CN105069864A - Door lock control secure communication scheme based on NFC (near field communication) function of smart phone - Google Patents

Abstract

The invention relates to a security communication scheme for door lock control based on the NFC function of a smart phone, which includes two communication subjects, namely a door lock module and a smart phone terminal key module, and the two communication subjects are in the ISO/IEC? 14443 protocol for communication, in which the communication process is divided into two parts: first, the door lock module and the key module are based on ISO? The mutual authentication of the 9798-2 three-round authentication protocol mutually confirms that the other party is a legal subject, then the key module sends the request content, the door lock module responds to the request content and feeds back information, and finally ends the communication. The present invention can realize the interactive communication between the door lock and the intelligent terminal, and overcomes the NFC of the current intelligent mobile phone? The shortcomings of the inability to carry out interactive communication in the implementation of P2P functions can overcome the major security defects in the two-way authentication and resistance to replay attacks in the existing smart phone door lock control scheme.

Description

Security communication scheme for door lock control based on smart phone NFC function

technical field

The invention relates to a security communication scheme for door lock control based on the NFC function of a smart phone.

Background technique

With the maturity of NFC technology, more and more smart phones begin to support this function. NFC technology integrates ISO/IEC14443A/B and FeliCa Radio Frequency Identification (RFID) standards. NFC technology itself supports card emulation (CardEmulation) mode, card reader (RFIDReader) mode and peer-to-peer (P2P) communication mode, and the functions are very complete, but the existing Android smartphones have limited implementation of the NFC function, only the card reader mode and the AndroidBeam function of point-to-point communication, the card emulation mode is only introduced after Android4.4, and has a single function.

The incompleteness of these implementations limits the scope of application of the NFC function of smartphones. At present, the commonly used applications are limited to the reading and writing of NFC electronic tags and the transmission of short information between mobile phones, such as business cards, pictures, URLs, etc. Another common The purpose is to assist in the realization of Bluetooth pairing. At the same time, many of the smart door lock systems currently used in major hotels or office areas use contactless smart cards as keys. Although they provide certain convenience, users still need to carry smart cards as keys.

Since NFC technology is fully compatible with the underlying communication protocol of the existing common non-contact smart card, and the mobile phone is already an essential item that people carry with them, the smart phone with NFC function is used as the key of the smart door lock. Very good application prospects. There have been many smart door locks that support the NFC function, but the design of all these door locks has not noticed or cannot solve the authentication and communication security issues when the smart phone communicates with the door lock through the NFC function, so the security is very low , The design of the door lock itself is to ensure security. If the designed door lock supporting NFC function does not consider the security of wireless communication, the security of the door lock cannot be guaranteed at all.

Most of these existing patents avoid this major security issue. The key communication process simply mentions sending a unique identification code to the door lock through the NFC mobile phone, even in the patent "A NFC-based Access Control System" (application number: CN201410664589) A technical error occurred in the patent, which said that "NFC (Near Field Communication Technology) has the characteristics of two-way data transmission, mutual authentication, dynamic encryption and one-time key". The current NFC technology does not have the characteristics of mutual authentication, dynamic encryption and one-time key at all.

The key shortcoming of the existing patents and products is that the communication protocol between the NFC smart phone and the door lock is simply realized by sending an identification number including a unique identification code or password from the mobile phone to the door lock. This one-way data transmission cannot realize the mutual authentication function of the communication parties, nor can it prevent the occurrence of replay attacks.

Since there is no mutual authentication, this kind of door lock system cannot prevent the emergence of illegal door locks or illegal mobile phones. The simplest attack situation is that the attacker can use a mobile phone with NFC function instead of the door lock, and directly accept the unlock command of the legitimate mobile phone. , which is the unique identification code, and then you can replay the previously received unique identification code to the door lock to open the door. This kind of attack is very convenient to implement. As long as the attacker has access to the smartphone used for unlocking and runs the corresponding unlocking software on the phone, another NFC mobile phone can be used to replace the door lock and approach the mobile phone used for unlocking to easily obtain the unlock. Instructions, the whole process will not take more than 1 minute.

The reason for this security problem is that the existing communication solutions are all one-way data transmission, and there is no interaction process between the mobile phone and the door lock. The reason is mainly due to the fact that AndroidBeam technology, which is a specific implementation scheme of the point-to-point communication mode of the existing NFC technology, only supports sending one piece of data to the other party at a time. Therefore, if you want to fundamentally solve security problems, you cannot use AndroidBeam technology.

