RFID electronic tag encryption system based on national cryptographic algorithm

Abstract

The invention discloses an RFID (Radio Frequency Identification) electronic tag encryption system based on a national cryptographic algorithm, which relates to the technical field of radio frequency identification and comprises a tag key dispersion module, a national cryptographic algorithm module, a key management module, an encryption module and an anti-counterfeiting detection module, the label key dispersion module performs key dispersion on the label UID based on the PSAM card to generate an anti-counterfeiting authentication identification code; sM1 and SM7 national cryptographic algorithms are integrated into the encryption module by the national cryptographic algorithm module, and encryption operation is carried out; the key management module carries out key management and storage in the label issuing and using process based on the PSAM card. According to the invention, the SM1 algorithm is adopted to encrypt the information taking the label UID and the sector number as dispersion factors, the data area key is generated, the security of the system is enhanced, the legality and uniqueness of the label are ensured through the anti-counterfeiting authentication identification code generated by the PSAM card, the read-write operation security of the data area is ensured, and the security and autonomous controllability of data exchange are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of radio frequency identification, and in particular to an RFID electronic tag encryption system based on a national secret algorithm. Background Art

[0002] As a contactless automatic identification technology, RFID technology has been widely used in logistics, warehousing, retail, and transportation. However, traditional RFID electronic tags generally use internationally accepted encryption algorithms. Although these encryption algorithms have improved data security to a certain extent, they also have some disadvantages. Some advanced encryption algorithms have high computational complexity, which places high demands on the computing power and storage capacity of RFID tags. They completely rely on international algorithms for processing. In the RFID authentication protocol based on symmetric keys, once the key of a tag is leaked, the security of the entire system will be threatened. This risk is particularly prominent when the key is poorly managed or subjected to malicious attacks, resulting in poor security and uncontrollability during data exchange. In this regard, we propose an RFID electronic tag encryption system based on the national secret algorithm. Summary of the invention

[0003] In order to solve the above technical problems, an RFID electronic tag encryption system based on the national secret algorithm is provided. This technical solution solves the above problems of poor data quality, high calculation requirements and uncontrollability.

[0004] To achieve the above objectives, the technical solution adopted by the present invention is: an RFID electronic tag encryption system based on a national secret algorithm, comprising: a tag key dispersion module, a national secret algorithm module, a key management module, an encryption module and an anti-counterfeiting detection module;

[0005] The tag key dispersion module disperses the tag UID key based on the PSAM card to generate an anti-counterfeiting authentication identification code;

[0006] The national secret algorithm module integrates the SM1 and SM7 national secret algorithms into the encryption module to perform encryption operations;

[0007] The key management module manages and stores keys during label issuance and use based on the PSAM card;

[0008] The encryption module uses the national secret algorithm to encrypt the tag UID and the sector area number as the dispersion factor information to generate the data area key;

[0009] The anti-counterfeiting detection module identifies and detects the encrypted RFID electronic tag to check whether it is legal, and transmits data after authentication.

[0010] Preferably, the steps for the tag key dispersing module to generate the anti-counterfeiting authentication identification code are:

[0011] A1. Input parameters, including the tag's UID and master key;

[0012] A2, based on the PSAM card, use the master key and tag UID to input, generate a subkey based on the AES algorithm, combine the subkey with the expression UID, and generate an anti-counterfeiting authentication identification code through hash operation;

[0013] The AES algorithm block length is 128 bits. When generating sub-keys, the initial key is first split into "words" and stored in the extended key array. The round constant corresponding to each round is determined, and the array is filled according to the rules. If the current word sequence number is divisible by the number of initial key words, the previous byte is first cycled and replaced by a byte, then XORed with the word at the number of positions before the initial key word, and finally XORed with the round constant. The calculation is continued until the array is filled. These words constitute the sub-keys required for each round of AES encryption.

[0014] Preferably, the hash operation in step A2 is performed based on the SHA-256 algorithm to generate a 256-bit hash value, the key and the UID are concatenated to obtain M=K‖UID, and the hash operation is performed, and the processing formula is:

[0015] H=SHA256(M)=SHA256(K‖UID)

[0016] Where H is the anti-counterfeiting authentication identification code, SHA256 is the hash function algorithm, M is the data in the input hash function, and K is the key.

