Security authentication method and device of radio frequency card, electronic equipment, medium and chip

Abstract

The application discloses a kind of security authentication method, device, electronic equipment, medium and chip related to the field of radio frequency identification technology of radio frequency card, the method comprises: in response to the authentication instruction issued by card reader, generate first random number;Determine the target detection method matched with the demand authentication rate;According to the randomness of the first random number, the detection result about the first random number is determined according to the target detection method;In the case where it is determined that the detection result meets the random performance requirement, first ciphertext is sent to the card reader to carry out authentication process;The first ciphertext is the encryption result based on the first random number.The method can ensure the randomness of random number in authentication process, improve the security of radio frequency card authentication.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of radio frequency identification, and in particular to a security authentication method and device for a radio frequency card, an electronic device, a medium and a chip. BACKGROUND

[0002] In the related art, in the process of entry authentication of a radio frequency card, random data and encryption algorithms are used to disperse and conceal data in order to ensure the concealment of authentication keys in the channel, thereby ensuring the security of channel data. However, if the random number is attacked, the security of authentication cannot be ensured, and the risk of key leakage is increased. SUMMARY

[0003] Therefore, it is necessary to provide a security authentication method and device for a radio frequency card, an electronic device, a medium and a chip, which can improve the security of the use process of the radio frequency card.

[0004] A security authentication method for a radio frequency card is applied to a radio frequency card, and the method comprises the following steps.

[0005] In response to an authentication instruction issued by a card reader, a first random number is generated.

[0006] A target detection method that matches a required authentication rate is determined.

[0007] The randomness of the first random number is detected according to the target detection method, and a detection result about the first random number is determined.

[0008] If it is determined that the detection result meets the randomness requirement, a first ciphertext based on an encryption result of the first random number is sent to the card reader to perform an authentication process.

[0009] A security authentication device for a radio frequency card is applied to a radio frequency card, and the device comprises the following.

[0010] A receiving module is configured to receive an authentication instruction issued by a card reader.

[0011] An authentication module is configured to generate a first random number based on the authentication instruction.

[0012] A determination module is configured to determine a target detection method that matches a required authentication rate from among a plurality of detection methods according to the required authentication rate.

[0013] A detection module is configured to detect the randomness of the first random number according to the target detection method, and determine a detection result about the first random number.

[0014] The authentication module is configured to send a first ciphertext to the card reader for an authentication process if the detection result meets the random performance requirement, wherein the first ciphertext is an encryption result of the first random number.

[0015] An electronic device includes a memory and a processor, the memory storing a computer program, and the processor implementing the following steps when executing the computer program:

[0016] receiving an authentication instruction issued by the card reader and generating a first random number based on the authentication instruction;

[0017] According to the required authentication rate, determine a target detection method that matches the required authentication rate in the set detection method;

[0018] According to the target detection method, detect the randomness of the first random number, and determine a detection result about the first random number;

[0019] If the detection result meets the random performance requirement, send a first ciphertext to the card reader for an authentication process, wherein the first ciphertext is an encryption result of the first random number.

[0020] A computer readable storage medium having a computer program stored thereon, the computer program being executed by a processor to implement the following steps:

[0021] receiving an authentication instruction issued by the card reader and generating a first random number based on the authentication instruction;

[0022] According to the required authentication rate, determine a target detection method that matches the required authentication rate in the set detection method;

[0023] According to the target detection method, detect the randomness of the first random number, and determine a detection result about the first random number;

[0024] If the detection result meets the random performance requirement, send a first ciphertext to the card reader for an authentication process, wherein the first ciphertext is an encryption result of the first random number.

[0025] A chip includes a memory and a processor, the memory storing a computer program, characterized in that the processor implements the above-mentioned security authentication method of the radio frequency card when executing the computer program.

[0026] The security authentication method, device, electronic equipment, medium and chip of the radio frequency card can detect the randomness of the random number generated by the radio frequency card by using a target detection method matched with the required authentication rate, and the radio frequency card sends the first ciphertext to the card reader for the authentication process when it is determined that the random number meets the randomness requirement, so that the random number generated by the radio frequency card has randomness, the randomness of the channel data is ensured, and the security of the key and data of the radio frequency card is ensured. BRIEF DESCRIPTION OF DRAWINGS

[0027] Figure 1 An interaction diagram of a radio frequency card and a card reader in the related art is shown.

[0028] Figure 2 A flowchart of a security authentication method of a radio frequency card in an embodiment is shown.

[0029] Figure 3 A radio frequency card authentication flowchart including random number detection in an embodiment is shown.

[0030] Figure 4 A flowchart of using a chi-square detection method to detect the randomness of the first random number in an embodiment is shown.

[0031] Figure 5 A flowchart of protecting against exhaustive attacks in an embodiment is shown.

[0032] Figure 6 A control flowchart of a protection scheme against exhaustive attacks in an embodiment is shown.

[0033] Figure 7 A flowchart of a three-round authentication method of a radio frequency card in an embodiment is shown.

[0034] Figure 8 An authentication interaction diagram between a radio frequency card and a card reader in an embodiment is shown.

[0035] Figure 9 A structural block diagram of a security authentication device of a radio frequency card in an embodiment is shown. DETAILED DESCRIPTION

[0036] In order to make the purposes, technical solutions and advantages of the present application clearer, the present application is further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0037] Before the technical solutions of the embodiments of the present application are described in detail, the working principle of the radio frequency card in the related art is briefly described.

[0038] Radio frequency cards integrate computer technology, automatic control technology, network communication technology, smart card technology, sensing technology, pattern recognition technology, and mechatronics technology. They are mainly used in automatic fare collection systems for buses, ferries, and subways, and are also applied in access control, identity verification, and electronic wallets.

[0039] The RFID card complies with the near-field communication protocol ISO / IEC 14443. The communication layer (i.e., the RFID interface) of the RFID card complies with Parts 2 and 3 of the near-field communication protocol ISO / IEC 14443 standard. The security layer of the RFID card supports domain-verified CRYPTO1 data stream encryption.

