WO2018045916A1 - Authorization method, system, and card - Google Patents

Abstract

An authorization method, system, and a card. The authorization method comprises: a card receives an authentication instruction sent by a first card reader, the authentication instruction carrying identification information and first authentication information (S101); the card obtains, according to the identification information, a first authentication key in a first state corresponding to the first card reader (S102); the card authenticates the first authentication information with the first authentication key, and sends second authentication information to the first card reader if the authentication succeeds (S103); the first card reader receives the second authentication information, determines whether to authorize the card or not at least according to the second authentication information, and sends response information to the card (S104); the card obtains, with the first authentication key in the first state, a second authentication key in the first state corresponding to a second card reader, and stores the second authentication key in the first state, a precondition for the second card reader to authorize the card being that the card has been successfully authorized by the first card reader (S105).

Description

Authorization method, system and card

Cross-reference to related applications

This application claims the priority of the Chinese patent application filed by the China Patent Office on September 9, 2016, with the application number 201610815363.X, and the invention name is "an authorization method, system and card".

Technical field

The present invention relates to the field of electronic technologies, and in particular, to an authorization method, system, and card.

Background technique

In the authorization system, in order to achieve different levels of authorization, it is often necessary to set a plurality of card readers, each of which can implement a specific level of authorization. However, in the existing authorization system, each reader is independent of each other and has no association with other readers. Therefore, the criminals only need to break through a card reader to obtain the authorization that the card reader can implement. However, the time required for a criminal to break through each card reader is similar, that is, a card reader that is not capable of a higher level of authorization in the prior art does not achieve a higher security guarantee.

Summary of the invention

The present invention is directed to solving the above problems/one of them.

The main object of the present invention is to provide an authorization method;

Another object of the present invention is to provide a card;

It is still another object of the present invention to provide an authorization system.

In order to achieve the above object, the technical solution of the present invention is specifically implemented as follows:

An aspect of the present invention provides an authorization method, including: a card receiving an authentication instruction sent by a first card reader, wherein the authentication instruction carries identification information and first authentication information; and the card is based on the identification information. Acquiring a first authentication key in a first state corresponding to the first card reader, wherein the first state is an available state; the card using the first authentication key to the first authentication The information is authenticated, and when the authentication is passed, the second authentication information is sent to the first card reader; the first card reader receives the second authentication information, and at least determines whether the message is based on the second authentication information. Authorizing the card and transmitting response information to the card; wherein, after the card authenticates the first authentication information by using the first authentication key, the method further includes: the card Obtaining, by using the first authentication key in the first state, a second authentication key in a first state corresponding to the second card reader, and storing the second authentication key in the first state, where Description Prerequisite two card readers given authorization for the card have succeeded in obtaining Authorization of the first card reader.

Another aspect of the present invention provides a card, including: a first receiving module, configured to receive an authentication command sent by a first card reader, where the authentication command carries identification information and first authentication information; An acquiring module, configured to acquire, according to the identifier information, a first authentication key in a first state corresponding to the first card reader, where the first state is an available state; and the first authentication module is configured to: The first authentication information is authenticated by using the first authentication key, and the first sending module is triggered when the authentication is passed; the first sending module is configured to send the first sending card to the first card reader. The first receiving module is further configured to receive the authentication response information returned by the first card reader, and the second acquiring module is configured to perform, by the first authentication module, the first authentication information. When the authentication and the authentication pass or the authentication response information indicates that the card is authorized, the first authentication key in the first state is used to acquire the second authentication in the first state corresponding to the second card reader. Key, and sending the second authentication key in the first state to the first storage module, wherein the second card reader gives the card authorization: the card has successfully obtained the first read The first storage module is configured to store the second authentication key in the first state.

Another aspect of the present invention provides an authorization system, comprising: a card reader according to any one of claims 10 to 15, wherein the first card reader comprises: a second receiving module, Receiving the second authentication information sent by the card; the authorization module, configured to determine, according to the second authentication information, whether the card is authorized; and the second sending module, configured to send, to the card, whether the indication is Response information for card authorization.

It can be seen from the technical solution provided by the present invention that the present invention provides an authorization method, each card reader corresponding to an authentication key, and the card only uses the first authentication in the available state corresponding to the first card reader. The key can authenticate the first authentication information of the first card reader, and send the authentication information to the first card reader, in order to obtain the authorization of the first card reader, and use the first authentication key pair in the card. After the authentication information is passed, the second authentication key in the first state of the second card reader is obtained according to the first authentication key in the first state, thereby implementing hierarchical management of the authentication key. Therefore, for a card reader with a higher security level, corresponding control authority can be set, for example, if one card has been authorized by one or more other card readers, according to the other one or more card readers. The authentication key in one state acquires the authentication key in the first state of the card reader, and thus it is possible to obtain the authorization of the card reader.

DRAWINGS

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly described below. It is obvious that the drawings in the following description are only some embodiments of the present invention, Those of ordinary skill in the art will be able to obtain other figures from these drawings without the inventive effort.

1 is a flowchart of an authorization method according to Embodiment 1 of the present invention;

2 is a schematic structural diagram of an authorization system according to Embodiment 2 of the present invention;

3 is another schematic structural diagram of an authorization system according to Embodiment 2 of the present invention;

4 is a schematic structural diagram of a card according to Embodiment 3 of the present invention;

FIG. 5 is a schematic diagram of another structure of a card according to Embodiment 3 of the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

The embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

Example 1

This embodiment provides an authorization method. As shown in FIG. 1, the method includes the following steps (S101-S105).

S101: The card receives the authentication command sent by the first card reader, where the authentication command carries the identification information and the first authentication information;

S102: The card acquires a first authentication key in a first state corresponding to the first card reader according to the identifier information, where the first state is an available state;

S103: The card authenticates the first authentication information by using the first authentication key, and sends the second authentication information to the first card reader if the authentication passes;

S104: The first card reader receives the second authentication information, determines, according to the second authentication information, whether it is a card authorization, and sends the authentication response information to the card.

