KR20040092669A - A rfid terminal and a tag with security function - Google Patents

Abstract

PURPOSE: A radio frequency identification equipment and a radio frequency identification tag having a security function are provided to apply security and authentication functions to an RFID tag. CONSTITUTION: A transmitting module(231) transmits carrier waves to a non-contact RFID(Radio Frequency IDentification) tag(100). A receiving module(232) receives sub-carrier waves returned from the RFID tag(100). An encryption module(300) receives a tag unique code fixed in the RFID tag(100) for generating an authentication cipher for a tag based on the tag unique code and a predetermined user master key code. A central processing unit(210) controls the transmitting module(231), the receiving module(232), and the encryption module(300). The central processing unit(210) transmits the authentication cipher for a tag to the RFID tag(100) through the transmitting module(231) to record the authentication cipher for a tag at an authentication area of a memory of the RFID tag(100).

Description

A RFID TERMINAL AND A TAG WITH SECURITY FUNCTION}

The present invention relates to a wireless recognition terminal and a tag, and more particularly, to a wireless recognition terminal and a tag for authenticating a tag through an authentication password outputted through an encryption algorithm by receiving a unique code of a tag and a master key code of a user. will be.

In recent years, the RFID (Radio Frequency IDentification) system, which automatically recognizes an object in a non-contact manner and even authenticates and pays an object, has been in the spotlight. In the case of magnetic recognition or barcode recognition system, a specific external display is required and the recognition rate gradually decreases over time due to weakening of magnetic force and damage or damage, whereas RFID system can overcome such disadvantage. RFID systems are emerging as new solutions, such as those used in various automation projects, distribution, livestock management, access control, time and attendance, logistics, and parking management. Specifically, for example, prepaid / postpaid, including credit / debit cards. It can be used for buses, subway cards, parking lot access cards, department store cards, manufacturing processes on conveyor belts, postal delivery systems, identification tags that record animal information. For example, a microchip RFID tag with an antenna smaller than a grain may be attached to the trademark of the clothing or hat product of FIG. 1 to receive various information about the style-size-color-distribution of the product, and the main computer network. The consumer can quickly make a purchase decision after checking the stock status of an identified object such as a garment or a hat product through the Internet. For example, a consumer may be able to determine if the product he / she wants is currently available at a store near his or her region.

In a radio recognition system, an object including object recognition information is called a radio frequency identification tag (RFID tag), and an identifier or terminal is a device for recording predetermined data in the tag or reading data recorded in the tag. It is called (terminal). The RFID tag is also called a smart tag, and itself functions only as an identifier or a memory, but it may be necessary to provide a separate control device such as the prepaid / postpaid transportation card of FIG. 2.

However, the RFID tag is an electromagnetic object identification device using a radio frequency, and is distinguished from a smart card in that there is no central processing unit (CPU) and there is only a simple control unit, a memory, and a transmission / reception antenna.

However, while smart cards have a strong security function, the RFID tag has only a role of a memory as an indicator or a recognizer, so there is no security at all. For example, it is defenseless to copy data in memory of an RFID tag as it is and to copy and use a recognition object using the RFID tag as a recognition medium. In this case, since the RFID tag is attached, consumers may be mistaken for genuine products even though they are counterfeits.

Therefore, in order to circumvent the vulnerability of the security function of the RFID tag, smart cards having a built-in security CPU have been widely used. Smart cards are so reliable that they are officially recognized worldwide as being virtually perfect for their security and authentication capabilities.

However, since the price of the smart card is very expensive compared to the RFID tag, the smart card cannot replace the RFID tag unless the value of the recognition object is high. In particular, smart cards are not economical unless the price of an article that is a recognition object is significantly higher than a smart card.

In addition, there is a method of encrypting data and identification information stored in the memory in the RFID tag by software, but in the case of using a hard copy of the encrypted information stored in the memory as it is, software encryption of the data and identification information Will be of no use.

Therefore, in view of economics, it has been pointed out the need for a separate system that can give a smart card-level security and authentication function to the RFID tag.

It is an object of the present invention to provide a system capable of adding a high reliability security and authentication function at the smart card level to an RFID RFID tag having only a simple identification and memory function.

Another object of the present invention is to provide a system for implementing a security and authentication function for an RFID RFID tag at a low cost.

