ACR3x Mobile Card Reader

Transcription

1 ACR3x Mbile Card Reader Reference Manual V1.05 Subject t change withut prir ntice

2 Revisin Histry Release Date Revisin Descriptin Versin Number Initial Release Updated Sectin Features Added Sectin Cntactless Card Cmmands Updated Sectin Sensitive Data Injectin Methd Updated Sectin Features Updated Sectin Features Updated Sectin Lad Authenticatin Keys Remved ACR32 and replaced with ACR Page 2 f 81

3 Table f Cntents 1.0. Intrductin Definitins f Terms Features ACR ACR ACR Supprted Cards Magnetic Cards Cntact Smart Cards MCU Cards Memry-based Cntact Smart Cards Cntactless Smart Cards System Blck Design ACR ACR ACR Hardware Design Battery Status LED Micr USB Interface Audi Channel Cmmunicatin Parameters Magnetic Stripe Card Interface Cntact Smart Card Interface Smart Card Pwer Supply VCC (C1) Prgramming Vltage VPP (C6) Card Type Selectin Interface fr Micrcntrller-based Cards Card Tearing Prtectin Cmmunicatin Prtcl Applicatin Prgramming Interface Cntact Card Cmmands Memry Card 1, 2, 4, 8, and 16 kilbit I2C Card SELECT_CARD_TYPE SELECT_PAGE_SIZE READ_MEMORY_CARD WRITE_MEMORY_CARD Memry Card 32, 64, 128, 256, 512, and 1024 kilbit I2C Card SELECT_CARD_TYPE SELECT_PAGE_SIZE READ_MEMORY_CARD WRITE_MEMORY_CARD Memry Card Atmel AT88SC SELECT_CARD_TYPE READ_MEMORY_CARD WRITE_MEMORY_CARD VERIFY_PASSWORD INITIALIZE_AUTHENTICATION VERIFY_AUTHENTICATION Memry Card Atmel AT88C Page 3 f 81

4 SELECT_CARD_TYPE READ_MEMORY_CARD WRITE_MEMORY_CARD VERIFY_PASSWORD INITIALIZE_AUTHENTICATION VERIFY_AUTHENTICATION Memry Card SLE4418/SLE4428/SLE5518/SLE SELECT_CARD_TYPE READ_MEMORY_CARD READ_PRESENTATION_ERROR_COUNTER_MEMORY_CARD (SLE4428 and SLE5528) READ_PROTECTION_BIT WRITE_MEMORY_CARD WRITE_PROTECTION_MEMORY_CARD PRESENT_CODE_MEMORY_CARD (SLE4428 and SLE5528) Memry Card SLE4432/SLE4442/SLE5532/SLE SELECT_CARD_TYPE READ_MEMORY_CARD READ_PRESENTATION_ERROR_COUNTER_MEMORY_CARD (SLE4442 and SLE5542) READ_PROTECTION_BITS WRITE_MEMORY_CARD WRITE_PROTECTION_MEMORY_CARD PRESENT_CODE_MEMORY_CARD (SLE4442 and SLE5542) CHANGE_CODE_MEMORY_CARD (SLE4442 and SLE5542) Memry Card SLE4406/SLE4436/SLE5536/SLE SELECT_CARD_TYPE READ_MEMORY_CARD WRITE_ONE_BYTE_MEMORY_CARD PRESENT_CODE_MEMORY_CARD AUTHENTICATE_MEMORY_CARD (SLE4436, SLE5536 and SLE6636) Memry Card SLE SELECT_CARD_TYPE READ_MEMORY_CARD WRITE_MEMORY_CARD ERASE_SCRATCH_PAD_MEMORY_CARD VERIFY_USER_CODE VERIFY_MEMORY_CODE Memry Card AT88SC101/AT88SC102/AT88SC SELECT_CARD_TYPE READ_MEMORY_CARD WRITE_MEMORY_CARD ERASE_NON_APPLICATION_ZONE ERASE_APPLICATION_ZONE_WITH_ERASE ERASE_APPLICATION_ZONE_WITH_WRITE_AND_ERASE VERIFY_SECURITY_CODE BLOWN_FUSE Cntactless Card Cmmands Pseud APDU fr Cntactless Interface Get Data PICC Cmmands (T=CL Emulatin) fr MIFARE Classic 1K/4K Memry Cards Lad Authenticatin Keys Authenticatin fr MIFARE Classic (1K/4K) Read Binary Blcks Update Binary Blcks Value Blck Operatin (INC, DEC, STORE) Read Value Blck Cpy Value Blck Access PC/SC Cmpliant Tags (ISO ) Page 4 f 81

5 Access FeliCa Tags Sensitive Data Injectin Methd Authenticatin Custmer Master Key Injectin AES Key Injectin DUKPT Initializatin Card Data Encryptin AES-128 CBC Encryptin Test Vectrs TDES ECB Encryptin Test Vectrs Appendix A. Track Data Errr Cde Appendix B. System Errr Cdes List f Figures Figure 1 : ACR31 Architecture Figure 2 : ACR3201 Architecture Figure 3 : ACR35 Architecture Figure 4 : Sensitive Data Injectin Mdel Figure 5 : Authenticatin Prcedure List f Tables Table 1 : Definitins f Terms... 6 Table 2 : 3.5 mm Audi Scket Wiring Table 3 : MIFARE Classic 1K Memry Map Table 4 : MIFARE Classic 4K Memry Map Table 5 : MIFARE Ultralight Memry Map Table 6 : System Errr Cdes Page 5 f 81

6 1.0. Intrductin The ACR3x Mbile Card Reader serves as an interface fr the cmmunicatin between a mbile device and a magnetic/cntact/cntactless card. Different types f cards have different cmmands and cmmunicatin prtcls, and the ACR3x establishes a unifrm interface frm the mbile device t the card. The ACR3x is cnnected t the mbile device thrugh a 3.5 mm audi jack interface. Thrugh this, the ACR3x will read infrmatin frm the cards thrugh the decder n the reader which will be sent t the mbile device, such as smartphne r tablet. Furthermre, as a way t enhance security, the card infrmatin is encrypted using the AES-128 encryptin algrithm befre it will be sent t the backend server. This dcument describes the hardware and sftware design f the ACR3x and the list f cmmands it uses t cmmunicate with the mbile device Definitins f Terms Abbreviatin ACS Secret Key AES AES Key Custm ID Custmer Master Key Device ID Master Reset MReset Sessin Key Sessin Key TDES Descriptin Key used t perfrm Master Reset authenticatin. This key cannt be mdified thrugh cmmand messages and is hard cded in the firmware. This key must be kept securely by ACS nly. Advanced Encryptin Standard The key used t encrypt the magnetic stripe track data using AES-128 CBC cipher mde. This key can be mdified by the custmer. 10 bytes f identificatin cde set by custmer. This ID can be mdified by the custmer. The key being kept by the custmer t perfrm authenticatin with ACR3x befre the injectin f AES Key, new Custmer Master Key, Custm ID and DUKPT ptin, as well as perfrming DUKPT initializatin. This key can be mdified by the custmer 8 bytes f unique identificatin cde f the MCU used in ACR3x. Custmer can use this ID t derive the Custm ID r DUKPT initializatin data. This ID cannt be mdified by any means and is hard cded inside the MCU by the MCU manufacturer. This term is equivalent t factry reset. By perfrming a Master Reset, all the data stred in the flash memry will be erased and set t default values Key being created uniquely after each success mutual authenticatin fr Master Reset Key being created uniquely after each success mutual authenticatin fr sensitive data injectin Triple Data Encryptin Standard Table 1: Definitins f Terms Page 6 f 81

7 2.0. Features 2.1. ACR mm Audi Jack Interface Pwer Surce: Pwered by a CR2016 battery Magnetic Stripe Card Reader: Reads up t tw tracks f card data Capable f bi-directinal reading Supprts AES-128 encryptin algrithm Supprts DUKPT Key Management System Supprts ISO 7810/7811 magnetic cards Supprts Hi-cercivity and Lw-cercivity magnetic cards Supprts JIS1 and JIS2 Supprts Andrid 2.3 and later 1 Supprts ios 5.0 and later 2 Cmpliant with the fllwing standards: CE FCC VCCI RHS 2 REACH 1 Uses an ACS-defined Andrid Library 2 Uses an ACS-defined ios Library Nte: Visit fr the list f supprted devices. Page 7 f 81

8 2.2. ACR mm Audi Jack Interface USB Full Speed Interface Pwer Surce: Pwered by a Lithium-in battery (rechargeable thrugh Micr-USB Prt) USB Pwered (PC-linked mde) Plug and Play CCID supprt brings utmst mbility Smart Card Reader: Cntact Interface: Supprts ISO 7816 Class A, B, and C (5 V, 3 V, 1.8 V) cards Supprts micrprcessr cards with T=0 and T=1 prtcl Supprts memry cards Supprts PPS (Prtcl and Parameters Selectin) Features Shrt Circuit Prtectin Magnetic Stripe Card Reader: Reads up t tw tracks f card data Capable f bi-directinal reading Supprts AES-128 encryptin algrithm Supprts DUKPT Key Management System Supprts ISO 7810/7811 magnetic cards Supprts Hi-cercivity and Lw-cercivity magnetic cards Supprts JIS1 and JIS2 Applicatin Prgramming Interface: Supprts PC/SC Supprts CT-API (thrugh wrapper n tp f PC/SC) Supprts Andrid 2.0 and later 3 Supprts ios 5.0 and later 4 Cmpliant with the fllwing standards: EN 60950/IEC ISO 7816 ISO 7811 EMV Level 1 (Cntact) PC/SC CCID CE FCC RHS 2 REACH VCCI (Japan) KC (Krea) Micrsft WHQL 3 Uses an ACS-defined Andrid Library; PC/SC and CCID supprt are nt applicable 4 Uses an ACS-defined ios Library; PC/SC and CCID supprt are nt applicable Nte: Visit fr the list f supprted devices. Page 8 f 81

