WO2016029721A1 - 隐藏超高频电子标签识别号的安全认证方法 - Google Patents

隐藏超高频电子标签识别号的安全认证方法 Download PDF

Info

Publication number
WO2016029721A1
WO2016029721A1 PCT/CN2015/079692 CN2015079692W WO2016029721A1 WO 2016029721 A1 WO2016029721 A1 WO 2016029721A1 CN 2015079692 W CN2015079692 W CN 2015079692W WO 2016029721 A1 WO2016029721 A1 WO 2016029721A1
Authority
WO
WIPO (PCT)
Prior art keywords
electronic tag
tag
read
rnt
write
Prior art date
Application number
PCT/CN2015/079692
Other languages
English (en)
French (fr)
Inventor
孙正良
黄金
蔡岗
刘东波
胡家彬
Original Assignee
公安部交通管理科学研究所
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 公安部交通管理科学研究所 filed Critical 公安部交通管理科学研究所
Priority to US15/106,843 priority Critical patent/US20180196973A1/en
Priority to JP2016541528A priority patent/JP6169802B2/ja
Priority to EP15835462.1A priority patent/EP3118776B1/en
Publication of WO2016029721A1 publication Critical patent/WO2016029721A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06K—GRAPHICAL DATA READING; PRESENTATION OF DATA; RECORD CARRIERS; HANDLING RECORD CARRIERS
    • G06K17/00—Methods or arrangements for effecting co-operative working between equipments covered by two or more of main groups G06K1/00 - G06K15/00, e.g. automatic card files incorporating conveying and reading operations
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0618—Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation
    • H04L9/0625—Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation with splitting of the data block into left and right halves, e.g. Feistel based algorithms, DES, FEAL, IDEA or KASUMI
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/037—Protecting confidentiality, e.g. by encryption of the control plane, e.g. signalling traffic
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06K—GRAPHICAL DATA READING; PRESENTATION OF DATA; RECORD CARRIERS; HANDLING RECORD CARRIERS
    • G06K7/00—Methods or arrangements for sensing record carriers, e.g. for reading patterns
    • G06K7/10—Methods or arrangements for sensing record carriers, e.g. for reading patterns by electromagnetic radiation, e.g. optical sensing; by corpuscular radiation
    • G06K7/10009—Methods or arrangements for sensing record carriers, e.g. for reading patterns by electromagnetic radiation, e.g. optical sensing; by corpuscular radiation sensing by radiation using wavelengths larger than 0.1 mm, e.g. radio-waves or microwaves
    • G06K7/10257—Methods or arrangements for sensing record carriers, e.g. for reading patterns by electromagnetic radiation, e.g. optical sensing; by corpuscular radiation sensing by radiation using wavelengths larger than 0.1 mm, e.g. radio-waves or microwaves arrangements for protecting the interrogation against piracy attacks

