KR20100010012A - Rfid authentication apparatus for comprising authentication function and method thereof - Google Patents

Abstract

PURPOSE: An RFID authentication apparatus with an authentication function and a method thereof are provided to use authentication information and an authentication key, thereby checking whether a product is real. CONSTITUTION: A confirmation data generating unit(305) encrypts confirmation data using an output key. The confirmation data generating unit transmits the encrypted confirmation data to an authentication tag. A tag authentication unit(309) receives encrypted confirmation response data corresponding to the encrypted confirmation data from the authentication tag to decrypt. The tag authentication unit compares confirmation data with the decrypted confirmation response data. The tag authentication unit distinguishes whether the authentication tag is real.

Description

RFID authentication apparatus and method having an authentication function {RFID Authentication Apparatus for comprising Authentication Function and Method}

The present invention relates to an RFID authentication apparatus and method, and more particularly, to an RFID authentication apparatus and method having an authentication function.

The present invention is derived from the research conducted as part of the IT growth engine technology development project of the Ministry of Knowledge Economy and the Ministry of Information and Telecommunication Research and Development. [Task management number: 2005-S-106-04, Task name: Sensor tag for RFID / USN and Sensor node technology development].

Conventionally, an RFID device can be used for article distribution management. Such an RFID device may communicate according to the ISO / IEC 18000-6 protocol.

However, since the RFID tag of the RFID device cannot be excluded from the possibility of copying, it is not possible to secure the stability of the distribution of goods. Therefore, there is a need for an authentication server, an authentication reader, and an authentication tag that can verify the authenticity of the tag.

The problem to be solved by the present invention is to provide an RFID authentication device and method that can verify the authenticity of the product by using the authentication information and the authentication key.

RFID authentication apparatus according to an embodiment of the present invention for solving the above problems is determined an authentication key using the authentication information received from the authentication tag, and generates an output key using the determined authentication key and the arbitrarily generated input key A key data processing unit, an acknowledgment data generation unit for encrypting the confirmation data having a predetermined length using the output key, and transmitting the encrypted confirmation data to the authentication tag, and corresponding to the encrypted confirmation data. And a tag authenticator configured to receive the encrypted acknowledgment data from the authentication tag, decrypt the received acknowledgment data, compare the arbitrary acknowledgment data with the decrypted acknowledgment data, and authenticate the authentication tag.

RFID authentication method according to an embodiment of the present invention for solving the above problems is to determine the authentication key using the authentication information received from the authentication tag, and using the authentication key and the randomly generated input key output key Generating and encrypting confirmation data of a predetermined length using the output key, transmitting the encrypted confirmation data to the authentication tag, and encrypting the encrypted confirmation response data corresponding to the confirmation data. And receiving and decrypting from the authentication tag, and comparing the arbitrary verification data with the decrypted acknowledgment data, and authenticating the authentication tag.

RFID authentication apparatus and method according to an embodiment of the present invention can verify the authenticity of the product by authenticating the authentication tag using the authentication information and the authentication key. Therefore, when the RFID authentication device is utilized, the security of the tag can be improved.

Hereinafter, an RFID authentication system and method according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

An RFID system having an authentication function according to an embodiment of the present invention includes an authentication server, an authentication reader, and an authentication tag.

Here, the authentication tag may be an RFID tag that supports an authentication function using an authentication key, and may include an authentication memory shown in FIGS. 1A and 1B.

1A is a diagram illustrating a memory map included in an authentication tag of an RFID authentication system having an authentication function according to an embodiment of the present invention, and FIG. 1B is an authentication tag of an RFID authentication system having an authentication function according to an embodiment of the present invention. It is a figure which shows the coefficient value of the memory map contained in the.

As shown in Figs. 1A and 1B, an authentication memory stores an SecParam, an Advanced Encryption Standard Key (AES Key), and the like.

First, SecParam is a memory area for transmitting the encryption method and information used in the encryption algorithm and includes the number of rounds and the AES Key Index. Here, the AES Key Index indicates a location where the AES Key is stored in the authentication reader.

