WO2013152653A1 - 空中接口安全方法及设备 - Google Patents

空中接口安全方法及设备 Download PDF

Info

Publication number
WO2013152653A1
WO2013152653A1 PCT/CN2013/072632 CN2013072632W WO2013152653A1 WO 2013152653 A1 WO2013152653 A1 WO 2013152653A1 CN 2013072632 W CN2013072632 W CN 2013072632W WO 2013152653 A1 WO2013152653 A1 WO 2013152653A1
Authority
WO
WIPO (PCT)
Prior art keywords
short
coupling device
range
card
proximity card
Prior art date
Application number
PCT/CN2013/072632
Other languages
English (en)
French (fr)
Inventor
杜志强
铁满霞
张国强
Original Assignee
西安西电捷通无线网络通信股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 西安西电捷通无线网络通信股份有限公司 filed Critical 西安西电捷通无线网络通信股份有限公司
Priority to US14/394,036 priority Critical patent/US9350721B2/en
Priority to EP13775724.1A priority patent/EP2838224B1/en
Priority to KR1020147031673A priority patent/KR101601071B1/ko
Publication of WO2013152653A1 publication Critical patent/WO2013152653A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44—Program or device authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44—Program or device authentication
    • G06F21/445—Program or device authentication by mutual authentication, e.g. between devices or programs
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06K—GRAPHICAL DATA READING; PRESENTATION OF DATA; RECORD CARRIERS; HANDLING RECORD CARRIERS
    • G06K17/00—Methods or arrangements for effecting co-operative working between equipments covered by two or more of main groups G06K1/00 - G06K15/00, e.g. automatic card files incorporating conveying and reading operations
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless
    • H04L2209/805—Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Definitions