1 is a garment and a hat as a recognition object with an RFID tag attached thereto,

2 is a prepaid / postpaid transportation card as an article to be tagged with an RFID tag;

3 is a schematic diagram showing the structure of a general RFID tag and a wireless recognition terminal,

4 is a schematic diagram showing the structure of an RFID tag and a wireless recognition terminal according to the present invention;

5 is a schematic diagram showing the structure of an RFID tag and a wireless recognition terminal according to the present invention;

6 is a memory structure of a radio recognition tag according to the present invention;

7A is a block diagram of an encryption unit according to the present invention;

7b is a flowchart illustrating an encryption process according to the present invention;

7c is a flowchart of 3DES encryption according to the present invention;

8 is a flowchart illustrating a method of recording an authentication password in a radio recognition tag according to the present invention;

9 is a flowchart illustrating a method of authenticating a radio recognition tag according to the present invention.

(Explanation of symbols for the main parts of the drawing)

100 ... radio recognition tag, 110 ... tag unique code (Tp)

120.Authentication password storage area for tags,

130 ... General data area,

200 ...

210 ... CPU, 220 ... Memory,

230, antenna, 231, transmitter,

232 ... receiver, 300 ... crypto,

Tp ... tag unique code, Ke ... user's master keycode

Authentication password for Tc ... tag, authentication password for Tc1 ... tag,

Authentication password for Tc2 ... terminal

The present invention has been made to achieve the above object, the authentication code (Tc1) generated based on the unique code (Up) and the master key code (Ke) of the radio identification tag to the radio identification tag If the wireless identification tag holding the authentication password approaches the proximity recognition area of the terminal device for recognition (hereinafter referred to as a terminal), the terminal receives the unique number Tp of the wireless identification tag and the master key code Ke. After generating the authentication password (Tc2) by the combination with the terminal and the wireless terminal as a system consisting of a configuration for determining whether or not authentication by comparing the authentication password (Tc2) recorded in the radio recognition tag with the terminal authentication password (Tc2) Recognition tag.

In more detail, the terminal and the recognition tag according to the present invention have the following configuration.

That is, the terminal according to the first aspect of the present invention is to generate an authentication password for the first time and to record it in a radio recognition tag. The terminal transmits a carrier wave to a contactless RFID tag and the radio recognition tag. In the radio recognition terminal for recording the information stored in the radio identification tag through a receiving unit for receiving the returned subcarrier,

Receives a tag unique code (Tp) fixed in the radio recognition tag through the receiving unit, encrypts the tag based on the tag unique code and a predetermined user master key code (Ke) An encryption unit for generating an authentication password Tc1;

A central processing unit controlling the transmitter, the receiver, and the encryption unit,

The central processing unit transmits the tag authentication code Tc1 generated by the encryption unit through the transmitter to the wireless tag, and transmits the tag code to the authentication area of the memory of the tag. Tc1) is recorded (claim 1).

The encryption unit may include an arithmetic unit that divides the unique code of the radio recognition tag into two blocks and calculates a plurality of rounds of encryption modification by combining with the master key code.

The encryption unit may be replaced with a smart card that can be attached to or detached from the terminal. If the communication speed is not a problem, the encryption unit may play a role in a separate main server connected through a communication cable with the terminal.

In addition, the terminal according to the second aspect of the present invention provides a method for determining whether to authenticate first before data communication is made when a wireless identification tag in which an authentication password is already recorded is approached and accessed. A wireless recognition terminal which reads information stored in the wireless identification tag through a transmitter for transmitting a carrier toward a contactless RFID tag and a receiver for receiving a subcarrier transmitted from the wireless tag.

The radio recognition tag includes an authentication password (Tc1) for the tag,

The wireless recognition terminal,

Receives a tag unique code (Tc1) fixed in the radio recognition tag through the receiving unit, and encrypts based on the tag unique code and a predetermined user master key code (Ke) for the terminal An encryption unit for generating an authentication password Tc2;

A central processing unit controlling the transmitter, the receiver, and the encryption unit,

The CPU may determine whether to authenticate by comparing the terminal authentication password Tc2 generated by the encryption unit with the authentication password Tc1 recorded in the authentication area of the memory of the wireless identification tag. (Claim 4).

The encryption unit may include an arithmetic unit that divides the unique code of the radio recognition tag into two blocks and calculates a plurality of rounds of encryption modification by combining with the master key code.

The encryption unit may be replaced with a smart card that can be attached to or detached from the terminal. If the communication speed is not a problem, the encryption unit may be in charge of a separate main server connected through the terminal and the communication cable.

