WO2012027898A1 - Method and device for radio frequency identification(rfid) access control - Google Patents

Abstract

The present invention relates to the technical field of Radio Frequency Identification (RFID), particularly to a method and device for RFID access control, wherein, the method includes that: a reader establishes a connection with a tag; said reader sends a user password to said tag; said tag matches the permission of said user password in the user password area which contains at least two users, and matches the user storage area corresponding to said user password, and according to the permission and the user storage area, said tag performs a received control instruction. The embodiment of the present invention enables the safe access to the data in the tag thus ensuring high data security for different users.

Description

 RFID access control method and device

TECHNICAL FIELD The present invention relates to the field of RFID technologies, and in particular, to an RFID access control method and apparatus. Background technique

 RFID (Radio Frequency Identification) is a technology for identifying targets by non-contact two-way data communication through radio frequency. RFID technology is a collection of basic technologies, including microchip manufacturing technology, antenna technology, radio frequency technology, communication technology, data exchange and data coding technology.

UHF RFID systems means; operating frequency is _840~845ΜΗ Ζ, 920~925ΜΗ Ζ (UHF band) of

RFID system. The simplest UHF RFID system consists of a tag, a reader, and an antenna. When the tag enters the magnetic field, the receiving card reader sends a signal to the tag. The obtained energy sends the relevant information of the product stored in the chip (Passive Tag) or the passive tag to the card reader. After reading the tag information and decoding the card reader, the card reader sends the tag information to the central information system. For related processing, other hardware and software support is needed in practical applications.

 The characteristics of RFID-based support for the Internet will have a profound impact on the society's intelligence, information, and production models. Therefore, the significance of its application will be related to the country's economic development and national defense construction process, involving national information security and the state. interest.

At present, in terms of the core technologies involved in the international EPC global C1G2 and ISO/IEC 18000 _6C standards, only EPC coding, transmission and remote authentication are considered in the system, and the special requirements of data in the communication process and different applications are not fully considered. The air interface communication protocol uses the "kill" and "Access" password access control mechanisms to solve the data security problem in the media access control layer custom command, the state machine and the memory design of the tag integrated circuit. Without considering The difference between the special user data and the general user data, and the security of the user storage block data itself, the general user card reader can easily read the sensitive data of the special user, and therefore, there is a great security risk.

Summary of the invention

 The embodiment of the invention provides an RFID access control method and device, which is used to solve the problem that the data stored in the tag is not secure enough in the prior art, and cannot be accessed separately by the user.

 An embodiment of the present invention provides an RFID access control method, including:

 The reader establishes a connection with the tag;

 The reader/writer sends a user password to the tag;

 The tag matches the user password in a user password area including at least two users, and matches the user storage area corresponding to the user password;

 The tag executes the received control command according to the authority and the user storage area.

 According to a further aspect of the embodiments of the present invention, the tag communicates with the reader/writer in an encrypted manner.

 According to still another aspect of the embodiments of the present invention, the method further includes: the tag determining whether the tag of the tag is a specific value, if the tag is The specific value matches the user password in the user password area including at least two users, and matches the user storage area corresponding to the user password.

 According to another aspect of the embodiments of the present invention, the rights include read rights and write rights.

 The embodiment of the invention further provides a label access control method in an RFID system, comprising: establishing a connection with an external device;

 Receive user password;

Match the permissions of the user password in the user password area of at least two users, and match The user storage area corresponding to the user password;

 The received control command is executed according to the authority and the user storage area.

 According to an aspect of the present invention, when the tag transmits data to an external device, the transmitted data is encrypted, and when the tag receives the external device data, the received data is decrypted.

 According to still another aspect of the embodiments of the present invention, after receiving the user password, the method further includes: determining whether the identifier bit of the label is a specific value, and if the identifier bit is a specific value, at a user password area including at least two users. The right to match the user password and match the user storage area corresponding to the user password.

 An embodiment of the present invention further provides a label in an RFID system, including,

 a radio unit for connecting to an external device and receiving a user password;

 a user data area, which includes at least two user storage areas for storing user data; a user password area for storing passwords and rights of at least two users;

 a matching unit, configured to match the user password in the user password area, and match the user storage area corresponding to the user password;

 An execution unit, configured to execute the received control command according to the permission and the user storage area.

 According to an aspect of the present invention, an encryption unit and a decryption unit are further included, which are respectively connected to the radio frequency unit and the matching unit, for encrypting data sent by the tag and decrypting the received data. .

 According to still another aspect of the embodiments of the present invention, the method further includes: an identifier unit, respectively connected between the radio frequency unit and the matching unit, configured to identify whether the identifier bit in the label is a specific value, if the identifier bit is specific The value informs the matching unit of the right to match the user password in the user password area, and matches the user storage area corresponding to the user password.