[0017] Preferably, the national encryption algorithm module obtains the software implementation library of the algorithm based on the manufacturer, adds the source files and static library files in the algorithm library to the encryption module, configures the compilation environment, and calls the encryption and decryption functions provided by the algorithm library in the code of the encryption module.

[0018] Preferably, the key management module is managed based on the PSAM card. After the key is generated, it is stored in the encryption area of ​​the PSAM card. The PSAM card hardware encrypts the storage of the master key and the working key, and backs up the key off-site. When the label is issued, the PSAM card assigns a working key to the electronic label and encrypts the transmission for dynamic distribution.

[0019] Preferably, the encryption module performs encryption based on the national encryption algorithm, and the encryption formula is:

[0020] K data =KD SM1 (K master , DF) = KD SM1 (K master , UID ‖ Sector)

[0021] Where K datais the data area key, KD SM1 is the key distribution function of the SM1 algorithm, K master is the master key, DF is the dispersion factor, and Sector is the sector number;

[0022] Master Key K master With the dispersion factor DF as input, the key dispersion function KD of the SM1 hardware module SM1 After processing, the output is the key K data .

[0023] Preferably, the anti-counterfeiting detection module includes an identification unit, a transmission unit and a record storage unit, wherein the identification unit is used to read the UID and encrypted data of the RFID electronic tag to identify and determine whether it is a legal electronic tag, the transmission unit performs secure data exchange after determining that it is legal, and the record storage unit records the identification and judgment operation process in real time and generates a record log;

[0024] The specific operation steps of the anti-counterfeiting detection module are as follows:

[0025] B1. The RFID reader sends a query message to activate the electronic tags within the range. The tags respond and send the UID and encrypted data.

[0026] B2. Send the UID, extract the tag UID, sector number and dispersion factor, identify and authenticate, and determine whether it is legal;

[0027] B3. After judging the legality, data exchange processing is carried out. During the data exchange process, the subkey is used to encrypt the data;

[0028] B4. The record storage unit records the authentication result and operation log locally or uploads it to the server. The log content includes the tag UID, authentication time and operation type.

[0029] Preferably, the identification judgment is performed by storing the UIDs of all legal electronic tags in a static list. After reading the UID of the electronic tag, it is compared one by one with the UIDs in the list. If a match is found, the electronic tag is determined to be a legal tag; if no match is found, it is determined to be an illegal tag.

[0030] Preferably, before the transmission unit performs secure data exchange, the transmission unit and the legitimate electronic tag negotiate a symmetric key through a secure channel, encrypt the data to be sent to the electronic tag using the negotiated symmetric key, and send it to the electronic tag. After the electronic tag receives the encrypted data, it uses the same symmetric key to decrypt it and obtain the original data. Based on the encrypted data, both parties use a message authentication code to check the integrity of the data and perform interactive transmission.

[0031] Preferably, the record storage unit records the identification and judgment operation process in real time, and generates a record log. The record storage selects a combined log, configures a log collector in the record storage unit, and sends the log information to the log collector for storage; the log classification includes time, operation type and result composition.

[0032] Compared with the prior art, the present invention has the following beneficial effects:

[0033] The present invention integrates the SM1 and SM7 national cryptographic algorithms issued by the State Cryptography Administration into the encryption system of the RFID electronic tag to ensure the security of data exchange and compliance with national standards, uses the PSAM card as a security authentication module to realize key management and anti-counterfeiting authentication in the process of label issuance and use, adopts the SM1 algorithm to encrypt the information of the label UID and sector number as dispersion factors, generates a data area key, enhances the security of the system, and ensures the legitimacy and uniqueness of the label through the anti-counterfeiting authentication identification code generated by the PSAM card, ensures the security of the read and write operations of the data area, and improves the security and autonomous controllability of data exchange. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 To invent the encryption system framework diagram;

[0035] Figure 2 This is a unit framework diagram for the invented anti-counterfeiting detection module. DETAILED DESCRIPTION

[0036] The following description is used to disclose the present invention so that those skilled in the art can implement the present invention. The preferred embodiments described below are only examples, and those skilled in the art may think of other obvious variations.

