WO2022121938A1 - 一种利用定时通讯保护密钥协商的安全通信方法及系统 - Google Patents
一种利用定时通讯保护密钥协商的安全通信方法及系统 Download PDFInfo
- Publication number
- WO2022121938A1 WO2022121938A1 PCT/CN2021/136413 CN2021136413W WO2022121938A1 WO 2022121938 A1 WO2022121938 A1 WO 2022121938A1 CN 2021136413 W CN2021136413 W CN 2021136413W WO 2022121938 A1 WO2022121938 A1 WO 2022121938A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- smart card
- card reader
- response
- card
- key
- Prior art date
Links
- 238000004891 communication Methods 0.000 title claims abstract description 160
- 238000000034 method Methods 0.000 title claims abstract description 103
- 230000005540 biological transmission Effects 0.000 claims abstract description 56
- 238000012545 processing Methods 0.000 claims abstract description 26
- 238000012795 verification Methods 0.000 claims description 22
- 230000003993 interaction Effects 0.000 claims description 11
- 230000001360 synchronised effect Effects 0.000 abstract description 10
- 238000005259 measurement Methods 0.000 description 11
- 238000010586 diagram Methods 0.000 description 3
- 230000000737 periodic effect Effects 0.000 description 2
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
- H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
- H04W12/0431—Key distribution or pre-distribution; Key agreement
Definitions
- the present invention relates to the technical field of communication, and in particular, to a method and system for secure communication using timing communication to protect key negotiation.
- the existing non-contact IC card reader card reading mechanism is based on 14443, 15693 and other protocols for data transmission.
- the protocol during the card reading process between the card reader and the card, after the card reader sends the instruction data , there will be a frame waiting time, indicating the maximum time range that the card reader waits to receive the response data from the card. That is to say, after the card reader sends an instruction to the card, the card reader is waiting to receive the response data from the card. As long as the data is returned within the waiting time, the card reader will receive it.
- it is easy to Security risks such as man-in-the-middle attack and data tampering.
- the present invention aims to solve one of the above problems.
- the main purpose of the present invention is to provide a secure communication method utilizing timing communication to protect key negotiation
- Another object of the present invention is to provide a secure communication system utilizing timing communication to protect key negotiation.
- One aspect of the present invention provides a secure communication method using timing communication to protect key negotiation, including:
- the card reader establishes a communication connection with the smart card, and the communication connection includes a wired connection or a wireless connection;
- the card reader sends a judgment instruction to the smart card and starts timing
- the smart card receives the judgment instruction, starts timing, and generates a judgment response
- the smart card sends the determination response to the card reader when the timing reaches a preset duration, wherein the preset duration is the length of time used by the smart card to generate the determination response according to the determination instruction;
- the card reader starts to receive the determination response when the timing reaches the window range of the preset duration, where the window range of the preset duration is [T, T+ ⁇ T], where T is the The preset duration, ⁇ T is the transmission duration, and the transmission duration is calculated according to the distance between the smart card and the card reader;
- the card reader receives the determination response, it performs a key negotiation process with the smart card, and the card reader and the smart card generate session keys respectively;
- the session key is used for communication between the card reader and the smart card.
- Another aspect of the present invention provides a secure communication system utilizing timing communication to protect key negotiation, including: a card reader and a smart card; wherein:
- the card reader is used to establish a communication connection with the smart card, the communication connection includes a wired connection or a wireless connection; send a determination instruction to the smart card, and start timing;
- the smart card is used to receive the judgment instruction, start timing, and generate a judgment response; when the timing reaches a preset duration, send the judgment response to the card reader, wherein the preset duration is the the length of time used by the smart card to generate a judgment response according to the judgment instruction;
- the card reader is further configured to start receiving the determination response within a window range within which the timing reaches the preset duration, where the window range of the preset duration is [T, T+ ⁇ T], where, T is the preset duration, ⁇ T is the transmission duration, and the transmission duration is calculated according to the distance between the smart card and the card reader; if the card reader receives the determination response, Perform a key negotiation process with the smart card, and generate a session key with the smart card respectively; communicate with the smart card through the session key.
- Another aspect of the present invention provides a secure communication method using timing communication to protect key negotiation, including:
- the card reader establishes a communication connection with the smart card, and the communication connection includes a wired connection or a wireless connection;
- the card reader performs a key agreement operation with the smart card
- the card reader sends the first information to the smart card and starts timing
- the smart card receives the first information, starts timing, and generates a first response
- the smart card sends the first response to the card reader when the timing reaches a preset duration, wherein the preset duration is the duration of data processing by the smart card;
- the card reader starts to receive the first response within the window range of the preset duration, where the window range of the preset duration is [T, T+ ⁇ T], where T is the The preset duration, ⁇ T is the transmission duration, and the transmission duration is calculated at least according to the distance between the smart card and the card reader;
- the card reader and the smart card After receiving the first response, the card reader and the smart card respectively generate a session key
- the session key is used for communication between the card reader and the smart card.
- Another aspect of the present invention provides a secure communication system utilizing timing communication to protect key negotiation, including: a card reader and a smart card; wherein:
- the card reader is used to establish a communication connection with a smart card, the communication connection includes a wired connection or a wireless connection; perform a key agreement operation with the smart card; perform a key agreement operation between the card reader and the smart card During the process, send the first information to the smart card and start timing;
- the smart card is used to receive the first information, start timing, and generate a first response; when the timing reaches a preset duration, send the first response to the card reader, wherein the preset duration is the length of time used for data processing of the smart card;
- the card reader is further configured to start receiving the first response within a window range within which the timing reaches the preset duration, wherein the window range of the preset duration is [T, T+ ⁇ T], where , T is the preset duration, ⁇ T is the transmission duration, and the transmission duration is calculated at least according to the distance between the smart card and the card reader; after receiving the first response, and The smart card generates a session key respectively; communicates with the smart card through the session key.
- the present invention provides a secure communication method and system using timing communication to protect key negotiation.
- the card reader and the smart card set a synchronous timing mode.
- the judgment response or the first response is sent from time to time, and the card reader only receives the judgment response or the first response when the timing reaches the preset time window, which ensures that there is no man-in-the-middle attack between the card reader and the smart card, and the key negotiation
- the process itself is secure, thereby guaranteeing the security of subsequent data transmissions. Thereby, the security risk of data hijacking by the middleman that may exist in the card reading process is solved.
- FIG. 1 is a flowchart of a secure communication method using timing communication to protect key negotiation according to Embodiment 1 of the present invention
- FIG. 2 is a schematic structural diagram of a secure communication system using timing communication to protect key negotiation according to Embodiment 1 of the present invention.
- Embodiment 3 is a flowchart of another secure communication method using timing communication to protect key negotiation provided by Embodiment 2 of the present invention
- Fig. 4 is a schematic structural diagram of another secure communication system using timing communication to protect key negotiation according to Embodiment 2 of the present invention.
- the present invention determines the preset conditions before the key negotiation process starts, and executes the key negotiation process only when the preset conditions are met to ensure the key The security of the negotiation process itself, and then use the negotiated session key to protect the subsequent transaction application process to completely solve the problem of man-in-the-middle attacks.
- FIG. 1 shows a flowchart of a secure communication method using timing communication to protect key negotiation provided by an embodiment of the present invention.
- the secure communication method using timing communication to protect key negotiation provided by an embodiment of the present invention includes:
- the card reader establishes a communication connection with the smart card, and the communication connection includes a wired connection or a wireless connection.
- the card reader can establish a connection with the smart card.
- the connection can be a wired connection, such as a USB connection, or a network connection, or a wireless connection, such as an NFC connection, a Bluetooth connection, or a 2.4G connection.
- the specific connection The manner is not particularly limited in the present invention.
- the card reader sends a judgment instruction to the smart card, and starts timing
- the smart card receives the judgment instruction, starts timing, and generates a judgment response.
- the card reader sends a judgment instruction to the smart card, and after the smart card receives the judgment instruction, both parties synchronize timing.
- the determination command may be a single command or data to be processed, and the determination response may be a response to the command or a response after the data to be processed is processed.
- the secure communication method using timing communication to protect key negotiation further includes: the smart card determines It is determined whether the instruction is a preset instruction or whether the determination instruction carries a determination identifier; and the smart card determines whether the determination instruction is a preset instruction or the determination instruction carries a determination identifier.
- the timing can be started only after it is determined that the instruction is a preset instruction or the determination identifier is carried in it.
- the smart card sends a determination response to the card reader when the timing reaches a preset duration, where the preset duration is the duration of time used by the smart card to generate the determination response according to the determination instruction;
- the card reader starts to receive a determination response within a window range within which the timing reaches a preset duration, wherein the window range of the preset duration is [T, T+ ⁇ T], where T is the preset duration, and ⁇ T is the transmission
- the transmission time is calculated according to the distance between the smart card and the card reader.
- a preset duration is set between the card reader and the smart card. After both parties have timed to the preset duration, the smart card sends a judgment response, the card reader receives the judgment response, and the card reader only receives within the preset duration window. Judgment response.
- the card reader and the smart card determine a fixed preset duration T for sending and receiving communication, the card reader determines the data transmission duration ⁇ T, and the smart card sends a judgment response after the time interval T according to the agreement, and the card reader can only be in the time window [T, Receive the judgment response within the time interval of T+ ⁇ T], if the third-party man-in-the-middle attacks remotely, the time for forwarding and processing data will not meet the time window, which ensures that the data interaction in the subsequent key negotiation process cannot be tampered with.