In addition, the RFID tag according to the third aspect of the present invention is manufactured to be used in a terminal having the above-described configuration, and the RFID tag for recording or reading data in accordance with a command of the RFID terminal. RFID tag,

When receiving the call signal of the unique code from the wireless recognition terminal, and transmits a built-in tag unique code (Tp),

Receive a tag authentication code (Tc1) generated by the combination of the tag unique code (Tp) and the predetermined master key code (Ke) from the wireless recognition terminal, and stores in the authentication area of the memory,

When receiving the call signal of the authentication code from the wireless recognition terminal, characterized in that for transmitting the tag unique code (Tp) and the authentication code (Tc1) to the untrusted terminal (claim 7).

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings and examples.

(Example 1)

1 and 2 show clothing and hats and prepaid / postpaid transportation cards as items to be recognized with RFID tags attached. In the case of clothing, bar codes are conventionally used, but barcodes are rapidly converted to RFID tags due to problems such as slow recognition speed, surface damage over time, and the barcode itself does not function as a memory. to be. In the case of a transportation card, it is necessary to minimize the communication with the main computer by providing an RFID with its own arithmetic function in order to minimize the time required to determine the departure point, the arrival point and the usage fee (for example, within 10 mS). .

3 is a schematic diagram showing the structure of a general RFID tag 100 and a wireless recognition terminal 200. The RFID tag 100 is attached to an object to be identified such as clothing, tableware, various parts, and the like, and the wireless recognition terminal 200 stores the memory information of the RFID tag 100 at a recognizable proximity distance of the wireless recognition terminal 200. Record or read.

Although not shown, the RFID tag 100 is composed of an EEPROM memory, a coil that combines an antenna and a generator, a controller, and the like.

For example, in accordance with the ISO 14443 communication protocol, the wireless recognition terminal 200 modulates ASK (Ampltude Shift Keying) on a 13.56 MHz carrier and transmits the data to the RFID tag 100 through the antenna 230. And a receiver 232 for receiving a BPSK (Binary Phase Shift Keying) signal of an 847.5 KHz subcarrier transmitted from the RFID tag 232 through the antenna 230, a CPU 210, a memory 220, and a user interface ( A keyboard, a mouse, a display, and the like; 240, a communication module 250 such as a connector for data input and output with an external computer or an external device.

The wireless recognition terminal 200 includes a terminal for generating an authentication password for the first time and recording it in a wireless identification tag, a terminal for reading a wireless identification tag containing information, and a terminal that combines a recording and reading function.

The recording terminal 200 according to the present invention includes a transmitter for transmitting a carrier wave toward the contactless RFID tag 100 to generate an authentication password for the first time and record the RFID code in an RFID tag as shown in FIG. 4. 231 and a receiving unit 232 for receiving the subcarriers transmitted from the RFID tag 100, the CPU 210, the antenna 230, the memory 220, the user interface 240, and encryption for encryption processing. A unit 300 and an EEPROM 222 for storing a user key code Ke are included.

EEPROM 222 is embedded in the encryption unit 300 as a place to store the authentication password for the terminal, it is separately indicated. The encryption unit 300 is preferably configured such that the authentication password in the EEPROM 222 is not exposed (for example, a smart card). The user interface 240 refers to a console for controlling a terminal by a terminal user such as a keyboard, a mouse, and a display device.

The encryption unit 300 is an arithmetic unit for outputting encrypted data by combining based on various input data, and of course, may be embedded in the CPU 210. However, in order to facilitate communication with the main computer and operation of the terminal, and to facilitate conversion as necessary, it is necessary to provide a separate encryption unit 300 through the communication module 250 as shown in FIG. 4. desirable. The encryption unit 300 receives a tag unique code (Tp) fixed in the wireless recognition tag 100 through the receiver 232, and receives a tag unique code and a predetermined user master key code; Encryption based on Ke) generates an authentication password Tc1 for the tag. The tag unique code (Tp) is included in the non-replicable position inside the RFID tag chip, so that it can be read but not written. All RFID tags have different serial numbers. That is, the tag unique code (Tp) is hardware determined at the time of manufacturing the RFID tag chip, and since every tag chip has a different serial number, it can be used for security and authentication functions in the present invention. It becomes the ground that there is. On the other hand, the user master keycode is a code designated by the user of the tag.

As shown in FIG. 4, the encryption unit 300 may conveniently insert a smart card having a high encryption scheme. If necessary, as shown in FIG. 5, the main computer may play a role of creating a cipher text.

The CPU 210 controls the transmitter 231, the receiver 232, and the encryption unit 300, and transmits the authentication password for the tag generated by the encryption unit 300 toward the wireless identification tag 100. Through the transmission, the tag authentication password is recorded in the authentication area 120 of the memory of the radio recognition tag.