S105. The card acquires the second authentication key in the first state corresponding to the second card reader by using the first authentication key in the first state, and stores the second authentication key in the first state, and the second card is read. The precondition for the card to be authorized is that the card has successfully obtained the authorization of the first card reader. It should be noted that although step S105 is illustrated in FIG. 1 after step S104, step 105 is not only performed after step S104, and step S105 may be performed in step S103, the card uses the first authentication key pair. After the authentication information is sent after the authentication is passed, the card may receive the response information sent by the first card reader in step S104, and if it is determined that the response information indicates that the first card reader is authorized by the card, step S105 is performed.

With the authorization method provided in this embodiment, each card reader corresponds to an authentication key, and the card can only use the first authentication key in the available state corresponding to the first card reader to be the first card reader. An authentication information is authenticated, and the authentication information is sent to the first card reader, so as to obtain the authorization of the first card reader, and after the card authenticates the first authentication information by using the first authentication key, according to the first state The first first authentication key acquires the second authentication key in the first state of the second card reader, thereby implementing hierarchical management of the authentication key. Therefore, for a card reader with a higher security level, To set the corresponding control authority, for example, if a card needs to be authorized by one or more other card readers, the card reader can be obtained according to the authentication key in the first state of the other card reader or cards. The authentication key in the first state, in order to obtain the authorization of the card reader.

In this embodiment, the card may be a magnetic stripe card, an integrated circuit card (IC card), a smart card, or the like, which is not limited in this embodiment, as long as it can be read by the card reader. Cards are all within the scope of this embodiment. The first card reader is a card reader currently interacting with the card, and the type of the first card reader corresponds to the type of the card, for example, when the card is a magnetic stripe card, the first card reader may be a magnetic card reader. When the card is an IC card, the first card reader can be an IC card reader; the first card reader can also be other types of card readers, which is not specifically limited in this embodiment.

Further, in the present embodiment, the card may be of a contact type or a non-contact type. If the card is non-contact type, the contact between the card and the first card reader is non-contact communication, and the communication standard can adopt standard protocols such as ISO14443A, ISO14443B, and ISO15693. When the card is within the working distance of the first card reader, the card can communicate with the first card reader, enabling communication without the need for a card. When the card is in contact type, contact communication is performed between the card and the first card reader, and the card can communicate with the first card reader only when the card contact is properly connected to the interface of the first card reader. In this embodiment, when the card is non-contact type, the first card reader can periodically broadcast a card search instruction, and if the card is located in the card reading range of the first card reader, the card can respond to the first card reader. The card-finding instruction sends a card-seeking response to the first card reader, and after receiving the card-seeking response, the first card reader can determine the currently read card, and then send an authentication command to the card.

In this embodiment, the identifier information carried in the authentication command sent by the first card reader may be a unique identifier corresponding to the first card reader. For example, the identifier information may be the serial number of the first card reader, or It is identification information of a first authentication key (ie, an authentication key used to authenticate the first authentication information) corresponding to the first card reader. In this embodiment, the card determines the first authentication key in the available state corresponding to the first card reader by using the identification information, thereby determining whether the first authentication information sent by the first card reader can be authenticated.

In this embodiment, the first authentication key in a plurality of different states may be stored in the card, and the first authentication keys in different states may be separately stored in different storage areas of the card to facilitate the calling of the card. For example, the first authentication key in the first state is stored in the first storage area, and the first authentication key in the other state is stored in the second storage area. The card may pre-store the mapping relationship between the identification information of all the card readers and the authentication key. After receiving the identification information of the first card reader, the card may be obtained from the first storage area according to the identification information of the first card reader. The first authentication key in the first state. The first authentication key in the first state refers to the first authentication key that can be directly used. Specifically, the first state may be a plain text state. Only the first authentication key in the first state can be directly used. The authentication key in other states cannot be directly used. Only the first authentication key in other states can be converted into the first authentication key in the first state. use.

In this embodiment, the card can authenticate the identity of the first card reader by using the first authentication information. In specific applications The first authentication information may be a first check value generated by the first card reader by using the own authentication key to calculate the first calculation factor, where the first calculation factor may be a random number generated by the first card reader. The number of times that the first card reader is authorized, and the total number of times the card is requested for authorization, which is not limited in this embodiment. The first card reader uses the authentication key to calculate the first calculation factor according to a preset verification algorithm to obtain a check value, and the check value is carried in the first authentication information and sent to the card. The preset verification algorithm may be a MAC algorithm, or may be another verification algorithm, for example, a signature algorithm, which is not limited in this embodiment. When the card authenticates the first authentication information, the first authentication key in the first state of the obtained first card reader is used, and the card adopts the same verification algorithm as the first card reader, and the first calculation is performed on the card. The factor is calculated to obtain a check value, and the calculated check value is compared with the check value in the received first authentication information. If the same, the first authentication information is authenticated. If not, the first authentication information is obtained. The certification did not pass. If the first authentication information is authenticated, it indicates that the first authentication information has not been tampered with and the identity of the first card reader is legal. If the authentication fails, the first authentication information is tampered with and/or the identity of the first card reader. illegal. The first calculation factor may be that the first card reader is carried in the authentication command and sent to the card, or the card is obtained by using the same rule as the first card reader, which is not limited in this embodiment.

In this embodiment, the card generates the second authentication information when the card passes the authentication of the first authentication information. Sending the second authentication information to the first card reader, where the second authentication information may be a verification value generated by the card using the authentication key to calculate the second calculation factor according to a preset verification algorithm, or the second authentication. The information may also be a third verification value generated by the card using the authentication key to calculate the first calculation factor and the second calculation factor according to a preset verification algorithm, wherein the second calculation factor may be the card according to the first reading. The algorithm generated by the card (or background) agreed by the algorithm may also be a count of the number of times the card is authorized, or may be a random factor generated by the card (in this case, the card may use the second calculation factor and the second authentication information) Send it to the first card reader together).