- the time window for the card reader to receive the judgment response is T+ ⁇ T
- T is the time limit for command processing
- the smart card sends data according to T
- ⁇ T is the data transmission time tolerance range, for example, if it is non-contact communication, it is The accommodating range of air transmission time
- the ⁇ T transmission time is calculated according to the distance between the smart card and the card reader. For example, if it is a contactless communication, the ⁇ T can be the maximum allowed between the card reader and the smart card.
- the preset duration is negotiated between the card reader and the smart card; or the preset duration is pre-stored in the card reader and the smart card; or the determination instruction includes a duration identifier, and the preset duration The duration corresponding to the duration ID is obtained for the smart card according to the duration ID.
- the preset duration T can be prefabricated and stored in the fixed area of the chip before the device leaves the factory, or the preset duration set can be stored in the device, and the selected T can be determined by sending an identifier each time, or Yes, each instruction data transmitted has a T value in it.
- the preset duration can be sent to the smart card by the card reader carrying the duration identifier in the judgment instruction, and the smart card can obtain the corresponding preset duration according to the duration identifier; or both parties can store a list of preset durations, and select one each time according to the preset rules. preset duration. This is not specifically limited in the present invention.
- the timing includes: the card reader and the smart card use built-in clocks for timing respectively; or the card reader and the smart card respectively use the periodic timing of the communication signal; or the card reader and the smart card respectively communicate with each other.
- the phase timing of the signal; or the card reader and the smart card are respectively timed by the modulated pulse signal of the communication signal.
- timing methods may include but are not limited to:
- Timing measurement Both the card reader and smart card support precise timing function, and use the built-in clock for timing.
- Period measurement For contactless communication, the time is recorded by recording the period of the carrier wave.
- the card reader and the smart card respectively perform synchronous timing measurement through the period of the communication signal; the card reader and the smart card can use the judgment command to send and receive ends as the start identifier of the synchronous timing.
- the card reader and the smart card can perform synchronous timing measurement based on the phase of the communication signal, set the expected phase, and the card reader and the smart card can judge the end of the sending and receiving of the command as the start mark of the synchronous timing.
- the card reader and the smart card can perform synchronous counting measurement with the modulated pulse signal of the communication signal, and the card reader and the smart card can use the judgment command to send and receive the end as the start mark of the synchronous timing.
- the card reader receives the determination response, it performs a key negotiation process with the smart card, and the card reader and the smart card generate session keys respectively.
- the card reader only when the card reader receives the determination response, can it be determined that there is no risk of man-in-the-middle hijacking between the card reader and the smart card, and the subsequent key negotiation process can be performed, and the card reader and the smart card generate session keys respectively.
- a and B represent two communication parties, A can be a card reader, B can be a smart card, or B can be a card reader, and A can be a smart card.
- B uses the prefabricated CA root certificate to verify the received certificate of A. If the verification fails, an error message is sent to end the link; otherwise, the next step is performed;
- B generates random number R2, connects R1
- A uses the prefabricated CA root certificate in A to verify the received certificate of B. If the verification fails, an error message is sent to end the link; otherwise, the next step is performed;
- A checks whether the signature S2 is correct, if the verification fails, an error message is sent to end the link; otherwise, the next step is performed;
- Both parties A and B respectively use a specific method to calculate the session key based on R1
- the session key can include an encryption key and or a verification key, and the encryption key is used for the encryption of the sender during data transmission.
- the verification key is used to calculate the verification value when sending data.
- A generates a random number R2, and sends the random number R2 and A's certificate to B;
- B obtains the certificates of R2 and A, and B uses the prefabricated CA root certificate to verify the received certificate of A. If the verification fails, an error message is sent to end the link; otherwise, the next step is performed;
- B uses the public key in the certificate of A to encrypt R1 to generate ciphertext E1, and uses the private key to sign R2
- A uses the prefabricated CA root certificate to verify the received certificate of B. If the verification fails, an error message is sent to end the link; otherwise, the next step is performed;
- A checks whether the signature S1 is correct, if the verification fails, an error message is sent to end the link; otherwise, the next step is performed;
- Both parties A and B respectively use a specific method to calculate the session key based on R1.
- the session key can include an encryption key and or a verification key.
- the encryption key is used for the encryption of the sender and the receiver during data transmission.
- the decryption key is used to calculate the check value when sending data.
- a session key is used to communicate between the card reader and the smart card.
- the session key is used for communication between the card reader and the smart card to ensure the security of subsequent data transmission.
- the communication between the card reader and the smart card by using the session keys includes: a preset method between the card reader and the smart card from multiple session keys determine one of the keys to communicate.
- a preset method between the card reader and the smart card from multiple session keys determine one of the keys to communicate.
- each time the card reader and the smart card communicate one of multiple session keys can be determined for communication.
- the communication between the two parties is one-time-one-password to ensure the security of subsequent data transmission.
- using the secure communication method of using timing communication to protect key negotiation provided by the embodiment of the present invention is different from the existing communication method of sending data immediately after card processing is completed.
- the card reader and the smart card set a synchronous timing mode. After the card reader sends a judgment command to the smart card, the smart card only sends a judgment response when the timing expires, and the card reader only receives judgment within the window range of the preset time period.
- the response ensures that there is no man-in-the-middle attack between the card reader and the smart card, and the key negotiation process itself is secure, thereby ensuring the security of subsequent data transmissions. Thereby, the security risk of data hijacking by the middleman that may exist in the card reading process is solved.
- a secure communication system using timing communication to protect key negotiation includes: a card reader and a smart card; wherein:
- the card reader is used to establish a communication connection with the smart card, and the communication connection includes a wired connection or a wireless connection; send a judgment instruction to the smart card, and start timing;
- the smart card is used to receive the judgment instruction, start timing, and generate a judgment response; when the timing reaches a preset time length, the judgment response is sent to the card reader, wherein the preset time period is the length of time used by the smart card to generate the judgment response according to the judgment instruction;
- the card reader is also used to start receiving the judgment response within the window range when the timing reaches the preset time length, wherein the window range of the preset time length is [T, T+ ⁇ T], where T is the preset time length, ⁇ T is the transmission time, which is calculated according to the distance between the smart card and the card reader; if the card reader receives a judgment response, it performs the key negotiation process with the smart card, and generates a session key with the smart card; Communicate via session keys.
- the smart card is further configured to, after receiving the determination instruction, the smart card starts timing, and before generating the determination response, determine whether the determination instruction is a preset instruction or whether the determination instruction carries a determination identifier; And the smart card determines that the determination instruction is a preset instruction or the determination instruction carries a determination identifier.
- the preset duration is negotiated between the card reader and the smart card; or the preset duration is pre-stored in the card reader and the smart card; or the determination instruction includes a duration identifier, and the preset duration The duration corresponding to the duration ID is obtained for the smart card according to the duration ID.
- the card reader and the smart card are respectively timed in the following ways: the card reader and the smart card are respectively timed by using a built-in clock; or the card reader and the smart card are respectively timed by the period of the communication signal; or The card reader and the smart card are respectively timed by the phase of the communication signal; or the card reader and the smart card are respectively timed by the modulated pulse signal of the communication signal.
- the card reader communicates with the smart card through the session key in the following manner: the card reader is specifically used to communicate with the smart card according to the preset way to determine one of multiple session keys to communicate.
- the use of the secure communication device for protecting key negotiation using timing communication is different from the existing communication mode of sending data immediately after card processing is completed.
- the card reader and the smart card set a synchronous timing mode. After the card reader sends a judgment command to the smart card, the smart card only sends a judgment response when the timing expires, and the card reader only receives judgment within the window range of the preset time period.
- the response ensures that there is no man-in-the-middle attack between the card reader and the smart card, and the key negotiation process itself is secure, thereby ensuring the security of subsequent data transmissions. Thereby, the security risk of data hijacking by the middleman that may exist in the card reading process is solved.
- the present invention in order to ensure the security of the key negotiation process, in the process of executing the key negotiation process, the present invention first determines the preset conditions, and only when the preset conditions are met, the key negotiation process itself is determined. It is safe, and the subsequent transaction application process is protected by the negotiated session key, which completely solves the problem of man-in-the-middle attacks.
- FIG. 3 shows a flowchart of a secure communication method using timing communication to protect key negotiation provided by an embodiment of the present invention.
- the secure communication method using timing communication to protect key negotiation provided by an embodiment of the present invention includes:
- the card reader establishes a communication connection with the smart card, and the communication connection includes a wired connection or a wireless connection.
- the card reader can establish a connection with the smart card.
- the connection can be a wired connection, such as a USB connection, or a network connection, or a wireless connection, such as an NFC connection, a Bluetooth connection, or a 2.4G connection.
- the specific connection The manner is not particularly limited in the present invention.
- the card reader performs a key negotiation operation with the smart card.
- This embodiment provides two key negotiation processes. For details, refer to the two key negotiation processes provided in step S106 of Embodiment 1.
- the present invention uses this example to describe the key agreement process, but the present invention is not limited to this.
- the card reader sends the first information to the smart card, and starts timing
- the smart card receives the first information, starts timing, and generates a first response.
- the card reader sends the first information to the smart card, and after the smart card receives the first information, both parties synchronize timing.
- the secure communication method using timing communication to protect key negotiation further includes: the smart card determines Whether the first information is preset information or whether the first information carries an identifier is determined; and the smart card determines whether the first information is preset information or the first information carries an identifier. Specifically, timing can be started only after the first information is preset information or carries an identifier therein.