6 schematically illustrates a memory structure of a radio recognition tag. The tag unique code 110, the authentication area 120, and the general data area 130 are disclosed. Here, the tag unique code 110 is also disclosed, but it should be noted that there is a characteristic that can not be duplicated because it is actually stored in a separate place in the RFID tag chip is not stored in the memory. The tag unique code 110 is transmitted at the start of communication with the terminal or with general data in the general data area 130 for every communication. That is, the tag unique code 110 cannot be duplicated, but the authentication region 120 and the general data region 130 can be duplicated because they are general memory regions.

For example, the encryption unit 300 of the wireless recognition terminal divides the unique code 110 of the wireless recognition tag, that is, the encryption device using the DES or 3DES scheme into two blocks, and encrypts and modifies the data by combining with the master key code. It may include a computing device for calculating a round a plurality of times.

In addition, the encryption unit 300 may be replaced with a smart card that can be attached and detached to the terminal. If the communication speed is not a problem, the encryption unit 300 may play a role in a separate main server connected through a communication cable with the terminal.

FIG. 7A is a block diagram of the encryption unit 300, FIG. 7B is an encryption process, and FIG. 7C is a schematic diagram of a 3DES encryption block.

As shown in FIG. 7A, when the terminal 200 receives the tag unique code Tp from the radio recognition tag 100, the DES or 3DES encryption unit 300 may include the tag unique code Tp and the master of the user stored in advance. After combining the key code Ke and performing the operation for encryption, the authentication password Tc1 is output.

7B is a flowchart illustrating an encryption process. For example, if the tag unique code (Tp) is composed of 64-bit plain text, it is initial permutated, and then the 64-bit block of the substitute is divided into two 32-bit blocks. The auxiliary key (K1) generated by storing the register (L0) and the right register (R0), receiving 32-bit blocks of the right register, splitting and recombining from the user key code (Ke) by the key schedule. A cipher function unit f for receiving and encrypting an input, an exclusive OR operation unit for receiving data of the cipher function unit f and data of the left register L0, and 32 of the right register R0. A basic first round is obtained by a left register (L1) of the next round that swaps and stores a bit block, and a right register (R1) of a next round that stores data of the exclusive OR operation part. And, on the other round pieces 16 are configured such form the 16 rounds. After 16 rounds of modifications, the encrypted Cipher Text (Tc1) is output through a reverse initial substitution.

A key schedule is a method of dividing a user's master key code Ke into several keys and determining how to use them. Although it is possible to simply divide numerically, there is a limit in numerically dividing the basic bit string of the master keycode, so that the number of divisions can be increased by complicated division and combination. When the tag unique code Tp is composed of 128-bit plain text, the tag-specific code Tp is divided into rounds in which 64-bit block exchange is repeated.

7C shows a flow diagram of 3DES encryption. 3DES encryption is a triple DES encryption, and is generally composed of a first DES encryption unit, a DES decryption unit, and a second DES encryption unit. 3DES encryption requires a decryption key Kd to be used for the DES decryption unit in addition to the encryption key Ke that is the master key code of the user. In the present invention, the decryption key Ke is a part of the master key code Ke according to the key schedule. Can be used by dividing.

The CPU 210 records the authentication code Tc1 for the tag created through the encryption process in the authentication area of the memory in the radio tag.

8 shows a flow chart for recording an authentication cipher in a contactless RFID tag according to the present invention.

First, a user designates a master key code Ke as a password that only the user knows, inputs the master key code Ke into the recording terminal 200, and stores it (S110). The CPU 210 of the terminal may record and store the master key code Ke input from the user in the EEPROM 222 of the encryption unit. The master key code (Ke) for input in the encryption process should be at least 64 bits or more, but if less than 64 bits are input, the subkey data strings (K1, K2, ...) are divided and combined as necessary. Can be regenerated.

Subsequently, when the wireless recognition tag 100 approaches the recognizable distance, while the recording terminal 200 is in the standby state to detect whether the wireless recognition tag 100 approaches the recognizable distance (for example, within 20 cm). The call signal is transmitted to the RFID tag 100 (S120). When the RFID tag receives a call signal, a magnetic field is formed in the internal antenna, and the tag unique code Tp of the tag chip is transmitted by the electromotive force formed by the RF tag. Thus, the antenna 230 of the recording terminal receives the tag unique code (Tp) (S130).

Next, the recording terminal 200 uses the tag unique code Tp received from the radio recognition tag as an input value, and uses the master key code Ke stored in the EEPROM 222 as an auxiliary key to set the encryption value. Create an authentication password for the tag (Tc1) (S140).