SecParam is an area for future use (RFU: Bits 00h-3h (4 bits)), a value indicating the encryption method between the authentication tag and the authentication reader (Round: Bits 04h-07h (4 bits)), and between the authentication tag and the authentication reader. It consists of a key index value (Key Index: Bits 08h-0Fh (8 bits)) containing the key used.

On the other hand, SecParam Round is used to generate an output key. Here, the number of rounds may be arbitrarily adjusted by the authentication reader in order to consider the operation power and response time of the authentication tag. According to the setting of the round bit, an encryption scheme as shown in FIG. 2 may be provided.

The key index may be represented by 00000000 ₂ to 11111111 ₂ , and is not limited thereto. The key index may be defined as an extended bit vector (EBV) and may be extended according to a database size of a key. RFU also fills 0000 ₂ .

Next, the AES key is a 128-bit private key required to generate an output key, and is stored in addresses 12-19 of the authentication memory, and needs to be separately managed as an access password. For example, the AES key should be set to be able to write only in the secured state or to be able to read and write only in the secured state.

3 is a block diagram showing the configuration of an RFID authentication system having an authentication function according to an embodiment of the present invention.

Referring to FIG. 3, the RFID authentication system includes an authentication server 301, an authentication reader 321, and an authentication tag 331.

The authentication server 301 includes a key database 302, a key processing unit 303, a confirmation data generation unit 305, an encryption unit 307, a tag authentication unit 309, and a decryption unit 311.

When the key processing unit 303 receives the authentication information from the authentication reader 321, it determines the authentication key (AES key) using the authentication information. Here, the authentication information includes EPC, and SecParam. That is, the key processing unit 303 determines in the key database 302 which manages an authentication key (AES Key) corresponding to SecParam's AES Key Index.

Thereafter, the key processing unit 303 generates an output key using the authentication key and an input key InputKey_RN arbitrarily generated by the authentication server. In this case, the input key InputKey_RN may be a public key.

The confirmation data generation unit 305 generates confirmation data having a predetermined length and encrypts the confirmation data using the encryption unit 307. Thereafter, the confirmation data generation unit 305 transmits the input key and the encrypted confirmation data to the authentication reader 321. Here, the encryption unit 307 may encrypt the confirmation data by performing an exclusive OR (XOR) on the confirmation data and the output key.

When the tag authenticator 309 receives encrypted confirmation response data from the authentication reader 321, the tag authenticator 309 decrypts the acknowledgment data using the decryption unit 311, and confirms the verification data and the decrypted acknowledgment message. By comparing the authenticity of the authentication tag. That is, when the confirmation data and the decrypted confirmation response message are the same, the tag authentication unit 309 may determine that the authentication tag is genuine by the manufacturer as the authentication tag is authenticated through the authentication reader. On the other hand, when the confirmation data and the decrypted confirmation response message is not the same, the tag authentication unit 309 may determine that the authentication tag is not genuine by the producer as the authentication tag is not authenticated through the authentication reader. Thereafter, the tag authenticator 309 may transmit the authentication result to the authentication reader 321. Here, the decryption unit 311 may decrypt the encrypted acknowledgment data by performing an exclusive OR (XOR) on the encrypted acknowledgment data and the output key.

Therefore, the encryption unit 307 and the decryption unit 311 have the same encryption method and decryption method for performing an exclusive OR (XOR) using the output key on the input data, respectively, and thus may have the same structure. have.

The authentication reader 321 may further include an authentication information transmitter 323 and a confirmation data transmitter 325 in addition to the existing reader function.

When the authentication information transfer unit 323 receives the authentication information from the authentication tag 331, the authentication information transfer unit 323 transfers a part of the authentication information to the authentication server 301. Here, the authentication information may include a PC, XPC, EPC, and SecParam.

At this time, the authentication information transmitting unit 323 may receive the PC, XPC, EPC, and SecParam transmitted after the ST bit of the XPC is identified as “1” by the authentication tag 331.

In addition, the authentication information transmission unit 323 first receives the PC, XPC, EPC of the authentication information, and if the ST bit of the XPC is identified as "1", it determines that the authentication tag 331 supports the authentication function. . Thereafter, the authentication information transmitter 323 may receive the SecParam from the authentication tag 331 using the Get_SecParam command and the response message shown in FIG. 4.

