CN103324971A - Smart card system and dynamic key update authentication method of smart card system - Google Patents

Abstract

The invention relates to a smart card system and a dynamic key update authentication method for preventing potential safety hazards of communication line transmission. The time stamp generation and verification module is used to provide system time stamp information to the radio frequency reader from time to time, and verify all Whether the time stamp information returned by the device fingerprint code encryption returned by the radio frequency reader is consistent with the time stamp information generated by the remote server; the security module is used to encrypt and decrypt the smart card data read and written by the radio frequency card reader, So that all the information transmitted between the radio frequency card reader and the server is encrypted. The smart card system of the present invention utilizes the dynamic time stamp authentication mechanism and the dynamic password encryption and decryption technology to ensure the data security on the communication line from the radio frequency card reader to the server, block the potential safety hazard of the transmission line of the smart card information system, and ensure the data security of the smart card The security of transmission is suitable for information management of personnel, materials and equipment.

Description

A smart card system and its dynamic key update authentication method

【Technical field】

The invention relates to a smart card information system, in particular to a smart card system for preventing potential safety hazards in communication line transmission and a dynamic key update authentication method thereof, belonging to the technical field of information security.

【Background technique】

At present, our military has widely used smart card information systems, which involve the management of various materials, equipment and personnel. The security vulnerabilities of smart card information systems will make related military information systems face more serious security risks than general information systems.

In the research on smart card security mechanism in recent years, many researchers have proposed many security mechanisms, such as: the Hash-Lock authentication protocol proposed by Sarma et al.; the randomized Hash-Lock authentication protocol proposed by Weis et al.; The distributed smart card inquiry-response authentication protocol; the Hash chain authentication protocol proposed by Ohkubo et al.; the LCAP authentication protocol proposed by Lee et al.; and the hash ID change authentication protocol proposed by Henrici et al., etc.

However, in the above authentication protocol, either only one or several of the security requirements of the smart card system are met, and the overall security goal is not fully realized, or it is too complicated, requiring storage resources and computing resources beyond the limit of existing smart card label resources , cannot be concretely implemented. In particular, many current smart card authentication protocols are based on the assumption that there is a secure communication channel between the server and the reader. It is non-encrypted data, so that the data transmitted between the server and the reader can be intercepted by accessing in the middle of the transmission line, and the relevant information of the smart card can be obtained, so the current smart card application system has serious security risks.

Therefore, in order to avoid the above-mentioned technical problems, it is indeed necessary to provide a smart card system and its dynamic key update authentication method to prevent potential safety hazards in communication line transmission, so as to overcome the above-mentioned defects in the prior art.

【Content of invention】

In order to solve the above problems, the purpose of the present invention is to provide a smart card system for encrypted data transmission on the transmission line, which can prevent smart card information interception from the transmission line.

Another object of the present invention is to provide a dynamic key update authentication method of a smart card system that prevents potential safety hazards in communication line transmission.

In order to achieve the above-mentioned first purpose, the technical solution adopted by the present invention is: a smart card system, which includes a smart card, a radio frequency reader and a remote server; wherein,

The remote server includes a timestamp generation and verification module, a security module, a timeout processing module, a monitoring display screen and an alarm; wherein, the timestamp generation and verification module is used to provide system information to the radio frequency reader from time to time. Timestamp information, and verify the timestamp information encrypted by the new and old device fingerprints returned by the radio frequency reader and the returned value decrypted by the remote server using the new and old device fingerprints of the radio frequency reader Whether the timestamp information is consistent; the security module is used to encrypt and decrypt the data transmitted between the remote server and the radio frequency reader;

The radio frequency reader includes an MCU module, a radio frequency transceiver module, a communication interface module, and a FLASH storage module. Wherein, the FLASH storage module is used to store the old and new device fingerprints based on time stamps; the MCU module includes a dynamic password generation module and a data encryption and decryption module, and the dynamic password generation module is used when the radio frequency reader receives the When the new time stamp sent by the remote server, judge whether the new time stamp is greater than the old time stamp stored in the FLASH storage module, when established, start the dynamic password generation module to generate a group of dynamic passwords as the new device fingerprint code , and use the new and old device fingerprint codes to encrypt the new time stamp respectively as the password update confirmation return value, and send it to the remote server, and the data encryption and decryption module completes the data encryption and decryption functions; the communication interface module includes RS232 interface, USB interface or RS485 interface.