As an optional implementation manner of the embodiment of the present invention, after receiving the second authentication information, the first card reader may determine whether it is a card authorization according to at least the second authentication information, or may perform a judgment jointly with the background. For example, the first card reader can authenticate at least the second authentication information by itself, obtain the authentication result, and then determine whether it is the card authorization according to at least the authentication result; or the first card reader can also send the second authentication information to the background. The background authentication is performed on at least the second authentication information, and the authentication result is returned to the first card reader, and then the first card reader determines whether the card is authorized according to at least the authentication result.

In the above optional implementation manner, when the first card reader or the background authenticates the second authentication information, using the authentication key of the card, using the same verification algorithm as the card, the second calculation factor, or the first calculation factor Computation with the second calculation factor to generate a check value, and comparing whether the calculated check value and the received check value in the second authentication information are the same. If they are the same, the second authentication information is authenticated. If not, then The second authentication information authentication fails. If the second authentication information is authenticated, it indicates that the second authentication information has not been tampered with and the identity of the card is legal. If the authentication fails, the second authentication information is falsified and/or the identity of the card is invalid. The first card reader only judges whether it is based on the authentication result. In the case of card authorization, if the second authentication information is authenticated, the response information indicating successful authorization is sent to the card, and if the second authentication information is not authenticated, the response information indicating that the authorization is not authorized is sent to the card.

In this embodiment, the first card reader can determine whether it is a card authorization according to the second authentication information, and can determine whether the card is authorized according to other information. Therefore, as an optional implementation manner of the embodiment of the present invention, If the authentication result of the second authentication information indicates that the authentication is passed, further determining whether the card is authorized according to the authorization authority list of the first card reader. Whether the card is an authorized user of the first card reader is determined whether the card is authorized by the card according to whether the card is in the authorization permission list of the first card reader. In a specific application, the authorization list of the first card reader may be stored in the background, or may be stored locally in the first card reader, and if it is stored locally in the first card reader, it is judged by the first card reader. If it is stored in the background, it is judged by the background, and finally, it is combined with the authentication result of authenticating the second authentication information to determine whether it is a card authorization. For example, if the second authentication information is authenticated by the background and the authorized permission list is stored in the background, after the background authenticates the second authentication information, it is further determined whether the card is in the authorization permission list of the first card reader, and if And authenticating the authentication result to the first card reader, the first card reader determines to authorize the card according to the authentication result; and if the first card reader authenticates the second authentication information, the authorization permission list is After being stored in the first card reader, the background authentication of the second authentication information is passed, and the first card reader is returned with an authentication result indicating whether the second authentication information is authenticated, if the authentication result indicates that the second authentication information is authenticated. Then, the first card reader further determines whether the card is in the authorization permission list of the first card reader, and if so, determines to authorize the card, otherwise determines that the card is not authorized. In addition, if the second authentication information is authenticated by the first card reader and the authorization authority list is stored in the first card reader, after the first card reader authenticates the second authentication information, it is further determined whether the card is in the first In the list of authorized rights of a card reader, if yes, it is determined that the card is authorized; and when the first card reader authenticates the second authentication information and the authorized permission list is stored in the background, the first card is read. After the second authentication information is authenticated, the device can send the related information of the card to the background, and the background determines whether the card is in the authorization permission list of the first card reader, and returns the determination result to the first card reader, first The card reader determines whether to authorize the card based on the returned judgment result.

As an optional implementation manner of the embodiment of the present invention, in order to improve the security of the authorization method, the premise that the card satisfies the authorization of the card by the first card reader may be authenticated in the background. In a specific implementation process, the background may use the first security status to record information about the authorization obtained by the card.

In the specific implementation process, the pre-condition for granting the card authorization by the first card reader may include only a group of third card readers that have authorized the same card, and the background only needs to judge whether the card has been successfully obtained according to the first security state. The authorization of all the third card readers in the precondition of the card authorization given by the card reader. If the card has successfully obtained the authorization of all the third card readers in the precondition, the card satisfies the precondition of the authorization given by the first card reader. Otherwise, the card does not satisfy the preconditions for the authorization given by the first card reader.

In a specific application, in order to increase security, the first card reader can also define a group of preconditions for granting authorization. The order in which the third card authorizes the same card and/or the effective time each third card reader authorizes the same card. Correspondingly, the first security state further includes: the order in which the card is successfully authorized, and/or the time when the card successfully obtains the authorization, that is, the background also needs to record the order and/or time of successfully obtaining the authorization of each card reader. When the background determines whether the card satisfies the control authority according to the first security state, the method further includes: determining, according to the first security state, whether the order in which the card is successfully authorized is consistent with the authorization order in the precondition; and/or determining according to the first security state Whether the time the card was successfully authorized is within the valid time of the precondition. If the order in which the card is successfully authorized is consistent with the authorization order in the precondition, and/or the time when the card is successfully authorized is within the valid time in the precondition, the card satisfies the precondition of the authorization given by the first card reader; otherwise, The card does not satisfy the preconditions for the authorization given by the first card reader.

In this embodiment, after the card authenticates the first authentication information, the card can directly acquire the second authentication key in the first state corresponding to the second card reader by using the first authentication key in the first state. Alternatively, in the case that the authentication response information received by the card is the authorization of the card, the card acquires the second authentication key in the first state corresponding to the second card reader by using the first authentication key in the first state. After the card acquires the second authentication key in the first state, the second authentication key in the first state may be stored in the storage area of the card. When the card needs to obtain the authorization of the second card reader, the second The second authentication key in one state authenticates the authentication information sent by the second card reader, thereby obtaining the authorization of the second card reader.