9 2.3. ACR mm Audi Jack Interface Pwer Surce: Pwered by a Lithium-in battery (rechargeable thrugh USB cable) Smart Card Reader: Cntactless Interface: Built-in antenna fr cntactless tag access, with reading distance f up t 30 mm (depending n tag type) Supprts ISO Part 4 Type A and B cards, MIFARE, FeliCa, and all 4 types f NFC (ISO/IEC 18092) tags 5 Built-in anti-cllisin feature (nly ne tag is accessed at any time) NFC Supprt: Card reader/writer mde Magnetic Stripe Card Reader: Reads up t tw tracks f card data Capable f bi-directinal reading Supprts AES-128 encryptin algrithm Supprts DUKPT Key Management System Supprts ISO 7810/7811 magnetic cards Supprts Hi-cercivity and Lw-cercivity magnetic cards Supprts JIS1 and JIS2 Supprts Andrid 2.0 and later 6 Supprts ios 5.0 and later 7 Cmpliant with the fllwing standards: EN 6095/IEC ISO ISO ISO 7811 CE FCC RHS 2 REACH VCCI (Japan) 5 Tpaz type is excluded. Please cntact ACS fr mre details. 6 Uses an ACS-defined Andrid Library 7 Uses an ACS-defined ios Library Nte: Visit fr the list f supprted devices. Page 9 f 81

10 3.0. Supprted Cards 3.1. Magnetic Cards ACR3x perates with ISO 7810/7811 magnetic cards with Hi-cercivity and Lw-cercivity Cntact Smart Cards MCU Cards ACR3201 is a PC/SC-cmpliant smart card reader that supprts ISO 7816 Class A, B and C (5 V, 3 V, and 1.8 V) smart cards. It als wrks with MCU cards fllwing either the T=0 and T=1 prtcl. The card ATR indicates the specific peratin mde (TA2 present; bit 5 f TA2 must be 0) and when that particular mde is nt supprted by the ACR3201, it will reset the card t negtiable mde. If the card cannt be set t negtiable mde, the reader will then reject the card. When the card ATR indicates the negtiable mde (TA2 nt present) and cmmunicatin parameters ther than the default parameters, the ACR3201 will execute the PPS and try t use the cmmunicatin parameters that the card suggested in its ATR. If the card des nt accept the PPS, the reader will use the default parameters (F=372, D=1). Fr the meaning f the afrementined parameters, please refer t ISO Memry-based Cntact Smart Cards ACR3201 wrks with several memry-based cntact smart cards such as: Cards fllwing the I2C bus prtcl (free memry cards) with maximum 128-byte page with capability, including: Atmel : AT24C01/02/04/08/16/32/64/128/256/512/1024 SGS-Thmsn: ST14C02C, ST14C04C Gemplus: GFM1K, GFM2K, GFM4K, GFM8K Cards with secure memry IC with passwrd and authenticatin, including: Atmel : AT88SC153 and AT88SC1608 Cards with intelligent 1 KB EEPROM with write-prtect functin, including: Infinen : SLE4418, SLE4428, SLE5518 and SLE5528 Cards with intelligent 256-byte EEPROM with write-prtect functin, including: Infinen : SLE4432, SLE4442, SLE5532 and SLE5542 Cards with 104 type EEPROM nn-reladable tken cunter cards, including: Infinen : SLE4406, SLE4436, SLE5536 and SLE6636 Cards with intelligent 416-bit EEPROM with internal PIN check, including: Infinen : SLE4404 Cards with Security Lgic with Applicatin Zne(s), including: Atmel : AT88SC101, AT88SC102 and AT88SC1003 Page 10 f 81

11 3.3. Cntactless Smart Cards ACR35 wrks with varius cntactless cards and tags such as: ISO Type A cards ISO Type B cards ISO/IEC (NFC) cards MIFARE Classic 1K/4K FeliCa MIFARE Ultralight MIFARE Ultralight C MIFARE DESFire EV1 Page 11 f 81

12 4.0. System Blck Design 4.1. ACR31 ISO7810/7811 Magnetic Head Magnetic Stripe Decder IC Pwer Management Phne Jack MCU Mbile Device Battery ACR31 Figure 1: ACR31 Architecture Page 12 f 81

13 4.2. ACR3201 ISO7810/7811 ISO7816 Magnetic Head ACR3901 Smart Card Reader IC Magnetic Stripe Decder IC Phne Jack MCU Mbile Device Pwer Management Re-chargeable Battery ACR32 Figure 2: ACR3201 Architecture Page 13 f 81

14 4.3. ACR35 ISO7810/ MHz frequency Magnetic Head Built-in Antenna Magnetic Stripe Decder IC ACR1251 RF chip Phne Jack MCU Mbile Device Pwer Management Re-chargeable Battery ACR35 Figure 3: ACR35 Architecture Page 14 f 81

15 5.0. Hardware Design 5.1. Battery ACR31 is using a CR2016 battery which has a capacity f 90 mah. On the ther hand, ACR3201 and ACR35 are using a rechargeable Lithium-in battery which has a capacity f 200 mah Status LED The different LED clrs indicate the different states f ACR3201 and ACR35, where: Green LED Operatinal Red LED Battery status 5.3. Micr USB Interface The Micr USB prt is used fr cnnecting the ACR3201 and ACR35 t the cmputer as battery charging prt. This prt is als used fr rdering the ACR3201 t act as a PC-linked reader Audi Channel Cmmunicatin Parameters ACR3x is cnnected t a mbile device thrugh Audi Channel. Pin Signal Functin 1 Left Transmit the data t ACR3x 2 Right Wake up device signal 3 GND GND 4 MIC Transmit the data t smart phne Table 2: 3.5 mm Audi Scket Wiring 5.5. Magnetic Stripe Card Interface ACR3x can read any magnetic stripe card that cnfrms t ISO 7810/7811 standards. ISO 7810 specifies the physical characteristics f the card, while ISO 7811 specifies the recrding technique used in identificatin cards. High-cercivity (Hi-C) magnetic stripes are typically black in clr and are encded with a strnger magnetic field (2750 Oersted). This makes Hi-C cards mre durable because the data encded n the stripes are less likely t be unintentinally erased when expsed t an utside magnetic field. When swiped acrss the magnetic head, Hi-C magnetic stripes can induce larger signal pulses and are mre easily detected and decded. Lw-cercivity (L-C) magnetic stripes are generally brwn in clr and are encded with lwer magnetic field intensity (300 Oersted). They will induce small signal pulses cmpared t Hi-C cards when swiped acrss the magnetic head. As a result, the Signal-Nise (S/N) rati is relatively lw and they are mre vulnerable t nise interference. A mre sphisticated hardware supprt and signal prcessing algrithm are needed t decde the signal crrectly. Since the magnetic fields f Hi-C and L-C cards are different, a magnetic stripe decder IC with autmatic gain cntrl can be used in the design t cater these tw types f cards. Page 15 f 81

16 5.6. Cntact Smart Card Interface The interface between the ACR3201 and the inserted smart card fllws the specificatin f ISO with certain restrictins r enhancements t increase the practical functinality f ACR Smart Card Pwer Supply VCC (C1) The current cnsumptin f the inserted card must nt be higher than 50 ma Prgramming Vltage VPP (C6) Accrding t ISO , the smart card cntact C6 (VPP) supplies the prgramming vltage t the smart card. Since all cmmn smart cards in the market are EEPROM-based and d nt require the prvisin f an external prgramming vltage, the cntact C6 (VPP) has been implemented as a nrmal cntrl signal in the ACR3201. The electrical specificatins f this cntact are identical t thse f the signal RST (at cntact C2) Card Type Selectin The cntrlling PC must always select the card type thrugh the prper cmmand sent t the ACR3201 prir t activating the inserted card. This includes bth the memry cards and MCU-based cards. Fr MCU-based cards, the reader allws t select the preferred prtcl, T=0 r T=1. Hwever, this selectin is nly accepted and carried ut by the reader thrugh the PPS when the card inserted in the reader supprts bth prtcl types. Whenever an MCU-based card supprts nly ne prtcl type, T=0 r T=1, the reader autmatically uses that prtcl type, regardless f the prtcl type selected by the applicatin Interface fr Micrcntrller-based Cards Fr micrcntrller-based smart cards, nly the cntacts C1 (VCC), C2 (RST), C3 (CLK), C5 (GND) and C7 (I/O) are used. A frequency f 4 MHz is applied t the CLK signal (C3) Card Tearing Prtectin The ACR3201 prvides a mechanism t prtect the inserted card when it is suddenly withdrawn while it is pwered up. The pwer supply t the card and the signal lines between the ACR3201 and the card is immediately deactivated when the card is being remved. Hwever, as a rule t avid any electrical damage, a card shuld nly be remved frm the reader while it is pwered dwn. Nte: The ACR3201 never switches n the pwer supply t the inserted card by itself. The cntrlling cmputer thrugh the prper cmmand sent t the reader must explicitly d this. Page 16 f 81