[0037] Reference Figure 1 As shown, an RFID electronic tag encryption system based on a national secret algorithm includes: a tag key dispersion module, a national secret algorithm module, a key management module, an encryption module and an anti-counterfeiting detection module;

[0038] The tag key dispersion module disperses the tag UID key based on the PSAM card to generate an anti-counterfeiting authentication identification code;

[0039] The national secret algorithm module integrates the SM1 and SM7 national secret algorithms into the encryption module to perform encryption operations;

[0040] The key management module manages and stores keys during label issuance and use based on the PSAM card;

[0041] The encryption module uses the national secret algorithm to encrypt the tag UID and the sector area number as the dispersion factor information to generate the data area key;

[0042] The anti-counterfeiting detection module identifies and detects the encrypted RFID electronic tag to check whether it is legal, and transmits data after authentication.

[0043] This application generates an anti-counterfeiting authentication identification code by dispersing the key of the label UID based on the PSAM card. It uses the security characteristics of the PSAM card and combines the unique identification of the label to increase the complexity and uniqueness of the key, making it extremely difficult to forge the anti-counterfeiting authentication identification code, and effectively preventing the label from being counterfeited; the SM1 and SM7 national secret algorithms are integrated into the encryption module. The national secret algorithm has high security and autonomous controllability, can resist a variety of attack methods, and encrypts the data with high strength to protect the confidentiality of the data during transmission and storage;

[0044] Key management and storage are performed based on PSAM cards, which provide a secure storage environment and encryption mechanism to ensure the security of keys during label issuance and use, prevent key leakage, and protect system security from the source. The data area key is encrypted using the label UID and sector number as dispersion factors. Each label and sector corresponds to a unique key, which enhances the pertinence and security of data area encryption and makes it more difficult to illegally obtain data.

[0045] The steps for the tag key dispersion module to generate the anti-counterfeiting authentication identification code are as follows:

[0046] A1. Input parameters, including the tag's UID and master key;

[0047] A2, based on the PSAM card, use the master key and tag UID to input, generate a subkey based on the AES algorithm, combine the subkey with the expression UID, and generate an anti-counterfeiting authentication identification code through hash operation;

[0048] The AES algorithm block length is 128 bits. When generating sub-keys, the initial key is first split into "words" and stored in the extended key array. The round constant corresponding to each round is determined, and the array is filled according to the rules. If the current word sequence number is divisible by the number of initial key words, the previous byte is first cycled and replaced by a byte, then XORed with the word at the number of positions before the initial key word, and finally XORed with the round constant. The calculation is continued until the array is filled. These words constitute the sub-keys required for each round of AES encryption.

[0049] This application inputs two parameters, the tag UID and the master key, which increases the complexity and uniqueness of key generation, making the anti-counterfeiting authentication identification code more difficult to crack or forge, because the attacker needs to obtain both the tag UID and the master key to carry out an effective attack, greatly improving the security threshold of the system; the sub-key is combined with the tag UID for hash operation to generate the anti-counterfeiting authentication identification code, ensuring that each tag has a unique anti-counterfeiting authentication identification code.

[0050] In step A2, the hash operation is performed based on the SHA-256 algorithm to generate a 256-bit hash value. The key and the UID are concatenated to obtain M=K‖UID. The hash operation is performed and the processing formula is:

[0051] H=SHA256(M)=SHA256(K‖UID)

[0052] Where H is the anti-counterfeiting authentication identification code, SHA256 is the hash function algorithm, M is the data in the input hash function, and K is the key.

[0053] The SHA-256 algorithm of the present application has excellent anti-collision performance, that is, it is difficult to find two different data M1 and M2 such that SHA256(M1)=SHA256(M2), which ensures that different key and UID splicing data can generate a unique 256-bit hash value, reducing the possibility of forging anti-counterfeiting authentication identification code, because it is difficult for attackers to find another data combination to produce the same hash value to impersonate legitimate data; by performing hash operation on the key and UID splicing data, the generated anti-counterfeiting authentication identification code can be used to verify the integrity of the data.

