WO2011137499A1

WO2011137499A1 - Secure communications system based on radiofrequency identification and exchange of information

Info

Publication number: WO2011137499A1
Application number: PCT/BR2010/000304
Authority: WO
Original assignee: Miinistério Das Cidades /Departamento Nacional De Trânsito; BOHN, Jürgen Josef
Priority date: 2010-05-07
Filing date: 2010-09-20
Publication date: 2011-11-10
Also published as: BRPI1001987A2; BRPI1001987B1

Abstract

Disclosed is the implementation of a secure communication method based on the ISO 18000-6C protocol, using secure data encryption mechanisms to provide means of mutual authentication by challenge-response between interrogator and transponder, including the transmission of an identifier with additional transponder identification data to the interrogator, the transmission being protected by dynamic encryption and authenticity and integrity codes; the secure and authenticated reading and writing of data in the memory of the transponder, in both cases with a challenge-response authorisation of each request and protection of the data transmitted in the physical layer by dynamic encryption and authenticity and integrity codes, comprising an execution scheme with two command phases, and an execution scheme with intercalated command sequences, shortening execution time of customised commands that are computationally intensive in the transponder, in comparison with sequential execution, and making efficient processing of communication failures possible.

Description

SECURE COMMUNICATION SYSTEM BASED ON IDENTIFICATION AND EXCHANGE OF INFORMATION BY

RADIO FREQUENCY FIELD OF APPLICATION

This report describes the Invention of Invention of a

SAFE COMMUNICATION SYSTEM BASED ON IDENTIFICATION AND EXCHANGE OF INFORMATION BY RADIO FREQUENCY, which will be employed in the communication between a transmitter and one or multiple receivers / transmitters, aiming to provide greater security and communication efficiency in systems based on the standardized ISO 18000 protocol. -6C, which will be used on the platform of the National Automatic Vehicle Identification System (SINIAV).

DEFINITIONS The National Automatic Vehicle Identification System

(SINIAV), approved by resolution of the National Traffic Council, was created with the purpose of planning and implementing actions to combat theft and theft of vehicles and cargo, as well as to manage traffic control.

Defined by Resolution No. 212 of the National Traffic Council, SINIAV is the result of studies developed by the Working Group defined by the Ministry of Cities, composed of representatives of the National Traffic Department, Presidential Institutional Security Office, Municipal Secretariat. Paulo State Traffic Department and the Rio de Janeiro State Traffic Department, which drafted a proposal establishing the requirements for the implementation of the system that will be able to identify the vehicles of the Brazilian fleet.

Also in accordance with Resolution No. 212 of the National Traffic Council and its possible amendments, SINIAV is composed of electronic cards installed in vehicles that act as receivers / transmitters; reader antennas, which act as receivers, and computerized processing centers, with the electronic plate having a unique serial number and containing vehicle information such as the plate number; chassis, and the RENAVAM code.

The electronic board will become an effective instrument for monitoring projects aimed at increasing urban mobility and environmental control, and antennas that read vehicle data will be installed in locations to be defined by the State Traffic Departments (DETRANs). .

At the state level, the State Traffic Departments will be responsible for the management of the system, as well as for the implantation of the electronic identification plates of the vehicles that will be installed in the places that allow its operation.

PASSWORD V aims to comply with the indications provided for in Article 114 of

Brazilian Traffic Code, with regard to vehicle identification, as well as Complementary Law No. 121 of February 09, 2006, which created the National System for Prevention, Inspection and Suppression of Vehicle and Cargo Theft.

After implementation of the SIN1AV, the vehicle that does not have the electronic identification plate will be in irregular condition, subjecting its owner to the violation of traffic classified as serious, being susceptible to sanctions provided for in Article 237 of the Brazilian Traffic Code, which provides , in addition to a fine, loss of five points at CNH, and vehicle retention for regularization.

ISO 18000-6 / Amdl - Type C Transponder Extension, hereafter simply referred to as ISO 18000-6C, is used in radio frequency identification (RFID) systems in the ultra-high frequency (UHF), which can range from 860-960 MHz, and is the first RFBD standard to be ratified worldwide by the International Organization for Standardization (ISO) [ISO / IEC 18000- 6, ISO / IEC 18000-6 / Amd 1].

The basic FID system contains interrogators, also called readers, as well as receivers / transmitters, also called transponders or electronic boards. As specified in the ISO 18000-6C protocol, an interrogator transmits information to a transponder by modulating an RF signal in the 860-960 MHz frequency band. The transponder returns the information to the interrogator by modulating the same RF signal. , and thus, by attaching transponders to objects, their presence and identification can be determined by interrogators in the face of transponder signaling, thereby providing configurations of remote object identification systems based on the ISO standard. 18000-6C, which are currently widely used in Brazil and abroad.

BACKGROUND ART

In current techniques, remote object identification systems based on the ISO 18000-6C standard provide little protection against the possibility of unauthorized third parties deciphering data that is communicated between the interrogator and the transponder, thereby allowing access to recorded and / or generated information, also allowing an attacker to write data to the transponder.

There is consensus that it is generally relatively easy to emulate a transponder that implements the ISO 18000-6C standard, which becomes extremely problematic when applying this technology to systems where data security is a priority requirement.

The current state of the art related to the security means in ISO 18000-6C-based implementations terminate short (32-bit) password combinations in combination with a technique called "cover-coding" (16-bit random number XOR). Therefore, these means provide only limited protection for data transmission at the physical layer, associated with wireless communication between the interrogator and the transponder, and access to the functionality of the transponders themselves; thus, these media can be easily broken and are therefore unsuitable for applications requiring a high level of data security.

Transponders, configured to the ISO 18000-6C standard, are vulnerable to unauthorized manipulation, including data deletion; clandestine listening of data during communication; unauthorized reading of data; altering stored data, and falsifying - either by cloning, mimicking or emulating the transponders.

The solution provided by the object of the present invention presents an alternative and innovative solution, configured in the ISO 18000-6C standard, which provides security level to the communicated and recorded data, compatible with the intended application.

The proprietary transponder security system, configured under the ISO 18000-6C EAS standard, utilizes 32-bit secret access keys for transponder memory access control, which provides a basic level of access control protection, without data encryption. The lack of encryption of data transmitted over the air interface makes this system unsuitable to protect the confidentiality required for high security applications.

Another relevant mechanism in the market, which can be considered lightweighf and suitable for low-power operation and commercial transponder use. RFID / UHF passive, in the ISO 18000-6C standard, is the proprietary Cryptol cipher, which is currently being used mainly in passive HF transponders, configured to ISO 14443 and MEFARE (MIFA E Classic) standards, for data encryption with 48-bit secret keys. However, there is a body of literature reporting successful cryptoanalytic attacks against this proprietary cipher used for authentication and encryption, which resulted in the determination of secret keys in the order of magnitude of minutes.

There are other solutions that provide data protection means in RFID systems; however, they rely on proprietary or non-ISO 18000-6C compliant protocols.

SUMMARY OF THE INVENTION

Therefore, the development of a remote identification system based on the international standard ISO 18000-6C is extremely desirable, which adds high level of transponder identification data security, reading and writing data.

Non-exhaustive examples of identification systems that require a high level of data and communication security are vehicle identification systems, including electronic vehicle registration and electronic toll systems.

The present invention aims to overcome deficiencies that are found in the usual identification and communication systems based on the ISO 18000-6C standard by introducing custom commands to the standard itself, resulting in a system suitable for applications requiring a high level of protection. authenticity of interrogators and transponders; authorization of access to transponder functionality, and protection of the confidentiality, integrity and timeliness of data communicated between interrogators and transponders using standardized high end.

The present invention defines an efficient execution scheme for custom commands, allowing communication fault handling, reducing execution time compared to sequential execution while maintaining full compliance with the ISO 18000-6C protocol.

OBJECTIVES OF THE INVENTION

In view of the foregoing, the main object of the invention is to propose a secure communication system based on the standardized ISO 18000-6C radio frequency identification protocol.

Another object of the invention is to propose a secure communication system whose communication protocol will allow the remote identification of transponders with complete security.

Another object of the invention is to propose a secure communication system using a tamper-resistant encryption algorithm.

Another object of the invention is to propose a secure communication system with dynamic data encryption, resulting in ciphertext whose binary representation varies with the time of encryption, regardless of the characteristics of the original text.

Another object of the invention is to propose a secure communication system that establishes a unique communicative session context between an interrogator and a transponder, with nonces, and optionally with the generation of variable secret cryptographic keys per session.

Another object of the invention is to propose a secure communication system that ensures accurate implicit authentication of the interrogator requesting identification of a transponder.

Another object of the invention is to propose a secure communication system that ensures accurate authentication of the identified transponder by the interrogator.

Another object of the invention is to propose a secure communication system that ensures that only system-authenticated interrogators can unambiguously identify transponders.

Another object of the invention is to propose a secure communication system that ensures the protection of the confidentiality, integrity, and timeliness of information transmitted via a communication medium, preferably via air, between an interrogator and a transponder.

Another object of the invention is to propose a secure communication system that ensures that only an authenticated and authorized interrogator can read information from the transponder.

Another object of the invention is to propose a secure communication system that ensures that only an authenticated and authorized interrogator can write information on the transponder.

Another object of the invention is to propose a secure communication system that ensures that an interrogator receives encrypted status code in response to each command executed, with the intention of reliably changing the state of the transponder's persistent memory, ensuring consistency of the transponder memory.

Another object of the invention is to propose a secure communication system which ensures data encryption protected against unauthorized alterations, including data substitution and / or alteration of the transmitted data sequence.

Another object of the invention is to propose a secure communication system which ensures that session hijacking after successful mutual authentication between interrogator and transponder is not practicable.

Another object of the invention is to propose a communication system It is secure that ensures the transponder prompt response, even when executing commands whose processing is computationally expensive on the transponders.

Another object of the invention is to propose a secure communication system that allows parallel command execution over time of operations on multiple transponders, reducing the total execution time and making the interaction between an interrogator and multiple transponders more efficient.

Another object of the invention is to propose a secure communication system which can enable the permanent deactivation of native commands and the corresponding state machine states and transitions of the ISO 18000-6C protocol that compromise the effectiveness of their communication.

Another object of the invention is to propose a secure communication system that extends the state machine of the ISO 18000-6C protocol, in consideration of new custom commands.

Another objective of the invention is to propose a secure communication system that maintains full compatibility with the ISO 18000-6C protocol by leveraging the concept of custom commands, allowing extension of functionality of the existing protocol without however changing its characteristic. fundamental to be ISO 18000-6C.

Another object of the invention is to propose a secure communication system that allows the ISO 18000-6C protocol inventory procedure on the transponder, where mutual authentication between an interrogator and a transponder can be performed by exchanging only two instead of three. , explicit messages.

Another object of the invention is to propose a secure communication system that enables authentication and identification of high speed transponders. Another object of the invention is to propose a secure communication system that allows the authentication and identification of transponders through a single combined command, with transmission of a limited size identifier data, enabling high transmission time efficiency by reducing communication overhead, and maximizing the contiguous processing interval on the transponder, reducing processing overhead on the interrogator.

BACKGROUND OF THE INVENTION

The above objectives, as well as others, are achieved by the invention by systemic functional improvements introduced in the transponders; interrogators, and the ISO 18000-6C communication protocol.

Another feature of the secure communication system is that it employs custom commands for interrogators, which generate corresponding responses for transponders.

Another feature of the secure communication system is that it employs a symmetric encryption algorithm.

Another feature of the secure communication system is that the transponder has a unique and unique ID denoted UTID (unique transponder identifier).

Another feature of the secure communication system is that each transponder has a group ID denoted GID.

Another feature of the secure communication system is that the symmetric encryption algorithm encrypts information prior to transmission via the communication interface.

Another feature of the secure communication system is that the cryptographic code is changed in each communication.

Another feature of the secure communication system is the because custom commands perform transponder authentication.

Another feature of the secure communication system is that custom commands perform the interrogator authentication in an implicit and explicit manner.

Another feature of the secure communication system is that custom commands read transponder information, authenticate the request and protect the information transmitted by encryption.

Another feature of the secure communication system is that custom commands execute writing information on the transponder, with request authentication and protection of information transmitted by encryption.

Another feature of the secure communication system is that it provides a means for returning interrogators a cryptographically protected status code in response to each command sent and executed by a transponder, with the intention of changing the state of the transponder's persistent memory. .

Another feature of the secure communication system is that it provides a means to prevent session hijacking after successful mutual authentication between the interrogator and the transponder.

Another feature of the secure communication system is that it provides auxiliary custom commands, which execute computationally expensive custom commands on transponders in two phases.

Another feature of the secure communication system is that it establishes a temporary context, denoted session, as part of any interaction of limited duration between an interrogator and a transponder, which involves identifying the transponder, reading data from or writing data to the transponder, and where establishing a session covers a coordinated initialization of the interrogator and transponder cryptographic machines.

Another feature of the secure communication system is that the custom commands and corresponding responses of the communication protocol consist of parameters that vary in a coordinated manner before each message exchange between an interrogator and a transponder.

Another feature of the secure communication system is that custom commands are executed by parallelism on multiple transponders over time.

Another feature of the secure communication system is that the transponder may consist of a passive, semi-passive / semi-active or active device.

Another feature of the secure communication system is that the transponder has volatile (eg RAM) and nonvolatile (eg EEPROM) memories.

Another feature of the secure communication system is that the transponder has a state machine, which defines its behavior in relation to commands received from interrogators, the internal state and the processing performed.

Another feature of the secure communication system is that the transponder has the implementation of a symmetric key cryptographic algorithm, also called a cryptographic machine.

Another feature of the secure communication system is that the cryptographic machine has a pseudo-random number generator (PRNG). Another feature of the secure communication system is that the transponder has a mechanism for generating and verifying binary error detection codes.

Another feature of the secure communication system is that the transponder has a mechanism for generating and verifying authentication and integrity cryptographic codes over binary data.

Another feature of the secure communication system is that it has a mechanism for enabling or disabling dynamic generation of authentication and integrity cryptographic codes.

Another feature of the secure communication system is that it has a mechanism for enabling or disabling the inclusion of a pre-recorded static integrity and authentication cryptographic code in the transponder memory in the transponder authentication response.

Another feature of the secure communication system is that the transponder has a mechanism for dynamic cryptographic key generation for single use per communicative session.

Another feature of the secure communication system is that it has a mechanism for enabling or disabling dynamic cryptographic key generation.

Another feature of the secure communication system is that it disables native commands from the ISO 18000-6C protocol.

Another feature of the secure communication system is that partial disabling of the original state machine from the ISO 18000-6C protocol.

Another feature of the secure communication system is that it prepares UII response data on transponders during inventory according to ISO 18000-6C to subsequent authentication and identification phase and establishment of a secure session context.

Another feature of the secure communication system is that it modifies the generation of the UH response in transponders during inventory according to the ISO 18000-6C protocol, including the insertion of a random value in the transponder response generated during runtime.

Another feature of secure communication system is full compatibility with ISO 18000-6C.

Another feature of the secure communication system is the authentication and identification of transponders through a single combined command, with transmission of a limited size identifying data set.

Another feature of the secure communication system is single-command authentication in conjunction with two-phase execution to maximize parallel over time for multi-transponder operations, resulting in optimal performance of high-speed transponder interaction. .

BRIEF DESCRIPTION OF THE FIGURES

Other objects, features and advantages of the present invention will be further appreciated by descriptions of preferred embodiments of the invention, provided by way of non-limiting example, and the accompanying figures, and where:

Figure 1 schematically illustrates the simplified block diagram of the proposed secure communication system;

Figure 2 schematically illustrates a CTR mode initialization mechanism of a cryptographic machine on the interrogator and transponder as part of a communicative session; Figure 3 schematically illustrates a first initiation mechanism of a new session between an interrogator and a transponder;

Figure 4 illustrates a schematic representation of the inventory according to the ISO 18000-6C protocol, with the transponder response as a second alternate initialization mechanism;

Figure 5 illustrates a schematic representation of the inventory according to the ISO 18000-6C protocol, with transponder response as a third alternative boot mechanism;

Figure 6 illustrates an alternative mechanism for establishing a new pair of random values between the interrogator and the transponder;

Figure 7 schematically illustrates the implicit mutual authentication between an interrogator and a transponder, with reading transponder identifying data protected by a cryptographic envelope;

Figure 8 schematically illustrates a secure and authenticated reading between an interrogator and a transponder;

Figure 9 schematically illustrates secure and authenticated writing between an interrogator and a transponder;

Figure 10 schematically illustrates the extended state machine of the transponders;

Fig. 11 schematically illustrates the two-phase command execution mechanism by auxiliary messages;

Fig. 12 schematically illustrates the interleaved command execution mechanism for interaction between an interrogator and multiple transponders;

Figure 13 schematically illustrates a mechanism that allows the interrogator to obtain a permanent handle of a transponder after singularization;

Figure 14 schematically illustrates another embodiment of authentication. implicit mutual between an interrogator and a transponder, with reading transponder identifier data protected by a cryptographic envelope, with certain command and response parameters being represented by unencrypted text;

Fig. 15 schematically illustrates a second extended state machine embodiment of the transponders, in which the transponder does not respond to new interrogator command requests while processing a custom command;

Figures 16, 17, 18, and 19 schematically illustrate varied embodiments of the implicit mutual authentication mechanism between an interrogator and a transponder, with reading transponder identifying data protected by a cryptographic envelope.

Figures 19, 20, 21, 22, 23, and 24 schematically illustrate varied embodiments of the authenticated secure reading mechanism.

Figures 25, 26, 27, and 28 schematically illustrate varied embodiments of the authenticated secure writing mechanism.

Fig. 29 schematically illustrates a combined embodiment of the two authenticated secure reading and writing mechanisms.

Preferred Description of the Invention

The secure communication system based on the ISO 18000-6C protocol comprises, among others, a communication medium consisting of a set of custom commands, configured in accordance with the ISO 18000-6C specification, to be implemented in the following interrogators and transponders, including specifying their valid transponder responses, to provide identification and access to transponder data via cryptographic mechanisms; a set of auxiliary custom commands to be implemented interrogators and transponders, to improve the efficiency of transponder operations in handling communication and execution failures, and in specifying valid transponder responses, and in specifying the extent of the transponder state machine by taking into account the commands customized in the present invention.

System Simplified Block Diagram

Figure 1 illustrates the simplified schematic diagram of the proposed secure communication system block diagram, which is a first embodiment of the present invention, and where, without limitation of generality, the system operability can be divided into three sequential phases:

Singularization of transponders by the interrogator, according to the mechanism specified in the ISO 18000-6C protocol, with the establishment of permanent control references by means of a new custom Req Handle command, which constitutes a second embodiment of the present invention.

Mutual authentication between interrogator and transponder, with implicit identification and reading of transponder data, through a new custom command Mutual Auth Read, which is another embodiment of the present invention.

Authenticated read and write access to transponder memory through new custom commands Secure Auth Read and Secure Auth Write, which constitute further embodiments of the present invention.

Custom commands

In one embodiment of the present invention, the secure communication system covers the following main custom commands:

. Mutual Auth Read (MAR) . Secure Auth Read (SAR)

. Secure Auth Write (SAW)

In another embodiment of the present invention, the secure communication system - other than the ISO 18000-6C standard, transponder TID, UII, and USER memory areas can be accessed exclusively through the main custom commands protected by Mutual encryption mechanisms. Auth Read, Secure Auth Read and Secure Auth Write, or similar custom command protected by data security mechanisms; encryption, authentication, and authorization mechanisms.

In another embodiment of the present invention, the secure communication system also covers the following auxiliary custom commands:

. Finalize

. Init CryptoEngine

. Init Session

. Req iandle

. Set RN TN

It should be noted that the decisive and essential qualities of the secure communication system are based on the features and functionality inherent in the commands, and on specific responses, regardless of the names chosen for these commands and their respective responses, as well as the parameters. included in the signatures of these commands and responses.

Native commands disabled

In another embodiment of the present invention, the secure communication system defines a set of native transponder commands specified in the ISO 18000-6C protocol for deletion. or for permanent deactivation after initialization and before the first use of the field transponder:

. Read

. Write

. Kill

. Lock

. Access

. Blockword

. BlockErase

Note that custom commands Secure Authenticated Read and

Secure Authenticated Write is a safe replacement for the functionality of native Read, Write, BlockWrite, and BlockErase commands. The functionality of the BlockErase command, in particular, can be achieved by overwriting existing information by well-defined new information, such as a zero-value sequence of bits in the memory area, by using the Secure Authenticated Write command.

Fundamental Definitions

In order to enable communicative interaction with a transponder that is located in the interrogation zone according to the ISO 18000-6C protocol, the interrogator has to detect and singularize the transponder, and for this the ISO 18000-6C protocol defines the detection phase. and transponder singulation by the interrogator, called inventory.

Upon successful completion of this transponder singularization phase, the interrogator is aware of a transponder temporary identifier called RN 16, each RN 16 consisting of a well-defined bit-code binary code which is used, by the interrogator to address messages to the transponder as part of communication via the air interface, and, once established, RN 16 is valid until the transponder participates in a new inventory, where a new RN 16 is generated, or until that receives an explicit request for a new generation.

As a non-limiting reference to the generality of the present secure communication system, it is assumed that RN 16 is represented by a 16-bit binary number as specified in the ISO 18000-6C protocol. Secure communication allows the use of temporary identifiers of arbitrary formats and sizes.

The temporary communicative dialogue, involving the exchange of messages and information, between an interrogator and a transponder constitutes a communicative session, or simply a session, and a new session begins from the establishment of a permanent Handle for the transponder between the interrogator and the transponder. transponder, and terminates when the interrogator discards the current known permanent handle, terminating interaction with the transponder, or if the transponder's currently known permanent handle becomes invalid, without the interrogator being aware of a valid new permanent handle. The maximum validity of an established permanent Handle is limited to the duration of the communicative session.

In the description of the present invention, where not otherwise specified, the word Handle is also used in the sense of permanent Handle.

The present secure communication system covers an identifier stored permanently in the physical memory of each transponder, dynamically generated by the transponder at runtime, such as the identifier is unique and allows unambiguous identification of the transponder, and in the context of the present invention this identifier is called a unique transponder identifier (UTID) and in principle this identifier may be implemented by any binary code . As a non-limiting reference to the generality of the secure communication system, the UTID in the transponders was assumed to be represented by a 64-bit binary number.

The present secure communication system covers a group identifier, called GID, permanently stored in the physical memory of the transponders, with the following semantics: any two transponders belonging to the same group use the same binary code and the same GID ( cryptographic key (s) to establish the secure context of a temporary communicative session for the purpose of transponder authentication by the interrogator; the reciprocal authorization of the interrogator by the transponder for access control, and the protection of communication between both through cryptographic mechanisms. Conversely, if two transponders have different group identifiers, they belong to different groups, and use different cryptographic keys to establish the secure context of the temporary communicative session.

To prevent unambiguous identification of transponders through the GID, and thus to protect the identity confidentiality of individual transponders, it is suggested that the number of transponders belonging to the same group be significantly greater than (number) one. Beyond what is required, defining the size and interpretation of the GID is not essential to the secure communication system.

As a non-limiting reference to the generality of the present secure communication system, it is assumed that the GID is represented by a 24-bit binary number. In addition, for access control cryptographic mechanisms, the present invention covers that transponders may have one or more individual cryptographic keys; that is, an individual key associated with the UTID, or sharing the same cryptographic keys with other members of the same group; that is, an individual key associated with the GID.

As a non-limiting reference to the generality of the present secure communication system, it is assumed that: transponders of the same group, that is, with the same GID, will use the same AK key to establish the secure communicative context; which optionally will include the generation of an SK temporary session key, and will perform implicit mutual authentication, with implicit identification and reading of transponder data, via the Mutual Auth Read command; and that each transponder will use an individual key, called RK, for read access control, and another individual key, called WK, for data write access control.

In the present invention, without limitation of generality, the following formal notation is used to indicate that the AK key is determined by the GID, and the RK and WK keys are determined by the transponder UTID: AK = AK (G / D ), RK = RK (£ / 27), orRK = SK (MSK, S), according to the GSK parameter value of the Mutual Auth Read command, and WK = WK (UTID), respectively, with MSK = MSK (GZD), and seed S variable per session.

Alternatively, the RK and WK keys can also be determined based on the GID value.

The interrogator could, for example, look up AK, RK, WK, and optionally MSK, in a database containing associations between GIDs and UTIDs, on the one hand, and authentication and control keys. access on the other side. However, specifying the key collection process is not essential to the operation of the secure communication system.

In addition, the present invention encompasses the case of the dynamic generation of secret keys RK and WK using information exchanged as part of establishing the temporary session secure context as time-varying seed using one or more indexed master keys shared between transponders. and interrogator. In this case, the maximum time interval for the validity of dynamically generated keys is restricted to the limited duration of the corresponding communicative session.