As an optional implementation manner of the embodiment of the present invention, the card acquires the second authentication key in the first state corresponding to the second card reader by using the first authentication key in the first state, including: using the first state of the card The first first authentication key calculates a second authentication key in the second state corresponding to the second card reader that is stored locally, and obtains the second authentication key in the first state.

As an optional implementation manner of the embodiment of the present invention, the second authentication key in the second state includes: an encrypted second authentication key; the card is stored locally by using the first authentication key in the first state. The second authentication key in the second state corresponding to the second card reader is calculated, and the second authentication key in the first state is obtained, including: the card is stored locally by using the first authentication key in the first state. The encrypted second authentication key corresponding to the second card reader is decrypted to obtain a decrypted second authentication key. That is, in the alternative embodiment, the first state refers to a decrypted state, that is, a plaintext state, and the second state refers to an encrypted state. The card can decrypt the encrypted second authentication key by using the first authentication key in the first state as a decryption key, and obtain the decrypted second authentication key, that is, the second authentication key of the plaintext. Before the card authenticates the first authentication information, the second authentication key is stored in the form of cipher text, which ensures the storage security of the second authentication key.

For example, in the optional implementation, the second authentication key in the second state may be obtained by encrypting the second authentication key in the first state by using the first authentication key in the first state, and the card is utilized. When the first authentication key in the first state acquires the second authentication key in the first state, the second authentication key in the second state is decrypted using the first authentication key in the first state, that is, The second authentication key in the first state. That is, in the optional implementation manner, in the initial state, the authentication key stored in the card may be processed according to the preconditions for granting authorization by each card reader. The second authentication key of the second card reader that the first card reader has authorized the card to authorize the card, when storing, may use the first authentication key of the first card reader for the second reading The second authentication key of the card device is encrypted and stored, and a decryption mechanism is set in the card: after the card passes the authentication of the first authentication information sent by the first card reader, or after receiving the indication that the first card reader has been After responding to the authorization of the card, decrypting the encrypted second authentication key of the second card reader to obtain the plaintext of the second authentication key of the second card reader, so that the subsequent card is authorized to request the second card reader At the same time, the authentication information sent by the second card reader can be successfully authenticated using the second authentication key.

Taking a system with three card readers as an example, assume that the three card readers are numbered as the first card reader, the second card reader, and the third card reader. The precondition for granting authorization by the first card reader may be that the same card does not need to obtain authorization of any card reader, and the corresponding authentication key is K1, and the precondition for granting authorization by the second card reader may be that the same card has been successfully obtained. The authorization of the No. 1 card reader, the corresponding authentication key is K2, and the precondition for the authorization of the No. 3 card reader can be that the same card has successfully obtained the authorization of the No. 1 card reader and the No. 2 card reader, and obtained The order of authorization is: first obtain the authorization of the first card reader, then obtain the authorization of the second card reader, and the authentication key corresponding to the third card reader is K3. In the initial state, the authentication key stored in the card is: K1 of plaintext, ciphertext K2' of K2 obtained by encrypting K2 with K1, and ciphertext K3' of K3 obtained by encrypting K3 with K2. . In use, if the card first requests the authorization of the second card reader, the second card reader sends the authentication information calculated by K2 to the card, and after receiving the authentication information, the card cannot store the plaintext of K2 locally. The authentication information is authenticated, so that the corresponding authentication information cannot be returned to the second card reader, and the authorization of the second card reader cannot be obtained. If the card first requests authorization of the first card reader, the first card reader sends the authentication information calculated by K1 to the card, and after receiving the authentication information, the card obtains the plaintext of the local storage K1, and authenticates the authentication information. After the certification is passed, the corresponding authentication information is returned to the first card reader, and the first card reader authenticates the authentication information. After the authentication is passed, the card is authorized to be authorized, and the corresponding response information is returned, and the card is received. After responding to the information, it is determined that the card reader has authorized the card, decrypting K2' to obtain the plaintext of K2; after that, the card requests the authorization of the second card reader, and the second card reader sends the card to K2. After the authentication information is obtained, the card obtains the plaintext of the local storage K2 after receiving the authentication information, and authenticates the authentication information. After the authentication is passed, the corresponding authentication information is returned to the second card reader, and the second card is read. The device authenticates the authentication information, and after the authentication is passed, determines to authorize the card, and returns corresponding response information, and the card is received. After the response information, determining II card reader have to be authorized to K3 'decrypts the plaintext K3. After that, the card requests the authorization of the third card reader, and the third card reader sends the authentication information calculated by K3 to the card, and after receiving the authentication information, the card obtains the plaintext of the local storage K3, and performs the authentication information. After the certification is passed, the corresponding authentication information is returned to the third card reader, and the third card reader authenticates the authentication information, and after the authentication is passed, the card is authorized to be authorized. Thereby, linkage authorization between multiple card readers is realized.

In this embodiment, the second state may be an unavailable state, and the authentication key in the second state may not be directly used to authenticate the authentication information sent by the card reader. The second authentication key in the second state of the second card reader is pre-stored in the card Key, the card can only obtain the second authentication key in the first state by using the first authentication key in the first state to calculate the second authentication key in the second state, and then obtain the second card reader in the first state. Authorization. In a specific implementation process, the card may store all the authentication keys in the first state in the same storage area, and store all the authentication keys in the second state in another storage area, so as to facilitate the card call and the same state. The next authentication key is processed in batches. The card may store the second authentication key in the first state in a buffer area, where the buffer area refers to an accessor that can perform high-speed data exchange, for example, a Random Access Memory (RAM). Storing the second authentication key in the first state in the buffer area can improve the speed at which the card reads the first authentication key and the second authentication key in the first state. Before the card authenticates the first authentication information, the second authentication key is stored in the form of the second state that is unavailable, ensuring the storage security of the second authentication key; and the card only uses the first authentication in the first state. The key can calculate the second authentication key in the first state, that is, the card must obtain the authorization of the first card reader to obtain the authorization of the second card reader, thus implementing the first card reader and the second reading. The linkage of the card.

