CN103929308A - Information verification method applied to RFID card - Google Patents

Information verification method applied to RFID card Download PDF

Info

Publication number
CN103929308A
CN103929308A CN201410168419.8A CN201410168419A CN103929308A CN 103929308 A CN103929308 A CN 103929308A CN 201410168419 A CN201410168419 A CN 201410168419A CN 103929308 A CN103929308 A CN 103929308A
Authority
CN
China
Prior art keywords
rfid card
information
card
card reader
rfid
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN201410168419.8A
Other languages
Chinese (zh)
Other versions
CN103929308B (en
Inventor
吴江
李陈
陶源
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
JIAXING CHENXIANG INFORMATION TECHNOLOGY Co Ltd
Original Assignee
JIAXING CHENXIANG INFORMATION TECHNOLOGY Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by JIAXING CHENXIANG INFORMATION TECHNOLOGY Co Ltd filed Critical JIAXING CHENXIANG INFORMATION TECHNOLOGY Co Ltd
Priority to CN201410168419.8A priority Critical patent/CN103929308B/en
Publication of CN103929308A publication Critical patent/CN103929308A/en
Application granted granted Critical
Publication of CN103929308B publication Critical patent/CN103929308B/en
Expired - Fee Related legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Abstract

The invention provides a high-security information verification method applied to an RFID card. The information verification method applied to the RFID card comprises the following processes, firstly, whether the connection between a card reader and an RFID card is legal or not is judged, and if the connection between the card reader and the RFID card is legal, the following steps are executed: (1) the card reader sends verification information to the RFID card, the verification information is a set of raw information at least comprising one-time identification codes of verification of this time, or the verification information is first encrypted information obtained by processing the raw information; (2) the RFID card processes the verification information to obtain second encrypted information; (3) the card reader reads the second encrypted information and transmits the second encrypted information to a server for verification, verification succeeds if verification values obtained through operation of the raw information by the server is identical to the second encrypted information, and otherwise the verification fails, or, the verification succeeds if the data obtained by decryption of the second encrypted information by the server is identical to the raw information, and otherwise the verification fails.