  • Air interface security method and device The present application claims priority to Chinese Patent Application entitled “Air Interface Security Method and Equipment” submitted to the Chinese Patent Office on April 11, 2012, application number 201210121152. The citations are incorporated herein by reference.
  • TECHNICAL FIELD The present invention relates to the field of network security in information security technologies, and in particular, to a method and device for air interface security. Background technique
  • the IS0/IEC 14443 standard includes four parts: physical characteristics, RF interface energy and signal interface, initialization and anti-collision, and transmission protocol. It is divided into Type A and Type B modes. This standard solves the problem of passive (no card The technical problems in the two communication fields, power supply and non-contact, are characterized by more convenient and fast communication. At present, IS0/IEC 14443 Type A has been widely used in mobile payment, channel control, bus fare, attendance and access control. Type B is mainly used in the second generation of residential ID cards in China, and its application prospects are very broad.
  • the IS0/IEC 14443 standard communicates over the air interface without any physical or visible contact. This feature makes it widely used, and it also faces multiple security threats, such as an attacker intercepting or illegally intercepting a short range. Interaction information between the card and the short-range coupling device; spoofing the legal proximity card by copying or forging; remotely reading the secret information in the proximity card through the short-range coupling device of the large RF power, and then using the background server to crack In order to achieve the purpose of illegally obtaining information in the proximity card, various types of attacks are emerging.
  • the present invention provides an air interface security method, which performs the following steps in a transmission protocol process:
  • the short-range coupling device sends a security parameter request message to the short-range card
  • the proximity card after receiving the security parameter request message, performs security parameter feedback to the short-range coupling device;
  • the proximity coupling device and the proximity card establish a secure link according to the security parameter.
  • the embodiment of the present invention further provides a short-range coupling device that implements the foregoing method, which can execute a transmission protocol process, and the short-range coupling device includes:
  • a sending unit configured to send a security parameter request message to the proximity card
  • a receiving unit configured to receive security parameter feedback sent by the proximity card
  • a link establishing unit configured to establish a security link with the proximity card according to the security parameter.
  • the embodiment of the invention further provides a short-range card for implementing the above method, which can execute a transmission protocol process, and the short-range card includes:
  • a receiving unit configured to receive a security parameter request message sent by the short-range coupling device
  • a sending unit configured to send security parameter feedback to the short-range coupling device
  • a link establishing unit configured to establish a secure link with the short-range coupling device according to the security parameter.
  • the present invention provides the security protection capability of the air interface, and provides the identity authentication function for the proximity coupling device and the proximity card to ensure the legality and authenticity of the identity of the communication parties. At the same time, it does not bring additional hardware overhead for short-range coupling devices and proximity cards.
  • the air interface security method of the present invention introduces security mechanisms such as security parameter negotiation, identity authentication, and secure communication in the transmission protocol, and enhances the air interface security protection capability of the transmission protocol.
  • the air interface security method implementation process of the present invention includes:
  • Step 1 The short-range coupling device sends a security parameter request message to the short-range card, for example, including the message code.
  • Step 2 After receiving the security parameter request message, the short-range card performs security parameter feedback to the short-range coupling device.
  • Step 3 The short-range coupling device and the short-range card establish a safety link according to the security parameters.
  • step 1 The specific implementation manner of step 1 above may be:
  • the short-range coupling device includes a security parameter request message in the Request for Answer To Select (RATS) sent to the proximity card, for Initiate negotiation of security parameters with the proximity card.
  • RATS Request for Answer To Select
  • step 2 may be:
  • the short-range card In the process of performing the IS0/IEC 14443 transmission protocol between the short-range coupling device and the short-range card, the short-range card returns the selection response ATS (Answer To Select) to the short-range coupling device after receiving the selection response request RATS of the short-range coupling device. Select the information in the ATS that supports the support parameters of the proximity card to the authentication mechanism and the cryptographic algorithm.
  • the authentication mechanism includes, but is not limited to, a pre-shared key based authentication mechanism or a certificate based authentication mechanism.
  • the cryptographic algorithm includes, but is not limited to, a symmetric cryptographic algorithm, or an asymmetric cryptographic algorithm.
  • step 3 The specific implementation manner of the foregoing step 3 may be:
  • the short-range coupling device After the short-range coupling device negotiates the security parameters with the short-range card (ie, completes the request and feedback of the security parameters according to steps 1, 2), the two parties perform identity authentication according to the authentication mechanism in the negotiated security parameters, for example, based on pre-shared secrets. Identification of keys, or identification based on digital certificates. Successful identity authentication After that, a secure link between the short-range coupling device and the proximity card is established.
  • step 3 above may further include:
  • the short-range coupling device and the short-range card can negotiate to generate a session key during identity authentication, and the short-range coupling device and the proximity card use the session key to encrypt and transmit data to implement secure communication.
  • the session key can also be generated in other ways, for example, by means of key pre-distribution, i.e., pre-distributing the session key to the proximity coupled device and the proximity card prior to the secure communication.
  • step 0 may also be included, for the proximity card to announce the security capability to the short-range coupling device, specifically:
  • Step 0 During the communication initialization and anti-collision process, the short-range card informs the short-range coupling device that it has the air interface security protection capability.
  • step 0 The specific implementation of step 0 is:
  • Step 01 During the IS0/IEC 14443 protocol initialization and anti-collision process, the short-range coupling device sends a selection command to the proximity card;
  • the proximity card After receiving the selection command sent by the short-range coupling device, the proximity card includes the information supporting the air interface security protection capability in the response returned by the proximity card.
  • step 02 above may be:
  • the short-range card After the short-range card receives the selection command sent by the short-range coupling device, the short-range card includes its selection confirmation SAK (Select AcKnowledge) sent to the short-range coupling device.
  • SAK Select AcKnowledge
  • the information supporting the air interface security protection capability can be carried by adding a value based on the value of the original SAK, and is used to inform the short-range coupling device that selects the proximity card to have the air interface security protection capability.
  • step 1 and step 2 above may be:
  • Example 1 in the above step 1, in the process of performing the IS0/IEC 14443 transmission protocol between the short-range coupling device and the short-range card, the short-range coupling device sends a selection response request RATS to the proximity card, and the selection response request RAS includes the security parameter.
  • a request message which includes all authentication mechanisms supported by the short-range coupling device and all cryptographic algorithms supported by the short-range coupling device;
  • the proximity card receives the selection response After requesting the RATS, first selecting a combination of the authentication mechanism and the cryptographic algorithm from all the authentication mechanisms supported by the short-range coupling device and all the cryptographic algorithms supported by the short-range coupling device according to the local policy, and then returning the selective response ATS to the short-range coupling device. Selecting a combination of the authentication mechanism and the cryptographic algorithm in the response ATS;
  • Example 2 in the above step 1, in the process of performing the IS0/IEC 14443 transmission protocol between the short-range coupling device and the short-range card, the short-range coupling device sends a selection response request RATS to the proximity card, and the selection response request RAS includes the security parameter. Request message; In the above step 2, after receiving the selective response request RATS, the short-range card returns a selection response ATS to the short-range coupling device, and selects all authentication mechanisms supported by the proximity card and all passwords supported by the proximity card in the response ATS.
  • the algorithm so that the short-range coupling device can select a combination of an authentication mechanism and a cryptographic algorithm from all the authentication mechanisms supported by the short-range card and all the cryptographic algorithms supported by the short-range card according to its local policy, as a negotiation with the short-range card Safety parameter
  • Example 3 in the above step 1, in the process of performing the IS0/IEC 14443 transmission protocol between the short-range coupling device and the short-range card, the short-range coupling device sends a selection response request RATS to the proximity card, and the selection response request RAS includes the security parameter. Request message;
  • the proximity card after receiving the selective response request RATS, the proximity card selects one of the authentication mechanisms and all the cryptographic algorithms supported by itself to be included in the ATS and is returned to the ATS.
  • a short-range coupling device as a safety parameter generated in consultation with a short-range coupling device;
  • Example 4 in the above step 1, in the process of performing the IS0/IEC 14443 transmission protocol between the short-range coupling device and the short-range card, the short-range coupling device sends a selection response request RATS to the proximity card, and the selection response request RAS includes the security parameter.
  • a request message which includes a combination of an authentication mechanism and a cryptographic algorithm selected by the short-range coupling device among all the authentication mechanisms supported by itself and all supported cryptographic algorithm combinations; in the above step 2, after the short-range card receives the RATS According to the local policy, it is determined whether the authentication mechanism and the cryptographic algorithm combination in the RATS are supported, and the judgment result is returned to the short-range coupling device through the ATS.
  • the present invention also provides a proximity coupling device for implementing the air interface security method described above.
  • the short range coupling device includes a first transmitting unit, a first receiving unit, and a first link establishing unit.
  • the first sending unit of the short-range coupling device is configured to send a security parameter request message to the short-range card, where the first receiving unit is configured to receive the security parameter feedback sent by the short-range card, and the first link establishing unit is configured to establish the security parameter according to the security parameter.
  • a secure link with the proximity card is configured to send a security parameter request message to the short-range card.
  • the specific implementation manner of the short-range coupling device may be:
  • the first sending unit of the short-range coupling device includes a security parameter request message for initiating and short-range in the selection response request RATS sent to the proximity card.