[0040] Reference Figure 1 As shown, Figure 1 The diagram illustrates the interaction between the RFID card and the reader. In the RFID card, the chip is connected to a multi-turn antenna coil and embedded in a plastic package, forming a passive, contactless card. The RFID card does not have any battery; its power source is generated by the radio carrier wave transmitted from the reader's antenna and coupled to the RFID card's antenna. This power typically reaches 2V or higher, supplying power to the chip on the RFID card, which operates at a frequency of 13.56MHz. When the RFID card approaches the reader's antenna, the high-speed RF communication interface transmits data at a rate of 106 kBit / s.

[0041] During the operation of the RFID card, in the entry authentication stage, in order to ensure the concealment of the authentication key in the channel, random data and the CRYPTO1 encryption algorithm are used to discretize and conceal the data, ensuring that intruders cannot obtain effective information from the channel and thus ensuring the security of the channel data. Therefore, the randomness of the random number becomes the key to the authentication security of the RFID card, ensuring the randomness of the channel data and protecting the security of the authentication.

[0042] Random numbers are sequences of numbers generated using a specific algorithm and a seed value. They can simulate a normal distribution that a truly random algorithm might produce, appearing random in a seemingly random manner. However, if the random source of an RFID card is attacked, the random numbers generated will no longer be random. Furthermore, if patterns appear in the channel data, intruders can deduce or guess the generation pattern of the random numbers. By analyzing and cracking these patterns, they can deduce the keys used in encryption algorithms, increasing the risk of key leakage.

[0043] Based on this, this application provides a security authentication method for radio frequency cards, which can protect the security of the radio frequency card authentication process by detecting the generated random number and protecting the randomness of the random number.

[0044] The implementation details of the technical solutions in the embodiments of this application are described in detail below.

[0045] In one embodiment, as shown in FIG. 1, a security authentication method for a radio frequency card is provided, which can include the following steps: Figure 2

[0046] Step S201, in response to an authentication instruction issued by a card reader, a first random number is generated.

[0047] Here, mutual authentication is required between the radio frequency card and the card reader to ensure the security and reliability of communication. Such mutual authentication usually involves the card reader sending an authentication instruction to the radio frequency card, and the radio frequency card generating a first random number in response to the authentication instruction issued by the card reader. The radio frequency card can be a Mifare card.

[0048] In practical applications, the radio frequency card can use a random number generation algorithm to generate random numbers. Common random number generation algorithms include pseudo-random number generation algorithms and true random number generation algorithms. Pseudo-random number generation algorithms generate seemingly random number sequences through deterministic calculation processes, while true random number generation algorithms generate truly random numbers using the uncertainty of physical processes.

[0049] Step S202, determine a target detection method that matches the required authentication rate.

[0050] Here, in order to ensure that the generated first random number has random properties, the randomness of the first random number needs to be detected. In practical applications, there are many methods for detecting the randomness of random numbers. Here are some commonly used methods for detecting the randomness of random numbers:

[0051] (1) Statistical test: Statistical test can detect whether the random number meets the expected distribution, such as uniform distribution, normal distribution, etc. Common statistical tests can include frequency test, sequence test, chi-square test, etc.

[0052] (2) Linear complexity test: Linear complexity test can detect whether the random number has a certain linear complexity. By calculating the length of the shortest linear feedback shift register of the random number sequence, the quality of the random number is evaluated.

[0053] (3) Matrix test: Matrix test can detect whether the random number sequence has certain independence and uniformity. The test will convert the random number sequence into a matrix and detect the eigenvalues and eigenvectors of the matrix to evaluate the quality of the random number.

[0054] (4) Block test: Block test can detect whether there are repeated blocks in the random number. The test will divide the random number into several blocks and detect whether there are repeated subsequences in each block to evaluate the quality of the random number.

[0055] ​(5) Nonlinear complexity test. The nonlinear complexity test can detect whether the random number has a certain nonlinear property. The test calculates the length of the shortest nonlinear feedback shift register of the random number to evaluate the quality of the random number.

[0056] For different random number randomness detection methods, there will be differences in detection time. Different methods require different calculation and analysis processes, so their execution times may differ. Generally speaking, statistical tests and block tests are relatively fast methods because these two methods only require simple calculation and comparison operations on random numbers. Linear complexity tests and nonlinear complexity tests require more complex calculations, so these two methods take longer to execute. Matrix tests require matrix operations and eigenvalue calculations, so their execution times are also relatively long.

[0057] In addition, the length of the random number also affects the detection time. Longer random numbers require more calculations and analysis, so their detection times may be longer.

[0058] It can be understood that the authentication between the radio frequency card and the card reader should be completed within a reasonable time range to ensure user experience and system response speed. The generation of random numbers and randomness detection during the authentication process directly affect the total time consumption of the authentication. The more complex and time-consuming randomness tests can make the authentication process slower. Therefore, the appropriate target detection method should be selected according to the required authentication rate, so as to ensure the randomness of the random number while trying to control the time consumption of the authentication process to improve user experience and system response speed.

[0059] In one embodiment, the selectable random performance detection methods include the bit detection method and the chi-square detection method. The detection rate of the bit detection method is higher than that of the chi-square detection method. Therefore, in application scenarios that require faster authentication speed, the bit detection method can be selected to detect the randomness of the first random number. In application scenarios that do not have high requirements for authentication speed, the chi-square detection method can be selected to detect the randomness of the first random number.

[0060] In actual applications, different authentication speed application scenarios are quantified using the required authentication rate. When the required authentication rate is greater than or equal to a first threshold, it is considered to be in an application scenario that requires faster authentication speed. When the required authentication rate is less than the first threshold, it is considered to be in an application scenario that does not have high requirements for authentication speed.

[0061] It should be noted that, according to actual application requirements, the target detection method can be set to other detection methods other than the chi-square detection method and the bit detection method, as long as the required authentication rate is met.

[0062] Step S203, detecting the randomness of the first random number according to the target detection method, and determining the detection result about the first random number.