The encryption method may be any method, but it is preferable to employ an internationally recognized DES method or 3DES method. For example, as shown in FIG. 7, a method of dividing the unique code Tp of the radio recognition tag into two blocks and calculating a plurality of rounds for encrypting and modifying by combining with the master key code Ke is used. It is preferable. This is because it is necessary to give the security tag a security level equivalent to that of an internationally recognized smart card, and more advanced encryption methods may be employed.

If the encryption process is simply expressed as a function, it is as follows.

T _c1 = f (Ke, Tp)

In addition, the encryption process itself may be in charge of the CPU 210 of the terminal, but in terms of security, it is preferable to take care of the encryption-only processor or a separate smart card 300. When the CPU 210 is in charge of the encryption process, there is a problem of slowing down the system and overloading, but there is a possibility that information related to security may escape to another route. That is, in addition to the CPU 210 that is a processor for operating the system, it is preferable to provide a separate processor for performing only an encryption process.

Lastly, the recording terminal 200 records the tag authentication password Tc1 in the authentication area 120 of the memory of the radio recognition tag 100 (S150).

The radio recognition tag 100, which has undergone such a process, is attached to the object to be recognized (clothing, telephone card, etc.) and subsequently read in by the reading terminal (described in Embodiment 2). By returning the tag unique code (Tp) and the authentication code (Tc1) together, it can play a role of security and authentication.

(Example 2)

The wireless recognition terminal 200 according to the second aspect of the present invention reads the information of the wireless identification tag 100. For example, the wireless identification tag 100, in which the authentication password is already recorded, is approaching a close range. When accessing, the transmitter 231 and 13. the radio recognition tag 100 for transmitting a 13.56 MHz carrier toward the contactless radio tag 100 to determine whether authentication is performed immediately before data communication is performed. The wireless recognition terminal 200 reads the information stored in the wireless recognition tag 100 through a receiving unit 232 for receiving a 847.5 KHz subcarrier transmitted from. The radio recognition tag 100 includes an authentication encryption code Tc1 for the tag, and the radio recognition terminal 200 receives the tag unique code Tp fixed in the radio recognition tag 100 through the receiver 232. And an encryption unit 300 for generating an authentication password Tc2 for the terminal by encrypting the tag based on the tag unique code Tp and the predetermined user master key code Ke.

The general matters of the second embodiment are the same as those of the first embodiment, except that the premise that the wireless identification tag 100 already includes the authentication code Tc1 for the tag is different from the first embodiment. Therefore, the same general matters as those of the system of Example 1 are omitted.

The storage terminal 200 according to the present invention, as shown in Fig. 4, the transmitter 231 for transmitting a 13.56 MHz carrier wave toward the contactless wireless identification tag 100, in order to call the wireless identification tag having an authentication password for the tag. And a receiving unit 232 for receiving 847.5 KHz subcarriers transmitted from the RFID tag 100 and returning the CPU 210, the antenna 230, the memory 220, the user interface 240, and the encryption process. An encryption unit 300 and an EEPROM 222 for storing a user key code Ke in the encryption unit are included.

EEPROM 222 is embedded in the encryption unit 300, and is separately indicated to emphasize this. Meanwhile, a blacklist memory including a separate EEPROM may also be installed in the terminal body to store the blacklist. Since the blacklist can be stored in a database of the main computer, the blacklist memory of the terminal body is not necessarily required. The user interface 240 refers to a console for controlling a terminal by a terminal user such as a keyboard, a mouse, and a display device.

The encryption unit 300 is an arithmetic unit for outputting encrypted data by combining based on various input data, and of course, may be embedded in the CPU 210. However, in order to facilitate communication with the main computer and operation of the terminal, and to facilitate conversion as necessary, it is necessary to provide a separate encryption unit 300 through the communication module 250 as shown in FIG. 4. desirable. The encryption unit 300 receives a tag unique code fixed in the wireless recognition tag 100 through the receiving unit 232 and based on the tag unique code and a predetermined user master key code. To generate an authentication password for the tag. The tag unique code is included in the non-replicable area inside the radio recognition tag, and the user master key code is a code designated by the user of the tag.

As shown in FIG. 4, the encryption unit 300 may conveniently insert a smart card having a high encryption scheme. If necessary, as shown in FIG. 5, the main computer may play a role of creating a cipher text.