[0054] The computer code is:

[0055] import hashlib

[0056] #Assume that the subkey and expression UID are byte type

[0057] sub_key=b"your_sub_key"

[0058] emoji_uid=b"your_emoji_uid"

[0059] #Concatenate subkey and expression UID

[0060] combined_data=sub_key+emoji_uid

[0061] #Perform SHA-256 hash operation

[0062] hash_object=hashlib.sha256(combined_data)

[0063] authentication_code=hash_object.hexdigest()

[0064] print("Anti-counterfeiting authentication identification code:",authentication_code)

[0065] The national encryption algorithm module obtains the algorithm's software implementation library from the manufacturer, adds the source files and static library files in the algorithm library to the encryption module, configures the compilation environment, and calls the encryption and decryption functions provided by the algorithm library in the encryption module code.

[0066] This application directly uses the algorithm software implementation library provided by the manufacturer. There is no need for developers to write complex national secret algorithm code from scratch, which reduces the development workload, shortens the development cycle, and improves the project development efficiency. The national secret algorithm itself has high security. Introducing it into the encryption module can enhance the encryption strength of the entire system, effectively protect the security of data during transmission and storage, and prevent data from being stolen or tampered with.

[0067] The key management module is managed based on the PSAM card. After the key is generated, it is stored in the encryption area of ​​the PSAM card. The PSAM card hardware encrypts the storage of the master key and the working key, and backs up the key off-site. When the label is issued, the PSAM card allocates the working key to the electronic label and encrypts the transmission for dynamic distribution.

[0068] The PSAM card in this application has a hardware encryption function, which stores the master key and working key in its encryption area, and can effectively resist physical attacks and side-channel attacks. The hardware encryption mechanism is implemented at the chip level, and the encryption process is more difficult to crack and tamper with, which greatly improves the security of key storage and protects core key assets; backing up the keys off-site can prevent the loss of keys due to local disasters, equipment failure or human damage.

[0069] The encryption module is encrypted based on the national encryption algorithm. The encryption formula is:

[0070] K data =KD SM1 (K master , DF) = KD SM1 (K master , UID ‖ Sector)

[0071] Where K data is the data area key, KD SM1 is the key distribution function of the SM1 algorithm, K master is the master key, DF is the dispersion factor, and Sector is the sector number;

[0072] Master Key K master With the dispersion factor DF as input, the key dispersion function KD of the SM1 hardware module SM1 After processing, the output is the key K data .

[0073] This application uses the SM1 hardware module to implement key dispersion and encryption operations. The hardware itself has a physical protection mechanism that can prevent side-channel attacks and physical-level tampering threats. The hardware module encrypts keys and data, reducing the risk of software-level attacks and further improving the security of the system. The data area key is generated by the master key and dispersion factor, which simplifies the complexity of key management.

[0074] Reference Figure 2 As shown, the anti-counterfeiting detection module includes an identification unit, a transmission unit and a record storage unit, wherein the identification unit is used to read the UID and encrypted data of the RFID electronic tag to identify and determine whether it is a legal electronic tag. After determining that it is legal, the transmission unit performs secure data interaction, and the record storage unit records the identification and judgment operation process in real time and generates a record log;

[0075] The specific operation steps of the anti-counterfeiting detection module are as follows:

[0076] B1. The RFID reader sends a query message to activate the electronic tags within the range. The tags respond and send the UID and encrypted data.

[0077] B2. Send the UID, extract the tag UID, sector number and dispersion factor, identify and authenticate, and determine whether it is legal;

[0078] B3. After judging the legality, data exchange processing is carried out. During the data exchange process, the subkey is used to encrypt the data;

[0079] B4. The record storage unit records the authentication result and operation log locally or uploads it to the server. The log content includes the tag UID, authentication time and operation type.

[0080] The identification unit of the present application reads the UID and encrypted data of the RFID electronic tag and performs identification and judgment, which can accurately distinguish between legal and illegal electronic tags. By authenticating the UID, sector number and dispersion factor information, it greatly improves the anti-counterfeiting capability and prevents counterfeit and shoddy products from entering the system; the transmission unit only conducts secure data interaction after determining that the tag is legal, and uses a subkey to encrypt the data during the interaction process, further enhancing the confidentiality and integrity of data transmission.

[0081] The identification judgment is performed by storing the UIDs of all legal electronic tags in a static list. After reading the UID of the electronic tag, it is compared one by one with the UIDs in the list. If a match is found, the electronic tag is judged to be a legal tag; if no match is found, it is judged to be an illegal tag.