  • the security parameter negotiation of the card the first receiving unit receives the selection response ATS sent by the short-range card, and selects information about the support status of the security parameter including the proximity card pair authentication mechanism and the cryptographic algorithm in the response ATS; the first link establishing unit
  • the proximity card is authenticated according to the authentication mechanism in the negotiated security parameters. After the identity authentication is successful, a secure link between the short-range coupling device and the short-range card is established.
  • the first link establishing unit of the short range coupling device may also negotiate with the proximity card to generate a session key, so that the proximity coupling device and the proximity card may utilize the session key pair data. Encrypted transmission is performed to implement secure communication.
  • the session key can also be generated by other means, for example, by means of key pre-distribution, i.e., pre-distributing the session key to the first link establishing unit and the proximity card of the short-range coupling device prior to the secure communication.
  • the short-range coupling device can also receive the security capability that the short-range card advertises to the short-range coupling device, that is, the short-range coupling device receives the short-range card to the short-range during the communication initialization and anti-collision process.
  • the proximity card advertised by the coupled device has air interface security protection capabilities.
  • a preferred embodiment is: in the IS0/IEC 14443 protocol initialization and anti-collision process, the first transmitting unit of the short-range coupling device sends a selection command to the short-range card; the first receiving unit receives the short-range card to the short-range coupling device
  • the notified proximity card supports the information of the air interface security protection capability, and the information may be included in the selection confirmation SAK sent by the proximity card, and may be carried by adding a value based on the original SAK value.
  • a specific embodiment of the first sending unit and the first receiving unit of the short-range coupling device may be: Example 1, the first sending unit sends a selection response request RATS to the proximity card, and the selection response request RATS includes a security parameter request message, where The message contains all the authentication mechanisms supported by the proximity coupled device. And all cryptographic algorithms supported by the short-range coupling device; the first receiving unit receives the selection response ATS sent by the short-range card, and the selection response ATS includes all the authentication mechanisms supported by the short-range card from the short-range coupling device according to its local policy and a combination of one of the authentication mechanisms and the cryptographic algorithm selected by all the cryptographic algorithms supported by the coupled device;
  • the first sending unit sends a selection response request RATS to the proximity card, and the selection response request RATS includes a security parameter request message;
  • the first receiving unit receives the selection response ATS sent by the proximity card, and the selection response ATS includes the short range All authentication mechanisms supported by the card and all cryptographic algorithms supported by the proximity card, so that the first link establishing unit of the proximity coupling device can follow all the authentication mechanisms and proximity cards supported by the short-range card according to the local policy of the proximity card.
  • the all supported cryptographic algorithms a combination of an authentication mechanism and a cryptographic algorithm is selected as a security parameter generated by negotiation with the proximity card;
  • the first sending unit sends a selection response request RATS to the proximity card, and the selection response request RATS includes a security parameter request message;
  • the first receiving unit receives the selection response ATS sent by the proximity card, and the selection response ATS includes the short range
  • the card selects one of the authentication mechanism and the cryptographic algorithm among all the authentication mechanisms supported by itself and all the cryptographic algorithms supported by itself, as a security parameter generated by the short-range coupling device and the proximity card negotiation;
  • the first sending unit sends a selection response request RATS to the proximity card, and the selection response request RATS includes a security parameter request message, where the message includes all authentication mechanisms supported by the first link establishing unit and the proximity coupling device.
  • the selection response request RATS includes a security parameter request message, where the message includes all authentication mechanisms supported by the first link establishing unit and the proximity coupling device.
  • One of the supported cryptographic algorithm combinations is combined with a cryptographic algorithm; the first receiving unit receives the selective response ATS sent by the short-range card, and the selective response ATS includes the short-range card to determine whether it supports the RATS according to its local policy. The result of the combination of the authentication mechanism and the cryptographic algorithm.
  • the present invention also provides a proximity card for implementing the air interface security method described above.
  • the short range card includes a second receiving unit, a second transmitting unit, and a second link establishing unit.
  • the second receiving unit of the short-range card is configured to receive a security parameter request message sent by the short-range coupling device, and the second sending unit sends the security parameter feedback to the short-range coupling device, and the second link establishing unit is configured to perform short-range coupling
  • the device establishes a secure link based on security parameters.
  • the specific implementation of the short-range card can be:
  • the second receiving unit of the short-range card receives the selection response request RATS sent by the short-range coupling device, and the selection response request RATS includes a security parameter request message, which is used to initiate Negotiating with the security parameters of the short-range card; the second sending unit sends the selection response ATS to the short-range coupling device, and selects information about the support status of the response ATS including the proximity card to the authentication mechanism and the cryptographic algorithm; After the road establishing unit negotiates the security parameters with the short-range coupling device, the road establishing unit performs identity authentication according to the authentication mechanism in the negotiated security parameters. After the identity is successfully authenticated, a secure link between the short-range coupling device and the short-range card is established.
  • the second link establishing unit of the short-range card may also negotiate with the short-range coupling device to generate a session key, so that the proximity card and the short-range coupling device use the session key to perform data on the session. Encrypted transmission for secure communication.
  • the session key can also be generated by other means, for example, by means of key pre-distribution, i.e., pre-distributing the session key to the second link establishing unit and the short-range coupling device of the short-range card prior to the secure communication.
  • the short-range card can also be used to notify the short-range coupling device of its security capability, that is, in the communication initialization and anti-collision process, the short-range card notifies the short-range coupling device that it has the air interface security protection. ability.
  • a preferred embodiment is: in the IS0/IEC 14443 protocol initialization and anti-collision process, the second receiving unit of the short-range card receives the selection command sent by the short-range coupling device; the second transmitting unit returns to the process coupling device to support the air Information about the security protection capability of the interface. The information can be carried by the added value based on the value of the original SAK and sent to the short-range coupling device through the selection confirmation S AK for notifying the short-range coupling device. With air interface security protection.
  • the second receiving unit receives the selection response request RATS sent by the short-range coupling device, and the selection response request RATS includes a security parameter request message, where the message includes all the authentication mechanisms supported by the short-range coupling device and the short-range coupling device support. All cryptographic algorithms; the second transmitting unit returns a selection response ATS to the short-range coupling device, and the selection response ATS includes a second link establishing unit according to the proximity card
  • the ground policy is a combination of one of the authentication mechanism and the cryptographic algorithm selected from all the authentication mechanisms supported by the short-range coupling device and all the cryptographic algorithms supported by the short-range coupling device;
  • the second receiving unit receives the selection response request RATS sent by the short-range coupling device, and the selection response request RATS includes the security parameter request message; the second sending unit returns the selection response ATS to the short-range coupling device, and the selection response ATS includes the near All authentication mechanisms supported by the card and all cryptographic algorithms supported by the proximity card, so that the proximity coupling device can select one of all the authentication mechanisms supported by the short-range card and all the cryptographic algorithms supported by the short-range card according to its local policy.
  • the second receiving unit receives the selection response request RATS sent by the short-range coupling device, and the selection response request RATS includes the security parameter request message; the second sending unit returns the selection response ATS to the short-range coupling device, and the selection response ATS includes the
  • the second link establishing unit combines all the authentication mechanisms supported by the short-range card and all the cryptographic algorithms supported by the short-range card with a cryptographic algorithm as a security parameter generated by negotiation with the short-range coupling device;
  • the second receiving unit receives the selection response request RATS sent by the short-range coupling device, and the selection response request RATS includes a security parameter request message, where the message includes all the authentication mechanisms supported by the short-range coupling device and all supported by the device.
  • An authentication mechanism selected in the combination of cryptographic algorithms is combined with a cryptographic algorithm; the second transmitting unit returns a selection response ATS to the short-range coupling device, and the second response establishing unit includes a second link establishing unit to determine whether to support the RATS according to the proximity card local policy. The result of the combination of the authentication mechanism and the cryptographic algorithm.
  • the invention enhances the security protection capability of the IS0/IEC 14443 air interface by introducing security mechanisms such as security capability notification, security parameter negotiation, identity authentication and secure communication, and can provide identity authentication functions for short-range coupling devices and short-range cards, ensuring The legality and authenticity of the identity of both parties to the communication, and the ability to provide secure communication functions for short-range coupling devices and short-range cards when needed, to prevent communication data from being stolen, tampered, and the like.
  • the present invention solves the compatibility problem well, and the air interface security IS 0/IEC 14443 protocol can be fully compatible with the original IS0/IEC 14443 protocol, and only supports the enhanced air interface security protection in the short-range coupling device and the proximity card.
  • the method provided by the present invention performs secure communication.
  • only the short-range coupling device supports the IS0/IEC 14443 protocol with air interface security protection capability or only the short-range card supports the IS0/IEC 14443 protocol with air interface security protection capability.
  • the short-range coupling device and the short-range card still use the original I S0/IEC 14443 protocol for communication.
  • the IS0/IEC 1444 3 protocol which enhances air interface security, increases system security without incurring additional hardware overhead for short-range coupling and proximity cards.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本发明提供了一种空中接口安全方法，其在传输协议过程中执行：1）近程耦合设备向近程卡发送安全参数请求消息；2）近程卡收到安全参数请求消息后，向近程耦合设备进行安全参数反馈；3）近程耦合设备与近程卡根据安全参数建立安全链路。另外，本发明还提供了实现上述方法的近程耦合设备及近程卡等设备。本发明通过引入安全机制，提供了空中接口的安全防护能力，能够为近程耦合设备和近程卡提供身份鉴别功能，确保通信双方身份的合法性和真实性。同时不会为近程耦合设备和近程卡带来额外的硬件开销。