Contents of the invention

The problem to be solved by the present invention is the non-interactive communication between the NFC smart phone and the door lock mentioned above, there is no mutual authentication, and the security problem that replay attacks cannot be prevented, while ensuring the scalability of functions, the timeliness of communication and Replaceability of cryptographic algorithms.

The technical scheme for realizing the above-mentioned purpose is as follows:

The door lock control security communication scheme based on the smart phone NFC function is characterized in that it includes two communication subjects, namely the door lock module and the smart phone terminal key module, and the two communication subjects communicate on the ISO/IEC14443 protocol, wherein The communication process is divided into two parts:

First, the door lock module and the key module perform mutual authentication based on the ISO9798-2 three-round authentication protocol to confirm that the other party is a legal subject, then the key module sends the request content, the door lock module responds to the request content and feeds back information, and finally ends communication.

In the present invention, a mutually authenticated security communication protocol is adopted, the door lock adopts the NFC card simulation mode, and the smart phone terminal adopts the card reader mode for NFC communication, so as to achieve the purpose of interactive communication, which is the basis for the establishment of the entire invention. It can realize the interactive communication between the door lock and the intelligent terminal, and overcomes the disadvantage that the interactive communication cannot be carried out in the realization of the P2P mode of NFC technology at the present stage.

Description of drawings

Fig. 1 is a schematic diagram of the communication process of the present invention

detailed description

The present invention will be described in detail below in conjunction with the accompanying drawings.

There are two communication subjects in the present invention: the door lock module LOCK and the smart phone terminal key module KEY. The door lock module adopts the existing NFC chip that supports the card simulation function, and works in the card simulation mode, simulating a smart card using the ISO/IEC14443 communication protocol, while the key module works in the card reader mode. The two communication subjects communicate on top of the ISO/IEC14443 protocol. The communication process can be divided into two parts. First, the door lock module LOCK and the key module KEY perform mutual authentication based on the ISO9798-2 three-round authentication protocol, and mutually confirm that the other party is a legal subject. Then the key module KEY sends the request content, and the door lock module LOCK feeds back and responds, and then ends the communication according to the result of the feedback. The entire communication process is encrypted and protected using the AES encryption algorithm. The present invention does not make rigid regulations on the NFC chip used in the door lock, as long as it supports the card simulation function, it can be used. The present invention has no requirements on the encryption algorithm of the communication process, and can use other symmetric block encryption algorithms other than the AES algorithm to realize the same function.

The specific communication steps are as follows:

(1) First, the key module KEY sends a start authentication request command REQ_BEGIN to the door lock module LOCK to start the entire authentication process;

(2) After the door lock module LOCK receives the start authentication request command, the door lock module LOCK generates a first random number, and uses the system key KS shared with the key module KEY to perform AES encryption on the generated first random number and send it to Give the key module KEY;

(3) Then the key module KEY decrypts the feedback message, and generates a second random number and temporary session key KT, and uses the shared system key KS (“||” symbol to indicate concatenation) to generate the second random number , the decryption result and the temporary session key KT are AES encrypted and transmitted to the door lock module LOCK;

(4) Then the door lock module LOCK decrypts the received message to obtain the decrypted message, thereby obtaining the temporary session key KT and the second random number, and verifies whether the decrypted message contains the correct first random number, and if so, completes To authenticate the key module KEY, and use the decrypted temporary session key KT to encrypt the first random number and the second random number with AES and send them to the key module KEY; if the decrypted message obtained by the door lock module LOCK contains incorrect The first random number, then stop the communication;

(5) The key module KEY decrypts the received message to obtain the decrypted message, and verifies whether it is the same as the message fed back by the door lock module in the previous step. If it is the same, the authentication to the door lock module LOCK is completed, and the entire mutual authentication process ends;

(6) Next, the actual request is sent. In the next communication, the temporary key is used for encryption. The key module KEY encrypts and sends the required request command REQ (such as an unlock request plus an unlock key). The specific command format is a Byte request code plus corresponding parameters. The door lock module LOCK judges whether the request command can be executed according to the received request and corresponding parameters (such as whether the unlock key of the unlock request is correct), and executes the actual request according to the judgment result, and then responds and feeds back information. The specific response format is a Byte response result code plus relevant information, the whole communication process ends.

The beneficial effects brought by the technical solution of the present invention:

(1) The present invention can realize the interactive communication between the door lock and the intelligent terminal. The present invention adopts the setting that the door lock works in the card simulation mode, and the intelligent terminal works in the card reader mode, which overcomes the disadvantage that interactive communication cannot be carried out in the realization of the NFC function P2P mode of the smart phone at the present stage.