[0063] Here, after determining the target detection method, the first random number is processed and analyzed according to the target detection method, the randomness of the first random number is comprehensively evaluated, and the detection result about the first random number is determined.

[0064] In one embodiment, the randomness of the first random number is detected using a bit detection method, which is used to detect the randomness of each bit in the random number, and the randomness of the random number can be evaluated by counting the frequency distribution of the bit. Specifically, the number of 0s and 1s in the first random number can be counted to determine the ratio of the number of 0s and 1s in the first random number.

[0065] It should be noted that in the case where the first random number is not binary, the first random number can be first converted to binary format, and then the ratio of the number of 0s and 1s in the first random number is determined; in another way, the ratio of the number of each bit corresponding to the data format to which the first random number belongs can be directly counted, for example, assuming that the first random number is a quaternary data format, the number of 0s, 1s, 2s and 3s in the first random number is counted respectively, and the corresponding number ratio is determined respectively.

[0066] In actual application, when the first random number has randomness, the number of each bit in the first random number is close, so that the randomness of the first random number can be reflected by the number ratio of each bit.

[0067] As shown in Figure 3 , a radio frequency card authentication process schematic diagram containing random number detection is shown. Figure 3

[0068] Step 1, the card reader issues an authentication instruction.

[0069] Step 2, the radio frequency card generates a random number.

[0070] Step 3, calculate the ratio of 0s and 1s in the binary data of the random number.

[0071] Step 4, determine whether the ratio of 0s and 1s satisfies 50%+x. If it is satisfied, step 5 is executed, and if it is not satisfied, step 6 is executed.

[0072] Step 5, the generated random number participates in the authentication process.

[0073] Step 6, the radio frequency card enters a safe state.

[0074] In one embodiment, as shown in Figure 4 ​As shown, the random performance of the first random number is detected using a chi-square detection method.

[0075] Step S401, the first random number is split into a plurality of test data of a set data format.

[0076] Step S402, the data value range defined by the set data format is divided into k non-intersecting intervals.

[0077] Step S403, the first frequency and the second frequency of the test data contained in the ith interval are determined.

[0078] Step S404, according to the first frequency and the second frequency, the bias value corresponding to the first random number is determined.

[0079] Here, the first random number is split according to the set data format to obtain a plurality of test data with a data size of a set data size, for example, the first random number is 512 bits, and the first random number is split every 4 bits to obtain 128 hexadecimal test data.

[0080] The set data format defines a corresponding data value range, which is divided into k (k≥2) non-intersecting intervals according to the data value range, for example, assuming that the test data is hexadecimal, the corresponding value range is 0~15, and thus the value range is divided into 16 different intervals.

[0081] In an ideal case, the plurality of test data will fall into each interval evenly, so that the first frequency can be obtained by dividing the number of test data obtained by the number of intervals k, for example, with 128 hexadecimal test data, in an ideal case, the test data falling into each interval is 8, that is, the interval with value "0" contains 8 hexadecimal test data, the interval with value "1" contains 8 hexadecimal test data, and so on.

[0082] After dividing the k intervals, the actual number of 128 hexadecimal test data obtained by the unified division falling into each interval is obtained, and thus the second frequency is obtained.

[0083] In practice, the number of test data actually contained in each interval will deviate from the first frequency, wherein the bias value can be calculated by the chi-square formula, specifically, wherein, represents the bias value, represents the second frequency corresponding to the ith interval, represents the first frequency corresponding to the ith interval, which is obtained by can reflect the deviation between the actual observation value and the theoretical inference value.

[0084] It can be understood that if the first random number has randomness, the second frequency number will approach the first frequency number in an ideal state, that is, the deviation between the first frequency number and the second frequency number is small, so that the detect the randomness of the first random number.

[0085] Step S204, in the case where it is determined that the detection result meets the randomness requirement, the first ciphertext is sent to the card reader for authentication process.

[0086] After determining the detection result about the first random number, it can be determined whether the first random number meets the randomness requirement, wherein the randomness requirement defines that the generation process of the random number has the characteristics of unpredictability and reproducibility, that is, the generated random number is irregular, thereby ensuring the security of the first random number.

[0087] In general, the randomness requirement includes the following aspects:

[0088] (1) Uniformity: The random source should be able to generate all possible values within a given range, and the probability of each value appearing should be equal, so as to ensure that the generated random number is uniformly distributed.

[0089] (2) Independence: The generated random numbers should be independent of each other, that is, the generation of a random number should not be affected by the previously generated random numbers, so as to ensure that the generated random numbers are truly random.

[0090] (3) Unpredictability: The random source should have the characteristic of unpredictability, that is, the next random number cannot be predicted by the generated random numbers, so as to ensure that the generation process of the random number is secure and not easy to be attacked.

[0091] (4) Long periodicity: The random source should have a long period, that is, the generated random numbers in the period will not be repeated, so as to ensure that the generated random numbers remain random over a long period of time.

[0092] In the case where it is determined that the first random number meets the randomness requirement according to the detection result of the first random number, it indicates that the first random number has randomness, which can ensure the security of the authentication, and then the first ciphertext obtained by encrypting the first random number by the radio frequency card is allowed to be sent to the card reader to perform the subsequent authentication process.

[0093] In one embodiment, in the process of detecting the randomness of the first random number using the bit detection method, a finite 0-1 sequence is considered. If the sequence is sufficiently random, the probabilities of 1 and 0 appearing in the sequence should be the same, and as the length of the sequence increases, the probabilities should tend to 50%. Based on this, the calculated quantity ratio is compared with the set value range, so as to determine whether the first random number meets the randomness requirement.

[0094] Taking the quantity ratio obtained by the number of 0 and 1 of the first random number in the statistical binary as an example, the set value range can be set to 50% ± x, where x represents the allowable error range, and the value of x is determined by the randomness of the random number, the length of the sequence, and the severity of the detection, that is, in the case where the quantity ratio tends to 50%, it can be determined that the first random number meets the randomness requirement.