Description

空中接口安全方法及设备 本申请要求 2012年 4月 11 日提交中国专利局、申请号为 201210121152. 8， 发明名称为 "空中接口安全方法及设备" 的中国专利申请的优先权， 其 全部内容通过引用结合在本申请中。 技术领域 本发明属信息安全技术中的网络安全领域， 尤其涉及一种针对空中接口 安全的方法及设备。 背景技术
IS0/IEC 14443标准包括物理特性、 射频接口能量与信号接口、 初始化与 防冲突、 传输协议共 4个部分， 并分为 Type A和 Type B两种模式， 该标准解决 了无源 （卡中无电源） 和非接触这两项通信领域的技术难题， 具有通信更加 方便、 快捷的特点。 目前， IS0/IEC 14443 Type A已被大量应用于移动支付、 通道控制、 公交收费、 考勤和门禁等领域， Type B在国内主要用于第二代居 民身份证， 应用前景都非常广阔。
IS0/IEC 14443标准通过空中接口进行通信，不需要任何物理或可见接触， 这一特点使其获得广泛应用的同时， 也导致其面临着多种安全威胁， 如攻击 者通过监听或非法截获近程卡与近程耦合设备的交互信息； 通过复制或伪造 对合法的近程卡进行假冒； 通过大射频功率的近程耦合设备远程读取近程卡 内的保密信息， 然后利用后台服务器进行破解以达到非法获取近程卡内信息 的目的等， 各类攻击层出不穷。 由于 IS0/IEC 14443标准在空中接口方面缺乏 安全防护机制， 随着各类采用该标准的产品的规模化应用， 各类用卡不安全 事件， 包括伪造、 信息窃听与篡改等逐渐增多， 在给个人财产带来危害的同 时， 将引起社会的不稳定， 进而影响公共安全。 发明内容
为了解决背景技术中存在的各种技术问题， 本发明提供一种空中接口安 全方法， 是在传输协议过程中执行以下步骤：
1 ) 近程耦合设备向近程卡发送安全参数请求消息；
2 )所述近程卡收到所述安全参数请求消息后， 向所述近程耦合设备进行 安全参数反馈；
3 ) 所述近程耦合设备与所述近程卡根据所述安全参数建立安全链路。 本发明实施例还提供了一种实现上述方法的近程耦合设备， 可执行传输 协议过程， 近程耦合设备包括：
发送单元， 用于向近程卡发送安全参数请求消息；
接收单元， 用于接收所述近程卡发来的安全参数反馈；
链路建立单元， 用于根据所述安全参数建立与所述近程卡之间的安全链 路。
本发明实施例还提供了一种实现上述方法的近程卡， 可执行传输协议过 程， 近程卡包括：
接收单元， 用于接收近程耦合设备发来的安全参数请求消息；
发送单元， 用于向所述近程耦合设备发送安全参数反馈；
链路建立单元， 用于根据所述安全参数建立与所述近程耦合设备之间的 安全链路。
本发明通过引入安全机制， 提供了空中接口的安全防护能力， 能够为近 程耦合设备和近程卡提供身份鉴别功能， 确保通信双方身份的合法性和真实 性。 同时不会为近程耦合设备和近程卡带来额外的硬件开销。 附图说明
无。 具体实施方式
为使本发明的目的、 技术方案和优点更加清楚明白， 下面结合实施方式 和附图， 对本发明做进一步详细说明。 在此， 本发明的示意性实施方式及其 说明用于解释本发明， 但并不作为对本发明的限定。
本发明空中接口安全方法在传输协议中， 引入安全参数协商、 身份鉴别 以及保密通信等安全机制， 增强传输协议的空中接口安全防护能力。 本发明 空中接口安全方法实施过程包括：
步骤 1 近程耦合设备向近程卡发送安全参数请求消息，例如包含消息码； 步骤 2 近程卡收到安全参数请求消息后， 向近程耦合设备进行安全参数 反馈；
步骤 3 近程耦合设备与近程卡根据安全参数建立安全链路。
上述步骤 1的具体实施方式可以为：
在近程耦合设备与近程卡执行 IS0/IEC 14443传输协议过程中， 近程耦合 设备在向近程卡发送的选择应答请求 RATS (Request for Answer To Select ) 中包含安全参数请求消息， 用于发起与近程卡的安全参数协商。
上述步骤 2的具体实施方式可以为：
在近程耦合设备与近程卡执行 IS0/IEC 14443传输协议过程中， 近程卡在 收到近程耦合设备的选择应答请求 RATS后， 向近程耦合设备返回选择应答 ATS (Answer To Select ) ， 选择应答 ATS中包括近程卡对鉴别机制和密码算法等 安全参数的支持情况的信息。 所述鉴别机制包括但不限于基于预共享密钥的 鉴别机制， 或者是基于证书的鉴别机制。 所述密码算法包括但不限于对称密 码算法， 或者非对称密码算法。
上述步骤 3的具体实施方式可以为：
在近程耦合设备与近程卡协商完安全参数 （即， 按照步骤 1、 2完成安全 参数的请求及反馈） 后， 双方按照协商的安全参数中的鉴别机制进行身份鉴 别， 例如基于预共享密钥的鉴别， 或者基于数字证书的鉴别。 身份鉴别成功 后， 即建立了近程耦合设备与近程卡之间的安全链路。
在其他实施例中， 上述步骤 3还可以进一步包括：
近程耦合设备与近程卡可在身份鉴别时协商产生会话密钥， 近程耦合设 备与近程卡利用会话密钥对数据进行加密传输， 实现保密通信。 会话密钥也 可通过其他方式产生， 例如， 利用密钥预分发的方式， 即在保密通信之前将 会话密钥预分发给近程耦合设备与近程卡。
在步骤 1之前， 还可以包括步骤 0， 用于近程卡向近程耦合设备通告其安 全能力， 具体为：
步骤 0 在通信初始化和防冲突过程中， 近程卡向近程耦合设备通告其具 备空中接口安全防护能力。
步骤 0的具体实施方式为：
步骤 01 IS0/IEC 14443协议初始化和防冲突过程中， 近程耦合设备向近 程卡发送选择命令；
步骤 02 近程卡收到近程耦合设备发送的选择命令后， 在近程卡返回的响 应中包含其支持空中接口安全防护能力的信息。
上述步骤 02的具体实施方式可以为：