Definitions

  • the invention relates to an authentication method, in particular to a security authentication method for hiding an UHF electronic tag identification number, and belongs to the technical field of UHF radio frequency identification.
  • Radio Frequency Identification is a non-contact automatic identification technology based on wireless communication. It is one of the six basic technologies in the field of Internet of Things. Radio frequency identification technology can realize automatic identification or reading and writing of object information without physical contact, and is widely used in automatic identification and digital management of personnel, animals and articles.
  • UHF RFID Passive UHF RFID refers to radio frequency identification systems operating at 840-845 MHz and 920-925 Mhz.
  • the simple electronic tag reading system consists of three parts: an electronic tag, a reading and writing device, and an antenna.
  • the tag and the reading and writing device communicate by electromagnetic backscatter coupling, and the tag acquires the energy required for the work through electromagnetic induction without a battery.
  • UHF RFID wireless communication has broadcast characteristics, especially its long reading distance (5 meters to 20 meters), so it is extremely vulnerable to forgery, replay and other attacks. Therefore, privacy protection and information security are important in RFID applications.
  • UHF RFID's main air interface protocol standards are ISO18000-6C (referred to as 6C standard) and China's national standard GB/T29768 issued in 2013. Among them: the 6C standard can only protect the data of the electronic tag user area by accessing the password, and the access code and identification number (TID) of the electronic tag are transmitted in the air in the air. Therefore, the 6C standard is difficult to prevent the electronic tag data from being copied and stolen.
  • the national standard GB/T29768 adopts a secure authentication method and communication mechanism based on symmetric cryptographic algorithm.
  • TID electronic tag identification number
  • the national standard GB/T29768 uses the electronic tag identification number (TID) as the key dispersion parameter in the security authentication process, the TID is returned in plain text. Therefore, the national standard GB/T29768 still cannot read and protect the TID information.
  • TID is the unique identification information of the vehicle identified by the electronic label, and is the core information of the vehicle-related application. If the TID cannot be protected, the illegal reading and writing device will be able to read the TID. The trajectory tracking of the vehicle has serious safety hazards.
  • the object of the present invention is to overcome the deficiencies in the prior art and provide a security authentication method for hiding an UHF electronic tag identification number, which can prevent an illegal reading and writing device from realizing vehicle trajectory tracking by acquiring an electronic tag identification number to ensure electronic The identity and communication of the tag and the read and write device.
  • a security authentication method for hiding an UHF electronic tag identification number includes the following steps:
  • the reading and writing device sends the authentication request information to the electronic tag, and after receiving the authentication request information sent by the reading and writing device, the electronic tag reads the batch key BKey from the security information area of the electronic tag and reads out from the identification information area.
  • the electronic label batch number TBN; the electronic label encrypts the batch key BKey, the electronic label batch number TBN, and the random number RRN with the electronic tag identification number TID to obtain the tag encryption identification number TID',
  • the electronic tag returns the tag encryption identification number TID', the random number RNt, and the electronic tag batch number TBN as a response to the read/write device;
  • the reading and writing device receives the tag encryption identification number TID′, the random number RRN, and the electronic tag batch number TBN, and encrypts and distributes the electronic tag batch number TBN by using the authentication root key RKey to obtain the read and write batch key BKey′, and uses the read/write function.
  • the batch key BKey' decrypts the tag encryption identification number TID' and the random number RNT to obtain the read/write tag decryption identification number TID";
  • the read/write device decrypts the read/write tag decryption identification number TID′′ by using the authentication root key RKey to obtain a read/write single tag authentication key TKey′, and reads and writes the single tag authentication key TKey′ and the random number RNr. Performing an encryption operation to obtain a read and write access control code MAC 1 , and the read/write device sends the read and write access control code MAC 1 to the electronic tag;
  • the electronic tag receives read and write access control code MAC 1, using a single security tag TKey key information decrypting operation zone, to obtain a random number RNt '; tag random number RNt' RNT is compared with the random number, when the random If the number RNt' is inconsistent with the random number RNT, the authentication process between the device and the read/write device is terminated; otherwise, the process proceeds to step e;
  • the electronic tag again generates a random number RNt", and encrypts the random number RNt" with the single-label authentication key TKey to obtain the tag access control code MAC 2 , and sends the tag access control code MAC 2 To the reading and writing device;
  • the read/write device receives the tag access control code MAC 2 and decrypts the tag access control code MAC2 by using the read/write single tag authentication key TKey' to obtain a random number RNr'; if the random number RNr' and the random number RNr If they are consistent, the read/write device passes the authentication of the electronic tag, otherwise the authentication fails.
  • the authentication root key RKey is located in the security control module PSAM of the read/write device, and the security control module PSAM encrypts and distributes the electronic label batch number TBN by using the authentication root key RKey to obtain the read/write batch key BKey'. .
  • the electronic tag encrypts the electronic tag identification number TID, the random number RRN, and the electronic tag batch key BKey to obtain an electronic tag, and the tag encryption identification number TID' is
  • TID' E1(TID ⁇ RNt, BKey)
  • E1 is a symmetric encryption operation function
  • ⁇ is an exclusive OR operation
  • the read/write device obtains the read/write tag decryption identification number TID"
  • TID′′ E2(TID′,BKey) ⁇ RNt
  • E2 is a symmetric encryption operation function
  • ⁇ is an exclusive OR operation
  • E2 is a symmetric encryption operation function, and
  • the electronic tag obtains the random number RNt'
  • E1 is a symmetric encryption operation function
  • represents an information cascade operation.
  • the electronic tag obtains the tag read and write access control code MAC 2 as
  • E1 is a symmetric encryption operation function
  • represents an information cascade operation.
  • the read/write device obtains the random number RNr'
  • E2 is a symmetric encryption operation function, and
  • the invention can better protect the security risks and privacy problems of the radio frequency identification system. Especially for the car-related field, the advantages of this type of installation certification are more obvious. Specifically, it has the following advantages:
  • the electronic tag identification number TID information protection function In the security authentication method of the present invention, the electronic tag identification number TID information is XORed with a random number and encrypted and returned. Therefore, each return value of the same electronic tag is different, which can effectively prevent the illegal reading and writing device from tracking the tag by recording the tag response information.
  • the safety certification method is applicable to vehicle-related applications requiring high-speed, long-distance reading.
  • the electronic tag After the read/write device issues the authentication request, the electronic tag first returns the ciphertext information including the electronic tag identification number TID, so that the read/write device can obtain the electronic tag even if the subsequent security authentication step fails.
  • Electronic tag identification number TID In the vehicle-related application, the electronic tag identification number TID can uniquely correspond to the vehicle, and the identity information of the vehicle registration can be obtained through the background application system retrieval.
