Advanced. Card. Systems. Ltd. by Eric Lee. June, Advanced Card Systems Ltd. Room 2910, The Center, 99 Queen's Road Central, Hong Kong.

Size: px

Start display at page:

Download "Advanced. Card. Systems. Ltd. by Eric Lee. June, Advanced Card Systems Ltd. Room 2910, The Center, 99 Queen's Road Central, Hong Kong."

Ursula Kelly
5 years ago
Views:

1 Advanced Card Systems Ltd. by Eric Lee June,

2 2

3 What is a Contactless Smart Card? A kind of Smart Card which can be accessed without electrical contact A type of RFID tag What is RFID (Radio Frequency Identification)? Non-contacting identification technique with a range from a few inches to several hundred feet First used in World War II to identify friendly aircrafts 3

4 Types of RFID Active Tag on-board power source requires less power from the reader longer read write range limited operating life more expensive Passive Tag obtain operating power from the reader higher-powered reader shorter read range unlimited life time smaller, lighter, and less expensive 4

5 Operating Frequencies Frequency Band Characteristics Typical Applications Low khz (125kHz) Low Frequency Intermediate MHz (13.56MHz) High Frequency High MHz UHF GHz SHF Short to medium read range Inexpensive low reading speed Short to medium read range potentially inexpensive medium reading speed Long read range High reading speed Line of sight required Expensive Access control Animal identification Inventory control Car immobilizer Access control Smart cards Railroad car monitoring Toll collection systems 5

6 RFID Applications in Hong Kong and China Octopus Autotoll Warehouse management Railway Tracking Container Tracking Animal Tagging Physical Access Control Time Attedance 6

7 Forms of Contactless Tags 7

8 ISO standards of RFID in 13.56MHz 8

9 of Contactless Smart Cards 9

10 Communication ISO7816 vs ISO

11 Communication ISO7816 vs ISO

12 Communication Inductive Coupling ASK (Amplified Shifted Keying) Card Card Reader: Load Modulation 12

13 ISO part 2 - Communication Type A Downlink: ASK 100%, modified Miller Code, 106 kbit/s Common Parameters Power Supply: 13,56 MHz, inductive coupling Field strength: 1,5.. 7,5 A/m Type B Downlink: ASK 10%, NRZ Code, 106 kbit/s Uplink: Loadmodulation with 847 khz Subcarrier ASK-modulated, Manchester Code, 106 kbit/s Uplink: Loadmodulation with 847 khz Sucarrierer BPSK (bi-phase shift keying), NRZ Code Anticollision: Bit Frame Anticollision: Slotted Aloha 13

14 ISO part 3 Anticollision and Selection Type A Bit Frame Anticollision (simplified illustration) Manchester coding Card logical Card logical 1 Card x ? Invalid Manchester state: BIT COLLISION 14

15 ISO part 3 Anticollision and Selection Type A Bit Frame Anticollision (simplified illustration) 15

16 ISO part 3 Anticollision and Selection Type A Bit Frame Anticollision (simplified illustration) D A 8 6 LSB MSB D 2 C 6 16

17 ISO part 3 Anticollision and Selection Type A Bit Frame Anticollision (simplified illustration) [Request ALL] to wake up all cards [REQA] [ATQA] [REQA] [ATQA] * If more than 1 card answer, collisions may occur. The reader will treat a collision bit as 1 thus resulting in logicalling Oring all ATQAs. 17

18 ISO part 3 Anticollision and Selection Type A Bit Frame Anticollision (simplified illustration) [SELECT] with no initial serial number st collision 2nd collision

19 ISO part 3 Anticollision and Selection Type A Bit Frame Anticollision (simplified illustration) [SELECT] with initial serial number D A If no further collision detected, the card with serial number 0x68AD is obtained. The [SELECT] command is then issued again with full serial number to select the card 19

20 ISO part 3 Anticollision and Selection Type A Bit Frame Anticollision [SELECT] level 1 [SELECT] level 2 [SELECT] level 3 Cascade Tag, value 0x88 Cascaded (multiple level) Anticollision 20