在 IS0/IEC 14443协议初始化和防冲突过程中， 近程卡收到近程耦合设备 发送的选择命令后， 近程卡在其向近程耦合设备发送的选择确认 SAK (Select AcKnowledge ) 中包含其支持空中接口安全防护能力的信息， 该信息可通过 在原有 SAK取值基础上新增取值来承载， 用于告知选择该近程卡的近程耦合设 备其具备空中接口安全防护能力。
上述步骤 1及步骤 2的具体实施例可为：
例 1， 上述步骤 1中， 在近程耦合设备与近程卡执行 IS0/IEC 14443传输协 议过程中， 近程耦合设备向近程卡发送选择应答请求 RATS, 选择应答请求 RAT S中包含安全参数请求消息， 该消息中包含近程耦合设备支持的所有鉴别机制 和近程耦合设备支持的所有密码算法； 上述步骤 2中， 近程卡在收到选择应答 请求 RATS后， 首先根据本地策略从近程耦合设备支持的所有鉴别机制和近程 耦合设备支持的所有密码算法中选择一种鉴别机制和密码算法的组合， 然后 向近程耦合设备返回选择应答 ATS , 选择应答 ATS中包括所述鉴别机制和密码 算法的组合；
例 2， 上述步骤 1中， 在近程耦合设备与近程卡执行 IS0/IEC 14443传输协 议过程中， 近程耦合设备向近程卡发送选择应答请求 RATS , 选择应答请求 RAT S中包含安全参数请求消息； 上述步骤 2中， 近程卡收到选择应答请求 RATS后， 向近程耦合设备返回选择应答 ATS , 选择应答 ATS中包含近程卡支持的所有鉴 别机制和近程卡支持的所有密码算法， 从而使近程耦合设备可根据其本地策 略从近程卡支持的所有鉴别机制和近程卡支持的所有密码算法中选择一种鉴 别机制与密码算法的组合， 作为与近程卡协商产生的安全参数；
例 3， 上述步骤 1中， 在近程耦合设备与近程卡执行 IS0/IEC 14443传输协 议过程中， 近程耦合设备向近程卡发送选择应答请求 RATS , 选择应答请求 RAT S中包含安全参数请求消息； 上述步骤 2中， 近程卡收到选择应答请求 RATS后， 在自己所支持的所有鉴别机制和自己支持的所有密码算法中选择一种鉴别机 制与密码算法组合包含在 ATS中返回给近程耦合设备， 作为与近程耦合设备协 商产生的安全参数；
例 4， 上述步骤 1中， 在近程耦合设备与近程卡执行 IS0/IEC 14443传输协 议过程中， 近程耦合设备向近程卡发送选择应答请求 RATS , 选择应答请求 RAT S中包含安全参数请求消息， 该消息中包含近程耦合设备在自己所支持的所有 鉴别机制和支持的所有密码算法组合中选择的一种鉴别机制与密码算法组 合； 上述步骤 2中， 近程卡收到 RATS后， 根据本地策略判断自己是否支持 RATS 中的所述鉴别机制与密码算法组合， 并将判断结果通过 ATS返回给近程耦合设 备。
本发明还提供了用于实施上述空中接口安全方法的近程耦合设备。 近程 耦合设备包括第一发送单元、 第一接收单元及第一链路建立单元。 近程耦合设备的第一发送单元用于向近程卡发送安全参数请求消息， 第 一接收单元用于接收近程卡发来的安全参数反馈， 第一链路建立单元用于根 据安全参数建立与近程卡之间的安全链路。
近程耦合设备的具体实施方式可以为：
在近程耦合设备执行 IS0/IEC 14443协议的传输协议过程中， 近程耦合设 备的第一发送单元在向近程卡发送的选择应答请求 RATS中包含安全参数请求 消息， 用于发起与近程卡的安全参数协商； 第一接收单元接收近程卡发来的 选择应答 ATS , 选择应答 ATS中包括近程卡对鉴别机制和密码算法等安全参数 的支持情况的信息； 第一链路建立单元在与近程卡协商完安全参数后， 按照 协商的安全参数中的鉴别机制对近程卡进行身份鉴别。 身份鉴别成功后， 即 建立了近程耦合设备与近程卡之间的安全链路。
在其他实施方式中， 在身份鉴别时， 近程耦合设备的第一链路建立单元 还可与近程卡协商产生会话密钥， 使得近程耦合设备与近程卡可利用会话密 钥对数据进行加密传输， 从而实现保密通信。 会话密钥也可通过其他方式产 生， 例如， 利用密钥预分发的方式， 即在保密通信之前将会话密钥预分发给 近程耦合设备的第一链路建立单元与近程卡。
进一步地， 在其他实施方式中， 近程耦合设备还可接收近程卡向近程耦 合设备通告的安全能力， 即在通信初始化和防冲突过程中， 近程耦合设备接 收近程卡向近程耦合设备通告的近程卡具备空中接口安全防护能力。 一较佳 实施例是： 在 IS0/IEC 14443协议初始化和防冲突过程中， 近程耦合设备的第 一发送单元向近程卡发送选择命令； 第一接收单元接收近程卡向近程耦合设 备通告的近程卡支持空中接口安全防护能力的信息， 该信息可包含于近程卡 发送的选择确认 SAK中， 并可通过在原有 SAK取值基础上新增取值来承载。
近程耦合设备的第一发送单元和第一接收单元的具体实施例可为： 例 1， 第一发送单元向近程卡发送选择应答请求 RATS, 选择应答请求 RATS 中包含安全参数请求消息， 该消息中包含近程耦合设备支持的所有鉴别机制 和近程耦合设备支持的所有密码算法； 第一接收单元接收近程卡发来的选择 应答 ATS , 选择应答 ATS中包括近程卡根据其本地策略从近程耦合设备支持的 所有鉴别机制和近程耦合设备支持的所有密码算法中选择的一种鉴别机制和 密码算法的组合；
例 2， 第一发送单元向近程卡发送选择应答请求 RATS, 选择应答请求 RATS 中包含安全参数请求消息； 第一接收单元接收近程卡发来的选择应答 ATS, 选 择应答 ATS中包含近程卡支持的所有鉴别机制和近程卡支持的所有密码算法， 从而使近程耦合设备的第一链路建立单元可根据近程卡的本地策略从近程卡 支持的所有鉴别机制和近程卡支持的所有密码算法中选择一种鉴别机制与密 码算法的组合， 作为与近程卡协商产生的安全参数；
例 3， 第一发送单元向近程卡发送选择应答请求 RATS, 选择应答请求 RATS 中包含安全参数请求消息； 第一接收单元接收近程卡发来的选择应答 ATS, 选 择应答 ATS中包含近程卡在自己所支持的所有鉴别机制和自己支持的所有密 码算法中选择一种鉴别机制与密码算法组合， 作为近程耦合设备与近程卡协 商产生的安全参数；