  • FIG. 1 is a schematic structural diagram of a passive ultra-high frequency radio frequency identification system safety authentication system according to the present invention.
  • FIG. 2 is a schematic flow chart of a method for securely hiding a UHF electronic tag identification number according to the present invention.
  • FIG. 1 is a schematic structural diagram of a passive UHF radio frequency identification system authentication system of the present invention, which comprises an electronic tag and a read/write device.
  • the electronic tag includes three storage partitions: an identification information area, a user data area, and a security information area.
  • the identification information area stores an electronic tag identification number TID (unique serial number) and an electronic tag batch number TBN information.
  • TID unique serial number
  • the electronic tag identification number TID is initialized and written by the tag chip manufacturing enterprise, and the electronic tag batch number TBN is completed by the key management center to complete the initial writing of the electronic tag, and the electronic tag identification number TID and the electronic tag batch number TBN cannot be changed after being written.
  • the user data area stores personalized information of the identified item, and the information is personalizedly written when the electronic label is actually used;
  • the security information area stores a batch key BKey and a single label authentication key TKey, the batch secret
  • the key BKey and the single-label authentication key TKey are encrypted and generated by the authentication root key RKey for the electronic tag batch number TBN and the electronic tag identification number TID, and are written synchronously with the electronic tag batch number TBN information.
  • the security control module PSAM built in the read/write device stores the authentication root key RKey information, which is written by an authorized management authority.
  • the authentication method of the present invention includes the following steps:
  • the read/write device sends an authentication request message to the electronic tag, and the electronic tag is sent by the read/write device.
  • the batch key BKey is read out from the security information area of the electronic tag and the electronic tag batch number TBN is read from the identification information area;
  • the electronic tag sets the batch key BKey, the electronic tag batch number TBN, and the random number RNT with
  • the electronic tag identification number TID performs an encryption operation to obtain a tag encryption identification number TID', and the electronic tag returns the tag encryption identification number TID', the random number RNt, and the electronic tag batch number TBN as a response to the read/write device;
  • the electronic tag encrypts the electronic tag identification number TID, the random number RRN, and the electronic tag batch key BKey to obtain an electronic tag, and the tag encryption identification number TID′ is
  • TID' E1(TID ⁇ RNt, BKey)
  • E1 is a symmetric encryption operation function
  • ⁇ is an exclusive OR operation
  • the random number RNt is a value randomly generated within the electronic tag.
  • the reading and writing device receives the tag encryption identification number TID′, the random number RRN, and the electronic tag batch number TBN, and encrypts and distributes the electronic tag batch number TBN by using the authentication root key RKey to obtain the read and write batch key BKey′, and uses the read/write function.
  • the batch key BKey' decrypts the tag encryption identification number TID' and the random number RNT to obtain the read/write tag decryption identification number TID";
  • the authentication root key RKey is located in the security control module PSAM of the read/write device.
  • the security control module PSAM encrypts and distributes the electronic label batch number TBN by using the authentication root key RKey to obtain the read/write batch key BKey'. Calculated as follows:
  • ED is a cryptographic dispersion operation function.
  • the read/write device obtains the read/write tag decryption identification number TID"
  • TID′′ E2(TID′,BKey) ⁇ RNt
  • E2 is a symmetric encryption operation function
  • ⁇ is an exclusive OR operation
  • the encryption function E1 in the electronic tag and the encryption function E2 in the reading and writing device are a preset encryption type, and the tag encryption identification number obtained by the electronic tag encryption.
  • the TID' can decrypt the read/write tag decryption identification number TID" in the read/write device, and the specific implementation process is well known to those skilled in the art.
  • the read/write device is a legitimate device, the obtained read/write batch key BKey' will be The batch key BKey in the electronic tag is consistent.
  • the obtained read/write batch key BKey' is inconsistent with the batch key BKey in the electronic tag, and thus the obtained read/write tag decryption identification number TID is obtained. "Not the result of the default.
  • the read/write device decrypts the read/write tag decryption identification number TID′′ by using the authentication root key RKey to obtain a read/write single tag authentication key TKey′, and reads and writes the single tag authentication key TKey′ and the random number RNr. Performing an encryption operation to obtain a read and write access control code MAC 1 , and the read/write device sends the read and write access control code MAC 1 to the electronic tag;
  • E2 is a symmetric encryption operation function, and
  • the electronic tag receives read and write access control code MAC 1, using a single security tag TKey key information decrypting operation zone, to obtain a random number RNt '; tag random number RNt' RNT is compared with the random number, when the random If the number RNt' is inconsistent with the random number RNT, the authentication process between the device and the read/write device is terminated; otherwise, the process proceeds to step e;
  • the electronic tag gets the random number RNt'
  • E1 is a symmetric encryption operation function
  • represents an information cascade operation.
  • the electronic tag again generates a random number RNt", and encrypts the random number RNt" with the single-label authentication key TKey to obtain the tag access control code MAC 2 , and sends the tag access control code MAC 2 To the reading and writing device;
  • the electronic tag gets the tag read and write access control code MAC 2
  • E1 is a symmetric encryption operation function
  • represents an information cascade operation.
  • the read/write device receives the tag access control code MAC 2 and decrypts the tag access control code MAC2 by using the read/write single tag authentication key TKey' to obtain a random number RNr'; if the random number RNr' and the random number RNr If they are consistent, the read/write device passes the authentication of the electronic tag, otherwise the authentication fails.
  • the read/write device gets the random number RNr'
  • E2 is a symmetric encryption operation function, and
  • the encryption algorithm of the symmetric encryption operation functions E1 and E2 of a-f in the step uses the national secret algorithm SM7, and the encryption algorithm of the encryption distribution function ED uses the SM1 algorithm.
  • the symmetric encryption algorithm in the specific embodiment of the present invention is not limited to the SM7 algorithm, and may also use a symmetric encryption algorithm such as SM4, DES, or 3DES.
  • the invention By encrypting the electronic tag identification number TID by using a random number, the invention returns in a cipher text manner, which can effectively prevent the illegal reading and writing device from acquiring the electronic tag identification number TID information to realize illegal tracking and identification of the items identified by the electronic tag.
  • the authentication method can effectively resist attacks such as eavesdropping, counterfeiting and replay, and has the advantages of preventing electronic tag information from being stolen and preventing forgery of tags.
  • the security authentication method uses a national secret symmetric encryption algorithm, adopts a dual key and a secondary authentication mechanism, and implements the validity verification of the electronic label of the batch card and the key and the two-way security verification of the single label single key.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Toxicology (AREA)
  • Health & Medical Sciences (AREA)
  • Theoretical Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Electromagnetism (AREA)
  • General Health & Medical Sciences (AREA)
  • Artificial Intelligence (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Storage Device Security (AREA)