 An embodiment of the present invention further provides an RFID system, including

 a reader, configured to establish a connection with the tag, and send a user password to the tag;

The tag, configured to receive the user password; in a user password area including at least two users The user's password is matched and the user storage area corresponding to the user password is matched; and the received control command is executed according to the authority and the user storage area.

 The security access to the data in the tag can be achieved by the embodiment of the present invention, and the data security for different users is high. DRAWINGS

 The drawings described herein are provided to provide a further understanding of the invention and are in no way of limitation. In the drawing:

 1 is a flowchart of an RFID system access control method according to an embodiment of the present invention; FIG. 2 is a flowchart of a label access control method in an RFID system according to an embodiment of the present invention; FIG. a structural diagram of the storage area;

 4 is a structural diagram of a tag in an RFID system according to an embodiment of the present invention;

 Fig. 5 is a block diagram showing the structure of an RFID system according to an embodiment of the present invention. detailed description

 In order to make the objects, the technical solutions and the advantages of the present invention more comprehensible, the present invention will be described in detail below with reference to the embodiments and the accompanying drawings. The illustrative embodiments of the present invention and the description thereof are intended to explain the present invention, but are not intended to limit the invention.

 FIG. 1 is a flowchart of an RFID system access control method according to an embodiment of the present invention.

 Including, step 101, the reader establishes a connection with the tag. The connection between the reader and the tag can be established by using an access password in the prior art.

Step 102: The reader/writer sends a user password to the tag. Different readers send their own specific user passwords, or a reader/writer can send different user passwords to the tags according to the user's choice. The user passwords can be divided into read passwords and write passwords, where the read The password or password can be a 32-bit password. The user password is used to distinguish the user's identity. Users with different identities can get different data content from the label. For example, confidential data content can only be obtained by The reader who inputs the secret user password reads or writes. The ordinary data content can be read or written by the reader who inputs the ordinary user password. If the user has the write permission, the corresponding user storage area can be performed. In addition to the written permissions, there is permission to read the user store.

 The tag further has an identifier bit for identifying whether the tag supports a mode of the multi-user storage area. If the identifier bit is a specific value, the received user password is matched with multiple user passwords in the user password area, otherwise directly In the prior art, the process of not distinguishing the user's access, such as matching the access password, and then accessing the tag.

 The compatibility of tags in prior art RFID systems can be achieved by the identification bits.

 Step 103: The tag matches the user password in a user password area including at least two users, and matches a user storage area corresponding to the user password.

 The read password and the write password of all users are included in the user password area of the tag, wherein each user's read password and write password can be 32 bits long, in this example 15 user passwords, each Each user password has a read password and a write password. The block of the user password area is B0~B15. For example: OOrTlFn is the read password block of user Β0, and 20rT3Fn is the write password of user B0. (Write Password) Memory block. According to the input user password, the user password in the user password area is matched, and the user's authority is obtained, and which password is matched with which user's corresponding authority.

 According to the user password input above, the user storage area corresponding to the user password is matched. For example, if the input user password matches the read password of the user B1, the reader/writer has read permission for the storage area of the user B1 of the label.

Step 104: The tag executes the received control command according to the authority and the user storage area. The control command includes: if the permission of the user password is a read permission, sending data in a user storage area corresponding to the user password to the reader/writer; if the permission of the user password is a write permission, And allowing the reader/writer input data to be written into the user storage area corresponding to the user password and/or reading data of the corresponding user storage area; if the user password does not match any one of the user passwords in the label, This control command performs operations on any user memory area. As a further embodiment of the present invention, the reader/writer communicates with the tag in an encrypted manner. The encryption method may be a Data Encryption Algorithm (DEA) or an Advanced Encryption Standard (AES).

 2 is a flow chart of a method for controlling tag access in an RFID system according to an embodiment of the present invention.

 Including step 201, establishing a connection with an external device. For example, the connection between the reader and the reader through the radio frequency method can be the connection method of the reader/writer and the label in the prior art; or the label can be connected to the computer through a reader/writer, etc., for setting the label parameter and reading. Take or write data.

 Step 202: Receive a user password.

 Step 203: Match the user password in the user password area including at least two users, and match the user storage area corresponding to the user password.

 Step 204: Execute the received control command according to the permission and the user storage area.

 The user password area includes a read password and a write password of a plurality of users, and the user password matches the read password or the write password, and the user has read permission or write permission to the corresponding user storage area of the label.

 When the tag communicates with the external device, including transmitting the RF signal and receiving the RF signal, it can be transmitted by encryption. It can be encrypted by DEA or AES.