例 4， 第一发送单元向近程卡发送选择应答请求 RATS, 选择应答请求 RATS 中包含安全参数请求消息， 该消息中包含第一链路建立单元在近程耦合设备 所支持的所有鉴别机制和支持的所有密码算法组合中选择的一种鉴别机制与 密码算法组合； 第一接收单元接收近程卡发来的选择应答 ATS , 选择应答 ATS 中包含近程卡根据其本地策略判断其是否支持 RATS中的所述鉴别机制与密码 算法组合的判断结果。
本发明还提供了用于实施上述空中接口安全方法的近程卡。 近程卡包括 第二接收单元、 第二发送单元及第二链路建立单元。
近程卡的第二接收单元用于接收近程耦合设备发来的安全参数请求消 息， 第二发送单元由于向近程耦合设备发送安全参数反馈， 第二链路建立单 元用于与近程耦合设备根据安全参数建立安全链路。 近程卡的具体实施方式可以为：
在近程卡执行 IS0/IEC 14443协议的传输协议过程中， 近程卡的第二接收 单元接收近程耦合设备发送的选择应答请求 RATS, 选择应答请求 RATS中包含 安全参数请求消息， 用于发起与近程卡的安全参数协商； 第二发送单元向近 程耦合设备发送选择应答 ATS , 选择应答 ATS中包括近程卡对鉴别机制和密码 算法的等安全参数的支持情况的信息； 第二链路建立单元在与近程耦合设备 协商完安全参数后， 按照协商的安全参数中的鉴别机制进行身份鉴别。 身份 鉴别成功后， 即建立了近程耦合设备与近程卡之间的安全链路。
在其他实施例中， 在身份鉴别时， 近程卡的第二链路建立单元还可与近 程耦合设备协商产生会话密钥， 使得近程卡与近程耦合设备利用会话密钥对 数据进行加密传输， 从而实现保密通信。 会话密钥也可通过其他方式产生， 例如， 利用密钥预分发的方式， 即在保密通信之前将会话密钥预分发给近程 卡的第二链路建立单元及近程耦合设备。
进一步地， 在其他实施方式中， 近程卡还可用于向近程耦合设备通告其 安全能力， 即在通信初始化和防冲突过程中， 近程卡向近程耦合设备通告其 具备空中接口安全防护能力。 一较佳实施例是： 在 IS0/IEC 14443协议初始 化和防冲突过程中， 近程卡的第二接收单元接收近程耦合设备发送的选择命 令； 第二发送单元向进程耦合设备返回其支持空中接口安全防护能力的信息， 该信息可被在原有 SAK取值基础上新增的取值来承载并通过包含在选择确认 S AK中发给近程耦合设备， 用于向近程耦合设备告知其具备空中接口安全防护 能力。
近程卡的第二发送单元和第二接收单元的具体实施例可为：
例 1， 第二接收单元接收近程耦合设备发送的选择应答请求 RATS, 选择应 答请求 RATS中包含安全参数请求消息， 该消息中包含近程耦合设备支持的所 有鉴别机制和近程耦合设备支持的所有密码算法； 第二发送单元向近程耦合 设备返回选择应答 ATS , 选择应答 ATS中包括第二链路建立单元根据近程卡本 地策略从近程耦合设备支持的所有鉴别机制和近程耦合设备支持的所有密码 算法中选择的一种鉴别机制和密码算法的组合；
例 2， 第二接收单元接收近程耦合设备发送的选择应答请求 RATS, 选择应 答请求 RATS中包含安全参数请求消息； 第二发送单元向近程耦合设备返回选 择应答 ATS , 选择应答 ATS中包含近程卡支持的所有鉴别机制和近程卡支持的 所有密码算法， 从而使近程耦合设备可根据其本地策略从近程卡支持的所有 鉴别机制和近程卡支持的所有密码算法中选择一种鉴别机制与密码算法的组 合， 作为与近程卡协商产生的安全参数；
例 3， 第二接收单元接收近程耦合设备发送的选择应答请求 RATS, 选择应 答请求 RATS中包含安全参数请求消息； 第二发送单元向近程耦合设备返回选 择应答 ATS , 选择应答 ATS中包含第二链路建立单元在近程卡所支持的所有鉴 别机制和近程卡支持的所有密码算法中选择的一种鉴别机制与密码算法组 合， 作为与近程耦合设备协商产生的安全参数；
例 4， 第二接收单元接收近程耦合设备发送的选择应答请求 RATS, 选择应 答请求 RATS中包含安全参数请求消息， 该消息中包含近程耦合设备在自己所 支持的所有鉴别机制和支持的所有密码算法组合中选择的一种鉴别机制与密 码算法组合； 第二发送单元向近程耦合设备返回选择应答 ATS , 选择应答 ATS 中包含第二链路建立单元根据近程卡本地策略判断是否支持 RATS中的所述鉴 别机制与密码算法组合的判断结果。
本发明通过引入安全能力通告、 安全参数协商、 身份鉴别以及保密通信 等安全机制， 增强了 IS0/IEC 14443 空中接口的安全防护能力， 能够为近程 耦合设备和近程卡提供身份鉴别功能， 确保通信双方身份的合法性和真实性， 并能够在需要时为近程耦合设备和近程卡提供保密通信功能， 防止通信数据 被窃取、 篡改等。 同时， 本发明很好地解决了兼容性问题， 空中接口安全 IS 0/IEC 14443协议能够与原有 IS0/IEC 14443协议完全兼容，只有在近程耦合 设备和近程卡同时支持增强空口安全防护能力的 IS0/IEC 14443协议时， 才 以本发明提供的方法进行安全通信， 其他情况， 包括只有近程耦合设备支持 具备空口安全防护能力的 IS0/IEC 14443 协议或者只有近程卡支持具备空口 安全防护能力的 IS0/IEC 14443协议等，近程耦合设备和近程卡仍采用原有 I S0/IEC 14443协议进行通信。 此外， 增强空口安全防护能力的 IS0/IEC 1444 3 协议在增加系统安全性的同时不会为近程耦合设备和近程卡带来额外的硬 件开销。
以上所述的具体实施方式， 对本发明的目的、 技术方案和有益效果进行 了进一步详细说明， 所应理解的是， 以上所述仅为本发明的具体实施方式而 已， 并不用于限定本发明的保护范围， 凡在本发明的精神和原则之内， 所做 的任何修改、 等同替换、 改进等， 均应包含在本发明的保护范围之内。

