KR20110097574A - Copy protection and data tamper prevention methods for contactless smart cards - Google Patents

Abstract

The present invention relates to a method for preventing duplication and data tampering of a smart card, and more particularly, to a method for preventing duplication and data tampering of a smart card by encrypting data embedded in a smart card through a reader.
To this end, the present invention comprises the steps of installing a second encryption algorithm in the RF card reader or charger; And when using the RF card in a reader or a charger, storing the encrypted data on the RF card using a second encryption algorithm installed in the RF card reader or the charger.
Accordingly, according to the present invention, it is possible to improve security by encrypting a smart card with a new encryption algorithm, and it is possible to prevent copying of My Pair card and preventing data forgery without a separate device or card collection.

Description

The method for preventing from clone and fraud of the contactless integrated IC card}

The present invention relates to a method for preventing duplication and data tampering of a smart card, and more particularly, to a method for preventing duplication and data tampering of a smart card by encrypting data embedded in a smart card through a reader.

The basic mechanism for reading information stored in a contactless card (hereinafter abbreviated as "card") is as follows. The contactless card receives an information transmission request by receiving a weak electromagnetic wave from a contactless card reader (hereinafter referred to as "reader") through an antenna embedded in the contactless card, and transmits the stored information to the reader. In this way, the reader can read information stored in the card without contacting the card.

Such a contactless card has a problem that it is difficult to maintain security since information can be copied using a mobile reader from the outside even without direct contact. Accordingly, methods have been developed to encrypt the storage or to prevent arbitrary reading by a third party. Korean Utility Model Publication No. 20-2009-0001892 discloses a wallet formed with an electromagnetic shielding film that blocks hacking radio waves. In addition, WO 2005/69195 discloses a method of determining the contact angle of a card and a reader to block external hacking.

On the other hand, the card by data encryption is widely used in the field of access control and transportation card, my pair card dominates the market and is used for almost all prepaid and postpaid transportation card in the world. When MyFairCard was developed, the contents of cryptographic algorithms inside MyFairCard were not disclosed and the detailed encryption methodology was not known until recently. However, crypto algorithms and protocols that seem to be inaccessible due to technological advances have been studied and attacked by many engineers now, and the cryptographic algorithms and methods of copying are the basis of security. Analyzed and published. Now, engineering students can study their analysis and reports to make it easy to copy or alter data from My Fair cards such as traffic cards and access cards. Therefore, the encryption algorithms that are now installed in My Pair Card cannot secure the security.

As a result, the processor is being replaced with an internal processor based on the new international standard ISO 7816. However, since tens of millions of Mifare cards are already in use, it is urgently required to prepare countermeasures. This is not going smoothly.

In particular, in the transportation card field, since it is widely used for public transportation and other payment transactions in the form of prepaid card and postpaid card, it is particularly confusing in the field used as electronic money, and card duplication and data modulation methods are widely known to the general public. By strengthening the security of tens of millions of traffic cards in Korea, which have already been used before, it can prevent confusion such as card duplication and data forgery.

Accordingly, there is a continuing demand for a new method that can easily improve the security of a contactless smart card such as My Pair card.

The problem to be solved in the present invention is to provide a new method for improving the security of the contactless smart card.

Another object of the present invention is to provide a system for secondly encrypting and operating an encrypted smart card.

Another problem to be solved in the present invention is to provide a new security enhancement method that can prevent card data copying by hacking and illegal use using the same.

In order to solve the above problems, the card hacking prevention method of the present invention

Installing a second encryption algorithm in an RF type card reader or charger incorporating a primary encryption algorithm that decrypts the RF card;

Obtaining card data from an RF-type card and decrypting it with a first order encryption algorithm;

Obtaining plain text data from the decrypted data, optionally using a secondary encryption algorithm;

Processing plain text data;

Encrypting the processed data using a secondary encryption algorithm;

And encrypting the encrypted data using a primary encryption algorithm and storing the encrypted data in a card.

In the present invention, the second encryption algorithm is an encryption algorithm decrypted with a symmetric key different from the first encryption algorithm formed on the card, and the encryption control module is modified by modifying the firmware of a conventional reader or charger in which the first encryption algorithm is installed. Can be installed in addition.

In the practice of the present invention, the encryption control module, in the case of the RF card reader, can be installed via a wireless LAN in the bus garage or by using a USB memory card in which the encryption S / W module is stored.

In the present invention, the card is a traffic card for the RF reader, a smart card encrypted by the primary card encryption module, preferably a mi pair card using data encrypted by the Cryoto-1 encryption module.

In the present invention, the secondary encryption module is a module capable of re-encrypting or decrypting the primary encrypted data, and is an encryption module using a symmetric key block algorithm such as 3DES, SEED, AES, etc. which are commonly used.

In one embodiment of the present invention, the mi pair card includes an encryption block, a control and arithmetic block, an EEPROM block which is a volatile memory unit, an authentication unit and an collision avoidance block, and an RF interface block.

In one embodiment of the present invention, the RF bus terminal includes a reader circuit unit and firmware, the reader circuit unit is a symmetric key that can decrypt the interface logic block, MPU, memory, RF control, RF reader control, and card encryption module Blocks are included. The firmware is installed with a terminal operating program, and operates an authentication unit of the RF card, a data encryption control module and an encryption key management module, and includes a card interface management unit and a card memory management unit.

Hacking prevention method according to the invention comprises the steps of identifying a tamper card; And blacklisting the modulation card. In the practice of the present invention, the step of confirming the modulation card may be used to increase the transaction number of the card for each transaction and encrypt it with data, and then store and confirm the card number and data in the card and the terminal together. . As a result, in the state where the secondary encryption module is not solved, the data before the use of the card is read and stored, and after use, the data is overwritten and returned to the state before use to prevent illegal use.