Abstract

一种隐藏超高频电子标签识别号的安全认证方法，该安全认证方法通过对电子标签识别号TID进行随机数加密后，以密文方式返回，能有效防止非法读写设备获取TID信息实现对电子标签所标识的物品进行非法跟踪和身份识别。同时，该认证方法能有效抵御窃听、仿冒和重放等攻击，具有防止电子标签信息被窃取、防止伪造标签等优点。该安全认证方法使用国密对称加密算法，采用双密钥和二次认证机制，实现了批量卡同密钥的电子标签合法性验证和单标签单密钥的双向安全验证。

Description

隐藏超高频电子标签识别号的安全认证方法 技术领域
本发明涉及一种认证方法，尤其是一种隐藏超高频电子标签识别号的安全认证方法，属于超高频射频识别的技术领域。
背景技术
射频识别(RFID)是一种基于无线通信的非接触式自动识别技术，是物联网领域的六大基础技术之一。射频识别技术无需通过物理接触，即可实现对物体信息的自动识别或读写，广泛应用于人员、动物、物品等身份自动识别和数字化管理。
无源超高频射频识别(UHF RFID)是指工作频率为840～845MHz和920～925Mhz的射频识别***。简单的电子标签识读***由电子标签、读写设备、天线三部分组成，标签和读写设备采用电磁反向散射耦合方式进行通信，标签通过电磁感应获取工作所需能量，无需电池。
UHF RFID无线通信具有广播特性，特别是其识读距离远(5米至20米)，因此极容易遭受伪造、重放等攻击，因此，在射频识别***应用中隐私保护和信息安全是需要重点考虑。目前，UHF RFID主要的空中接口协议标准有ISO18000-6C(简称6C标准)和我国2013年颁布的国家标准GB/T29768。其中：6C标准只能通过访问密码保护电子标签用户区的数据，电子标签的访问密码和标识号(TID)在空中明文传输，因此，6C标准难于防止电子标签数据复制和盗用。而国家标准GB/T29768采用了基于对称密码算法的安全认证方法和通讯机制，因此，其安全性能与6C标准相比有了明显的提高。但是，由于国标GB/T29768在安全认证过程中使用电子标签识别号(TID)作为密钥分散参数，需将TID明文返回，因此，国标GB/T29768仍然无法对TID信息进行读保护。而在涉车应用领域中，TID是电子标签所标识的车辆唯一标识信息，是涉车应用的核心信息，如果无法对TID进行保护，将存在非法读写设备通过识读TID，即可实现对车辆的轨迹跟踪，存在严重的安全隐患。
发明内容
本发明的目的是克服现有技术中存在的不足，提供一种隐藏超高频电子标签识别号的安全认证方法，其能防止非法读写设备通过获取电子标签识别号实现车辆轨迹跟踪，确保电子标签与读写设备的身份互认和通讯。
按照本发明提供的技术方案，一种隐藏超高频电子标签识别号的安全认证方法，所述认证方法包括如下步骤：
a、读写设备向电子标签发送认证请求信息，电子标签在收到读写设备发送的认证请求信息后，从电子标签的安全信息区内读出批密钥BKey并从标识信息区内读出电子标签批号TBN；电子标签将批密钥BKey、电子标签批号TBN以及随机数RNt与电子标签识别号TID进行加密运算，得到标签加密识别号TID′， 电子标签将标签加密识别号TID′、随机数RNt以及电子标签批号TBN作为应答返回至读写设备内；
b、读写设备接收标签加密识别号TID′、随机数RNt以及电子标签批号TBN，利用认证根密钥RKey对电子标签批号TBN进行加密分散，以得到读写批密钥BKey′，利用读写批密钥BKey′对标签加密识别号TID′以及随机数RNt进行解密运算，以得到读写标签解密识别号TID″；
c、读写设备利用认证根密钥RKey对读写标签解密识别号TID″加密分散，以获得读写单标签认证密钥TKey′，并将读写单标签认证密钥TKey′与随机数RNr进行加密运算，以得到读写访问控制码MAC1，读写设备将读写访问控制码MAC1发送至电子标签；
d、电子标签接收读写访问控制码MAC1，利用安全信息区的单标签密钥TKey进行解密运算，以得到随机数RNt′；电子标签将随机数RNt′与随机数RNt进行比较，当随机数RNt′与随机数RNt不一致时，则终止与读写设备间的认证过程，否则，进入步骤e；
e、电子标签再次产生随机数RNt″，并将所述随机数RNt″与单标签认证密钥TKey进行加密运算，以得到标签访问控制码MAC2，并将所述标签访问控制码MAC2发送至读写设备；
f、读写设备接收标签访问控制码MAC2，并利用读写单标签认证密钥TKey′对标签访问控制码MAC2进行解密运算，以得到随机数RNr′；若随机数RNr′与随机数RNr一致时，则读写设备通过电子标签的认证，否则认证失败。
所述步骤b中，认证根密钥RKey位于读写设备的安全控制模块PSAM内，安全控制模块PSAM利用认证根密钥RKey对电子标签批号TBN进行加密分散，以得到读写批密钥BKey′。
所述步骤a中，电子标签对电子标签识别号TID、随机数RNt以及电子标签批密钥BKey进行加密运算，得到电子标签将标签加密识别号TID′为
TID′＝E1(TID⊕RNt,BKey)
其中，E1为对称加密运算函数，⊕为异或运算。
所述步骤b中，读写设备得到读写标签解密识别号TID″为
TID″＝E2(TID′,BKey)⊕RNt
其中，E2为对称加密运算函数，⊕为异或运算。
所述步骤c中，读写设备得到读写访问控制码MAC1为
MAC1＝E2(RNt||RNr,TKey′)
其中，E2为对称加密运算函数，||表示信息级联运算。
所述步骤d中，电子标签得到随机数RNt′为
{RNt′||RNr}＝E1(MAC1,TKey)
其中，E1为对称加密运算函数，||表示信息级联运算。
所述步骤e中，电子标签得到标签读写访问控制码MAC2为
MAC2＝E1(RNt″||RNr,TKey)
其中，E1为对称加密运算函数，||表示信息级联运算。
所述步骤f中，读写设备得到随机数RNr′为
{RNt″||RNr}＝E2(MAC2,TKey)
其中，E2为对称加密运算函数，||表示信息级联运算。
本发明对射频识别***存在的安全隐患和隐私问题都能较好的防护。特别针对涉车领域，这种安装认证方式优势更加明显。具体有如下优点：
1、具有电子标签标识号TID信息保护功能。本发明的安全认证方法中，电子标签标识号TID信息与随机数异或并加密后返回。因此，同一个电子标签的每次返回值是不同的，这样能有效防止非法读写设备通过记录标签响应信息，对标签进行跟踪。