The CPU 210 controls the transmitter 231, the receiver 232, and the encryption unit 300, specifically, the tag unique code Tp and the tag for the tag from the radio recognition tag 100 through the receiver 232. After receiving the authentication password Tc1, the tag unique code Tp is sent to the encryption unit 300 for encryption to generate the authentication password Tc2 for the terminal, and then the authentication password Tc1 for the tag. And the terminal authentication password (Tc2).

6 schematically illustrates a memory structure of a radio recognition tag. The tag unique code 110, the authentication area 120, and the general data area 130 are disclosed. Here, the tag unique code 110 is also disclosed, but is actually stored in a separate place in the RFID tag chip is not stored in the memory, there is a characteristic that can not be duplicated. The tag unique code 110 is transmitted at the start of communication with the terminal or with general data in the general data area 130 for every communication. That is, the tag unique code 110 (Tp) cannot be duplicated, but the authentication area 120 (Tc1) and the general data area 130 are duplicated because they are general memory areas. Even if the illegal copyer duplicates the authentication code (Tc1) in the authentication area, it is possible to generate authentication codes for different tag unique codes of the duplicated chip unless it can duplicate the tag unique code (Tp1) that is unique to the chip. Is not. For example, the encryption unit 300 of the wireless recognition terminal divides the unique code 110 of the wireless recognition tag, that is, the encryption device using the DES or 3DES scheme into two blocks, and encrypts and modifies the data by combining with the master key code. It may include a computing device for calculating a round a plurality of times.

In addition, although the encryption unit 300 may be in charge of the CPU 210 itself, it is preferable to install it as a separate computing device. For example, the encryption unit 300 may be replaced with a smart card that can be attached and detached from the terminal. If the communication speed is not a problem, the encryption unit 300 may play a role in a separate main server connected through a communication cable with the terminal.

The CPU 210 controls the transmitter 231, the receiver 232, and the encryption unit 300, the authentication password for the terminal generated by the encryption unit 300, and the wireless recognition tag received through the receiver 232. The authentication password for the tag recorded in the authentication area in the memory of 100 is compared to determine whether to authenticate. That is, if the terminal authentication password and the tag authentication password are the same, the authentication is approved. If not, the authentication is rejected, and the wireless recognition tag 100 is blacklisted.

In the black list processing, the unique number of the radio recognition tag 100 is stored in a blacklist memory in the terminal, or transferred to the main computer through the communication module 250 to be stored in a database (DB). At the same time, the memory of the RFID tag 100 may be deleted or blackmarked so that the RFID tag 100 may no longer be used.

The encryption unit 300 may include an arithmetic unit that divides the unique code of the radio recognition tag into two blocks and calculates a plurality of rounds of encryption and deformation by combining with the master key code.

In addition, the encryption unit 300 may be replaced with a smart card that can be attached and detached to the terminal. If the communication speed does not matter, the encryption unit 300 may be in charge of a separate main computer connected to the terminal 200 through a communication cable.

6 schematically illustrates a memory structure of a radio recognition tag. The tag unique code 110, the authentication area 120, and the general data area 130 are disclosed. Here, the tag unique code 110 is also disclosed, but is actually stored in a separate place in the wireless tag tag instead of being stored in the memory there is a characteristic that can not be duplicated. The tag unique code 110 is transmitted at the start of communication with the terminal or with general data in the general data area 130 for every communication. That is, since the tag unique code 110 exists at a special position inside the chip, it cannot be copied because it can be read but not written, but since the authentication area 120 and the general data area 130 are general memory areas, duplication is not possible. Possibility is as described above.

For example, the encryption unit 300 of the wireless recognition terminal divides the unique code 110 of the wireless recognition tag, that is, the encryption device using the DES or 3DES scheme into two blocks, and encrypts and modifies the data by combining with the master key code. It may include a computing device for calculating a round a plurality of times.

In addition, the encryption unit 300 may be replaced with a smart card that can be attached and detached to the terminal. If the communication speed is not a problem, the encryption unit 300 may play a role in a separate main server connected through a communication cable with the terminal.

FIG. 7A is a block diagram of the encryption unit 300, FIG. 7B is an encryption process, and FIG. 7C is a schematic diagram of a 3DES encryption block. It is possible to determine whether to approve by comparing the terminal authentication password (Tc2) identified through this process with the tag authentication password (Tc1).

However, unlike the first embodiment, the encryption unit 300 according to the second embodiment does not generate the authentication password Tc1 for the tag, but compares the authentication password Tc2 for the terminal to be compared with the authentication password Tc1 for the tag. Note that it generates

The encryption process is similar to the process in Example 1.