[0082] This application creates a list to store UIDs and uses basic loops and comparison operations to determine the legitimacy of tags. It is easy to implement and deploy for developers with limited technical capabilities or systems with limited resources. The management of static lists is very convenient. When you need to add or delete legal tags, you only need to modify the list accordingly. The list can be updated at any time according to actual business needs to ensure that the system can promptly identify new legal tags or exclude tags that are no longer used.

[0083] Before the transmission unit conducts a secure data transaction, the transmission unit and the legitimate electronic tag negotiate a symmetric key through a secure channel, encrypt the data to be sent to the electronic tag using the negotiated symmetric key, and send it to the electronic tag. After receiving the encrypted data, the electronic tag uses the same symmetric key to decrypt it and obtain the original data. Based on the encrypted data, both parties use a message authentication code to verify the integrity of the data and conduct interactive transmission.

[0084] The present application negotiates symmetric keys through a secure channel, thereby avoiding the risk of keys being stolen or tampered with during transmission. The secure channel can use encryption technology and identity authentication methods to ensure that only the transmission unit and the legitimate electronic tag can participate in the key negotiation process. Once the symmetric key is negotiated, both parties use the key to encrypt the data. Even if the data is intercepted during transmission, the attacker cannot decrypt and obtain sensitive information without the corresponding key, thereby effectively protecting the confidentiality of the data. Compared with asymmetric encryption algorithms, symmetric encryption algorithms have higher encryption and decryption efficiency. During the data interaction process, the use of negotiated symmetric keys for encryption and decryption operations can quickly process large amounts of data, reduce communication delays, and improve communication efficiency. This is particularly important for application scenarios with high real-time requirements, such as communication between IoT devices and real-time monitoring systems.

[0085] The record storage unit records the identification and judgment operation process in real time, and generates a record log. The record storage selects a combined log, configures a log collector in the record storage unit, and sends the log information to the log collector for storage; the log classification includes time, operation type and result composition.

[0086] This application log contains time, operation type and result classification information. When a problem occurs in the system, the time clue can be used to quickly locate the time when the specific operation occurred. Combined with the operation type and result, it can accurately determine which link has a problem. If the result is abnormal after an anti-counterfeiting identification operation is performed at a specific time, the program, hardware or data related to the operation can be checked in detail. By analyzing the log, the execution time and frequency of different operation types can be counted to discover performance bottlenecks in the system. If the execution time of a certain operation type is too long, it may mean that the program code corresponding to the operation needs to be optimized, or that the related hardware resources are insufficient.

[0087] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments, and the above embodiments and descriptions only describe the principles of the present invention. The present invention may be subject to various changes and improvements without departing from the spirit and scope of the present invention, and these changes and improvements fall within the scope of the present invention claimed.

Claims

1. An RFID electronic tag encryption system based on a national secret algorithm, characterized in that: include: Label key dispersion module, national secret algorithm module, key management module, encryption module and anti-counterfeiting detection module; The tag key dispersion module disperses the tag UID key based on the PSAM card to generate an anti-counterfeiting authentication identification code; The national secret algorithm module integrates the SM1 and SM7 national secret algorithms into the encryption module to perform encryption operations; The key management module manages and stores keys during label issuance and use based on the PSAM card; The encryption module uses the national secret algorithm to encrypt the tag UID and the sector area number as the dispersion factor information to generate the data area key; The anti-counterfeiting detection module identifies and detects the encrypted RFID electronic tag to check whether it is legal, and transmits data after authentication.

2. According to the RFID electronic tag encryption system based on the national secret algorithm according to claim 1, it is characterized in that: The steps for the tag key dispersion module to generate the anti-counterfeiting authentication identification code are as follows: A1. Input parameters, including the tag's UID and master key; A2, based on the PSAM card, use the master key and tag UID to input, generate a subkey based on the AES algorithm, combine the subkey with the expression UID, and generate an anti-counterfeiting authentication identification code through hash operation; The AES algorithm block length is 128 bits. When generating subkeys, the initial key is first split into "words" and stored in the extended key array. The round constant corresponding to each round is determined, and the array is filled according to the rules. If the current word sequence number is divisible by the number of initial key words, the previous byte is first word-looped and byte-replaced, and then XORed with the word at the number of initial key words, and finally XORed with the round constant; the calculation is continued until the array is filled. These words constitute the subkeys required for each round of AES encryption.