Description

Be applied to the Information Authentication method of rfid card
Technical field
The present invention relates to Information Authentication technical field, is specifically a kind of Information Authentication method that is applied to rfid card.
Background technology
(Radio Frequency IDentification, abbreviation: RFID) RFID is a kind of wireless communication technology, can identify specific objective and read and write related data by radio signals, and without setting up machinery between recognition system and specific objective or optics contacts, RFID technology is widely used, such as the RFID mass transit card being widely known by the people.
OTP (One-Time Password) is the abbreviation (password was used and cancelled) of one-time password, and the appearance of OTP is mainly the fragility that solves original static password, and most OTP adopt two-factor authentication principle to realize.If authenticate a system, first you need to have a password generator (being referred to as below token) that belongs to yourself so.
Time synchronized based on token and server, generates consistent dynamic password by computing, the token based on time synchronized, and general turnover rate is 60 seconds, within every 60 seconds, produces a new password.
Based on existing token, token can face following problem:
Storage time needs clock chip, and needs certain electric power and can not interrupt, and in the time of cannot changing battery, just can only more renew token so run into the situations such as battery electric power is finished.
Clock chip can run into precision problem, if clock chip timekeeping performance is not enough, or owing to occurring that other reasons causes the time to produce error, needs to proofread and correct in time when error arrives certain limit, if exceed correcting range, can only more renew token.
At present, rfid card is also application to some extent aspect the Information Authentication based on OTP technology, such as the Chinese patent document that Granted publication is CN203466832U disclosed " a kind of dynamic token system based on NFC ", it can pass through mobile phone, dull and stereotyped, the various equipment with NFC function such as computer, with bank, finance etc. needs the system of dynamic token authentication to carry out communication, complete dynamic token authentication, although easy to use, practical, but may there is certain potential safety hazard in this class rfid card in Information Authentication process, reason is, this class rfid card card is interior without battery, it relies on antenna that the operation energy is provided, therefore can not store current time, and current time whether consistent with server one end be authentication precondition, if use time-based certificate scheme, current time can only obtain from card reader, and once current time is tampered, to produce potential safety hazard thus, fail safe reduces, if there is illegal person on legal rfid card side, he gives the legal RFID following time of input, legal rfid card obtains this time to carry out computing and obtains corresponding validation value password in other words, illegal person reads this validation value again, illegal person utilizes this validation value just can be at the time in the described future server of out-tricking, said process is exactly in brief, illegal person utilizes described legal rfid card to extract in advance disposal password.
Summary of the invention
Technical problem to be solved by this invention is, overcomes the defect of prior art, and a kind of Information Authentication method that is applied to rfid card of high security is provided, for adopting the Information Authentications such as network payment, credit report inquiry of RFID technology that safety guarantee is provided.
For solving the problems of the technologies described above, the present invention proposes a kind of Information Authentication method that is applied to rfid card, it comprises following process, first judge between card reader and rfid card, contact whether legal, if so, carry out following steps, 1) card reader sends authorization information to rfid card, this authorization information is at least comprising one group of raw information of this checking one-off recognition code, or this authorization information is for to process to described raw information the first enciphered message obtaining; 2) rfid card is processed and is obtained the second enciphered message authorization information; 3) card reader reads the second enciphered message and sends server to and verifies, if the validation value that described in server operation, raw information obtains is identical with the second enciphered message, be verified, otherwise checking is not passed through, or, if server is deciphered the second enciphered message, to obtain data identical with raw information, be verified, otherwise checking do not passed through.
Adopt after said structure, compared with prior art, the present invention has the following advantages: due to before checking, also need to judge that whether card reader and rfid card both sides are legal, only have legal can further verifying, if illegal, between card reader and rfid card, can not continue proof procedure, proof procedure will interrupt, simultaneously, when checking, the present invention possesses checking one-off recognition code this time, such as this time verifies that one-off recognition code is the order number of a random code or the current transaction of user, this checking one-off recognition code is unique and cannot obtain in advance in current time, this time checking one-off recognition code is by the basic prerequisite of checking, therefore, even if changed current time, also cannot obtain the second enciphered message that can pass through, so the present invention has advantages of high security.
As improvement, first cryptographic Hash of described authorization information for described raw information or the first enciphered message are carried out to Hash operation acquisition, like this, transmit the first cryptographic Hash and there is the short and small advantage of data at Data processing, possess the advantage of versatility, high efficiency, fail safe simultaneously.
As improvement, described the second enciphered message is the second cryptographic Hash; The process that obtains this second cryptographic Hash is, first rfid card is encrypted computing to authorization information and obtains enciphered message, then rfid card carries out Hash operation to obtain the second cryptographic Hash to this enciphered message, like this, after encryption, the second cryptographic Hash that also utilization coding operation rule (Hash operation) obtains is as the second enciphered message, like this, transmit the second cryptographic Hash and there is the short and small advantage of data at Data processing, possess the advantage of versatility, high efficiency, fail safe simultaneously.
As improvement, rfid card waits for that after receiving authorization information user is confirmed whether to verify, if so, perform step 2), like this, the control whether checking is carried out is transferred to user, there will not be rfid card automatically to start checking, and, after contacting whether legal being decrypted between card reader and rfid card, whether user can also carry out in final decision checking, and the raising of fail safe is had to certain help.
As improvement, substriber validation method is inputted password for user in card reader, and card reader sends to rfid card by this password, rfid card judges whether password accurately determines whether verifying, like this, card reader and rfid card, without hardware modification, are more conveniently implemented to the present invention on original hardware.
As improvement, substriber validation method is located at the switch of rfid card for user operation, and this switch triggering rfid card verifies, like this, fail safe is higher.
As improvement, whether legal method can be also to judge card reader and rfid card both sides: 1) card reader produces the first random number backup, and this first random number sends to rfid card; 2) rfid card produces the second random number and using the second random number as character string, is connected to the second random number and usings this as the 3rd random number, utilizes the 3rd random number described in secret key encryption, and this ciphertext is sent to card reader; 3) the backup comparison of first half first random number of the decruption key decrypting ciphertext value of obtaining for card reader, if consistent, rfid card is legal, otherwise illegal; 4) card reader sends to rfid card by the latter half of the value of obtaining after decrypt ciphertext, legal if rfid card compares consistent card reader by itself and the backup of the second random number, otherwise illegal.Like this, only need one-time authentication can judge that whether both sides are all legal, guaranteeing, under the prerequisite of fail safe, to have shortened checking flow process.