17 6.0. Cmmunicatin Prtcl ACR3x is a slave device and almst all peratins are initiated by the mbile device. The mbile device that sends the cmmand is carried ut in the frm f successive cmmand request-respnse exchange. Additinally, the new request message shuld wait until previus respnse message has been received ACR3x will cmmunicate with a mbile device thrugh its audi jack interface. The cmmunicatin channel is bi-directinal, with the reader sending data t the mbile device thrugh the MIC pin f the audi jack while the mbile device sending cmmands t the reader thrugh the Right-Channel f the audi jack. While it is nt perating, the ACR3x will remain in deep sleep mde. Upn receiving a wake up signal frm the mbile device thrugh the Left-Channel f the audi jack, the ACR3x will wake up and send back an acknwledgement signal t the mbile device. ACR3x will then wait fr the swipe f the magnetic stripe card within a timeut limit. After successfully btaining the data frm the swiped card, the ACR3x will perfrm AES-128 encryptin n the received card data and send back the encrypted data t the mbile device in cmmunicatin. If the reader fails t btain a card swipe r cmmand message within the timeut limit, the ACR3x will send back the crrespnding status t the mbile device. After which, ACR3x will g back t deep sleep mde t save battery pwer. Befre the cmmunicatin prtcl between the ACR3x and the mbile device emply a direct signal feeding, the signal received frm the ACR3x will be passing thrugh a DC ffset cancellatin filter. The data t be transmitted will be encded using the Manchester cding scheme (cnfrms t IEEE 802.3), with the clck frequency used in the Manchester cding scheme being set at 10 khz. Since the data transmissin speed in the Manchester cding scheme always matches the clck speed, a maximum baud rate f arund 10 Kbps culd be achieved. The signal interpretatin n the mbile device and ACR3x is based n sampling the crrespnding input wavefrms. The sampling frequency shuld be at least duble the clck frequency (Nyquist rate) used in the Manchester cding scheme. After sampling the signals, the data encded in the signals culd be received by determining the lgical zer-crssing time. Page 17 f 81

18 7.0. Applicatin Prgramming Interface Please refer t the HTML files included in the ACR3x Andrid Library r ACR3x ios Library. The libraries may be dwnladed frm ACS website. Page 18 f 81

19 8.0. Cntact Card Cmmands This sectin cntains the memry card cmmand set fr ACR Memry Card 1, 2, 4, 8, and 16 kilbit I2C Card SELECT_CARD_TYPE This cmmand pwers dwn and up the selected card inserted in the card reader and perfrms a card reset. Nte: This cmmand can nly be used after the lgical smart card reader cmmunicatin has been established using the SCardCnnect( ) API. Fr details f SCardCnnect( ) API, please refer t PC/SC specificatin. Cmmand Frmat Pseud-APDU CLA INS P1 P2 Lc Card Type FFh A4h 00h 00h 01h 01h Respnse Data Frmat = 90 00h if n errr SELECT_PAGE_SIZE This cmmand chses the page size t read the smart card. The default value is 8-byte page write. It will reset t default value whenever the card is remved r the reader is pwered ff. Cmmand Frmat Pseud-APDU CLA INS P1 P2 Lc Page Size FFh 01h 00h 00h 01h Page size = 03h fr 8-byte page write = 04h fr 16-byte page write = 05h fr 32-byte page write = 06h fr 64-byte page write = 07h fr 128-byte page write Page 19 f 81

20 Respnse Data Frmat = 90 00h if n errr READ_MEMORY_CARD Cmmand Frmat Pseud-APDU CLA INS Byte Address MSB LSB MEM_L FFh B0h Byte Address MEM_L Memry address lcatin f the memry card Length f data t be read frm the memry card Respnse Data Frmat BYTE 1 BYTE N BYTE x Data read frm memry card = 90 00h if n errr WRITE_MEMORY_CARD Cmmand Frmat CLA FFh INS D0h Pseud-APDU Byte Address MEM_L Byte 1... Byte n MSB LSB Byte Address Memry address lcatin f the memry card MEM_L Length f data t be written t the memry card Byte x Data t be written t the memry card Page 20 f 81

21 Respnse Data Frmat = 90 00h if n errr Page 21 f 81

22 8.2. Memry Card 32, 64, 128, 256, 512, and 1024 kilbit I2C Card SELECT_CARD_TYPE This cmmand pwers dwn and up the selected card that is inserted in the card reader and perfrms a card reset. Nte: This cmmand can nly be used after the lgical smart card reader cmmunicatin has been established using the SCardCnnect( ) API. Fr details f SCardCnnect( ) API, please refer t PC/SC specificatins. Cmmand Frmat Pseud-APDU CLA INS P1 P2 Lc Card Type FFh A4h 00h 00h 01h 02h Respnse Data Frmat = 90 00h if n errr SELECT_PAGE_SIZE This cmmand chses the page size t read the smart card. The default value is 8-byte page write. It will reset t default value whenever the card is remved r the reader is pwered ff. Cmmand Frmat Pseud-APDU CLA INS P1 P2 Lc Page size FFh 01h 00h 00h 01h Data Page size TPDU t be sent t the card = 03h fr 8-byte page write = 04h fr 16-byte page write = 05h fr 32-byte page write = 06h fr 64-byte page write = 07h fr 128-byte page write Page 22 f 81

23 Respnse Data Frmat = 90 00h if n errr READ_MEMORY_CARD Cmmand Frmat Pseud-APDU CLA INS Byte Address MSB LSB MEM_L FFh INS Byte Address MEM_L = B0h fr 32, 64, 128, 256, 512 kilbit iic card = *b fr 1024 kilbit iic card, where * is the MSB f the 17 bit addressing Memry address lcatin f the memry card Length f data t be read frm the memry card Respnse Data Frmat BYTE 1 BYTE N BYTE x Data read frm memry card = 90 00h if n errr WRITE_MEMORY_CARD Cmmand Frmat CLA FFh INS INS Pseud-APDU Byte Address MEM_L Byte 1... Byte n MSB LSB = D0h fr 32, 64, 128, 256, 512 kilbit iic card = *b fr 1024 kilbit iic card, where * is the MSB f the 17 bit addressing Page 23 f 81

24 Byte Address MEM_L Byte x Memry address lcatin f the memry card Length f data t be written t the memry card Data t be written t the memry card Respnse Data Frmat = 90 00h if n errr Page 24 f 81

25 8.3. Memry Card Atmel AT88SC SELECT_CARD_TYPE This cmmand pwers up and dwn the selected card that is inserted in the card reader and perfrms a card reset. It will als select the page size t be 8-byte page write. Nte: This cmmand can nly be used after the lgical smart card reader cmmunicatin has been established using the SCardCnnect( ) API. Fr details f SCardCnnect( ) API, please refer t PC/SC specificatins. Cmmand Frmat Pseud-APDU CLA INS P1 P2 Lc Card Type FFh A4h 00h 00h 01h 03h Respnse Data Frmat = 90 00h if n errr READ_MEMORY_CARD Cmmand Frmat Pseud-APDU CLA INS P1 Byte Address MEM_L FFh 00h INS Byte Address MEM_L = B0h fr reading zne 00b = B1h fr reading zne 01b = B2h fr reading zne 10b = B3h fr reading zne 11b = B4h fr reading fuse Memry address lcatin f the memry card Length f data t be read frm the memry card Page 25 f 81

26 Respnse Data Frmat BYTE 1 BYTE N BYTE x Data read frm memry card = 90 00h if n errr WRITE_MEMORY_CARD Cmmand Frmat Pseud-APDU CLA INS P1 Byte Address MEM_L Byte 1... Byte n FFh 00h INS Byte Address MEM_L MEM_D = D0h fr writing zne 00b = D1h fr writing zne 01b = D2h fr writing zne 10b = D3h fr writing zne 11b = D4h fr writing fuse Memry address lcatin f the memry card Length f data t be written t the memry card Data t be written t the memry card Respnse Data Frmat = 90 00h if n errr Page 26 f 81

27 VERIFY_PASSWORD Cmmand Frmat Pseud-APDU CLA INS P1 P2 Lc Pw(0) Pw(1) Pw(2) FFh 20h 00h 03h Pw(0),Pw(1),Pw(2) P2 Passwrds t be sent t memry card = rpb where the tw bits rp indicate the passwrd t cmpare r = 0: Write passwrd, r = 1: Read passwrd, p: Passwrd set number, rp = 01 fr the secure cde. Respnse Data Frmat ErrrCnt 90h (ErrrCnt) = 90h Errr Cunter. FFh indicates the verificatin is crrect. 00h indicates the passwrd is lcked (r exceeded the maximum number f retries). Other values indicate the current verificatin has failed INITIALIZE_AUTHENTICATION Cmmand Frmat Pseud-APDU CLA INS P1 P2 Lc Q(0) Q(1) Q(7) FFh 84h 00h 00h 08h Q(0),Q(1) Q(7) Hst randm number, 8 bytes Respnse Data Frmat = 90 00h if n errr Page 27 f 81

28 VERIFY_AUTHENTICATION Cmmand Frmat Pseud-APDU CLA INS P1 P2 Lc Ch(0) Ch(1) Ch(7) FFh 82h 00h 00h 08h Ch(0),Ch(1) Ch(7) Hst challenge, 8 bytes Respnse Data Frmat = 90 00h if n errr Page 28 f 81

29 8.4. Memry Card Atmel AT88C SELECT_CARD_TYPE This cmmand pwers dwn and up the selected card that is inserted in the card reader and perfrms a card reset. It will als select the page size t be 16-byte page write. Nte: This cmmand can nly be used after the lgical smart card reader cmmunicatin has been established using the SCardCnnect( ) API. Fr details f SCardCnnect( ) API, please refer t PC/SC specificatins. Cmmand Frmat Pseud-APDU CLA INS P1 P2 Lc Card Type FFh A4h 00h 00h 01h 04h Respnse Data Frmat = 90 00h if n errr READ_MEMORY_CARD Cmmand Frmat Pseud-APDU CLA INS Zne Address Byte Address MEM_L FFh INS Zne Address Byte Address MEM_L = B0h fr reading user zne = B1h fr reading cnfiguratin zne r reading fuse = A10A9A8b where A10 is the MSB f zne address = Dn t care fr reading fuse = A7A6A5A4 A3A2A1A0b is the memry address lcatin f the memry card = b fr reading fuse Length f data t be read frm the memry card Page 29 f 81