[0095] In one embodiment, in the process of detecting the randomness of the first random number using the chi-square detection method, a reasonable standard deviation value is determined according to the number of test data and the actual scene requirement. By comparing the calculated deviation value with the standard deviation value, it can be determined whether the first random number meets the randomness requirement. Specifically, when the deviation value is less than the standard deviation value, it means that the randomness of the first random number is good, and the first random number can be used. When the deviation value is greater than the standard deviation value, it means that the randomness of the first random number is poor, and the first random number fails the chi-square test and cannot be used for subsequent authentication.

[0096] In one embodiment, the determination of the standard deviation value is described. The standard deviation value is determined according to the preset significance level and the degrees of freedom. In this embodiment, the degrees of freedom are determined according to the k intervals divided, and specifically, the degrees of freedom = k-1.

[0097] The significance level is generally set to 0.05 or 0.01, and needs to be determined according to the specific research purpose and the requirements of the field.

[0098] After the degrees of freedom and the significance level are determined, the corresponding standard deviation value can be obtained by looking up the chi-square distribution table or using computer software. The chi-square distribution table lists the standard deviation values under different degrees of freedom and significance levels, and the corresponding standard deviation value can be found in the table according to the degrees of freedom and the significance level. When using computer software for chi-square detection, the software will automatically calculate the corresponding standard deviation value according to the degrees of freedom and the significance level.

[0099] In one embodiment, assuming that the generated first random number has regularity, continuing to use the first random number for subsequent authentication will be easily broken by intruders to compromise the security of the radio frequency card, based on which, in the case of determining that the first random number does not meet the randomness requirement, the radio frequency card will not send the first ciphertext to the card reader, and the radio frequency card will be controlled to enter a safe state.

[0100] The radio frequency card will not be able to perform further verification or operation in the safe state, thereby protecting sensitive data or functions in the radio frequency card and preventing unauthorized access or attack.

[0101] In the safe state of the radio frequency card, the following effects usually occur:

[0102] (1) Authentication failure: the radio frequency card cannot pass the verification request to perform identity authentication and cannot obtain access permission.

[0103] (2) Function restriction: some functions or operations of the radio frequency card are prohibited or limited, such as unable to read or write data, unable to execute some instructions, etc.

[0104] (3) Unable to unlock: the radio frequency card is in a safe state and usually cannot be unlocked by conventional means, and special measures or specific keys are required to remove it.

[0105] In actual application, when the intruder attacks the random source of the radio frequency card by using voltage, temperature, laser irradiation, etc., the generated random number may no longer have randomness, at which time the random number randomness protection mechanism is triggered to avoid the radio frequency card sending the random number with predictability to the card reader, and the radio frequency card is controlled to enter a safe state to prevent further damage by the intruder.

[0106] In the above embodiment, it is used to solve the problem that the random source is destroyed to cause the random number to no longer have randomness, which threatens the authentication security of the radio frequency card.

[0107] In the process of the radio frequency card performing verification, it also faces the problem of exhaustive attack. The main purpose of the radio frequency card sending the first ciphertext to the card reader after encrypting the first random number is to keep the plaintext secret to prevent intruders from knowing. The attempt of the intruder to analyze the first ciphertext is called attack, the intruder can intercept channel data to obtain information about the key or plaintext, if the intruder does not master enough information to recover the plaintext, it is difficult to crack. If the intruder tries every possible key by exhaustion and checks whether the obtained ciphertext has meaning, it will also not guarantee the security of the key and data.

[0108] For the exhaustive attack, the key problem is how to shorten the cracking time, if the time required by the cracking algorithm is greater than the value of the encrypted data, then the encrypted data will be protected. In practical applications, the speed of the exhaustive attack is determined by the number of keys to be tested and the test speed of each key. The key length of the radio frequency card is fixed, that is, the number of keys is certain, so the test speed of each key is limited, thereby providing protection for the radio frequency card against the exhaustive attack.

[0109] The following embodiment illustrates how to protect against the exhaustive attack, as shown in Figure 5 , a flowchart for protecting against the exhaustive attack is shown. Figure 5

[0110] Step S501, in the authentication process, record the number of authentication failures.

[0111] Step S502, in the case where the number of authentication failures reaches a second threshold, control the radio frequency card to enter a safe state.

[0112] Here, after the radio frequency card sends the first ciphertext to the card reader, the subsequent authentication process will be performed. In the authentication process, the number of authentication failures is recorded. When the number of authentication failures reaches a certain number, the radio frequency card is controlled to enter a safe state, and further verification or operation cannot be performed. The user needs to take the card to the card center to unlock, thereby limiting the number of authentication failures of the radio frequency card, increasing the test data for verifying each key in the exhaustive attack, greatly increasing the trial and error cost, and thereby avoiding the risk of key leakage caused by the exhaustive attack.

[0113] In practical applications, the second threshold is determined by the design strength of the protection. The greater the protection strength, the smaller the second threshold set.

[0114] It should be noted that in this embodiment, even if the chip of the radio frequency card is powered off, the recorded number of failures will not be cleared, that is, the number of authentication failures will be accumulated.

[0115] As shown in Figure 6 , a schematic diagram of the protection scheme against the exhaustive attack is shown. Figure 6

[0116] Step 1, start the authentication process

[0117] Step 2, determine whether the key is correct. If the key is correct, perform step 3; if the key is incorrect, perform step 4.

[0118] Step 3, in the case where the key is correct, determine that the authentication is passed.

[0119] ​​Step 4, if the key is incorrect, it is determined whether the number of trial and error times is reached. If the number of trial and error times is not reached, step 1 is returned to perform a new round of authentication process. If the number of trial and error times is reached, step 5 is performed.

[0120] Step 5, in the case where the number of trial and error times is reached, the radio frequency card is controlled to enter a safe state.

[0121] In an embodiment, the authentication mechanism between the radio frequency card and the card reader is a three-round authentication mechanism. The three-round authentication mechanism is described below from the radio frequency card side. As shown in Figure 7 Figure 7 a flowchart of a three-round authentication method of a radio frequency card is shown.