The smart card system of the present invention further includes: the security module includes a symmetric cipher algorithm module for performing encryption and decryption operations on data communicated using symmetric ciphers, and a hash operation module for performing hash operations.

The smart card system of the present invention further includes: the remote server sends a group of newly generated time stamps to the radio frequency reader from time to time through the time stamp generation and verification module, and at the same time sends the time stamps through the The security module generates a set of new device fingerprints; after the radio frequency reader receives the new time stamp, the MCU module judges whether the received new time stamp is greater than the old time stamp; when the new time stamp is greater than the old time stamp , the RF reader recalculates and generates a new device fingerprint code as a data transmission encryption and decryption code, and returns the new time stamp to the remote server after being encrypted by the new device fingerprint code and the device fingerprint code respectively as a dynamic key update confirmation information.

The smart card system of the present invention is further as follows: after the remote server receives the return value of the radio frequency reader in time, the remote server uses the new and old device fingerprint codes of the radio frequency reader to pair the received returns After the value is decrypted, compare and judge, and when the returned new timestamp value is consistent with the new timestamp generated by the remote server, it means that the remote server has received the dynamic key update confirmation returned by the RF reader information, the dynamic key update of the smart card system is completed, and the smart card system determines that there is no potential safety hazard of malicious attack at the line end, and the new device fingerprint code of the RF reader is used as the encryption and decryption key to encrypt and decrypt the sending and receiving data; when When the time stamp information is inconsistent, perform an update authentication again; after three consecutive update authentications, if it is still inconsistent, the smart card system determines that there is serious interference or a disconnection at the line end, terminates the communication, and activates the alarm;

The smart card system of the present invention can also be: after the remote server sends the newly generated timestamp, it starts the timeout processing module, and when the timeout of the timeout processing module expires, it still does not receive the response returned by the radio frequency reader When the dynamic key update completes confirmation information, restart the timeout processing module shown, and perform update authentication again; after re-update authentication, the remote server receives the dynamic key update returned by the radio frequency reader To confirm the information, the smart card system determines that there is no malicious attack on the line end. If the remote server has not received the dynamic key update confirmation information returned by the radio frequency reader after re-updating the authentication three times, the smart card system determines that there is serious interference or a disconnection at the line end, and terminates the communication. the alarm is activated;

In order to achieve the above-mentioned second purpose, the technical solution adopted by the present invention is: a dynamic key update authentication method for a smart card system, which includes the following steps:

Step 1: The remote server sends a set of newly generated timestamps to the RF reader from time to time through the timestamp generation and verification module, and generates a set of timestamps through the security module at the same time. new device fingerprint;

Step 2: After the RF reader/writer receives the new time stamp, the MCU module calls out the old time stamp of the FLASH storage module, and judges whether the new time stamp is greater than the old time stamp;

Step 3: If the new time stamp is greater than the old time stamp, replace the old time stamp of the FLASH storage module with the new time stamp, start the dynamic password generation module, generate a new device fingerprint code, and use the new and old time stamps respectively The device fingerprint code encrypts the new time stamp and sends it to the remote server as a password update confirmation value; otherwise, the RF reader only uses the old device fingerprint code to encrypt the new time stamp and sends it to the remote server as a return value. the remote server;

Step 4: The remote server compares and judges the return value of the radio frequency card reader after decrypting the fingerprint codes of the new and old devices respectively. When the returned new timestamp value is consistent with the new timestamp generated by the remote server When consistent, the update of the dynamic password of the smart card system is completed, and it is determined that there is no potential safety hazard of malicious attack at the line end, otherwise the smart card system starts a new update authentication program or starts the alarm;

Step 5: When reading and writing data on the smart card, the remote server uses the fingerprint code of the new device as a key to encrypt the data information and then transmits or decrypts the received data, and the radio frequency card reader uses the fingerprint code of the new device to The data read by the smart card is encrypted and then transmitted or decrypted from the information transmitted from the line.