Referring to FIG. 4, the Get_SecParam command message is a command for the authentication reader to read the SecParam value of the authentication tag in order to confirm the setting of the SecParam value of the authentication memory. The code value of the Get_SecParam command uses “0xE101 (11100001 00000001)”.

When the confirmation data delivery unit 325 receives the confirmation data from the authentication server 301, the confirmation data is transmitted to the authentication tag 331, and when receiving the confirmation response data from the authentication tag 331, the authentication response data is authenticated. Transfer to server 301.

At this time, the confirmation data transfer unit 325 may transmit the confirmation data to the authentication tag 331 using the Sec_Auth command and the response message shown in FIG. 5, and receive the confirmation response data from the authentication tag 331. .

Referring to FIG. 5, the Sec_Auth command message is a command for authenticating authenticity produced by a producer through an authentication reader with respect to an authentication tag. The Sec_Auth command message includes confirmation data and an input key (InputKey_RN). Here, the confirmation data is data randomly generated by the authentication server, and is an arbitrary value encrypted by using an authentication key (AES key) owned by the authentication tag and an input key (InputKey_RN) arbitrarily generated by the authentication server.

The code value of the Sec_Auth command uses "0xE102 (11100001 00000010)". The confirmation data in the Sec_Auth command is a randomly generated 16-bit nonce value, and the size of the confirmation data is not limited thereto and may be a variable arbitrarily determined value.

The authentication tag 331 includes an authentication memory 333, a key processing unit 335, an acknowledgment data generator 337, a decryption unit 339, and an encryption unit 341.

The key processor 335 transmits the authentication information to the authentication reader 321, and generates an output key using the input key InputKey_RN received from the authentication reader 321. That is, the key processing unit 335 generates an output key using an authentication key (AES key) stored in the authentication memory 333 and an input key (InputKey_RN) of the Sec_Auth command message received from the authentication reader 321.

When the acknowledgment data generator 337 receives the encrypted acknowledgment data from the authentication reader 321, the acknowledgment data generator 337 generates encrypted acknowledgment data corresponding to the encrypted acknowledgment data. That is, when the acknowledgment data generator 337 receives the encrypted acknowledgment data, the acknowledgment data generator 337 may decrypt the acknowledgment data using the decryption unit 339 and re-encrypt the acknowledgment data decrypted using the encryption unit 341. have. Thereafter, the acknowledgment data generation unit 337 transmits the re-encrypted acknowledgment data, that is, the encrypted acknowledgment data to the authentication reader 321. In this case, the acknowledgment data generator 337 receives the encrypted acknowledgment data and then transmits the encrypted acknowledgment data to the authentication reader 321 within a preset time (for example, 20 ms).

Here, the decryption unit 339 may decrypt the encrypted confirmation data by performing an exclusive OR (XOR) on the encrypted confirmation data and the output key. In addition, the encryption unit 341 may generate encrypted verification response data by performing an exclusive OR (XOR) on the decrypted verification data and the output key to re-encrypt the verification data.

In an RFID authentication system having an authentication function according to an embodiment of the present invention, as the authentication server includes a key processing unit, a verification data generation unit, a tag authentication unit, and the like, the authentication server performs authenticity check on the authentication tag. But it is not limited thereto. For example, the authentication reader may include a key database, a key processing unit, a verification data generation unit, an encryption unit, a decryption unit, and a tag authentication unit. Accordingly, the authentication reader may perform authenticity check on the authentication tag.

6 is a diagram illustrating a method for generating an output key required for data encryption and decryption in an RFID authentication system having an authentication function according to an embodiment of the present invention.

Referring to FIG. 6, a key generator generates an output key by receiving an input key (Input Key, Public Key), an authentication key (AES Key), and the number of rounds of SecParam. In this case, the input key is 128 bits of data generated by repeating the 16-bit input key InputKey_RN transmitted through the Sec_Auth command message from the authentication server or 128 bits of data generated by the authentication server. In addition, an AES key is a secret key set in advance between the authentication server and the authentication tag.