As improvement, order number when this time checking one-off recognition code is customer transaction, like this, is more conducive to the compatibility with existing payment system, reduces improvement cost.
Embodiment
Below the present invention is further detailed explanation:
The applicable rfid card of the present invention is the rfid card with certain computing capability, refers generally to CPU type rfid card; Take and adopt RSA token to illustrate as example, before using rfid card, first, in rfid card, deposit RSA private key in and whether between card reader and rfid card, contact legal middle rfid card key used judging, the server of far-end is preserved RSA private key, and whether between card reader and rfid card, contacting legal middle rfid card key used judging, the server of far-end also can be preserved RSA PKI and use for checking.
The present invention is applied to the Information Authentication method of rfid card, it comprises following process, first judge between card reader and rfid card, contact whether legal, if, carry out following steps, 1) card reader sends authorization information to rfid card, and this authorization information is at least comprising one group of raw information containing this checking one-off recognition code, or this authorization information is for to process to described raw information the first enciphered message obtaining, 2) rfid card is processed and is obtained the second enciphered message authorization information, 3) card reader reads the second enciphered message and sends server to and verifies, if the validation value that described in server operation, raw information obtains is identical with the second enciphered message, be verified, otherwise checking is not passed through, described in server operation, the process of raw information and rfid card are in full accord, it is the calculating process of server operation and the algorithm of use obtains the whole calculating process of the second enciphered message with rfid card by raw information and the algorithm of use is identical, or, if server is deciphered the second enciphered message, to obtain data identical with raw information, be verified, otherwise checking is not passed through, such as, card reader sends raw information to rfid card, then rfid card is encrypted and obtains the second enciphered message raw information, card reader reads the second enciphered message and sends server to, server is deciphered the second enciphered message and is obtained data and compare with raw information, if identical, be verified, otherwise checking is not passed through.
Raw information simply form forms, such as the character string of described current time, this checking one-off recognition code sequentially connects the total character string obtaining, this process is called for short character string and connects, in like manner, if comprise other checking information, described current time, this checking one-off recognition code, other checkings sequentially connect by the character string of information the total character string obtaining.
1) in, card reader sends authorization information to rfid card and can change, such as, authorization information is expressly, what send is the one group of raw information that at least comprises this checking one-off recognition code, or, authorization information is that raw information is carried out to the cryptographic Hash after Hash operation, or, authorization information is the data that cleartext information is further encoded and obtained, coding can be to use base64 algorithm, Quote-Printable algorithm etc. coding method, or, authorization information is the information after encrypting, what send is that described raw information is encrypted to the ciphertext obtaining, this encryption can be with aes algorithm, RSA Algorithm etc. encryption technology, or, authorization information is that ciphertext is further carried out to the cryptographic Hash that Hash operation obtains, or, authorization information is the data that cipher-text information is further encoded and obtained.
2) in, rfid card is processed and is obtained the second enciphered message and can change authorization information, such as, the ciphertext obtaining after authorization information is encrypted is directly as the second enciphered message, this encryption can be by aes algorithm, RSA Algorithm etc. existing encryption technology, or, ciphertext is further processed and obtained the second enciphered message, described further processing can be the cryptographic Hash that obtains of Hash operation as the second enciphered message, also can adopt the data that obtain after the coding method calculation process such as base64 as the second enciphered message for the situation with spcial character.
In this example, first cryptographic Hash of described authorization information for described raw information or the first enciphered message are carried out to Hash operation acquisition; Described the second enciphered message is the second cryptographic Hash; The process that obtains this second cryptographic Hash is, first rfid card is encrypted computing to authorization information and obtains enciphered message, and then rfid card carries out Hash operation to obtain the second cryptographic Hash to this enciphered message.
Described Hash operation is SHA256 hash algorithm.
Rfid card waits for that after receiving the first cryptographic Hash user is confirmed whether to verify, if so, performs step 2).
Substriber validation method is inputted password for user in card reader, and card reader sends to rfid card by this password, and rfid card judges whether password accurately determines whether verifying.
In this example, substriber validation method is located at the switch of rfid card for user operation, and this switch triggering rfid card verifies, this can adopt the voltage that changes a pin in the chip of rfid card by switch to be used as triggering signal, does not add and repeats.
Whether legal method is to judge card reader and rfid card both sides: 1) card reader produces the first random number backup, and this first random number sends to rfid card; 2) rfid card produces the second random number and using the second random number as character string, is connected to the second random number and usings this as the 3rd random number, utilizes the 3rd random number described in secret key encryption, and this ciphertext is sent to card reader; 3) the backup comparison of first half first random number of the decruption key decrypting ciphertext value of obtaining for card reader, if consistent, rfid card is legal, otherwise illegal; 4) card reader sends to rfid card by the latter half of the value of obtaining after decrypt ciphertext, legal if rfid card compares consistent card reader by itself and the backup of the second random number, otherwise illegal.Like this, only need one-time authentication can judge that whether both sides are all legal, guaranteeing, under the prerequisite of fail safe, to have shortened checking flow process
Whether legal method can be also to judge card reader and rfid card both sides: as improvement, whether legal method is to judge card reader and rfid card both sides: 1) card reader produces random number backup, and this random number sends to rfid card; 2) rfid card utilizes random number generating ciphertext described in secret key encryption, and this ciphertext is sent to card reader; 3) value that card reader obtains with decruption key decrypting ciphertext compares with backup, if consistent, rfid card is legal, otherwise data and described ciphertext comparison after illegal or card reader is encrypted backup with encryption key, if consistent, rfid card is legal, otherwise illegal; 4) card reader is used access key access rfid card, rfid card authentication secret, if explanation card reader identical with the built-in access key of card is legal, otherwise illegal, like this, increased and cracked difficulty, fail safe is better.
Order number when this time checking one-off recognition code is customer transaction; This time checking one-off recognition code can be also one group of information, such as comprising proving time, order number, user name etc.