In the case where the card stores the first authentication key in the first state and the second authentication key in the first state in the buffer area, the card may empty the buffer area under predetermined conditions, and thus, as an embodiment of the present invention In an optional implementation manner, the method provided in this embodiment further includes: clearing the buffer area when a preset time arrives or a preset event occurs.

In this embodiment, the card can be timed from when it is activated, and all data in the buffer area is cleared every preset time. The card may also start timing when the second authentication key in the first state is stored in the buffer area, and the buffer area is cleared every predetermined time. In the specific implementation process, the preset time may have an initial value. If the length of the preset time is not set in the card, the card clears the buffer area according to the initial preset time. It is also possible to set the length of the preset time in the card so that the preset time is not equal to the initial value, and the card clears the buffer area according to the reset preset time. It is also possible to set a preset event for triggering to clear the buffer area in the card, and when the preset event occurs, the card performs the operation of clearing the buffer area. Specifically, the preset event may be that the first authentication information is not authenticated. When the card arrives at the preset time or the preset event occurs, the buffer area is cleared, which can save the storage space of the buffer area.

As an optional implementation manner of the embodiment of the present invention, after the card receives the authentication command sent by the first card reader, the method further includes: the card acquiring the attribute information of the current authentication, The attribute information is encrypted and stored; before the card receives the authentication command sent by the first card reader, the method may further include: the first card reader obtains the identification information of the card, and the first card reader sends an authentication instruction to the card; The first card reader sends a notification including at least the identification information of the card to the background; the background acquires and stores the attribute information of the current authentication of the card according to the notification, for example, the first card reader can send a card search instruction, and the card responds to the card search. The instruction sends a card seek response to the first card reader, and the first card reader receives the card search response, and obtains the identification information of the card from the card search response. After the card is encrypted and stored, the method may further include: acquiring encrypted attribute information stored in the card; decrypting the encrypted attribute information; and comparing the decrypted attribute information with the attribute information of the card stored in the background If it does not match, the identification card is an illegal card. After identifying that the card is an illegal card, the card may be instructed to delete each authentication key of the internal cache, that is, the card is restored. The initial setting indicates that the card is illegal in the background or each card reader, and the card cannot be authorized. Therefore, it can be avoided that the background cannot be known that the card is illegally read.

In this embodiment, the attribute information of the current authentication of the card may be attribute information of the first card reader for authenticating the card, for example, the time, location, and first card reader of the first card reader for authenticating the card. Information such as the cumulative number of times the authentication command is sent. Specifically, the recording mode of the location may be a serial number of the first card reader, and the serial number of the first card reader may be associated with the location of the first card reader, and may be determined according to the serial number of the first card reader. The location of the first card reader; in addition, a chip having a positioning function may be disposed inside the first card reader, and the location information of the card authentication by the first card reader may be acquired according to the positioning chip. The attribute information is encrypted and stored in the card, which prevents the attribute information inside the card from being acquired by other illegal devices, and ensures the security of the attribute information.

In this embodiment, after the background obtains the notification including at least the identification information of the card, the attribute information of the current authentication is associated with the identification information of the card and stored. After the card encrypts the attribute information and stores it, the encrypted attribute information stored in the card may be read by the background or read by the proprietary device capable of reading the attribute information inside the card, and the encrypted attribute information is decrypted and decrypted. The attribute information is compared with the attribute information of the card recorded in the background. If the comparison is inconsistent, the card has the risk of being illegally read by the illegal device, and the card is identified as an illegal card. With the optional implementation manner, the illegal device can be prevented from attacking the card, the illegal authentication command is initiated, and the data inside the card is obtained, thereby breaking the card.

Example 2

This embodiment provides a card, and FIG. 2 is a schematic structural diagram of the card 21 provided in this embodiment. In the present embodiment, the structure of the card 21 is briefly described. For other matters not mentioned, refer to the description in Embodiment 1.

As shown in FIG. 2, the card 21 provided in this embodiment includes: a first receiving module 2101, configured to receive an authentication command sent by the first card reader, where the authentication command carries the identification information and the first authentication information; The first obtaining module 2102 is configured to obtain, according to the identifier information, a first authentication key in a first state corresponding to the first card reader, where the first state is an available state, and the first authentication module 2103 is configured to use the first An authentication key is used to authenticate the first authentication information, and in the case that the authentication is passed, the first sending module 2104 is triggered; the first sending module 2104 is configured to send the second authentication information to the first card reader; the first receiving module 2101. The method is further configured to receive the authentication response information returned by the first card reader. The second obtaining module 2105 is configured to perform the authentication on the first authentication information by the first authentication module 2103, and the authentication pass or the authentication response information indicates the card. When the authorization is performed, the second authentication key in the first state corresponding to the second card reader is obtained by using the first authentication key in the first state, and the second authentication key in the first state is dense. The key is sent to the first storage module 2106, wherein the second card reader gives the card authorization condition that the card has successfully obtained the authorization of the first card reader; the first storage module 2106 is configured to store the first state. Two authentication keys.

With the card provided in this embodiment, each card reader corresponds to an authentication key, and the card is only used and the first card is read. The first authentication key in the available state corresponding to the device can authenticate the first authentication information of the first card reader, and send the authentication information to the first card reader, so as to obtain the authorization of the first card reader, and After the first authentication information is authenticated by the card using the first authentication key, the second authentication key in the first state of the second card reader is obtained according to the first authentication key in the first state, thereby implementing authentication. Hierarchical management of keys.

