etc., represent the polynomial coefficients of the feedback function, which determine the state transition of the LFSR.

[0066] Encryption process:

[0067] During the encryption process, the output of the LFSR is used to encrypt the communication between the reader and the smart card. Figure 4 The diagram illustrates multiple states of the LFSR, each corresponding to a specific bit sequence. These states are transformed through a feedback function to generate new bit sequences. This process is deterministic, meaning that given the same initial state and feedback function, the LFSR will always produce the same bit sequence.

[0068] Authentication and session key generation:

[0069] The CRYPTO1 algorithm also includes an authentication process where the reader and smart card exchange encrypted random numbers to verify each other's identities. Figure 4 In this process, the output of the LFSR is used, where the bit sequence of each state is used as an encrypted random number. Once both parties have successfully exchanged and verified the random number, they can use this information to generate a session key for subsequent encrypted communication.

[0070] Figure 5 This paper details the process of simulating and fully verifying the logic under test (DUT) of a contactless smart card using a simulated card reader in a verification environment. The process begins with the simulated card reader receiving a random number and performing a CRC check on it, the first step in ensuring data integrity. If the CRC check passes, the simulated card reader collects the random number from the reader and uses the CRYPT01 algorithm to generate an expected value, which serves as a crucial reference for subsequent verification processes.

[0071] Next, the analog reader compares the data sent by the reader with the previously generated expected value. If the data matches, it indicates that the reader's response conforms to the expectations of the CRYPT01 algorithm, and the analog reader then receives the data from the smart card and verifies its correctness. This step is crucial for verifying the accuracy of communication between the reader and the smart card. Once the data is confirmed to be correct, the analog reader enables encryption to ensure that subsequent data transmissions are conducted in an encrypted state, thereby enhancing data security.

[0072] exist Figure 5 In the card reader section, the process begins with the reader receiving a random number and performing a cyclic redundancy check. If the check is successful, the reader generates the first token according to the CRYPT01 algorithm and sends it to the smart card. Subsequently, the reader receives data from the smart card, decrypts it, and verifies whether the received data is the expected data. If the data is correct, the reader also enables encryption to ensure secure communication.

[0073] The contactless smart card also plays a crucial role in the process. It first generates random numbers and performs cyclic redundancy check (CRUD) logic, then receives data from the reader. The smart card decrypts and verifies the received data to ensure it matches the expected data. If the data is correct, the smart card generates a second token according to the CRYPT01 algorithm and sends it to the reader, simultaneously enabling encryption.

[0074] pass Figure 5 The process illustrated in this invention allows for the simulation of the interaction between a card reader and a smart card in a verification environment, enabling comprehensive verification of the smart card's logic under test. This method not only ensures the security and reliability of the smart card but also allows for the timely identification and correction of potential problems during the development phase, thereby improving the overall performance of the smart card.

[0075] Figure 6A comprehensive verification process is demonstrated, allowing the simulation of contactless smart card behavior in a controlled test environment to verify the reader's logic and performance. This process begins by simulating the generation of random numbers and cyclic redundancy checks by the contactless smart card, which simulates the initial steps of the smart card communicating with the reader in a real-world scenario.

[0076] Next, the analog contactless smart card receives data from the reader and decrypts and verifies it to ensure data integrity and correctness. If data verification fails, the analog smart card identifies and prepares the corresponding error message, which may include length errors or cyclic redundancy check errors. This step is crucial for ensuring the accuracy and reliability of data transmission.

[0077] After successful data verification, the simulated contactless smart card generates a second token using the CRYPT01 algorithm and sends it back to the card reader. This token is a crucial component of the verification process, ensuring the security of both parties' identities and communication. Subsequently, the simulated smart card enables encryption, meaning all subsequent data transmissions will be encrypted to prevent unauthorized access and data leakage.

[0078] pass Figure 6 The illustrated process demonstrates how this invention can simulate the complete interaction between a contactless smart card and a reader in a verification environment. This includes not only data generation, transmission, and verification, but also error handling and the initiation of encrypted communication. Such simulation verification is crucial for ensuring the security and reliability of smart card systems. It allows for the identification and correction of potential problems during the product development phase, thereby improving the performance of the final product and user trust. By simulating smart card feedback, developers can verify whether the reader's logic can correctly handle the smart card's response and whether it can correctly identify and handle errors. This comprehensive testing method helps ensure the stability and security of smart cards and readers in practical applications.

[0079] In one embodiment of the present invention, the user identity data of the contactless smart card is 32 bits. This design conforms to the relevant protocols for contactless smart cards, ensuring compatibility and interoperability with existing systems. 32 bits are sufficient to provide a unique identifier for each user, which is crucial for user identity verification and differentiation. Furthermore, the bit width is set to 96 bits, which not only includes the 32 bits of user identity data but also provides space for additional checksums and security features, enhancing the reliability and security of data transmission.

[0080] Furthermore, both the first and second sets of data contain 32 bits of information. This indicates that additional information can be transmitted during communication between the smart card and the reader. This information can be used to enhance the security of the authentication process or for other security-related functions. This design allows for greater flexibility and scalability for smart card systems while maintaining compatibility with existing standards.