The dynamic key update authentication method of the smart card system of the present invention is further as follows:

After the remote server receives the return value of the radio frequency reader, it uses the new device fingerprint code generated by the remote server to decrypt the return value. When the decrypted timestamp value is consistent with the new timestamp value, the The fingerprint code of the new device of the smart card system has been updated, and it can be determined that there is no potential security risk of malicious attack at the line end; when the received timestamp information is inconsistent with the timestamp of the remote server, or the RF read When the writer returns information, the timeout processing module is started, and the time stamp transmission authentication is performed again; after updating the authentication three times in a row, the remote server still has not received the correct time stamp information returned by the radio frequency reader, so The smart card system determines that there is serious interference or disconnection at the line end, terminates the communication, and activates the alarm.

The dynamic key update authentication method of the smart card system of the present invention further comprises: after the line end of the smart card system is authenticated, the monitoring display screen on the remote server displays the authentication result.

Compared with the prior art, the present invention has the following beneficial effects: the smart card system of the present invention for preventing potential safety hazards in communication line transmission utilizes a dynamic time stamp authentication mechanism and dynamic password encryption and decryption technology to effectively ensure the communication between the radio frequency card reader and the server. The safety of communication on the segment line blocks the hidden danger of the transmission line of the smart card application information system, ensures the security of the smart card data, and is suitable for the information management of personnel, materials and equipment.

【Description of drawings】

Fig. 1 is a schematic diagram of the smart card system of the present invention.

Fig. 2 is a schematic diagram of another embodiment of the smart card system of the present invention.

【Detailed ways】

Please refer to the accompanying drawing 1 of the specification, the present invention is a smart card system for preventing potential safety hazards in communication line transmission, which includes a smart card 12 , a radio frequency reader 13 and a remote server 14 .

The remote server includes a timestamp generation and verification module 1, a security module 4, an overtime processing module 3, a monitoring display screen 2 and an alarm 5; The writer 13 provides system time information, and the new device fingerprint code generated by the remote server 14 decrypts the received information to obtain the timestamp information returned by the radio frequency reader 13, and judges whether the timestamp information is consistent; The security module 4 is used for encrypting and decrypting the smart card information data.

The radio frequency card reader 12 includes an MCU module 10 , a radio frequency transceiver module 9 , a communication interface module 7 and a FLASH storage module 8 . The MCU module 10 in the radio frequency reader 13 is connected and communicates with the smart card 12 through the radio frequency transceiver module 9 and the radio frequency antenna 11 . The RF transceiver module uses FM1702 with a frequency of 13.56MHZ.

The MCU module 10 in the radio frequency reader 13 is connected with the remote server 14 through the communication interface module 7 . The communication interface can be an RS232 serial port, an RS485 serial port or a USB data port, wherein the data transmission between the radio frequency card reader 13 and the remote server 14 adopts encrypted text transmission.

The FLASH storage module 8 is used to store the device fingerprint code and time stamp of the last successful authentication; the MCU module 10 includes a dynamic device fingerprint code generation module, and the MCU is used for when the radio frequency reader 13 receives the remote When the new timestamp sent by the server 14, judge whether the new timestamp is greater than the old timestamp saved by the FLASH storage module 8, when established, start the dynamic device fingerprint generation module to generate a group of new device fingerprints, And use the new and old device fingerprints to encrypt the new time stamp as a return value and send it to the remote server 14. Otherwise, only use the fingerprint code of the old device to encrypt the new time stamp as a return value and send it to the remote server 14 .

After the remote server 14 receives the return value from the radio frequency reader 13, use the new device fingerprint code generated by the remote server 14 to decrypt the return value, when the decrypted timestamp value is consistent with the new timestamp value , the new device fingerprint code of the smart card system has been updated (the line dynamic encryption and decryption password has been updated), and it can be determined that there is no potential safety hazard of malicious attack at the line end; When the time stamps are inconsistent, or when the return information of the radio frequency reader 13 is not received, the timeout processing module shown starts, and a time stamp transmission authentication is performed again; if after three consecutive line authentications, the remote server 14 has not yet After receiving the correct time stamp information returned by the radio frequency reader 13, the smart card system determines that there is serious interference or an open circuit at the line end, terminates the communication, and activates the alarm 5.