- the present invention can have two forms of existence of the first information and the first response:
- the first information is the key information during the key negotiation operation between the card reader and the smart card, and the first response is the key information generated after processing the key information Response; the preset duration is the duration for the smart card to process key information.
- the key information includes: the data to be signed; the key information response includes: the signature of the data to be signed; or the key information includes: the data to be verified; the key information response includes: the verification result of the verification of the data to be verified, or the verification result of the data to be verified.
- the data to be transmitted generated after passing the verification; or the key information includes: the data to be calculated;
- the key information response includes: the response generated after processing the to-be-calculated data, or the key information includes: a key hopping instruction;
- the key information response includes: Response to key hopping command.
- the key information is the random number R1 generated by B, and the response of the key information is the random signature S1 generated after processing by A and the certificate of A; in the key negotiation process of the above method 2 During the process, the key information is the certificates of R2 and A; the response of the key information is the certificates of E1, S2 and B sent by B after processing the received data.
- the above is only an implementation of the present invention. The invention is not limited to this.
- the first information is the first information sent by the card reader to the smart card
- the first response is that the card reader and the smart card perform key negotiation operations.
- the last information response is generated;
- the preset duration is the duration for the smart card to perform data interaction and generate the last information response;
- the transmission duration is calculated according to the distance between the smart card and the card reader and the number of interactions.
- the first information is the random number R1 generated by B, and the first response is the random signature S1 sent by A and the certificate of A; in the key negotiation process of the above method 2,
- the first information is the certificates of R2 and A sent by A, and the first response is the certificates of E1, S2 and B sent by B.
- the above is only an implementation manner of the present invention, and the present invention is not limited thereto.
- the smart card sends a first response to the card reader when the timing reaches a preset duration, where the preset duration is the duration of data processing by the smart card;
- the card reader starts to receive the first response within the window range within which the timing reaches the preset time length, wherein the window range of the preset time length is [T, T+ ⁇ T], where T is the preset time length, and ⁇ T is the Transmission duration, which is calculated at least according to the distance between the smart card and the card reader.
- a preset time duration is set between the card reader and the smart card. After the timing of both parties reaches the preset time duration, the smart card sends the first response, the card reader receives the first response, and the card reader is only within the window range of the preset duration. Receive the first response within.
- the card reader and the smart card both determine the fixed preset duration T for sending and receiving communication, the card reader determines the data transmission duration ⁇ T, the smart card sends the first response after the time interval T according to the agreement, and the card reader can only be used in the time window [T , T+ ⁇ T] to receive the first response, if a third-party man-in-the-middle attacks remotely, the time for forwarding and processing data will not meet the time window, which ensures that the data transmission in the key negotiation process cannot be tampered with.
- the time window for the card reader to receive the first response is T+ ⁇ T
- T is the time limit for command processing
- the smart card sends the first response according to T
- ⁇ T is the accommodating range of data transmission time, for example, if it is non-contact communication, it is the accommodating range of air transmission time
- the ⁇ T transmission time is calculated according to the distance between the smart card and the card reader, for example, if it is For non-contact communication
- ⁇ T is the sum of the data transmission time tolerance and the data interaction time , for example, if it is non-contact communication
- ⁇ T can be the data interaction.
- S the maximum transmission distance allowed between the card reader and the smart card
- v the speed of light
- Tt the data interaction time
- the preset duration is negotiated between the card reader and the smart card.
- the preset duration is pre-stored in the card reader and the smart card; or the first information includes a duration identifier, and the preset duration is a duration corresponding to the duration identifier obtained by the smart card according to the duration identifier.
- the preset duration T can be prefabricated and stored in the fixed area of the chip before the device leaves the factory, or the preset duration set can be stored in the device, and the selected T can be determined by sending an identifier each time, or Yes, each instruction data transmitted has a T value in it.
- the preset duration can be sent to the smart card by the card reader carrying the duration identifier in the first information, and the smart card can obtain the corresponding preset duration according to the duration identifier; the two parties can also store a list of preset durations, which are selected according to preset rules each time. a preset duration. This is not specifically limited in the present invention.
- the timing includes: the card reader and the smart card use built-in clocks for timing respectively; or the card reader and the smart card respectively use the periodic timing of the communication signal; or the card reader and the smart card respectively communicate with each other.
- the phase timing of the signal; or the card reader and the smart card are respectively timed by the modulated pulse signal of the communication signal.
- the timing method may include, but is not limited to, timing measurement, period measurement, phase measurement, and pulse count measurement.
- timing measurement may include, but is not limited to, timing measurement, period measurement, phase measurement, and pulse count measurement.
- period measurement may include, but is not limited to, timing measurement, period measurement, phase measurement, and pulse count measurement.
- pulse count measurement may include, but is not limited to, pulse count measurement.
- the card reader and the smart card respectively generate session keys, including: in the case that the key information includes a key hopping instruction, and the key information response includes a response to the key hopping instruction , the card reader and the smart card determine a session key from multiple session keys in a preset manner according to the key hopping instruction.
- the card reader and the smart card determine a session key from multiple session keys in a preset manner according to the key hopping instruction.
- each time the card reader and the smart card communicate one of multiple session keys can be determined for communication.
- the communication between the two parties is one-time-one-password to ensure the security of subsequent data transmission.
- a session key is used to communicate between the card reader and the smart card.
- the session key is used for communication between the card reader and the smart card to ensure the security of subsequent data transmission.
- the secure communication method using timing communication to protect key negotiation provided by the present invention is different from the existing communication method of sending data immediately after card processing is completed.
- the smart card After the card reader sends the first information to the smart card, the smart card only sends the first response when the timer expires, and the card reader only receives the first response when the timer reaches the preset time window.
- the first response ensures that there is no man-in-the-middle attack between the card reader and the smart card, and the key negotiation process itself is secure, thereby ensuring the security of subsequent data transmission. Thereby, the security risk of data hijacking by the middleman that may exist in the card reading process is solved.
- an embodiment of the present invention also provides a secure communication system utilizing timing communication to protect key negotiation, and the secure communication system utilizing timing communication to protect key negotiation is applied to the above method.
- the structure of the key negotiated secure communication system is described.
- a secure communication system using timing communication to protect key negotiation includes: a card reader and a smart card; wherein:
- the card reader is used to establish a communication connection with the smart card, and the communication connection includes a wired connection or a wireless connection; perform a key negotiation operation with the smart card; during the key negotiation operation between the card reader and the smart card, send the first information to the smart card, and start timing;
- the smart card is used to receive the first information, start timing, and generate a first response; when the timing reaches a preset duration, the first response is sent to the card reader, wherein the preset duration is the duration of data processing of the smart card;
- the card reader is further configured to start receiving the first response within the window range when the timing reaches the preset time length, wherein the window range of the preset time length is [T, T+ ⁇ T], where T is the preset time length, ⁇ T is the transmission duration, and the transmission duration is calculated at least according to the distance between the smart card and the card reader; after receiving the first response, the session key is generated with the smart card respectively; and the session key is used to communicate with the smart card.
- the first information is key information during the key negotiation operation between the card reader and the smart card
- the first response is a key information response generated after processing the key information
- preset The duration is the duration for the smart card to process key information.
- the key information includes: data to be signed; the key information response includes: a signature performed on the data to be signed; or the key information includes: data to be verified; the key information response includes: the data to be verified The verification result of the verification, or the data to be transmitted generated after passing the verification of the data to be verified; or the key information includes: the data to be calculated; the key information response includes: the response generated after processing the data to be calculated.
- the first information is the first information sent by the card reader to the smart card, and the first response is that after the card reader and the smart card exchange data during the key negotiation operation, The last information response generated; the preset duration is the duration of data interaction and the generation of the last information response by the smart card; the transmission duration is calculated according to the distance between the smart card and the card reader and the number of interactions.
- the smart card is further configured to start timing after receiving the first information, and before generating the first response, determine whether the first information is preset information or whether the first information carries and the smart card determines that the first information is preset information or the first information carries an identifier.
- the card reader communicates with the smart card through the session key in the following manner: the card reader is specifically used to communicate with the smart card according to the preset way to determine one of multiple session keys to communicate.
- the preset duration is negotiated between the card reader and the smart card; or the preset duration is pre-stored in the card reader and the smart card; or the first information includes a duration identifier, which is preset
- the duration is the duration corresponding to the duration ID obtained by the smart card according to the duration ID.
- the card reader and the smart card are respectively timed in the following ways: the card reader and the smart card are respectively timed by using a built-in clock; or the card reader and the smart card are respectively timed by the period of the communication signal; or The card reader and the smart card are respectively timed by the phase of the communication signal; or the card reader and the smart card are respectively timed by the modulated pulse signal of the communication signal.
- the secure communication system using timing communication to protect key negotiation provided by the present invention is different from the existing communication method of sending data immediately after card processing is completed.
- the smart card After the card reader sends the first information to the smart card, the smart card only sends the first response when the timer expires, and the card reader only receives the first response when the timer reaches the preset time window.