That is, as shown in FIG. 7B, when the tag unique code Tp is composed of 64-bit plain text, the initial permutation is performed, followed by two 64-bit blocks of the substitution part. Divided into 32-bit blocks, stored in left register (L0) and right register (R0), 32-bit blocks of right register are received and generated by dividing and recombining from user key code (Ke) by key schedule A cipher function unit f for receiving and encrypting the modified auxiliary key K1, an exclusive OR operation unit for receiving data of the cipher function unit f and data of the left register L0, and A left register L1 of the next round that swaps and stores a 32-bit block of the right register R0, and a right register R1 of the next round that stores data of the exclusive OR operation unit. It constitutes the first round, and these rounds consist of 16 rounds to form 16 rounds. After 16 rounds of modifications, the encrypted Cipher Text (Tc1) is output through a reverse initial substitution.

A key schedule is a method of dividing a user's master key code Ke into several keys and determining how to use them. Although it is possible to simply divide numerically, there is a limit in numerically dividing the basic bit string of the master keycode, so that the number of divisions can be increased by complicated division and combination. When the tag unique code Tp is composed of 128 bits of plain text, the tag is divided into a round and repeated exchange of 64-bit blocks is performed.

7C shows a flow diagram of 3DES encryption. 3DES encryption is a triple DES encryption, and is generally composed of a first DES encryption unit, a DES decryption unit, and a second DES encryption unit. 3DES encryption requires a decryption key Kd to be used for the DES decryption unit in addition to the encryption key Ke that is the master key code of the user. In the present invention, the decryption key Ke is a part of the master key code Ke according to the key schedule. Can be used by dividing.

9 is a flowchart illustrating a method for confirming and authenticating authentication data (tag unique code and tag authentication code) in a radio recognition tag by the reading terminal 200 according to the present invention.

First, a user designates a master key code Ke as a password that only the user knows, inputs the master key code Ke into the reading terminal 200, and stores it (S210). For example, the CPU 210 of the terminal may record and store the master key code Ke input from the user in the EEPROM 222 of the encryption unit. The master key code (Ke) for input in the encryption process should be at least 64 bits or more, but if less than 64 bits are input, the subkey data strings (K1, K2, ...) are divided and combined as necessary. Can be regenerated.

Subsequently, when the wireless recognition tag 100 approaches the recognizable distance while the standby terminal 200 is in the standby state to detect whether the wireless recognition tag 100 approaches the recognizable distance (for example, within 20 cm). The call signal is transmitted to the radio tag 100 (S20). In this case, the RFID tag must have a tag unique code (Tp) and an authentication code (Tc1) for the tag.

When the RFID tag receives a call signal, a magnetic field is formed in the internal antenna, and the tag unique code Tp of the tag chip and the authentication code Tc1 for the tag are transmitted by the electromotive force generated by the RF tag. As a result, the receiver 232 receives the tag unique code Tp and the authentication code Tc1 through the antenna 230 of the recording terminal (S230).

Next, the recording terminal 200 uses the tag unique code Tp received from the radio recognition tag as an input value, and uses the master key code Ke stored in the EEPROM 222 as an auxiliary key to set the encryption value. Create a terminal authentication password (Tc2) (S240).

The encryption method may be any method, but it is preferable to employ an internationally recognized DES method or 3DES method. For example, as shown in FIG. 7, a method of dividing the unique code Tp of the radio recognition tag into two blocks and calculating a plurality of rounds for encrypting and modifying by combining with the master key code Ke is used. It is preferable. This is because it is necessary to give the security tag a security level equivalent to that of an internationally recognized smart card, and more advanced encryption methods may be employed.

If the encryption process is simply expressed as a function, Equation 1 below.

T _c2 = f (Ke, Tp)

In addition, the encryption process itself may be in charge of the CPU 210 of the terminal, but in terms of security, it is preferable to take care of the encryption-only processor or a separate smart card 300. When the CPU 210 is in charge of the encryption process, there is a problem of slowing down the system and overloading, but there is a possibility that information related to security may escape to another route. That is, in addition to the CPU 210 that is a processor for operating the system, it is preferable to provide a separate processor for performing only an encryption process.

Next, in the authentication step, it is determined whether to authenticate by comparing the terminal authentication password (Tc2) generated in the encryption step (S240) and the tag authentication password (Tc1) received from the radio recognition tag (S250 ~). S275).

Specifically, in the authentication step, if the terminal authentication password (Tc2) and the tag authentication password (Tc1) is the same (S260), the authentication is approved (S260), the terminal authentication password (Tc2) and the tag authentication password (Tc1) is the same. If not, the authentication is refused (S270).