2、单标签单密钥的双向身份认证。所述安全认证方法中每张标签均有不同身份认证密钥，即使通过非法的方式获知了单标签密钥，也只能读取单张标签数据，无法读取其他电子标签存储的数据，从而有效的防止标签存储信息被窃取。
3、所述安全认证方法适用于需要高速、远距离识读等涉车应用领域。在所述认证方法中，读写设备发出认证请求后，电子标签首先返回包含电子标签识别号TID的密文信息，因此，即使后续安全认证步骤失败，所述读写设备也能获得该电子标签的电子标签识别号TID。在涉车应用中，电子标签识别号TID可以唯一对应车辆，通过后台应用***检索可获知车辆注册的身份信息。
附图说明
图1为本发明无源超高频射频识别***安全认证***的结构示意图。
图2为本发明隐藏超高频电子标签识别号的安全认证方法流程示意图。
具体实施方式
下面结合具体附图和实施例对本发明作进一步说明。
如图1所示：本发明的无源超高频射频识别***认证***的结构示意图，***包括电子标签和读写设备组成。
所述电子标签包含标识信息区、用户数据区、安全信息区三个存储分区。所述标识信息区存储电子标签识别号TID(唯一序列号)和电子标签批号TBN信息。所述电子标签识别号TID由标签芯片生产企业初始化写入，所述电子标签批号TBN由密钥管理中心完成电子标签的初始化写入，电子标签识别号TID、电子标签批号TBN写入后不可更改；所述用户数据区存储所标识物品的个性化信息，这些信息在电子标签实际使用时个性化写入；所述安全信息区存储批密钥BKey和单标签认证密钥TKey，所述批密钥BKey和单标签认证密钥TKey由认证根密钥RKey对电子标签批号TBN和电子标签识别号TID加密分散生成，与电子标签批号TBN信息同步写入。
所述读写设备内置的安全控制模块PSAM存储认证根密钥RKey信息，由授权的管理机关写入。
为了能防止非法读写设备通过获取电子标签识别号实现车辆轨迹跟踪，确保电子标签与读写设备的身份互认和通讯，本发明的认证方法包括如下步骤：
a、读写设备向电子标签发送认证请求信息，电子标签在收到读写设备发送 的认证请求信息后，从电子标签的安全信息区内读出批密钥BKey并从标识信息区内读出电子标签批号TBN；电子标签将批密钥BKey、电子标签批号TBN以及随机数RNt与电子标签识别号TID进行加密运算，得到标签加密识别号TID′，电子标签将标签加密识别号TID′、随机数RNt以及电子标签批号TBN作为应答返回至读写设备内；
具体地，电子标签对电子标签识别号TID、随机数RNt以及电子标签批密钥BKey进行加密运算，得到电子标签将标签加密识别号TID′为
TID′＝E1(TID⊕RNt,BKey)
其中，E1为对称加密运算函数，⊕为异或运算。随机数RNt为在电子标签内随机产生的数值。
b、读写设备接收标签加密识别号TID′、随机数RNt以及电子标签批号TBN，利用认证根密钥RKey对电子标签批号TBN进行加密分散，以得到读写批密钥BKey′，利用读写批密钥BKey′对标签加密识别号TID′以及随机数RNt进行解密运算，以得到读写标签解密识别号TID″；
认证根密钥RKey位于读写设备的安全控制模块PSAM内，安全控制模块PSAM利用认证根密钥RKey对电子标签批号TBN进行加密分散，以得到读写批密钥BKey′。计算公式如下：
BKey′＝ED(TBN,RKey)
其中，ED为加密分散运算函数。
所述步骤b中，读写设备得到读写标签解密识别号TID″为
TID″＝E2(TID′,BKey)⊕RNt
其中，E2为对称加密运算函数，⊕为异或运算。
在具体实施时，对于经过授权合法的读写设备，所述电子标签内的加密函数E1与读写设备内的加密函数E2为预先设定的加密类型，经过电子标签加密得到的标签加密识别号TID′在读写设备内能够解密得到读写标签解密识别号TID″，具体实施过程为本技术领域人员所熟知。当读写设备为合法设备时，得到的读写批密钥BKey′会与电子标签内的批密钥BKey相一致。当为非法读写设备时，得到的读写批密钥BKey′与电子标签内的批密钥BKey不一致，因此，得到的读写标签解密识别号TID″不是预设得到的结果。
c、读写设备利用认证根密钥RKey对读写标签解密识别号TID″加密分散，以获得读写单标签认证密钥TKey′，并将读写单标签认证密钥TKey′与随机数RNr进行加密运算，以得到读写访问控制码MAC1，读写设备将读写访问控制码MAC1发送至电子标签；
所述步骤c中，读写设备得到读写访问控制码MAC1为
MAC1＝E2(RNt||RNr,TKey′)
其中，E2为对称加密运算函数，||表示信息级联运算。
d、电子标签接收读写访问控制码MAC1，利用安全信息区的单标签密钥TKey进行解密运算，以得到随机数RNt′；电子标签将随机数RNt′与随机数RNt进行比较，当随机数RNt′与随机数RNt不一致时，则终止与读写设备间的认证 过程，否则，进入步骤e；
电子标签得到随机数RNt′为
{RNt′||RNr}＝E1(MAC1,TKey)
其中，E1为对称加密运算函数，||表示信息级联运算。
e、电子标签再次产生随机数RNt″，并将所述随机数RNt″与单标签认证密钥TKey进行加密运算，以得到标签访问控制码MAC2，并将所述标签访问控制码MAC2发送至读写设备；
电子标签得到标签读写访问控制码MAC2为
MAC2＝E1(RNt″||RNr,TKey)
其中，E1为对称加密运算函数，||表示信息级联运算。
f、读写设备接收标签访问控制码MAC2，并利用读写单标签认证密钥TKey′对标签访问控制码MAC2进行解密运算，以得到随机数RNr′；若随机数RNr′与随机数RNr一致时，则读写设备通过电子标签的认证，否则认证失败。
读写设备得到随机数RNr′为
{RNt″||RNr}＝E2(MAC2,TKey)
其中，E2为对称加密运算函数，||表示信息级联运算。
本发明具体实施方式中，所述步骤中a-f的对称加密运算函数E1、E2的加密算法使用国密算法SM7，加密分散函数ED的加密算法使用SM1算法。但本发明具体实施方式所述对称加密算法不仅限于SM7算法，也可使用SM4、DES、3DES等对称加密算法。
本发明通过对电子标签识别号TID进行随机数加密后，以密文方式返回，能有效防止非法读写设备获取电子标签识别号TID信息实现对电子标签所标识的物品进行非法跟踪和身份识别。同时，该认证方法能有效抵御窃听、仿冒和重放等攻击，具有防止电子标签信息被窃取、防止伪造标签等优点。该安全认证方法使用国密对称加密算法，采用双密钥和二次认证机制，实现了批量卡同密钥的电子标签合法性验证和单标签单密钥的双向安全验证。