[0122] Step S701, the second ciphertext returned by the card reader is received.

[0123] Here, after the radio frequency card sends the first ciphertext to the card reader, the card reader will perform decryption processing on the first ciphertext to obtain the decryption result of the first ciphertext, which belongs to the first round of authentication.

[0124] The radio frequency card can receive the second ciphertext returned by the card reader, and the second ciphertext is obtained by encrypting the decryption result of the first ciphertext and the second random number by the card reader, wherein the second random number is generated by the random source of the card reader.

[0125] Step S702, the second ciphertext is decrypted to obtain the decryption result of the first ciphertext and the second random number.

[0126] Here, the radio frequency card performs decryption processing on the received second ciphertext, and can obtain the decryption result of the first ciphertext and the second random number from the second ciphertext, wherein the decryption result of the first ciphertext here is essentially the first random number received by the card reader.

[0127] Step S703, it is detected whether the decryption result of the first ciphertext is consistent with the first random number.

[0128] In actual application, if the card reader decrypts the first ciphertext using the key agreed in advance, in this case, the decryption result of the first ciphertext is consistent with the first random number, and since the intruder does not know the specific key, in this case, the decrypted data is inconsistent with the unencrypted data, so as to fail to pass the authentication.

[0129] Based on this, the radio frequency card needs to compare the decryption result of the first ciphertext with the first random number to determine whether the decryption result of the first ciphertext is consistent with the first random number, so that the card reader can pass the authentication of the radio frequency card.

[0130] Among them, steps S702-S703 constitute the second round of authentication in the three-round authentication. ​

[0131] Step S704, in the case where the decryption result of the first ciphertext is consistent with the first random number, the third ciphertext is sent to the card reader.

[0132] Here, after the card reader authenticates the radio frequency card, the radio frequency card sends the third ciphertext to the card reader, so that the card reader verifies the radio frequency card based on the third ciphertext. The third ciphertext is obtained by the radio frequency card encrypting the decrypted second random number.

[0133] Similarly, it is determined whether the decryption result of the third ciphertext is consistent with the generated second random number, so as to determine whether the radio frequency card can pass the authentication of the card reader, which constitutes the third round of authentication in the three-round authentication.

[0134] In the process of the three-round authentication, the card reader and the radio frequency card both use the triple data encryption algorithm (3DES, Triple Data Encryption Algorithm) to encrypt data.

[0135] As shown in Figure 8 , a schematic diagram of authentication interaction between the radio frequency card and the card reader is shown. The authentication process between the radio frequency card and the card reader will be described below. Figure 8 Figure 8 Step 1: The card reader sends an authentication instruction to the radio frequency card.

[0136] Step 2: After the card reader receives the authentication instruction, the random source of the card reader generates a random number M and encrypts the random number M. The encrypted random number M is sent to the card reader.

[0137] Step 3: After receiving, the card reader decrypts the encrypted random number M to obtain M', and then encrypts M' and the random number N generated by the card reader after splicing processing. The encrypted M'+N is sent to the radio frequency card.

[0138] Step 4: After receiving, the radio frequency card decrypts the encrypted M'+N, checks M', and determines whether M' is consistent with M. If it is wrong, the authentication fails and the authentication process is exited. If it is consistent, the subsequent authentication process is continued.

[0139] Step 5: The random number N is encrypted to obtain N', which is sent to the card reader.

[0140] Step 6, after receiving N', the card reader decrypts N' and checks whether the decryption result obtained after decrypting N' is consistent with the random number N. If it is wrong, the authentication fails and the authentication process is exited. If it is consistent, the authentication is passed.

[0141]

[0142] ​​It should be noted that the generated random number M needs to be detected in step 2 to determine whether the random source of the radio frequency card is attacked, and when it is detected that the random number M does not meet the random performance requirement, any data sent to the card reader will be rejected, thereby causing the authentication process of steps 3-6 to fail, so that the video card cannot pass the three-round authentication, and the purpose of protecting the data is achieved.

[0143] In one embodiment, in the process of three-round authentication, data is encrypted by a key. In actual application, the radio frequency card and the card reader are both equipped with two different keys, namely key A and key B. Whether key A or key B is used depends on the design of the radio frequency card and the authentication protocol. In general, the card reader will indicate which key needs to be used through the identification bit or instruction in the authentication request when sending the authentication request. The radio frequency card determines the target key used in the current authentication process according to the set identification bit of the received authentication instruction, and performs encryption and decryption operations based on the target key, so as to obtain the first ciphertext after encryption of the first random number.

[0144] In one embodiment, the scenario of authentication failure in three-round authentication is described.

[0145] In the process of three-round authentication, there are two nodes that can determine whether the authentication fails. The first node is the radio frequency card confirming whether the decryption result of the first ciphertext is consistent with the first random number. When it is determined that the decryption result of the first ciphertext is not consistent with the first random number, it indicates that the authentication fails, and the authentication process will be exited. At this time, the number of authentication failures needs to be updated. The second node is the card reader confirming whether the decryption result of the third ciphertext is consistent with the second random number. When it is determined that the decryption result of the third ciphertext is not consistent with the second random number, it indicates that the authentication fails, and the authentication process will be exited. At this time, the number of authentication failures also needs to be updated. That is, the radio frequency card and the card reader are considered to be authenticated successfully only through three-round authentication. If an error occurs in one of the links, it will be determined that the authentication fails.

[0146] In the above embodiment, by detecting the random performance of the random number generated by the radio frequency card, it can be avoided that the random source generates a random number with regularity due to attack, thereby ensuring the randomness of the random number, preventing data tampering and leakage, and ensuring the integrity and security of the data in the authentication process. When an intruder attacks by testing the keys one by one, the exhaustive attack protection mechanism will be triggered, the radio frequency card will enter a safe state, and data and key leakage will be prevented.