In the context of the present invention, encryption of a plaintext block B using an encryption secret key K and resulting in a ciphertext block C is termed C = Cκ (Β). The reverse operation of decrypting a ciphertext block C using a decryption secret key K to obtain the original plaintext block B is called B = DK (Ç). E _K (BI, B ₂ , B _n ), naming the encryption of n text words Bi, B ₂ , B _n , without defining an order, compression or logical combination (for example, by the XOR logical operation), specifies the words similarly, D _K (Ci, C ₂ , C _n ) refers to the decryption of n text words Q, C ₂ , C _n , without defining a specific order, compression, or logical combination of the words in the decryption process.

Thus, for example, the dynamic generation of a time-varying session key (SK) secret key for a time-limited session between interrogator and transponder can be performed by the operation SK = SK (MSK, S): = E _M SK (S) using a time-varying seed S - for example, a random number, and an MSK session secret key shared between interrogator and transponder. In the following, descriptions of the constituent parts of the secure communication system, object of the present invention, focus on the specification and description of the main parameters of the interrogator commands and the transponder responses, without limiting the generality of the system. of the present invention, and without excluding the possibility of including additional parameters in the command signatures, and responses for other purposes that do not interfere or compromise the primary purposes of these commands and responses.

In addition, as a reference, and without limiting the generality of the secure system, the generic Handle and CRC parameters will be included in the command and response signatures. The Handle parameter is used for the identification of data transmission containers. The CRC parameter represents a cyclic redundancy check type error detection code for the purpose of error detection in message transmission.

It is noted that the present invention allows the use of mechanism for generating and verifying arbitrary error detecting codes. To maintain compatibility with the ISO 18000-6C protocol, it is recommended to apply CRC-16 code, in the version specified by the International Telegraph and Telephone Consultative Committee (CCITT).

It is noted that the definition of data transmission and processing failure detection and treatment is not fundamental to the specification of the secure communication system of the present invention. Dynamic Encryption Engine

The dynamic data encryption mechanism is another embodiment of the present invention, which is performed, in a first form, by including two parameters, np variables (unique values, nonces), in data encryption and decryption. , one being generated by the interrogator, and the other by the transponder, during the mutual authentication and transponder identification phase of each new session.

As a non limiting reference to the generality of the present secure communication system are considered 64-bit nonces in binary representation resulting in a range of 2 ⁰⁴ possible states for each, and together, resulting in two possible states, thereby ensuring that In practice, binary representations of the result of encrypting texts containing one or both nonces as a result of any of the observed encryptions are incongruent - even if the original texts are the same.

Another embodiment of the present invention is a second way to perform dynamic encryption, which occurs after initialization between transponder and interrogator, by operating the symmetric cipher of the cryptographic machine, with the well-defined generation of a time-varying data sequence by combining in a certain way, this sequence with the original data or with the encrypted data. The second form may be used in combination with the first form described above or separately.

Without limiting the generality of the secure system, to perform dynamic encryption by a particular operating mode, the CBC (Cipher Block Chaining) and CTR (Counter) operating modes can be used, for example, as specified by NIST [NIST Special Publication 800- 38 A, 2001], or any other mode with comparable operational characteristics.

The purpose of using dynamic encryption, in combination with nonces generated by the interrogator and the transponder, is to protect confidentiality; the timeliness; the oneness (uniqueness), and the integrity of messages and data to be transmitted via the air interface, which in itself does not allow effective access control.

It is noted that the present secure communication system essentially permits the use of arbitrary block-size and arbitrary key-sized symmetric algorithms operated in modes compatible with or comparable to those described in the present invention.

The present secure communication system covers the use of more advanced standardized symmetric algorithms in relation to the state of the art. As a non-limiting reference to the generality of the present secure communication system, the use of Advanced Encryption Standard (AES) algorithm, with processing blocks and symmetric 128-bit keys, is assumed. of size. If it is necessary to encrypt multiple blocks of data that form a logical unit, the cryptographic algorithm preferably operates in a mode that allows chaining of the individual blocks, as performed by CBC mode and CTR mode (relative to sequence). unique counters needed for the correct decryption of encrypted data, ideally in combination with complementary mechanisms to protect the integrity of this data), ensuring detection of unauthorized alteration or substitution of encrypted data exchanged between the interrogator and the transponder. In the case of the use of the AES algorithm, the present secure communication system provides, without limitation, for the use of CTR mode of operation, and, where not defined differently for individual block encryption, the use of the basic mode of operation. ECB (Electronic Code Book) encryption [NIST Special Publication 800-38 A, 2001]. It is another embodiment of the present invention that by combining an interrogator nonce and a transponder nonce with the ECB mode encrypted data, and for generating all initial counters for the cryptographic machine CTR mode, the encryption mechanism dynamics of this secure communication system will continue to function without degradation in quality of service, and without a significant reduction in the level of security, even in the event that the random number generator used in either entity is experiencing unintended transient failures, such as faults induced by electromagnetic interference, or intentional failures such as maliciously injected faults deliberately.

Cryptographic Machine Initialization

Figure 2 schematically illustrates a CTR mode initialization mechanism of a cryptographic machine on the interrogator and transponder as part of a captive session, which constitutes an embodiment of the present secure communication system, and where, without limitation, generally supposing operation with keys and blocks of u bits, where u is an even number: The interrogator first sends the Init Cr ptoEngine custom command, which contains, as the main parameter, a unique / nonce value generated by the interrogator, called CTR R; the transponder responds with a message containing as its main parameter another unique value of u / 2 bits generated by the transponder, called CTR_T, and concatenating the two unique values, it is given a value of u bits that can be used as initial counter C ₀ for the AES algorithm CTR mode implemented by the transponder cryptographic machine. Without limitation of generality, in the case of the standardized AES algorithm, the value of u can assume one of 128, 192 or 256 bits, respectively. The present secure communication system covers cases in which the initialization of the cryptographic machine's CTR mode of operation on the interrogator and transponder is performed in alternate ways, and, without limiting the generality, the random values CTR R and CTR T can, for example, to be entered as additional parameters in other commands that are part of the present secure communication system.

Figure 7 schematically illustrates a second CTR operation mode initialization mechanism of the cryptographic machine, the interrogator and the transponder, which constitutes an embodiment of the present secure communication system, wherein the exchange of the initial counter halves, called CRN and CTN is performed implicitly as part of the custom implicit mutual authentication command.

It should be noted that the application of other cryptographic algorithms for operating modes other than CTR is subject to the requirement of different cryptographic machine initialization mechanisms, and the application of such mechanisms is covered by the secure communication system.

Mechanism for Establishing a Permanent Handle for Extended Transponder Control

Figure 13 schematically illustrates a mechanism that allows the interrogator to obtain a permanent handle from a transponder immediately after singularization, which constitutes an embodiment of the present secure communication system, wherein the permanent handle, or simply the handle, allows the interrogator to maintain interactions. extended with several parallel transponders.

The interrogator sends the custom command Req Handle, with the Old Handle and CRC parameters, to the transponder, and the transponder responds with a message containing the CRC error detector code and the new one. Permanent Handle, called the New Handle; The interrogator accepts the New JHandle as the new permanent Handle for future transponder interactions as part of a communicative session to be established with the transponder.

At the same time, with the establishment of the permanent Handle, the internal state of the transponder changes to a new state outside the original state set as defined by ISO 18000-6C, causing insensitivity of the internal state and behavior of the transponder to conflicting subsequent inventory commands from the original protocol, which is an essential feature for parallelized interaction of an interrogator with multiple transponders - constituting yet another embodiment of the present secure communication system.

Without limitation of the generality, the interrogator generally establishes the permanent Handle, after successfully having singled out a transponder; ie shortly after receiving the first temporary reference RN 16 and information from the transponder UII memory area in response to sending the ACK message to it as part of the inventory procedure as specified in the ISO 18000-6C protocol. Consequently, on the first call of the Req Handle command, after transponder singularization, the interrogator should use the temporary reference value RN 16 as the Old Handle parameter value to establish a permanent Handle.

Communicative Session Initiation Mechanisms

The session initiation mechanism between an interrogator and a transponder is another embodiment of the present secure communication system, where the transponder informs the interrogator of its group identifier (GID), and where a secure context of the transponder is established. temporary communicative session, in preparation for the subsequent step of mutual authentication and transponder identification by the interrogator.

Session initialization can be performed after transponder singularization and after establishment of a valid permanent Handle through a dedicated custom command. Figure 3 schematically illustrates a first initiating mechanism of a new session between an interrogator and a transponder, which is another embodiment of the present secure communication system, where the interrogator sends the Init Session custom command, with the parameters Handle and CRC, to transponder, and the transponder responds with a message containing the Handle; the GID; a single value TN (nonce transponder); a unique transponder nonce (CTN) value, and the CRC error detector code.

A second alternative mechanism, which is another embodiment of the present secure communication system, forwards the GID, TN and CTN parameters from transponder to interrogator, forming the response of each transponder in the inventory phase, so that the response with UII memory data includes the GID and the unique TN and CTN values, dynamically generated during runtime, or pre-calculated in advance.

Figure 4 is a schematic representation of the inventory according to the ISO 18000-6C protocol with the transponder response according to the second alternative mechanism which is another embodiment of the present secure communication system where: the first three steps mark the messages provided by the ISO 18000-6C protocol during transponder detection and singularization [ISO / IEC 18000-6 / Amd 1], and the fourth step shows the inclusion of the additional GID, TN and CTN parameters in the transponder final response, where , to maintain compliance With the ISO 18000-6C protocol, TN and CTN memory areas can be logically mapped to the memory area of the UII memory bank.

The advantage of the second mechanism (figure 4) over the first (figure 3) is a significant reduction in communication overhead, since, as indispensable data is passed through during inventory, there is no need for further exchange. of messages, that is, an interrogator command and a transponder response.

Figure 5 is a schematic representation of the inventory according to the ISO 18000-6C protocol with the transponder response as a third alternative mechanism which constitutes another embodiment of the present secure communication system where in the fourth step only the parameter invariable GID is included in the final transponder response, and the time-varying values TN and CTN are generated by the transponder and passed to the interrogator as part of the authentication and identification phase as described by the Mutual Auth Read command.

Therefore, the third mechanism allows the memory area of the GID parameter to be logically or physically mapped to the memory area of the UII memory bank, eliminating the need to generate a new real-time unique value or to have a unique value available. pre-calculated during inventory.

As a result, an essential advantage of the third mechanism is that it enables the transponder to meet the constraints set for allowable response times as part of the inventory process specified in ISO 18000-6C. In particular, this significantly facilitates the eventual implementation of the mechanisms presented in the present invention in typically slower processing passive transponders than those using the internal battery for processing, where the The former generally require significantly longer times for the generation of cryptographic pseudorandom numbers than is required by ISO 18000-6C for transponder responses to commands that are part of the inventory phase.

Next, as a non-limiting generality reference, the availability of the third communicative session initiation mechanism between the interrogator and the transponder is assumed, with GID value information as part of the inventory, and with the generation and information of nonces TN and CTN as part of the transponder authentication and identification phase.

Time Variable Parameter Generation Mechanism

In another embodiment of the present secure communication system prior to each new communicative session between the interrogator and the transponder, which involves the transfer of encrypted data, the interrogator and the transponder determine and share two new time varying parameters, TN and RN , in a well-defined manner, or generate values derived from the unique values established prior to the current communicative session, in which case both the interrogator and the transponder should set the same new values for TN and RN.

As a non-limiting generality reference, Next Nonce is a bi-function function N _<m → N _<m , which unambiguously generates a new value derived n 'from a known value n: n' = Next Nonce (n), with N _<m since the universe of natural numbers is less than a maximum number m, including zero, and thus, in the context of the present secure communication system, and without limitation of generality, it is assumed that interrogators and transponders implement the same. Next Nonce function to generate nonces TN and RN derivatives as TN = Next Nonce (TN) and RN = Next Nonce (RN).

Without limitation of generality, an example for the Next Nonce function is "increment by 1 (modulo m)": n '= Next Nonce (n) = n + 1 (modulo m), with m— 2 ^M , in case of nonces 64-bit in size.

Figure 6 illustrates an alternative mechanism for establishing a new pair of unique values between the interrogator and the transponder which is another embodiment of the present secure communication system where the interrogator sends a new unique value in a first step. while transponder implicitly requesting a new unique transponder value, which responds with a new unique value, and in this example, and without limitation of generality, the exemplary name SetJRN TN of the interrogator custom command was chosen.

Alternatively, nonces RN and TN may be encrypted prior to transmission using a shared secret key between transponder and interrogator.

Other purposes of changing nonces TN and RN, with each new custom command exchange and corresponding response in the current session between the interrogator and transponder, and before the start of a new session, are:

- Protect the timeliness and uniqueness of messages by checking the TN and RN values included in received messages, both interrogator and transponder, and can unambiguously determine whether the message is being current or a repetition of an old message.

- Protect the confidentiality of information included in messages by increasing the original text with nonces TN and RN before encryption, which results in different ciphertext, even if the initial text is identical, before two encryptions at different times.

In particular, before startup and mode availability For cryptographic machine operations with automatic output variation, the use of nonces in the described manner is necessary for the protection of confidentiality, as in the case of using ECB mode, for example.

- Protect the integrity of information included in messages by increasing the original text with nonces TN, RN, or both nonces, before encrypting the text, which results in a known portion of the original text, which serves as a reference for validation of future encryption of ciphertext, taking advantage of the feature that, using an advanced cryptographic algorithm such as AES, a change of at least one bit in the ciphertext (in ECB mode, for example) results in practice in changing each individual bit of deciphered text, with a probability of approx. 50% compared to the original text.

Without limitation of generality, by inserting in the original text a known nonce of, for example, 64 bits in size, the probability of detecting a ciphertext change corresponds approximately to the value of 1/2) ⁶⁴ , which in practice allows detection of all occurrences of bit changes.

In particular, the combination of a known nonce with an unknown data to the recipient in the same original text is necessary for the protection and verification of the integrity of the encrypted text against changes when using the ECB and CTR [NIST Special Publication] operating modes. 800-38 A, 2001], as well as in the case of any operational mode of cryptographic algorithms that do not allow the integrity check of encrypted (unknown) data as part of the decryption process.

Mechanism for implicit mutual authentication with transponder identification

The mechanism for implicit mutual authentication with identification, transponder by the interrogator is another embodiment of the present secure communication system. The mechanism, among other essential purposes, aims, in the context of a communicative session, to prove the authenticity of the transponder to the interrogator. Another purpose is, through the transponder's early transmission of the data requested by the interrogator, after encapsulation by an appropriate cryptographic envelope, to indirectly and implicitly authenticate the interrogator without receiving an immediate response from the interrogator to the challenge provided by the transponder, thus, implicitly restricting access to unique numbers and a fixed set of additional identifying data provided by the transponder to authentic interrogators.

The resulting mechanism protects the confidentiality, integrity and timeliness of this transponder identifying information during transmission through dynamic encryption to prevent unauthorized third parties from identifying and tracking the transponder.

The mechanism also ensures that only an authentic interrogator can open the cryptographic envelope, thus protecting data provided in advance by the transponder. For an unauthentic interrogator, the cryptographic envelope only contains one data set, in unrecognizable binary form, as a result of the applied cryptographic mechanism, which constitutes another embodiment of the present invention.

Another embodiment of the present secure communication system is that implicit mutual authentication becomes explicit for the transponder with knowledge of the interrogator's authenticity from the moment the (authentic) interrogator sends a transponder memory access command, Aiming at reading or writing data, containing the answer will run the initial challenge of the transponder. Figure 7 schematically illustrates the implicit mutual authentication between an interrogator and a transponder, based on the Mutual Auth Read command, which allows the cross-sectional determination of the transponder first and, implicitly, of the interrogator by means of a transponder scheme. challenge-response in combination with dynamic encryption, with an implicit read of transponder identifying data that is protected by a cryptographic envelope — which constitutes another embodiment of the present secure communication system.

Already aware of the GID group identifier and transponder permanent handle, the interrogator sends the transponder the custom command Mutual Auth Read, with authentication challenge and the first half of the seed for cryptographic machine initialization, in preparation of the encryption mechanisms. for the ongoing communicative session. The transponder processes the interrogator command, and prepares the answer with two essential components. The first component is represented by an ECB mode encrypted data packet, without limitation, containing the transponder challenge to the interrogator and the second half of the seed for cryptographic machine initialization, for CTR operating mode, with chaining. cipher blocks (by means of a specific sequence of counters used for encryption).

The second component consists of a sequence of encrypted and chained blocks in CTR mode and, without limitation, after initialization of your cryptographic machine, the set of seed halves as the basis of the initial counter, using both challenges - of the interrogator. and the transponder - with internal reference to the first encrypted block for validating the correct decryption and optionally generating a temporary secret key for the current session, using the two challenges TN and RN, together with the seed, in combination with a shared secret key.

An unauthentic transponder is unaware of the required shared secret keys associated with the reported GID, or the default session secret key, or the master secret key required to generate the session temporary key, and thus cannot obtain the challenge and half of the interrogator seed, thus failing to generate the envelope with the transponder data in CTR mode, with the interrogator challenge inserted as a reference, and the correct response to the challenge.

Similarly, an unauthentic reader is unaware of the shared secret keys that guarantee data protection; keys are associated with the known GID, and cannot decrypt in ECB mode half of the transponder seed, and therefore cannot decipher in CTR mode the envelope with the transponder confidential data.

Additionally, the unauthentic interrogator cannot decrypt the ECB mode encrypted transponder challenge.

In addition, the unauthentic interrogator is unable to provide CTR-mode encrypted challenge response on subsequent transponder access attempts via custom Secure Auth Read and Secure Auth Write commands, ensuring authentication and authorization of these requests fails by the transponder.

The basic procedure of implicit mutual authentication mechanism to read the transponder identification data is performed by the custom command Read Mutual Auth _T shown in more detail in Figure 7.

In a first step, the interrogator gets the symmetric key of default current transponder authentication, AK = ÂK (GID), using G1D as a reference; generates unique numbers RN (reader noncé) and CRN (counter reader noncé), which serve as a challenge and seed, respectively, from interrogator to transponder; concatenates nonces with the three parameters SMD, DMD, and GSK; computes, in ECB mode, the EAK ciphertext (RN, CRN, SMD, DMD, GSK) and finally sends the Mutual Auth Read command with the prepared parameters and the other parameters, as specified in figure 7, to the transponder.

The Static Message Authentication Code Descriptor (SMD) parameter, which is another embodiment of the present secure communication system, represents an indicator for the optional inclusion of a pre-computed Static Message Authentication Code (SMAC) integrity and authenticity protection code. over the concatenated UTID and TDATA data, and permanently recorded in the nonvolatile memory of the transponder when the transponder responds.

Without limitation in general, the preferred implementation of the static authenticity code is the CMAC mechanism [NIST SP800-38B, 2005], with 128-bit-sized Message Authentication Code (MAC) generation.

The Dynamic Message Authentication Code (DMD) parameter

Descriptor), which is another embodiment of the present secure communication system, is an indicator for the optional inclusion of a Dynamic Message Authentication Code (DMAC) integrity and authenticity protection code into the transponder response, and which must be computed in time. execution on a selection of the other response data elements, including nonces RN and TN, and additionally the UTID and TDATA data, either in original text or in ciphertext form. Without limitation of generality, the preferred implementation of the dynamic authenticity code is the CMAC mechanism [NIST SP800-38B, 2005], with 64-bit-sized MAC (message authentication code) generation.

In the second step: the transponder gets the EAK response (RN, CRN,

SMD, DMD, GSK) decrypts the answer using the secret symmetric key AK, calculates DAK (AND _A K (RN, CRN, SMD, DMD, GSK)), holds the RN challenge, half of the initial CRN counter of the interrogator, and the SMD, DMD, and GSK parameters, and continue to perform the third step of implicit mutual authentication.

In the third step: the transponder generates the unique numbers TN (noncé transponder) and CRN (noncé transponder), which serve as a challenge and seed, respectively, from the transponder to the interrogator; concatenates these nonces and computes the EAK ciphertext (TN, CTN) in ECB mode of the AES cryptographic machine; get the UTID {Unique Transponder IDentifier) and TDATA {Transponder Data) data from memory, and, if indicated by the SMD parameter received from the interrogator, obtain from memory the SMAC static integrity and authenticity code pre-calculated on the UTID data and TDATA, or set the value of SMAC to the empty word string (zero word string); calculates a CRC-16 error detector code, called DCRC, on the data RN, TN, UTID, DATA, obtaining DCRC = CRC-16 (RN, TN, UTID, TDATA); initializes the CTR operating mode of the internal cryptographic machine itself using, as its initial counter, the CTN value concatenated with CRN; encrypts, with the AES cryptographic machine, in CTR mode, the text composed of the values RN, TN, UTID, TDATA, DCRC, and SMAC, using the SK secret key, with SK obtained, as indicated by the interrogator's GSK parameter; that is, by reading from a standard session key from memory, or generated on time, using a session key obtained from memory in combination with a seed, represented by the set of RN and TN values, thus obtaining ESK (RN, TN, UTID, TDATA, DCRC, SMAC), if indicated by the DMD parameter received from the interrogator; generate the DMAC dynamic integrity and authenticity code on the RN, TN, UTID, TDATA data, or define the DMAC value as the empty word string; and returns the set of values, obtained as a response with the other parameters, to the interrogator as specified in figure 7.

In the fourth step: the interrogator gets the answer from the transponder; first decrypts the transponder TN and CTN data using the secret symmetric key AK, calculating DAK (EAK (TN, CTN)); initializes the CTR operating mode of the internal cryptographic machine itself, using as initial counter the CTN value, concatenated with the known CRN value; get the secret key of the SK session. as indicated by the GSK parameter, either obtain the current transponder default session key, SK = SK (GiD), using G1D as a reference, or generate the session key using a transponder MSK secret session generator key, using the GID as reference, MSK = MSK (G / D), in combination with the seed represented by the set of known values RN and TN; decrypts the ciphertext E _SK (RN, TN, UTID, TDATA, DCRC, SMAC); checks whether the RN and TN values contained in the deciphered text are identical to locally kept copies; recalculates and checks the DMAC code if it is not represented by the zero-length word as indicated by the DMD parameter; recalculates and checks the SMAC code if it is not represented by the zero-length word as indicated by the SMD parameter; recalculates and verifies the DCRC code, and if all checks succeed, transponder authentication is considered to be successful. succeeded, and the interrogator extracts the UTID identifier and TDATA data from the decrypted text; and concludes implicit mutual authentication, considering the transponder to be authentic. If the transponder authentication fails, the interrogator considers the transponder to be unauthentic and treats the failure accordingly.

It is noted that the specification of the transponder reaction to the interrogator authentication failure, and vice versa, from the interrogator reaction to the transponder authentication failure, may vary depending on the needs of the particular application, without influencing the basic operation of the transmission mechanism. implicit mutual authentication.

Without limiting the generality of the secure system, the address of the portion of memory to be returned by the transponder, represented by UITD, TDATA data, and optionally the additional value SMAC, can be specified by a variable parameter to be included in the interrogator command, instead of using predefined addressing.

In addition, and without limitation in general terms, DMAC data may be calculated over other data sets, including larger data sets, and with the individual data being both original and encrypted text, with the sole requirement that the DMAC code allows the interrogator to unambiguously check the integrity of the RN, TN, UTID, and TDATA data.

Secure Reading Engine with Request Authentication

The mechanism for secure reading with request authentication is another embodiment of the present secure communication system, and among other essential purposes of this mechanism are: enabling the interrogator to read a defined amount of persistent memory data or volatile, from the transponder; verifying the authenticity and authorization of the interrogator's read request by of a challenge-response mechanism in the transponder; the protection of the integrity, uniqueness, timeliness and confidentiality of data transmitted via the air interface by dynamic encryption and CRC error detection codes. Optionally, the protection may also rely on message authentication code (MAC) integrity and authenticity cryptographic codes, including a descriptor of the memory area to be read and data to be taken back by the transponder, in order to prevent unauthorized third parties may manipulate or gain knowledge of data stored or generated by the transponder once such third parties have broken all communication protection and data protection barriers described to the present described level.

Figure 8 schematically illustrates an authenticated read between interrogator and transponder, based on the Secure Auth Read command, and which constitutes another embodiment of the present secure communication system.

In a first step: the interrogator obtains the symmetric read authorization key from the current transponder, RK = RK {UTID), using the UTID as a reference; updates local copies of nonces for the current session, TN = Next Nonce (TN) and RN = Next Nonce (RN); calculates, with the AES cryptographic machine, in CTR mode, the E _RK ciphertext (TN, RN, LMAR, LCRC, DMD), with LMAR being a descriptor of the logical memory area range to be read, LCRC being a detector code of CRC errors computed on the LMAR parameter, and DMD being an indicator for the optional inclusion of a dynamic DMAC integrity and authenticity protection code in the response to be computed by the runtime transponder on the main elements. response data; and sends the Secure Auth Read command, with the parameters entered as specified in figure 8, to the transponder.