Claims (8)

  1. 一种隐藏超高频电子标签识别号的安全认证方法，其特征是，所述认证方法包括如下步骤：
    (a)、读写设备向电子标签发送认证请求信息，电子标签在收到读写设备发送的认证请求信息后，从电子标签的安全信息区内读出批密钥BKey并从标识信息区内读出电子标签批号TBN；电子标签将批密钥BKey、电子标签批号TBN以及随机数RNt与电子标签识别号TID进行加密运算，得到标签加密识别号TID′，电子标签将标签加密识别号TID′、随机数RNt以及电子标签批号TBN作为应答返回至读写设备内；
    (b)、读写设备接收标签加密识别号TID′、随机数RNt以及电子标签批号TBN，利用认证根密钥RKey对电子标签批号TBN进行加密分散，以得到读写批密钥BKey′，利用读写批密钥BKey′对标签加密识别号TID′以及随机数RNt进行解密运算，以得到读写标签解密识别号TID″；
    (c)、读写设备利用认证根密钥RKey对读写标签解密识别号TID″加密分散，以获得读写单标签认证密钥TKey′，并将读写单标签认证密钥TKey′与随机数RNr进行加密运算，以得到读写访问控制码MAC1，读写设备将读写访问控制码MAC1发送至电子标签；
    (d)、电子标签接收读写访问控制码MAC1，利用安全信息区的单标签密钥TKey进行解密运算，以得到随机数RNt′；电子标签将随机数RNt′与随机数RNt进行比较，当随机数RNt′与随机数RNt不一致时，则终止与读写设备间的认证过程，否则，进入步骤(e)；
    (e)、电子标签再次产生随机数RNt″，并将所述随机数RNt″与单标签认证密钥TKey进行加密运算，以得到标签访问控制码MAC2，并将所述标签访问控制码MAC2发送至读写设备；
    (f)、读写设备接收标签访问控制码MAC2，并利用读写单标签认证密钥TKey′对标签访问控制码MAC2进行解密运算，以得到随机数RNr′；若随机数RNr′与随机数RNr一致时，则读写设备通过电子标签的认证，否则认证失败。
  2. 根据权利要求1所述的隐藏超高频电子标签识别号的安全认证方法，其特征是：所述步骤(b)中，认证根密钥RKey位于读写设备的安全控制模块PSAM内，安全控制模块PSAM利用认证根密钥RKey对电子标签批号TBN进行加密分散，以得到读写批密钥BKey′。
  3. 根据权利要求1所述的隐藏超高频电子标签识别号的安全认证方法，其特征是：所述步骤(a)中，电子标签对电子标签识别号TID、随机数RNt以及电子标签批密钥BKey进行加密运算，得到电子标签将标签加密识别号TID′为
    TID′＝E1(TID⊕RNt,BKey)
    其中，E1为对称加密运算函数，⊕为异或运算。
  4. 根据权利要求1所述的隐藏超高频电子标签识别号的安全认证方法，其 特征是：所述步骤(b)中，读写设备得到读写标签解密识别号TID″为
    TID″＝E2(TID′,BKey)⊕RNt
    其中，E2为对称加密运算函数，⊕为异或运算。
  5. 根据权利要求1所述的隐藏超高频电子标签识别号的安全认证方法，其特征是：所述步骤(c)中，读写设备得到读写访问控制码MAC1为
    MAC1＝E2(RNt||RNr,TKey′)
    其中，E2为对称加密运算函数，||表示信息级联运算。
  6. 根据权利要求1所述的隐藏超高频电子标签识别号的安全认证方法，其特征是：所述步骤(d)中，电子标签得到随机数RNt′为
    {RNt′||RNr}＝E1(MAC1,TKey)
    其中，E1为对称加密运算函数，||表示信息级联运算。
  7. 根据权利要求1所述的隐藏超高频电子标签识别号的安全认证方法，其特征是：所述步骤(e)中，电子标签得到标签读写访问控制码MAC2为
    MAC2＝E1(RNt″||RNr,TKey)
    其中，E1为对称加密运算函数，||表示信息级联运算。
  8. 根据权利要求1所述的隐藏超高频电子标签识别号的安全认证方法，其特征是：所述步骤(f)中，读写设备得到随机数RNr′为
    {RNt″||RNr}＝E2(MAC2,TKey)
    其中，E2为对称加密运算函数，||表示信息级联运算。
PCT/CN2015/079692 2014-08-29 2015-05-25 隐藏超高频电子标签识别号的安全认证方法 WO2016029721A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
US15/106,843 US20180196973A1 (en) 2014-08-29 2015-05-25 Security Certification Method for Hiding Ultra-High Frequency Electronic Tag Identifier
JP2016541528A JP6169802B2 (ja) 2014-08-29 2015-05-25 Ｕｈｆ帯電子タグ識別番号が隠されたセキュリティ認証方法
EP15835462.1A EP3118776B1 (en) 2014-08-29 2015-05-25 Security authentication method for hiding ultra high frequency electronic tag identifier