30 Respnse Data Frmat BYTE 1 BYTE N BYTE x Data read frm memry card = 90 00h if n errr WRITE_MEMORY_CARD Cmmand Frmat Pseud-APDU CLA INS Zne Address Byte Address MEM_L Byte 1 Byte n FFh INS Zne Address Byte Address MEM_L Byte x = D0h fr writing user zne = D1h fr writing cnfiguratin zne r writing fuse = A10A9A8b where A10 is the MSB f zne address = Dn t care fr writing fuse = A7A6A5A4 A3A2A1A0b is the memry address lcatin f the memry card = b fr writing fuse Length f data t be written t the memry card Data t be written t the memry card Respnse Data Frmat = 90 00h if n errr Page 30 f 81

31 VERIFY_PASSWORD Cmmand Frmat Pseud-APDU CLA INS P1 P2 Lc Data FFh 20h 00h 00h 04h RP Pw(0) Pw(1) Pw(2) Pw(0),Pw(1),Pw(2) RP Passwrds t be sent t memry card = 0000 rp2p1p0b where the fur bits rp2p1p0 indicate the passwrd t cmpare: r = 0 : Write passwrd, r = 1 : Read passwrd, p2p1p0 : Passwrd set number. (rp2p1p0 = 0111 fr the secure cde) Respnse Data Frmat ErrrCnt 90h (ErrrCnt) = 90h = Errr Cunter. FFh indicates the verificatin is crrect. 00h indicates the passwrd is lcked (r exceeded the maximum number f retries). Other values indicate the current verificatin has failed INITIALIZE_AUTHENTICATION Cmmand Frmat Pseud-APDU CLA INS P1 P2 Lc Q(0) Q(1) Q(7) FFh 84h 00h 00h 08h Byte Address Q(0),Q(1) Q(7) Memry address lcatin f the memry card Hst randm number, 8 bytes Page 31 f 81

32 Respnse Data Frmat = 90 00h if n errr VERIFY_AUTHENTICATION Cmmand Frmat Pseud-APDU CLA INS P1 P2 Lc Q1(0) Q1(1) Q1(7) FFh 82h 00h 00h 08h Byte Address Q1(0),Q1(1) Q1(7) Memry address lcatin f the memry card Hst challenge, 8 bytes Respnse Data Frmat = 90 00h if n errr Page 32 f 81

33 8.5. Memry Card SLE4418/SLE4428/SLE5518/SLE SELECT_CARD_TYPE This cmmand pwers dwn and up the selected card that is inserted in the card reader and perfrms a card reset. Nte: This cmmand can nly be used after the lgical smart card reader cmmunicatin has been established using the SCardCnnect( ) API. Fr details f SCardCnnect( ) API, please refer t PC/SC specificatins. Cmmand Frmat Pseud-APDU CLA INS P1 P2 Lc Card Type FFh A4h 00h 00h 01h 05h Respnse Data Frmat = 90 00h if n errr READ_MEMORY_CARD Cmmand Frmat Pseud-APDU CLA INS Byte Address MSB LSB MEM_L FFh B0h MSB Byte Address LSB Byte Address MEM_L = A9A8b is the memry address lcatin f the memry card = A7A6A5A4 A3A2A1A0b is the memry address lcatin f the memry card Length f data t be read frm the memry card Respnse Data Frmat BYTE 1 BYTE N BYTE x Data read frm memry card = 90 00h if n errr Page 33 f 81

34 READ_PRESENTATION_ERROR_COUNTER_MEMORY_CARD (SLE4428 and SLE5528) This cmmand is used t read the presentatin errr cunter fr the secret cde. Cmmand Frmat Pseud-APDU CLA INS P1 P2 MEM_L FFh B1h 00h 00h 03h Respnse Data Frmat ERRCNT DUMMY 1 DUMMY 2 ERRCNT DUMMY Errr Cunter. FFh indicates that the last verificatin is crrect. 00h indicates that the passwrd is lcked (exceeded the maximum number f retries). Other values indicate that the last verificatin has failed. Tw bytes dummy data read frm the card = 90 00h if n errr READ_PROTECTION_BIT Cmmand Frmat Pseud-APDU CLA INS Byte Address MSB LSB MEM_L FFh B2h MSB Byte Address LSB Byte Address = A9A8b is the memry address lcatin f the memry card = A7A6A5A4 A3A2A1A0b is the memry address lcatin f the memry card MEM_L Length f prtectin bits t be read frm the card, in multiples f 8 bits. Maximum value is 32. MEM_L = 1 + INT( (number f bits - 1)/8 ) Fr example, t read 8 prtectin bits starting frm memry 0010h, the fllwing pseud-apdu shuld be issued: FF B h Page 34 f 81

35 Respnse Data Frmat PROT 1 PROT L PROT y Bytes cntaining the prtectin bits = 90 00h if n errr The arrangement f the prtectin bits in the PROT bytes is as fllws: PROT 1 PROT 2 P8 P7 P6 P5 P4 P3 P2 P1 P16 P15 P14 P13 P12 P11 P10 P P18 P17 Px is the prtectin bit f BYTE x in the respnse data 0 byte is write prtected 1 byte can be written WRITE_MEMORY_CARD Cmmand Frmat CLA FFh INS D0h Pseud-APDU Byte Address MEM_L Byte 1... Byte N MSB LSB MSB Byte Address LSB Byte Address MEM_L Byte x = A9A8b is the memry address lcatin f the memry card = A7A6A5A4 A3A2A1A0b is the memry address lcatin f the memry card Length f data t be written t the memry card Data t be written t the memry card Respnse Data Frmat = 90 00h if n errr Page 35 f 81

36 WRITE_PROTECTION_MEMORY_CARD Each byte specified in the cmmand is used in the card t cmpare the byte stred in a specified address lcatin. If the data match, the crrespnding prtectin bit is irreversibly prgrammed t 0. Cmmand Frmat CLA FFh INS D1h Pseud-APDU Byte Address MEM_L Byte 1... Byte N MSB LSB MSB Byte Address LSB Byte Address MEM_L Byte x = A9A8b is the memry address lcatin f the memry card = A7A6A5A4 A3A2A1A0b is the memry address lcatin f the memry card Length f data t be written t the memry card Byte values t be cmpared with the data in the card starting at Byte Address. BYTE 1 is cmpared with the data at Byte Address; BYTE N is cmpared with the data at (Byte Address+N-1). Respnse Data Frmat = 90 00h if n errr PRESENT_CODE_MEMORY_CARD (SLE4428 and SLE5528) This cmmand is used t submit the secret cde t the memry card t enable the write peratin with the SLE4428 and SLE5528 card, the fllwing actins are executed: 1. Search a 1 bit in the presentatin errr cunter and write the bit t Present the specified cde t the card. 3. Try t erase the presentatin errr cunter. Cmmand Frmat Pseud-APDU CLA INS P1 P2 MEM_L FFh 20h 00h 00h 02h CODE Byte 1 Byte 2 CODE Tw bytes secret cde (PIN) Page 36 f 81

37 Respnse Data Frmat ErrrCnt 90h (ErrrCnt) = 90h = Errr Cunter. FFh indicates successful verificatin. 00h indicates that the passwrd is lcked (r exceeded the maximum number f retries). Other values indicate that current verificatin has failed. Page 37 f 81

38 8.6. Memry Card SLE4432/SLE4442/SLE5532/SLE SELECT_CARD_TYPE This cmmand pwers dwn and up the selected card that is inserted in the card reader and perfrms a card reset. Nte: This cmmand can nly be used after the lgical smart card reader cmmunicatin has been established using the SCardCnnect( ) API. Fr details f SCardCnnect( ) API, please refer t PC/SC specificatins. Cmmand Frmat Pseud-APDU CLA INS P1 P2 Lc Card Type FFh A4h 00h 00h 01h 06h Respnse Data Frmat = 90 00h if n errr READ_MEMORY_CARD Cmmand Frmat Pseud-APDU CLA INS P1 Byte Address MEM_L FFh B0h 00h Byte Address = A7A6A5A4 A3A2A1A0b is the memry address lcatin f the memry card MEM_L Length f data t be read frm the memry card Respnse Data Frmat BYTE 1 BYTE N BYTE x Data read frm memry card = 90 00h if n errr Page 38 f 81

39 READ_PRESENTATION_ERROR_COUNTER_MEMORY_CARD (SLE4442 and SLE5542) This cmmand is used t read the presentatin errr cunter fr the secret cde. Cmmand Frmat Pseud-APDU CLA INS P1 P2 MEM_L FFh B1h 00h 00h 04h Respnse Data Frmat ERRCNT DUMMY 1 DUMMY 2 DUMMY 3 ERRCNT DUMMY Errr cunter. 07h indicates that the last verificatin is crrect. 00h indicates that the passwrd is lcked (exceeded the maximum number f retries). Other values indicate that the last verificatin has failed. Three bytes dummy data read frm the card = 90 00h if n errr READ_PROTECTION_BITS This cmmand is used t read the prtectin bits fr the first 32 bytes. Cmmand Frmat Pseud-APDU CLA INS P1 P2 MEM_L FFh B2h 00h 00h 04h Respnse Data Frmat PROT 1 PROT 2 PROT 3 PROT 4 PROT y Bytes cntaining the prtectin bits frm prtectin memry = 90 00h if n errr Page 39 f 81