As a non-limiting reference of generality, following the standard ISO 18000-6C, the LMAR logical memory area range descriptor can be defined by concatenating the following fields specified in the ISO 18000-6C protocol: MemBank, JVordPtr, and WordCount. Note that LMAR must comply with the requirements of the ISO 18000-6C protocol for correct memory addressing.

As another non-limiting general reference, the LMAR logical area range descriptor may be represented by a more complex data structure incorporating additional parameters including LCRC and DMD parameters and others, and in the case of the write engine secure with request authentication, one or more integrity protection codes, type CRC-16 or other, protecting data to be written in the memory range defined by LMAR.

In the second step: the transponder updates the local copies of the current session nonces, TN = Next Nonce (TN) and RN = Next_Nonce (RN); decrypts the ciphertext received from the interrogator using the secret RK read-symmetric authentication key; calculates D _RK (E _RK (TN, RN, LMAR, LCRC, DMD)) with the AES cryptographic machine in CTR mode; checks whether the values contained in the deciphered text TN and RN are identical to local copies, and that the LCRC code is correct; if so, the interrogator's authentication and authorization is considered successful, and the transponder continues execution of the third read and authenticated step; otherwise, the interrogator is considered unauthorized to read data from the transponder memory, and the transponder suspends the communicative session with the interrogator, or otherwise handles the failure.

In the third step: the transponder gets the requested RD AT A data from the memory area specified in the LMAR parameter; computes a CRC error detector code on the RN, TN, and RD AT A value set; encrypts, in CTR mode, the text composed of the values TN, RN, RDATA and RCRC, resulting in ERK ciphertext (TN, RN, RDATA, RCRC); generate the DMAC dynamic integrity and authenticity code on the RN, TN, and RDATA data, or set the DMAC value to the empty word string as indicated by the received DMD parameter; and returns the final results obtained in the answer, with the other parameters, to the interrogator.

In the fourth step: the interrogator decrypts, in CTR mode, the ERK ciphertext (TN, RN, RDATA, RCRC) of the transponder using the secret symmetric key RK; calculates DRK (ERK (TN, RN, RDATA, RCRC)); checks whether the values contained in the decrypted text TN and RN are identical to locally kept copies; reevaluates and verifies the RCRC code; if identical, the returned RDATA data is considered authentic, accurate, and current, and the interrogator considers the reading successful; if the nonces TN and RN are not congruent with local values, or if the RCRC code verification fails, the interrogator considers the reading to be uneven, and continues processing accordingly.

It is noted that the specification of the transponder reaction to the interrogator authorization failure, and vice versa, from the interrogator reaction to the authenticity and timeliness verification failure of data returned by the transponder, may vary depending on the needs of the particular application without influence the basic operation of the authenticated read engine.

Without limiting the generality of the secure system, DMAC data can be calculated over other data sets, including larger data sets, and with individual data being either original text or encrypted text, with the sole requirement that the DMAC code allow the interrogator unambiguously to verify the integrity of the RN, TN, and RDATA data.

Key management alternatives constitute, without limitation generally, the RK key is dynamically generated by the interrogator and the transponder, or replaced by the current SK session key already established.

Another embodiment of the present secure communication system provides for a new authentication to be performed on each new read command, with TN and RN session nonces changed by the Next Nonce function, to ensure that a session hijacking does not occur. practicable, as each read access is authorized individually.

Secure Authentication with Request Authentication Engine

The mechanism for secure writing with request authentication is another embodiment of the present secure communication system, and includes, among other essential purposes of this mechanism, enabling the interrogator to write defined amount of data in the persistent or volatile memory of the transponder; verifying the authenticity and authorization of the interrogator's written request by means of a challenge-response mechanism in the transponder, and protecting the integrity, uniqueness, timeliness, and confidentiality of data transmitted via the air interface by dynamic encryption , CRC type error detection codes, and optionally MAC message type integrity codes, including the descriptor of the memory area to be written, the data to be written, and the execution code of the write operation to be taken over by the transponder, in order to prevent unauthorized third parties from manipulating or obtaining knowledge of data stored in or generated by the transponder.

Figure 9 schematically illustrates autcíaudaud writing. An interrogator and transponder, based on the Secure Auth JVrite command, which constitutes another embodiment of the present secure communication system.

As a first step: the interrogator obtains the symmetric write authorization key from the current transponder, WK = WK (UTID), using the UTID as a reference, updates the local copies of the current session nonces, TN = Next Nonce (TN), and RN = Next Nonce (RN); computes, with the AES cryptographic machine, in CTR mode, the _WK ciphertext (TN, RN, LMAR, LCRC, WDATA, WCRC, DMD), with LMAR being a descriptor of the logical memory area range to be written, LCRC being a CRC error detector code computed on the LMAR parameter, WDATA, representing the data to be written, WCRC being a CRC error detector code computed on the WDATA data, and DMD, being the indicator for the optional inclusion of a dynamic integrity and authenticity protection code calculated on the main elements of the command; inserts the DMD data a second time, unencrypted, into the command, together with the DMAC dynamic integrity and authenticity code, or calculated over the RN, TN, LMAR, and WDATA data, or represented by the empty word string) as indicated by the DMD parameter; and sends the Secure Auth Vrite command, with the parameters entered as specified in figure 9, to the transponder.

Without limitation generally, the DMD parameter is included a second time, as the original text, before the given DMAC, so that the transponder has the ability to consider the DMAC descriptor, without having to decrypt the encrypted data received in real time during transmission. .

Alternatively, and without limitation of generality, the WCRC code may be computed over other data, such as the data set TN, RN, and WDATA, to associate nonce values with the CRC code.

As a general non-limiting reference, following the ISO 18000-6C standard, the LMAR logical memory area range descriptor may be defined by concatenating the following fields specified in the ISO 18000-6C protocol: MemBank, WordPtr, and WordCount. Note that LMAR must meet the requirements of the ISO 18000-6C protocol for correct memory addressing.

In the second step: the transponder updates the local copies of the current session nonces, TN = Next_Nonce (TN) and RN = Next Nonce (RN); decrypts in CTR mode the ciphertext received from the interrogator using the read authentication secret symmetric key WK; calculates D _WK (E _WK (TN, RN, LMAR, LCRC, WDATA, WCRC, DMD)); checks whether the RN and TN values contained in the deciphered text are identical to locally kept copies; reevaluates and verifies the DMAC code if not represented by the zero-length word as indicated by the decrypted DMD parameter; reevaluates and verifies the LCRC code; reevaluates and verifies the WCRC code; if all checks succeed, the interrogator's authentication and authorization is considered successful, and the transponder continues to perform the third authenticated write step; otherwise, the interrogator is considered unauthorized to write data to the transponder's memory, and the transponder suspends the communicative session with the interrogator, or otherwise handles the failure.

In the third step: the transponder writes the WDATA data to the memory area specified in the LMAR parameter; generates an informative code of the result of the operation called WCODE; encrypts, in CTR mode, the text composed of the three values TN, RN, and WCODE; returns the final result E _WK (TN, RN, WCODE), in response, with the other parameters to interrogator.

In the fourth step: the interrogator decrypts, in CTR mode, the ciphertext E _WK (TN, RN, WCODE) from the transponder, using the secret symmetric key WK, calculates D _WK (E _WK (TN, RN, WCODE); the values contained in the deciphered text TN and RN are identical to locally kept copies, if they are, the WCODE code will be considered authentic, complete and current, the interrogator considers the writing according to the particular semantics defined by the WCODE code, otherwise if the nonces TN and RN are not congruent with local values, the interrogator considers the reading to be uneven and continues his processing accordingly, treating the situation accordingly.

An example for WCODE generation in the transponder, which is another embodiment of the present secure communication system, is the generation of a CRC-16 code on the contents of the newly written memory area. However, the semantics of authentic codes returned by the transponder in response to the data write operation, and the handling of different codes in the interrogator has no bearing on the present secure communication system.

Alternatives to key management constitute, without limitation, the dynamic generation of the WK key, the interrogator and the transponder, or their replacement with the current established SK session key.

Another embodiment of the present secure communication system provides for Performing a new authentication on each new write command with TN and RN session nonces, changed via the Next Nonce function, to ensure that a session hijacking is not practicable as each write access is authorized individually.

Extended States Machine

Figure 10 schematically illustrates the extended state machine of the transponders, which is another embodiment of the present secure communication system, where the original states of the ISO 18000-6C protocol have been deactivated and deleted: Open, Secured, and Killed, and all transitions associated with these states were also eliminated.

As a general non-limiting reference, new states and transitions have been introduced into the transponder state machine for new interrogator commands and corresponding transponder responses: WAIT1NG, MAR-PROC, MAR-READY, AUTHENTICIATED, SAR-PROC, SAR-READY, SAW-PROC, and SAW-READY.

These new states are assumed by each transponder in the following situations and under the following conditions:

- WAITING, meaning "waiting": The transponder immediately switches to this state if and only if one of the following conditions is met:

(a) The transponder is currently in ACKNOWLEDGED state, and has completed sending a response regarding the error free receipt of a Req Handle command from an MSR (error free) transmission;

(b) The transponder is currently in WAITING and has completed sending a response regarding the error-free receipt of a repetition of the previous RSU Req Handle command; c) The transponder is currently in WAITING and has completed sending an error-free response to a new request from the RSU Req Handle command (with valid permanent handle);

d) The transponder is currently in MAR-PROC state and has completed receiving error free and is executing the interrogator's Finalize command with the FEOP flag set.

- MAR-PROC, short for "mutual authentication processing": The transponder immediately switches to this state if one of the following conditions is met:

(a) The transponder is currently in WAITING state, and has completed sending an auxiliary response regarding the error-free receipt of an interrogator Mutual Auth Read command;

b) The transponder is currently in the MAR-PROC state, and has completed sending an auxiliary response regarding error-free receiving of a direct retransmission of the interrogator's Mutual Auth Read command, which was already received by the transponder in previous transmission.

- MAR-READY, short for "mutual authentication ready": The transponder immediately changes to this state if one of the following conditions is met:

a) The transponder is currently in MAR-PROC state, has completed internal processing of the Mutual _Auth Read command, including the necessary decryption and internal data encryption operations, has successfully prepared the secure envelope with encrypted transponder identifier data, and is ready to return the implicit mutual authentication return message to the interrogator;

(b) The transponder is currently in MAR-READY state and has completed sending an auxiliary response to an error-free direct relay of the last interrogator Mutual Auth Read command, which has already been processed by the transponder.

- AUTHENTICATED, meaning "authenticated": A transponder immediately switches to this state if one of the following conditions is met:

(a) The transponder is currently in MAR-READY state and has completed receiving, in error-free transmission, the interrogator's Finalize command, and has answered it by sending the Mutual Auth Read command back to the interrogator;

b) The transponder is currently in AUTHENTICATED state and has completed responding to a direct, error-free retransmission of the interrogator's previously processed Finalize command;

c) The transponder is currently in SAR-PROC state and has completed receiving, error free, and executing the interrogator's Finalize command, with the FEOP flag set;

d) The transponder is currently in SAR-READY state, has received the interrogator's Finalize command in error-free transmission, and completed sending the reply to the Secure Auth Read command to the interrogator;

e) The transponder is currently in SAW-PROC state and has completed receiving, error free, and executing the interrogator Finalize command. with the established FEOP flag;

f) The transponder is currently in SAW-READY state, has received the interrogator's Finalize command, in error-free transmission, and completed sending response to the interrogator's Secure_Auth_Write command.

SAR-PROC, short for "read-authenticated-read processing": The transponder immediately switches to this state if one of the following conditions is met: (a) The transponder is currently in AUTHENTICATED state and has completed sending an auxiliary response regarding the error-free receipt of the interrogator's Secure Auth Read command;

(b) The transponder is currently in SAR-PROC state and has completed sending an auxiliary response regarding error-free receipt of a direct retransmission of the interrogator's Secure Auth Read command, which was already received by the transponder in previous transmission.

- SAR-READY, abbreviation for "secure-authenticated-read ready": The transponder immediately switches to this state if one of the following conditions is met:

a) The transponder is currently in SAR-PROC state and has completed internal processing of the last Secure Auth Read command received, including the necessary internal data decryption and encryption operations, has successfully authenticated and authorized the interrogator in the process, and is ready to send return message to processed Secure Auth Read command to interrogator;

(b) The transponder is currently in SAR-READY state and has completed sending an auxiliary response regarding error-free receipt of a direct retransmission of the last interrogator's Secure Auth Read command that has already been processed by the transponder.

SAW-PROC, short for "secure-authenticated-write processing": The transponder immediately switches to this state if one of the following conditions is met: a) The transponder is currently in AUTHENTICATED state and has completed the sending auxiliary response for error-free receipt of interrogator Secure Auth Vrite command;

(b) The transponder is currently in SAW-PROC state and has completed sending an ancillary response regarding the free, enos, receipt of a direct retransmission of the interrogator's Secure Auth Vrite command, which was already received by the transponder in previous transmission.

- SAW-READY, abbreviation for "secure-authenticated-write ready": The transponder immediately switches to this state if one of the following conditions is met:

a) The transponder is currently in SAW-PROC state and has completed internal processing of the last Secure Auth Write command received, including the necessary internal data decryption and encoding operations, has successfully authenticated and authorized the interrogator in the process, and is ready to send the return message to the processed Secure Auth Write command to the interrogator;

(b) The transponder is currently in SAW-READY state and has completed the auxiliary response sending for error-free receipt of a direct retransmission of the last interrogator Secure Auth Write command that has already been processed by the transponder.

Without limitation in general, in addition to the above state transitions, the transponder may implement additional transitions, such as for the initial READY state, as desired in exceptional situations, including:

a) The transponder receives a Select command;

b) The transponder receives a Query, QueryRep, or

OueryAdjust;

c) The transponder receives an unexpected custom command (outside of the standard command flow), skipping necessary states and / or transitions as defined in the present invention;

d) The transponder has reset or power-up due to power loss or other transient failure that has resulted in loss of internal transponder status information. It is noted that the above modified state machine represents a reference model compatible with the commands defined in the secure communication system embodiment, including all other compatible embodiments of this reference state machine that enable an implementation of communication mechanisms whose functionality is compatible with the secure communication system of the present invention, including state machines with different state names, number or types, and transitions.

Without losing the essence of the present secure communication system, and without limitation of the generality, conceivable alternative embodiments can, for example, merge the two SAR-PROC and SAR-READY states into one state if the two-phase execution mechanism of custom commands are not implemented, or if their execution is unnecessary, for example, because of a secure communication system implementation on an advanced hardware transponder that allows a transponder response without significant delay, and within defined protocol boundaries and application, and the same observation may apply to both state pairs SAW-PROC and SAW-READY, and MAR-PROC and MAR-READY.

Two-Step Command Execution Mechanism

Fig. 11 schematically illustrates the two-step command execution mechanism by auxiliary messages constituting another embodiment of the present secure communication system.

The two-phase execution mechanism applies to message pairs, consisting of an interrogator command and the corresponding response from the addressed transponder.

A first essential purpose of the mechanism is to enable transponders, to send a first confirmatory response to assist primary commands that require cryptographic processing, with an internal processing time on the transponder of the order of milliseconds to tens of milliseconds or more, where this quality enables interrogators to detect transmission errors and that would result in the main custom command not executing within a short, well-defined time frame. Specifically, and without limitation of generality, the mechanism allows, according to ISO 18000-6C, that the transponder may continue to respond to the interrogator's custom command at time Ti, and the interrogator can detect the lack of response at time T3 ( t).

Another purpose of the mechanism is to leave the interrogator in control of the interaction with the transponder and, after the presumed termination of processing of the primary custom command in the transponder, after time At, the interrogator requests, through an auxiliary custom command called Finalize, to transmit of the transponder primary response.

Thus, the execution of the main custom command is divided into two distinct phases: the first phase being the confirmation phase, and the second phase being the finalization of the main command execution.

A significant advantage of this two-phase main command execution is that the interrogator can take advantage of the At time interval during which the transponder is being busy processing the primary request to process other tasks or to communicate with other transponders, reducing waiting time and increasing the operational efficiency of the interrogator.

The two-phase execution mechanism of this secure communication system will benefit from the execution of any command-command parent. response, between interrogator and transponder, involving extended processing on the transponder, and in particular this mechanism applies to custom commands that involve using transponder encryption: Mutual Auth Read, Secure_Auth_Read, and Secure Auth Write.

As a non-limiting reference to the generality of the present secure communication system, to enable the interrogator to estimate At time more accurately, information about transponder performance or processing time can be kept in a database and the interrogator can access this information using one of the GID, UTID, and SPC values received from the transponder as the access key.

Alternatively, a variation of the auxiliary response that constitutes another embodiment of the present secure communication system is the inclusion of an optional parameter — called EPTI—, to indicate the expected processing time indicator, which may, without general limitation, EPTI reports an index of the transponder's relative processing performance, such as the number of bits the transponder can encrypt or decrypt per millisecond, and an indication of read and write performance in nonvolatile memory such as, but not limited to, the 16-bit word rewrite time in the transponder's internal EEPROM or Flash or FeRAM (or other) memory, allowing the interrogator to calculate the time required for cryptographic and memory access on the transponder. Also, EPTI can also provide the absolute estimate of the processing time required, considering the type and load of the request received from the interrogator, and, in general, knowledge of EPTI enables the interrogator to estimate the required wait time. greater accuracy than not having this information. Alternatively, without limitation of generality, expected processing reference times by command and transponder type and implementation can be managed in the form of tables kept in the interrogators by mapping transponder model version numbers and protocol version numbers implemented to absolute or relative processing performance values. In this case, it is supposed to include a transponder implementation model number, and a protocol version number implemented by the transponder, in the UII memory bank, the contents of which will be read by the interrogator during the inventory phase.

A variation of the auxiliary custom command, which is another embodiment of the present secure communication system, is the inclusion of an optional parameter, denoted FEOP, to force the force end of processing into the transponder when it is not yet done. has completed internal processing upon receipt of the Finalize command. Without limiting the generality, FEOP can be performed through a binary flag (boolean flag), which takes the values "1" or "on", to force the end of processing and "0" or "off", to allow further processing on the transponder.

Without limitation, in the two-phase command execution mechanism, the transponder's reaction to a Finalize command, with or without FEOP enabled, depends on the needs and boundary conditions of the particular application. Thus, for example, a transponder, which has not completed local processing, may respond to a Finalize command with FEOP disabled, by means of an error message, not processing processing, and to stop executing the command, or return a dedicated response. requesting more time to execute the interrogator and continue processing, or ignore the command. Without limitation of generality, the specification of the treatment in the interrogator,

I

The inability of the transponder to send a response to the Finalize command may depend on the particular application and is not essential to the specification of the present secure communication system. For example, the interrogator may extend the wait time and send a new Finalize command to get the answer, or simply unilaterally abandon the interaction.

It is noted that the present invention covers all variations of the two-stage execution mechanism having compatible purposes and advantages, including mechanisms involving different number of auxiliary messages and / or parameters. A possible compatible variation is that the transponder does not send an auxiliary confirmation, and the interrogator directly sends the Finalize command after a certain timeout.

Another compatible variation is that if you eliminate the Finalize command and, instead of letting the transponder respond after a set time interval, let, for example, and without limitation of generality, this is deduced by the interrogator and the transponder by the known amount of data that the transponder will have to process internally.

Interleaved Command Execution Mechanism

Figure 12 schematically illustrates the interleaved command execution mechanism for interaction between an interrogator and multiple transponders, and is another embodiment of the present secure communication system, where, among others, the essential purpose is to enable partial parallelism of command processing. of interrogators on transponders to reduce the total execution time compared to a sequential execution of message pairs consisting of an interrogator command and a corresponding transponder response addressed.

The interleaved execution mechanism used in the present secure communication system executes two-phase commands, for the benefit of any sequence of command-response pairs between an interrogator and a transponder, involving extended processing on the transponder, in order of magnitude. milliseconds to tens of milliseconds or more. In particular, the mechanism applies to custom command sequences, according to the object of the present invention, which involve the use of transponder encryption: Mutual Auth Read, Secure Auth Read, and Secure Auth Write.

Without limitation of generality, the generic principle of the interleaved execution mechanism can be divided into three stages, as illustrated in figure 12:

I ^o . Sending stage of primary commands;

2nd stage of waiting for the interrogator, and

3. Primary response collection stage.

In the first stage, using the two-phase execution scheme, the interrogator sends the next due PCi primary command, as per the current communicative session, and receives an immediate auxiliary response ARj (auxiliary reply) from each Ti transponder in a set. from M Ti to TM transponders, with which the interrogator is holding communicative sessions.

In the second stage, the interrogator waits for completion of the Ti transponder processing, and, without limitation in generality, if the maximum command processing time is of the order of milliseconds for all transponders, given by t _proc , then the MSW should wait for at least t _wait = t _pr0 c - (M1) χ (t _req +) ≥ 0 milliseconds upon receipt of ARj so that PCi processing in the transponder Ti is terminated, with t _req representing the upper limit for transmission of a single PQ primary command, with t _conf representing the upper limit for receiving a single transponder auxiliary response ARj, and M specifying the total number of transponders to be transmitted. processed.

Note that transmission time is determined by different factors, including data transfer rates for uplink and downlink, maximum allowable tolerances, and message datagram sizes.

If the time required to send all M PQ commands with

1 <i <M, is greater than the internal processing time of the Ti transponder, then t _w = 0, and the interrogator can continue to the next stage without delay.

In the third and final stage, the interrogator sends the Auxiliary Command Finalize ACi commands to request and receive the PRi primary response transmissions from the Ti, 1 <i <M transponders.

If the time to receive primary responses in the third stage is less than the time to send primary commands in the first stage, the interrogator may be subject to additional timeouts, as exemplified below.

Without limiting the generality of its application, the interleaved execution engine follows a simplified model for parallelized implicit mutual authentication of multiple transponders Ti, 1 <i <M, from the interrogator's point of view, and constitutes another embodiment of the present system. secure communication where:

1. Send requests and receive implicit mutual authentication auxiliary acknowledgments: For all Ti with 1 <i <M, executed in sequence: 1. Send to Ti: Mutual Auth Read (Handle _x , Εκ (...), CRC)

ii. Receive from T _Í : Reply (Handlei, CRC)

2. Expect availability of the first primary response. Wait for t _w milliseconds with:

. t _w = max (0; t _proc - (M1) χ (t _req +))> 0,

• t _req = GetTransmissionTime (Mutual Auth Read (Handlei, Εκ (...), CRC)),

• tconf ⁼ GetTransmissionTime (Reply (Handlei, CRC)).

3. Request and collect primary mutual authentication responses: For every Tj with 1 <i <M, executed in sequence:

i. Send to T _Í : Finalize (Handlei, CRC)

ii. Receive from T. Reply (Handlei, Εκ (...), CRC)

iii. If (i <M): Wait At milliseconds with:

. At = max (0; t _req + - m - t _rsp ) ≥ 0;

. t _fm = GetTransmissionTime (Finalize (Handlei, CRC));

• trsp ⁼ GetTransmissionTime (Reply (Handlei, Εκ (...), CRC)).

In the example, GetTransmissionTime is an abstract helper mechanism for determining the transmission time of messages to be sent over the air interface.

The interleaved execution engine covers the execution of any homogeneous or heterogeneous set of commands to be executed on transponders.

Note that the interleaved execution engine is not limited to a particular sequence of command transmission per stage, but covers sequence optimization and change in consideration of the transmission and processing time of each command and response, with the aim of avoiding or reduce the interrogator's waiting time.

Also note that the present secure communication system it covers any variation of the interleaved command execution engine that has compatible purposes and advantages, including mechanisms involving auxiliary messages and / or distinct parameters, such as a compatible variation where, in the first stage, the transponder only sends PQ primary commands without receiving AR auxiliary acknowledgments _f .

Secure Communication Method Variations and Generalizations

In addition to the variations described, the present secure communication system also covers any variation and generalization that does not fundamentally differ from the functionalities and / or purposes of the mechanisms described herein, and in particular, and without limitation of any other possible variations, the This secure communication system covers the following variations:

Modifications to the custom command signature of the present secure communication system to support multiple key generations by key type, such as multiple authentication key generations, read and write access, and, for example, and without limitation of generality , the key generation identification to be used can be performed by means of an additional parameter in the affected commands that indicates the key generation to be used.

- Modifications to the custom commands of this secure communication system to support the use of one or multiple master keys, and the use of a key grants certain well-defined rights to the interrogator, either directly or indirectly through generation. a temporary secret key, including but not limited to exclusive read or write access to special or general areas of transponder memory; authorization of the use of special functionality and specific transponder commands; activation or temporarily or permanently disabling read and / or write access to transponder memory areas, including modifying the internal status of these transponder memory areas from "read and write allowed" to "read only", and vice versa, and the permanent and total deactivation of transponders (KM).

- In coordination with interrogators, transponders change or replace TN and RN nonces received in custom commands before generating the corresponding responses instead of reusing TN and RN nonces of custom commands received without change.

- Substitution of nonces, or increase with other time-varying values, chosen within a range sufficient to guarantee an insignificant likelihood of repeating the values used as nonces in messages in practice, as required by the particular application.

- Use of arbitrary encryption algorithms for cryptographic operations of custom commands defined by this secure communication system.

- Modification of command, response, and parameter nomenclature in command and response signatures, without essential modification of the functionality and purpose of the affected commands, responses, and parameters.

- Modifications to the composition of custom command parameters and transponder responses, without essential modification of the functionality and purposes of the commands and responses that are the subject of this secure communication system. Parameters can, for example, and without limitation, be combined by means of reversible logic operations, such as with the XOR operation, to reduce the total bit size of the composite data set for the purpose of reducing transmission time, or the number and time of operations required cryptographic

- Modifications of parameter sizes in number of command and response bits, and in particular modifications due to the use of different block sizes of 128 bits used in the reference algorithm (AES-128), or modifications due to the use of cryptographic algorithms other than the AES reference algorithm, and nonces with varying bit lengths.

- Custom commands optimized for specific data block sizes, including variations of custom transponder read / write access commands that contain standard size data blocks and / or preset read / write memory addresses.

- The use of arbitrary bit numbers for custom command parameters and corresponding responses.

- Cryptographic machines implemented on interrogators and / or transponders that use operating modes other than CTR mode, to ensure the integrity protection of encrypted data of arbitrary size.

- Descriptions of the constituent parts of the secure communication system, focusing on the specification and description of the main parameters of interrogator commands and transponder responses, without limiting the generality and without excluding the possibility of including additional parameters in the command and response signatures. for other purposes that do not interfere with or compromise the primary purposes of these commands and responses.

- Variations in the specification of commands and responses, objects of the present secure communication system, in relation to the different ways of handling exceptions and faults in processing and transmitting data. commands and answers.

- Secure and authenticated versions of the native Lock and Kill commands implemented following the Secure Authenticated Write command model, defining a new custom command, with a new characteristic bit sequence as specified in the ISO 18000-6C protocol, overriding the data parameters to be written by the Secure Authenticated Write command, with parameters required for their operation, for example, obtaining, but not limited to, custom Secure Auth Kill and Secure Auth Lock commands, and replacing the writing result code of the response to the Secure Authenticated command. Write with an appropriate code of the result of the new operation, and where the Access command becomes unnecessary after deactivating the other commands and modifying the state machine.

- Changed definitions of the LMAR logical memory range descriptor, including settings that are different from the memory addressing mode defined in ISO 18000-6C but whose adoption is permissible by that standard in custom commands. For example, the size values of LMAR components may be changed without limitation, or an entirely different addressing scheme may be defined, such as a Linear Block Addressing (LBA) scheme or the like.

Other Variations and Generalizations of the Secure Communication Method

In addition to the variations described, the present secure communication system also covers, without limitation of any other possible variations, the following variations:

Custom command variations that represent representations of the present secure communication system (including, without limitation generally, the custom commands Mutual Auth Read, Secure Auth Read, and Secure Auth Write) so that some or all of the command parameters are entered in plaintext rather than encrypted (ciphertext) , targeting applications that allow for a reduced level of safety protection in favor of improved processing performance on the transponder. Figure 14 schematically illustrates a variation of the Mutual Auth Read custom command and the corresponding response, which constitutes an embodiment of the present secure communication system, in which the auxiliary parameters RN, CRN, SMD, DMD, TN, and CTN are exchanged. no cryptographic envelope protection;

Variations of custom commands that represent representations of the present secure communication system - including, without limitation, the Mutual Auth Read, Secure Auth Read, and Secure Auth Write custom commands - as command parameters are changed, or added, in order to perform different behaviors of interrogator commands and corresponding transponder responses. As a non-limiting reference to the generality of the present secure communication system, it is assumed that additional parameters are used to include static, precalculated and stored in transponder memory, or dynamic authenticity codes generated by the runtime transponder ( meaning also in real time) in the transponder response. Another non-limiting reference is the inclusion of an additional parameter in the custom command for generating one or more temporary keys for data encryption with restricted validity for the duration of the communication session between the transponder and an interrogator. Another non-limiting reference is the inclusion of an additional parameter in the custom command for indexing one or more secret keys, or one or more secret master keys for generating one or more session keys.

Variations of custom commands that represent representations of the present secure communication system, including, but not limited to, the custom commands Mutual Auth Read, Secure Auth Read, and Secure_Auth_Write, such that one or more parameters, explicitly reserved for future use, are entered in the command and / or corresponding response. As a non-limiting reference to the generality of the present secure communication system, the use of an RFFU parameter of at least one bit size with a well-defined default value is assumed. Without limitation of generality, the default value will be represented by a sequence of bits larger than or equal to 1 bit, with the most significant bit (MSB) being the 'Ο' bit to indicate non-use of the parameter and non-consideration. the same by the container. The use of such RFFU-type parameters in commands and responses allows the extension of functionality in the implementation of the secure communication system in interrogating and reading equipment that ensures backward compatibility with previous commands and responses. Additionally, without limitation of generality, the value of the RFFU parameter, which indicates the presence of new functionality, will be broken down by a sequence of N bits larger than or equal to 1 bit, with the most significant bit (MSB) being bit ' Γ to indicate the use of the parameter as a function of a new command and / or response characteristic to be evaluated by the container. If the size of the RFFU parameter is larger than 1 bit, the nature of the new function will be broken down by the sequence of the least significant Nl bits of the RFFU parameter, allowing switching between up to 2 new ^{N 1.} varied features. In addition, without limitation of generality, the size of the RFFU parameter in case of MSB being represented by bit 'may have a well-defined size that is larger than the size of RFFU parameter in case of MSB being equal to bit value' Ο ', to keep the message size containing the RFFU parameter as small as possible, to improve message transmission efficiency over the air interface, while also reducing the likelihood of transmission error, which increases with each additional message size bit. Figure 14 schematically illustrates a variation of the Mutual Auth Read custom command, which is an embodiment of the present secure communication system, in which a new RFFU parameter has been inserted into the command and corresponding response.

- Variations of the mechanisms for initiating the communicative session, which constitute other non-limiting representations of the present secure communication system, including, without limitation, the mechanisms illustrated in Figures 3 and 4, as some or all of , the parameters of the commands and their responses are protected by encryption using secret keys shared between interrogator and transponder.

- Variations of custom commands characterized by the use of asymmetric cryptographic algorithms to protect the confidentiality, integrity, authenticity, uniqueness, and timeliness of data and messages. As a non-limiting reference to the generality of the present secure communication system, it is assumed, in transponders that have the technical capacity to perform asymmetric cryptography at runtime, the use of asymmetric algorithm for data encryption and decryption; for exchanging temporary secret session keys; to the use in symmetric encryption algorithms; for the protection of data to be transmitted over the air interface; for the generation of data authenticity and integrity codes, and for the generation of digital signatures on exchanged data and messages, for the purpose of non-repudiation of sent and received data and messages. In particular, another non-limiting reference to the generality of the present secure communication system is the insertion of a dynamic digital signature code into the secure communication mechanisms Mutual AuthJRead, Secure Auth Read, and Secure Auth Write, and the various variations thereof calculated by the reader, or the transponder, or calculated in real time, on the reader command data, transponder response data, or protocol data, replacing or supplementing any dynamic integrity and authenticity protection code DMAC used by replacing or supplementing any static SMAC integrity and authenticity protection code used, and replacing or supplementing any CRC dynamic data integrity protection code used. As a non-limiting reference to the generality of the present secure communication system, for the generation of digital signatures or asymmetric codes of authenticity and integrity using a public and private key scheme, the use of asymmetric algorithms, such as elliptic curve cryptography, is assumed. (ECC, Elliptic Curves Cryptography) [NIST Federal Information Processing Standards Publication No. 186-3, 2009], which, according to the state of the art, allow efficient implementations of resource-limited transponders compared to the use of the RSA mechanism, which requires secret keys and significantly larger block sizes, or the use of asymmetric algorithms with comparable key size, block size, and computational complexity is assumed, or smaller compared to asymmetric ECC algorithms.

- Variations of custom commands in which the Open state remains existing, and not deleted from the transponder state machine, with the Req RN command remaining valid (not disabled), and the Req Índle custom command being executed after the first execution of the state. Req RN command in inventory phase with transponder in Open state.

Variations of the present secure communication system in which the custom command Reqjíandle contains, as another non-limiting embodiment of the present secure communication system, one or more additional parameters for changing the internal state of the transponder. As a non-limiting reference to the generality of the present secure communication system, such changes include changing the status values of sessions S0, SI, S2, and S3, and the selected flag SL, as defined by ISO 18000-6C as well as the introduction and use of new internal state parameters in the transponders. As another non-limiting reference to the generality of the present secure communication system, such change includes the insertion of an additional parameter to reset the transponder as follows. conditional - by evaluating a logical condition against the internal state of the transponder - or unconditional.

Variations of the present secure communication system in which the transponder response to the custom command Reqjíandle contains, as another non-limiting embodiment of the present secure communication system, one or more additional parameters for transponder internal state information to the interrogator. As a non-limiting reference to the generality of the present secure communication system, such information includes the state values of the SO, SI, S2, and S3, and the selected flag SL, as defined by ISO 18000-6C, and the values of other internal transponder parameters, including additional newly entered internal state parameters.

Variations of transponder state machine embodiments, including the non-limiting embodiment of the extended state transponder machine schematically illustrated by FIG. 15, which is another embodiment of the present secure communication system, with variations of state transitions in shape. transponder does not respond to reader command requests while processing one of the complex custom commands Mutual Auth Read, Secure Auth Read, and Secure Auth Write, which require extended processing time on the OBU and a high power or power level in this process. , and not considering new reader commands during the processing of these complex custom commands, which in some cases significantly improves the robustness of secure communication system implementation in passive transponder devices (which do not have their own power source).

- Variations of the custom commands in which, as another non-limiting embodiment of the present secure communication system, a message transmission counter is used in the custom commands sent by the interrogator and the responses returned by the transponder for the purpose of identification. more efficient retransmissions, and for flow control and message delivery order in variations of the secure communication system that allow multiple commands and / or multiple responses to be sent and temporarily stored for retransmission. As a non-limiting reference to the generality of the present secure communication system, such message transmission identifiers include numeric counters. bicycles with binary size representation of one or more bits. A non-limiting example is a 2-bit counter with the increment function "plus a module 2 ² ", resulting in the sequence of values 0, 1, 2, and 3 per counter cycle. Another non-limiting example is a non-numeric message identifier that uses two or more differentiated values, such as a flag with values A and B.

- Custom command variations in which encryption mode is exchanged with decryption mode in command messages, which is another non-limiting embodiment of the present secure communication system, with the aim of enabling secure transponder communication system implementations in the so that only encryption mode needs to be implemented on the transponder to reduce implementation complexity and power consumption in transponder operation, as well as improve the processing time performance of the resource-limited transponder compared to the interrogating device . So in other words, the encryption operation (CIPH) can be given by the decryption function (DEC), and the reverse decryption operation (CIPH ¹ ) by the encryption function (ENC), this being permissible in the case of symmetric ciphers, such as AES and DES, where encryption and decryption features are interchangeable to achieve data encryption and decryption. As a non-limiting reference to the generality of the present secure communication system, the use of the symmetric cryptographic algorithm AES is assumed, as well as any other symmetric cryptographic algorithm, such as DES, TDES, Blowfish, or IDEA, without generality limitation, in ECB, by the reader in the decryption function (DEC), to encrypt (CIPH) the original data (plaintext), being CIPHHDEC, so that the transponder then decrypts (CIPH ^"1 ) the ciphertext (ciphertext) by applying the AES cryptographic symmetric algorithm in ECB operating mode in the reverse encryption function (ENC), where CffH ^{"1 =} ENC, to retrieve the original text using the same shared secret symmetric key or generated synchronously between transponder and interrogator.

Variations of custom commands in which the secret encryption keys in commands and corresponding responses of the same communicative session between interrogator and transponder are varied, which constitutes another non-limiting embodiment of the present secure communication system. Without limitation generally, such secret key variations include the periodic generation of new time-variable seed-based session secret keys, such as non-limiting, the use of nonces in the messages of each new response-type pair, and the use of multiple secret keys for encryption of different data blocks in the same command or response message.

Variations of realizations of the implicit mutual authentication mechanism Auth Auth of the secure communication system

Figure 16 schematically illustrates a non-limiting embodiment of implicit mutual authentication between an interrogator and a transponder reading transponder identifying data protected by a cryptographic envelope using nonces RN, TN, CTN as a non-limiting example in general. 64-bit CRN56 and 56-bit CRN56 the ECB operating mode of the AES-128 cryptographic machine with the 128-bit AK secret key in the form that CIPH = ENC and CIPH ^"l = DEC, to protect the confidentiality and integrity of the RN and CRN56 protocol parameters in the command and TN and CTN in the corresponding response, and using the machine's CTR mode AES-128 encryption with 128-bit SK secret key to protect the confidentiality and integrity of 64-bit UTID and TDATA vehicular data and the SMAC static integrity and authenticity protection code contained in the response, with SMAC being pre-calculated on UTID and TDATA data, and previously stored in memory during transponder customization, with SMAC size and type defined by parameter SMD2, with dynamic error detection DC code C, type CRC- 16, being calculated over vehicular data and SMAC code at runtime by the transponder, and with the DCRC parameter in the transponder response, being combined with the least significant 16 bits of the TN parameter by the XOR (or exclusive) operation. , and with a dynamic code of integrity and authenticity protection DMAC, of size and type defined by parameter DMD2, and calculated at run time by the transponder over the encoded data blocks. CTR mode, contained in the reply message, and using the 64-bit CTN and 56-bit CRN56 parameters to initialize the CTR mode start counter, and with the command message containing non-limiting examples of parameters RFFU2 parameter being a 2-bit parameter reserved for future use and not encrypted, SMD2 being a 2-bit descriptor parameter of the SMAC code, DMD2 being a 2-bit descriptor parameter of the DMAC code, GSKl being a descriptor parameter 1-bit setting the mechanism for obtaining the transponder SK session secret key - being performed by the bit value '0' in binary notation of the GSKl parameter, without limitation, the use of a predefined session default secret key, and by the bit value T of the GSKl parameter, the use of a standard master key to generate, at run time, a new temporary SK session secret key SK key dynamic operation using nonces RN and TN, or other combination of time variable parameters such as seed, and the RFFUP3 parameter being a 3-bit parameter reserved for future use, protected by encryption, and RFFU2 and RFFUP3 being non-limiting examples of parameters intended for safe future introduction of new command functionality without changing the basic structure of the current command to maintain backward compatibility and interoperability of implementations of different versions of the transponder and interrogator safe mechanism.

Figure 17 schematically illustrates another non-limiting embodiment of implicit mutual authentication between an interrogator and a transponder, reading transponder identifying data protected by a cryptographic envelope, which uses nonces RN, TN, CTN as a non-limiting example generally; 64-bit, and 56-bit CRN56, the ECB operating mode of the AES-128 cryptographic machine, with 128-bit AK and SK secret keys, in the form CIPH = ENC, with CIPH = DEC on all cases to protect the confidentiality and integrity of the RN and CRN56 protocol parameters in the command and CTN in their two occurrences, and RN and TN in the corresponding response and the DCRC dynamic code error detection type CRC- 16, calculated at runtime by the transponder on 64-bit UTED and TDATA vehicular data and SMAC code contained in the response, with the DCRC parameter being combined with the least significant 16-bit parameters by the XOR (or exclusive) operation, and using the AES-128 encryption machine's CTR encryption mode as the SK secret key, to protect the confidentiality and integrity of UTED and TDATA vehicular data, and the SMAC static code of protection of integrity and authenticity in response, with SMAC being pre-calculated on UTED and TDATA data and previously stored in memory during transponder customization, with SMAC size and type defined by SMD2 parameter, DCRC dynamic error detection code, type CRC-16, being calculated over vehicle data and SMAC code at runtime by the transponder, with the DCRC parameter in the transponder response being combined with the least significant 16 bits of the TN parameter by the XOR (or exclusive) operation, and with a dynamic DMAC integrity and authenticity protection code of the type and size defined by the DMD2 parameter and calculated at runtime by the transponder over the CTR mode encrypted data blocks with the SK secret key and over the SK secret key encrypted data blocks in ECB mode contained in the reply message and using the 64-bit CTN and 56-bit CRN56 parameters to initialize the initial counter CTR mode, and with the command message containing, as non-limiting examples of additional parameters, RFFU2 being a 2-bit parameter reserved for future use and not encrypted, SMD2 being a 2-bit descriptor parameter of SMAC code, DMD2 being a 2-bit descriptor parameter of DMAC code, MKS3 being a 3-bit descriptor parameter for selecting the default session key or master key to be used for SK session secret key generation, with MKS3 without general limitation indexing a total of 2 ³ = 8 keys or master keys with indexes 0 to 7, these keys being pre-written to transponder memory during customization, GSKl being a 1-bit descriptor parameter that defines the mechanism for obtaining the temporary secret key. SK session by the transponder, being made by the bit value '0' in binary notation of the GSKl parameter, without limitation of generality, the use of a key default secret session indexed by the MKS3 parameter stored in the transponder, and by the bit value '' of the GSK1 parameter the use of that secret master key stored in the transponder and indexed by the MKS3 parameter for the runtime generation of a temporary session secret key SK, and in this process of dynamic SK key generation using nonces RN and TN or other combination of time-varying parameters as seed, and the parameter RFFU2 being a non-limiting example for a parameter intended for future introduction from new functionality to command without changing the basic structure of the current command to maintain backward compatibility and interoperability of implementations of different versions of the secure engine in transponders and interrogators.

Figure 18 schematically illustrates another non-limiting embodiment of implicit mutual authentication between an interrogator and a transponder, reading transponder identifying data protected by a cryptographic envelope, which uses nonces RN, TN, IRN, and non-limiting example generally. ITN, 64-bit long, ECB operating mode of AES-128 cryptographic machine, with 128-bit AK secret key, in form CIPH = ENC with CIPH ^ DEC, to protect the confidentiality and integrity of parameter protocol parameters RN and IRN protocol in the command and TN and ITN in the corresponding response, a dynamic 64-bit DMAC integrity and authenticity protection code in the command, and, without limitation, the DMAC being calculated at runtime by the reader on the ECB mode encrypted RN and ITN block in the command using, as a non-limiting example, a secret key and a determined DMAC format and size s by the reader, in real time, as a function of the transponder GID group identifier CBC mode, with 128-bit SK secret key, to protect the confidentiality and integrity of nonces TN and RN, vehicle identification number, and, without limitation, represented by the yehicle identification number (VIN) , according to 128-bit international standard ISO 3779, and DCRC dynamic error detection code, 16-bit CRC-16 type, calculated over the VIN, at runtime by the transponder, with the DCRC parameter in the response being combined with the least significant 16 bits of the TN parameter by the XOR (or exclusive) operation, and using the 64-bit IRN and ITN parameter set as the CBC mode initialization vector (IV) from the AES-128 cryptographic machine.

Figure 19 schematically illustrates another non-limiting embodiment of implicit mutual authentication between an interrogator and a transponder, reading transponder identifying data protected by a cryptographic envelope, which uses nonces RN, TN, IRN as a non-limiting example. , and ITN, 64-bit in size, the ECB operating mode of the AES-128 cryptographic machine with 128-bit AK secret key in decryption function, for CIPHHDEC data encryption, with CIPH ^ ENC to protect confidentiality and integrity of the RN and IRN protocol parameters in the command, the form CIPH = DEC allowing transponder decryption of the interrogator encrypted data to be performed in ECB mode in the encryption function, then CEPH ^ ENC, removing the need for additional implementation of the decryption mode in favor of the unique mode of encryption in the transponder, allowing, without limitation in general, in certain cases s cryptographic machine implementation s reducing the cryptographic algorithm implementation chip area and power consumption in the operation of the algorithm in passive transponders, and using the ECB operating mode of AES-128 cryptographic machine with 128-bit AK secret key in encryption function, for encrypting data in the form CIPH = ENC with CIPH ^ DEC, to protect the confidentiality and integrity of parameters and TN and ΓΓΝ na using the CBC mode of encryption of the symmetric cryptographic algorithm with the 128-bit SK secret key to protect the confidentiality and integrity of nonces RN and TN, the vehicle identification number being, without limitation, represented by the VTN ( vehicle Identification number), as per 128-bit ISO 3779 international standard, and the 64-bit SMAC static integrity and authenticity protection code pre-calculated over VTN during transponder customization, with the SMAC parameter in the transponder response being matched with the TN parameter by the XOR (or exclusive) operation and using the 64-bit IRN and ITN parameter set as the d array and initialization vector (IV), for the initialization of CBC mode in the current communication session between interrogator and transponder, and using, as a non-limiting example, a 1-bit binary TC transmission counter in command messages and response to indication of new command and response transmissions and retransmissions, respectively, and command and response messages containing non-limiting examples of additional parameters, a 1-bit size RFFU parameter reserved for future use, not encrypted, and the parameter RFFU is intended for the future introduction of new features in the engine without changing the basic command structure and corresponding response to maintain backward compatibility and interoperability of implementations of different versions of the secure engine in transponders and interrogators.

Secure Read Engine Embodiment Variations Secure_Auth_Read with secure communication system request authentication

Figure 20 schematically illustrates a non-limiting embodiment of secure authentication with request authentication between an interrogator and a transponder, which uses, as a non-limiting example, 64 bit-sized nonces RN and TN, an area interval descriptor 64-bit LMAR to be read, the LMAR parameter in the interrogator command being combined with the RN parameter, by XOR (or exclusive) operation, the AES-128 encryption machine ECB encryption operating mode with 128-bit SK session in CIPEHENC form, with CIPH ^ DEC, to protect the confidentiality and integrity of nonces and the LMAR 64-bit memory descriptor on command, and to protect the confidentiality and integrity of nonces and DMAC dynamic code from 64-bit integrity and authenticity protection in response, DMAC being calculated at runtime by the transponder over n 1 data blocks DWi to DW _n at 128 bits each, c om the DW block _n containing a well defined padding if the amount of data read and contained in the last block is smaller than the block size, and the DMAC parameter in the transponder response being combined with the TN parameter. by XOR (exclusive or), and using the CTR mode of AES-128 encryption machines to protect the confidentiality and integrity of data DWI DW _n read from the transponder memory in case of successful authentication request.

Figure 21 schematically illustrates another non-limiting embodiment of secure reading with request authentication between an integrator and a transponder, which uses, as a non-limiting example, 64 bit-sized nonces RN and TN, a data descriptor. 64-bit LMAR logical range to be read, the LMAR parameter in the interrogator command being combined with the RN parameter, by XOR (or exclusive) operation, using the AES-128 keyed cryptographic machine ECB operating mode CIPHHSNC 128-bit SK secret code with CEPH ^ DEC to protect the confidentiality and integrity of the 64-bit nonces and LMAR memory descriptor in the interrogator command and using the AES-128 CTR mode with secret 128-bit key SK to protect the confidentiality of nonces RN and TN data DWI DW _n read from the transponder memory, and dynamic code CPCR integrity type CRC-16 of 16 bits in response, the CPCR is calculated , at run time, by the transponder over n≥ 1 data blocks DWi to DW _n at 128 bits each, with the DW block _n containing a well-defined padding, if the amount of data read and contained in the last block is smaller. that size block, the RCRC parameter in the transponder response being combined with the least significant 16 bits of the TN parameter by the XOR (or exclusive) operation, and using as a non-limiting example a 1-bit binary TC transmission counter in the command messages and reply, to indicate new transmissions and retransmissions.

Figure 22 schematically illustrates another non-limiting embodiment of secure authentication with request authentication between an interrogator and a transponder, which uses, as a non-limiting example, 64-bit long nonces RN and TN, an area interval descriptor 64-bit LMAR to be read, the LMAR parameter in the interrogator command being combined with the RN parameter, by XOR (or exclusive) operation, the CBC operating mode of the 128-bit AES-128 SK secret key cryptographic machine bits in the form CIPH = ENC, with CIPH ^ DEC, to protect the confidentiality and integrity of nonces and the 64-bit LMAR memory descriptor in the interrogator command, and to protect the confidentiality and integrity of nonces, of data read DWi to DW _n , and the 16-bit CRC-16 integrity integrity dynamic code RCRC in response, the RCRC being calculated at run time by the transponder over n≥ 1 data blocks DWi to DW _n at 128 bits each with the block DW _not containing a well-defined padding, if the amount of data read and contained in the last block is smaller than the block size, the RCRC parameter in the transponder response being combined with the least significant 16 bits of the TN parameter by XOR ( using the command and response messages as a non-limiting example of additional parameters, the 1-bit RFFU parameter reserved for future use and not encrypted, and using a dynamic integer protection code DMAC is of pre-defined size and type or defined by an auxiliary parameter included in the LMAR parameter, and the DMAC is calculated at run time by the transponder over the CBC mode encrypted data blocks contained in the transponder response.

Fig. 23 schematically illustrates another non-limiting embodiment of secure reading with request authentication between an interrogator and a transponder, which uses, as a non-limiting example generally, 64 bit-sized nonces RN and TN, an area interval descriptor LMAR, 64-bit LMAR, the LMAR parameter in the interrogator command being concatenated with the TN and RN parameters, the ECB operating mode of the AES-192 cryptographic machine with 192-bit SK secret key in the form CIPH = DEC , with CEPFF ^ ENC, to protect the confidentiality and integrity of nonces and the LMAR memory descriptor in the interrogator command, and using the CBC mode of the 192-bit SK secret key AES-192 encryption machine in the form CIPH = ENC, with CIPIT ^ DEC, to protect the confidentiality and integrity of nonces in the response, DWI data DW _n read from the transponder memory and the DMAC dynamic integrity protection code and 64-bit authenticity, DMAC being calculated at run time, by the transponder on n≥ 1 data blocks DWI DW _n 192 bits each, with the DW block _not containing a well - defined padding if the amount of data read and contained in the last block is less than the block size, the DMAC parameter in the transponder response being concatenated with NB parameters and TN, and the type of DMAC being predefined or defined by an auxiliary parameter included in the LMAR parameter.

Fig. 24 schematically illustrates another non-limiting embodiment of secure reading with request authentication between an interrogator and a transponder, optimized for secure and authenticated reading of a single transponder memory block containing up to 64 data bits, using, as a non-exemplary example. nonce RN and TN, 64-bit size, a 64-bit logical memory area range descriptor to read LMAR, for addressing up to 64 bits of data to be read from transponder memory, LMAR parameter in the interrogator command being concatenated with the TN and RN parameters using the ECB operating mode of the AES-192 cryptographic machine with 192-bit SK secret key in CIPH-ENC form with CIPH ^ DEC to protect confidentiality and integrity nonces TN and RN and the LMAR memory descriptor in the interrogator command, and protect the confidentiality and integrity of nonces RN and TN and the single data block 64-bit DW64 messages in the reply message, the block DW64 containing a well-defined padding if the amount of data to be read is less than 64 bits.

Secure_Auth_Write secure write engine embodiment variations with secure communication system request authentication

Fig. 25 schematically illustrates a non-limiting embodiment of secure writing with explicit request authentication between an interrogator and a transponder, which uses, as a non-limiting example, 64 bit-sized nonces RN and TN, a time slot descriptor. 48-bit logical memory area to be written LMAR48, LMAR48 being concatenated with a 16-bit CRC-16 integrity integrity WCRC code, the WCRC being calculated, at run time, by the interrogator over n≥ 1 blocks data DWI DW _No of 128 bits each, with the DW block "containing a well defined padding if the amount of data to be written in the last block is less than the block size, and this padding being removed by the transponder before write data DWi to DW _n in internal memory at the addresses specified by parameter LMAR48 in case of successful command authentication by analyzing the validity and correcting the TN values , RN, WCRC and any additional integrity code contained in parameter LMAR48 by the transponder, the set of parameters LMAR48 and WCRC concatenated in the interrogator command being combined with parameter RN, by XOR (or exclusive) operation, and using CBC mode of the AES-128 cryptographic machine with the 128-bit WK secret write key, to protect on command the confidentiality and integrity of nonces RN and TN, parameters LMAR48 and WCRC, and n≥ 1 data blocks DWi to DW „e to be written to the transponder memory, and using the machine's CBC encryption mode AES-128 encryption with the 128-bit WK write secret key to protect the confidentiality and integrity of nonces RN and TN and WCRC * parameter in the transponder reply message, WCRC * being a CRC-16 dynamic integrity code, 16-bit, calculated by the transponder at run time over the area of memory that was actually written, with the WCRC * parameter in the transponder response combined with the least significant 16 bits of the TN parameter by the XOR (or exclusive) operation. , and using as a non-limiting example a 1-bit binary TC transmission counter in command and response messages for indicating new command and response transmissions and retransmissions.

Fig. 26 schematically illustrates another non-limiting embodiment of secure writing with explicit request authentication between an interrogator and a transponder, which uses as an optional non-limiting example an optional 64-bit dynamic integrity and authenticity protection code DMAC; a DMD parameter being, without generality limitation, a 4-bit descriptor indicating the presence and type and size of the DMAC, being used without generality limitation the DMD value in binary notation to indicate the absence of the DMAC, corresponding to zero-bit DMAC size, and the remaining DMD values are used to describe the DMAC algorithm size and type and the secret key index used by the interrogator to generate the DMAC at run time over the data encrypted in CTR mode with the WK secret key and on the WK secret key encrypted data blocks in ECB using 64-bit nonces RN and TN, a 64-bit logical memory area range descriptor to be written LMAR, optionally containing a code additional integrity dynamics being calculated at run time by the interrogator on the n 1 data blocks DWi to DW _n at 128 bits each, with the DW block _n containing a well-defined padding if the amount of data in this last block a be written is smaller than the block size, and with this padding being removed by the transponder before writing the data DWi to DW _n to internal memory at the addresses specified by the LMAR parameter, in case of successful command authentication, by parsing transponder the validity and correctness of the DMAC, TN, and RN values, and any additional integrity codes contained in the LMAR parameter, the LMAR parameter in the interrogator command being combined with the RN parameter by the XOR (or exclusive) operation, and using ECB mode of the AES-128 cryptographic machine with the 128-bit WK secret write key in the decryption function for data encryption in the form CIPH = DEC, with CIPH ^{"1 =} = ENC, pa to protect the confidentiality and integrity of the TN, RN, and LMAR data on command, and using the AES-128 encryption machine's CTR mode with the 128-bit WK write secret key to protect the confidentiality and integrity of n≥ 1 blocks DWi to DW data _not contained in the command and intended to be written to the transponder memory upon successful request authentication, and using the AES-128 encryption machine ECB encryption mode with the 128-bit WK write secret key at encryption function, for encrypting data in the form CIPH = ENC with CIPHT ^{1 =} DEC, to protect the confidentiality and integrity of nonces RN and TN and the WCRC parameter in the transponder reply message, WCRC being a dynamic integrity code type 16-bit CRC-16, calculated by the transponder, at run time, over the memory area that was actually written, and the WCRC parameter being the transponder combined with the least significant 16 bits of the TN parameter by the XOR (or unique) operation.

Fig. 27 schematically illustrates another non-limiting embodiment of secure writing with explicit request authentication between an interrogator and a transponder, which uses, as a non-limiting example, nonces RN and TN, 64 bits in size, a time slot descriptor. 64-bit LMAR logical memory area to be written, internally containing an additional 16-bit CRC-16 dynamic integrity code being calculated at run time by the interrogator on n≥ 1 DWi data blocks DW _{n is} 192 bits each, with DW block _n containing a well-defined padding if the amount of data in this last block to be written is smaller than the block size, and with this padding being removed by the transponder before writing the data. DWi to DW _{n data} in the internal memory at the addresses specified by the LMAR parameter, in case of successful command authentication through transponder analysis of the validity and correctness of the TN, and RN values, and any additional integrity codes contained in the LMAR parameter, the LMAR parameter in the interrogator command being concatenated with the TN and RN parameters, and using the ECB mode of the AES-192 cryptographic machine with the secret key of 192-bit WK writing in the encryption function for data encryption in the form C1PHHENC, with CIPH ^ DEC, to protect the confidentiality and integrity of the TN, RN, and LMAR data in the command, and using the AES-CTR mode CTR mode. 192 with the 192-bit WK secret write key to protect the confidentiality and integrity of n≥ 1 data blocks DWi to DW _not contained in the command and intended to be written to the transponder memory upon successful request authentication, and using ECB mode of machine encryption AES-192 encryption with WK 192-bit secret write key in the encryption function for data encryption in the form CIPH = ENC, with CrPH ^{"1 =} DEC, to protect the confidentiality and integrity of nonces RN and TN and the parameter LM AR * in the transponder response message, with 64-bit LMAR * being the effectively written logical memory area range descriptor, internally containing the recalculated, additional 16-bit dynamic CRC-16 integrity code execution, by the transponder over the content of that data area in the transponder memory that was actually written, and the LMAR * parameter being in the transponder response concatenated with the RN and TN parameters.

Fig. 28 schematically illustrates another non-limiting embodiment of secure writing with explicit request authentication between an interrogator and a transponder optimized for secure and authenticated writing of a data block in transponder memory which it uses as a non-limiting example generally nonces RN and TN, 64-bit long, a 16-bit DW16 data block, a logical memory area range descriptor to be written LMAR48, 48-bit, LMAR48 being concatenated with block DW16 a be written, if the command authentication is successful, through the transponder's analysis of the validity and correctness of the TN value and any additional integrity codes contained in parameter LMAR48, with the set of parameters LMAR48 and DW16 in the interrogator command, being combined parameter RN, by XOR (or exclusive) operation, and using the ECB mode of the AES-128 cryptographic machine with the WK write secret key 128-bit encryption function for CIPH ^ ENC data encryption with CEPH ^ DEC to protect the confidentiality and integrity of the TN, RN, LMAR48, and DW16 data using the AES-128 encryption machine ECB encryption mode with the 128-bit WK secret write key in the encryption function, for data encryption in the form CIPH = ENC, with QPH ^{"1 =} DEC, to protect the confidentiality and integrity of nonces RN and TN and parameter DW16 * in the transponder reply message, DW16 * being the data block read again by the transponder of the logical memory area that was actually written, and parameter DW16 * in the reply of the transponder combined with the least significant 16 bits of the TN parameter by the XOR (or exclusive) operation.

Combined realization variation of authenticated secure writing and authenticated secure reading mechanisms of the secure communication system

Fig. 29 schematically illustrates a non-limiting embodiment of combining, in a single command, the functionality of the authenticated secure write and authenticated secure read mechanisms, optimized for secure and authenticated reading of a single data block RDW128 and secure and of a single WDW32 block of data in transponder memory, which uses, as a non-limiting example, nonces RN and TN, 64 bits in size, a range descriptor of the logical memory area to be read RLMAR48, 48 bits, a range descriptor of the WL AR48 48-bit logical memory area to be written, and a 32-bit WDW32 data block to be written to the memory area specified by the WLMAR48 parameter, and using the machine's ECB mode AES-256 encryption with 256-bit secret key Kl in encryption function, for data encryption in the form CIPH = ENC, with CIPH ^ DEC, to protect confidentiality and integrity. TN, RN, RLMAR48, WLMAR48, and WDW32 data on the controller, and using the ECB mode of encryption of the AES-256 encryption machine with the 256-bit K2 secret write key in the encryption function, for data encryption in the form CIPEHENC, with CIPFf ^{1 =} DEC, to protect the confidentiality and integrity of the transponder reply message nonces RN and TN of the 32-bit WCRC parameter and the 128-bit RDW128 data block read from the memory area specified by the RLMAR48 parameter, where WCRC is a 32-bit CRC-32 dynamic integrity code, s calculated by the transponder, at run time, over the area of memory that was actually written, and the WCRC parameter being the transponder response combined with the most significant 32 bits of the TN parameter by the XOR (or exclusive) operation.

Transponder Types

Unlike the ISO 18000-6C protocol, the present secure communication system covers implementations on all types of transponders, including passive, semi-active or semi-passive, and active transponders.

In the context of the present secure communication system, the transponder types are characterized as follows:

Passive transponder refers to a transponder that receives both information and energy for the operation of the interrogator's RF signal itself;

Semi-active (or semi-passivó) transponder refers to a transponder that uses its own power source for internal integrated circuit operation and only draws power from the interrogator's RF signal to return information to the intern through modulation of a signal. of RF over the interrogator carrier;

- active transponder refers to a transponder that uses its own power source for both internal integrated circuit operation and transmit information to the interrogator by modulating an RF signal generated by the transponder itself.

The present secure communication system also covers all types of interrogators and transponders that implement the ISO 18000-6C protocol in whole or in part, including future developments with full backwards compatibility as well as derivatives of the ISO 18000-6C backwards compatible protocol. restricted.

applications

The present secure communication system covers all application domains of the ISO 18000-6C protocol, and also covers any radio frequency identification application that benefits in any way from the mechanisms described in the present invention, including but not limited to the case. , the electronic registration, identification, location, and tracking of persons and tangible assets of any kind, such as vehicles, truck fleets and other means of transportation, as well as cargo, animals, manufactured goods, materials valuables, medicines, documents, packaging, boxes, palettes, and containers, as well as the protection of assets and documents from counterfeiting, imitation, theft, and theft, replacing or complementing, without limitation, vehicular information stored on transponders electronic product codes (EPC) or other identifying data as required s of processes and applications.

As a non-limiting reference to the generality of this secure communication system, this secure communication system explicitly covers all application domains linked to the Brasil-ED system (www.brasil-id.org.br) for identification, tracking, and authentication of radio frequency goods (RFID) including all applications requiring or benefiting from one or more secure communication system for the secure and efficient identification and authentication of products, documents, people, and vehicles, including the secure recording of data on transponders, with an emphasis on situations where the time available for RFID identification and authentication is limited because of the mobility of objects or persons to be tracked, or because of the mobility of reading equipment (interrogator).

As a non-limiting reference to the generality of the present secure communication system, such applications connected to the Brasil-ID system and covered by this secure communication system include the identification, authentication, and recording of low volume high speed product transponders or large volumes of products at low speeds, so that the time available to complete a secure reader-transponder interaction is limited and critical given the high complexity of transponder processing due to cryptographic mechanisms.

As a non-limiting reference to the generality of this secure communication system, this secure communication system also covers all applications that generally require an authentication mechanism with a high level of cryptographic protection to ensure the authenticity of goods, components. , products, documents, people, means of transport, and physical places (without limitation in general, represented by global GPS coordinates, names and numbers of mas, or other means) and logical (without limitation in general, exemplified logical locations , such as "dispatch zone", "pickup zone", and others as per particular tracking and identification and authentication process and application).

Although the present invention has been described on the basis of By way of exemplary embodiments, modifications may be made to its basic inventive concept, which will be defined by the following set of claims.

Claims

1 SAFETY COMMUNICATION SYSTEM BASED ON IDENTIFICATION AND INFORMATION EXCHANGE BY RADIO FREQUENCY, which will be employed in the communication between a transmitter and one or multiple receivers / transmitters, aiming to provide greater security and communication efficiency in systems based on the ISO standard protocol. 18000-6C, and which will be used on the platform of the National Automatic Vehicle Identification System (SINIAV), characterized by incorporating systemic functional improvements introduced in the transponders; interrogators and the ISO 18000-6C communication protocol employing custom interrogator commands which generate corresponding transponder responses, employing a symmetric cryptographic algorithm, and the transponder has a unique and unique DD denoted UTID ( unique transponder identifier), and where each transponder has a GID denoted group ID, the symmetric encryption algorithm encrypts the information before transmission via the communication interface, and whose cryptographic code will be changed on each communication, with custom commands perform the transponder authentication, and also perform the interrogator authentication, implicitly and explicitly, as well as read and write the transponder information, with request authentication and the protection of the information transmitted by encryption. still a means to return to the inte rogers an encryption-protected status code, in response to each command sent and executed by a transponder, intended to change the state of the transponder's persistent memory, and additional auxiliary custom commands that execute custom commands are also provided. computationally expensive two-phase transponders, and a temporary context, denoted session, is also established as part of any interaction, of limited duration, between an interrogator and a transponder, which involves identifying the transponder, reading data from or writing where the establishment of a session covers a coordinated initialization of the interrogator and transponder cryptographic machines, and the custom commands and corresponding responses of the communication protocol consist of parameters that vary in a coordinated manner before each message exchange between an interrogator and a transponder, and where custom commands are executed by parallelism over time of operations on multiple transponders, which may consist of a passive, semi-passive / semi-active, or active device. having volatile and nonvolatile memories, as well as having are a state machine, which defines its behavior in relation to commands received from interrogators, the internal state and the processing performed, and the transponder has the implementation of a symmetric key cryptographic algorithm, also called cryptographic machine, which has a pseudo-random number generator (PRNG), as well as a mechanism for generating and verifying binary error detection codes, and a mechanism for generating and verifying cryptographic codes. authentication and integrity over binary data, with a mechanism for enabling or disabling dynamic generation of authentication and integrity cryptographic codes, and a mechanism for enabling or disabling the inclusion of a static and pre-defined authentication and integrity cryptographic code. transponder memory, transponder authentication response the transponder still has a mechanism for dynamic cryptographic key generation for single use per communicative session, and a mechanism for enabling or disabling dynamic cryptographic key generation, with the system providing for the disabling of native commands and partial disabling of the original protocol state machine 18000-6C in order to transmit the preparatory data in the UII response on transponders during inventory, in accordance with ISO 18000-6C protocol for subsequent authentication and identification phase and establishment of a secure session context by modifying the generation of the UII response on transponders during inventory according to the ISO 18000-6C protocol, including the insertion of a random value into the transponder response, generated at runtime, with full ISO 18000-6C compatibility, with authentication and identification of transponders is through a single combined command with transponders issuance of a limited-size identifier dataset, providing for single-command authentication in conjunction with two-phase execution to maximize parallel over time for operations on multiple transponders, resulting in optimal performance of transponder interaction across high speed of travel relative to the times usually observed in transit of traceable objects.

SAFE COMMUNICATION SYSTEM according to claim 1, characterized in that it comprises, inter alia, a means of communication consisting of a set of custom commands configured in accordance with ISO 18000-6C , to be implemented in interrogators and transponders, including the specification of their valid transponder responses, in order to provide identification and access to transponder data by cryptographic mechanisms; one set of auxiliary custom commands to be implemented in interrogators and transponders to improve the efficiency of transponder operations in handling communication and execution failures, and in specifying valid transponder responses; The specification of the transponder state machine extension takes into account the custom commands in the present invention.

SAFE COMMUNICATION SYSTEM according to claim 1, characterized in that its operability can be divided into a first phase of transponder Singularization by the interrogator according to the mechanism specified in the ISO 18000-6C protocol, with the establishment of permanent control references through of a new custom command Req Handle; a second phase of Mutual Authentication between interrogator and transponder, with implicit identification and reading of transponder data via a new custom Mutual Auth Read command, and a third phase of Transponder Memory Read and Write Authentication through new custom commands Secure Auth Read and Secure Auth Write.

SAFE COMMUNICATION SYSTEM according to claim 3, characterized in that it covers the following main custom commands: Mutual Auth Read (MAR); Secure Auth Read (SAR), and Secure_AuthJVrite (SAW)

SAFE COMMUNICATION SYSTEM according to claim 3, characterized in that, unlike the ISO 18000-6C standard, the TID, UII, and USER memory areas of transponders can be accessed exclusively through the main protected custom commands. encryption mechanisms, Mutual Auth Read, Secure Auth Read, and Secure Auth Write, or similar custom command protected by data security mechanisms, encryption, authentication and authorization mechanisms.

SAFE COMMUNICATION SYSTEM according to claim 1, characterized in that it covers the following auxiliary custom commands: Finalize; Init CryptoEngine; Init Session; Req Handle, and Set RN TN.

SAFE COMMUNICATION SYSTEM according to claim 1, characterized in that it defines a set of native transponder commands, specified in the ISO 18000-6C protocol, for total deletion or permanent deactivation after initialization and before the first use of the transponder. field transponder: Read; Write; Kill; Lock; Access; BlockWrite, and BlockErase.

SAFE COMMUNICATION SYSTEM according to claim 7, characterized in that the Secure Authenticated Read and Secure Authenticated Write custom commands provide secure substitutes for the functionality of the native Read, Write, BlockWrite, and BlockErase commands, while BlockErase command functionality. in particular it can be achieved by overwriting existing information by well-defined new information, such as a zero value bit sequence, in the memory area by using the Secure Authenticated Write command.

SAFE COMMUNICATION SYSTEM according to claim 1, characterized in that, to enable communicative interaction with a transponder that is located in the interrogation zone, according to the ISO 18000-6C protocol, the interrogator must detect and singularize the transponder and, for this, the ISO 18000-6C protocol defines the phase of detection and singulation of transponders by the interrogator, called inventory.

10. SECURE COMMUNICATION SYSTEM, in accordance with claim 9, characterized in that, upon successful completion of the transponder singularization phase, the interrogator is aware of a transponder transponder identifier called RN 16, each RN 16 consisting of a binary code of a number well defined bit rate, which is used by the interrogator to address messages to the transponder as part of communication via the air interface and, once established, the RN 16 is valid until the transponder participates in a new inventory, where a new one is generated. RN 16, or until you receive an explicit request for a new generation.

SAFE COMMUNICATION SYSTEM according to claim 10, characterized in that, without limitation, RN 16 may be represented by a 16-bit binary number as specified in the ISO 18000-6C protocol, but may , temporary identifiers of arbitrary formats and sizes should be used.

SAFE COMMUNICATION SYSTEM according to claim 1, characterized in that the temporary communicative dialogue involving the exchange of messages and information between an interrogator and a transponder is a communicative session, or simply a session, with a new session. begins from the establishment of a permanent transponder handle between the interrogator and the transponder, and ends the moment the interrogator discards the current known permanent handle and the interaction with the transponder or the currently known permanent transponder interaction ends. It is invalid if the interrogator is unaware of a valid new Permanent Handle, and where the maximum validity of an established Permanent Handle is limited to the duration of the communicative session.

13. SECURE COMMUNICATION SYSTEM, in accordance with claim 1, characterized in that it covers an identifier permanently stored in the physical memory of each transponder, dynamically generated by the transponder at runtime, such that the identifier is unique and allows unambiguous identification of the transponder, which identifier is called the UTID (unique transponder identifier) and, in principle, can be implemented using any binary code, and it can be assumed without limitation that the UTID in the transponders is represented by a 64-bit binary number.

SAFE COMMUNICATION SYSTEM according to claim 1, characterized in that it covers a group identifier, called GID, permanently stored in the physical memory of the transponders, with the following semantics: any two transponders belonging to the same group use as GID the same binary code and same cryptographic key (s) to establish the secure context of a temporary communicative session, for the purpose of transponder authentication by the interrogator, the transponder's mutual authorization of the transponder for access control, and protection of communication between them through cryptographic mechanisms, and conversely, if two transponders have different group identifiers, they belong to different groups and use different cryptographic keys to establish the secure context of the temporary communicative session.

SECURE COMMUNICATION SYSTEM according to claim 14, characterized in that, to prevent unambiguous transponder identification through the GID, and thus to protect the identity confidentiality of individual transponders, the number of transponders belonging to it group should be significantly larger than number one.

SAFE COMMUNICATION SYSTEM according to claim 15, characterized in that, as a general non-limiting reference, it can be assumed that the GID is represented by a 24-bit binary number.

Secure communication system according to claim 1, characterized in that, for cryptographic access control mechanisms, transponders may have one or more individual cryptographic keys; that is, an individual key associated with the UTID, or sharing the same cryptographic keys with other members of the same group; that is, an individual key associated with the GID.

SAFE COMMUNICATION SYSTEM according to claim 17, characterized in that, as a general non-limiting reference, transponders of the same group may be assumed; that is, with the same GID, will use the same AK key to establish the secure communicative context, which optionally includes the generation of a temporary SK session key, and perform implicit mutual authentication with implicit identification and reading of the transponder data, for example. Mutual Aut Read command, and that each transponder uses an individual key called RK for read access control and another individual key called WK for data write access control.

A secure communication system according to claim 18, characterized in that, without limitation of generality, the following formal notation is used to indicate that the AK key is determined by the GID and the keys RK and WK are determined according to the transponder UTID: AK = AK (GID), RK = RK (£ / 77 £>) or RK = SK (MSK, S), depending on the parameter value Mutual Auth Read command GSK, and WK = WK (UTID), respectively, with secret key MSK = MSK (G / D) and seed S variable per session.

SAFE COMMUNICATION SYSTEM according to claim 19, characterized in that, alternatively, the keys RK and WK can also be determined as a function of the GID value.

Secure communication system according to claim 18, characterized in that it covers the dynamic generation of secret keys RK and WK, using information exchanged as part of establishing the secure context of the temporary session as time-varying seed, and using one or more indexed master keys shared between transponder and interrogator, where in this case the maximum time span of the dynamically generated keys is restricted to the limited duration of the corresponding communicative session.

A secure communication system according to claim 1, characterized in that the encryption of a plaintext block B using a secret encryption key K and resulting in a ciphertext block C is referred to as C = EK (B); The reverse operation, decrypting a ciphertext block C using a decryption secret key K, obtaining the original plaintext block B, is called B = DK (C). EK (BI, B ₂ , B _n ), denominating the encryption of n text words Bi, B ₂ , B _n , without defining an order, compression, specific logical combination of words in the encryption process, similarly, D _K (Ci, C ₂ , C _n ) refers to the decryption of n text words Ci, C ₂ , C _N , without defining an order, compression, word-specific logical combination, in the decryption process.

SECURE COMMUNICATION SYSTEM according to claim 22, characterized in that the dynamic generation of a time-varying SK (session key) secret key for a restricted duration session between interrogator and transponder can be performed via operation SK = SK (MSK, S) = E _MS K (S), using a time-varying seed S, for example, a random number, and an MSK secret master session key shared between interrogator and transponder.

SAFE COMMUNICATION SYSTEM according to claim 1, characterized in that without general limitation the generic Handle and CRC parameters will be included in the command and response signatures, where the Handle parameter is used for the identification of recipients. and the CRC parameter represents a cyclic redundancy check, for error detection in message transmission.

SAFE COMMUNICATION SYSTEM according to claim 1, characterized in that it allows the use of the mechanism for generating and verifying arbitrary error detection codes, and in order to maintain compatibility with the ISO 18000-6C protocol, it is recommended to apply Code CRC-16 in the version specified by the International Telegraph and Telephone Consultative Committee (CCITT).

SECURE COMMUNICATION SYSTEM according to claim 1, characterized in that the dynamic data encryption mechanism is performed in a first form by including two time-varying parameters (nonces) in the encryptions and data decryption, one being generated by the interrogator and the other by the transponder, during the mutual authentication and transponder identification phase of each new session.

27 secure communication system according to claim 26, characterized by the fact that, as non - limiting reference of generality, be considered 64-bit nonces in binary representation resulting in a range of 2 ⁰⁴ possible states each, together resulting in 2 possible states, thus ensuring that, in practice, binary representations of the encryption result of texts containing one or both nonces as a result of any of the observed encryptions are incongruent, even if the original texts were equal.

SECURE COMMUNICATION SYSTEM according to claim 26, characterized in that, in a second form for performing dynamic encryption, after a coordinated initialization step between transponder and interrogator, by operating the symmetric cipher of the cryptographic machine in a mode that generates, in a well-defined manner, a time-varying sequence of data to be combined in some way with the original or encrypted data, and this second form may be used in combination with the first form. described, or separately.

SECURE COMMUNICATION SYSTEM according to claim 1, characterized in that, without limitation of generality, to perform dynamic encryption in a particular operating mode, CBC (Cipher Block Chaining) and CTR ( Counter), as specified by NIST, or any other comparable operating mode.

Secure communication system according to claim 18, characterized in that the purpose of using dynamic encryption in combination with nonces generated by the interrogator and the transponder is to protect confidentiality. (confidentiality), timeliness, uniqueness, and integrity of messages and data to be transmitted via the air interface, which in themselves do not allow effective access control.

SAFE COMMUNICATION SYSTEM according to claim 1, characterized in that it covers the use of more advanced standardized symmetric algorithms and, as a general non-limiting reference, the use of the Advanced Encryption Standard (AES) algorithm is adopted. 128-block-size symmetric keys and processing blocks, and if it is necessary to encrypt multiple data blocks that form a logical unit, the cryptographic algorithm preferably operates in a mode that allows chaining of the individual blocks as performed. CBC mode and CTR mode (regarding the sequence of single counters required for the correct decryption of encrypted data, ideally in combination with complementary mechanisms to protect the integrity of this data), ensuring detection of unauthorized alteration or substitution of encrypted data exchanged between the interrogator and the transponder, whereas in the case of the The use of the AES algorithm provides for, without limitation, the use of CTR operating mode and, where not defined otherwise, for encryption of individual blocks, the use of the basic ECB {Electronic Code Book) operating mode. .

SECURE COMMUNICATION SYSTEM according to claim 31, characterized in that by combining an interrogator nonce and a transponder nonce with the ECB mode encrypted data and for generating all initial counters For CTR mode of the cryptographic machine, the dynamic encryption engine will continue to work without degrading quality of service and without significantly reducing the level of security, even at in which case the random number generator used in either entity is experiencing intentional and unintended transient failures.

A secure communication system according to claim 1, characterized in that it provides for a CTR mode initialization mechanism of a cryptographic machine on the interrogator and transponder as part of a communicative session, where, without limitation of the generality , an operation with keys and blocks of u bits is assumed, being u an even number, the interrogator first sends the custom command Init CryptoEngine, which contains as main parameter a unique {noncé) value of u / 2 bits generated by the interrogator, called CTR R; the transponder responds with a message containing as its main parameter another unique value of u / 2 bits generated by the transponder, called CTR T, and, concatenating the two unique values, is given a value of u bits that can be used as initial counter Co for the AES algorithm CTR mode implemented by the transponder cryptographic machine; Without limitation of generality, in the case of the standardized AES algorithm, the value of u can have one of 128, 192, or 256 bits, respectively.

SAFE COMMUNICATION SYSTEM according to claim 33, characterized in that it covers the cases in which the initialization of the CTR mode of operation of the cryptographic machine on the interrogator and the transponder is performed in alternative ways and, without limiting the generality, the values Random CTR R and CTR T can, for example, be entered as additional parameters in other commands that are part of the present secure communication system.

SAFE COMMUNICATION SYSTEM according to claim 1, characterized in that it provides for a second initialization mechanism of the CTR mode of operation of the cryptographic machine in the interrogator and transponder, in which the initial counter halves called CRN and CTN are exchanged implicitly, as part of the custom implicit mutual authentication command.

SAFE COMMUNICATION SYSTEM according to claim 35, characterized in that the application of other cryptographic algorithms for operating modes other than CTR is subject to the requirement of different cryptographic machine initialization mechanisms and the application of such mechanisms is covered. by secure communication system.

SAFE COMMUNICATION SYSTEM according to claim 1, characterized in that it provides a mechanism that allows the interrogator to obtain a permanent handle from a transponder immediately after singularization, where the permanent handle, or simply the handle, allows the interrogator maintain prolonged interactions with multiple transponders in parallel.

SAFE COMMUNICATION SYSTEM according to claim 37, characterized in that the interrogator sends the custom command Req Handle, with the parameters Old Handle and CRC, to the transponder, and the transponder responds with a message containing the detector code. of CRC errors and the new Permanent Handle, called the New Handle, the interrogator accepts the New Handle as the new Permanent Handle for future transponder interactions as part of a communicative session to be established with the transponder.

SAFE COMMUNICATION SYSTEM according to claim 37, characterized in that with the establishment of the

Permanent handle, the internal state of the transponder changes to a new state outside the original state set as defined by ISO 18000-6C, causing insensitivity of the internal state and the transponder behavior to subsequent conflicting inventory commands from the original protocol, which is an essential feature for a parallelized interaction of an interrogator with multiple transponders.

40. SAFE COMMUNICATION SYSTEM according to claim 37, characterized in that, without limitation of generality, the interrogator generally establishes the permanent Handle shortly after successfully distinguishing a transponder; ie shortly after receiving the first temporary reference RN 16 and information from the transponder UII memory area in response to sending the ACK message to it as part of the inventory procedure as specified in the ISO 18000-6C protocol; therefore, on the first call of the Req Handle command after transponder singularization, the interrogator should use the temporary reference value RN 16 as the value of the OldJHfandle parameter to establish a permanent handle.

SAFE COMMUNICATION SYSTEM according to claim 1, characterized in that it provides a session initiation mechanism between an interrogator and a transponder, wherein the transponder informs the interrogator of its group identifier (GID), and establishes a context. secure the temporary communicative session, as preparation for the subsequent step of mutual authentication and transponder identification by the interrogator.

SAFE COMMUNICATION SYSTEM according to claim 41, characterized in that the session initialization can be performed after the transponder singularization and after the establishment of a valid permanent Handle by means of a dedicated custom command, where in a first session initiation mechanism between an interrogator and a transponder, the interrogator sends the custom Init Session command with the Handle and CRC parameters to the transponder, and the transponder responds with a message that contains the Handle, the GID, a unique nontransparent (TN) value, a single countertransponent nonce (CTN) value, and the CRC error detector code.

SAFE COMMUNICATION SYSTEM according to claim 41, characterized in that a second alternative mechanism passes the transponder GID, TN and CTN parameters to the interrogator to form the response of each transponder in the inventory phase, so that the The response with UII memory data includes the GID and the dynamically generated TN-CTN single values during runtime or calculated in advance.

SAFE COMMUNICATION SYSTEM according to claim 43, characterized by the fact that the inventory according to the ISO 18000-6C protocol, with the transponder response - obtained according to the second alternative mechanism -, select, in the first three steps, the messages predicted by the ISO 18000-6C protocol during transponder detection and singularization and, in the fourth step, shows the inclusion of the additional GID, TN and CTN parameters in the transponder final response, where, to maintain ISO compliance 18000-6C, TN and CTN memory areas can be logically mapped to the memory area of the UII memory bank.

SAFE COMMUNICATION SYSTEM according to claim 41, characterized in that the advantage of the second mechanism over the first is a significant reduction in the communication overhead, since, as indispensable data is passed through during inventory , there is no need for another message exchange, that is, an interrogator command and a transponder response.

SAFE COMMUNICATION SYSTEM according to claim 41, characterized in that the inventory according to the ISO 18000-6C protocol with the transponder response - obtained as a third alternative mechanism - in the fourth step only the invariable parameter GID is included in the final transponder response, and the time variable values TN and CTN are generated by the transponder and forwarded to the interrogator as part of the authentication and identification phase as described in the Mutual Auth Read command.

SAFE COMMUNICATION SYSTEM according to claim 46, characterized in that the third mechanism allows the memory area of the GID parameter to be logically or physically mapped to the memory area of the UH memory bank, and eliminates the need to generate a new real-time single value or have a pre-calculated single value available during inventory.

SAFE COMMUNICATION SYSTEM according to claim 46, characterized in that, as a result, an essential advantage of the third mechanism is to enable the transponder to meet defined constraints of allowable response times as part of the specified inventory process. 18000-6C, which in particular significantly facilitates the possible implementation of mechanisms in passive transponders, which generally require for the generation of pseudo-random cryptographic numbers significantly longer than expected by ISO 18000 -6C for transponder responses to commands that are part of the inventory phase.

49. SAFE COMMUNICATION SYSTEM according to claim 46, characterized in that, as a non-limiting reference to generality, the availability of the third party is mechanism for initiating the communicative session between the interrogator and the transponder, with GID value information as part of the inventory, and with the generation and information of nonces TN and CTN as part of the authentication and identification phase of the transponder.

SECURE COMMUNICATION SYSTEM according to claim 1, characterized in that prior to each new communicative session between the interrogator and the transponder involving the transfer of encrypted data, the interrogator and the transponder determine and share two new parameters. time variables: TN and RN, in a well-defined manner, or generate values derived from the unique values established prior to the current communicative session, in which case both the interrogator and the transponder must establish the same new values for TN. and RN.

SAFE COMMUNICATION SYSTEM according to claim 1, characterized in that, as a non-limiting generality reference, Next Nonce is a bi-function function N < _m -> N _<m which unambiguously generates a new derived value n 'of a known value n: n' = Next Nonce (n), with N _<m being the multitude of natural numbers less than a maximum number m and including zero, and thus, without limitation of generality, Interrogators and transponders are supposed to implement the same Next Nonce function to generate nonces TN and RN derivatives as needed, as follows: TN = Next Nonce (TN) and RN = Next Nonce (RN).

SAFE COMMUNICATION SYSTEM according to claim 51, characterized in that, without limitation of generality, an example for the Next_Nonce function is "increment by 1 (module m)": n '= Next Nonce (n) = n + 1 (module m), with m = 2 ⁶⁴ in case of 64 bit nonces in size.

A secure communication system according to claim 1, characterized in that it provides for an alternative mechanism for establishing a new unique value pair between the interrogator and the transponder, where the interrogator sends in a first step a new value. unique to the transponder by implicitly requesting a new unique transponder value, which responds with a new unique value, and in this example, and without limitation of generality, was assigned the name Set RN TN to the interrogator custom command.

SECURE COMMUNICATION SYSTEM according to claim 53, characterized in that, alternatively, nonces RN and TN can be encrypted prior to transmission using a secret key shared between transponder and interrogator.

SECURE COMMUNICATION SYSTEM according to claim 53, characterized in that other purposes of changing nonces TN and RN, in each new custom command exchange and response in the current session between the interrogator and transponder, and prior to the beginning (a) protect the timeliness and uniqueness of messages by checking the TN and RN values included in incoming messages, both interrogator and transponder, and can unambiguously determine whether the message is being current or whether it is of a repetition of an old message; (b) protect the confidentiality of information included in messages by increasing the original text with nonces TN and RN before encryption, which results in a different ciphertext, even if the initial text is identical, before two encryptions at a time. In particular, prior to the initialization and availability of operating modes of the cryptographic machine with automatic output varying, the use of nonces in the manner described necessary for the protection of confidentiality, such as, for example, in the case of using ECB mode, and, (c) protecting the integrity of information included in messages by increasing the original text with nonces TN, RN, or both nonces before text encryption, which results in a known part of the original text that serves as a reference for validating future encryption of the ciphertext, taking advantage of the feature that, using an advanced cryptographic algorithm such as AES, a change of at least one bit in the ciphertext results in practice, when changing each individual bit of deciphered text with a probability of approximately 50% compared to the original text.

SAFE COMMUNICATION SYSTEM according to claim 55, characterized in that, without limitation of generality, by inserting in the original text a known nonce, for example 64 bits in size, the probability of detecting an alteration of the ciphertext roughly correspond to the value l- (1/2) ⁶⁴ which, in practice, allows detection of all occurrences of bit changes.

SAFE COMMUNICATION SYSTEM according to claim 55, characterized in that, in particular, the combination of a known nonce with an unknown data to the recipient in the same original text is necessary for the protection and verification of the integrity of the encrypted text against changes in the use of ECB and CTR operating modes, as well as in any operating mode of cryptographic algorithms that do not allow verification of the integrity of encrypted (unknown) data as part of the decryption process.

A secure communication system according to claim 1, characterized in that it provides for a mechanism for implicit mutual authentication with transponder identification by the which, among other essential purposes, is intended, in the context of a communicative session, to prove the authenticity of the transponder to the interrogator, and to provide for the transponder's early transmission of data requested by the interrogator, after encapsulation by a cryptographic envelope, appropriate, to authenticate the interrogator indirectly and implicitly without receiving an immediate response from the interrogator to the challenge provided by the transponder, thereby implicitly restricting access to unique numbers and a fixed set of additional identifying data provided by the transponder to authentic interrogators. .

SECURE COMMUNICATION SYSTEM according to claim 58, characterized in that the resulting mechanism protects the confidentiality, integrity, and timeliness of transponder identifying information in transmission through dynamic encryption to prevent unauthorized third parties. can identify and track the transponder.

60. SAFE COMMUNICATION SYSTEM according to claim 58, characterized in that the mechanism also ensures that only an authentic interrogator can open the cryptographic envelope by protecting the data provided in advance by the transponder, and for an unauthentic interrogator, The cryptographic envelope only contains one data set in binary, unrecognizable form as a result of the applied cryptographic mechanism.

61. SECURE COMMUNICATION SYSTEM according to claim 58, characterized in that implicit mutual authentication becomes explicit for the transponder, knowing the interrogator's authenticity, from the moment the (authentic) interrogator sends a command access memory to the transponder, with the read or write data, containing the correct response to the initial transponder challenge.

62. SECURE COMMUNICATION SYSTEM according to claim 58, characterized in that the implicit mutual authentication between an interrogator and a transponder, based on the Mutual Auth Read command, allows the transponder to be determined first and, implicitly, the authenticity of the transponder. interrogator by means of a challenge-response scheme, in combination with dynamic encryption, with an implicit reading of transponder identifying data protected by a cryptographic envelope.

A secure communication system according to claim 58, characterized in that, having knowledge of the GID group identifier and the permanent transponder handle, the interrogator sends to the transponder the custom command Mutual Auth Read with authentication challenge and first half of the seed for cryptographic machine initialization, in preparation for the encryption mechanisms for the ongoing communicative session; the transponder processes the interrogator command, and prepares the response with two essential components, where the first component is represented by an ECB mode encrypted data packet, and, without limitation, containing the transponder challenge to the interrogator and, the second half of the seed for initializing the cryptographic machine to cipher block chained CTR operating mode (by means of a specific sequence of counters used in the encryption).

A secure communication system according to claim 58, characterized in that the second component is composed of a sequence of encrypted and chained blocks in CTR mode and, without limitation generally, upon initialization of its cryptographic machine by the seed halves as the basis of the initial counter, using both the interrogator and the trarisponder challenges, with internal reference in the first encrypted block, for validating the decryption, and optionally generating a temporary secret key for the current session, using both TN and RN challenges together as seed in combination with a shared secret master key.

SECURE COMMUNICATION SYSTEM according to claim 58, characterized in that an unauthentic transponder is unaware of the necessary shared secret keys that guarantee data protection, keys associated with the reported GID, or the standard secret key. session key or master secret key required to generate the session temporary key, and thus cannot obtain the challenge and half of the interrogator seed, and cannot generate the CTR mode transponder data envelope with the challenge from the inserted interrogator as a reference and correct answer to the challenge.

66. SECURE COMMUNICATION SYSTEM according to claim 58, characterized in that an unauthentic reader is unaware of the shared secret keys associated with the known GID, and cannot decrypt in half the transponder seed in ECB mode. , and consequently, can not decipher in CTR mode the envelope with the confidential data of the transponder.

67. SAFE COMMUNICATION SYSTEM according to claim 58, characterized in that, additionally, the non-authenticated interrogator cannot decrypt the challenge of the ECB mode encrypted transponder.

68. SAFE COMMUNICATION SYSTEM, in accordance with claim 58, characterized in that an unauthentic interrogator is unable to provide the CTR-mode encrypted challenge response on subsequent transponder access attempts through the custom Secure Auth Read and Secure Auth Write commands, as is in practice guaranteed failed authentication and authorization of these requests by the transponder.

A secure communication system according to claim 58, characterized in that the basic procedure of the implicit mutual authentication mechanism with reading transponder identifier data is performed by the Mutual Auth Read custom command.

SECURE COMMUNICATION SYSTEM according to claim 58, characterized in that, in a first step, the interrogator obtains the standard symmetric authentication key of the current transponder, AK = AK (GID), using the GID as a reference, generates the unique reader nonce (RN) and counter reader nonce (CRN) numbers that serve as challenge and seed, respectively, from the interrogator to the transponder, concatenates the nonces with the three parameters SMD, DMD, and GSK, and computes in ECB mode the ciphertext E _AK (RN, CRN, SMD, DMD, GSK), and sends the Mutual Auth Read command with the prepared parameters, and the other parameters to the transponder.

SAFE COMMUNICATION SYSTEM according to Claim 70, characterized in that the Static Message Authentication Code Descriptor (SMD) parameter represents an indicator for the optional inclusion of a Static Message Authentication SMAC (Static Message Authentication) integrity and authenticity protection code. Pre-computed over the concatenated UTID and TDATA data and permanently recorded in the non-volatile memory of the transponder, in the response of the transponder.

SECURE COMMUNICATION SYSTEM according to claim 71, characterized in that, without limitation, the preferred implementation of the static authenticity code is the CMAC mechanism, with 128-bit Message Authentication Codé (MAC) code generation. of size.

A secure communication system according to claim 70, characterized in that the Dynamic Message Authentication Code Descriptor (DMD) parameter represents an indicator for the optional inclusion of a Dynamic Message Authentication Protection (DMAC) integrity code. Authentication Code) in the transponder response, and which must be computed at runtime on a selection of the other response data elements, including nonces RN and TN, and additionally UTID and TDATA data in original text or in the form of ciphertext.

A secure communication system according to claim 72, characterized in that, without limitation, the preferred implementation of the dynamic authentication code is the CMAC mechanism, with 64-bit message authentication code (MAC) generation. of size.

SAFE COMMUNICATION SYSTEM according to claim 70, characterized in that in the second step the transponder obtains the interrogator's E _AK (RN, CRN, SMD, DMD, GSK), decrypts the response using the symmetric key. secret AK, computes D _AK (E _AK (RN, CRN, SMD, DMD, GSK)), keeps the RN challenge, half of the interrogator's initial CRN counter, and the SMD, DMD, and GSK parameters, and continues execution of the third step of implicit mutual authentication.

SAFE COMMUNICATION SYSTEM according to claim 70, characterized in that in the third step: the transponder generates the unique numbers TN (transponder nonce) and CRN {counter transponder nonce), which serve as challenge and seed, respectively, from the transponder to the interrogator; concatenates these nonces and computes the ciphertext E _AK (TN, CTN) in ECB mode of the AES cryptographic machine; get the UTID (Unique Transponder IDentifier) and TD ATA {Transponder Data) data from memory, if indicated by the SMD parameter received from the interrogator; get from memory the static authenticity and integrity code SMAC, pre-calculated on the UTID and TDATA data, or set the value of SMAC to the empty word string; calculates a CRC-16 error detector code, called DCRC, on the data RN, TN, UTID, DATA, obtaining DCRC = CRC-16 (RN, TN, UTID, TDATA); initializes the CTR operating mode of the internal cryptographic machine itself using as initial counter the CTN value concatenated with CRN; encrypts with the AES cryptographic machine in CTR mode the text composed of the values RN, TN, UTID, TDATA, DCRC, and SMAC, using the secret key SK, with SK obtained as indicated by the GSK parameter received from the interrogator; that is, by reading a standard or time-generated session key from memory using a session master key obtained from memory in combination with a seed represented by the set of values RN and TN, thus obtaining E _SK (RN, TN , UTID, TDATA, DCRC, SMAC), if indicated by the DMD parameter received from the interrogator; generate the DMAC dynamic integrity and authenticity code on the RN, TN, UTID, TDATA data, or set the DMAC value to the empty word string e; returns the set of values obtained in response with the other parameters to the interrogator.

77. SAFE COMMUNICATION SYSTEM according to claim 70, characterized in that in the fourth step: the interrogator obtains the answer from the transponder; first decrypts the transponder TN and CTN data using the secret symmetric key AK, calculating D _AK (E _AK (TN, CTN)) initializes the CTR operating mode of the internal cryptographic machine itself using as initial counter the CTN value concatenated with the CRN value known; get the secret session key SK as indicated by the GSK parameter, or get the default session key from the current transponder, SK = SK (GZD), using the GID as a reference, or generate the session key using the session master key Transponder MSK, using GID as reference, MSK = MSK (G / D), in combination with the seed represented by the set of known values RN and TN; Decrypts the ciphertext E _SK (RN, TN, UTID, TDATA, DCRC, SMAC); checks whether the RN and TN values contained in the deciphered text are identical to locally kept copies; recalculates and checks the DMAC code if it is not represented by the zero length word as indicated by the DMD parameter; recalculates and checks the SMAC code if not represented by the zero length word as indicated by the SMD parameter; recalculates and checks the DCRC code and; if all checks are successful, the transponder authentication is considered successful, and the interrogator extracts the UTID identifier and TDATA data from the decrypted text and completes the implicit mutual authentication, considering the transponder to be authentic; If the transponder authentication fails, the interrogator considers the transponder to be unauthentic and handles the failure accordingly.

78. A secure communication system according to claim 70, characterized in that, without limitation of generality, the address of the part of the memory to be returned by the The transponder, represented by the UITD, TDATA data, and optionally the additional SMAC value, can be specified by a variable parameter to be included in the interrogator custom command rather than using a predefined addressing.

SAFE COMMUNICATION SYSTEM according to claim 70, characterized in that, without limitation, DMAC data can be calculated over other data sets, including larger data sets, and with the individual data being in original text or encrypted, with the sole requirement that the DMAC code unambiguously allow the interrogator to verify the integrity of the RN, TN, UTID, and TDATA data.

80. SAFE COMMUNICATION SYSTEM according to claim 1, characterized in that it provides a mechanism for secure reading with request authentication, and among other essential purposes of this mechanism are enabling the interrogator to read a quantity. set of transponder persistent or volatile memory data; verifying the authenticity and authorization of the interrogator read request through a transponder challenge-response mechanism, and protecting the integrity, uniqueness, timeliness, and confidentiality of data transmitted via the air interface by dynamic encryption; CRC error detection codes, and optionally message authentication code (MAC) integrity and authenticity cryptographic codes, including a memory area descriptor to be read and data to be returned by the transponder, with the to prevent unauthorized third parties from manipulating or obtaining knowledge of data stored or generated by the transponder once such third parties have broken all communication and data storage described to the present described level.

SECURITY COMMUNICATION SYSTEM according to claim 80, characterized in that the authenticated read between interrogator and transponder is based on the Secure Auth Read command, where, in a first step: the interrogator obtains the symmetric read authorization key from the current transponder, RK = RK (Í / 77), using UTID as a reference, updates the local copies of the current session nonces, TN = Next Nonce (TN) and RN = Next Nonce (RN), and; calculates, with the AES cryptographic machine in CTR mode, the E _RK ciphertext (TN, RN, LMAR, LCRC, DMD), with LMAR being a descriptor of the logical memory area range to be read, LCRC being a CRC-type errors computed over the LMAR parameter, and DMD being an indicator for the optional inclusion of a dynamic DMAC integrity and authenticity protection code in the response to be computed by the runtime transponder over the main data elements of the response and ; sends the Secure Auth Read command, with the parameters entered to the transponder.

SECURE COMMUNICATION SYSTEM according to claim 80, characterized in that, as a general non-limiting reference, following the ISO 18000-6C standard, the LMAR logical memory area range descriptor can be defined by concatenating the fields specified in the ISO 18000-6C protocol: MemBank, WordPtr, and WordCount, and LMAR must meet the requirements of the ISO 18000-6C protocol for correct memory addressing.

83. SAFE COMMUNICATION SYSTEM according to claim 80, characterized in that, as another non-limiting generality reference, the memory area range descriptor LMAR logic can be represented by a more complex data structure incorporating additional parameters including the LCRC and DMD parameters and others, and in the case of the request-authentication secure write mechanism, one or more CRC-16 integrity protection codes. or another protecting the data to be written in the memory range defined by LMAR.

SAFE COMMUNICATION SYSTEM according to claim 80, characterized in that in the second step: The transponder updates the local copies of the nonces of the current session, TN = Next Nonce (TN) and RN = Next Nonce (RN); decrypts the ciphertext received from the interrogator using the read-authentication secret symmetric key RK; calculates D _RK (E _RK (TN, RN, LMAR, LCRC, DMD)) with the AES cryptographic machine in CTR mode, and; checks whether the values contained in the deciphered text TN and RN are identical to local copies and that the LCRC code is correct, and; if so, the interrogator's authentication and authorization is considered successful, and the transponder continues execution of the third read and authenticated step; otherwise, the interrogator is considered unauthorized to read data from the transponder memory, and the transponder suspends the communicative session with the interrogator or otherwise treats the failure.

SAFE COMMUNICATION SYSTEM according to claim 80, characterized in that in the third step: the transponder obtains the requested RDATA data from the memory area specified in the LMAR parameter; computes a CRC error detector code on the RN, TN, and RDATA value set; encrypts in CTR mode the text composed of the values TN, RN, RDATA and RCRC, resulting in the ciphertext E _RK (TN, RN, RDATA, RCRC); generates the DMAC dynamic integrity and authenticity code on the RN, TN, and RD ATA or sets the DMAC value to the zero-length empty word (iempty word string) as indicated by the received DMD parameter, and returns the final results obtained in the response, with the other parameters, to the interrogator.

SAFE COMMUNICATION SYSTEM according to claim 80, characterized in that in the fourth step the interrogator: decrypts in CTR mode the ERK encrypted text (TN, RN, RD AT A, RCRC) of the transponder using the key symmetric secret RK; calculate DRK (ERK (TN, RN, RDATA, RCRC)) and; checks whether the values contained in the decrypted text TN and RN are identical to locally kept copies; recalculates and checks the RCRC code; if identical, the returned RDATA data is considered authentic, accurate, and current, and the interrogator considers the reading successful; If the nonces TN and RN are not congruent with the local values, or if the RCRC code verification fails, the interrogator considers the reading to be irregular and continues processing accordingly.

SAFE COMMUNICATION SYSTEM according to claim 80, characterized in that the specification of the transponder reaction to the interrogator authorization failure, and vice versa, the interrogator reaction to the authenticity and timeliness verification failure returned by the transponder, may vary according to the needs of the particular application, without influencing the basic operation of the authenticated read engine.

A secure communication system according to claim 80, characterized in that, without limitation, DMAC data can be calculated over other data sets, including larger data sets, and with individual data being in plain text or encrypted, with the only requirement that the DMAC code unambiguously allows the interrogator to verify the integrity of the RN, TN, and RD ATA data.

89. SECURE COMMUNICATION SYSTEM according to claim 80, characterized in that key management alternatives constitute, without limitation, that the RK key is dynamically generated by the interrogator and the transponder, or replaced by the current key. SK session already established.

90. SECURE COMMUNICATION SYSTEM according to claim 80, characterized in that by performing a new authentication on each new read command with the TN and RN session nonces changed by the Next Nonce function, it is ensured that a session hijacking is not practicable as each read access is allowed individually.

SAFE COMMUNICATION SYSTEM according to claim 1, characterized in that it provides a mechanism for secure writing with request authentication which, among other essential purposes of this mechanism, includes enabling the interrogator to write defined amount of data to memory persistent or volatile transponder; verifying the authenticity and authorization of the interrogator's written request by means of a challenge-response mechanism in the transponder, and protecting the integrity, uniqueness, timeliness, and confidentiality of data transmitted via the air interface by dynamic encryption, detector codes CRC errors, and optionally by message authentication code (MAC) integrity and authenticity cryptographic codes, including the descriptor of the memory area to be written, the data to be written, and the execution code of the operation returned by the transponder to prevent unauthorized third parties from manipulating or obtaining knowledge of data stored in or generated by the transponder.

SAFE COMMUNICATION SYSTEM according to claim 91, characterized in that the authenticated write between an interrogator and a transponder is based on the Secure Auth Write command, and in the first step the interrogator: obtains the symmetric key. write authorization of the current transponder, WK = WK (UTID), using UTID as a reference; updates the local copies of the current session nonces, TN = Next Nonce (TN), and RN = NextJSÍcece (RN); computes, with the AES cryptographic machine in CTR mode, the ciphertext E _W K (TN, RN, LMAR, LCRC, WDATA, WCRC, DMD), with LMAR being a descriptor of the logical memory area range to be written, LCRC being a CRC error detector code computed on the LMAR parameter, WDATA representing the data to be written, WCRC being a CRC error detector code computed on the WDATA data, and DMD being the indicator for the optional inclusion of a dynamic code of integrity and authenticity protection calculated on the main elements of the command; Inserts the DMD data a second time without encryption in the command, together with the DMAC dynamic integrity and authenticity code, either calculated over the RN, TN, LMAR, and WDATA data, or represented by the empty word string as indicated by the DMD parameter, and; sends the Secure Auth Write command, with the parameters entered to the transponder.

93. SAFE COMMUNICATION SYSTEM according to claim 92, characterized in that, without limitation of generality, the DMD parameter is included a second time as the original text before the given DMAC, so that the transponder has the ability to consider DMAC descriptor without decrypting data encrypted signals received in real time during transmission.

A secure communication system according to claim 92, characterized in that alternatively and without limitation the WCRC code may be computed over other data such as the TN, RN data set. , and WDATA, to associate the nonces values with the CRC code.

95. SAFE COMMUNICATION SYSTEM according to claim 92, characterized in that, as a general non-limiting reference, following the ISO 18000-6C standard, the LMAR logical memory area range descriptor may be defined by concatenation. from the following fields specified in the ISO 18000-6C protocol: MemBank, WordPtr, and WordCount, where LMAR must meet the requirements of the ISO 18000-6C protocol for memory mail addressing.

SECURE COMMUNICATION SYSTEM according to claim 91, characterized in that in the second step, the transponder: updates the local copies of the nonces of the current session, TN = Next Nonce (TN) and RN = Next Nonce (RN) ; decrypts in CTR mode the ciphertext received from the interrogator using the read authentication secret symmetric key WK; calculate DWK (EWK (TN, RN, LMAR, LCRC, WDATA, WCRC, DMD)); checks whether the RN and TN values contained in the deciphered text are identical to locally kept copies; recalculates and checks the DMAC code if not represented by the zero-length word confonne indicated by the decrypted DMD parameter; recalculates and checks LCRC code, recalculates and checks WCRC code; if all checks are successful, the interrogator authentication and authorization is considered successful, and the transponder continues to perform the third step of authenticated writing; otherwise the The interrogator is considered unauthorized to write data to the transponder's memory, and the transponder suspends the communicative session with the interrogator, or otherwise handles the failure.

SAFE COMMUNICATION SYSTEM according to claim 91, characterized in that in the third step the transponder: writes the WDATA data in the memory area specified in the LMAR parameter; generates an informative code of the result of the operation called WCODE; encrypts in CTR mode the text composed of the three values TN, RN, and WCODE e; returns the final result E _WK (TN, RN, WCODE) as a response with the other parameters to the interrogator.

SECURE COMMUNICATION SYSTEM according to claim 91, characterized in that in the fourth step the interrogator: decrypts in CTR mode the ciphertext E _WK (TN, RN, WCODE) of the transponder using the secret symmetric key WK; calculates D _WK (E _WK (TN, RN, WCODE) e; verifies that the values contained in the deciphered text TN and RN are identical to the locally kept copies, and, if so, the WCODE code is considered to be authentic, complete and current; interrogator considers writing according to the particular semantics defined by the WCODE code, otherwise if the nonces TN and RN are not congruent with local values, the interrogator considers the reading to be irregular and continues its processing accordingly, treating the situation as a proper way.

99. SAFE COMMUNICATION SYSTEM according to claim 91, characterized in that the specification of the transponder reaction to the interrogator authorization failure and, vice versa, the interrogator reaction to the authenticity and timeliness verification failure The data returned by the transponder may vary according to the needs of the particular application without influencing the basic operation of the transponder. authenticated reading engine.

100. SAFE COMMUNICATION SYSTEM according to claim 91, characterized in that for the generation of WCODE in the transponder, a CRC-16 code may be generated on the contents of the newly written memory area. .

SECURITY COMMUNICATION SYSTEM according to claim 91, characterized in that the key management alternatives constitute, without limitation, the dynamic generation of the WK key by the interrogator and the transponder, or their replacement by the current key. SK session already established.

SECURE COMMUNICATION SYSTEM according to claim 91, characterized in that by performing

Re-authenticating each new write command with the TN and RN session nonces changed via the Next Nonce function, is guaranteed that a session hijacking is not practicable as each write access is individually authorized.

SAFE COMMUNICATION SYSTEM according to claim 1, characterized in that it provides for extended state machine transponders where, from the original states of the ISO 18000-6C protocol, the states Open, Secured, and Killed have been disabled. All transitions associated with these states have also been deleted, and as a general non-limiting reference, new states and transitions have been introduced into the transponder state machine for new interrogator commands and corresponding transponder responses: WAITING, MAR -PROC, MAR-READY, UTHENTICIA TED, SAR-PROC, SAR-READY, SAW-PROC, and SAW-READY, and these new states are assumed by each transponder under the following conditions and under the following conditions: WAITING ("waiting "), where the transponder immediately switches to this state if and only if one of the following conditions is met: (a) the transponder is currently in ACKNOWLEDGED state, and has completed sending a response on receipt of a Req Handle command from a free transmission. MSW errors; (b) the transponder is currently in WAITING and has completed sending a response regarding receipt of a repeat of the previous RSU Req Handle command; (c) the transponder is currently in WAITING and has completed submitting a response regarding error-free receipt of a new request from the valid RSU Permanent Handle Req Handle command; (d) the transponder is currently in MAR-PROC state and has completed receiving error free and executing the interrogator's Finalize command with the FEOP flag set; MAR-PROC ("mutual authentication processing"), and the transponder immediately switches to this state if one of the following conditions is met: (a) the transponder is currently in WAITING state, and has completed sending auxiliary response to error free receipt of an interrogator Mutual Auth Read command; (b) the transponder is currently in MAR-PROC state and has completed the auxiliary response sending regarding error-free receipt of a direct retransmission of the interrogator Mutual Auth Read command that has already been received by the transponder in previous transmission; MAR-READY, ("mutual authentication ready"), and the transponder immediately switches to this state if one of the following conditions is met: (a) the transponder is currently in the MAR-PROC state, completed the Mutual Auth Read command internal processing, including the necessary decryption and internal data encryption operations, has successfully prepared the secure envelope with encrypted transponder, and is ready to return the return message of the implicit mutual authentication to the interrogator; (b) the transponder is currently in MAR-READY state and has completed auxiliary response sending to an error-free direct relay of the last interrogator Mutual Auth Read command that has already been processed by the transponder; AUTHENTICATED ("authenticated"), where a transponder immediately switches to this state, if one of the following conditions is met: (a) the transponder is currently in the MAR-READY state, has received the interrogator's Finalize command and has met the error-free command sending the return to the Mutual Auth Read command to the interrogator; (b) the transponder is currently in AUTHENTICATED state and has completed responding to an error-free direct relay of the interrogator's previously processed Finalize command; (c) the transponder is currently in SAR-PROC state and completed receiving error free and executing the interrogator's Finalize command with the FEOP flag set; (d) the transponder is currently in SAR-READY state, received the error-free Finalize command from the interrogator, and completed sending the response to the Secure Auth Read command to the interrogator; (e) the transponder is currently in SAW-PROC state and completed receiving error free and executing the interrogator's Finalize command with the FEOP flag set; (f) the transponder is currently in SAW-READY state, has received the interrogator's Finalize command error-free, and completed by sending a reply to the Secure Auth Write command to the interrogator; SAR-PROC (secure-authenticated-read processing), and the transponder immediately switches to this state if one of the following conditions is met: (a) the transponder is currently in AUTHENTICATED state and has completed sending auxiliary response regarding free receipt of. mistakes the Secure Auth Read command of the interrogator; (b) the transponder is currently in SAR-PROC state and has completed sending an auxiliary response regarding error-free receipt of a direct relay of the interrogator's Secure Auth Read command that was already received by the transponder in previous transmission; SAR-READY (secure-authenticated-read ready), and the transponder immediately switches to this state if one of the following conditions is met: (a) the transponder is currently in SAR-PROC state and has completed internal processing of the last Secure Auth Read command received, including the necessary internal data decryption and encryption operations, has successfully authenticated and authorized the interrogator in the process, and is ready to send back the processed Secure Auth Read command to the interrogator; (b) the transponder is currently in SAR-READY state and has completed the auxiliary response submission regarding error-free receipt of a direct retransmission of the last interrogator Secure Auth Read command that has already been processed by the transponder; SAW-PROC ("secure-authenticated-write processing"), and the transponder immediately switches to this state if one of the following conditions is met: (a) the transponder is currently in AUTHENTICATED state and has completed sending auxiliary response for error free receipt of the interrogator's Secure Auth Write command; (b) the transponder is currently in SAW-PROC state and has completed the auxiliary response sending regarding error-free receiving of a direct retransmission of the Integrator Secure Auth Command that was already received by the transponder in previous transmission; SAW-READY ("secure-authenticated-write ready"), with the transponder immediately changing to this state if one of the following conditions is met: (a) the transponder is currently in SAW-PROC state and has completed internal processing of the last Secure Auth Vrite command received, including the necessary internal data decryption and encryption operations, authenticated and has successfully authorized the interrogator in the process, and is ready to send the return message to the processed Secure Auth Write command to the interrogator; (b) the transponder is currently in SAW-READY state and has completed the auxiliary response send regarding error-free receipt of a direct relay of the last Secure Auth Vrite command from the interrogator that has already been processed by the transponder.

104. SAFE COMMUNICATION SYSTEM according to claim 103, characterized in that, without limitation of generality, the transponder may implement additional transitions, such as for the initial READY state, as desired in exceptional situations, including: ( a) the transponder receives a Select command; (b) the transponder receives a Query, QueryRep, or QueryAdjust command; (c) the transponder receives an unexpected custom command and, outside the standard command flow, skips required states and / or transitions; (d) the transponder has reset or power-up due to power loss or other transient failure that has resulted in loss of internal transponder status information.

SAFE COMMUNICATION SYSTEM according to claim 104, characterized in that, without limitation, conceivable alternative embodiments may, for example, merge the two SAR-PROC and SAR-READY states into one state if the Two-phase custom command execution mechanism is not implemented, or unnecessary execution; for example because of a secure communication system implementation on an advanced hardware transponder, which allows a transponder response without significant delay and within defined protocol and application limits, and the same observation may apply to both SAW-P OC and SAW-READY, and MAR-PROC and MAR-READY.

SAFE COMMUNICATION SYSTEM according to claim 1, characterized in that it provides for a two-phase command execution mechanism by means of auxiliary messages, which will be applied to the message pairs composed of an interrogator command and a corresponding response. addressed transponder whose first essential purpose is to enable transponders to send a first confirmatory response to assist primary commands that need cryptographic processing with an internal processing time on the transponder of the order of milliseconds to tens of milliseconds or more, where this quality enables interrogators to detect transmission and processing errors that would result in non-execution of the main custom command within a short, well-defined time interval. Specifically, without limitation in general terms, the mechanism allows, according to ISO 18000-6C, that the transponder may continue to respond to the custom interrogator command at time Ti, and the interrogator can detect timeout response T3 .

SAFE COMMUNICATION SYSTEM according to claim 106, characterized in that another purpose of the mechanism is to leave the interrogator in control of interaction with the transponder and, after the supposed termination of processing of the primary custom command in the transponder, after At time, the interrogator requests, by means of an auxiliary custom command called Finally, the transmission of the transponder primary response and thus the execution of the main custom command is divided into two distinct phases: the first acknowledgment phase, and the second finalization phase of the main command execution.

SECURE COMMUNICATION SYSTEM according to claim 106, characterized in that, in this execution of the two-phase main command, the interrogator takes advantage of the time interval At, during which the transponder is busy processing the request. primary, to process other tasks or communicate with other transponders, reducing waiting time and increasing the interrogator's operational efficiency.

109. SAFE COMMUNICATION SYSTEM according to claim 106, characterized in that the two-stage execution mechanism benefits from the execution of any command-response pair between interrogator and transponder involving prolonged processing on the transponder and, in In particular, this mechanism applies to custom commands that involve using transponder encryption: Mutual Auth Read, Secure Auth Read, and Secure Auth Write.

SAFE COMMUNICATION SYSTEM according to claim 106, characterized in that, as a general non-limiting reference, to enable the interrogator to more accurately estimate At time, information about the performance or processing time of the Transponders can be kept in a database and the interrogator can access this information using one of the GID, UTID, and SPC values received from the transponder as an access key.

111. SAFE COMMUNICATION SYSTEM according to claim 106, characterized in that, alternatively, a variation of the auxiliary response is the inclusion of an optional parameter - EPTI - for the indication of the expected processing time indicator, EPTI can, without limitation, provide an index of the relative processing performance of the transponder, such as the number of bits the transponder can encrypt or decrypt per millisecond, and an indication of read and write performance in nonvolatile memory, such as, without limitation, 16 bit word write (rewrite) time in EEPROM or Flash memory or internal Transponder FeRAM (or other), allowing the interrogator to calculate the time required for cryptographic operations and memory access on the transponder, or EPTI can also provide the absolute estimate of processing time required, considering type and load. of the request received from the interrogator, and generally knowledge of EPTI enables the interrogator to estimate the waiting time required. With greater accuracy than not having this information.

SAFE COMMUNICATION SYSTEM according to claim 106, characterized in that, alternatively, without limitation, the expected processing reference times by command and transponder type and implementation can be managed in the form of tables kept in interrogators by mapping transponder model version numbers and implemented protocol version numbers to absolute or relative processing performance values. In this case, it is assumed that a transponder implementation model number and a protocol version number implemented by the transponder are included in the UII memory bank, the contents of which will be read by the interrogator during the inventory phase.

113. SAFE COMMUNICATION SYSTEM according to claim 106, characterized in that a variation of the Auxiliary custom command is the inclusion of an optional parameter, denoted FEOP, to force the force end of processing into the transponder when it has not yet finished internal processing at the time of receiving the Finalize command, and without limiting the In general, FEOP can be performed using a binary flag {binary flag; boolean flag) that receives the values "1" or "enabled" to force end processing and "0" or "disabled" to allow further processing on the transponder.

SAFE COMMUNICATION SYSTEM according to claim 106, characterized in that, without limitation in the two-phase command execution mechanism, the reaction of the transponder to a Finalize command, with or without FEOP enabled, depends on needs and boundary conditions of the particular application, so, for example, a transponder that has not completed local processing can respond to a Finalize command with FEOP disabled, by means of an error message warning that processing has not been completed, and stop processing. execution of the command, or return dedicated response requesting more time to execute the interrogator and continue processing, or ignore the command. Without limiting the generality, specifying the interrogator's treatment of the transponder's inability to send a response to the primary command to a Finalize command may depend on the particular application, and the interrogator may, for example, extend the wait time and send a new one. Finalize command to get the answer, or simply abandon the interaction unilaterally.

115. SAFE COMMUNICATION SYSTEM according to claim 106, characterized in that it covers all variations of the two-stage execution mechanism which have purposes and advantages. compatible, including mechanisms involving different number of auxiliary messages and / or different parameters, with a possible compatible variation being that the transponder does not send an auxiliary acknowledgment, and the interrogator directly sends the Finalize command after a certain timeout.

SAFE COMMUNICATION SYSTEM according to claim 106, characterized in that in another compatible variation the Finalize command is eliminated and instead of letting the transponder respond after a defined time interval, for example, and without limitation of the generality, that this be deduced by the interrogator and the transponder, by the known amount of data that the transponder will have to process internally.

SAFE COMMUNICATION SYSTEM according to claim 1, characterized in that it provides an interleaved command execution mechanism for the interaction between an interrogator and multiple transponders, which, among others, has as its essential purpose to enable partial processing parallelism. of transponder interrogator commands to reduce the total execution time compared to a sequential execution of message pairs composed of an interrogator command and a corresponding response from the addressed transponder.

A secure communication system according to claim 117, characterized in that the interleaved execution mechanism executes two-phase commands for the benefit of any command-response pair sequence between an interrogator and a transponder involving prolonged processing. in the transponder, in the order of magnitude from milliseconds to tens of milliseconds or more, and in particular the mechanism applies to sequences of custom commands involving the use of transponder encryption: Mutual Auth Read, Secure Auth Read, and Secure Auth Write.

119. SAFE COMMUNICATION SYSTEM according to claim 117, characterized in that, without limitation of generality, the generic principle of the interleaved execution mechanism can be divided into three stages, the first stage of sending the primary commands; the second stage of the interrogator's wait, and the third stage of collecting the primary responses, and in the first stage, using the two-phase execution scheme, the interrogator sends the next due primary command PCi (session) communicative, and receives an immediate auxiliary response AR ₍ helper reply) from each Tj transponder of a set of M Ti to TM transponders with which the interrogator is holding communicative sessions; In the second stage, the interrogator waits for completion of the Ti transponder processing, and, without limitation of generality, if the maximum command processing time is of the order of milliseconds for all transponders, given by t _pr0 c, then the RSU should wait for at least t _wait = t _proc - (M1) x (t _req + t _con f) ≥ milliseconds after receiving ARj for PCi processing on the Ti transponder to be terminated, with t _req representing the upper bound for transmitting a single primary command PCi, with t _con f representing the upper limit for receiving a single auxiliary response ARj from the transponder, and M specifying the total number of transponders to be processed, the transmission time being determined by factors. including data transfer rates for uplink and downlink, maximum allowable tolerances and message datagram sizes, and if via all M PQ commands, with 1 <i <M, is longer than time Transponder Ti internal processing, then t _w = 0 and the interrogator can continue to the next stage without delay, and in the third and last stage, the interrogator sends the Finalize auxiliary ACj commands to request and receive the transmissions from PRi primary responses of the transponders Tj, 1 <i <M, where in case the receiving time of the primary responses in the third stage is less than the sending time of the primary commands in the first stage, the interrogator may be subject to waiting times. additional.