[0147] In one embodiment, a secure authentication device of a radio frequency card is provided, as shown in Figure 9 The secure authentication device 900 of the radio frequency card can include a generation module 901, a determination module 902, a detection module 903, and an authentication module 904.

[0148] The generation module 901 is configured to generate a first random number in response to an authentication instruction issued by the card reader; the determination module 902 is configured to determine a target detection method matched with the required authentication rate; the detection module 903 is configured to detect randomness of the first random number according to the target detection method, and determine a detection result of the first random number; the authentication module 904 is configured to send the first ciphertext based on the first random number to the card reader to perform an authentication process, in a case where the detection result meets the randomness requirement.

[0149] In one embodiment, the determination module 902 is specifically configured to determine the bit detection method as the target detection method in a case where the required authentication rate is greater than or equal to a first threshold; and determine the chi-square detection method as the target detection method in a case where the required authentication rate is less than the first threshold.

[0150] In one embodiment, in a case where the target detection method is the bit detection method, the detection module 903 is specifically configured to determine a ratio of the number of 0s to the number of 1s in the first random number according to the number of 0s and the number of 1s in the first random number.

[0151] In one embodiment, before sending the first ciphertext to the card reader to perform the authentication process, the detection module 903 is specifically configured to compare the ratio with a set value range to determine whether the first random number meets the randomness requirement.

[0152] In one embodiment, in a case where the target detection method is the chi-square detection method, the detection module 903 is specifically configured to split the first random number into a plurality of test data in a set data format; wherein a data size of each test data is a set data size; divide a data value range defined by the set data format into k non-intersecting intervals, where k≥2; determine a first frequency and a second frequency of test data contained in an i-th interval; the first frequency represents a number of test data that the i-th interval should contain in an ideal case; the second frequency represents a number of test data that the i-th interval contains in an actual case; and determine a deviation value corresponding to the first random number according to the first frequency and the second frequency.

[0153] In one embodiment, before sending the first ciphertext to the card reader to perform the authentication process, the detection module 903 is specifically configured to determine whether the first random number meets the randomness requirement according to the deviation value and a standard deviation value.

[0154] In an embodiment, before determining whether the first random number meets the random performance requirement according to the bias value and the standard deviation value, the detection module 903 is specifically configured to determine a degree of freedom of chi-square detection according to the divided k intervals; and determine the standard deviation value in a chi-square distribution table according to a preset significance level and the degree of freedom.

[0155] In an embodiment, the authentication module 904 is further configured to, in a case where the first random number does not meet the random performance requirement, control the radio frequency card to suspend sending the first ciphertext to the card reader, and control the radio frequency card to be in a security state; and functions of the radio frequency card are limited in the security state.

[0156] In an embodiment, after sending the first ciphertext to the card reader for the authentication process, the authentication module 904 is further configured to record a number of authentication failures in the process of authentication; and in a case where the number of authentication failures reaches a second threshold value, control the radio frequency card to enter the security state; and functions of the radio frequency card are limited in the security state.

[0157] In an embodiment, the authentication process is a three-round authentication process, and after sending the random number encrypted based on the key to the card reader, the authentication module 904 is further configured to receive second ciphertext returned by the card reader; the second ciphertext is obtained by the card reader encrypting a decryption result of the first ciphertext and a second random number generated by the card reader; decrypt the second ciphertext to obtain the decryption result of the first ciphertext and the second random number; detect whether the decryption result of the first ciphertext is consistent with the first random number; in a case where it is determined that the decryption result of the first ciphertext is consistent with the first random number, send third ciphertext to the card reader, so that the card reader determines an authentication result of the radio frequency card based on a decryption result of the third ciphertext and the second random number sent by the card reader; and the third ciphertext is an encryption result of the second random number decrypted by the radio frequency card.

[0158] In an embodiment, the authentication module 904 is specifically configured to, in a case where it is determined that the decryption result of the first ciphertext is not consistent with the first random number, update the number of authentication failures; and in a case where the decryption result of the third ciphertext is authenticated as not consistent with the second random number sent by the card reader, update the number of authentication failures.

[0159] In an embodiment, the authentication module 904 is specifically configured to determine a target key used in the authentication process according to a set identification bit of the authentication instruction, encrypt the first random number based on the target key to generate the first ciphertext.

[0160] The specific limitation of the security authentication device of the radio frequency card can refer to the limitation of the security authentication method of the radio frequency card in the above, which will not be described here. Each module in the security authentication device of the radio frequency card can be realized by software, hardware and their combination in whole or in part. The above modules can be embedded in or independent of the processor in the computer device in hardware form, or can be stored in the memory in the computer device in software form, so that the processor calls and executes the operation corresponding to each module.

[0161] In one embodiment, an electronic device is provided, comprising a memory and a processor, the memory stores a computer program, and the processor implements a security authentication method of a radio frequency card when executing the computer program.

[0162] In one embodiment, a computer storage medium is provided, which stores a computer program, and the computer program is executed by a processor to implement a security authentication method of a radio frequency card.

[0163] It should be noted that the logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a list of executable instructions for implementing logic functions, which can be embodied in any computer-readable medium for use by or in connection with an instruction execution system, apparatus or device, such as a computer-based system, a system including a processor or other system that can fetch the instructions from an instruction execution system, apparatus or device and execute the instructions, or in conjunction with these instruction execution systems, apparatus or devices. For the purpose of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transport programs for use by or in connection with an instruction execution system, apparatus or device, or in conjunction with these instruction execution systems, apparatus or devices. More specific examples (non-exhaustive list) of computer-readable medium include the following: electrical connections (electronic devices) having one or more wires, portable computer diskettes (magnetic devices), random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memories), fiber optic devices, and portable compact disk read-only memories (CDROM). In addition, the computer-readable medium can even be paper or other suitable medium on which the program can be printed, because the program can be obtained electronically, for example, by optical scanning of the paper or other medium, followed by editing, interpreting or otherwise processing the obtained program with the aid of a computer, and then storing it in a computer memory, if necessary.