40 The arrangement f the prtectin bits in the PROT bytes is as fllws: PROT 1 PROT 2 P8 P7 P6 P5 P4 P3 P2 P1 P16 P15 P14 P13 P12 P11 P10 P P18 P17 Px is the prtectin bit f BYTE x in the respnse data 0 byte is write prtected 1 byte can be written WRITE_MEMORY_CARD Cmmand Frmat Pseud-APDU CLA INS P1 Byte Address MEM_L Byte 1... Byte N FFh D0h 00h Byte Address MEM_L Byte x = A7A6A5A4 A3A2A1A0b is the memry address lcatin f the memry card Length f data t be written t the memry card Data t be written t the memry card Respnse Data Frmat = 90 00h if n errr WRITE_PROTECTION_MEMORY_CARD Each byte specified in the cmmand is internally in the card cmpared with the byte stred at the specified address and if the data match, the crrespnding prtectin bit is irreversibly prgrammed t 0. Cmmand Frmat Pseud-APDU CLA INS P1 Byte Address MEM_L Byte 1... Byte N FFh D1h 00h Byte Address MEM_L = 000A4 A3A2A1A0b (00h t 1Fh) is the prtectin memry address lcatin f the memry card Length f data t be written t the memry card Page 40 f 81

41 Byte x Byte values t be cmpared with the data in the card starting at Byte Address. BYTE 1 is cmpared with the data at Byte Address; BYTE N is cmpared with the data at (Byte Address + N-1). Respnse Data Frmat = 90 00h if n errr PRESENT_CODE_MEMORY_CARD (SLE4442 and SLE5542) T submit the secret cde t the memry card t enable the write peratin with the SLE4442 and SLE5542 card, the fllwing actins are executed: 1. Search a 1 bit in the presentatin errr cunter and write the bit t Present the specified cde t the card. 3. Try t erase the presentatin errr cunter. Cmmand Frmat Pseud-APDU CODE CLA INS P1 P2 MEM_L Byte 1 Byte 2 Byte 3 FFh 20h 00h 00h 03h CODE Three bytes secret cde (PIN) Respnse Data Frmat ErrrCnt 90h (ErrrCnt) = 90h = Errr Cunter. 07h indicates that the verificatin is crrect. 00h indicates the passwrd is lcked (exceeded the maximum number f retries). Other values indicate that the current verificatin has failed. Page 41 f 81

42 CHANGE_CODE_MEMORY_CARD (SLE4442 and SLE5542) This cmmand is used t write the specified data as new secret cde in the card. The current secret cde must be presented t the card with the PRESENT_CODE cmmand prir t the executin f this cmmand. Cmmand Frmat Pseud-APDU CODE CLA INS P1 P2 MEM_L Byte 1 Byte 2 Byte 3 FFh D2h 00h 01h 03h Respnse Data Frmat = 90 00h if n errr Page 42 f 81

43 8.7. Memry Card SLE4406/SLE4436/SLE5536/SLE SELECT_CARD_TYPE This cmmand pwers dwn and up the selected card that is inserted in the card reader and perfrms a card reset. Nte: This cmmand can nly be used after the lgical smart card reader cmmunicatin has been established using the SCardCnnect( ) API. Fr details f SCardCnnect( ) API, please refer t PC/SC specificatins. Cmmand Frmat Pseud-APDU CLA INS P1 P2 Lc Card Type FFh A4h 00h 00h 01h 07h Respnse Data Frmat = 90 00h if n errr READ_MEMORY_CARD Cmmand Frmat Pseud-APDU CLA INS P1 Byte Address MEM_L FFh B0h 00h Byte Address MEM_L = Memry address lcatin f the memry card Length f data t be read frm the memry card Respnse Data Frmat BYTE 1 BYTE N BYTE x Data read frm memry card = 90 00h if n errr Page 43 f 81

44 WRITE_ONE_BYTE_MEMORY_CARD This cmmand is used t write ne byte t the specified address f the inserted card. The byte is written t the card with LSB first, i.e., the bit at card address 0 is regarded as the LSB f byte 0. Fur different WRITE mdes are available fr this card type, which are distinguished by a flag in the cmmand data field: a) Write The byte value specified in the cmmand is written t the specified address. This cmmand can be used fr writing persnalizatin data and cunter values t the card. b) Write with carry The byte value specified in the cmmand is written t the specified address and the cmmand is sent t the card t erase the next lwer cunter stage. Thus, this write mde can nly be used fr updating the cunter value in the card. c) Write with backup enabled (SLE4436, SLE5536 and SLE6636 nly) The byte value specified in the cmmand is written t the specified address. This cmmand can be used fr writing persnalizatin data and cunter values t the card. Backup bit is enabled t prevent data lss when card tearing ccurs. d) Write with carry and backup enabled (SLE4436, SLE5536 and SLE6636 nly) The byte value specified in the cmmand is written t the specified address and the cmmand is sent t the card t erase the next lwer cunter stage. Thus, this write mde can nly be used fr updating the cunter value in the card. Backup bit is enabled t prevent data lss when card tearing ccurs. With all write mdes, the byte at the specified card address is nt erased prir t the write peratin and, hence, memry bits can nly be prgrammed frm '1' t '0'. The backup mde available in the SLE4436 and SLE5536 card can be enabled r disabled in the write peratin. Cmmand Frmat Pseud-APDU CLA INS P1 Byte Address MEM_L MODE BYTE FFh D0h 00h 02h Byte Address MODE BYTE = Memry address lcatin f the memry card Specifies the write mde and backup ptin 00h: Write 01h: Write with carry 02h: Write with backup enabled (SLE4436, SLE5536 and SLE6636 nly) 03h: Write with carry and with backup enabled (SLE4436, SLE5536 and SLE6636 nly) Byte value t be written t the card Page 44 f 81

45 Respnse Data Frmat = 90 00h if n errr PRESENT_CODE_MEMORY_CARD T submit the secret cde t the memry card t enable the card persnalizatin mde, the fllwing actins are executed: 1. Search a '1' bit in the presentatin cunter and write the bit t '0'. 2. Present the specified cde t the card. ACR3901x des nt try t erase the presentatin cunter after the cde submissin. This must be dne by the applicatin sftware thrugh a separate Write with carry' cmmand. Cmmand Frmat Pseud-APDU CODE CLA INS P1 P2 MEM_L ADDR Byte 1 Byte 2 Byte 3 FFh 20h 00h 00h 04h 09h ADDR CODE Byte address f the presentatin cunter in the card Three bytes secret cde (PIN) Respnse Data Frmat = 90 00h if n errr AUTHENTICATE_MEMORY_CARD (SLE4436, SLE5536 and SLE6636) T read a card authenticatin certificate frm a SLE5536 r SLE6636 card, the ACR3901x executes the fllwing actins: 1. Select Key 1 r Key 2 in the card as specified in the cmmand. 2. Present the challenge data specified in the cmmand t the card. 3. Generate the specified number f CLK pulses fr each bit f authenticatin data cmputed by the card. 4. Read 16 bits f authenticatin data frm the card. 5. Reset the card t nrmal peratin mde. Page 45 f 81

46 The authenticatin has t be perfrmed in tw steps. The first step is t send the Authenticatin Certificate t the card. The secnd step is t get back tw bytes f authenticatin data calculated by the card. Step 1: Send Authenticatin Certificate t the Card Cmmand Frmat CLA INS P1 P2 MEM_L FFh 84h 00h 00h 08h Pseud-APDU CODE KEY CLK_CNT Byte 1 Byte 2 Byte 5 Byte 6 KEY CLK_CNT BYTE Key t be used fr the cmputatin f the authenticatin certificate: 00h: Key 1 with n cipher blck chaining 01h: Key 2 with n cipher blck chaining 80h: Key 1 with cipher blck chaining (SLE5536 and SLE6636 nly) 81h: Key 2 with cipher blck chaining (SLE5536 and SLE6636 nly) Number f CLK pulses t be supplied t the card fr the cmputatin f each bit f the authenticatin certificate. Typical value is 160 clcks (A0) Card challenge data Respnse Data Frmat 61h 02h = 61 02h if n errr, meaning tw bytes f authenticatin data are ready. The authenticatin data can be retrieved by Get_Respnse cmmand. Step 2: Get back the Authenticatin Data (Get_Respnse) Cmmand Frmat Pseud-APDU CLA INS P1 P2 MEM_L FFh C0h 00h 00h 02h Respnse Data Frmat CERT CERT 16 bits f authenticatin data cmputed by the card. The LSB f BYTE 1 is the first authenticatin bit read frm the card. = 90 00h if n errr Page 46 f 81

47 8.8. Memry Card SLE SELECT_CARD_TYPE This cmmand pwers dwn and up the selected card that is inserted in the card reader and perfrms a card reset. Nte: This cmmand can nly be used after the lgical smart card reader cmmunicatin has been established using the SCardCnnect( ) API. Fr details f SCardCnnect( ) API, please refer t PC/SC specificatins. Cmmand Frmat Pseud-APDU CLA INS P1 P2 Lc Card Type FFh A4h 00h 00h 01h 08h Respnse Data Frmat = 90 00h if n errr READ_MEMORY_CARD Cmmand Frmat Pseud-APDU CLA INS P1 Byte Address MEM_L FFh B0h 00h Byte Address = Memry address lcatin f the memry card MEM_L Length f data t be read frm the memry card Respnse Data Frmat BYTE 1 BYTE N BYTE x Data read frm memry card = 90 00h if n errr Page 47 f 81

48 WRITE_MEMORY_CARD This cmmand is used t write data t the specified address f the inserted card. The byte is written t the card with LSB first, i.e., the bit at card address 0 is regarded as the LSB f byte 0. The byte at the specified card address is nt erased prir t the write peratin and, hence, memry bits can nly be prgrammed frm '1' t '0'. Cmmand Frmat Pseud-APDU CLA INS P1 Byte Address MEM_L Byte 1 Byte N FFh D0h 00h Byte Address MEM_L BYTE = Memry address lcatin f the memry card Length f data t be written t the memry card Byte value t be written t the card Respnse Data Frmat = 90 00h if n errr ERASE_SCRATCH_PAD_MEMORY_CARD This cmmand is used t erase the data f the scratch pad memry f the inserted card. All memry bits inside the scratch pad memry will be prgrammed t the state f 1. T erase errr cunter r user area, please use the VERIFY_USER_CODE cmmand as specified in the Sectin Cmmand Frmat Pseud-APDU CLA INS P1 Byte Address MEM_L FFh D2h 00h 00h Byte Address Memry byte address lcatin f the scratch pad Typical value is 02h Page 48 f 81