In this embodiment, the first receiving module 2101 and the first sending module 2104 may be separate modules, or may be integrated in the same communication module. The first receiving module 2101 and the first sending module 2104 may be a contactless communication module or a contact communication module. The first storage module 2106 can be a buffer area, for example, a Random Access Memory (RAM). Data in the buffer area enables high-speed data exchange.

In this embodiment, after the first authentication module 2103 authenticates the first authentication information, or after the first receiving module 2101 receives the response information, and the response information is the authorization of the card 21, the second acquisition The module 2105 acquires the second authentication key in the first state corresponding to the second card reader by using the first authentication key in the first state.

As an optional implementation of the embodiment of the present invention, as shown in FIG. 3, the card 21 further includes: a second storage module 2107, configured to store a second authentication key in a second state corresponding to the second card reader; The second obtaining module 2105 acquires the second authentication key in the first state corresponding to the second card reader by using the first authentication key in the first state and the second storage module 2107 The second authentication key in the second state corresponding to the card reader is calculated to obtain the second authentication key in the first state.

In this embodiment, the second storage module 2107 is configured to store an authentication key in the second state. The second storage module 2107 may be a non-Volatile Random Access Memory (NVRAM), and the stored data will not be lost even after the NVRAM is powered off.

As an optional implementation manner of the embodiment of the present invention, the second authentication key in the second state includes: an encrypted second authentication key; and the second obtaining module 2105 is configured to correspond to the second card reader in the following manner. The second authentication key in the second state is calculated to obtain the second authentication key in the first state: using the first authentication key in the first state to store the second card reader stored in the second storage module 2107 The corresponding encrypted second authentication key is decrypted to obtain a decrypted second authentication key. In the case where the first authentication key in the first state and the second authentication key in the first state are stored in the first storage area 2106, the card can empty the buffer area under predetermined conditions, and thus, as the present invention An optional embodiment of the embodiment, as shown in FIG. 3, the card 21 provided in this embodiment further includes: an emptying module 2108, configured to clear the first storage module 2106 when a preset time arrives or a preset event occurs. The stored data may include: the first authentication module 2103 fails to authenticate the first authentication information. When the clearing module 2108 arrives at a preset time or a preset event occurs, the first storage module 2106 is emptied, and the storage space of the first storage module 2106 can be saved.

As an optional implementation of the embodiment of the present invention, as shown in FIG. 3, the card 21 provided in this embodiment further includes: a third obtaining module 2109, an encryption module 2110, a third storage module 2111, and a response module 2112; The third obtaining module 2109 is configured to obtain the attribute information of the current authentication after receiving the authentication instruction sent by the first card reader, and The information is sent to the encryption module 2110. The encryption module 2110 is configured to receive the attribute information, and encrypt the attribute information to obtain the attribute information ciphertext, and send the attribute information ciphertext to the third storage module 2111. The third storage module 2111 receives The attribute information ciphertext is stored; the response module 2112 is configured to send the attribute information ciphertext stored by the third storage module 2111 in response to the read instruction. The attribute information is encrypted and stored in the third storage module 2111, and the attribute information can be obtained by other illegal devices to ensure the security of the attribute information.

Example 3

This embodiment provides an authorization system. As shown in FIG. 4, the authorization system includes a first card reader 22 and a card 21. The card 21 in this embodiment is the same as the card 21 in the second embodiment. For details, refer to the description of the second embodiment. In this embodiment, the structure of the authorization system is briefly described. For other unworked matters, refer to the description in Embodiment 1.

As shown in FIG. 4, the first card reader 22 includes: a second receiving module 221, configured to receive second authentication information sent by the card 21; and an authorization module 222, configured to determine, according to at least the second authentication information, whether the card is 21 or not Authorization; a second sending module 223, configured to send, to the card 21, response information indicating whether the card 21 is authorized.

With the authorization system provided in this embodiment, each card reader corresponds to an authentication key, and the card can only use the first authentication key in the available state corresponding to the first card reader to be the first card reader. An authentication information is authenticated, and the authentication information is sent to the first card reader, so as to obtain the authorization of the first card reader, and obtain the first state of the second card reader according to the first authentication key in the first state. The second authentication key, thereby implementing hierarchical management of the authentication key. Therefore, for a card reader with a higher security level, corresponding control authority can be set, for example, if one card has been authorized by one or more other card readers, according to the other one or more card readers. The authentication key in one state acquires the authentication key in the first state of the card reader, and thus it is possible to obtain the authorization of the card reader.

In the specific implementation process, after the second receiving module 221 receives the second authentication information, the authorization module 222 may determine, according to the second authentication information, whether it is a card authorization, or may perform a determination jointly with the background. Therefore, as an optional implementation manner of the embodiment of the present invention, as shown in FIG. 5, the authorization system provided in this embodiment further includes: a background 23; an authorization module 222, including: a sending unit 2221, configured to send a second to the background 23 The authentication unit 2222 is configured to receive an authentication result obtained by the background 23 at least authenticating the second authentication information. The authorization unit 2223 is configured to determine, according to the authentication result, whether the card 21 is authorized. The background 23 includes: a third receiving module. 231. The second authentication module 232 is configured to receive the second authentication information. The second authentication module 232 is configured to perform at least the second authentication information to obtain the authentication result. The third sending module 233 is configured to return the authentication result to the first card reader 22.

In this embodiment, the authorization module 222 can determine whether it is a card authorization according to the second authentication information, and can also determine whether it is a card authorization according to other information. Therefore, as an optional implementation manner of the embodiment of the present invention, the authorization module is authorized. When the authentication result of the authentication of the second authentication information indicates that the authentication is passed, the module 222 judges by the following method Whether or not the card is authorized: according to the authorization authority list of the first card reader 22, it is judged whether or not the card 21 is authorized. Whether or not the card 21 is an authorized user of the first card reader 22 is determined based on whether the card 21 is in the authorization authority list of the first card reader 22 to determine whether or not the card 21 is authorized.