- the first response ensures that there is no man-in-the-middle attack between the card reader and the smart card, and the key negotiation process itself is secure, thereby ensuring the security of subsequent data transmission. Thereby, the security risk of data hijacking by the middleman that may exist in the card reading process is solved.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
本发明提供了一种利用定时通讯保护密钥协商的安全通信方法及系统，区别于现有的卡片处理完成后立即发送数据的通信方式，本发明在密钥协商流程执行之前，或在密钥协商流程执行的过程中，读卡器与智能卡设定了同步计时方式，在读卡器向智能卡发送信息后，智能卡仅在计时到时时才发送响应，且读卡器仅在计时达到预设时长的窗口范围内才接收该响应，确保了读卡器与智能卡之间没有中间人攻击，密钥协商流程本身是安全的，由此可以保证后续数据传输的安全性。由此解决读卡过程中可能存在的中间人数据劫持的安全风险。
Description
相关申请的交叉引用
本申请要求发明名称为“一种利用定时通讯保护密钥协商的安全通信方法及系统”、中国专利申请号“202011430470.3”、申请日为2020年12月9日的中国专利申请以及发明名称为“一种利用定时通讯保护密钥协商的安全通信方法及系统”、中国专利申请号“202011427084.9”、申请日为2020年12月9日的中国专利申请的优先权，上述中国专利申请的全部内容在此引入本申请作为参考。
本发明涉及通信技术领域，尤其涉及一种利用定时通讯保护密钥协商的安全通信方法及系统。
对于NFC、蓝牙、2.4G等非接触式或网络通讯中，往往面临中间人攻击安全风险，所以建立安全的通信通道，并确保安全通道建立中密钥协商的关键步骤不可被攻击是非常重要的。
现有的非接触式IC卡读卡器读卡机制，是基于14443，15693等协议进行数据传输的，在协议中，在读卡器与卡的读卡过程中，在读卡器发送了指令数据以后，会有一个帧等待时间，表明了读卡器等待接收卡片响应数据的最大时间范围。也就是说在读卡器向卡片发送了指令以后，读卡器就在等待接收卡片的响应数据，只要是在正等待时间之内返回的数据，读卡器就会接收，这样的通讯协议中容易被中间人攻击，数据被篡改等安全风险。
发明内容
本发明旨在解决上述问题之一。
本发明的主要目的在于提供一种利用定时通讯保护密钥协商的安全通信方法；
本发明的另一目的在于提供一种利用定时通讯保护密钥协商的安全通信系统。
为达到上述目的，本发明的技术方案具体是这样实现的：
本发明一方面提供了一种利用定时通讯保护密钥协商的安全通信方法，包括：
读卡器与智能卡建立通信连接，所述通信连接包括有线连接或者无线连接；
所述读卡器向所述智能卡发送判定指令，并开始计时；
所述智能卡接收所述判定指令，并开始计时，生成判定响应；
所述智能卡在计时达到预设时长时将所述判定响应发送至所述读卡器，其中，所述预设时长为所述智能卡根据所述判定指令生成判定响应的用时长度；
所述读卡器在计时达到所述预设时长的窗口范围内，开始接收所述判定响应，其中，所述预设时长的窗口范围为[T，T+△T]，其中，T为所述预设时长，△T为传输时长，所述传输时长为根据所述智能卡和所述读卡器之间的距离计算得到的；
如果所述读卡器接收到所述判定响应，与所述智能卡执行密钥协商流程，所述读卡器与所述智能卡分别生成会话密钥；
所述读卡器与所述智能卡之间通过所述会话密钥进行通信。
本发明另一方面提供了一种利用定时通讯保护密钥协商的安全通信系统，包括：读卡器和智能卡；其中：
所述读卡器，用于与所述智能卡建立通信连接，所述通信连接包括有线连接或者无线连接；向所述智能卡发送判定指令，并开始计时；
所述智能卡，用于接收所述判定指令，并开始计时，生成判定响应；在计时达到预设时长时将所述判定响应发送至所述读卡器，其中，所述预设时长为所述智能卡根据所述判定指令生成判定响应的用时长度；
所述读卡器，还用于在计时达到所述预设时长的窗口范围内，开始接收所述判定响应，其中，所述预设时长的窗口范围为[T，T+△T]，其中，T为所述预设时长，△T为传输时长，所述传输时长为根据所述智能卡和所述读卡器之间的距离计算得到的；如果所述读卡器接收到所述判定响应，与所述智能卡执行密钥协商流程，与所述智能卡分别生成会话密钥；与所述智能卡之间通过所述会话密钥进行通信。
本发明另一方面提供了一种利用定时通讯保护密钥协商的安全通信方法，包括：
读卡器与智能卡建立通信连接，所述通信连接包括有线连接或者无线连接；
所述读卡器与所述智能卡进行密钥协商操作；
在所述读卡器与所述智能卡进行密钥协商操作过程中，所述读卡器将第一信息发送至所述智能卡，并开始计时；
所述智能卡接收所述第一信息，并开始计时，生成第一响应；
所述智能卡在计时达到预设时长时将所述第一响应发送至所述读卡器，其中，所述预设时长为所述智能卡数据处理的用时长度；
所述读卡器在计时达到所述预设时长的窗口范围内，开始接收所述第一响应，其中，所述预设时长的窗口范围为[T，T+△T]，其中，T为所述预设时长，△T为传输时长，所述 传输时长为至少根据所述智能卡和所述读卡器之间的距离计算得到的；
所述读卡器在接收到所述第一响应后，与所述智能卡分别生成会话密钥；
所述读卡器与所述智能卡之间通过所述会话密钥进行通信。
本发明另一方面提供了一种利用定时通讯保护密钥协商的安全通信系统，包括：读卡器和智能卡；其中：
所述读卡器，用于与智能卡建立通信连接，所述通信连接包括有线连接或者无线连接；与所述智能卡进行密钥协商操作；在所述读卡器与所述智能卡进行密钥协商操作过程中，将第一信息发送至所述智能卡，并开始计时；
所述智能卡，用于接收所述第一信息，并开始计时，生成第一响应；在计时达到预设时长时将所述第一响应发送至所述读卡器，其中，所述预设时长为所述智能卡数据处理的用时长度；
所述读卡器，还用于在计时达到所述预设时长的窗口范围内，开始接收所述第一响应，其中，所述预设时长的窗口范围为[T，T+△T]，其中，T为所述预设时长，△T为传输时长，所述传输时长为至少根据所述智能卡和所述读卡器之间的距离计算得到的；在接收到所述第一响应后，与所述智能卡分别生成会话密钥；与所述智能卡之间通过所述会话密钥进行通信。
由上述本发明提供的技术方案可以看出，本发明提供了一种利用定时通讯保护密钥协商的安全通信方法及系统，区别于现有的卡片处理完成后立即发送数据的通信方式，本发明在密钥协商流程执行之前，或在密钥协商流程执行的过程中，读卡器与智能卡设定了同步计时方式，在读卡器向智能卡发送判定指令或第一信息后，智能卡仅在计时到时时才发送判定响应或第一响应，且读卡器仅在计时达到预设时长的窗口范围内才接收判定响应或第一响应，确保了读卡器与智能卡之间没有中间人攻击，密钥协商流程本身是安全的，由此可以保证后续数据传输的安全性。由此解决读卡过程中可能存在的中间人数据劫持的安全风险。
图1为本发明实施例1提供的一利用定时通讯保护密钥协商的安全通信方法的流程图；
图2为本发明实施例1提供的一利用定时通讯保护密钥协商的安全通信系统的结构示意图。
图3为本发明实施例2提供的另一利用定时通讯保护密钥协商的安全通信方法的流程图；
图4为本发明实施例2提供的另一利用定时通讯保护密钥协商的安全通信系统的结构 示意图。
下面结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明的保护范围。
下面将结合附图对本发明实施例作进一步地详细描述。
实施例1
本发明为了确保密钥协商流程的安全性，本发明在密钥协商流程开始之前，先进行预设条件的判定，只有在符合预设条件的情况下，才执行密钥协商流程，确保密钥协商流程本身的安全性，之后用协商的会话密钥保护之后的交易应用流程，彻底解决中间人攻击的问题。
图1示出了本发明实施例提供的利用定时通讯保护密钥协商的安全通信方法的流程图，参见图1，本发明实施例提供的利用定时通讯保护密钥协商的安全通信方法，包括：
S101，读卡器与智能卡建立通信连接，通信连接包括有线连接或者无线连接。
具体地，读卡器可以与智能卡之间建立连接，该连接可以为有线连接，例如USB连接，或者网络连接，也可以建立无线连接，例如NFC连接、蓝牙连接或者2.4G连接等，具体的连接方式在本发明中并不进行具体限制。
S102，读卡器向智能卡发送判定指令，并开始计时；
S103，智能卡接收判定指令，并开始计时，生成判定响应。
具体地，读卡器向智能卡发送判定指令，且智能卡接收判定指令后，双方同步计时。其中，判定指令可以为单一指令，也可以为待处理数据，判定响应可以为对指令进行的响应，也可以为对待处理数据处理完毕之后的响应。
作为本发明实施例的一个可选实施方式，在智能卡接收判定指令之后，智能卡开始计时，生成判定响应之前，本发明实施例提供的利用定时通讯保护密钥协商的安全通信方法还包括：智能卡判断判定指令是否为预设指令或者判断判定指令中是否携带判定标识；且智能卡判断判定指令为预设指令或者判定指令中携带判定标识。具体地，只有判定指令为预设指令或者其中携带了判定标识后，才可以开始计时。
S104，智能卡在计时达到预设时长时将判定响应发送至读卡器，其中，预设时长为智能卡根据判定指令生成判定响应的用时长度；