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410439094.2A CN104217230B (zh) 2014-08-29 2014-08-29 隐藏超高频电子标签识别号的安全认证方法
CN201410439094.2 2014-08-29

Publications (1)

Publication Number Publication Date
WO2016029721A1 true WO2016029721A1 (zh) 2016-03-03

Family

ID=52098692

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/079692 WO2016029721A1 (zh) 2014-08-29 2015-05-25 隐藏超高频电子标签识别号的安全认证方法

Country Status (5)

Country Link
US (1) US20180196973A1 (zh)
EP (1) EP3118776B1 (zh)
JP (1) JP6169802B2 (zh)
CN (1) CN104217230B (zh)
WO (1) WO2016029721A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108763994A (zh) * 2018-07-23 2018-11-06 深圳麦格米特电气股份有限公司 超高频电子标签的读写控制方法、装置及读写设备
US11213773B2 (en) 2017-03-06 2022-01-04 Cummins Filtration Ip, Inc. Genuine filter recognition with filter monitoring system

Families Citing this family (24)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104217230B (zh) * 2014-08-29 2017-03-15 公安部交通管理科学研究所 隐藏超高频电子标签识别号的安全认证方法
CN105989386B (zh) * 2015-02-28 2019-03-29 北京天威诚信电子商务服务有限公司 一种读写无线射频识别卡的方法和装置
CN110365484B (zh) * 2015-03-17 2023-01-20 创新先进技术有限公司 一种设备认证的数据处理方法、装置及***
CN105246026B (zh) * 2015-09-22 2019-03-12 东南大学 一种智能可穿戴设备与其他设备的安全配对方法
CN105550618B (zh) * 2015-12-09 2018-04-13 公安部交通管理科学研究所 可信可控的车辆电子身份信息采集装置
CN105827691B (zh) * 2016-03-08 2019-08-13 中国联合网络通信集团有限公司 物联网设备控制方法及装置
CN106408069B (zh) * 2016-09-30 2019-06-21 日立楼宇技术（广州）有限公司 Epc卡的用户数据写入与读取方法和***
CN106936591B (zh) * 2017-05-10 2020-07-07 广州科技职业技术学院 Rfid双向认证方法与***
CN108875879A (zh) * 2017-05-11 2018-11-23 北京孚川电子科技有限公司 一种基于国密安全算法的双向授权认证方法及装置
GB2566323B (en) * 2017-09-11 2022-09-21 Pragmatic Printing Ltd Secure RFID tag identification
WO2019142268A1 (ja) * 2018-01-17 2019-07-25 三菱電機株式会社 登録装置、検索操作装置、データ管理装置、登録プログラム、検索操作プログラムおよびデータ管理プログラム
CN108964886B (zh) * 2018-05-04 2022-03-04 霍尼韦尔环境自控产品（天津）有限公司 包含加密算法的通信方法、包含解密算法的通信方法及设备
CN108881273A (zh) * 2018-07-06 2018-11-23 北京智芯微电子科技有限公司 基于国密算法的无线温湿度传感器及其通信方法
CN109861809B (zh) * 2019-02-20 2022-03-18 中国电子科技集团公司第三十研究所 一种实用化的分组随机加解密方法
CN110232296B (zh) * 2019-04-25 2020-06-30 苏州车付通信息科技有限公司 Rfid标签与读写器加密通讯的***
CN112054890B (zh) * 2019-06-06 2024-06-07 西安诺瓦星云科技股份有限公司 屏体配置文件导出、导入方法及其装置和播控设备
CN110598811A (zh) * 2019-08-23 2019-12-20 吴彬 车用滤芯的离线防伪识别方法
CN112699696B (zh) * 2019-10-21 2024-02-27 睿芯联科（北京）电子科技有限公司 一种射频识别防物理转移方法
CN112766006B (zh) * 2019-10-21 2023-11-03 睿芯联科（北京）电子科技有限公司 一种rfid物品识别***
CN111159314B (zh) * 2019-12-31 2023-06-02 合肥美的智能科技有限公司 电子标签的关联方法、装置、电子设备及存储介质
CN112084801B (zh) * 2020-07-23 2022-04-22 西安电子科技大学 一种用于低成本无源rfid***中的双向身份认证方法
CN112613330B (zh) * 2020-12-04 2022-11-11 中国电子科技集团公司第五十四研究所 一种基于gjb协议的超高频rfid验证***
CN114398916B (zh) * 2021-07-21 2024-05-07 威海北洋光电信息技术股份公司 射频无障碍人员通道机的数据加密处理方法
CN116669025B (zh) * 2023-07-26 2023-10-13 长沙盈芯半导体科技有限公司 一种超高频rfid芯片的安全防伪方法及***

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101488854A (zh) * 2008-01-18 2009-07-22 华为技术有限公司 一种无线射频识别***认证方法和设备
CN101950367A (zh) * 2010-08-16 2011-01-19 中国科学院计算技术研究所 一种引入代理装置的rfid***及其双向认证方法
CN103413109A (zh) * 2013-08-13 2013-11-27 江西理工大学 一种无线射频识别***的双向认证方法
CN104217230A (zh) * 2014-08-29 2014-12-17 公安部交通管理科学研究所 隐藏超高频电子标签识别号的安全认证方法