In the process of generating an output key, the key generator may generate two or more output keys in advance for smooth operation of the authentication tag. In this case, as the output key generated by the key generator is used as an input key for generating the next output key, the key generator may continuously generate another output key.

7 is a diagram illustrating an encryption and decryption method of an RFID authentication system having an authentication function according to an embodiment of the present invention.

Referring to FIG. 7, the encryption unit of the authentication server includes an XOR performing unit 701. The XOR execution unit 701 performs an XOR (eXclusive OR) on 0 to 15 bits of the confirmation data 703 and the output key 705 to be encrypted in bit units, thereby encrypting the confirmation data 707. ) The encrypted verification data 707 is transmitted to the authentication reader along with the input key InputKey_RN, and the verification data 707 and the input key InputKey_RN sent to the authentication reader are generated as a Sec_Auth command message and transmitted to the authentication tag. .

The decryption unit of the authentication tag includes an XOR execution unit 711. The XOR execution unit 711 performs an XOR (eXclusive OR) bit by bit on the 0 to 15 bits of the encrypted confirmation data 713 and the output key 715 included in the Sec_Auth command message, thereby decrypting the confirmation. Data 717 may be generated.

In this case, the output key 715 is data generated by the key processing unit of the authentication tag using the input key InputKey_RN included in the Sec_Auth command message and the authentication key in the authentication memory of the authentication tag.

The encryption unit of the authentication tag includes an XOR performer 721. The XOR execution unit 721 performs XOR (eXclusive OR) of 16 to 31 bits of the confirmation data 723 and the output key 725 to be encrypted in bit units, thereby encrypting the encrypted confirmation data ( 727). In this case, the confirmation data 723 to be encrypted may be decrypted confirmation data 717 in the decryption unit of the authentication tag. Accordingly, the XOR performer 721 may generate the encrypted confirmation data 727 by re-encrypting the decrypted confirmation data 717.

The encrypted verification data 727 is composed of a Sec_Auth response message, which is sent to the authentication reader, and the verification data 727 that is sent to the authentication reader is sent to the authentication server.

In addition, the decryption unit of the authentication server includes an XOR execution unit 731. The XOR execution unit 731 generates an decrypted confirmation data 737 by performing an XOR (eXclusive OR) of 16 to 31 bits of the encrypted confirmation data 733 and the output key 735 bit by bit. Can be.

Thereafter, the authentication server may determine the authenticity of the authentication tag by comparing the confirmation data 703 generated by the authentication server with the authentication tag through the authentication reader and comparing the decrypted confirmation data 737. have.

8 is a flowchart illustrating a method of operating an authentication server in an RFID authentication system having an authentication function according to an embodiment of the present invention, and FIG. 10 is an authentication of an RFID authentication system having an authentication function according to an embodiment of the present invention. A message flow diagram illustrating a communication procedure between a server, an authentication reader, and an authentication tag. Here, the authentication reader can access the authentication tag after connecting to the authentication server (Secure Server) through a wired or wireless network using a web address.

8 and 10, the authentication server receives the authentication information from the authentication reader (S801).

Here, the authentication information may include a PC, XPC, EPC, and SecParam.

Subsequently, the authentication server generates an output key using the authentication information (S803).

Specifically, the authentication server determines the authentication key (AES Key) based on the AES Key Index in the SecParam of the authentication information. Thereafter, the authentication server generates an output key using an authentication key (AES Key), a round value in SecParam, and an input key (InputKey_RN) arbitrarily generated by the authentication server.

Subsequently, the authentication server transmits the verification data encrypted using the output key to the authentication reader (S805).

Specifically, the authentication server generates confirmation data of any predetermined length, and encrypts the confirmation data using the output key. In this case, the authentication server may encrypt the verification data by performing an exclusive OR (XOR) on the verification data and the output key.

The authentication server then sends the encrypted confirmation data and the input key (InputKey_RN) to the authentication reader.

Subsequently, the authentication server receives confirmation response data corresponding to the confirmation data from the authentication reader (S807).

The authentication server then decrypts the received encrypted acknowledgment data using the output key. In this case, the authentication server may decrypt the encrypted acknowledgment data by performing an exclusive OR (XOR) on the encrypted acknowledgment data and the output key.