As an optional implementation manner of the embodiment of the present invention, in order to improve the security of the authorization method, the background 23 can authenticate the premise that the card 21 satisfies the authorization of the card 21 by the first card reader 22, and thus, as the present invention In an optional implementation manner of the embodiment, the second authentication module 232 is further configured to perform authentication on the precondition for authorizing the card 21 by the first card reader 22 to obtain an authentication result. In a specific implementation process, the background 23 can use the first security status to record the authorization related information obtained by the card 21, and the second authentication module 232 determines whether the card 21 satisfies the authorization of the card 21 by the first card reader 22 according to the first security status. Prerequisites.

As an alternative embodiment of the embodiment of the present invention, as shown in FIG. 5, the system provided in this embodiment further includes: a verification device 24; a background 23, further comprising: a fourth acquisition module 234, a fourth storage module 235; The card reader further includes: a fifth obtaining module 224; wherein the fifth obtaining module 224 is configured to obtain the identification information of the card 21; the sending unit 2222 is further configured to send, to the background 23, a notification that includes at least the identification information of the card 21. The third receiving module 231 is further configured to receive the notification, the fourth obtaining module 234 is configured to obtain the attribute information of the current authentication of the card according to the notification, and the fourth storage module 235 is configured to store the attribute information of the current authentication of the card. The verification device 24 is configured to acquire the encrypted attribute information from the card 21 and acquire the attribute information of the fourth storage module 235 from the background 23, decrypt the encrypted attribute information, and decrypt the attribute information obtained from the background 23 The information is compared, and if it does not match, the identification card 21 is an illegal card. In the present embodiment, the verification device 24 can be a standalone device or an integral part of the background 23. With the optional implementation, it is possible to prevent the illegal device from attacking the card 21, initiate an illegal authentication command, and acquire data inside the card 21, thereby breaking the card 21.

Any process or method description in the flowcharts or otherwise described herein can be understood as a component, segment or portion of code representing executable instructions including one or more steps for implementing a particular logical function or process. And the scope of the preferred embodiments of the invention includes additional implementations, in which the functions may be performed in a substantially simultaneous manner or in an opposite order depending on the functions involved, in the order shown or discussed. It will be understood by those skilled in the art to which the embodiments of the present invention pertain.

It should be understood that portions of the invention may be implemented in hardware, software, firmware or a combination thereof. In the above-described embodiments, multiple steps or methods may be implemented in software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented by any one or combination of the following techniques well known in the art: having logic gates for implementing logic functions on data signals. Discrete logic circuits, application specific integrated circuits with suitable combinational logic gates, programmable gate arrays (PGAs), field programmable gate arrays (FPGAs), etc.

One of ordinary skill in the art can understand that all or part of the steps carried by the method of implementing the above embodiments can be completed by a program to instruct related hardware, and the program can be stored in a computer readable storage medium. When executed, one or a combination of the steps of the method embodiments is included.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing component, or each unit may exist physically separately, or two or more units may be integrated into one component. The above integrated components can be implemented in the form of hardware or in the form of software functional components. The integrated components, if implemented in the form of software functional components and sold or used as separate products, may also be stored in a computer readable storage medium.

The above mentioned storage medium may be a read only memory, a magnetic disk or an optical disk or the like.

In the description of the present specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" and the like means a specific feature described in connection with the embodiment or example. A structure, material or feature is included in at least one embodiment or example of the invention. In the present specification, the schematic representation of the above terms does not necessarily mean the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in a suitable manner in any one or more embodiments or examples.

Although the embodiments of the present invention have been shown and described, it is understood that the foregoing embodiments are illustrative and not restrictive Variations, modifications, alterations and variations of the above-described embodiments are possible within the scope of the invention. The scope of the invention is defined by the appended claims and their equivalents.

Claims (20)