S105，读卡器在计时达到预设时长的窗口范围内，开始接收判定响应，其中，预设时长的窗口范围为[T，T+△T]，其中，T为预设时长，△T为传输时长，传输时长为根据智能卡和读卡器之间的距离计算得到的。
具体地，读卡器与智能卡之间设定预设时长，双方计时到达预设时长后，智能卡发送判定响应，读卡器接收判定响应，且读卡器只在预设时长的窗口范围内接收判定响应。
读卡器与智能卡双方确定固定的收发通信预设时长T，读卡器确定数据的传输时长△T，智能卡按照约定在时间间隔T后发送判定响应，读卡器只能在时间窗口[T，T+△T]的时间间隔内接收判定响应，若第三方中间人远程攻击，转发和处理数据的时间将不满足该时间窗口，这样确保了后续密钥协商流程中的数据交互不可被篡改。
具体实施时，读卡器接收判定响应的时间窗口是T+△T，T是指令处理的时间限制，智能卡按照T发送数据，△T是数据传输时间容纳范围，例如如果是非接触方式通信，则为空中传输时间的容纳范围；该△T传输时长为根据智能卡和读卡器之间的距离计算得到的，例如如果为非接触式方式通信，△T可以为读卡器与智能卡之间允许的最大传输距离与光速的比值，即△T＝2S/v，其中S为读卡器与智能卡之间允许的最大传输距离，v为光速。
作为本发明实施例的一个可选实施方式，预设时长为读卡器与智能卡协商得到的；或者预设时长为预先存储在读卡器和智能卡中的；或者判定指令包括时长标识，预设时长为智能卡根据时长标识获取与时长标识对应的时长。具体实施时，可以将预设时长T在设备出厂之前就已经预制存储在芯片的固定区域中，或者将预设时长集存储在设备中，每次可通过发送标识，确定选取的T，也可以是，传输的每一条指令数据中都带有T值。预设时长可以为读卡器在判定指令中携带时长标识发送给智能卡，智能卡根据该时长标识获取对应的预设时长；也可以双方存储一个预设时长列表，每次按照预设规则选定一个预设时长。这在本发明中并不做具体限制。
作为本发明实施例的一个可选实施方式，计时包括：读卡器与智能卡分别利用内置时钟进行计时；或者读卡器与智能卡分别通过通讯信号的周期计时；或者读卡器与智能卡分别通过通讯信号的相位计时；或者读卡器与智能卡分别通过通讯信号的调制后的脉冲信号进行计时。
具体地，计时方式可以包括但不限于：
1、计时测量：读卡器和智能卡卡均支持精确计时功能，使用内置时钟进行计时。
2、周期测量：对于非接通讯通过记录载波的周期来对时间进行记录。具体实现时，读卡器与智能卡分别通过通讯信号的周期进行同步计时测量；读卡器与智能卡可以以判定指令的收发结束作为同步计时的启动标识。
3、相位测量：具体实现时，读卡器与智能卡可以以通讯信号的相位进行同步计时测量，设定预期相位，读卡器与智能卡可以以判定指令的收发结束作为同步计时的启动标识。
4、脉冲计数测量：读卡器与智能卡可以以通讯信号的调制后的脉冲信号进行同步计数测量，读卡器与智能卡可以以判定指令的收发结束作为同步计时的启动标识。
S106，如果读卡器接收到判定响应，与智能卡执行密钥协商流程，读卡器与智能卡分别生成会话密钥。
具体地，只有读卡器接收到判定响应，才确定读卡器与智能卡之间没有中间人劫持风险，可以进行后续密钥协商流程，读卡器与智能卡分别生成会话密钥。
以下提供两种密钥协商流程，本发明以此为例进行密钥协商流程的说明，但本发明并不局限于此。其中，A和B代表通信双方，可以A为读卡器，B为智能卡，也可以B为读卡器，A为智能卡。
方式一：
1)B产生随机数R1；
2)A获取R1，利用私钥对R1以及A的序列号进行签名，生成随机签名S1，将随机签名S1，A的证书发送到B；
3)B使用预制的CA根证书验证收到的A的证书，如果验证不通过，则发送出错消息，结束链接；否则执行下一步；
4)B校验随机签名S1是否正确，如果验证不通过，则发送出错消息，结束链接；否则执行下一步；
5)B产生随机数R2，连接R1|R2，利用A证书中的公钥对R1|R2加密生成密文E1，利用私钥对E1签名生成S2；
6)B发送E1，S2和B的证书；
7)A使用A中预制的CA根证书验证收到的B的证书，如果验证不通过，则发送出错消息，结束链接；否则，执行下一步；
8)A校验签名S2是否正确，如果验证不通过，则发送出错消息，结束链接；否则执行下一步；
9)A对利用私钥对E1解密，得到R1|R2明文；
10)A和B双方分别基于R1|R2使用特定的方法计算会话密钥，该会话密钥可包括加密密钥和或校验密钥，加密密钥用于在数据传输时的发送方的加密与接收方的解密，校验密钥用于发送数据时计算校验值。
方式二：
1)A产生随机数R2，将随机数R2和A的证书发送至B；
2)B获取R2和A的证书，B使用预制的CA根证书验证收到的A的证书，如果验证不通过，则发送出错消息，结束链接；否则执行下一步；
3)B产生随机数R1；
4)B利用A证书中的公钥对R1加密生成密文E1，利用私钥对R2|E1签名生成S1；
5)B发送E1，S2和B的证书；
6)A使用预制的CA根证书验证收到的B的证书，如果验证不通过，则发送出错消息，结束链接；否则，执行下一步；
7)A校验签名S1是否正确，如果验证不通过，则发送出错消息，结束链接；否则执行下一步；
8)A利用私钥对E1解密，得到R1明文；
9)A和B双方分别基于R1使用特定的方法计算会话密钥，会话密钥可包括加密密钥和或校验密钥，加密密钥用于在数据传输时的发送方的加密与接收方的解密，校验密钥用于发送数据时计算校验值。
S107，读卡器与智能卡之间通过会话密钥进行通信。
具体地，读卡器与智能卡之间通过会话密钥进行通信，保证后续数据传输的安全性。
作为本发明实施例的一个可选实施方式，会话密钥为多个；读卡器与智能卡之间通过会话密钥进行通信包括：读卡器与智能卡之间按照预设方式从多个会话密钥中确定一个进行通信。具体实施时，读卡器与智能卡之间每次进行通信时，均可以从多个会话密钥中确定一个进行通信，双方共享密钥池，基于相同的密钥池滚动更换密钥，以保证双方通信一次一密，保证后续数据传输的安全性。
由此可见，利用本发明实施例提供的利用定时通讯保护密钥协商的安全通信方法，区别于现有的卡片处理完成后立即发送数据的通信方式，本发明在密钥协商流程执行之前，读卡器与智能卡设定了同步计时方式，在读卡器向智能卡发送判定指令后，智能卡仅在计时到时时才发送判定响应，且读卡器仅在计时达到预设时长的窗口范围内才接收判定响应，确保了读卡器与智能卡之间没有中间人攻击，密钥协商流程本身是安全的，由此可以保证后续数据传输的安全性。由此解决读卡过程中可能存在的中间人数据劫持的安全风险。
图2为示出了本发明实施例提供的利用定时通讯保护密钥协商的安全通信系统的结构示意图，该利用定时通讯保护密钥协商的安全通信系统应用于上述方法，以下仅对利用定时通讯保护密钥协商的安全通信系统的结构进行说明，其他未尽事宜，请参照上述利用定时通讯保护密钥协商的安全通信方法中的相关描述，在此不再赘述。参见图2，本发明实施例提供的利用定时通讯保护密钥协商的安全通信系统，包括：读卡器和智能卡；其中：
读卡器，用于与智能卡建立通信连接，通信连接包括有线连接或者无线连接；向智能卡发送判定指令，并开始计时；
智能卡，用于接收判定指令，并开始计时，生成判定响应；在计时达到预设时长时将判定响应发送至读卡器，其中，预设时长为智能卡根据判定指令生成判定响应的用时长度；
读卡器，还用于在计时达到预设时长的窗口范围内，开始接收判定响应，其中，预设时长的窗口范围为[T，T+△T]，其中，T为预设时长，△T为传输时长，传输时长为根据智能卡和读卡器之间的距离计算得到的；如果读卡器接收到判定响应，与智能卡执行密钥协商流程，与智能卡分别生成会话密钥；与智能卡之间通过会话密钥进行通信。
作为本发明实施例的一个可选实施方式，智能卡，还用于在接收判定指令之后，智能卡开始计时，生成判定响应之前，判断判定指令是否为预设指令或者判断判定指令中是否携带判定标识；且智能卡判断判定指令为预设指令或者判定指令中携带判定标识。
作为本发明实施例的一个可选实施方式，预设时长为读卡器与智能卡协商得到的；或者预设时长为预先存储在读卡器和智能卡中的；或者判定指令包括时长标识，预设时长为智能卡根据时长标识获取与时长标识对应的时长。
作为本发明实施例的一个可选实施方式，读卡器与智能卡分别通过以下方式计时：读卡器与智能卡分别利用内置时钟进行计时；或者读卡器与智能卡分别通过通讯信号的周期计时；或者读卡器与智能卡分别通过通讯信号的相位计时；或者读卡器与智能卡分别通过通讯信号的调制后的脉冲信号进行计时。
作为本发明实施例的一个可选实施方式，会话密钥为多个；读卡器通过如下方式与智能卡之间通过会话密钥进行通信：读卡器，具体用于与智能卡之间按照预设方式从多个会话密钥中确定一个进行通信。
由此可见，利用本发明实施例提供的利用定时通讯保护密钥协商的安全通信装置，区别于现有的卡片处理完成后立即发送数据的通信方式，本发明在密钥协商流程执行之前，读卡器与智能卡设定了同步计时方式，在读卡器向智能卡发送判定指令后，智能卡仅在计时到时时才发送判定响应，且读卡器仅在计时达到预设时长的窗口范围内才接收判定响应，确保了读卡器与智能卡之间没有中间人攻击，密钥协商流程本身是安全的，由此可以保证后续数据传输的安全性。由此解决读卡过程中可能存在的中间人数据劫持的安全风险。
实施例2
本发明为了确保密钥协商流程的安全性，本发明在密钥协商流程执行的过程中，先进行预设条件的判定，只有在符合预设条件的情况下，才确定密钥协商流程本身的是安全的，之后用协商的会话密钥保护之后的交易应用流程，彻底解决中间人攻击的问题。
图3示出了本发明实施例提供的利用定时通讯保护密钥协商的安全通信方法的流程图，参见图3，本发明实施例提供的利用定时通讯保护密钥协商的安全通信方法，包括：
S201，读卡器与智能卡建立通信连接，通信连接包括有线连接或者无线连接。
具体地，读卡器可以与智能卡之间建立连接，该连接可以为有线连接，例如USB连接，或者网络连接，也可以建立无线连接，例如NFC连接、蓝牙连接或者2.4G连接等，具体的连接方式在本发明中并不进行具体限制。