21 ISO part 3 Anticollision and Selection Type B Slotted Aloha Anticollision (simplified illustration) D A 8 6 LSB MSB D 2 C 6 21

22 ISO part 3 Anticollision and Selection Type B Slotted Aloha Anticollision (simplified illustration) [REQB] specifying N timeslots, e.g. N = 4 ATQB with the card s Unique Identifier (PUPI), in ths case the serial number DA86 ATQB including D2C6 Note: timeslot 1 timeslot 2 timeslot 3 timeslot 4 1. All command frames are protected by 2-byte CRC, hence collision is detected by a message with bad CRC. 2. The unique identifier PUPI can be a dynamically generated number 22

ISO 14443 part 3 Anticollision and Selection Type B Slotted Aloha Anticollision (simplified illustration) [ATTRIB] command specifying: 1.

23 ISO part 3 Anticollision and Selection Type B Slotted Aloha Anticollision (simplified illustration) [ATTRIB] command specifying: 1. The card s unique identifier PUPI (in this example, the serial number DA86) 2. Card Identifier (CID), the logical number of the address card to be used in the communication hereafter The card answers with Answer To Attrib (ATA) and starts listening higher level commands hereafter 23

24 Standards adopted by the major suppliers 24

25 Mifare Classic vs ISO

26 Mifare System 26

27 Some basic facts mifare stands for: MIFARE Mikorn Fare Collection System mifare works on: 13.56MHz ISM band mifare complies to: ISO14443 Type A mifare classic part 1-3, mifare DESFire part

28 MIFARE Mifare Security: Three Pass Authentication RN (card) RN (card) RN (reader) +RN (card) +TextA RN (reader) +RN (card) +TextA RN (card) +RN (reader) +TextB RN (card) +RN (reader) +TextB * There is no key contained in the messages between the card and the reader. 28

29 Mifare System (cards) mifare Classics (memory card) - ISO14443 Type A, part 1-3, No crypto security mifare Ultralight 512 bit (MF0 IC U10) - ISO14443 Type A, part 1-3, proprietary crypto security mifare Standard 1K (MF1 IC S50) mifare Standard 4K (MF1 IC S70) mifare DESFire (memory card) - ISO14443 Type A, part 1-4, DES/3DES security mifare DESFire (MF3 IC D40) mifare PROX (8051 based CPU card) - ISO14443 Type A, part 1-4, mifare proprietary, DES/3DES, RSA512/1024 security 8051 based CPU card with 64K ROM, 1-2K RAM, 4-16K EEPROM 29

30 Mifare System (cards) 30

31 Mifare System (cards) 31

32 Mifare contactless cards Mifare Ultralight Mifare Std 1K Mifare Std 4k Mifare DESFire Product Features MF0 IC U1X MF1 IC S50 MF1 IC S70 MF3 IC D40 Memory EEPROM size 512 bit 1024 byte 4096 byte 4096 byte OTP area 32 bit Write Endurance 1000 cycles 100,000 cycles 100,000 cycles 100,000 cycles Data Retention 2 years 10 years 10 years 10 years Organization 16 pages of 4 byte 16 sectors of 64 byte 32x 64 byte, 8x 256 byte Flexible file system RF-Interface ACC. To ISO 14443A Yes up to layer 3 Yes up to layer 3 Yes up to layer 3 Yes up to layer 4 Frequency MHz MHz MHz MHz Baudrate 106 kbit 106 kbit 106 kbit 106 kbit Anticollision bit-wise bit-wise bit-wise bit-wise Operating Distance up to 10cm up to 10cm up to 10cm up to 10cm Security Unique Serial Number 7 byte, cascaded 4 byte 4 byte 7 byte, cascaded Random Num. Generator - Yes Yes Yes, acc. FIPS Access Keys - 2 keys per sector 2 keys per sector 14 keys per application Access Conditions per page per sector per sector per file Mifare Classic Security - supported supported - DES & 3DES security MACing/Encipherment Anti-tearing support - for value blocks for value blocks Yes Special Features Multiapplication - supports MAD supports MAD2 28 applications, MAD3 Purse Functionality - Value block format Value block format Value file Secure Transport Trans n 48 byte rd 16 byte wr 512 byte rd 16 byte wr 512 byte rd 128 byte wr 512 byte rd 128 byte wr Transaction Time [ms] Room 2910, The Center 32