Claims (8)

1. an Information Authentication method that is applied to rfid card, it is characterized in that, it comprises following process, first judge between card reader and rfid card, contact whether legal, if so, carry out following steps, 1) card reader sends authorization information to rfid card, this authorization information is at least comprising one group of raw information of this checking one-off recognition code, or this authorization information is for to process to described raw information the first enciphered message obtaining; 2) rfid card is processed and is obtained the second enciphered message authorization information; 3) card reader reads the second enciphered message and sends server to and verifies, if the validation value that described in server operation, raw information obtains is identical with the second enciphered message, be verified, otherwise checking is not passed through, or, if server is deciphered the second enciphered message, to obtain data identical with raw information, be verified, otherwise checking do not passed through.
2. the Information Authentication method that is applied to rfid card according to claim 1, is characterized in that, first cryptographic Hash of described authorization information for described raw information or the first enciphered message are carried out to Hash operation acquisition.
3. the Information Authentication method that is applied to rfid card according to claim 1, is characterized in that, described the second enciphered message is the second cryptographic Hash; The process that obtains this second cryptographic Hash is, first rfid card is encrypted computing to authorization information and obtains enciphered message, and then rfid card carries out Hash operation to obtain the second cryptographic Hash to this enciphered message.
4. the Information Authentication method that is applied to rfid card according to claim 1, is characterized in that, rfid card waits for that after receiving authorization information user is confirmed whether to verify, if so, performs step 2).
5. the Information Authentication method that is applied to rfid card according to claim 4, it is characterized in that, substriber validation method is inputted password for user in card reader, and card reader sends to rfid card by this password, and rfid card judges whether password accurately determines whether verifying.
6. the Information Authentication method that is applied to rfid card according to claim 4, is characterized in that, substriber validation method is located at the switch of rfid card for user operation, and whether this switch triggering rfid card is verified.
7. the Information Authentication method that is applied to rfid card according to claim 1, it is characterized in that, judge between card reader and rfid card and contact whether legal method is: 1) card reader produces the first random number backup, and this first random number sends to rfid card; 2) rfid card produces the second random number and using the second random number as character string, is connected to the second random number and usings this as the 3rd random number, utilizes the 3rd random number described in secret key encryption, and this ciphertext is sent to card reader; 3) first half of the decruption key decrypting ciphertext value of obtaining and the backup comparison of the first random number for card reader, if consistent, rfid card is legal, otherwise illegal; 4) card reader sends to rfid card by the latter half of the value of obtaining after decrypt ciphertext, and rfid card is by the backup comparison of itself and the second random number, if consistent, card reader is legal, otherwise illegal.
8. the Information Authentication method that is applied to rfid card according to claim 1, is characterized in that, order number when this time checking one-off recognition code is customer transaction.
CN201410168419.8A 2014-04-01 2014-04-25 Information Authentication method applied to rfid card Expired - Fee Related CN103929308B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201410168419.8A CN103929308B (en) 2014-04-01 2014-04-25 Information Authentication method applied to rfid card