S202，读卡器与智能卡进行密钥协商操作。
本实施例提供两种密钥协商流程，具体可以参见实施例1步骤S106中提供的两种密钥协商流程。本发明以此为例进行密钥协商流程的说明，但本发明并不局限于此。
S203，在读卡器与智能卡进行密钥协商操作过程中，读卡器将第一信息发送至智能卡，并开始计时；
S204，智能卡接收第一信息，并开始计时，生成第一响应。
具体地，读卡器向智能卡发送第一信息，且智能卡接收第一信息后，双方同步计时。
作为本发明实施例的一个可选实施方式，智能卡接收第一信息之后，开始计时，生成第一响应之前，本发明实施例提供的利用定时通讯保护密钥协商的安全通信方法还包括：智能卡判断第一信息是否为预设信息或者判断第一信息中是否携带标识；且智能卡判断第一信息为预设信息或者第一信息中携带标识。具体地，只有第一信息为预设信息或者其中携带了标识后，才可以开始计时。
本发明可以具有两种第一信息和第一响应的存在形式：
第一种：作为本发明实施例的一个可选实施方式，第一信息为读卡器与智能卡进行密钥协商操作过程中的关键信息，第一响应为对关键信息进行处理后生成的关键信息响应；预设时长为智能卡对关键信息进行处理的用时长度。其中，关键信息包括：待签名数据；关键信息响应包括：对待签名数据进行的签名；或者关键信息包括：待验证数据；关键信息响应包括：对待验证数据进行验证的验证结果，或者对待验证数据进行验证通过后生成的待传输数据；或者关键信息包括：待计算数据；关键信息响应包括：对待计算数据进行处理后生成的响应，或者，关键信息包括：密钥跳变指令；关键信息响应包括：对密钥跳变指令的响应。
例如，在上述方式一的密钥协商过程中，关键信息为B产生的随机数R1，关键信息的响应为A进行处理后生成的随机签名S1和A的证书；在上述方式二的密钥协商过程中，关键信息为R2和A的证书；关键信息的响应为B对接收到的数据进行处理后发送的E1，S2和B的证书，当然，以上仅是本发明的一种实现方式，本发明并不局限于此。
第二种：作为本发明实施例的一个可选实施方式，第一信息为读卡器发送至智能卡的 第一个信息，第一响应为读卡器与智能卡在进行密钥协商操作过程中进行数据交互后，生成的最后一个信息响应；预设时长为智能卡进行数据交互以及生成最后一个信息响应的用时长度；传输时长为根据智能卡和读卡器之间的距离以及交互次数计算得到的。
例如，在上述方式一的密钥协商过程中，第一信息为B产生的随机数R1，第一响应为A发送的随机签名S1和A的证书；在上述方式二的密钥协商过程中，第一信息为A发送的R2和A的证书，第一响应为B发送的E1，S2和B的证书，当然，以上仅是本发明的一种实现方式，本发明并不局限于此。
S205，智能卡在计时达到预设时长时将第一响应发送至读卡器，其中，预设时长为智能卡数据处理的用时长度；
S206，读卡器在计时达到预设时长的窗口范围内，开始接收第一响应，其中，预设时长的窗口范围为[T，T+△T]，其中，T为预设时长，△T为传输时长，传输时长为至少根据智能卡和读卡器之间的距离计算得到的。
具体地，读卡器与智能卡之间设定预设时长，双方计时到达预设时长后，智能卡发送第一响应，读卡器接收第一响应，且读卡器只在预设时长的窗口范围内接收第一响应。
读卡器与智能卡双方确定固定的收发通信预设时长T，读卡器确定数据的传输时长△T，智能卡按照约定在时间间隔T后发送第一响应，读卡器只能在时间窗口[T，T+△T]的时间间隔内接收第一响应，若第三方中间人远程攻击，转发和处理数据的时间将不满足该时间窗口，这样确保了密钥协商流程中数据传输不可被篡改。
具体实施时，读卡器接收第一响应的时间窗口是T+△T，T是指令处理的时间限制，智能卡按照T发送第一响应，如果第一响应是对第一信息进行处理后得到的响应，则△T是数据传输时间容纳范围，例如如果是非接触方式通信，则为空中传输时间的容纳范围；该△T传输时长为根据智能卡和读卡器之间的距离计算得到的，例如如果为非接触式方式通信，△T可以为读卡器与智能卡之间允许的最大传输距离与光速的比值，即△T＝2S/v，其中S为读卡器与智能卡之间允许的最大传输距离，v为光速；如果第一响应是读卡器与智能卡在进行密钥协商操作过程中进行数据交互后，生成的最后一个信息响应，则△T是数据传输时间容纳范围与数据交互时长之和，例如如果是非接触方式通信，该△T传输时长为数据交互时长与根据智能卡和读卡器之间的距离计算得到的时长之和，例如如果为非接触式方式通信，△T可以为数据交互时长与读卡器与智能卡之间允许的最大传输距离与光速的比值之和，即△T＝Tt+2S/v，其中S为读卡器与智能卡之间允许的最大传输距离，v为光速，Tt为数据交互时长。
作为本发明实施例的一个可选实施方式，预设时长为读卡器与智能卡协商得到的；或者
预设时长为预先存储在读卡器和智能卡中的；或者第一信息包括时长标识，预设时长为智能卡根据时长标识获取与时长标识对应的时长。具体实施时，可以将预设时长T在设备出厂之前就已经预制存储在芯片的固定区域中，或者将预设时长集存储在设备中，每次可通过发送标识，确定选取的T，也可以是，传输的每一条指令数据中都带有T值。预设时长可以为读卡器在第一信息中携带时长标识发送给智能卡，智能卡根据该时长标识获取对应的预设时长；也可以双方存储一个预设时长列表，每次按照预设规则选定一个预设时长。这在本发明中并不做具体限制。
作为本发明实施例的一个可选实施方式，计时包括：读卡器与智能卡分别利用内置时钟进行计时；或者读卡器与智能卡分别通过通讯信号的周期计时；或者读卡器与智能卡分别通过通讯信号的相位计时；或者读卡器与智能卡分别通过通讯信号的调制后的脉冲信号进行计时。
具体地，计时方式可以包括但不限于：计时测量、周期测量、相位测量和脉冲计数测量。具体内容可以参见实施例1中关于计时方式的描述。
S207，读卡器在接收到第一响应后，与智能卡分别生成会话密钥；
作为本发明实施例的一个可选实施方式，读卡器与智能卡分别生成会话密钥，包括：在关键信息包括密钥跳变指令，关键信息响应包括对密钥跳变指令的响应的情况下，读卡器与智能卡根据密钥跳变指令按照预设方式从多个会话密钥中确定一个会话密钥。具体实施时，读卡器与智能卡之间每次进行通信时，均可以从多个会话密钥中确定一个进行通信，双方共享密钥池，基于相同的密钥池滚动更换密钥，以保证双方通信一次一密，保证后续数据传输的安全性。
S208，读卡器与智能卡之间通过会话密钥进行通信。
具体地，读卡器与智能卡之间通过会话密钥进行通信，保证后续数据传输的安全性。
由此可见，本发明提供的利用定时通讯保护密钥协商的安全通信方法，区别于现有的卡片处理完成后立即发送数据的通信方式，本发明在密钥协商流程执行的过程中，读卡器与智能卡设定了同步计时方式，在读卡器向智能卡发送第一信息后，智能卡仅在计时到时时才发送第一响应，且读卡器仅在计时达到预设时长的窗口范围内才接收第一响应，确保了读卡器与智能卡之间没有中间人攻击，密钥协商流程本身是安全的，由此可以保证后续数据传输的安全性。由此解决读卡过程中可能存在的中间人数据劫持的安全风险。
如图2所示，本发明实施例还提供了利用定时通讯保护密钥协商的安全通信系统，该利用定时通讯保护密钥协商的安全通信系统应用于上述方法，以下仅对利用定时通讯保护密钥协商的安全通信系统的结构进行说明，其他未尽事宜，请参照上述利用定时通讯保护 密钥协商的安全通信方法中的相关描述，在此不再赘述。参见图2，本发明实施例提供的利用定时通讯保护密钥协商的安全通信系统，包括：读卡器和智能卡；其中：
读卡器，用于与智能卡建立通信连接，通信连接包括有线连接或者无线连接；与智能卡进行密钥协商操作；在读卡器与智能卡进行密钥协商操作过程中，将第一信息发送至智能卡，并开始计时；
智能卡，用于接收第一信息，并开始计时，生成第一响应；在计时达到预设时长时将第一响应发送至读卡器，其中，预设时长为智能卡数据处理的用时长度；
读卡器，还用于在计时达到预设时长的窗口范围内，开始接收第一响应，其中，预设时长的窗口范围为[T，T+△T]，其中，T为预设时长，△T为传输时长，传输时长为至少根据智能卡和读卡器之间的距离计算得到的；在接收到第一响应后，与智能卡分别生成会话密钥；与智能卡之间通过会话密钥进行通信。
作为本发明实施例的一个可选实施方式，第一信息为读卡器与智能卡进行密钥协商操作过程中的关键信息，第一响应为对关键信息进行处理后生成的关键信息响应；预设时长为智能卡对关键信息进行处理的用时长度。
作为本发明实施例的一个可选实施方式，关键信息包括：待签名数据；关键信息响应包括：对待签名数据进行的签名；或者关键信息包括：待验证数据；关键信息响应包括：对待验证数据进行验证的验证结果，或者对待验证数据进行验证通过后生成的待传输数据；或者关键信息包括：待计算数据；关键信息响应包括：对待计算数据进行处理后生成的响应。
作为本发明实施例的一个可选实施方式，第一信息为读卡器发送至智能卡的第一个信息，第一响应为读卡器与智能卡在进行密钥协商操作过程中进行数据交互后，生成的最后一个信息响应；预设时长为智能卡进行数据交互以及生成最后一个信息响应的用时长度；传输时长为根据智能卡和读卡器之间的距离以及交互次数计算得到的。
作为本发明实施例的一个可选实施方式，智能卡，还用于在接收第一信息之后，开始计时，生成第一响应之前，判断第一信息是否为预设信息或者判断第一信息中是否携带标识；且智能卡判断第一信息为预设信息或者第一信息中携带标识。
作为本发明实施例的一个可选实施方式，会话密钥为多个；读卡器通过如下方式与智能卡之间通过会话密钥进行通信：读卡器，具体用于与智能卡之间按照预设方式从多个会话密钥中确定一个进行通信。
作为本发明实施例的一个可选实施方式，预设时长为读卡器与智能卡协商得到的；或者预设时长为预先存储在读卡器和智能卡中的；或者第一信息包括时长标识，预设时长为智能卡根据时长标识获取与时长标识对应的时长。