49 Respnse Data Frmat = 90 00h if n errr VERIFY_USER_CODE This cmmand is used t submit User Cde (2 bytes) t the inserted card. User Cde is t enable the memry access f the card. The fllwing actins are executed: 1. Present the specified cde t the card. 2. Search a '1' bit in the presentatin errr cunter and write the bit t '0'. 3. Erase the presentatin errr cunter. The User Errr Cunter can be erased when the submitted cde is crrect. Cmmand Frmat Pseud-APDU CLA INS Errr Cunter LEN Byte Address MEM_L FFh 20h 04h 08h 02h CODE Byte 1 Byte 2 Errr Cunter LEN Byte Address CODE Length f presentatin errr cunter in bits Byte address f the key in the card 2 bytes User Cde Respnse Data Frmat = 90 00h if n errr = 63 00h if there are n mre retries Nte: After = 90 00h has been received, read back the User Errr Cunter t check if the VERIFY_USER_CODE is crrect. If User Errr Cunter is erased and is equal t FFh, the previus verificatin is successful. Page 49 f 81

50 VERIFY_MEMORY_CODE This cmmand is used t submit Memry Cde (4 bytes) t the inserted card. Memry Cde is used t authrize the relading f the user memry, tgether with the User Cde. The fllwing actins are executed: 1. Present the specified cde t the card. 2. Search a '1' bit in the presentatin errr cunter and write the bit t '0'. 3. Erase the presentatin errr cunter. Please nte that Memry Errr Cunter cannt be erased. Cmmand Frmat CLA INS Errr Cunter LEN Byte Address Pseud-APDU MEM_L FFh 20h 40h 28h 04h Byte 1 CODE Byte 2 Byte 3 Byte 4 Errr Cunter LEN Byte Address CODE Length f presentatin errr cunter in bits Byte address f the key in the card 4 bytes Memry Cde Respnse Data Frmat = 90 00h if n errr = 63 00h if there are n mre retries Nte: After = 90 00h has been received, read back the Applicatin Area can check if the VERIFY_MEMORY_CODE is crrect. If all data in Applicatin Area is erased and is equal t FFh, the previus verificatin is successful. Page 50 f 81

51 8.9. Memry Card AT88SC101/AT88SC102/AT88SC SELECT_CARD_TYPE This cmmand pwers dwn and up the selected card that is inserted in the card reader and perfrms a card reset. Nte: This cmmand can nly be used after the lgical smart card reader cmmunicatin has been established using the SCardCnnect( ) API. Fr details f SCardCnnect( ) API, please refer t PC/SC specificatins. Cmmand Frmat Pseud-APDU CLA INS P1 P2 Lc Card Type FFh A4h 00h 00h 01h 09h Respnse Data Frmat = 90 00h if n errr READ_MEMORY_CARD Cmmand Frmat Pseud-APDU CLA INS P1 Byte Address MEM_L FFh B0h 00h Byte Address MEM_L = Memry address lcatin f the memry card Length f data t be read frm the memry card Respnse Data Frmat BYTE 1 BYTE N BYTE x Data read frm memry card = 90 00h if n errr Page 51 f 81

52 WRITE_MEMORY_CARD This cmmand is used t write data t the specified address f the inserted card. The byte is written t the card with LSB first, i.e., the bit at card address 0 is regarded as the LSB f byte 0. The byte at the specified card address is nt erased prir t the write peratin and, hence, memry bits can nly be prgrammed frm '1' t '0'. Cmmand Frmat Pseud-APDU CLA INS P1 Byte Address MEM_L Byte 1... Byte N FFh D0h 00h Byte Address MEM_L BYTE Memry address lcatin f the memry card Length f data t be written t the memry card Byte value t be written t the card Respnse Data Frmat = 90 00h if n errr ERASE_NON_APPLICATION_ZONE This cmmand is used t erase the data in Nn-Applicatin Znes. The EEPROM memry is rganized int 16-bit wrds. Althugh erases are perfrmed n single bit, the ERASE peratin clears an entire wrd in the memry. Therefre, perfrming an ERASE n any bit in the wrd will clear ALL 16 bits f that wrd t the state f 1. T erase Errr Cunter r the data in Applicatin Znes, please refer t the fllwing: 1. ERASE_APPLICATION_ZONE_WITH_ERASE cmmand as specified in Sectin ERASE_APPLICATION_ZONE_WITH_WRITE_AND_ERASE cmmand as specified in Sectin VERIFY_SECURITY_CODE cmmands as specified in Sectin Cmmand Frmat Pseud-APDU CLA INS P1 Byte Address MEM_L FFh D2h 00h 00h Byte Address Memry byte address lcatin f the wrd t be erased. Page 52 f 81

53 Respnse Data Frmat = 90 00h if n errr ERASE_APPLICATION_ZONE_WITH_ERASE This cmmand can be used in the fllwing cases: 1. AT88SC101: T erase the data in Applicatin Zne with EC Functin Disabled. 2. AT88SC102: T erase the data in Applicatin Zne AT88SC102: T erase the data in Applicatin Zne 2 with EC2 Functin Disabled. 4. AT88SC1003: T erase the data in Applicatin Zne AT88SC1003: T erase the data in Applicatin Zne 2 with EC2 Functin Disabled. 6. AT88SC1003: T erase the data in Applicatin Zne 3. The fllwing actins are executed fr this cmmand: 1. Present the specified cde t the card a. Erase the presentatin errr cunter. The data in crrespnding Applicatin Zne can be erased when the submitted cde is crrect. Cmmand Frmat CLA INS Errr Cunter LEN FFh 20h 00h Byte Address Pseud-APDU MEM_L CODE Byte 1 Byte 2 Byte N Errr Cunter LEN Byte Address Length f presentatin errr cunter in bits. The value shuld be 00h always. Byte address f the Applicatin Zne Key in the card. Please refer t the table belw fr the crrect value. AT88SC101: Erase Applicatin Zne with EC functin disabled Byte Address 96h LEN 04h AT88SC102: Erase Applicatin Zne 1 56h 06h AT88SC102: Erase Applicatin Zne 2 with EC2 functin disabled 9Ch 04h AT88SC1003: Erase Applicatin Zne 1 36h 06h Page 53 f 81

54 AT88SC1003: Erase Applicatin Zne 2 with EC2 functin disabled Byte Address 5Ch LEN 04h AT88SC1003: Erase Applicatin Zne 3 C0h 06h MEM_L CODE Length f the Erase Key. Please refer t the table abve fr the crrect value. N bytes f Erase Key Respnse Data Frmat = 90 00h if n errr Nte: After = 90 00h has been received, read back the data in Applicatin Zne t check if the ERASE_APPLICATION_ZONE_WITH_ERASE is crrect. If all data in Applicatin Zne is erased and is equal t FFh, the previus verificatin is successful ERASE_APPLICATION_ZONE_WITH_WRITE_AND_ERASE This cmmand can be used in the fllwing cases: 1. AT88SC101: T erase the data in Applicatin Zne with EC Functin Enabled. 2. AT88SC102: T erase the data in Applicatin Zne 2 with EC2 Functin Enabled. 3. AT88SC1003: T erase the data in Applicatin Zne 2 with EC2 Functin Enabled. With EC r EC2 Functin Enabled (that is, ECEN r EC2EN Fuse is undamaged and in 1 state), the fllwing actins are executed: 1. Present the specified cde t the card. 2. Search a '1' bit in the presentatin errr cunter and write the bit t '0'. 3. Erase the presentatin errr cunter. The data in crrespnding Applicatin Zne can be erased when the submitted cde is crrect. Cmmand Frmat CLA INS Errr Cunter LEN Byte Address Pseud-APDU MEM_L FFh 20h 80h 04h CODE Byte 1 Byte 2 Byte 3 Byte 4 Errr Cunter LEN Length f presentatin errr cunter in bits. The value shuld be 80h always. Page 54 f 81

55 Byte Address Byte address f the Applicatin Zne Key in the card AT88SC101 AT88SC102 AT88SC1003 Byte Address 96h 9Ch 5Ch CODE 4 bytes Erase Key Respnse Data Frmat = 90 00h if n errr = 63 00h if there are n mre retries Nte: After = 90 00h has been received, read back the data in Applicatin Zne can check whether the ERASE_APPLICATION_ZONE_WITH_WRITE_AND_ERASE is crrect. If all data in Applicatin Zne is erased and is equal t FFh, the previus verificatin is successful VERIFY_SECURITY_CODE This cmmand is used t submit Security Cde (2 bytes) t the inserted card. Security Cde is t enable the memry access f the card. The fllwing actins are executed: 1. Present the specified cde t the card. 2. Search a '1' bit in the presentatin errr cunter and write the bit t '0'. 3. Erase the presentatin errr cunter. The Security Cde Attempts Cunter can be erased when the submitted cde is crrect. Cmmand Frmat CLA INS Errr Cunter LEN Pseud-APDU Byte Address MEM_L FFh 20h 08h 0Ah 02h CODE Byte 1 Byte 2 Errr Cunter LEN Byte Address CODE Length f presentatin errr cunter in bits Byte address f the key in the card 2 bytes Security Cde Page 55 f 81