An authorization method, comprising: The card receives the authentication command sent by the first card reader, where the authentication command carries the identification information and the first authentication information; The card acquires a first authentication key in a first state corresponding to the first card reader according to the identifier information, where the first state is an available state; The card uses the first authentication key to authenticate the first authentication information, and if the authentication passes, sends the second authentication information to the first card reader; Receiving, by the first card reader, the second authentication information, determining, according to the second authentication information, whether the card is authorized, and sending the response information to the card; After the card authenticates the first authentication information by using the first authentication key, the method further includes: the card acquiring the first authentication key by using the first authentication key in the first state. a second authentication key in a first state corresponding to the second card reader, and storing the second authentication key in the first state, and a precondition for the second card reader to authorize the card is the The card has been successfully authorized by the first card reader. The method of claim 1 wherein And acquiring, by the first authentication key in the first state, the second authentication key in the first state corresponding to the second card reader, where the card includes: The card calculates, by using the first authentication key in the first state, the locally stored second authentication key in the second state corresponding to the second card reader, to obtain the location in the first state. The second authentication key is described. The method of claim 2 wherein: The second authentication key in the second state includes: the encrypted second authentication key; The card calculates, by using the first authentication key in the first state, the locally stored second authentication key in the second state corresponding to the second card reader, to obtain the location in the first state. The second authentication key includes: Decrypting the locally stored encrypted second authentication key corresponding to the second card reader by using the first authentication key in the first state to obtain the decrypted second authentication key . Method according to claim 2 or 3, characterized in that The first card reader receives the second authentication information, and at least determines whether the card is authorized according to the second authentication information, including: The first card reader authenticates at least the second authentication information to obtain an authentication result; or the first card reader sends the second authentication information to the background, and the background is at least for the second authentication. The information is authenticated, and the authentication result is returned to the first card reader; The first card reader determines whether the card is authorized according to at least the authentication result. The method of claim 4 wherein: Determining, by the first card reader, whether the card is authorized according to the authentication result of authenticating the second authentication information, including: When the authentication result indicates that the authentication is passed, the first card reader determines whether the card is authorized according to the authorization permission list of the first card reader. Method according to claim 4 or 5, characterized in that The background at least authenticating the second authentication information includes: The background authenticates the preconditions that the first card reader gives the card authorization. A method according to any one of claims 1 to 6, wherein The storing the second authentication key in the first state includes: storing the second authentication key in the first state in a buffer area; The method further includes: clearing the buffer area when a preset time arrives or a preset event occurs. The method of claim 7 wherein: The preset event includes: the card fails to pass the first authentication information authentication. A method according to any one of claims 1 to 8, wherein After the card receives the authentication command sent by the first card reader, the method further includes: the card acquiring the attribute information of the current authentication, and encrypting and storing the attribute information; Before the card receives the authentication command sent by the first card reader, the method further includes: the first card reader acquiring identification information of the card; the first card reader transmitting the authentication to the card The first card reader sends a notification including at least the identification information of the card to the background; the background acquires and stores the attribute information of the current authentication of the card according to the notification; After the card is encrypted and stored, the method further includes: acquiring the encrypted attribute information stored by the card; decrypting the encrypted attribute information; and decrypting the obtained The attribute information is compared with the attribute information of the card stored in the background, and if not, the card is identified as an illegal card. A card comprising: a first receiving module, configured to receive an authentication command sent by the first card reader, where the authentication command carries the identification information and the first authentication information; a first acquiring module, configured to acquire, according to the identifier information, a first authentication key in a first state corresponding to the first card reader, where the first state is an available state; The first authentication module is configured to authenticate the first authentication information by using the first authentication key, and trigger the first sending module if the authentication is passed; The first sending module is configured to send second authentication information to the first card reader; The first receiving module is further configured to receive authentication response information returned by the first card reader; a second acquiring module, configured to use, in the first state, in the case that the first authentication module authenticates the first authentication information and the authentication passes or the authentication response information indicates that the card is authorized The first authentication key acquires the second authentication key in the first state corresponding to the second card reader, and sends the second authentication key in the first state to the first storage module, where The precondition for the second card reader to authorize the card is that the card has successfully obtained the authorization of the first card reader; The first storage module is configured to store a second authentication key in the first state. A card according to claim 10, wherein The card further includes: a second storage module, configured to store a second authentication key in a second state corresponding to the second card reader; Obtaining, by the second acquiring module, the second authentication key in the first state corresponding to the second card reader by using the first authentication key in the first state to the second storage module The second authentication key stored in the second state corresponding to the second card reader is calculated to obtain the second authentication key in the first state. The card according to claim 11, wherein the second authentication key in the second state comprises: the encrypted second authentication key; The second obtaining module calculates the second authentication key in the second state by using the second authentication key in the second state corresponding to the second card reader by: using the The first authentication key in the first state decrypts the encrypted second authentication key corresponding to the second card reader stored in the second storage module, to obtain the decrypted second authentication key. . The card according to any one of claims 10 to 12, further comprising: The module is cleared to clear the data stored in the first storage module when a preset time arrives or a preset event occurs. The card of claim 13 wherein said predetermined event comprises: The first authentication module fails to pass the first authentication information authentication. The card according to any one of claims 10 to 14, wherein the card further comprises: a third acquisition module, an encryption module, a third storage module, and a response module; The third obtaining module is configured to: after the first receiving module receives the authentication command sent by the first card reader, acquire the attribute information of the current authentication, and send the attribute information to the encryption module; The cryptographic module is configured to receive the attribute information, and encrypt the attribute information to obtain an attribute information ciphertext, and send the attribute information ciphertext to the third storage module; The third storage module is further configured to receive the attribute information ciphertext and store the attribute information; The response module is configured to send the attribute information ciphertext stored by the third storage module in response to the read instruction. An authorization system, comprising: a first card reader and the card of any one of claims 10 to 15; The first card reader includes: a second receiving module, configured to receive second authentication information sent by the card; And an authorization module, configured to determine, according to the second authentication information, whether the card is authorized; And a second sending module, configured to send, to the card, response information indicating whether the card is authorized. The authorization system according to claim 16, wherein the system further comprises: a background; The authorization module includes: a sending unit, configured to send the second authentication information to the background; and a receiving unit, configured to receive an authentication result obtained by the background at least authenticating the second authentication information; Determining, by at least according to the authentication result, whether the card is authorized; The background includes: a third receiving module, configured to receive the second authentication information; a second authentication module, configured to perform at least authentication on the second authentication information, to obtain an authentication result; and a third sending module, configured to The first card reader returns the authentication result. The authorization system of claim 17 wherein: If the authentication result of the authentication of the second authentication information indicates that the authentication is passed, the authorization module determines whether the card is authorized by: determining, according to the authorization permission list of the first card reader, whether Authorize the card. The authorization system according to claim 17 or 18, characterized in that The second authentication module is further configured to perform authentication on a precondition for granting the card authorization by the first card reader, and obtain an authentication result. The authorization system according to any one of claims 17 to 19, wherein the system further comprises: a verification device; the background further comprising: a fourth storage module and a fourth acquisition module; the first reading card The device further includes: a fifth acquisition module; wherein The fifth obtaining module is configured to acquire identification information of the card; The sending unit is further configured to send, to the background, a notification that includes at least the identification information of the card; The third receiving module is further configured to receive the notification; The fourth obtaining module is configured to acquire the attribute information of the current authentication of the card according to the notification; the fourth storage module is configured to store the attribute information of the current authentication of the card; The verification device, configured to acquire the encrypted attribute information from the card and obtain the The attribute information of the fourth storage module decrypts the encrypted attribute information, compares the decrypted attribute information with the attribute information obtained from the background, and if not, identifies the card Is an illegal card.

Images