Subsequently, the authentication server compares the confirmation data with the confirmation response data to determine whether the authentication tag is authentic (S809).

In detail, when the verification data and the decrypted acknowledgment message are the same, the authentication server may determine that the authentication tag is genuine by the producer as the authentication tag is authenticated through the authentication reader.

On the other hand, when the verification data and the decrypted confirmation response message is not the same, the authentication server may determine that the authentication tag is not genuine by the producer as the authentication tag is not authenticated through the authentication reader.

Thereafter, the authentication server may transmit the authentication result to the authentication reader.

9 is a flowchart illustrating a method of operating an authentication tag in an RFID authentication system having an authentication function according to an embodiment of the present invention.

9 and 10, the authentication tag transmits the authentication information to the authentication reader (S901).

First, the authentication tag receives a Select message, Query or Query Rep message from the authentication reader, and transmits RN16 to the authentication reader when the slot counter of the authentication tag is '0'.

Thereafter, the authentication tag may transmit authentication information to the authentication reader in two ways, and a suitable method may be selected according to the authentication reader or the authentication tag.

In the first method, the authentication tag receives an ACK message, which is a response to RN16, from the authentication reader, and then transmits authentication information. That is, the authentication tag receives an ACK message, which is a response to RN16, from the authentication reader. If the ST bit of the XPC is "1", the authentication tag transmits PC, XPC, EPC, and SecParam of the authentication information to the authentication reader.

In the second method, the authentication tag receives an ACK message, which is a response to RN16, from the authentication reader, and then transmits only the PC, XPC, and EPC values of the authentication information.

Thereafter, the authentication tag checks whether the ST bit of the XPC is “1” by the authentication reader receiving the PC, the XPC, and the EPC. When the authentication tag receives the Req_RN from the authentication reader, it transmits a New_RN in response thereto.

Thereafter, when the authentication tag receives a Get SecParam command message for requesting SecParam from the authentication reader, the authentication tag may transmit the SecParam to the authentication reader by transmitting a Get SecParam response message.

Subsequently, in a new inventory process, the authentication tag receives confirmation data from the authentication reader (S903).

That is, the authentication tag may receive encrypted verification data by receiving a Sec_Auth command message from the authentication reader.

Subsequently, the authentication tag generates an output key using the authentication information (S905).

Specifically, the authentication tag generates an output key using an authentication key (AES Key), an input key (InputKey_RN), and a Round value in SecParam stored in the authentication memory.

Subsequently, the authentication tag generates confirmation response data for the confirmation data by using the output key (S907).

Specifically, the authentication tag decrypts the encrypted verification data using the output key. Thereafter, the authentication tag may re-encrypt the decrypted verification data using the output key, thereby generating encrypted verification response data.

Subsequently, the authentication tag transmits confirmation response data to the authentication reader (S909).

That is, the authentication tag may transmit encrypted acknowledgment data by transmitting a Sec_Auth response message to the authentication reader. At this time, the authentication tag receives the encrypted confirmation data, and transmits the encrypted confirmation response data to the authentication reader within a predetermined time (for example, 20ms).

11 is a message flow diagram illustrating a communication procedure between an authentication server, an authentication reader, and an authentication tag of an RFID authentication system having an authentication function according to another embodiment of the present invention.

Referring to FIG. 11, since the authentication server receives the authentication information from the authentication tag through the authentication reader and the method for generating the output key is the same as the method for receiving the authentication information and the output key of FIG. 10, description thereof will be omitted. do.

The authentication server then encrypts the same verification data twice in succession using the output key. Specifically, as shown in FIG. 12A, the authentication server uses randomly generated confirmation data (Confirm (16bits)) encrypted using the 0 to 15 bits of the output key and 16 to 31 bits of the output key. By using the second encrypted data can be generated. Here, the confirmation data is referred to as 16 bits, but is not limited thereto and may be variable.

The authentication server sends the encrypted first verification data and the second verification data to the authentication reader.

The authentication reader sends the encrypted first verification data to the authentication tag.