Further, after the line end of the smart card system is authenticated, the monitoring display screen 2 on the remote server displays an authentication result.

After the line end authentication of the smart card system is passed (that is, it is determined that there is no potential safety hazard of malicious attack at the line end), the MCU module 10 starts to process data information on the smart card 12 through the radio frequency transceiver module 9 and the radio frequency antenna 11. read and write operations.

The smart card system is suitable for the information management of military secret-related materials and equipment. Through the generated dynamic time stamp and dynamic password authentication, it can ensure the reliability of line-side communication security and the security of information data.

Please refer to shown in accompanying drawing 2 of specification sheet, and it is another embodiment of the smart card of the present invention to prevent potential safety hazards in communication line transmission, which includes smart card 12, radio frequency reader 13 and remote server 14; Stamp generation and verification module 1, safety module 4, overtime processing module 3, monitoring display screen 2 and alarm 5; described timestamp generation and verification module 1 is used for providing system time stamp to described radio frequency reader 13 from time to time information, and verify whether the returned time stamp of the radio frequency card reader 13 is consistent with the time stamp information generated by the remote server 14; the security module 4 is used to encrypt and decrypt user information data, and to The stamp generation and verification module 1 encrypts the generated new timestamp, and at the same time decrypts the timestamp information returned by the radio frequency reader 13 .

The radio frequency card reader 13 includes an MCU module 10 , a radio frequency transceiver module 9 , a communication interface module 7 and a FLASH storage module 8 .

Described radio frequency card reader 13 also comprises a display screen 15 and key 16, and described MCU module 10 is connected with display screen 15, key 16 respectively, and described key 16 is used for controlling described display screen 15 whether to display radio frequency card reader 13 and remote server 14 connection state.

When the button 16 is pressed, the display screen 15 displays the connection status between the radio frequency card reader 13 and the remote server 14 .

After the line terminal authentication of the smart card system is passed, the MCU module 10 activates the smart card 12 through the radio frequency transceiver module 9 and the radio frequency antenna 11 to read data information from the smart card 12 . Further preferably, the display screen 15 is also used to display the reading result of the smart card data information.

After the generation of dynamic time stamp and the generation and verification of dynamic device fingerprint code, the data of the smart card 12 can be read, written and encrypted. The reading and writing results can be seen through the display screen 15, and the data can be used to judge whether the data read and written this time is correct, so as to avoid data transmission errors that may be caused during the data operation.

The dynamic key renewal authentication method of smart card system of the present invention is as follows:

(1) The remote server 14 sends a group of newly generated time stamps to the radio frequency reader 13 from time to time through the time stamp generation and verification module, and simultaneously generates the time stamps through the security module A new set of device fingerprints;

(2) after the radio frequency reader/writer receives the new time stamp, the MCU module 10 transfers the old time stamp in the FLASH storage module 8, and judges whether the new time stamp is greater than the old time stamp;

(3) If the new time stamp is greater than the old time stamp, the old time stamp of the FLASH storage module 8 is replaced with a new time stamp, and the dynamic password generation module is started to generate a new device fingerprint code, and utilize new and old device fingerprints The code encrypts the new time stamp respectively as a return value and sends it to the remote server 14, otherwise the radio frequency reader 13 only returns the new time stamp information return value encrypted by the fingerprint code of the old device;

(4) The remote server 14 judges the return value of the radio frequency card reader 13 after decrypting the fingerprint codes of the new and old devices respectively, and when the return value is consistent with the new time stamp generated by the remote server 14 , the dynamic password update of the smart card system is completed, and it is determined that there is no potential safety hazard of malicious attack at the line end, otherwise the smart card system starts a re-update authentication program or starts the alarm;

(5) When reading and writing data to the smart card, the remote server 14 encrypts the read data information using the new device fingerprint code and then transmits or decrypts the information transmitted from the line and writes it into the smart card. The radio frequency card reader 13 encrypts the data read by the smart card 12 by using the fingerprint code of the new device, and then transmits or decrypts the information transmitted by the line.