[0081] It should be noted that the 32-bit information capacity provides ample space for unique user identification, while also allowing for future technological upgrades and functional expansion. Furthermore, the 96-bit width design provides additional verification and encryption capabilities for smart card data transmission, which is crucial for preventing data tampering or interception during transmission. However, this invention is not limited to this; for example, 48-bit or 64-bit information capacity can also provide effective user identification, and can be adjusted according to specific system requirements. Moreover, the bit width design can be extended to 128 bits or 160 bits to support larger information volumes and more complex security features, such as enhanced encryption and error detection mechanisms. This design flexibility allows this invention to adapt to a wider range of application scenarios, including environments with higher requirements for data security and system performance.

[0082] In one embodiment of the present invention, the verification of card readers and contactless smart cards is performed using a unified verification methodology. This is because the methodology can handle various verification components and environments, facilitating portability between different projects. Furthermore, the methodology possesses a standardized database, and its object-oriented programming features support class inheritance, polymorphism, and encapsulation, making it simple, standardized, and universal in application.

[0083] Compared to existing technologies, this invention significantly enhances the security of the communication process by implementing two-way authentication and data encryption between the card reader and the contactless smart card. By simulating the interaction between the card reader and the contactless smart card, this invention enables effective verification during the product development phase, allowing for the timely identification and resolution of potential problems. This method not only improves product reliability but also helps reduce production costs and increase product yield. Furthermore, this invention considers compatibility with existing contactless smart card protocols, ensuring the security of user identity data and the overall stability of the system. Through this innovative encryption and verification mechanism, the smart card system meets current security requirements and possesses the potential to adapt to future technological developments.

[0084] Second Embodiment

[0085] Based on the above method, a second embodiment of the present invention provides a contactless smart card encryption verification system. For example... Figure 7As shown, the system includes a processor and a memory; wherein the memory is coupled to the processor and is used to store a computer program, which, when executed by the processor, enables the processor to implement the method described in the above embodiments.

[0086] The processor controls the overall operation of the system to complete all or part of the steps described above. This processor can be a central processing unit (CPU), graphics processing unit (GPU), field-programmable gate array (FPGA), application-specific integrated circuit (ASIC), digital signal processing (DSP) chip, etc. The memory stores various types of data to support the operation of the system. This data may include, for example, instructions for any application or method operating on the system, as well as application-related data. The memory can be implemented using any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, etc.

[0087] In one exemplary embodiment, the system may be implemented by a computer or processor entity, or by a product having certain functions, for performing the methods described above and achieving the same technical effects as those methods described above. Specifically, the computer may be, for example, a personal computer, a laptop computer, an in-vehicle human-machine interface device, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.

[0088] In another exemplary embodiment, the present invention also provides a computer-readable storage medium including program instructions that, when executed by a processor, implement the steps of the method in any of the above embodiments. For example, the computer-readable storage medium may be the memory including the program instructions described above, which can be executed by a processor to complete the above method and achieve the same technical effects as the above method.

[0089] It should be noted that the above embodiments are merely illustrative examples. The technical solutions of each embodiment can be combined, and all are within the protection scope of this invention.

[0090] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0091] The method and system for contactless smart card encryption verification provided by this invention have been described in detail above. Any obvious modifications made by those skilled in the art without departing from the essence of this invention will constitute an infringement of the patent rights of this invention and will incur corresponding legal liability.

Claims

1. A method for contactless smart card encryption verification, characterized in that... include: S1: The contactless smart card generates a first random number and a cyclic redundancy check, and sends it to the card reader; S2: The card reader receives the first random number and cyclic redundancy check (CR) sent by the contactless smart card, checks the number of data and verifies whether the CR is correct; if correct, proceed to step S3. If incorrect, the verification process ends. S3: The card reader generates the user identity data of the contactless smart card using the first random number based on the linear feedback shift register of the encryption algorithm; S4: The card reader performs an XOR operation between the first random number and the user identity of the contactless smart card to generate the XORed user identity data. S5: The card reader combines the XORed user identity data and the key according to the encryption algorithm to generate the first combination of data; S6: The card reader generates a second random number and uses the second random number to generate a second combination of data according to the encryption algorithm; S7: Combine the first combination data and the second combination data to generate a first token and send it to the contactless smart card; S8: The contactless smart card verifies the correctness of the first token based on the encryption algorithm; If correct, proceed to step S9; if incorrect, generate an error report and end the verification process. S9: The contactless smart card converts the first token into a second token according to the encryption algorithm and sends the second token to the card reader; S10: The card reader receives the second token, decodes the second token according to the encryption algorithm, and verifies whether the second random number is correct; if correct, the card reader starts the built-in encryption module and encrypts all subsequent data according to the encryption algorithm; if incorrect, the verification ends.

2. The method as described in claim 1, characterized in that: The contactless smart card is a Mifare card, and the encryption algorithm is the CRYPTO1 algorithm.

3. The method as described in claim 2, characterized in that: The contactless smart card and the card reader employ a two-way authentication process involving three-factor authentication tokens.

4. The method as described in claim 1, characterized in that... The user identity data of the contactless smart card contains 32 bits of information.

5. The method as described in claim 4, characterized in that... The user identity data of the contactless smart card has a bit width of 96 bits.

6. The method as described in claim 1, characterized in that... The information content of the first combination of data is 32 bits.

7. The method as described in claim 5, characterized in that... The second combination of data contains 32 bits of information.

8. A contactless smart card encryption verification system, characterized in that... It includes a processor and a memory; wherein the memory is coupled to the processor and is used to store a computer program that, when executed by the processor, causes the processor to implement the method described in any one of claims 1 to 7.

Images