Contactless Access Card Security via UID-Based Key Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Contactless access card systems face security challenges in protecting data stored on the cards and communications between cards and card readers, as existing security mechanisms may not adequately prevent unauthorized access or data exposure.
Innovation Solution
The system generates a unique operation key for each access card using secret key generation algorithms, which is encrypted and stored, and employs a replacement key to control access to the encrypted operation key, using cryptographic keys and initialization vectors for encryption and decryption, ensuring enhanced security by validating the operation key before granting access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If contactless cards are used for proximity access, then convenience and speed of access are improved, but security risks increase due to potential unauthorized access and data exposure
Solution Approach 1:
The security system segments the authentication process into multiple independent layers: physical card presence verification, cryptographic key validation, operation key decryption, and authorized access control. Each layer operates independently to prevent unauthorized access while maintaining fast authentication when credentials are valid
Solution Approach 2:
A cryptographic intermediary layer is introduced between the physical card and the access control system. The operation key acts as a mediator that must be successfully decrypted and validated before access is granted, preventing direct unauthorized access to the card data while maintaining rapid authentication for legitimate users
2Object-affected harmful factors
If encryption is applied to protect data on contactless cards, then security is improved, but system complexity increases due to key management requirements
Solution Approach 1:
The operation key is pre-generated and pre-encrypted with a secret key during card provisioning. This preliminary action ensures that the card contains only encrypted cryptographic material, eliminating the need for complex runtime key generation and simplifying key management to storing and validating pre-computed cryptographic pairs
Solution Approach 2:
The card reader performs self-service by automatically generating the secret key locally and using it to decrypt the operation key without requiring external key management infrastructure. This eliminates complex centralized key management systems while maintaining strong encryption security
Data Source
AI summary
An access card may store an encrypted operation key and a key used to read the encrypted operation key from the access card. The encrypted operation key and the key may be based on a unique identifier (UID) of the access card. The encrypted operation key may be obtained by encrypting an operation key using a cryptographic key that is also based on the UID of the access card. An access card reader may read the UID from the access card and use it to generate the key used to read the encrypted operation key from the access card. The access card read may also use the UID read from the access card to generate a cryptographic key used to decrypt the encrypted operation key. The access card reader may validate the decrypted operation key and determine whether to grant or deny access, for example, via an access control device.