According to an aspect of the present invention, a traffic card RF reader is provided with a primary encryption module capable of encrypting or decrypting data of an encrypted RF card and a secondary encryption module capable of encrypting or decrypting encrypted data of a My Pair card. To provide.

According to the present invention, it is possible to improve the security by encrypting the smart card exposed the encryption method with a new encryption algorithm. In addition, by allowing the consumer to encrypt the data when the passenger boards the bus, it is possible to prevent copying of the Mifare card and data forgery without a separate device or card.

In addition, even if a hacker duplicates the card, even if the hack is a cryptic Cryoto-1 encryption module, the second encrypted data is obtained. Therefore, the contents of the card cannot be analyzed, preventing unauthorized use and data tampering. Secondary encryption modules can be updated regularly to enhance security.

In addition, by updating the number of times of use, unauthorized use by overwriting the duplicated card can be prevented.

1 is a block diagram showing authentication communication between a dedicated circuit and firmware of an RF card and a reader, and an RF card according to an exemplary embodiment of the present invention.
2 is a flowchart illustrating a method of decrypting and processing a data card according to an embodiment of the present invention.
3 is a flowchart illustrating encryption and card storage of data according to an embodiment of the present invention.

As shown in FIG. 1, the mi pair card 100 includes a memory block 101 composed of 16 sectors, an encryption block 102 driven by a Cryoto-1 encryption method, a control and operation block 103, and a volatile memory unit. An EEPROM block 104, and includes an authentication unit 105, an collision avoidance block 106, and an RF interface block 107.

The bus terminal 200 communicating with the My Pair card 100 is provided with a reader circuit unit 300 and a firmware 400.

The reader circuit unit 300 includes an interface logic block 301, an MPU 302, a memory 303, an RF control 304, an RF reader control 305, and a symmetric key block 306 of the Cryoto-1 encryption module. Included.

In the firmware 400, a terminal operating program 410 is installed, and the terminal operating program 410 includes a card map 411, a card balance management 412, a station information management 413, and a message management 414 area. It includes, and operates the authentication unit 420, the data encryption control module 430 and the encryption key management module 440 of the RF card, and includes a card interface management unit 450 and the card memory management unit 460.

As shown in FIG. 1 and FIG. 2, when the My Pair card 100 approaches the bus terminal 200 to ride a bus, a card authentication procedure is performed. When the card authentication process requests a response from the reader 200, the collision avoiding block 106 operates in the mypair card 100, and responds to the request, and when the terminal 200 requests the authentication / block value, the mypair card ( An authentication response is made in the authentication unit 105 at 100, and the terminal 200 transmits the terminal authentication value to the mi pair card 100, and transmits the card key value to the terminal for authentication.

As shown in FIG. 2, after the authentication procedure, when the data cipher text encrypted with the unique number and the Cryoto-1 is input from the My Pair card 100 (S301), the unique key is transmitted to the encryption key management module 440. In step S302, the ciphertext is received by receiving the corresponding symmetric key capable of decrypting the data ciphertext encrypted with Cryoto-1.

By using the decrypted data, the Mifare card 100 checks whether the new card is encrypted by the secondary encryption module installed in the firmware 300 or the card is not encrypted by the secondary encryption module or the old card (S303). .

In the case of the new card, the data decrypted by the symmetric key of the Cryoto-1 encryption module is second-decrypted by the built-in secondary encryption module (S304). When the decryption operation is performed, it compares the job number of the card with the job number of the card stored in the DB to determine whether it is a forgery. After the plain text data is output (S306). If it is not a normal card is stored in the black list (S305).

In the case of the old card, the plain text data is output after the DB is updated (S305) by immediately increasing the job number for the card without passing through the second decryption (S304).

The plain text data is used to update information on the balance of the card, the boarding station, etc., and then move to the encryption step.

As shown in FIG. 4, when the computerized plain text data is input together with the unique number (S401), after receiving the secondary encryption key by transmitting the unique number to the encryption key management module installed in the firmware (S402), 2. The encryption operation is performed using the car encryption key (S403), and data is transmitted to the My Pair card (S404).

 The My Pair card 100 receives the encrypted data and encrypts the data again using the Cryoto-1 encryption module to store the data.

Claims (6)

Installing a second encryption algorithm in an RF type card reader or charger incorporating a primary encryption algorithm that decrypts the RF card;
Decrypting data of the RF-type card with a primary encryption algorithm;
Obtaining plain text data from the decrypted data, optionally using a secondary encryption algorithm;
Processing the plain text data;
Encrypting the processed plain text data using a second encryption algorithm;
And encrypting the encrypted data using a primary encryption algorithm and storing the encrypted data in a card. The hacking prevention method according to claim 1, wherein the second encryption module is installed in a bus garage through a wireless LAN or using a USB memory card in which the second encryption module is stored. The method of claim 1, wherein the encryption module is updated periodically. The hacking prevention method according to claim 1, further comprising: determining whether the card is forged by comparing the number of times of use of the card with the number of times of use of the card. The hacking prevention method according to claim 1, wherein when the data decoded by the first algorithm is plain text data, the method proceeds to processing the plain text data without undergoing decoding using the second algorithm. Primary encrypted RF traffic card; And
A traffic card RF reader equipped with a primary encryption module for encrypting or decrypting the data of the primary encrypted RF traffic card and a second encryption module for re-encrypting or decrypting the encrypted data of the RF traffic card.
Transportation card system comprising a.

Images