 As a further aspect of the embodiment of the present invention, after the step 202, the method further includes: determining whether the identifier of the label is a specific value, and if the identifier is a specific value, matching in a user password area including at least two users. The user password is matched with the user storage area corresponding to the user password. Otherwise, the process of not distinguishing the user's access process, such as matching the access password, and then accessing the label, is directly performed.

 Through the user password area and the user storage area in the foregoing embodiment, it is possible to control the user to read or write different data in the label, enhance the security of the data in the label, and implement the label and the external device through encryption and decryption. Inter-communication is no longer a clear text transmission, enhancing data security in communications.

FIG. 3 is a structural diagram of a label storage area in an embodiment of the present invention. The user area (USER) of the tag has 16 storage areas, each of which is a user-specific storage area, and each user's storage area address is, for example, 00 _h to 0f _h .

 In the reserved area of the label (RESERVED), there is a password for setting a control password (Configure Password), which defines the encryption mode of each memory setting in the tag chip, that is, if the control password is set correctly, the EPC information except the user storage area can be changed. Or the use of configuration bits.

 Also included in the reserved area of the tag is Tag Configure Control: This setting is used to control the read/write status of the specified block of the tag memory and the address pointer of the corresponding block.

 User Password: Defines the read/write password for a special user memory block. The block of the user password area is Β (ΓΒ15, representing different users, OOrTlFn is the read password block of user Β0, 20rT3Fn is the write password storage block of user B0, and so on. ΙΕΟη ~ lFFn.

 The tag identification number (TID) area of the tag is used to store the factory information of the tag and the like.

 The EPC area of the tag is used to store EPC codes, as well as protocol files and parameters. The tag setting control has an identifier bit for identifying whether the tag supports a multi-user storage area. If the identifier bit is a specific value, for example, the tag supports a multi-user storage area, and the received user password is matched. Multiple user passwords in the user password area. Otherwise, the process of accessing the user without distinguishing the access process, such as matching the access password, and then accessing the label, is directly performed.

 In the embodiment of the present invention, the label setting control field in the reserved area of the label is defined as follows in Table 1. As can be understood by those skilled in the art, the following Table 1 defines only one example of implementing the method of the present invention, and It should not be construed as limiting the embodiments of the invention.

 Definition of label setting control

 Child "1 A definition

 If this bit is "0", it is consistent with the EPC C1G2 standard.

60h

The process of matching user passwords The encryption method when communicating with the outside world, when 40h = 0, it means setting the control password.

61h-62h Correctly operate the label EPC information or configuration bits; 012 AES; 102

 3-DES; 112 RFU, valid only for reserved memory areas

 63h Selects the function valid bit. If it is 0, the selection function is disabled.

 64h RFU (reserved memory area)

 65h-68h Default user storage index, up to 16 user memory blocks.

 User storage area storage mode, "0" is small capacity mode, "1" is large capacity

69h

 Volume mode.

 User memory block access control, "0" for all blocks, "1" for independent area

6Ah

 Block access.

 6Bh RFU

 The number of user memory blocks is reduced by "1", 00002 means block 1, 11112

6Ch-6Fh

 Block 16.

The label setting control field mentioned above may also include definitions of radio frequency parameters, as shown in Table 2. Table 2 Definition of RF parameters in the Label Settings Control field

Byte bit definition

 Continuous frequency bits (for anti-jamming, different numbers indicate the frequency band in which the tag operates)

70h-71h 00: 840MHz; 01: 880MHz; 10: 920MHz (default); 11:

 960MHz

72h power change mode. (0 is the normal mode; 1 is the load mode.)

 73h-7Fh RFU

The User Memory Control field in Figure 3 is defined as Table 3, which is used to store the parameters of the user memory area.

Table 3 Definition of User Store Control Fields in Label Reservations Byte bit definition

 What is the size of block 0:

 If the user adopts the small storage mode, IJ: 002:2 Bytes; 012:4

80h - 81h Bytes ;102 :8 Bytes; 112: 16 Bytes.

 If the user chooses the large storage mode, IJ: 002:16 Bytes; 012:32 Bytes; 102:64 Bytes; 112: 128 Bytes.

 Block 0 access bits:

 82h-83h 002: Read only; 012: Write only; 102: Read/write; 112: Block prefix lock, multiple selection Block selection

 ... access bits for other blocks

 BCh-BDh block 15 size.

 BEh-BFh block 15 access bit. Fig. 4 is a structural diagram of a tag in an RFID system according to an embodiment of the present invention.

 The radio unit 401, the user data area 402, the user password area 403, the matching unit 404, and the executing unit 405 are included.

 The radio frequency unit 401 is configured to connect with an external device and receive a user password.

 The user data area 402 includes at least two user storage areas for storing user data.

 The user password area 403 is configured to store passwords and permissions of at least two users.