3. The RFID electronic tag encryption system based on the national secret algorithm according to claim 2 is characterized in that: In step A2, the hash operation is performed based on the SHA-256 algorithm to generate a 256-bit hash value. The key and UID are concatenated to obtain M=K||UID. The hash operation is performed using the following formula: H=SHA256(M)=SHA256(K||UID) Where H is the anti-counterfeiting authentication identification code, SHA256 is the hash function algorithm, M is the data in the input hash function, and K is the key.

4. The RFID electronic tag encryption system based on the national secret algorithm according to claim 1 is characterized in that: The national encryption algorithm module obtains the algorithm's software implementation library from the manufacturer, adds the source files and static library files in the algorithm library to the encryption module, configures the compilation environment, and calls the encryption and decryption functions provided by the algorithm library in the encryption module code.

5. The RFID electronic tag encryption system based on the national secret algorithm according to claim 1 is characterized in that: The key management module is managed based on the PSAM card. After the key is generated, it is stored in the encryption area of ​​the PSAM card. The PSAM card hardware encrypts the storage of the master key and the working key, and backs up the key off-site. When the label is issued, the PSAM card allocates the working key to the electronic label and encrypts the transmission for dynamic distribution.

6. The RFID electronic tag encryption system based on the national secret algorithm according to claim 1 is characterized in that: The encryption module is encrypted based on the national encryption algorithm. The encryption formula is: K data =KD SM1 (K master ,DF)=KD SM1 (K master ,UID ‖ Sector) Where K data is the data area key, KD SM1 is the key distribution function of the SM1 algorithm, K master is the master key, DF is the dispersion factor, and Sector is the sector number; Master Key K master With the dispersion factor DF as input, the key dispersion function KD of the SM1 hardware module SM1 After processing, the output is the key K data .

7. The RFID electronic tag encryption system based on the national secret algorithm according to claim 1 is characterized in that: The anti-counterfeiting detection module includes an identification unit, a transmission unit and a record storage unit. The identification unit is used to read the UID and encrypted data of the RFID electronic tag to identify and determine whether it is a legal electronic tag. After determining that it is legal, the transmission unit performs secure data exchange. The record storage unit records the identification and judgment operation process in real time and generates a record log. The specific operation steps of the anti-counterfeiting detection module are as follows: B1. The RFID reader sends a query message to activate the electronic tags within the range. The tags respond and send the UID and encrypted data. B2. Send the UID, extract the tag UID, sector number and dispersion factor, identify and authenticate, and determine whether it is legal; B3. After judging the legality, data exchange processing is carried out. During the data exchange process, the subkey is used to encrypt the data; B4. The record storage unit records the authentication result and operation log locally or uploads it to the server. The log content includes the tag UID, authentication time and operation type.

8. The RFID electronic tag encryption system based on the national secret algorithm according to claim 7 is characterized in that: The identification judgment is performed by storing the UIDs of all legal electronic tags in a static list. After reading the UID of the electronic tag, it is compared one by one with the UIDs in the list. If a match is found, the electronic tag is judged to be a legal tag; if no match is found, it is judged to be an illegal tag.

9. The RFID electronic tag encryption system based on the national secret algorithm according to claim 7 is characterized in that: Before the transmission unit conducts a secure data transaction, the transmission unit and the legitimate electronic tag negotiate a symmetric key through a secure channel, encrypt the data to be sent to the electronic tag using the negotiated symmetric key, and send it to the electronic tag. After receiving the encrypted data, the electronic tag uses the same symmetric key to decrypt it and obtain the original data. Based on the encrypted data, both parties use a message authentication code to verify the integrity of the data and conduct interactive transmission.

10. The RFID electronic tag encryption system based on the national secret algorithm according to claim 7 is characterized in that: The record storage unit records the identification and judgment operation process in real time, and generates a record log. The record storage selects a combined log, configures a log collector in the record storage unit, and sends the log information to the log collector for storage; the log classification includes time, operation type and result composition.

Images