[0164] It should be understood that various parts of the present application can be implemented in hardware, software, firmware or a combination thereof. In the above embodiments, various steps or methods can be implemented in software or firmware that is stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, any of the following technologies, known in the art, or their combinations can be used: discrete logic circuitry having logic gates for implementing logic functions upon data signals, application specific integrated circuits having appropriate combinational logic gates, programmable gate arrays (PGA), field programmable gate arrays (FPGA), and the like.

[0165] In the description of the present application, the description of the terms "one embodiment", "some embodiments", "an example", "a specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In the present specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0166] In addition, the terms "first", "second" are only for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the technical features indicated. Therefore, the features defined with "first", "second" can explicitly or implicitly include at least one of the features. In the description of the present application, the meaning of "a plurality of" is at least two, for example, two, three, etc., unless otherwise explicitly specified.

[0167] Although the embodiments of the present application have been shown and described above, it should be understood that the above embodiments are exemplary and cannot be construed as limiting the present application, and those skilled in the art can make changes, modifications, replacements and variations to the above embodiments within the scope of the present application.

Claims

1. A security authentication method for a radio frequency card, characterized by, The method is applied to a radio frequency card, and comprises the following steps: In response to an authentication instruction issued by a card reader, a first random number is generated; A target detection method matching a required authentication rate is determined; The randomness of the first random number is detected according to the target detection method, and a detection result about the first random number is determined; in the case that the target detection method is a chi-square detection method, the first random number is split into a plurality of test data in a set data format; the data size of each test data is a set data size; a data value range defined by the set data format is divided into k non-intersecting intervals, where k is greater than or equal to 2; a first frequency and a second frequency of test data contained in the ith interval are determined; the first frequency represents the number of test data that the ith interval should contain under ideal conditions; the second frequency represents the number of test data that the ith interval contains under actual conditions; a deviation value corresponding to the first random number is determined according to the first frequency and the second frequency; whether the first random number meets a random performance requirement is determined according to the deviation value and a standard deviation value; the detection result is used to determine whether a random source for generating the random number is attacked; parameters of the target detection method are matched and set according to the required authentication rate, and the parameters include at least the number k of intervals, determination of degrees of freedom, and a significance level; In the case that the detection result meets the random performance requirement, a first ciphertext is sent to the card reader for an authentication process; the first ciphertext is an encryption result based on the first random number; when the deviation value is greater than the standard deviation value, it is determined that the first random number does not meet the random performance requirement, indicating that the random source for generating the first random number is attacked; the standard deviation value is determined by a chi-square distribution table according to a preset significance level and the degrees of freedom.

2. The security authentication method of a radio frequency card according to claim 1, characterized by, The target detection method matching the required authentication rate comprises the following steps: In the case that the required authentication rate is greater than or equal to a first threshold value, a bit detection method is determined as the target detection method; In the case that the required authentication rate is less than the first threshold value, a chi-square detection method is determined as the target detection method.

3. The security authentication method of a radio frequency card according to claim 1 or 2, characterized by, In the case that the target detection method is a bit detection method, the detection of the randomness of the first random number according to the target detection method to determine the detection result about the first random number comprises the following steps: According to the number of 0s and the number of 1s in the first random number, a number ratio of 0s and 1s in the first random number is determined.

4. The security authentication method of a radio frequency card according to claim 3, characterized by, Before the first ciphertext is sent to the card reader for the authentication process, the method comprises the following steps: The number ratio is compared with a set value range to determine whether the first random number meets the random performance requirement.

5. The security authentication method of a radio frequency card according to claim 1, characterized by, The method further comprises the following steps: In the case that the first random number does not meet the random performance requirement, the radio frequency card is controlled to suspend sending the first ciphertext to the card reader, and the radio frequency card is controlled to be in a safe state; the functions of the radio frequency card are limited in the safe state.

6. The security authentication method of a radio frequency card according to claim 1, characterized by, After the first ciphertext is sent to the card reader for the authentication process, the method comprises: In the process of authentication, the number of authentication failures is recorded; In the case where the number of authentication failures reaches a second threshold, the radio frequency card is controlled to enter a safe state; the functions of the radio frequency card are limited in the safe state.

7. The security authentication method of a radio frequency card according to claim 6, characterized by, The authentication process is a three-round authentication process, and after the random number encrypted based on the key is sent to the card reader, the method comprises: Receiving the second ciphertext returned by the card reader; the second ciphertext is obtained by the card reader based on the decryption result of the first ciphertext and the generated second random number; Decrypting the second ciphertext to obtain the decryption result of the first ciphertext and the second random number; Detecting whether the decryption result of the first ciphertext is consistent with the first random number; In the case where it is determined that the decryption result of the first ciphertext is consistent with the first random number, a third ciphertext is sent to the card reader to make the card reader determine the authentication result of the radio frequency card based on the decryption result of the third ciphertext and the second random number issued by the card reader; the third ciphertext is the encryption result of the second random number decrypted by the radio frequency card.

8. The security authentication method of a radio frequency card according to claim 7, characterized by, The number of authentication failures is recorded in the process of authentication, comprising: In the case where it is determined that the decryption result of the first ciphertext is inconsistent with the first random number, the number of authentication failures is updated; In the case where the decryption result of the third ciphertext is authenticated as inconsistent with the second random number issued by the card reader, the number of authentication failures is updated.

9. The security authentication method of a radio frequency card according to claim 1, characterized by, In the case where the detection result meets the random performance requirement, the first ciphertext is sent to the card reader for the authentication process, comprising: According to the set identification bit of the authentication instruction, the target key used in the authentication process is determined; Based on the target key, the first random number is encrypted to generate the first ciphertext.