The dynamic key update authentication method of the smart card system of the present invention is further as follows:

After the remote server 14 receives the return value from the radio frequency reader 13, use the new device fingerprint code generated by the remote server 14 to decrypt the return value, when the decrypted timestamp value is consistent with the new timestamp value , the new device fingerprint code of the smart card system has been updated, and it can be determined that there is no potential safety hazard of malicious attack at the line end; when the received timestamp information is inconsistent with the remote server 14 timestamp, or the received When the radio frequency reader 13 returns information, the timeout processing module is started, and the time stamp transmission authentication is performed again; after three consecutive line authentications, the remote server 14 has not yet received the return from the radio frequency reader 13. The correct time stamp information, the smart card system determines that there is serious interference or disconnection at the line end, terminates the communication, and the alarm 5 starts.

Further, after the line end of the smart card system is authenticated, the monitoring display screen 2 on the remote server displays the authentication result.

By dynamically sending the time stamp, dynamically updating and verifying the device fingerprint code of the radio frequency card reader, the smart card 12 data can be safely read and written, and the result of the dynamic device fingerprint code update authentication can also be passed through the display screen 15 is displayed, based on which it can be judged whether the dynamic device fingerprint code update is successful.

The above method updates the fingerprint code of the device in time through the generated dynamic time stamp, and uses the fingerprint code to encrypt and decrypt the smart card data transmitted by the line, so as to ensure the security of the line-side communication of the smart card system and the security of confidential information data sex.

The specific implementation above is only a preferred embodiment of this creation, and is not intended to limit this creation. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of this creation should be included in this creation. within the scope of protection.

Claims (8)