Claims

权 利 要 求 书
1、 一种空中接口安全方法， 其特征在于， 在传输协议过程中执行以下步 骤：
1 ) 近程耦合设备向近程卡发送安全参数请求消息；
2 )所述近程卡收到安全参数请求消息后， 向所述近程耦合设备进行安全 参数反馈；
3 ) 所述近程耦合设备与所述近程卡根据安全参数建立安全链路。
2、 根据权利要求 1所述的空中接口安全方法， 其特征在于： 所述步骤 1 ) 进一步包括：
所述近程耦合设备向所述近程卡发送选择应答请求 RATS , 所述选择应答 请求 RATS中包含安全参数请求消息， 用于发起与所述近程卡的安全参数协商。
3、 根据权利要求 1所述的空中接口安全方法， 其特征在于： 所述步骤 2 ) 进一步包括：
所述近程卡在收到所述近程耦合设备的选择应答请求 RATS后， 向所述近 程耦合设备返回选择应答 ATS , 所述选择应答 ATS中包括所述近程卡对鉴别机 制和密码算法的支持情况的信息。
4、 根据权利要求 1所述的空中接口安全方法， 其特征在于： 所述步骤 3 ) 进一步包括：
在所述近程耦合设备与所述近程卡协商完安全参数后， 双方按照协商的 鉴别机制进行身份鉴别， 身份鉴别成功后， 建立所述近程耦合设备与所述近 程卡之间的安全链路。
5、 根据权利要求 4所述的空中接口安全方法， 其特征在于： 所述步骤 3 ) 还进一步包括：
所述近程耦合设备与所述近程卡产生会话密钥， 所述近程耦合设备与所 述近程卡利用会话密钥对数据进行加密传输， 实现保密通信。
6、 根据权利要求 1-5中任意一项所述的空中接口安全方法， 其特征在于: 所述传输协议过程为 IS0/IEC 14443协议的传输协议过程。
7、 根据权利要求 1-5中任意一项所述的空中接口安全方法， 其特征在于: 所述步骤 1 ) 之前还包括：
步骤 0)在通信初始化和防冲突过程中， 所述近程卡向所述近程耦合设备 通告所述近程卡具备空中接口安全防护能力。
8、 根据权利要求 7所述的空中接口安全方法， 其特征在于： 所述步骤 0) 进一步包括：
步骤 01 ) 所述近程耦合设备向所述近程卡发送选择命令；
步骤 02 ) 所述近程卡收到所述近程耦合设备发送的所述选择命令后向所 述近程耦合设备返回响应， 所述响应中包含所述近程卡支持空中接口安全防 护能力的信息。
9、 根据权利要求 8所述的空中接口安全方法， 其特征在于： 所述步骤 02 ) 进一步包括：
所述近程卡收到所述近程耦合设备发送的选择命令后， 所述近程卡向所 述近程耦合设备发送选择确认 SAK, 所述选择确认 SAK中包含所述近程卡支持 空中接口安全防护能力的信息， 该信息通过在原有 SAK取值基础上新增取值来 承载， 用于告知选择该近程卡的近程耦合设备其具备空中接口安全防护能力。
10、 根据权利要求 7所述的空中接口安全方法， 其特征在于： 所述通信初 始化和防冲突过程为 IS0/IEC 14443协议的通信初始化和防冲突过程。
11、根据权利要求 1-5中任意一项所述的空中接口安全方法，其特征在于: 所述步骤 1 ) 及步骤 2 ) 具体为：
所述步骤 1 )中，所述近程耦合设备向所述近程卡发送选择应答请求 RATS, 所述选择应答请求 RATS中包含安全参数请求消息， 所述安全参数请求消息中 包含所述近程耦合设备支持的所有鉴别机制和近程耦合设备支持的所有密码 所述步骤 2 ) 中， 所述近程卡在收到所述选择应答请求 RATS后， 首先根据 本地策略从所述近程耦合设备支持的所有鉴别机制和所述近程耦合设备支持 的所有密码算法中选择一种鉴别机制和密码算法的组合， 然后向所述近程耦 合设备返回选择应答 ATS , 所述选择应答 ATS中包括所述鉴别机制和密码算法 的组合。
12、根据权利要求 1-5中任意一项所述的空中接口安全方法，其特征在于: 所述步骤 1 ) 及步骤 2 ) 具体为：
所述步骤 1 )中，所述近程耦合设备向所述近程卡发送选择应答请求 RATS , 所述选择应答请求 RATS中包含安全参数请求消息；
所述步骤 2 ) 中， 所述近程卡收到所述选择应答请求 RATS后， 向所述近程 耦合设备返回选择应答 ATS , 所述选择应答 ATS中包含近程卡支持的所有鉴别 机制和近程卡支持的所有密码算法。
13、根据权利要求 1-5中任意一项所述的空中接口安全方法，其特征在于: 所述步骤 1 ) 及步骤 2 ) 具体为：
所述步骤 1 )中，所述近程耦合设备向所述近程卡发送选择应答请求 RATS , 所述选择应答请求 RATS中包含安全参数请求消息；
所述步骤 2 ) 中， 所述近程卡收到所述选择应答请求 RATS后， 在自己所支 持的所有鉴别机制和自己支持的所有密码算法中选择一种鉴别机制与密码算 法组合， 并向所述近程耦合设备发送选择应答 ATS , 所述选择应答 ATS中包含 所述鉴别机制与密码算法组合。
14、根据权利要求 1-5中任意一项所述的空中接口安全方法，其特征在于: 所述步骤 1 ) 及步骤 2 ) 具体为：
所述步骤 1 )中，所述近程耦合设备向所述近程卡发送选择应答请求 RATS , 所述选择应答请求 RATS中包含安全参数请求消息， 所述安全参数请求消息中 包含所述近程耦合设备在所述近程耦合设备支持的所有鉴别机制和近程耦合 设备支持的所有密码算法组合中选择的一种鉴别机制与密码算法组合； 所述步骤 2 ) 中， 所述近程卡收到所述选择应答请求 RATS后， 根据本地策 略判断自己是否支持 RATS中的所述鉴别机制与密码算法组合， 并将判断结果 通过选择应答 ATS返回给所述近程耦合设备。
15、 一种近程耦合设备， 可执行传输协议过程， 其特征在于， 所述近程 耦合设备包括：
发送单元， 用于向近程卡发送安全参数请求消息；
接收单元， 用于接收所述近程卡发来的安全参数反馈；
链路建立单元， 用于根据所述安全参数建立与所述近程卡之间的安全链 路。
16、 根据权利要求 15所述的近程耦合设备， 其特征在于：
所述发送单元， 还用于向所述近程卡发送选择命令；
所述接收单元， 还用于接收所述近程卡向所述近程耦合设备通告的安全 能力。
17、 一种近程卡， 可执行传输协议过程， 其特征在于， 所述近程卡包括: 接收单元， 用于接收近程耦合设备发来的安全参数请求消息；
发送单元， 用于向所述近程耦合设备发送安全参数反馈；
链路建立单元， 用于根据所述安全参数建立与所述近程耦合设备之间的 安全链路。
18、 根据权利要求 17所述的近程卡， 其特征在于：
所述接收单元， 还用于接收所述近程耦合设备发来的选择命令； 所述发送单元， 还用于向所述近程耦合设备发送所述近程卡支持空中接 口安全防护能力的信息。
PCT/CN2013/072632 2012-04-11 2013-03-14 空中接口安全方法及设备 WO2013152653A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
US14/394,036 US9350721B2 (en) 2012-04-11 2013-03-14 Air interface security method and device
EP13775724.1A EP2838224B1 (en) 2012-04-11 2013-03-14 Air interface security method and device
KR1020147031673A KR101601071B1 (ko) 2012-04-11 2013-03-14 무선 인터페이스의 보안 방법 및 장치