After authentication of the radio recognition tag is made, normal general data processing is performed (S265).

If authentication of the radio recognition tag is not performed, the unique number of the radio identification tag is stored in the blacklist memory in the reading terminal or in the blacklist of the database (S275). During the blacklist processing, the radio recognition tag may be blackmarked so that it can no longer be used.

(Example 3)

The RFID tag 100 according to the third aspect of the present invention is manufactured to be used in a terminal having the configuration of the first embodiment or the second embodiment, and according to a command of the wireless recognition terminal 200, Is a radio recognition tag 100 to which is written or read, and has the memory structure of FIG. However, it should be noted that the tag unique code exists in a separate area inside the RFID chip.

When the wireless tag 100 according to the present invention receives the call signal of the unique code from the wireless terminal 200, it transmits the embedded tag unique code (110; Tp).

Then, a tag authentication code Tc1 generated by the combination of the tag unique code 100 (Tp) and the master key code Ke pre-specified by the user is received from the wireless recognition terminal 200 and received in the authentication area of the memory. Record it. In this process, the operation in the wireless recognition terminal 200 is the same as in the first embodiment.

In this way, the wireless recognition tag 100 in which the authentication password Tc1 is recorded reaches a recognizable proximity distance of the wireless recognition terminal 200 waiting for reading, and the call signal of the authentication password is received from the reading wireless recognition terminal 200. When receiving the, the tag unique code (100; Tp) and the authentication password (200; Tc1) transmits to the untrusted terminal 200. In this process, the operation in the wireless recognition terminal 200 is the same as in the second embodiment.

As described above, the present invention has been described through various embodiments. However, the above embodiments are only disclosed to aid the understanding of the present invention, and the scope of the present invention should not be construed as being limited thereto. Therefore, even if additions, changes, modifications, and reductions to the present invention, it is within the scope of the present invention as long as it is included in the technical idea defined by the claims.

SUMMARY OF THE INVENTION An object of the present invention is to provide a system that can add security and authentication functions to RFID RFID tags having only simple identification and memory functions.

Another object of the present invention is to provide a system for implementing a security and authentication function for RFID RFID tag at a low cost.

Claims (7)

A wireless identification terminal for recording information stored in the wireless identification tag through a transmitter for transmitting a carrier toward a contactless RFID tag and a receiver for receiving a subcarrier transmitted from the RFID tag, Receives a tag unique code fixed in the radio recognition tag through the receiving unit, and encrypts the tag based on the tag unique code and a predetermined user master key code to generate an authentication password for the tag. An encryption unit to perform; A central processing unit controlling the transmitter, the receiver, and the encryption unit, The central processing unit transmits the authentication code for the tag generated by the encryption unit through the transmitter toward the wireless tag, and records the tag authentication code in the authentication area of the memory of the tag. Wireless recognition terminal characterized in that. The method of claim 1, The encryption unit, And an arithmetic unit for dividing the unique code of the radio recognition tag into two blocks and calculating a plurality of rounds of encryption and deformation by combining with the master key code. The method according to claim 1 or 2, The encryption unit is a wireless recognition terminal, characterized in that the smart card. A wireless identification terminal that reads information stored in the wireless identification tag through a transmitter for transmitting a carrier toward a contactless RFID tag and a receiver for receiving a subcarrier transmitted from the RFID tag. The wireless identification tag includes an authentication password for the tag, The wireless recognition terminal, Receives a tag unique code fixed in the radio recognition tag through the receiving unit, and generates an authentication password for the terminal by encrypting based on the tag unique code and a predetermined user master key code. An encryption unit to perform; A central processing unit controlling the transmitter, the receiver, and the encryption unit, And the central processing unit determines whether to authenticate by comparing the authentication password for the terminal generated by the encryption unit with the authentication password for the tag recorded in the authentication area of the memory of the wireless identification tag. The method of claim 4, wherein The encryption unit And an arithmetic unit for dividing the unique code of the radio recognition tag into two blocks and calculating a plurality of rounds of encryption and deformation by combining with the master key code. The method according to claim 4 or 5, The encryption unit is a wireless recognition terminal, characterized in that the smart card. An RFID tag in which data is recorded or read according to a command of a RFID terminal, When receiving the call signal of the unique code from the wireless recognition terminal, and transmits a built-in tag unique code (unique code), Receiving a recording authentication password generated by the combination of the tag unique code and a predetermined master key code from the wireless identification terminal, and stores in the authentication area of the memory, And receiving the call signal of the authentication code from the wireless recognition terminal, transmitting the unique code and the authentication code to the wireless recognition system.