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN2014101284015 2014-04-01
CN201410128401 2014-04-01
CN201410128401.5 2014-04-01
CN201410168419.8A CN103929308B (en) 2014-04-01 2014-04-25 Information Authentication method applied to rfid card

Publications (2)

Publication Number Publication Date
CN103929308A true CN103929308A (en) 2014-07-16
CN103929308B CN103929308B (en) 2017-07-18

Family

ID=51147393

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201410168419.8A Expired - Fee Related CN103929308B (en) 2014-04-01 2014-04-25 Information Authentication method applied to rfid card

Country Status (1)

Country Link
CN (1) CN103929308B (en)

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104486758A (en) * 2014-12-30 2015-04-01 浙江工业大学 Method for encrypting wireless sensor network in intelligent medical system
CN104992211A (en) * 2015-07-24 2015-10-21 沈阳工程学院 Copy protection RFID electronic tag system and method therefor
CN107346383A (en) * 2016-09-09 2017-11-14 天地融科技股份有限公司 A kind of authorization method and system
CN107911223A (en) * 2017-11-23 2018-04-13 上海众人网络安全技术有限公司 A kind of method and device for intersecting signature
CN108833095A (en) * 2018-06-25 2018-11-16 北京奇虎科技有限公司 Behavior verification method, node, system and electronic equipment in block chain
CN113645614A (en) * 2021-07-26 2021-11-12 珠海格力电器股份有限公司 Data transmission method and device, electronic equipment and storage medium
CN113837700A (en) * 2021-01-11 2021-12-24 台州动产质押金融服务有限公司 Warehousing supervision method based on RFID (radio frequency identification) tag

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1932835A (en) * 2006-09-30 2007-03-21 华中科技大学 Safety identification method in radio frequency distinguishing system
CN101038619A (en) * 2007-02-06 2007-09-19 中国科学院研究生院 Radio frequency recognition system privacy identification method
CN101051903A (en) * 2007-03-30 2007-10-10 中山大学 RFID random key two-way certifying method accord with EPC C1G2 standard
CN101882994A (en) * 2009-05-06 2010-11-10 上海华虹集成电路有限责任公司 Triple authentication method based on block cipher
CN102510335A (en) * 2011-11-10 2012-06-20 西北工业大学 RFID (Radio Frequency Identification Device) mutual authentication method based on Hash
US20130166902A1 (en) * 2010-09-06 2013-06-27 Gemalto Sa Simplified smartcard personalization method, and corresponding device