56 Respnse Data Frmat = 90 00h if n errr = 63 00h if there are n mre retries Nte: After = 90 00h has been received, read back the Security Cde Attempts Cunter (SCAC) t check whether the VERIFY_USER_CODE is crrect. If SCAC is erased and is equal t FFh, the previus verificatin is successful BLOWN_FUSE This cmmand is used t blw the fuse f the inserted card. The fuse can be EC_EN Fuse, EC2EN Fuse, Issuer Fuse r Manufacturer s Fuse. Nte: The blwing f fuse is an irreversible prcess. Cmmand Frmat CLA INS Errr Cunter LEN Byte Address Pseud-APDU MEM_L Fuse Bit Addr (High) Fuse Bit Addr (Lw) CODE State f FUS Pin FFh 05h 00h 00h 04h 01h State f RST Pin 00h r 01h Fuse Bit Addr (2 bytes) Bit address f the fuse. Please refer t the table belw fr the crrect value. State f FUS Pin State f the FUS pin. Shuld always be 01h. State f RST Pin State f the RST pin. Please refer t belw table fr the crrect value. AT88SC101 AT88SC102 AT88SC1003 Fuse Bit Addr (High) Fuse Bit Addr (Lw) State f RST Pin Manufacturer Fuse 05h 80h 01h EC_EN Fuse 05h C9h 01h Issuer Fuse 05h E0h 01h Manufacturer Fuse 05h B0h 01h EC2EN Fuse 05h F9h 01h Issuer Fuse 06h 10h 01h Manufacturer Fuse 03h F8h 00h EC2EN Fuse 03h FCh 00h Issuer Fuse 03h E0h 00h Page 56 f 81

57 Respnse Data Frmat = 90 00h if n errr Page 57 f 81

58 9.0. Cntactless Card Cmmands This sectin cntains the cntactless card cmmand set fr ACR Pseud APDU fr Cntactless Interface Get Data This cmmand will return the serial number f the ATS f the PICC card. Get UID APDU Frmat (5 bytes) Cmmand Class INS P1 P2 Le 00h 00h Get Data FFh CAh 00h 01h (Max length) If P1=00h, Get UID Respnse Frmat (UID + 2 bytes) Respnse Data Out Result UID (LSB) UID (MSB) If P1 = 01h, Get ATS f an ISO14443 A card (ATS + 2 bytes) Respnse Data Out Result ATS Respnse Cdes Results Meaning Success 90 00h The peratin was cmpleted successfully Warning Errr 62 82h 6C XX Errr 63 00h The peratin failed Errr 6A 81h Functin nt supprted The end f the UID/ATS reached befre LE bytes (Le is greater than UID length) Wrng length (wrng number Le: XX encdes the exact number) if Le is less than the available UID length Examples: //T get the serial number f the PICC card UINT8 GET_UID[5]={FF, CA, 00, 00, 00h}; //T get the ATS f the ISO14443 A cntactless card UINT8 GET_ATS[5]={FF, CA, 01, 00, 00h}; Page 58 f 81

59 9.2. PICC Cmmands (T=CL Emulatin) fr MIFARE Classic 1K/4K Memry Cards Lad Authenticatin Keys This cmmand lads the authenticatin keys t the reader. The authenticatin keys are used t authenticate the particular sectr f the MIFARE Classic (1K/4K) memry card. Tw kinds f authenticatin key lcatins are prvided: vlatile and nn-vlatile key lcatins. Lad Authenticatin Keys APDU Frmat (11 bytes) Cmmand Class INS P1 P2 Lc Data In Lad Authenticatin Keys FFh 82h Key Structure Key Number 06h Key (6 bytes) Key Structure Key Number Key 1 byte. 00h = Key is laded int the reader vlatile memry. Other = Reserved. 1 byte. 00h 01h = Nn-vlatile memry fr string keys. The keys are permanently stred in the reader and will be retained in the reader s memry even if the reader is discnnected frm the PC. It can stre up t 2 keys inside the reader s nn-vlatile memry. Nte: The default value is FF FF FF FF FF FFh. 6 bytes. The key value laded int the reader. Example: FF FF FF FF FF FFh. Lad Authenticatin Keys Respnse Frmat (2 Bytes) Respnse Data Out Result Lad Authenticatin Keys Respnse Cdes Results Meaning Success 90 00h The peratin is cmpleted successfully. Errr 63 00h The peratin is failed. Example: // Lad a key {FF FF FF FF FF FFh} int the vlatile memry lcatin 00h. APDU = {FF FF FF FF FF FF FFh} Page 59 f 81

60 Authenticatin fr MIFARE Classic (1K/4K) This cmmand uses the keys stred in the ACR3x t d authenticatin with the MIFARE Classic (1K/4K) card (PICC). Tw types f authenticatin keys are used: TYPE_A and TYPE_B. Lad Authenticatin Keys APDU Frmat (10 bytes) Cmmand Class INS P1 P2 Lc Data In Authenticatin FFh 86h 00h 00h 05h Authenticate Data Bytes Authenticate Data Bytes (5 bytes): Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Versin 01h 00h Blck Number Key Type Key Number Blck Number Key Type Key Number 1 byte The memry blck t be authenticated. Fr MIFARE Classic 1K card, it has a ttal f 16 sectrs, wherein each sectr cnsists f 4 cnsecutive blcks. e.g., Sectr 00h cnsists f Blcks {00h, 01h, 02h and 03h}; Sectr 01h cnsists f Blcks {04h, 05h, 06h and 07h}; the last sectr 0Fh cnsists f Blcks {3Ch, 3Dh, 3Eh and 3Fh}. Once the authenticatin is dne successfully, there is n need t d the authenticatin again prvided that the blcks t be accessed belng t the same sectr.* Please refer t the MIFARE Classic 1K/4K specificatin fr mre details. *Nte: Once the blck is authenticated successfully, all blcks belnging t the same sectr are accessible. 1 byte. 60h = Key is used as TYPE A key fr authenticatin 61h = Key is used as TYPE B key fr authenticatin 1 byte. 00h ~ 01h = Vlatile memry fr string keys. They keys will be remved when the reader is discnnected frm the cmputer. Tw vlatile keys are prvided. The vlatile key can be used as a sessin key fr different sessins. Lad Authenticatin Keys Respnse Frmat (2 bytes) Respnse Data Out Result Page 60 f 81

61 Lad Authenticatin Keys Respnse Cdes Results Meaning Success 90 00h The peratin was cmpleted successfully Errr 63 00h The peratin failed Sectrs (16 sectrs, 4 cnsecutive blcks per sectr) Data Blcks (3 blcks, 16 bytes per blck) Trailer Blck (1 blck, 16 bytes) Sectr 0 00 ~ 02h 03h Sectr 1 04 ~ 06h 07h Sectr ~ 0Ah 3Bh Sectr 15 3C ~ 3E 3Fh 1 KB Table 3: MIFARE Classic 1K Memry Map Sectrs (32 sectrs, 4 cnsecutive blcks per sectr) Data Blcks (3 blcks, 16 bytes per blck) Trailer Blck (1 blck, 16 bytes) Sectr 0 00 ~ 02h 03h Sectr 1 04 ~ 06h 07h Sectr ~ 7Ah 7Bh Sectr 31 7C ~ 7Eh 7Fh 2 KB Sectrs (8 sectrs, 16 cnsecutive blcks per sectr) Data Blcks (15 blcks, 16 bytes per blck) Trailer Blck (1 blck, 16 bytes) Sectr ~ 8Eh 8Fh Sectr ~ 9Eh 9Fh Sectr 38 E0 ~ EEh EFh Sectr 39 F0 ~ FEh FFh 2 KB Table 4: MIFARE Classic 4K Memry Map Page 61 f 81

62 Example: //T authenticate the Blck 04h with a {TYPE A, key number 00h} // PC/SC V2.01, Obslete APDU = {FF h}; Similarly, // T authenticate the Blck 04h with a {TYPE A, key number 00h}. // PC/SC V2.07 APDU = {FF h} Nte: MIFARE Ultralight des nt need t perfrm authenticatin as its memry is freely accessible. Byte Number Page Serial Number SN0 SN1 SN2 BCC0 0 Serial Number SN3 SN4 SN5 SN6 1 Internal/Lck BCC1 Internal Lck0 Lck1 2 OTP OPT0 OPT1 OTP2 OTP3 3 Data read/write Data0 Data1 Data2 Data3 4 Data read/write Data4 Data5 Data6 Data7 5 Data read/write Data8 Data9 Data10 Data11 6 Data read/write Data12 Data13 Data14 Data15 7 Data read/write Data16 Data17 Data18 Data19 8 Data read/write Data20 Data21 Data22 Data23 9 Data read/write Data24 Data25 Data26 Data27 10 Data read/write Data28 Data29 Data30 Data31 11 Data read/write Data32 Data33 Data34 Data35 12 Data read/write Data36 Data37 Data38 Data39 13 Data read/write Data40 Data41 Data42 Data43 14 Data read/write Data44 Data45 Data46 Data bits r 64 bytes Table 5: MIFARE Ultralight Memry Map Page 62 f 81