The authentication tag decrypts the received encrypted first verification data using 0 to 15 bits of the output key, as shown in FIG. 12B, and uses 16 to 31 bits of the output key, as shown in FIG. 12C. To re-encrypt. The authentication tag sends the re-encrypted acknowledgment data to the authentication reader. In this case, the authentication tag may transmit the response data to the encrypted first verification data to the authentication reader using the Sec_Auth response message.

When the authentication reader receives the response data to the encrypted first confirmation data, the authentication reader compares the encrypted second confirmation data received from the authentication server to determine whether the authentication tag is authentic.

That is, when the response data to the encrypted first confirmation data and the encrypted second confirmation data are the same, the authentication reader may determine that the authentication tag is genuine by the producer as the authentication tag is authenticated through the authentication reader. On the other hand, if the authentication data is not the same as the response data for the encrypted first verification data and the encrypted second verification data, it is determined that the authentication tag is not genuine by the producer as the authentication tag is not authenticated through the authentication reader. can do.

13 is a flowchart illustrating a method of operating an authentication reader having a database of authentication keys in an RFID authentication system having an authentication function according to still another embodiment of the present invention, and FIG. 14 is an authentication method according to another embodiment of the present invention. In an RFID authentication system having a function, a message flow diagram illustrating a communication procedure between an authentication reader and an authentication tag having a database of authentication keys.

13 and 14, the authentication reader receives the authentication information of the authentication tag from the authentication tag (S1301).

Here, the authentication information may include a PC, XPC, EPC, SecParam.

The authentication reader can check whether the authentication tag supports the authentication function by using the ST bit of the XPC. That is, the authentication reader may determine that the authentication tag supports the authentication function when the ST bit of the XPC is "1".

Subsequently, the authentication reader having the database of authentication keys generates an output key using the authentication information (S1303).

Specifically, the authentication reader determines an AES Key based on an AES Key Index in SecParam of the authentication information.

Thereafter, the authentication reader generates an output key using an authentication key (AES Key), a round value in SecParam, and an input key (InputKey_RN) arbitrarily generated by the authentication reader.

Subsequently, the authentication reader sends the authentication data encrypted with the output key to the authentication tag (S1305).

Subsequently, the authentication reader receives confirmation response data corresponding to the confirmation data from the authentication tag (S1307).

Thereafter, the authentication reader decrypts the received acknowledgment data using the output key.

Subsequently, the authentication reader compares the confirmation data with the decrypted confirmation response data to determine whether the authentication tag is authentic (S1309).

Specifically, when the authentication data is the same as the confirmation data and the confirmation response message, it may be determined that the authentication tag is genuine by the manufacturer as the authentication tag is authenticated through the authentication reader. On the other hand, if the verification data and the confirmation response message is not the same, it may be determined that the authentication tag is not genuine produced by the manufacturer as the authentication tag is not authenticated through the authentication reader.

RFID authentication method having an authentication function according to an embodiment of the present invention can determine the authenticity of the authentication tag, it is possible to increase the security of the authentication tag.

As described above, the present invention has been described by way of limited embodiments and drawings, but the present invention is not limited to the above embodiments, and those skilled in the art to which the present invention pertains various modifications and variations from such descriptions. This is possible.

Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined not only by the claims below but also by the equivalents of the claims.

1A is a diagram illustrating a memory map included in an authentication tag of an RFID authentication system having an authentication function according to an embodiment of the present invention.

1B is a diagram illustrating coefficient values of a memory map included in an authentication tag of an RFID authentication system having an authentication function according to an embodiment of the present invention.

2 is a diagram illustrating an encryption method according to setting of a round bit.

3 is a block diagram showing the configuration of an RFID authentication system having an authentication function according to an embodiment of the present invention.

4 is a diagram illustrating a Get_SecParam command and a response message.

5 is a diagram illustrating a Sec_Auth command and response message.

6 is a diagram illustrating a method for generating an output key required for data encryption and decryption in an RFID authentication system having an authentication function according to an embodiment of the present invention.

7 is a diagram illustrating an encryption and decryption method of an RFID authentication system having an authentication function according to an embodiment of the present invention.