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE60133453T2 (de) * 2000-02-18 2009-05-07 Cypak Ab Verfahren und vorrichtung zur identifizierung und authentisierung
JP3456528B2 (ja) * 2000-05-10 2003-10-14 日本電気株式会社 携帯電話機およびデータの秘匿方法
JP2002118548A (ja) * 2000-10-05 2002-04-19 Matsushita Electric Ind Co Ltd 相互認証方法
JP2005348306A (ja) * 2004-06-07 2005-12-15 Yokosuka Telecom Research Park:Kk 電子タグシステム、電子タグ、電子タグリーダライタ、およびプログラム
KR20070030231A (ko) * 2004-06-30 2007-03-15 코닌클리케 필립스 일렉트로닉스 엔.브이. 디바이스로 등록되는 다수의 데이터 세트 중 하나를선택하는 방법, 및 대응하는 디바이스
CN101217362B (zh) * 2007-12-29 2010-04-21 中山大学 一种基于动态随机化drntru公钥加密***建立的rfid通信安全机制
US20120280788A1 (en) * 2011-05-05 2012-11-08 Juergen Nowottnick Communications apparatus and method therefor
CN102684872B (zh) * 2011-06-10 2015-01-21 中国人民解放军国防科学技术大学 基于对称加密的超高频射频识别空中接口安全通信方法
TWI502525B (zh) * 2012-04-17 2015-10-01 Taiwan Dev & Construction Co 電子標籤及用於確保電子標籤的認證系統與方法
CN103971426A (zh) * 2013-01-31 2014-08-06 北京同方微电子有限公司 一种基于psam安全控制的门禁***及其安全门禁方法
CN103413079B (zh) * 2013-07-29 2016-08-10 苏州众天力信息科技有限公司 一种基于tid码和epc码加密计算产生id码的方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101488854A (zh) * 2008-01-18 2009-07-22 华为技术有限公司 一种无线射频识别***认证方法和设备
CN101950367A (zh) * 2010-08-16 2011-01-19 中国科学院计算技术研究所 一种引入代理装置的rfid***及其双向认证方法
CN103413109A (zh) * 2013-08-13 2013-11-27 江西理工大学 一种无线射频识别***的双向认证方法
CN104217230A (zh) * 2014-08-29 2014-12-17 公安部交通管理科学研究所 隐藏超高频电子标签识别号的安全认证方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3118776A4 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11213773B2 (en) 2017-03-06 2022-01-04 Cummins Filtration Ip, Inc. Genuine filter recognition with filter monitoring system
CN108763994A (zh) * 2018-07-23 2018-11-06 深圳麦格米特电气股份有限公司 超高频电子标签的读写控制方法、装置及读写设备

Also Published As

Publication number Publication date
CN104217230B (zh) 2017-03-15
EP3118776B1 (en) 2018-11-28
CN104217230A (zh) 2014-12-17
EP3118776A1 (en) 2017-01-18
US20180196973A1 (en) 2018-07-12
JP6169802B2 (ja) 2017-07-26
JP2017500813A (ja) 2017-01-05
EP3118776A4 (en) 2017-07-05

Similar Documents

Publication Publication Date Title
WO2016029721A1 (zh) 隐藏超高频电子标签识别号的安全认证方法
CN102882683B (zh) 一种可同步的rfid安全认证方法
CN101847199B (zh) 用于射频识别***的安全认证方法
CN101882197B (zh) 一种基于分级密钥的rfid询问-应答安全认证方法
CN103279775B (zh) 能够保证秘密性和数据完整性的rfid***及其实现方法
CN103678994B (zh) 一种具有环境控制的usb加密存储***及方法
CN107547203B (zh) 一种防伪溯源方法以及***
CN104700125A (zh) 超高频射频识别***的aes加密和验证
CN102684872A (zh) 基于对称加密的超高频射频识别空中接口安全通信方法
CN103218633A (zh) 一种rfid安全认证方法
JP2005295408A (ja) 暗号化装置，復号化装置，暗号化復号化システム，鍵情報更新システム
CN102904723B (zh) 一种rfid***的隐私保护方法
CN101588238A (zh) 制证***中证件卡的加密和解密的方法
CN103793742A (zh) 一种交通电子车牌的电子标签安全认证和信息加密的技术
CN113988103B (zh) 一种基于多标签的rfid识别方法
CN110232296B (zh) Rfid标签与读写器加密通讯的***
CN103324970A (zh) 一种高效安全的rfid的收发方法及其***
KR101053636B1 (ko) 다중 암호방식을 이용한 태그와 ｒｆｉｄ리더간 인증 방법 및 시스템
CN111132152A (zh) 一种基于多层密钥体制的rfid标签认证方法
CN113988249B (zh) 一种基于排列的rfid识别方法
CN104346643B (zh) 基于AES算法对UHF 920‑925MHz 电子车牌***的加密方法
CN112364330B (zh) 一种安全控制装置及权限授权方法和电子标签识读方法
CN104243136A (zh) 一种用于干部人事档案管理的射频识别标识防伪验证方法
CN101477614A (zh) 射频电子标签的数据加密方法
CN104680225A (zh) RFID(840-845MHz)汽车电子标识的安全认证和AES加密

Legal Events

Date Code Title Description
ENP Entry into the national phase

Ref document number: 2016541528

Country of ref document: JP

Kind code of ref document: A

REEP Request for entry into the european phase

Ref document number: 2015835462

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2015835462

Country of ref document: EP

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15835462

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE