CN1319295A - 在数据交换中鉴别至少一个用户的方法 - Google Patents

在数据交换中鉴别至少一个用户的方法 Download PDF

Info

Publication number
CN1319295A
CN1319295A CN99811212A CN99811212A CN1319295A CN 1319295 A CN1319295 A CN 1319295A CN 99811212 A CN99811212 A CN 99811212A CN 99811212 A CN99811212 A CN 99811212A CN 1319295 A CN1319295 A CN 1319295A
Authority
CN
China
Prior art keywords
data
inquiry
user
algorithm
processing
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN99811212A
Other languages
English (en)
Other versions
CN1143483C (zh
Inventor
W·波克兰德特
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Infineon Technologies AG
Original Assignee
Infineon Technologies AG
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Infineon Technologies AG filed Critical Infineon Technologies AG
Publication of CN1319295A publication Critical patent/CN1319295A/zh
Application granted granted Critical
Publication of CN1143483C publication Critical patent/CN1143483C/zh
Anticipated expiration legal-status Critical
Expired - Fee Related legal-status Critical Current

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • GPHYSICS
    • G07CHECKING-DEVICES
    • G07FCOIN-FREED OR LIKE APPARATUS
    • G07F7/00Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
    • G07F7/08Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means
    • G07F7/10Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means together with a coded signal, e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
    • G07F7/1008Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00Payment architectures, schemes or protocols
    • G06Q20/30Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/34Payment architectures, schemes or protocols characterised by the use of specific devices or networks using cards, e.g. integrated circuit [IC] cards or magnetic cards
    • G06Q20/341Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00Payment architectures, schemes or protocols
    • G06Q20/30Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/36Payment architectures, schemes or protocols characterised by the use of specific devices or networks using electronic wallets or electronic money safes
    • G06Q20/367Payment architectures, schemes or protocols characterised by the use of specific devices or networks using electronic wallets or electronic money safes involving electronic purses or money safes
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00Payment architectures, schemes or protocols
    • G06Q20/30Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/36Payment architectures, schemes or protocols characterised by the use of specific devices or networks using electronic wallets or electronic money safes
    • G06Q20/367Payment architectures, schemes or protocols characterised by the use of specific devices or networks using electronic wallets or electronic money safes involving electronic purses or money safes
    • G06Q20/3672Payment architectures, schemes or protocols characterised by the use of specific devices or networks using electronic wallets or electronic money safes involving electronic purses or money safes initialising or reloading thereof
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00Payment architectures, schemes or protocols
    • G06Q20/38Payment protocols; Details thereof
    • G06Q20/40Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401Transaction verification
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00Payment architectures, schemes or protocols
    • G06Q20/38Payment protocols; Details thereof
    • G06Q20/40Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/409Device specific authentication in transaction processing
    • G06Q20/4097Device specific authentication in transaction processing using mutual authentication between devices and transaction partners
    • G06Q20/40975Device specific authentication in transaction processing using mutual authentication between devices and transaction partners using encryption therefor
    • GPHYSICS
    • G07CHECKING-DEVICES
    • G07FCOIN-FREED OR LIKE APPARATUS
    • G07F7/00Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
    • G07F7/08Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means
    • G07F7/0806Details of the card
    • G07F7/0813Specific details related to card security
    • G07F7/082Features insuring the integrity of the data on or in the card
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3234Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response

Abstract

在至少两个用户(1,2)之间在数据交换中鉴别至少一个用户(2)的方法中,由第一用户(1)向第二用户(2)传送一个第一数据(查询),该第二用户(2)借助一种算法处理此第一数据(查询)成为第二数据(响应),并将此数据传送给第一用户(1),该用户检查此数据的正确性。在借助算法处理第一数据(查询)的同时至少进行对第一数据(查询)的另一处理。

Description

在数据交换中鉴别至少一个用户的方法
本发明涉及在至少两个用户之间进行数据交换中鉴别至少一个用户的方法,在这种方法中,由第二用户传送给第一用户一个第一数据,第一用户借助一种算法处理此第一数据形成一个第二数据,并将此数据传送给第二用户,随之第二用户检查此第二数据的正确性。
这类方法从Hanns-Peter Knigs的文章″在标准化过程中,对智能卡进行密码识别的方法Cryptographic Identification Methodsfor Smart Cards in the Process of Standardization″IEEECommunications Magazine,卷29,第6期,1991年6月,42-48页,是已知的。在那里的方法中由写/读终端向智能卡发送一随机数作为第一数据,并在那里借助一种秘密算法和至少一秘密数字加密。此加密的结果由智能卡送回终端,并在那里或者脱密或者也以同样方法加密。将有关的结果与起初被发送的随机数或与所接收的第二数据进行比较。一个比较结果为正值则表明,两个数据交换用户都具有正确的算法和正确的秘密数字或具有正确的密钥,并且从而是可信的。
只有当数据交换仅涉及与金融或与安全有关的过程时,才优先使用这种鉴别方法。当然这样的过程易经常遭受到攻击。在此对一个入侵者提出的任务是找出所参予的密钥、秘密数字和算法。从通信的过程中可以推导出所采用鉴别的类型和从而达到攻击的目的。
本发明的任务是,尽可能好地隐蔽所进行的鉴别方法的类型。
该任务通过权利要求1的方法解决。优选进一步扩展在从属权利要求中给出。
通过同时实施至少两个处理过程给入侵者明显地增加困难,从探查例如与时间有关的功率吸收中推导出鉴别的内部运行过程。
下面借助实施例利用附图进一步说明本发明。
图1中,数据交换系统的原理图示出第一用户1,它可能是例如读/写终端,第二用户2,它在实例中应是智能卡或芯片卡。在下面叙述的实施例中,第二用户也就是这种卡向第一用户即终端应进行自我鉴别。由于这种原因只示出了卡中必要的电路装置。对于终端1向卡2也应进行自我鉴别的情况,终端1也必须具有相应的电路装置。
首先终端1发送第一数据,所谓的查询,到卡2。按本发明所述方法该查询在那里既输送给第一处理装置VE1也输送给第二处理装置VE2。为了进行鉴别必要的处理查询,由存储区SP输送给处理装置VE1、VE2必要的信息如秘密数或密钥。
处理本身或者可以是查询与预期的、在存储器区域SP中存储的值进行简单比较,或者相反例如是依据DES或RSA算法的一种复杂的加密。为此目的,处理单元VE1、VE2可以作为复合微处理器与对应的密码协同处理器一起构成。常常使用按硬件实现的单向加密装置,该装置例如用一个反馈移位寄存器构成。
处理装置VE1、VE2的输出数据被输送给逻辑装置,其输出信号作为响应转送给终端1。逻辑装置VKE不必强制性地将处理装置VE1、VE2的输出数据相互结合,而是也可以只让第一处理装置VE1的输出数据不加改变地作为响应通过并且阻塞第二处理装置VE2的输出数据,因为本发明的主要方面是在同时运行过程中至少两个,优选不同的处理过程的至少两个过程,以便例如不能从功率吸收中推导出内部结构和从属数据。
然而,如果处理装置VE1、VE2的输出数据例如借助实现逻辑装置VKE的EXOR门电路相互结合则更显其优点。
附图中的方框图还示出本发明的进一步扩展的两个处理单元VE1、VE2的逻辑连接。这里所说的逻辑连接是在一个处理单元中,数据处理的中间结果或最终结果包括在有关的另外处理单元的处理中。在此,在本发明的笫一种进一步扩展中,只是一个单元的输出数据在另外的处理单元中被考虑,而在另一个进一步扩展中,两个处理单元的输出数据都在各自的另一个处理单元中被考虑。
如在本说明书引言部分所述,应答的正确性可在终端1中以不同方式检验。为此,在已述的文献中已经详细的给出和说明了几种可能的方法,并且由于这种原因在附图中不再进一步说明。
在本发明的另一种方案中设置了一个差错计数器FZ,该计数器记录比较结果的负值的数量,并且在遇到某一预先设定的数量时处理装置VE1、VE2被阻塞,以便不能再进行进一步的鉴别和从而在终端1和卡2之间不能再进行进一步的数据交换。由此实现不能进行无数次试验来查询探查鉴别过程。

Claims (7)

1.在至少两个用户(1,2)之间进行数据交换中鉴别至少一个用户(2)的方法,其中由第一用户(1)传送给第二用户(2)一个第一数据(询问),第二用户(2)借助一种算法处理此第一数据(询问)形成一个第二数据(应答),并将此数据传送给第一用户(1)和第一用户(1)检查此第二数据(应答)的正确性,
其特征在于,
在借助算法进行对第一数据(询问)处理的同时,至少进行对第一数据(询问)的另一处理。
2.按权利要求1的方法,
其特征在于,
另一处理借助第二种算法进行。
3.按权利要求1的方法,
其特征在于,
另一处理是第一数据(查询)与预先给出的数据的比较。
4.按上述权利要求之一的方法,
其特征在于,
两种处理结果被相互结合成第二数据(响应)。
5.按上述权利要求之一的方法,
其特征在于,
对第一数据(查询)另一处理的最终结果或中间结果被用于借助第一算法对第一数据(查询)的处理。
6.按上述权利要求之一的方法,
其特征在于,
借助第一种算法对第一数据(查询)处理的最终结果或中间结果被用于对第一数据(查询)的另一处理。
7.按上述权利要求之一的方法,
其特征在于,
处理过程的数量受差错计数器(FZ)的限制。
CNB998112127A 1998-09-22 1999-09-09 在数据交换中鉴别至少一个用户的方法 Expired - Fee Related CN1143483C (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
EP98117939 1998-09-22
EP98117939.3 1998-09-22

Publications (2)

Publication Number Publication Date
CN1319295A true CN1319295A (zh) 2001-10-24
CN1143483C CN1143483C (zh) 2004-03-24

Family

ID=8232675

Family Applications (1)

Application Number Title Priority Date Filing Date
CNB998112127A Expired - Fee Related CN1143483C (zh) 1998-09-22 1999-09-09 在数据交换中鉴别至少一个用户的方法

Country Status (12)

Country Link
US (1) US6934843B2 (zh)
EP (1) EP1116358B1 (zh)
JP (1) JP3869657B2 (zh)
KR (1) KR100399809B1 (zh)
CN (1) CN1143483C (zh)
AT (1) ATE249119T1 (zh)
BR (1) BR9914035A (zh)
DE (1) DE59906893D1 (zh)
ES (1) ES2207285T3 (zh)
RU (1) RU2211547C2 (zh)
UA (1) UA65633C2 (zh)
WO (1) WO2000018061A1 (zh)

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE10000503A1 (de) * 2000-01-08 2001-07-12 Philips Corp Intellectual Pty Datenverarbeitungseinrichtung und Verfahren zu dessen Betrieb
DE10130099B4 (de) * 2001-06-21 2004-04-08 Infineon Technologies Ag Challenge-Response-Vorrichtung, Authentifikationssystem, Verfahren zum Erzeugen eines Response-Signals aus einem Challenge-Signal und Verfahren zur Authentifikation
JP2004112476A (ja) * 2002-09-19 2004-04-08 Sony Corp データ処理方法、そのプログラムおよびその装置
GB0514492D0 (en) * 2005-07-14 2005-08-17 Ntnu Technology Transfer As Secure media streaming
DE102005062763B4 (de) * 2005-12-28 2007-08-30 Siemens Ag Schaltungsanordnung für eine Speicherkarte mit Debit- oder Ausweiskartenfunktion
GB2443264A (en) * 2006-10-27 2008-04-30 Ntnu Technology Transfer As Integrity checking method for a device in a computer network, which controls access to data; e.g. to prevent cheating in online game

Family Cites Families (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH0654507B2 (ja) 1986-02-18 1994-07-20 株式会社東芝 携帯可能電子装置
DE69127560T2 (de) * 1990-01-30 1998-04-23 Toshiba Kawasaki Kk Gegenseitiges Erkennungssystem
JPH04143881A (ja) * 1990-10-05 1992-05-18 Toshiba Corp 相互認証方式
JPH06289782A (ja) 1993-04-07 1994-10-18 Matsushita Electric Ind Co Ltd 相互認証方法
DE4317380C1 (de) * 1993-05-25 1994-08-18 Siemens Ag Verfahren zur Authentifikation zwischen zwei elektronischen Einrichtungen
EP0701718A4 (en) * 1993-06-02 2000-03-29 Verifone Inc SYSTEM AND METHOD FOR RE-EVALUATING TOKENS STORED IN CI CARDS
DE4339460C1 (de) * 1993-11-19 1995-04-06 Siemens Ag Verfahren zur Authentifizierung eines Systemteils durch ein anderes Systemteil eines Informationsübertragungssystems nach dem Challenge-and Response-Prinzip
US5761309A (en) * 1994-08-30 1998-06-02 Kokusai Denshin Denwa Co., Ltd. Authentication system
JP3272213B2 (ja) * 1995-10-02 2002-04-08 インターナショナル・ビジネス・マシーンズ・コーポレーション Icカード及び情報処理装置の認証方法
US5991407A (en) * 1995-10-17 1999-11-23 Nokia Telecommunications Oy Subscriber authentication in a mobile communications system
JPH09128507A (ja) * 1995-11-02 1997-05-16 Oki Electric Ind Co Ltd 相互認証方法
NL1001863C2 (nl) * 1995-12-08 1997-06-10 Nederland Ptt Werkwijze voor het beveiligd afwaarderen van een elektronisch betaalmid- del, alsmede betaalmiddel voor het ten uitvoer leggen van de werkwijze.
JPH09238132A (ja) * 1996-02-29 1997-09-09 Oki Electric Ind Co Ltd 携帯用端末通信システム及びその通信方法
US6073236A (en) * 1996-06-28 2000-06-06 Sony Corporation Authentication method, communication method, and information processing apparatus
JPH1069222A (ja) 1996-08-27 1998-03-10 Dainippon Printing Co Ltd Icカード
JPH1079733A (ja) * 1996-09-03 1998-03-24 Kokusai Denshin Denwa Co Ltd <Kdd> Icカードを用いた認証方法及び認証システム
GB2321741B (en) * 1997-02-03 2000-10-04 Certicom Corp Data card verification system
US6298442B1 (en) * 1998-06-03 2001-10-02 Cryptography Research, Inc. Secure modular exponentiation with leak minimization for smartcards and other cryptosystems

Also Published As

Publication number Publication date
EP1116358A1 (de) 2001-07-18
US20010021975A1 (en) 2001-09-13
BR9914035A (pt) 2001-06-19
UA65633C2 (uk) 2004-04-15
US6934843B2 (en) 2005-08-23
ES2207285T3 (es) 2004-05-16
ATE249119T1 (de) 2003-09-15
EP1116358B1 (de) 2003-09-03
WO2000018061A1 (de) 2000-03-30
RU2211547C2 (ru) 2003-08-27
KR100399809B1 (ko) 2003-09-29
KR20010079902A (ko) 2001-08-22
DE59906893D1 (de) 2003-10-09
CN1143483C (zh) 2004-03-24
JP3869657B2 (ja) 2007-01-17
JP2002525972A (ja) 2002-08-13

Similar Documents

Publication Publication Date Title
US4438824A (en) Apparatus and method for cryptographic identity verification
Juels Strengthening EPC tags against cloning
CN106415611B (zh) 自认证芯片
US8316221B2 (en) Recording of a key in an integrated circuit
US6983882B2 (en) Personal biometric authentication and authorization device
US7571461B2 (en) Personal website for electronic commerce on a smart Java card with multiple security check points
KR102277646B1 (ko) 자동 기계에 대한 사용자의 인증 방법
CA2221321A1 (en) Tokenless identification system for authorization of electronic transactions and electronic transmissions
CN1143483C (zh) 在数据交换中鉴别至少一个用户的方法
US20190019189A1 (en) Payment authentication
TW202040385A (zh) 以裝置識別資料透過電信伺服器識別身份之系統及方法
US20090265270A1 (en) Token activation
JP2003123032A (ja) Icカード端末および本人認証方法
US10503936B2 (en) Systems and methods for utilizing magnetic fingerprints obtained using magnetic stripe card readers to derive transaction tokens
Van Deursen 50 ways to break RFID privacy
RU2412484C2 (ru) Защищенный переносной терминал для электронных транзакций и защищенная система электронных транзакций
US20090037744A1 (en) Biometric pin block
TWM580206U (zh) System for identifying identity through device identification by device identification data
JPH09265254A (ja) 情報記憶媒体の相互認証システム
US20040128258A1 (en) Card certification and authorization system and method thereof
JP2004287805A (ja) 子カード発行システムおよび子カード利用システム
CN106056793A (zh) 一种读卡系统和读卡方法
WO2007036901A1 (en) Method and device for privacy protection of rfid tags
JP2000251050A (ja) Icカード、icカード情報読取装置、icカード情報集中管理装置、icカードの不正記録情報検知方法及びシステム
JPH1097499A (ja) 個人認証方法

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
C14 Grant of patent or utility model
GR01 Patent grant
CF01 Termination of patent right due to non-payment of annual fee

Granted publication date: 20040324

Termination date: 20170909

CF01 Termination of patent right due to non-payment of annual fee