63 Read Binary Blcks The Read Binary Blcks cmmand is used in retrieving multiple data blcks frm the PICC card. The data blck/trailer blck must be authenticated first befre executing the Read Binary Blcks cmmand. Read Binary APDU Frmat (5 Bytes) Cmmand Class INS P1 P2 Le Read Binary Blcks Blck Number Number f Bytes t Read FFh B0h 00h 1 byte. The starting blck. 1 byte Blck Number Number f Bytes t Read Multiples f16 bytes fr MIFARE Classic (1K/4K) r Multiples f 4 bytes fr MIFARE Ultralight. Maximum f 48 bytes fr MIFARE Classic 1K (Multiple blcks mde; 3 cnsecutive blcks). Maximum f 240 bytes fr MIFARE Classic 4K (Multiple blcks mde; 15 cnsecutive blcks). Maximum f 16 bytes fr MIFARE Ultralight. Example 1: 10h (16 bytes). The starting blck nly (Single Blck Mde) Example 2: 40h (64 bytes). Frm the starting blck t starting blck+3. (Multiple Blcks Mde) Nte: Fr security reasns, the Multiple Blck Mde is used fr accessing Data Blcks nly. The Trailer Blck is nt suppsed t be accessed in Multiple Blcks Mde. Please use Single Blck Mde t access the Trailer Blck. Read Binary Blck Respnse Frmat (Multiples f 4/ Bytes) Respnse Data Out Result Data (Multiples f 4/16 Bytes) Read Binary Blck Respnse Cdes Results Meaning Success 90 00h The peratin was cmpleted successfully. Errr 63 00h The peratin failed. Examples: //Read 16 bytes frm the binary blck 04h (MIFARE Classic 1K r 4K) APDU = {FF B } //Read 240 bytes starting frm the binary blck 80h (MIFARE Classic 4K) //Blck 80 t Blck 8Eh (15 blcks) APDU = {FF B F0} Page 63 f 81

64 Update Binary Blcks The Update Binary Blcks cmmand is used in writing a multiple f data blcks int the PICC card. The data blck/trailer blck must be authenticated first befre executing the Update Binary Blcks cmmand. Update Binary APDU Frmat (Multiples f bytes) Cmmand Class INS P1 P2 Le Data In Update Binary Blcks FFh D6h 00h Blck Number Number f Bytes t Update Blck Data (Multiples f 16 bytes) Blck Number Number f Bytes t Update 1 byte. The starting blck t be updated. 1 byte. Multiples f16 bytes fr MIFARE Classic (1K/4K) r Multiples f 4 bytes fr MIFARE Ultralight. Maximum f 48 bytes fr MIFARE Classic 1K (Multiple blcks mde; 3 cnsecutive blcks). Maximum f 240 bytes fr MIFARE Classic 4K (Multiple blcks mde; 15 cnsecutive blcks). Maximum f 16 bytes fr MIFARE Ultralight. Example 1: 10h (16 bytes). The starting blck nly. (Single Blck Mde) Example 2: 30h (48 bytes). Frm the starting blck t starting blck +2. (Multiple Blcks Mde) Nte: Fr safety reasns, the Multiple Blck Mde is used fr accessing data blcks nly. The Trailer Blck is nt suppsed t be accessed in Multiple Blcks Mde. Please use Single Blck Mde t access the Trailer Blck. Blck Data Multiples f bytes (r 6 bytes) The data t be written int the binary blck/s. Update Binary Blck Respnse Cdes Results Meaning Success 90 00h The peratin was cmpleted successfully. Errr 63 00h The peratin failed. Examples: //Update the binary blck 04h f MIFARE Classic 1K r 4K with data { F} APDU = {FF D A 0B 0C 0D 0E 0F} //Update the binary blck 04h f MIFARE Ultralight with data { } APDU = {FF D } Page 64 f 81

65 Value Blck Operatin (INC, DEC, STORE) The Value Blck Operatin cmmand is used in manipulating value-based transactins, such as incrementing a value f the value blck. Value Blck Operatin APDU Frmat (10 bytes) Cmmand Class INS P1 P2 Le Data In Value Blck Operatin FFh D7h 00h Blck Number 05h VB_OP VB_Value (4 bytes) {MSB.. LSB} Blck Number VB_OP VB_Value 1 byte. The value blck t be manipulated. 1 byte. 00h = Stre the VB_Value int the blck. The blck will then be cnverted t a value blck. 01h = Increment the value f the value blck by the VB_Value. This cmmand is nly valid fr value blck. 02h = Decrement the value f the value blck by the VB_Value. This cmmand is nly valid fr value blck. 4 bytes. The value used fr value manipulatin. The value is a signed lng integer. Example 1: Decimal 4 = {FFh, FFh, FFh, FCh} VB_Value MSB LSB FFh FFh FFh FCh Example 2: Decimal 1 = {00h, 00h, 00h, 01h} VB_Value MSB LSB 00h 00h 00h 01h Value Blck Operatin Respnse Frmat (2 bytes) Respnse Data Out Result Value Blck Operatin Respnse Cdes Results Meaning Success 90 00h The peratin was cmpleted successfully. Errr 63 00h The peratin failed. Page 65 f 81

66 Read Value Blck The Read Value Blck cmmand is used in retrieving the value frm the value blck. This cmmand is nly valid fr value blck. Read Value Blck APDU Frmat (5 bytes) Cmmand Class INS P1 P2 Le Read Value Blck FFh B1h 00h Blck Number 04h Blck Number 1 byte. The value blck t be accessed. Read Value Blck Respnse Frmat (4 + 2 bytes) Respnse Result Data Out Value {MSB LSB} Value 4 bytes. The value returned by the card. The value is a signed lng integer. Example 1: Decimal 4 = {FFh, FFh, FFh, FCh} Value MSB LSB FFh FFh FFh FCh Example 2: Decimal 1 = {00h, 00h, 00h, 01h} Value MSB LSB 00h 00h 00h 01h Read Value Blck Respnse Cdes Results Meaning Success 90 00h The peratin was cmpleted successfully. Errr 63 00h The peratin failed. Page 66 f 81

67 Cpy Value Blck The Cpy Value Blck cmmand is used t cpy a value frm a value blck t anther value blck. Cpy Value Blck APDU Frmat (7 bytes) Cmmand Class INS P1 P2 Lc Data In Value Blck Operatin FFh D7h 00h Surce Blck Number 02h 03h Target Blck Number Surce Blck Number Target Blck Number 1 byte. The value f the surce value blck will be cpied t the target value blck. 1 byte. The value blck t be restred. The surce and target value blcks must be in the same sectr. Cpy Value Blck Respnse Frmat (2 bytes) Respnse Data Out Result Cpy Value Blck Respnse Cdes Results Meaning Success 90 00h The peratin was cmpleted successfully. Errr 63 00h The peratin failed. Examples: //Stre a value 1 int blck 05h APDU = {FF D } //Read a value int blck 05h APDU = {FF B } //Cpy the value frm value blck 05h t value blck 06h APDU = {FF D } //Increment the value blck 05h by 5 APDU = {FF D } Page 67 f 81

68 Access PC/SC Cmpliant Tags (ISO ) Basically, all ISO cmpliant cards (PICC) wuld understand the ISO APDUs. The ACR35 will cmmunicate with the ISO cmpliant cards by exchanging ISO APDUs and respnses. ACR35 will handle the ISO14443 Parts 1-4 prtcls internally. MIFARE Classic (1K/4K), MIFARE Mini, and MIFARE Ultralight tags are supprted thrugh the T=CL emulatin. ISO APDU Frmat Cmmand Class INS P1 P2 Lc ISO7816 Part 4 Cmmand Length f the Data In Data In Le Expected length f the Respnse Data ISO Respnse Frmat (Data + 2 bytes) Respnse Data Out Result Respnse Data ISO Respnse Cdes Results Meaning Success 90 00h The peratin was cmpleted successfully. Errr 63 00h The peratin failed. Typical sequence may be: 1. Present the tag and cnnect the PICC Interface. 2. Read/Update the memry f the tag. T d this: 1. Cnnect the tag. The ATR f the tag is 3B Ah. In which, The Applicatin Data f ATQB = , prtcl infrmatin f ATQB = It is an ISO Type B tag. 2. Send an APDU, Get Challenge. << h >> 1A F7 F3 1B CD 2B A9 58h [90 00h] Nte: Fr ISO Type A tags, the ATS can be btained by using the APDU FF CA h. Page 68 f 81

69 Example: //T read 8 bytes frm an ISO Type B PICC APDU = {80 B } Class INS P1 P2 Lc Data In Le 80h B2h 80h 00h Nne Nne 08h Answer: [$9000] Access FeliCa Tags Fr FeliCa Access, the cmmand is different with PC/SC-cmpliant tags and MIFARE. The cmmand fllws FeliCa specificatin with header added. FeliCa Cmmand Frmat Cmmand Class INS P1 P2 Lc Data In Felica Cmmand FFh 00h 00h 00h Length f the Data In Felica Cmmand (start with Length byte) FeliCa Respnse Frmat (Data + 2 bytes) Respnse Result Data Out Respnse Data Read Memry Blck Example: 1. Cnnect the FeliCa. The ATR = 3B 8F F 0C A B h In which, Bh = FeliCa 2. Read FeliCa IDM. CMD = FF CA h RES = [IDM (8bytes)] 90 00h e.g., FeliCa IDM = CB h 3. FeliCa cmmand access. Example: Read Memry Blck. CMD = FF CB h where: Felica Cmmand = CB h IDM = CB h RES = Memry Blck Data Page 69 f 81

70 10.0. Sensitive Data Injectin Methd In this sectin, a methd will be discussed n injecting sensitive data, such as the Custmer Master Key, DUKPT Initial PIN Encryptin Key, AES Encryptin Key, and Custm ID int the ACR3x in a mre secured scenari. Encrypted sensitive data will be transferred transparently thrugh the bridging device Secured Data Bridging Mbile Device ACR3x Prcessing Server Figure 4: Sensitive Data Injectin Mdel In the figure shwn abve, there are three entities invlved, namely the Secured Data Prcessing Server, the Bridging Mbile Device and ACR3x. The Secured Data Prcessing Server is respnsible fr receiving and generating ciphered sensitive data targeted at ACR3x, while the mbile device nly act as a message bridging channel between the data prcessing server and ACR3x. N data between the server and ACR3x will underg prcessing (except the need t repack the data int the frames suitable t be sent thrugh the audi channel t ACR3x) in the mbile device. Page 70 f 81