8 is a flowchart illustrating a method of operating an authentication server in an RFID authentication system having an authentication function according to an embodiment of the present invention.

9 is a flowchart illustrating a method of operating an authentication tag in an RFID authentication system having an authentication function according to an embodiment of the present invention.

10 is a message flow diagram illustrating a communication procedure between an authentication server, an authentication reader, and an authentication tag of an RFID authentication system having an authentication function according to an embodiment of the present invention.

11 is a message flow diagram illustrating a communication procedure between an authentication server, an authentication reader, and an authentication tag of an RFID authentication system having an authentication function according to another embodiment of the present invention.

12A to 12C are diagrams for describing encryption and decryption in an RFID authentication system having an authentication function according to another embodiment of the present invention.

13 is a flowchart illustrating a method of operating an authentication reader having a database of authentication keys in an RFID authentication system having an authentication function according to another embodiment of the present invention.

14 is a message flow diagram illustrating a communication procedure between an authentication reader and an authentication tag having a database of authentication keys in an RFID authentication system having an authentication function according to another embodiment of the present invention.

Claims (10)

A key processing unit which determines an authentication key using the authentication information received from the authentication tag, and generates an output key using the determined authentication key; A confirmation data generation unit which encrypts confirmation data of a predetermined length using the output key and transmits the encrypted confirmation data to the authentication tag; And Receiving and decrypting encrypted acknowledgment data corresponding to the encrypted acknowledgment data from the authentication tag, and comparing the predetermined length of the acknowledgment data with the decrypted acknowledgment data to determine the authenticity of the authentication tag. RFID authentication device including a tag authentication unit. The method of claim 1, An encryption unit for encrypting the verification data by performing an exclusive OR (XOR) on the verification data and the output key of the predetermined length; And A decryption unit that decrypts the encrypted acknowledgment data by performing an exclusive OR (XOR) on the encrypted acknowledgment data and the output key RFID authentication device further comprising. The method of claim 1, RFID authentication device further comprising a key database for managing the authentication key. A key processing unit for generating an output key using the authentication key; And Decrypt the encrypted verification data received from the authentication reader using the output key, and re-encrypt the decrypted verification data using the output key to generate encrypted verification response data corresponding to the encrypted verification data; And an acknowledgment data generator for transmitting the encrypted acknowledgment data to the authentication reader. The method of claim 4, wherein A decryption unit that decrypts the encrypted verification data by performing an exclusive OR (XOR) on the encrypted verification data and the output key; And An encryption unit for re-encrypting the decrypted confirmation data by performing an exclusive OR (XOR) on the decrypted confirmation data and the output key RFID authentication device further comprising. Determining an authentication key using the authentication information received from the authentication tag; Generating an output key using the authentication key, and encrypting confirmation data of any predetermined length using the output key; Transmitting the encrypted confirmation data to the authentication tag, and receiving and decrypting the encrypted confirmation response data corresponding to the confirmation data from the authentication tag; And And comparing authenticity of the predetermined length with the decrypted acknowledgment data to determine the authenticity of the authentication tag. Receiving encrypted verification data from an authentication reader; Generate an output key using an authentication key, decrypt the encrypted verification data using the generated output key, and re-encrypt the decrypted verification data using the output key to correspond to the encrypted verification data. Generating encrypted acknowledgment data; And Sending the encrypted acknowledgment data to the authentication reader. The method of claim 7, wherein And transmitting the encrypted confirmation response data to the authentication reader is performed within a preset time after receiving the encrypted confirmation data from the authentication reader. The method of claim 7, wherein The method may further include transmitting authentication information to the authentication reader. The step of transmitting the authentication information And when the specific bit of the XPC of the authentication information is "1", transmitting the PC, XPC, EPC, and SecParam of the authentication information. The method of claim 7, wherein The method may further include transmitting authentication information to the authentication reader. The step of transmitting the authentication information Transmitting the PC, XPC, and EPC of the authentication information to an authentication reader; And And after confirming that the specific bit of the XPC is “1” by the authentication reader, transmitting a SecParam of the authentication information to the authentication reader in response to a command of the authentication reader.

Images