Mifare System (reader chips) R/W Distance Host interface Card interface High Data Rates Reader ICs MF RC500 100 mm Parallel ISO 14443A - MF RC530 100 mm Parallel,

33 Mifare System (reader chips) R/W Distance Host interface Card interface High Data Rates Reader ICs MF RC mm Parallel ISO 14443A - MF RC mm Parallel, SPI ISO 14443A Up to 424 kbaud MF RC mm Parallel, SPI ISO 14443A&B Up to 424 kbaud CL RC mm Parallel, SPI ISO 14443A&B, ISO Up to 424 kbaud 33

34 34

35 Mifare Classic Card components 35

36 Mifare Ultralight card mapping 4 bytes / page 16 pages 16 * 4 = 64 bytes (512 bits) No Key 36

37 Mifare standard 1K card mapping 16 bytes / block 4 blocks / sector 16 sectors 16 * 4 * 16 = 1024 bytes 16 pairs of key 1 pair for each sector 37

Mifare standard 4K card mapping Sector 0-31 16 bytes / block 4 blocks / sector Sector 32 39 16 bytes

38 Mifare standard 4K card mapping Sector bytes / block 4 blocks / sector Sector bytes / block 16 blocks / sector 16 * 4 * *16*8 = 4096 bytes 16 pairs of key 1 pair for each sector 38

39 Mifare standard memory organization in a sector 39

40 Mifare standard access condition for data blocks 40

41 Mifare standard access condition for trailer block 41

42 Sector 0 block 0-3 Example: Suppose we want to set a sector 3 of a card with the following accessing condition: Sector 1 block 4-7 Sector 2 block 8-11 Sector 3 block 12 Read only by key A, Read/Write by key B block 13 Decrement by key A, Increment by key B block 14 Decrement by key A, Increment never block 15 Both key A and B changeable by key B Sector 4 C1 0, C2 0, C3 0 = 1,0,0 C1 1, C2 1, C3 1 = 1,1,0 C1 2, C2 2, C3 2 = 0,0,1 C1 3, C2 3, C3 3 = 0,1,1 Sector 5 5C 33 CA 00 bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 byte 6 (-C23 ) 0 (-C22) 1 (-C21) 0 (-C20) 1 (-C13 ) 1 (-C12) 1 (-C11) 0 (-C10) 0 byte 7 (C13 ) 0 (C12) 0 (C11) 1 (C10) 1 (-C33 ) 0 (-C32) 0 (-C31) 1 (-C30) 1 byte 8 (C33 ) 1 (C32) 1 (C31) 0 (C30) 0 (C23 ) 1 (C22) 0 (C21) 1 (C20) 0 byte 9 X X X X X X X X Sector trailer: Key A 5C 33 CA 00 Key B 42

43 Mifare Classic Card access procedure command to card 43

44 Multiple Application in Mifare Classic Card Mifare Application Directory - MAD 44

45 Multiple Application in Mifare Classic Card Mifare Application Directory - MAD 45

46 Multiple Application in Mifare Classic Card Mifare Application Directory - MAD 46

47 Anti-Tearing in Mifare Classic Card Contactless cards are more susceptible to have tearing problem as the user can easily pull the card out of the reader anytime. Anti-tearing is very important in transactions involving contactless cards. Basic principle: Elements: Redundant storage Balance Block, Backup Block, Value Block validity check 47

48 Anti-Tearing in Mifare Classic Card Balance Block Good Good Bad Bad Backup Block Good Bad Good Bad Registered? yes Toggle Balance/Backup no Registered? yes Clear register and open the gate no Proceed transaction Decrement Balance Block and register the card Decrement Backup Block Both blocks OK? yes Call for service Read back both blocks no 48

49 49

RFID Radio Frequency Identification The Basic Principle. Semiconductors 4

RFID Radio Frequency Identification The Basic Principle Semiconductors 4 Basic Transceive Principle Energy: Reader Tag Card Data: Reader Tag Card Data: Reader Tag Card LOAD modulation Semiconductors 5