作为本发明实施例的一个可选实施方式，读卡器与智能卡分别通过以下方式计时：读卡器与智能卡分别利用内置时钟进行计时；或者读卡器与智能卡分别通过通讯信号的周期计时；或者读卡器与智能卡分别通过通讯信号的相位计时；或者读卡器与智能卡分别通过通讯信号的调制后的脉冲信号进行计时。
由此可见，本发明提供的利用定时通讯保护密钥协商的安全通信系统，区别于现有的卡片处理完成后立即发送数据的通信方式，本发明在密钥协商流程执行的过程中，读卡器与智能卡设定了同步计时方式，在读卡器向智能卡发送第一信息后，智能卡仅在计时到时时才发送第一响应，且读卡器仅在计时达到预设时长的窗口范围内才接收第一响应，确保了读卡器与智能卡之间没有中间人攻击，密钥协商流程本身是安全的，由此可以保证后续数据传输的安全性。由此解决读卡过程中可能存在的中间人数据劫持的安全风险。
Claims (20)
- 一种利用定时通讯保护密钥协商的安全通信方法，其特征在于，包括：读卡器与智能卡建立通信连接，所述通信连接包括有线连接或者无线连接；所述读卡器向所述智能卡发送判定指令，并开始计时；所述智能卡接收所述判定指令，并开始计时，生成判定响应；所述智能卡在计时达到预设时长时将所述判定响应发送至所述读卡器，其中，所述预设时长为所述智能卡根据所述判定指令生成判定响应的用时长度；所述读卡器在计时达到所述预设时长的窗口范围内，开始接收所述判定响应，其中，所述预设时长的窗口范围为[T，T+△T]，其中，T为所述预设时长，△T为传输时长，所述传输时长为根据所述智能卡和所述读卡器之间的距离计算得到的；如果所述读卡器接收到所述判定响应，与所述智能卡执行密钥协商流程，所述读卡器与所述智能卡分别生成会话密钥；所述读卡器与所述智能卡之间通过所述会话密钥进行通信。
- 根据权利要求1所述的方法，其特征在于，在所述智能卡接收所述判定指令之后，所述智能卡开始计时，生成判定响应之前，所述方法还包括：所述智能卡判断所述判定指令是否为预设指令或者判断所述判定指令中是否携带判定标识；且所述智能卡判断所述判定指令为预设指令或者所述判定指令中携带判定标识。
- 根据权利要求1所述的方法，其特征在于，所述计时包括：所述读卡器与所述智能卡分别利用内置时钟进行计时；或者所述读卡器与所述智能卡分别通过通讯信号的周期计时；或者所述读卡器与所述智能卡分别通过通讯信号的相位计时；或者所述读卡器与所述智能卡分别通过通讯信号的调制后的脉冲信号进行计时。
- 根据权利要求1所述的方法，其特征在于，所述会话密钥为多个；所述读卡器与所述智能卡之间通过所述会话密钥进行通信包括：所述读卡器与所述智能卡之间按照预设方式从所述多个会话密钥中确定一个进行通信。
- 一种利用定时通讯保护密钥协商的安全通信系统，其特征在于，包括：读卡器和智能卡；其中：所述读卡器，用于与所述智能卡建立通信连接，所述通信连接包括有线连接或者无线连接；向所述智能卡发送判定指令，并开始计时；所述智能卡，用于接收所述判定指令，并开始计时，生成判定响应；在计时达到预设时长时将所述判定响应发送至所述读卡器，其中，所述预设时长为所述智能卡根据所述判 定指令生成判定响应的用时长度；所述读卡器，还用于在计时达到所述预设时长的窗口范围内，开始接收所述判定响应，其中，所述预设时长的窗口范围为[T，T+△T]，其中，T为所述预设时长，△T为传输时长，所述传输时长为根据所述智能卡和所述读卡器之间的距离计算得到的；如果所述读卡器接收到所述判定响应，与所述智能卡执行密钥协商流程，与所述智能卡分别生成会话密钥；与所述智能卡之间通过所述会话密钥进行通信。
- 根据权利要求5所述的系统，其特征在于，所述智能卡，还用于在接收所述判定指令之后，所述智能卡开始计时，生成判定响应之前，判断所述判定指令是否为预设指令或者判断所述判定指令中是否携带判定标识；且所述智能卡判断所述判定指令为预设指令或者所述判定指令中携带判定标识。
- 根据权利要求5所述的系统，其特征在于，所述读卡器与所述智能卡分别通过以下方式计时：所述读卡器与所述智能卡分别利用内置时钟进行计时；或者所述读卡器与所述智能卡分别通过通讯信号的周期计时；或者所述读卡器与所述智能卡分别通过通讯信号的相位计时；或者所述读卡器与所述智能卡分别通过通讯信号的调制后的脉冲信号进行计时。
- 根据权利要求5所述的系统，其特征在于，所述会话密钥为多个；所述读卡器通过如下方式与所述智能卡之间通过所述会话密钥进行通信：所述读卡器，具体用于与所述智能卡之间按照预设方式从所述多个会话密钥中确定一个进行通信。
- 一种利用定时通讯保护密钥协商的安全通信方法，其特征在于，包括：读卡器与智能卡建立通信连接，所述通信连接包括有线连接或者无线连接；所述读卡器与所述智能卡进行密钥协商操作；在所述读卡器与所述智能卡进行密钥协商操作过程中，所述读卡器将第一信息发送至所述智能卡，并开始计时；所述智能卡接收所述第一信息，并开始计时，生成第一响应；所述智能卡在计时达到预设时长时将所述第一响应发送至所述读卡器，其中，所述预设时长为所述智能卡数据处理的用时长度；所述读卡器在计时达到所述预设时长的窗口范围内，开始接收所述第一响应，其中，所述预设时长的窗口范围为[T，T+△T]，其中，T为所述预设时长，△T为传输时长，所述传输时长为至少根据所述智能卡和所述读卡器之间的距离计算得到的；所述读卡器在接收到所述第一响应后，与所述智能卡分别生成会话密钥；所述读卡器与所述智能卡之间通过所述会话密钥进行通信。
- 根据权利要求9所述的方法，其特征在于，所述第一信息为所述读卡器与所述智能卡进行密钥协商操作过程中的关键信息，所述第一响应为对所述关键信息进行处理后生成的关键信息响应；所述预设时长为所述智能卡对所述关键信息进行处理的用时长度。
- 根据权利要求10所述的方法，其特征在于，所述关键信息包括：待签名数据；所述关键信息响应包括：对所述待签名数据进行的签名；或者所述关键信息包括：待验证数据；所述关键信息响应包括：对所述待验证数据进行验证的验证结果，或者对所述待验证数据进行验证通过后生成的待传输数据；或者所述关键信息包括：待计算数据；所述关键信息响应包括：对所述待计算数据进行处理后生成的响应；或者，所述关键信息包括：密钥跳变指令；所述关键信息响应包括：对所述密钥跳变指令的响应。
- 根据权利要求9所述的方法，其特征在于，所述第一信息为所述读卡器发送至所述智能卡的第一个信息，所述第一响应为所述读卡器与所述智能卡在进行密钥协商操作过程中进行数据交互后，生成的最后一个信息响应；所述预设时长为所述智能卡进行数据交互以及生成最后一个信息响应的用时长度；所述传输时长为根据所述智能卡和所述读卡器之间的距离以及交互次数计算得到的。
- 根据权利要求9至12任一项所述的方法，其特征在于，所述智能卡接收所述第一信息之后，开始计时，生成第一响应之前，所述方法还包括：所述智能卡判断所述第一信息是否为预设信息或者判断所述第一信息中是否携带标识；且所述智能卡判断所述第一信息为预设信息或者所述第一信息中携带标识。
- 根据权利要求9所述的方法，其特征在于，所述计时包括：所述读卡器与所述智能卡分别利用内置时钟进行计时；或者所述读卡器与所述智能卡分别通过通讯信号的周期计时；或者所述读卡器与所述智能卡分别通过通讯信号的相位计时；或者所述读卡器与所述智能卡分别通过通讯信号的调制后的脉冲信号进行计时。
- 一种利用定时通讯保护密钥协商的安全通信系统，其特征在于，包括：读卡器和智能卡；其中：所述读卡器，用于与智能卡建立通信连接，所述通信连接包括有线连接或者无线连接；与所述智能卡进行密钥协商操作；在所述读卡器与所述智能卡进行密钥协商操作过程中，将第一信息发送至所述智能卡，并开始计时；所述智能卡，用于接收所述第一信息，并开始计时，生成第一响应；在计时达到预设时长时将所述第一响应发送至所述读卡器，其中，所述预设时长为所述智能卡数据处理的用时长度；所述读卡器，还用于在计时达到所述预设时长的窗口范围内，开始接收所述第一响应，其中，所述预设时长的窗口范围为[T，T+△T]，其中，T为所述预设时长，△T为传输时长，所述传输时长为至少根据所述智能卡和所述读卡器之间的距离计算得到的；在接收到所述第一响应后，与所述智能卡分别生成会话密钥；与所述智能卡之间通过所述会话密钥进行通信。
- 根据权利要求15所述的系统，其特征在于，所述第一信息为所述读卡器与所述智能卡进行密钥协商操作过程中的关键信息，所述第一响应为对所述关键信息进行处理后生成的关键信息响应；所述预设时长为所述智能卡对所述关键信息进行处理的用时长度。
- 根据权利要求16所述的系统，其特征在于，所述关键信息包括：待签名数据；所述关键信息响应包括：对所述待签名数据进行的签名；或者所述关键信息包括：待验证数据；所述关键信息响应包括：对所述待验证数据进行验证的验证结果，或者对所述待验证数据进行验证通过后生成的待传输数据；或者所述关键信息包括：待计算数据；所述关键信息响应包括：对所述待计算数据进行处理后生成的响应，或者所述关键信息包括：密钥跳变指令；所述关键信息响应包括：对所述密钥跳变指令的响应。
- 根据权利要求15所述的系统，其特征在于，所述第一信息为所述读卡器发送至所述智能卡的第一个信息，所述第一响应为所述读卡器与所述智能卡在进行密钥协商操作过程中进行数据交互后，生成的最后一个信息响应；所述预设时长为所述智能卡进行数据交互以及生成最后一个信息响应的用时长度；所述传输时长为根据所述智能卡和所述读卡器之间的距离以及交互次数计算得到的。
- 根据权利要求15至18任一项所述的系统，其特征在于，所述智能卡，还用于在接收所述第一信息之后，开始计时，生成第一响应之前，判断所述第一信息是否为预设信息或者判断所述第一信息中是否携带标识；且所述智能卡判断所述第一信息为预设信息或者所述第一信息中携带标识。