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201210121152.8 2012-04-11
CN201210121152.8A CN103379487B (zh) 2012-04-11 2012-04-11 空中接口安全方法及设备

Publications (1)

Publication Number Publication Date
WO2013152653A1 true WO2013152653A1 (zh) 2013-10-17

Family

ID=49327075

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2013/072632 WO2013152653A1 (zh) 2012-04-11 2013-03-14 空中接口安全方法及设备

Country Status (5)

Country Link
US (1) US9350721B2 (zh)
EP (1) EP2838224B1 (zh)
KR (1) KR101601071B1 (zh)
CN (1) CN103379487B (zh)
WO (1) WO2013152653A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10447338B2 (en) 2016-09-23 2019-10-15 Microsoft Technology Licensing, Llc Orthogonal spreading sequence creation using radio frequency parameters
US10020838B2 (en) 2016-09-23 2018-07-10 Microsoft Technology Licensing, Llc Sequence generation for spread spectrum from signal sampling
CN111263359B (zh) * 2020-02-21 2023-08-15 北京蓝玛星际科技有限公司 一种移动空口侦控平台系统

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101038619A (zh) * 2007-02-06 2007-09-19 中国科学院研究生院 射频识别系统隐私认证方法
WO2007147306A1 (fr) * 2006-06-13 2007-12-27 Zte Corporation Procédé de communication entre lecteur et étiquette dans le système rfid
CN101114901A (zh) * 2006-07-26 2008-01-30 联想(北京)有限公司 非接触式无线数据传输的安全认证系统、设备及方法

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6772331B1 (en) * 1999-05-21 2004-08-03 International Business Machines Corporation Method and apparatus for exclusively pairing wireless devices
US7254367B2 (en) * 2004-06-23 2007-08-07 Agere Systems Inc. Method and apparatus for pairing and configuring wireless devices
KR100931507B1 (ko) * 2007-12-11 2009-12-11 한국전자통신연구원 Ｒｆｉｄ 시스템에서 대칭키 암호화 기반 통신 데이터 보호방법과 이를 수행하기 위한 리더 및 태그
US20100001840A1 (en) * 2008-07-07 2010-01-07 You Sung Kang Method and system for authenticating rfid tag
SG165220A1 (en) * 2009-03-25 2010-10-28 Toshiba Kk Processing apparatus of portable electronic devices, portable electronic device, and processing system of portable electronic devices
US8432261B2 (en) * 2010-02-26 2013-04-30 GM Global Technology Operations LLC Simplified device pairing employing near field communication tags
CN102143488B (zh) * 2010-12-06 2013-06-12 西安西电捷通无线网络通信股份有限公司 一种读写器与电子标签安全通信的方法
US8774041B2 (en) * 2012-03-02 2014-07-08 Qualcomm Incorporated Proximity-based wireless handshaking for connection establishment

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2007147306A1 (fr) * 2006-06-13 2007-12-27 Zte Corporation Procédé de communication entre lecteur et étiquette dans le système rfid
CN101114901A (zh) * 2006-07-26 2008-01-30 联想(北京)有限公司 非接触式无线数据传输的安全认证系统、设备及方法
CN101038619A (zh) * 2007-02-06 2007-09-19 中国科学院研究生院 射频识别系统隐私认证方法

Also Published As

Publication number Publication date
EP2838224A4 (en) 2015-12-23
KR20150002798A (ko) 2015-01-07
US9350721B2 (en) 2016-05-24
EP2838224A1 (en) 2015-02-18
US20150089588A1 (en) 2015-03-26
CN103379487A (zh) 2013-10-30
EP2838224B1 (en) 2018-07-25
CN103379487B (zh) 2018-08-24
KR101601071B1 (ko) 2016-03-08

Similar Documents

Publication Publication Date Title
CN111049660B (zh) 证书分发方法、系统、装置及设备、存储介质
AU2011305477B2 (en) Shared secret establishment and distribution
CN108769007B (zh) 网关安全认证方法、服务器及网关
CN105337977A (zh) 一种动态双向认证的安全移动通讯架构及其实现方法
KR101531662B1 (ko) 사용자 단말과 서버간 상호 인증 방법 및 시스템
CN110505055A (zh) 基于非对称密钥池对和密钥卡的外网接入身份认证方法和系统
CN110635901A (zh) 用于物联网设备的本地蓝牙动态认证方法和系统
CN111416712B (zh) 基于多个移动设备的量子保密通信身份认证系统及方法
KR100957044B1 (ko) 커버로스를 이용한 상호 인증 방법 및 그 시스템
WO2017020530A1 (zh) 一种增强的wlan证书鉴别方法、装置及系统
CN101272241B (zh) 一种密钥的分配与管理方法
CN104796399B (zh) 一种数据加密传输的密钥协商方法
CN110519222A (zh) 基于一次性非对称密钥对和密钥卡的外网接入身份认证方法和系统
WO2013152653A1 (zh) 空中接口安全方法及设备
KR20130007097A (ko) 스마트폰 서비스의 보안 시스템 및 보안 방법
CN113905359B (zh) 一种银行外设的蓝牙安全通讯方法、装置、设备和介质
CN104796892A (zh) 基于近场通信nfc的无线局域网wlan身份验证方法
CN112995140B (zh) 安全管理系统及方法
CN108809656A (zh) 一种基于双重认证防护签名的密钥交换协议构造方法
CN105245532B (zh) 基于nfc认证的wlan接入方法
Gupta et al. Security mechanisms of Internet of things (IoT) for reliable communication: a comparative review
CN104780537A (zh) 一种无线局域网wlan身份验证方法
JP2009104509A (ja) 端末認証システム、端末認証方法
Sameni et al. Analysis of Attacks in Authentication Protocol IEEE 802.16 e
CN101917722B (zh) 一种无线城域网终端非归属地接入身份鉴别的方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 13775724

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 14394036

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 2013775724

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 20147031673

Country of ref document: KR

Kind code of ref document: A