10. A security authentication device for an RFID card, characterized in that, The device is applied to a radio frequency card, and the device comprises: A receiving module for receiving an authentication instruction issued by a card reader; An authentication module for generating a first random number based on the authentication instruction; A determination module for determining a target detection method matching the required authentication rate in a set detection method according to the required authentication rate. detecting a randomness of the first random number according to the target detection method, to determine a detection result of the first random number; in a case where the target detection method is a chi-square detection method, the first random number is split into a plurality of test data in a set data format; a data size of each test data is a set data size; a data value range defined by the set data format is divided into k disjoint intervals, where k>2; a first frequency and a second frequency of test data contained in an ith interval are determined; the first frequency represents a number of test data that the ith interval should contain in an ideal case; the second frequency represents a number of test data that the ith interval contains in an actual case; a bias value corresponding to the first random number is determined according to the first frequency and the second frequency; whether the first random number meets a randomness performance requirement is determined according to the bias value and a standard bias value; the detection result is used to determine whether a random source that generates a random number is attacked; parameters of the target detection method are matched and set according to the demand authentication rate, and the parameters include at least the number k of intervals, determination of a degree of freedom, and a significance level; an authentication module configured to, in a case where the detection result meets the randomness performance requirement, send a first ciphertext to the card reader for an authentication process; the first ciphertext is an encryption result of the first random number; in a case where the bias value is greater than the standard bias value, it is determined that the first random number does not meet the randomness performance requirement, indicating that the random source that generates the first random number is attacked; and the standard bias value is determined by a chi-square distribution table according to a preset significance level and the degree of freedom.

11. The security authentication apparatus of a radio frequency card according to claim 10, wherein The authentication module is further configured to, in a case where the first random number does not meet the randomness performance requirement, control the radio frequency card to suspend sending the first ciphertext to the card reader and control the radio frequency card to be in a safe state; functions of the radio frequency card are limited in the safe state.

12. The security authentication apparatus of a radio frequency card according to claim 11, wherein After the first ciphertext is sent to the card reader for the authentication process, the authentication module is further configured to: record a number of authentication failures in the process of authentication; in a case where the number of authentication failures reaches a second threshold, control the radio frequency card to enter the safe state; functions of the radio frequency card are limited in the safe state.

13. An electronic device comprising a memory and a processor, the memory storing a computer program, characterized in that, The processor implements the following steps when executing the computer program: receive an authentication instruction sent by the card reader, and generate a first random number based on the authentication instruction; determine a target detection method that matches a demand authentication rate in a set detection method according to the demand authentication rate, The randomness of the first random number is detected according to the target detection method, and a detection result about the first random number is determined; in a case where the target detection method is a chi-square detection method, the first random number is split into a plurality of test data in a set data format; a data size of each test data is a set data size; a data value range defined by the set data format is divided into k non-intersecting intervals, where k≥2; a first frequency and a second frequency of test data contained in an i-th interval are determined; the first frequency represents a number of test data that the i-th interval should contain in an ideal case; the second frequency represents a number of test data that the i-th interval contains in an actual case; a bias value corresponding to the first random number is determined according to the first frequency and the second frequency; whether the first random number meets a random performance requirement is determined according to the bias value and a standard deviation value; the detection result is used to determine whether a random source generating a random number is attacked; parameters of the target detection method are matched and set according to the demand authentication rate, and the parameters include at least the interval number k, determination of a degree of freedom, and a significance level; in a case where the detection result meets the random performance requirement, a first ciphertext is sent to the card reader for an authentication process; the first ciphertext is an encryption result of the first random number; in a case where the bias value is greater than the standard deviation value, it is determined that the first random number does not meet the random performance requirement, indicating that a random source generating the first random number is attacked; the standard deviation value is determined by a chi-square distribution table according to a preset significance level and the degree of freedom.

14. The electronic device of claim 13, wherein, The processor further implements the following steps when executing the computer program: in a case where the first random number does not meet the random performance requirement, the radio frequency card is controlled to pause sending the first ciphertext to the card reader, and the radio frequency card is controlled to be in a safe state; functions of the radio frequency card are limited in the safe state.

15. The electronic device of claim 14, wherein, The processor further implements the following steps when executing the computer program: in the process of authentication, the number of authentication failures is recorded; in a case where the number of authentication failures reaches a second threshold, the radio frequency card is controlled to enter a safe state; functions of the radio frequency card are limited in the safe state.

16. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the following steps: an authentication instruction issued by the card reader is received, and a first random number is generated based on the authentication instruction; a target detection method matched with the demand authentication rate is determined in a set detection method according to the demand authentication rate. According to the target detection method, randomness of the first random number is detected, and a detection result about the first random number is determined; in a case where the target detection method is a chi-square detection method, the first random number is split into a plurality of test data in a set data format; a data size of each test data is a set data size; a data value range defined by the set data format is divided into k non-intersecting intervals, where k>2; a first frequency and a second frequency of test data contained in an i-th interval are determined; the first frequency represents a number of test data that the i-th interval should contain in an ideal case; the second frequency represents a number of test data that the i-th interval contains in an actual case; according to the first frequency and the second frequency, a bias value corresponding to the first random number is determined; according to the bias value and a standard deviation value, whether the first random number meets a random performance requirement is determined; the detection result is used to determine whether a random source generating a random number is attacked; parameters of the target detection method are matched and set according to the demand authentication rate, and the parameters include at least the interval number k, determination of a degree of freedom, and a significance level; in a case where the detection result meets the random performance requirement, a first ciphertext is sent to the card reader to perform an authentication process; the first ciphertext is an encryption result of the first random number; in a case where the bias value is greater than the standard deviation value, it is determined that the first random number does not meet the random performance requirement, which represents that a random source generating the first random number is attacked; the standard deviation value is determined by a chi-square distribution table according to a preset significance level and the degree of freedom.

17. The computer-readable storage medium of claim 16, wherein, When the computer program is executed by the processor, the following steps are further implemented: In the process of performing authentication, the number of authentication failures is recorded; in a case where the number of authentication failures reaches a second threshold value, the radio frequency card is controlled to enter a safe state; functions of the radio frequency card are limited in the safe state.

18. A chip comprising a memory and a processor, the memory storing a computer program, characterized in that, The processor executes the computer program to implement the security authentication method of the radio frequency card in any one of claims 1 to 9.

Images