 The matching unit 404 is configured to match the user password in the user password area, and match the user storage area corresponding to the user password.

The executing unit 405 is configured to execute the received control command according to the authority and the user storage area. In the embodiment of the present invention, an encryption unit 406 and a decryption unit 407 may be further included between the radio unit 401 and the matching unit 404 for encrypting data sent by the label and decrypting the received data. The identifier unit 408 is further connected between the radio frequency unit and the matching unit 404, and is used to identify whether the identifier bit in the label is a specific value, and if the identifier bit is a specific value, notify the matching unit of the user password. The user in the area matches the user password and matches the user storage area corresponding to the user password. Otherwise, the process of not distinguishing the user's access process, such as matching the access password, and then accessing the label, is directly performed.

 FIG. 5 is a schematic structural diagram of an RFID system according to an embodiment of the present invention.

 Including reader/writer 501, tag 502.

 The reader/writer 501 establishes a connection with the tag 502. The tag 502 determines whether the tag supports the secure access of the multi-user. If not, the tag access process is entered in the prior art. This will not be repeated here.

 According to the identification bit in the tag, the reader can know whether the tag supports secure access by multiple users. If the multi-user secure access is supported, the reader sends the user password, and the tag receives the user password and the user. The user password in the password area is matched. If the received user password matches a user password in the user password area, the user storage area that the connected user can access is determined. For example, the received user password is the user Bl. Then, the user can access the user storage area of the user B1, and confirm the access right of receiving the user password. For example, if the received user password matches the write permission password of B1 in the user password area, the connected user is allowed to access. The user storage area B1, and the user can perform a write operation in the user storage area B1. When receiving the operation command of the reader/writer, the label reads or writes to the corresponding storage area according to the permission of the user password. operating.

 Through the user data area and the user password area in the above embodiment, the user's secure access mechanism can be implemented in one tag, and the data security of the existing RFID system can be enhanced.

Through the description of the above embodiments, those skilled in the art can clearly understand that the present invention can be implemented by hardware or by software plus a necessary general hardware platform. Based on such understanding, the technical solution of the present invention can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (can be a CD-ROM, a U disk, a mobile hard disk) And the like, including instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present invention.

 The specific embodiments of the present invention have been described in detail with reference to the preferred embodiments of the present invention. The scope of the invention, any modifications, equivalents, improvements, etc., made within the spirit and scope of the invention are intended to be included within the scope of the invention.

Claims

Claim An RFID access control method, comprising:  The reader establishes a connection with the tag;  The reader/writer sends a user password to the tag;  The tag matches the user password in a user password area including at least two users, and matches the user storage area corresponding to the user password;  The tag executes the received control command according to the authority and the user storage area.  The method according to claim 1, wherein the tag and the reader/writer communicate in an encrypted manner.  The method according to claim 1, wherein the reader/writer sends the user password to the label, the method further includes: the label determining whether the identifier of the label is a specific value, if the identifier The bit is a specific value, and the user password is matched in the user password area including at least two users, and the user storage area corresponding to the user password is matched.  A tag access control method in an RFID system, characterized in that  Establish a connection with external devices;  Receive user password;  Matching the user password in a user password area including at least two users, and matching the user storage area corresponding to the user password;  The received control command is executed according to the authority and the user storage area.  The method according to claim 4, wherein when the tag sends data to the external device, the sent data is encrypted, and when the tag receives the external device data, the received data is decrypted. . The method according to claim 4, further comprising: after receiving the user password, determining whether the identifier bit of the tag is a specific value, and if the identifier bit is a specific value, comprising at least two users The user password area matches the user password and matches the user password pair. The user store should be.  7. A tag in an RFID system, characterized by comprising  a radio unit for connecting to an external device and receiving a user password;  a user data area, which includes at least two user storage areas for storing user data; a user password area for storing passwords and rights of at least two users;  a matching unit, configured to match the user password in the user password area, and match the user storage area corresponding to the user password;  An execution unit, configured to execute the received control command according to the permission and the user storage area.  The tag according to claim 7, further comprising: an encryption unit and a decryption unit, respectively connected to the radio frequency unit and the matching unit, configured to encrypt and receive the data sent by the tag. The data is decrypted.  The tag according to claim 7, further comprising an identification unit respectively connected between the radio frequency unit and the matching unit, configured to identify whether the identification bit in the tag is a specific value, if the identifier bit For a specific value, the matching unit is notified to match the user password in the user password area, and the user storage area corresponding to the user password is matched.  10. An RFID system, characterized by comprising  a reader, configured to establish a connection with the tag, and send a user password to the tag;  The tag is configured to receive the user password; the user password in the user password area including at least two users is matched, and the user storage area corresponding to the user password is matched; according to the permission and the user storage area, Execute the received control command.