1. A smart card system, characterized in that: comprising a smart card, a radio frequency reader and a remote server; wherein, The remote server includes a timestamp generation and verification module, a security module, a timeout processing module, a monitoring display screen and an alarm; wherein, the timestamp generation and verification module is used to provide system information to the radio frequency reader from time to time. Timestamp information, and verify the timestamp information encrypted by the new and old device fingerprints returned by the RF reader and the time after the remote server decrypts the returned value by using the new and old device fingerprints of the RF reader Whether the stamp information is consistent; the security module is used to encrypt and decrypt the data transmitted between the remote server and the radio frequency reader. The radio frequency reader includes an MCU module, a radio frequency transceiver module, a communication interface module, and a FLASH storage module. Wherein, the FLASH storage module is used to store the old and new device fingerprints based on time stamps; the MCU module includes a dynamic password generation module and a data encryption and decryption module, and the dynamic password generation module is used when the radio frequency reader receives the When the new time stamp sent by the remote server, judge whether the new time stamp is greater than the old time stamp stored in the FLASH storage module, when established, start the dynamic password generation module to generate a group of dynamic passwords as the new device fingerprint code , and use the new and old device fingerprint codes to encrypt the new time stamp respectively as the password update confirmation return value, and send it to the remote server, and the data encryption and decryption module completes the data encryption and decryption functions; the communication interface module includes RS232 interface, RS485 interface or USB interface. 2. The smart card system according to claim 1, characterized in that: the security module includes a symmetric cryptographic algorithm module for encrypting and decrypting data communicated using symmetric ciphers, and a hash operation for performing hash operations module. 3. The smart card system according to claim 2, wherein: the remote server sends a group of newly generated timestamps to the radio frequency reader from time to time through the timestamp generation and verification module, and simultaneously Generate a set of new device fingerprint codes with the time stamp through the security module; after the radio frequency reader receives the new time stamp, the MCU module judges whether the received new time stamp is greater than the old time stamp; when When the new time stamp is greater than the old time stamp, the RF reader will recalculate and generate a new device fingerprint code as the encryption and decryption code for data transmission, and then encrypt the new time stamp with the new and old device fingerprint codes and return it to the remote device. The end server serves as a dynamic key update confirmation message. Otherwise, only the time stamp is encrypted by the fingerprint code of the old device and sent back to the remote server as dynamic key update confirmation information. 4. The smart card system according to claim 3, characterized in that: after the remote server receives the return value of the RF reader in time, the remote server utilizes the new and old IDs of the RF reader respectively. The device fingerprint code decrypts the returned information and compares and judges it. When the returned new timestamp value is consistent with the new timestamp generated by the remote server, it means that the remote server has received the RF read message. The dynamic key update confirmation information returned by the writer, the smart card system dynamic key update is completed, the smart card system determines that there is no potential security risk of malicious attacks at the line end, and the new device fingerprint code of the RF reader is enabled as the encryption and decryption key Encrypt and decrypt the sent and received data; if inconsistent, perform an update authentication again. After updating the authentication three times in a row, if the authentication is still inconsistent, the smart card system determines that there is serious interference or disconnection at the line end, terminates the communication, and activates the alarm. 5. The smart card system according to claim 4, wherein: after the remote server sends the newly generated timestamp, it starts the overtime processing module, and when the timeout of the overtime processing module expires, it still has not received the time stamp. When the dynamic key update confirmation information returned by the radio frequency reader is completed, restart the timeout processing module shown, and perform an update authentication again; after performing an update authentication again, the remote server receives the radio frequency The dynamic key update confirmation information returned by the device, the smart card system determines that there is no malicious attack on the line end. If the remote server has not received the dynamic key update confirmation information returned by the radio frequency reader after re-updating the authentication three times, the smart card system determines that there is serious interference or a disconnection at the line end, and terminates the communication. The above alarm is activated. 6. A dynamic key update authentication method of the smart card system according to any one of claims 1 to 4, characterized in that: comprising the steps of: Step 1: The remote server sends a set of newly generated timestamps to the RF reader from time to time through the timestamp generation and verification module, and generates a set of timestamps through the security module at the same time. new device fingerprint; Step 2: After the RF reader/writer receives the new time stamp, the MCU module calls out the old time stamp of the FLASH storage module, and judges whether the new time stamp is greater than the old time stamp; Step 3: If the new time stamp is greater than the old time stamp, replace the old time stamp of the FLASH storage module with the new time stamp, start the dynamic password generation module, generate a new device fingerprint code, and use the new and old time stamps respectively The device fingerprint code encrypts the new time stamp as a password update confirmation value and sends it to the remote server; otherwise, the RF reader only uses the old device fingerprint code to encrypt the new time stamp as a return value; Step 4: The remote server judges the return value of the radio frequency card reader after decrypting the fingerprint codes of the new and old devices respectively. When the returned new timestamp value is consistent with the new timestamp generated by the remote server When consistent, the update of the dynamic password of the smart card system is completed, and it is determined that there is no potential safety hazard of malicious attack at the line end, otherwise the smart card system starts a new update authentication program or starts the alarm; Step 5: When reading and writing data on the smart card, the remote server uses the fingerprint code of the new device as a key to encrypt the data information and then transmits or decrypts the received data, and the radio frequency card reader uses the fingerprint code of the new device to The data read by the smart card is encrypted and then transmitted or decrypted from the information transmitted from the line. 7. The dynamic key renewal authentication method of smart card system as claimed in claim 6, is characterized in that: after remote server receives described radio frequency reader return value, utilizes the new device fingerprint that described remote server generates Code to decrypt the return value, when the decrypted timestamp value is consistent with the new timestamp value, the new device fingerprint code of the smart card system has been updated, and it can be determined that there is no potential security risk of malicious attacks at the line end; the received When the time stamp information is inconsistent with the time stamp of the remote server, or when the information returned by the radio frequency reader is not received, the timeout processing module shown is started, and the time stamp transmission authentication is performed again; after three consecutive update authentications, all If the remote server has not received the correct time stamp information returned by the RF reader, the smart card system determines that there is serious interference or a short circuit at the line end, terminates the communication, and activates the alarm. 8. The dynamic key renewal authentication method of smart card system as claimed in claim 7, it is characterized in that: after the key renewal authentication of described smart card system, the authentication result is displayed on the monitor screen on the remote server .

Images