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1932835A (en) * 2006-09-30 2007-03-21 华中科技大学 Safety identification method in radio frequency distinguishing system
CN101038619A (en) * 2007-02-06 2007-09-19 中国科学院研究生院 Radio frequency recognition system privacy identification method
CN101051903A (en) * 2007-03-30 2007-10-10 中山大学 RFID random key two-way certifying method accord with EPC C1G2 standard
CN101882994A (en) * 2009-05-06 2010-11-10 上海华虹集成电路有限责任公司 Triple authentication method based on block cipher
US20130166902A1 (en) * 2010-09-06 2013-06-27 Gemalto Sa Simplified smartcard personalization method, and corresponding device
CN102510335A (en) * 2011-11-10 2012-06-20 西北工业大学 RFID (Radio Frequency Identification Device) mutual authentication method based on Hash

Cited By (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104486758A (en) * 2014-12-30 2015-04-01 浙江工业大学 Method for encrypting wireless sensor network in intelligent medical system
CN104486758B (en) * 2014-12-30 2017-12-29 浙江工业大学 The encryption method of radio sensing network in intelligent medical system
CN104992211A (en) * 2015-07-24 2015-10-21 沈阳工程学院 Copy protection RFID electronic tag system and method therefor
CN104992211B (en) * 2015-07-24 2017-11-21 沈阳工程学院 A kind of RFID system and method for anti-copying
CN107346383A (en) * 2016-09-09 2017-11-14 天地融科技股份有限公司 A kind of authorization method and system
CN107346383B (en) * 2016-09-09 2019-12-10 天地融科技股份有限公司 authorization method and system
CN107911223A (en) * 2017-11-23 2018-04-13 上海众人网络安全技术有限公司 A kind of method and device for intersecting signature
CN107911223B (en) * 2017-11-23 2021-03-09 上海众人网络安全技术有限公司 Cross signature method and device
CN108833095A (en) * 2018-06-25 2018-11-16 北京奇虎科技有限公司 Behavior verification method, node, system and electronic equipment in block chain
CN108833095B (en) * 2018-06-25 2022-01-25 北京奇虎科技有限公司 Behavior verification method, node, system and electronic equipment in block chain
CN113837700A (en) * 2021-01-11 2021-12-24 台州动产质押金融服务有限公司 Warehousing supervision method based on RFID (radio frequency identification) tag
CN113645614A (en) * 2021-07-26 2021-11-12 珠海格力电器股份有限公司 Data transmission method and device, electronic equipment and storage medium

Also Published As

Publication number Publication date
CN103929308B (en) 2017-07-18

Similar Documents

Publication Publication Date Title
US10609014B2 (en) Un-password: risk aware end-to-end multi-factor authentication via dynamic pairing
US11856104B2 (en) Methods for secure credential provisioning
CN106797311B (en) System, method and storage medium for secure password generation
CN103929308A (en) Information verification method applied to RFID card
CN107896147B (en) Method and system for negotiating temporary session key based on national cryptographic algorithm
CN110189442A (en) Authentication method and device
CN101483654A (en) Method and system for implementing authentication and data safe transmission
EP3398289B1 (en) A method, system and apparatus using forward-secure cryptography for passcode verification
KR101450291B1 (en) Server for authenticating smart chips and method thereof
US10547451B2 (en) Method and device for authentication
KR20180003113A (en) Server, device and method for authenticating user
CN102739403A (en) Identity authentication method and device for dynamic token
CN106100854A (en) The reverse authentication method of terminal unit based on authority's main body and system
KR20180000849A (en) Biometric card for encrypting card information using biometric crptosystem and biometric data and user authentication method thereof
US10771970B2 (en) Method of authenticating communication of an authentication device and at least one authentication server using local factor
EP3185504A1 (en) Security management system for securing a communication between a remote server and an electronic device
KR20170130963A (en) Apparatus for authenticating user in association with user-identification-registration and local-authentication and method for using the same
WO2018024603A1 (en) A method for generating a modified one-time password allowing to authenticate the user for which it has been generated
CN108243156B (en) Method and system for network authentication based on fingerprint key
JPH0199158A (en) Terminal authorizing method
KR20140007627A (en) Ic chip

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant
CF01 Termination of patent right due to non-payment of annual fee

Granted publication date: 20170718