- 根据权利要求15所述的系统，其特征在于，所述读卡器与所述智能卡分别通过以下方式计时：所述读卡器与所述智能卡分别利用内置时钟进行计时；或者所述读卡器与所述智能卡分别通过通讯信号的周期计时；或者所述读卡器与所述智能卡分别通过通讯信号的相位计时；或者所述读卡器与所述智能卡分别通过通讯信号的调制后的脉冲信号进行计时。
Applications Claiming Priority (4)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011427084.9A CN112688774A (zh) | 2020-12-09 | 2020-12-09 | 一种利用定时通讯保护密钥协商的安全通信方法及系统 |
| CN202011430470.3A CN112713991A (zh) | 2020-12-09 | 2020-12-09 | 一种利用定时通讯保护密钥协商的安全通信方法及系统 |
| CN202011427084.9 | 2020-12-09 | ||
| CN202011430470.3 | 2020-12-09 |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| WO2022121938A1 true WO2022121938A1 (zh) | 2022-06-16 |
Family
ID=81973075
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| PCT/CN2021/136413 WO2022121938A1 (zh) | 2020-12-09 | 2021-12-08 | 一种利用定时通讯保护密钥协商的安全通信方法及系统 |
Country Status (1)
| Country | Link |
|---|---|
| WO (1) | WO2022121938A1 (zh) |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20120249296A1 (en) * | 2009-12-23 | 2012-10-04 | Commissariat A L'energie Atomique Et Aux Energies Alternatives | Method of protection in a contactless radiofrequency communication |
| CN107707527A (zh) * | 2017-09-01 | 2018-02-16 | 清华大学 | 一种智能卡中继攻击的检测方法、读写终端及系统 |
| US20190342751A1 (en) * | 2016-08-05 | 2019-11-07 | Tendyron Corporation | Data communication method and data communication system |
| CN112688774A (zh) * | 2020-12-09 | 2021-04-20 | 天地融科技股份有限公司 | 一种利用定时通讯保护密钥协商的安全通信方法及系统 |
| CN112713991A (zh) * | 2020-12-09 | 2021-04-27 | 天地融科技股份有限公司 | 一种利用定时通讯保护密钥协商的安全通信方法及系统 |
-
2021
- 2021-12-08 WO PCT/CN2021/136413 patent/WO2022121938A1/zh active Application Filing
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20120249296A1 (en) * | 2009-12-23 | 2012-10-04 | Commissariat A L'energie Atomique Et Aux Energies Alternatives | Method of protection in a contactless radiofrequency communication |
| US20190342751A1 (en) * | 2016-08-05 | 2019-11-07 | Tendyron Corporation | Data communication method and data communication system |
| CN107707527A (zh) * | 2017-09-01 | 2018-02-16 | 清华大学 | 一种智能卡中继攻击的检测方法、读写终端及系统 |
| CN112688774A (zh) * | 2020-12-09 | 2021-04-20 | 天地融科技股份有限公司 | 一种利用定时通讯保护密钥协商的安全通信方法及系统 |
| CN112713991A (zh) * | 2020-12-09 | 2021-04-27 | 天地融科技股份有限公司 | 一种利用定时通讯保护密钥协商的安全通信方法及系统 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US7409552B2 (en) | Method for securing communications between a terminal and an additional user equipment | |
| CN103532713B (zh) | 传感器认证和共享密钥产生方法和系统以及传感器 | |
| WO2018127081A1 (zh) | 一种加密密钥获取方法及系统 | |
| CN106788989B (zh) | 一种建立安全加密信道的方法及设备 | |
| KR20170042549A (ko) | 제2 전자 엔티티에 의한 제1 전자 엔티티의 인증 방법 및 그러한 방법을 구현하는 전자 엔티티 | |
| WO2003061190A1 (en) | Secure data transmission links | |
| RU2008142008A (ru) | Способы аутентификации, шифрования и декодирования идентификатора клиентского терминала и устройства для их реализации | |
| KR20140023799A (ko) | Ｃａｎ에서 데이터의 기밀성과 무결성을 보장하는 방법 | |
| EP3128696B1 (en) | Entity authentication method and device | |
| WO2018024241A1 (zh) | 一种数据通信方法及系统 | |
| CN106357404A (zh) | 基于nfc芯片防伪认证的数据加密方法 | |
| US10609552B2 (en) | System and method for data communication protection | |
| CN106027249A (zh) | 身份证读卡方法和系统 | |
| CN113221136B (zh) | Ais数据传输方法、装置、电子设备和存储介质 | |
| WO2022121938A1 (zh) | 一种利用定时通讯保护密钥协商的安全通信方法及系统 | |
| CN103761660A (zh) | 产品真伪验证方法及装置 | |
| US8953804B2 (en) | Method for establishing a secure communication channel | |
| CN112713991A (zh) | 一种利用定时通讯保护密钥协商的安全通信方法及系统 | |
| CN115334480A (zh) | 蓝牙周边与中央设备以及验证方法 | |
| CN112688774A (zh) | 一种利用定时通讯保护密钥协商的安全通信方法及系统 | |
| CN113973001A (zh) | 一种认证密钥的更新方法及装置 | |
| EP3496441B1 (en) | Data communication method and system | |
| TW201446067A (zh) | 用於確保通信裝置之鄰近之系統、方法及設備 | |
| EP3358515A1 (en) | Method for cryptographically signing a transaction | |
| WO2018076299A1 (zh) | 数据传输方法及装置 |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| 121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 21902643 Country of ref document: EP Kind code of ref document: A1 |
|
| NENP | Non-entry into the national phase |
Ref country code: DE |
|
| 122 | Ep: pct application non-entry in european phase |
Ref document number: 21902643 Country of ref document: EP Kind code of ref document: A1 |