(2) The present invention can realize the mutual authentication of the door lock and the intelligent terminal key. The present invention realizes the mutual authentication function based on the system key KS shared by both communication parties. In the fourth step of communication, if the information received by LOCK verification is the same as that generated by itself, it proves that the communication peer knows the system key KS, so the legality authentication of LOCK to KEY is realized. Similarly, in the fifth step, if KEY Verify that the received information is the same as the one generated by itself, which proves that the communication peer knows the system key KS, so the legality authentication of KEY to LOCK is realized, and since the random numbers sent by both parties contain the random number of the other party, it is guaranteed The freshness of the communication prevents replay attacks in the authentication process, so the present invention can realize mutual authentication.

(3) The present invention can prevent the occurrence of replay attacks. The communication process of the present invention is encrypted using the AES encryption algorithm, and the temporary key KT used in each communication is different, so the occurrence of replay attacks can be prevented.

(4) The present invention has good function expandability, the request command uses one byte code, there can be 256 different requests, and each request can carry corresponding parameters. It is convenient to add extended functions other than unlocking, such as a time-limited temporary unlocking key command, corresponding time synchronization command, unlocking log reading command and other extended functions.

(5) The present invention communicates in time, and authentication speed is fast, and the present invention has adopted the symmetric encryption algorithm authentication mode in consideration of the limitation of the computing speed of hardware resource, has not used public key password authentication mode, has accelerated authentication process and communication process greatly The time-consuming encryption operation in the system fully meets the actual needs of door lock control through actual testing.

The encryption algorithm used in the present invention is replaceable, and any symmetric block encryption algorithm can be used for replacement. The entire authentication process has no correlation with the encryption algorithm used, and any symmetric block encryption algorithm can be used.

The above are only preferred embodiments of the embodiments of the present invention, and are not intended to limit the embodiments of the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the embodiments of the present invention shall include Within the protection scope of the embodiments of the present invention.

Claims (6)

1. The security communication scheme for door lock control based on the smart phone NFC function, which is characterized in that it includes two communication subjects, namely the door lock module and the smart phone terminal key module, and the two communication subjects communicate on the basis of the ISO/IEC14443 protocol , where the communication process is divided into two parts: First, the door lock module and the key module perform mutual authentication based on the ISO9798-2 three-round authentication protocol to confirm that the other party is a legal subject, then the key module sends the request content, the door lock module responds to the request content and feeds back information, and finally ends communication. 2. The door lock control security communication scheme based on smart phone NFC function according to claim 1, characterized in that: the specific steps of the communication process include: First, the key module sends a start authentication request command to the door lock module to start the entire authentication process; After the door lock module receives the start authentication request instruction, then the door lock module generates a first random number, uses the system key KS shared with the key module to encrypt the generated first random number and sends it to the key module; Then the key module decrypts the feedback message to obtain a decryption result 1, and generates a second random number and temporary session key KT, and uses the shared system key KS to generate the second random number, temporary session key KT and decryption The result is encrypted and transmitted to the door lock module; Then the door lock module decrypts the feedback message to get a decryption result 2, verify whether the decryption result 2 contains the correct first random number, if it contains the correct first random number Then the authentication of the key module KEY is completed, and the first random number and the second random number are encrypted and sent to the key module KEY using the temporary key KT; if the decryption result 2 contains the wrong first random number, the communication is stopped; Then the key module decrypts the feedback message to get a decryption result 3, verify whether it is the same as the message fed back by the door lock module in the previous step, if it is the same, complete the authentication of the door lock module, and the entire mutual authentication process ends; Next, the actual request is sent. In the next communication, the temporary key is used for encryption. The key module encrypts and sends the required request command. The door lock module judges whether the request command can be executed according to the received request and corresponding parameters, and Execute the actual request according to the judgment result, then respond and feed back the information, and the whole communication process ends. 3. The door lock control security communication scheme based on smart phone NFC function according to claim 2, characterized in that: the door lock module adopts an NFC chip that supports the card simulation function, and works in the card simulation mode, simulating a Smart card using ISO/IEC14443 communication protocol; The key module works in card reader mode. 4. The secure communication scheme for door lock control based on the smart phone's NFC function according to claim 2, characterized in that: the communication process is encrypted and protected using the AES encryption algorithm. 5. The door lock control security communication scheme based on smart phone NFC function according to claim 2, characterized in that: the communication process uses other symmetric block encryption algorithms other than AES algorithm. 6. The door lock control security communication scheme based on smart phone NFC function according to claim 2, characterized in that: the request command format required for encrypted transmission of the key module is a one-byte request code plus corresponding parameters.