SECURE COMMUNICATION SYSTEM according to claim 11, characterized in that, without limitation, the interleaved execution mechanism follows a simplified model for parallel implicit mutual authentication of multiple Ti, 1 <i <M , from the interrogator's point of view, where: (1) send requests and receive auxiliary acknowledgments of implicit mutual authentication: for all Tj with 1 <i <M, executed in sequence: (i) send to T _Í : Mutual Auth Read { Handlei, κ (- ..), CRC); (ii) receive T _i: {Reply Handlei, CRC); (2) expect availability of first primary response: waits for t _w milliseconds with: t _w = Max (0; t _proc - (M1) x (t _req +)) ≥ 0, t _req = GetTransmissionTime {Mutual Auth Read {Handlei , E _K (...), CRC)), t _conf = GetTransmissionTime {Reply {Handlei, CRC)); (3) request and collect primary mutual authentication responses: for every Tj with 1 <i <M, executed in sequence: (i) send to T _Í : Finalize (Handlei, CRC); (ii) receive from T ^: Reply (Handlei, E _K (...), CRC); (iii) if (i <M): wait At milliseconds, with: At = Max (0; t _req + _nf - t _fm - t _rsp )>0; t _fin = GetTransmissionTime {Finalize {Handlei, ···, CRC)); t _rsp = GetTransmissionTime {Reply {Handlei, E _K (...), CRC)).

121. SAFE COMMUNICATION SYSTEM, in accordance with claim 117, characterized in that the exemplified GetTransmissionTime constitutes an abstract auxiliary mechanism for determining the transmission time of messages to be sent via the air interface.

SAFE COMMUNICATION SYSTEM according to claim 117, characterized in that the interleaved execution mechanism covers the execution of any homogeneous or heterogeneous set of commands to be executed on transponders.

SAFE COMMUNICATION SYSTEM according to claim 117, characterized in that the interleaved execution mechanism is not limited to a particular sequence of command transmission per stage, but covers the optimization and change of the sequence in consideration of the transmission time and processing of each command and response to avoid or reduce the interrogator's wait time.

SAFE COMMUNICATION SYSTEM according to claim 117, characterized in that it covers any and all variations of the interleaved command execution mechanism having compatible purposes and advantages, including mechanisms involving auxiliary messages and / or distinct parameters, such as , for example, a compatible variation where, in the first stage, the transponder only sends PQ primary commands without receiving ARi auxiliary acknowledgments.

SECURITY COMMUNICATION SYSTEM according to claim 1, characterized in that it covers modifications of custom command signatures to allow multiple key generations per key type, such as multiple authentication key generations, read and write access , and, for example, and without limitation of In general, the identification of the key generation to be used can be performed by means of an additional parameter in the affected commands that indicates the key generation to be used.

SECURE COMMUNICATION SYSTEM according to claim 125, characterized in that it covers modifications of the customized commands of the present secure communication system to allow the use of one or multiple master keys, the use of a key grants certain well-defined rights to the interrogator, either directly or indirectly through the generation of a temporary secret key, including, but not limited to, exclusive, read or write access to the special or general areas of transponder memory; authorization of the use of special functionality and specific transponder commands; temporarily or permanently enabling or disabling read and / or write access to transponder memory areas, including modifying the internal status of these transponder memory areas from "read and write allowed" to "read only", and vice versa, and full and permanent disabling of {KM) transponders.

SAFE COMMUNICATION SYSTEM according to claim 125, characterized in that it covers, in coordination with interrogators, transponders that alter or replace nonces TN and RN received in custom commands before generating the corresponding responses, rather than reusing the ones. nonces TN and RN of custom commands received without change.

SAFE COMMUNICATION SYSTEM according to claim 125, characterized in that it covers nonces substitution or increase with other variable values for times chosen in a range sufficient to guarantee an insignificant probability of repetition of the values used as nonces in messages in practice, as needed by the particular application.

A secure communication system according to claim 125, characterized in that it covers the use of arbitrary cryptographic algorithms for the cryptographic operations of the custom commands defined by this system.

SAFE COMMUNICATION SYSTEM according to claim 125, characterized in that it covers changes in the nomenclature of commands, responses and parameters in command and response signatures, without essentially modifying the functionality and purposes of commands or responses or parameters affected.

SAFE COMMUNICATION SYSTEM according to claim 125, characterized in that it covers modifications of the composition of custom command parameters and transponder responses, without essential modification of the functionality and purposes of commands and responses and where parameters may be modified. , for example, and without limitation of the generality, be combined by reversible logic operations, such as with the XOR operation, to reduce the total bit size of the composite data set for the purpose of reducing transmission time, or number and time of cryptographic operations required.

SAFE COMMUNICATION SYSTEM according to claim 125, characterized in that it covers modifications of the parameter sizes in number of command and response bits and, in particular, modifications due to the use of different block sizes than that of 128 bits, reference algorithm, or modifications due to the use of cryptographic algorithms other than the AES reference, and nonces with varying bit lengths.

SAFE COMMUNICATION SYSTEM according to claim 125, characterized in that it covers custom commands optimized for specific data block sizes, including variations of custom read / write access commands for transponders that support standard size data blocks. , and / or preset memory addresses when writing data.

SAFE COMMUNICATION SYSTEM according to claim 125, characterized in that it covers the use of arbitrary number of bits for custom command parameters and corresponding responses.

SAFE COMMUNICATION SYSTEM according to claim 125, characterized in that it covers cryptographic machines implemented in interrogators and / or transponders that use operating modes other than CTR mode to ensure protection of the integrity of encrypted data of arbitrary size.

SAFE COMMUNICATION SYSTEM according to claim 125, characterized in that it covers descriptions of the constituent parts of the system focusing on the specification and description of the main parameters of interrogator commands and transponder responses, without limiting generality and without excluding the possibility of including additional parameters in command and response signatures for other purposes that do not interfere or compromise the main purposes of these commands and responses.

SAFE COMMUNICATION SYSTEM according to claim 125, characterized in that it covers variations in the specification of commands and responses, objects of the present secure communication system, in relation to the different ways of handling exceptions and failures in processing and transmitting commands and responses.

SAFE COMMUNICATION SYSTEM according to claim 125, characterized in that it covers secure and authenticated versions of the native Lock and Kill commands, implemented according to the Secure Authenticated Write command model, defining a new custom command with a new sequence. bits as specified in the ISO 18000-6C protocol, replacing the data parameters to be written from the Secure Authenticated Write command with necessary parameters of the respective operation, for example, and without limitation obtaining Secure Auth Kill custom commands and Secure Auth Lock, and replacing the write result code of the Secure Authenticated Write response with an appropriate result code of the new operation, and where the Access command becomes unnecessary after deactivating the other commands and modifying the state machine .

SAFE COMMUNICATION SYSTEM according to claim 125, characterized in that it covers altered definitions of the LMAR logical memory range descriptor, including definitions that are different from the memory addressing mode defined in ISO 18000-6C but whose adoption is permissible by said nonna in custom commands, which can be changed, for example, and without limitation of generality, the LMAR component size values, or an entirely different addressing scheme, such as an LBA ( Linear Block Addressing) or other.

140. SAFE COMMUNICATION SYSTEM according to claim 1, characterized in that it covers, in addition to those described and without limitation of other possible variations of custom commands that represent representations of the present secure communication system (including, but not limited to, custom commands Mutual Auth Read, Secure Auth Read, and Secure Auth Vrite), so that some, or all , command parameters are entered in plaintext rather than encrypted form for applications that allow for a reduced level of security protection in favor of improved processing performance on the transponder.

SAFE COMMUNICATION SYSTEM according to claim 140, characterized in that in a variation of the Mutual Auth Read custom command and the corresponding response, which constitutes an embodiment of the present secure communication system, the exchange of auxiliary parameters RN, CRN, SMD, DMD, TN, and CTN are performed without cryptographic envelope protection.

SECURE COMMUNICATION SYSTEM according to claim 140, characterized in that it covers, in addition to those described and without limitation of other possible ones, variations of the custom commands that represent representations of the present secure communication system, including, in particular, without limitation. In general, Mutual Auth Read, Secure Auth Read, and Secure Auth Write - custom commands, as command parameters are changed, or added, to perform different behaviors from interrogator commands and corresponding transponder responses.

143. SECURE COMMUNICATION SYSTEM according to claim 142, characterized in that, as a non-limiting reference to the generality of the present secure communication system, the use of additional parameters is assumed to effect the inclusion of static authenticity codes. , pre-calculated and stored in the memory of the transponder, or dynamic, generated by the transponder at runtime (also meaning in real time) in the transponder response.

144. SECURE COMMUNICATION SYSTEM according to claim 142, characterized in that another non-limiting reference is the inclusion of an additional parameter in the custom command for generating one or more temporary keys for encrypting data with validity restricted the length of the communication session between the transponder and an interrogator.

SAFE COMMUNICATION SYSTEM according to claim 142, characterized in that another non-limiting reference is the inclusion of an additional parameter in the custom command for indexing one or more secret keys, or one or more, secret master keys for generating one or more session keys.

SECURITY COMMUNICATION SYSTEM according to claim 142, characterized in that it covers, in addition to those described and without limitation of any other possible, variations of the customized commands that represent representations of the present secure communication system, including, without limitation, Mutual Auth Read, Secure Auth Read, and Secure Auth Write custom commands, such that one or more parameters explicitly reserved for future use are entered in the corresponding command and / or response.

SAFE COMMUNICATION SYSTEM according to claim 142, characterized in that, as a non-limiting reference to the generality of the present secure communication system, the use of an RFFU parameter of at least one bit in size is assumed. with a well-defined default value.

148. SAFE COMMUNICATION SYSTEM, in accordance with claim 147, wherein, without limitation, the default value is represented by a sequence of bits greater than or equal to 1 bit, with the most significant bit (MSB) being bit Ό 'to indicate the non-use of the parameter and non-consideration of it by the container.

SAFE COMMUNICATION SYSTEM according to claim 147, characterized in that the use of such RFFU type parameters in commands and responses allows the extension of functionality in the implementation of the secure communication system in interrogating and reading equipment in the form that ensures full backward compatibility with previous commands and responses.

SAFE COMMUNICATION SYSTEM according to claim 147, characterized in that, additionally and without limitation of generality, the value of the parameter RFFU, which indicates the presence of new functionality, is discriminated by a sequence of N bits in size. greater than or equal to 1 bit, with the most significant bit (MSB) being bit 'Γ, to indicate the use of the parameter in the function of a new command and / or response characteristic to be evaluated by the recipient.

SAFE COMMUNICATION SYSTEM according to claim 147, characterized in that, in case the size of the RFFU parameter is greater than 1 bit, the nature of the new function will be discriminated by the sequence of the least significant Nl bits of the RFFU parameter, allowing switching between up to 2 ^{N 1} new varied features.

152. SECURE COMMUNICATION SYSTEM according to claim 147, characterized in that, without limitation of the In general, the size of the RFFU parameter in the case of MSB being represented by the T bit may have a well-defined size which is larger than the size of the RFFU parameter in the case of MSB being equal to the bit value Ό 'to maintain the message size containing the minimum possible size RFFU parameter, to improve message transmission efficiency over the air interface, while also reducing the likelihood of transmission error, which increases with each additional message size bit.

SECURE COMMUNICATION SYSTEM according to claim 147, characterized in that, in a variation of the Mutual Auth Read custom command, which constitutes an embodiment of the present secure communication system, in which a new RFFU parameter has been inserted into the command. and in the corresponding answer.

SECURITY COMMUNICATION SYSTEM according to claim 147, characterized in that it covers, in addition to those described and without limitation of possible others, variations of the mechanisms for initiating the communicative session, which constitute other non-limiting representations of the present communication system. secure, including, but not limited to, mechanisms such that some or all of the parameters of commands and their responses are protected by encryption using secret keys shared between interrogator and transponder.

154. SECURE COMMUNICATION SYSTEM according to claim 153, characterized in that it uses asymmetric cryptographic algorithms to protect the confidentiality, integrity, authenticity, uniqueness, and timeliness of data and messages.

155. SAFE COMMUNICATION SYSTEM, in accordance with claim 153, characterized in that, as a non-limiting generality reference, it is assumed that in transponders having the technical capability to perform asymmetric runtime encryption, an asymmetric algorithm for data encryption and decryption will be used; for exchanging temporary secret session keys; for use in symmetric encryption algorithms; for the protection of data to be transmitted over the air interface; for the generation of data authenticity and integrity codes, and for the generation of digital signatures on exchanged data and messages for the purpose of approving non repudiatiori of sent / received data and messages.

SECURITY COMMUNICATION SYSTEM according to claim 155, characterized in that in another non-limiting reference to the generality of the present secure communication system is the insertion of a dynamic digital signature code into the secure communication mechanisms Mutual_Auth_Read, Secure Auth Read, and Secure Auth Write, and the various variations thereof, calculated by the transponder, in real time, on the transponder data and protocol data, replacing or supplementing any dynamic DMAC integrity and authenticity protection code used, replacing or completing any static SMAC integrity and authenticity protection code used, and replacing or completing any CRC type dynamic data integrity protection code used.

SECURITY COMMUNICATION SYSTEM according to claim 156, characterized in that as a non-limiting reference to the generality of the present secure communication system for the generation of digital signatures or asymmetric codes of authenticity and integrity using a public and private key scheme, the use of asymmetric elliptic curve cryptography (ECC) algorithms is assumed to allow efficient implementations on resource-limited transponders, compared to using the RSA mechanism that requires secret keys and significantly larger block sizes, or using asymmetric algorithms with comparable or smaller key size, block size, and computational complexity. compared to asymmetric ECC algorithms.

SAFE COMMUNICATION SYSTEM according to claim 157, characterized in that the Open state of the transponder remains existing, and is not deleted from the transponder state machine, with the Req RN command remaining valid (not disabled), and the Reqjtíandle custom command being executed after the first execution of the Req RN command, in the inventory phase with the transponder being in Open state.

SAFE COMMUNICATION SYSTEM according to claim 158, characterized in that the Req Handle custom command contains one or more additional parameters for changing the internal state of the transponder.

SECURITY COMMUNICATION SYSTEM according to claim 159, characterized in that as a non-limiting reference to the generality of the present secure communication system, such changes include changing the state values of the S0, SI, S2 session flags. , and S3, and the selected flag SL, as defined by nonna ISO 18000-6C, as well as the introduction and use of new internal state parameters in transponders.

161. SECURE COMMUNICATION SYSTEM according to claim 160, characterized in that as another non-limiting reference to the generality of the present secure communication system, such change includes the insertion of an additional parameter to reset of the transponder, in conditional form, by evaluating a logical condition as a function of the internal state of the transponder, or unconditional.

SAFE COMMUNICATION SYSTEM according to claim 161, characterized in that the transponder response to the custom Req Handle command containing one or more additional parameters for transponder internal state information to the reader.

SECURE COMMUNICATION SYSTEM according to claim 162, characterized in that, as a non-limiting reference to the generality of the present secure communication system, such information includes the session state flags values S0, SI, S2, and S3, and the selected flag SL, as defined by ISO 18000-6C, and the values of other internal transponder parameters, including additional internal state parameters re-entered.

SECURITY COMMUNICATION SYSTEM according to claim 162, characterized in that, in another non-limiting embodiment, the extended state transponder machine consists of variations of state transitions such that the transponder does not respond to command requests. while processing one of the Mutual _Auth_Read, Secure Auth Read, and Secure Auth Write complex custom commands, which require extended processing time on the OBU and a high level of power or power in this process, whereas no consideration of new reader while processing these commands Customized complexes in certain cases significantly improve the robustness of secure communication system implementation in passive transponder devices (which do not have their own power supply).

SECURE COMMUNICATION SYSTEM according to claim 164, characterized in that in another non-limiting embodiment of the present secure communication system a message transmission counter is used in the custom commands sent by the interrogator and in the responses. returned by the transponder for the purpose of more efficient retransmission identification, and for flow control and message delivery order in variations of the secure communication system that allow multiple commands and / or multiple responses to be sent and temporarily stored for retransmission.

166. SAFE COMMUNICATION SYSTEM according to claim 165, characterized in that as a non-limiting reference to the generality of the present secure communication system, such message transmission identifiers include cyclic numerical counters with binary representation of one or more sizes. more bits.

167. SAFE COMMUNICATION SYSTEM according to claim 166, characterized in that, as a non-limiting reference, the numeric counter can be a 2-bit counter with the increment function "plus a module 2 ² ", resulting in the sequence of values 0, 1, 2, and 3 per counter cycle.

Secure communication system according to claim 165, characterized in that, as a non-limiting reference, the non-numeric message identifier may use two or more differentiated values, such as a tray (lg) with values A and B.

SECURE COMMUNICATION SYSTEM according to claim 1, characterized in that another non-limiting embodiment of the present secure communication system is the exchange of use of encryption mode with command message pair decryption mode and response, respectively, with the goal of enabling secure transponder communication system implementations in the form that only the transponder encryption mode is required to reduce implementation complexity and power consumption in transponder operation, as well as how to improve processing time performance on the resource-limited transponder compared to the reader device.

SECURE COMMUNICATION SYSTEM according to claim 169, characterized in that the encryption operation (CIPH) can be given by the decryption function (DEC), and the reverse decryption operation (CIPH ¹ ) by the encryption function (ENC). ), in the case of symmetric ciphers such as AES and DES, where encryption and decryption features are interchangeable to achieve data encryption and decryption.

SECURITY COMMUNICATION SYSTEM according to claim 170, characterized in that as a non-limiting reference to the generality of the present secure communication system, the use of the symmetric cryptographic algorithm AES is assumed - as well as any other symmetric cryptographic algorithm. such as DES, TDES, Blowfish, or IDEA, without limitation in generality, in ECB operating mode by the reader in decryption function (DEC) to encrypt (CIPH) the original data (plaintexi), being CIPH = DEC, so that the transponder later decipher (CIPH ¹ ) the ciphertext obtained (ciphertext) by applying the symmetric AES cryptographic algorithm in operational mode ECB in the reverse encryption function (ENC), being CIPH ^ HENC, to retrieve the original text using the same shared symmetric secret key or generated synchronously between transponder and interrogator.

SECURITY COMMUNICATION SYSTEM according to claim 171, characterized in that in another non-limiting embodiment of the present secure communication system the variation of encryption secret keys in corresponding commands and responses of the same communicative session between interrogator and transponder, and without limitation generally, such secret key variations include the periodic generation of new time-variable seed-based session secret keys, such as non-limiting, the use of nonces used in the messages of each new command-response pair, and the use of multiple secret keys to encrypt different data blocks in the same command or response message.

Secure communication system according to claim 171, characterized in that a non-limiting embodiment of the implicit mutual authentication between an interrogator and a transponder, reading transponder identifying data protected by a cryptographic envelope, using as an example non-limiting, nonces RN, TN, CTN, 64-bit long and CRN56, 56-bit long, the ECB operating mode of the AES-128 cryptographic machine with the 128-bit AK secret key, in the form that CIPH = ENC, and CIPH ^ DEC to protect the confidentiality and integrity of the RN and CRN56 protocol parameters on the command and TN and CTN on the corresponding response, and using the 128-bit SK secret key AES-128 cryptographic machine CTR mode to protect the confidentiality and integrity of 64-bit UTID vehicular data, and 64-bit TDATA and static integrity and authenticity protection SMAC code contained in the response, with SMAC being pre-calculated on UTID and TDATA data and previously stored in memory during transponder customization, size and type defined by the SMD2 parameter, with the DCRC dynamic error detection code, type CRC-16, being calculated over the vehicle data and the SMAC code at run time by the transponder, and with the DCRC parameter in the error response. transponder being combined with the least significant 16 bits of the TN parameter by the XOR (or exclusive) operation, and a dynamic DMAC integrity and authenticity protection code of the size and type defined by the DMD2 parameter, and calculated at run time, transponder over the CTR mode encrypted data blocks contained in the reply message, and using the 64-bit CTN and 56-bit CRN56 parameters to initialize the contact r of CTR mode, and with the command message containing non-limiting examples of additional parameters, the 2-bit RFFU2 parameter reserved for future use and not encrypted, SMD2 being a 2-bit descriptor parameter of the SMAC code, DMD2 being a 2-bit descriptor parameter of the DMAC code, GSKl being a 1-bit descriptor parameter, defining the mechanism for obtaining the transponder SK session temporary secret key, being performed by the bit value O 'in binary notation of the GSKl parameter, without limitation, the use of a predefined session default secret key, and, by the bit value T of the GSKl parameter, the use of a default master key, to generate, at runtime, a new temporary session secret key SK , in this process of dynamic SK key generation using nonces RN and TN, or other combination of time-varying parameters as seed, and RFFUP3 being a 3-bit parameter, reserved for future use, encrypted, and being RFFU2 and RFFUP3 non-limiting examples of parameters intended for the safe future introduction of new command functionality without changing the basic structure of the current command to maintain backwards compatibility. {backward compatibility) and interoperability of implementations of different versions of the secure engine in transponders and interrogators.

A secure communication system according to claim 171, characterized in that in another non-limiting embodiment of the implicit mutual authentication between an interrogator and a transponder, reading transponder identifying data protected by a cryptographic envelope, uses, as a non-limiting example, nonces RN, TN, CTN, 64-bit size and CRN56, 56-bit size, the ECB operating mode of the AES-128 cryptographic machine with 128-bit AK and SK secret keys in the form CIPH = ENC, with CIPH- ^ DEC, in all cases to protect the confidentiality and integrity of the protocol parameters RN and CRN56 in the command and CTN in their two occurrences, and RN and TN in the corresponding response, and the dynamic code. Error detection DCRC, type CRC-16, calculated at runtime by the transponder over 64-bit UTID and TDATA vehicular data and the SMAC code contained in the response a, with the DCRC parameter being combined with the least significant 16 bits of the TN parameter by XOR (or exclusive) operation, and using the AES-128 encryption machine's CTR encryption mode as a SK secret key to protect confidentiality and integrity. UTID and TDATA vehicular data and SMAC static code for integrity and authenticity in response, with SMAC being pre-calculated on UTID and TDATA, and previously stored in memory during transponder customization, with SMAC size and type defined by SMD2 parameter, DCRC dynamic error detection code, type CRC-16, being calculated over vehicular data and over code SMAC, at run time, by the transponder, with the DCRC parameter in the transponder response being combined with the least significant 16 bits of the TN parameter, by XOR (or unique) operation, and a dynamic DMAC integrity and authenticity protection code type and size defined by the DMD2 parameter and calculated at runtime by the transponder over the CTR mode encrypted data blocks with the SK secret key and the ECB mode SK secret key encrypted data blocks contained in the response, and using the 64-bit CTN and 56-bit CRN56 parameters to initialize the CTR mode start counter, and with the command message containing non-limiting examples additional parameters, where RFFU2 is a 2-bit parameter reserved for future use and not encrypted, SMD2 being a 2-bit descriptor parameter of the SMAC code, DMD2 being a 2-bit descriptor parameter of the DMAC code, MKS3 being a 3-bit descriptor parameter for selecting the default session key or master key to be used for SK session secret key generation, with MKS3 without general limitation indexing a total of 2 ³ = 8 keys or master keys with indexes 0 to 7, these keys being pre-written to the transponder memory during customization, GSK1 being a 1-bit descriptor parameter that defines the mechanism for obtaining the transponder session temporary secret key by the bit value, ' , in binary notation of GSK1 parameter, without limitation of generality, the use of a session default secret key indexed by parameter MKS3, and stored in by the bit value of the GSK1 parameter, the use of that secret master key stored in the transponder and indexed by the MKS3 parameter for the generation, at run time, of a temporary SK session secret key, and in this generation process key dynamics using the nonces RN and TN, or other combination of time-variable parameters with the seed, and the RFFU2 parameter being a non-limiting example for a parameter intended for the future introduction of new features to the command, no change to the basic structure of the current command to maintain backward compatibility and interoperability of implementations of different versions of the secure engine in transponders and interrogators.

SECURITY COMMUNICATION SYSTEM according to claim 171, characterized in that in another non-limiting embodiment of the implicit mutual authentication between an interrogator and a transponder, reading transponder identifying data protected by a cryptographic envelope using non-limiting example, nonces RN, TN, IRN and ITN, 64-bit in size, the ECB operating mode of the AES-128 cryptographic machine with the 128-bit AK secret key in the form CIPH = ENC, with CIPFf = DEC, to protect the confidentiality and integrity of protocol parameters from RN and IRN protocol parameters in the command, and TN and ITN in the corresponding response, a dynamic 64-bit DMAC integrity and authenticity protection code in the command, and without limitation of In general, the DMAC is calculated at runtime by the reader on the block of data RN and ITN encrypted in ECB mode on the command using, as an example non-limiting, a secret key and a DMAC format and size determined in real time by the reader against the known transponder GID group identifier, and the mode CBC with the 128-bit SK secret key to protect the confidentiality and integrity of nonces TN and RN from the vehicle identification number, which, without limitation on generality, may be represented by ehicle identification number (VIN) as per international standard 128-bit ISO 3779 and 16-bit CRRC-16 dynamic error detection DCDC code calculated over the VIN at run time by the transponder with the DCRC parameter in the response and combined with the Least significant 16 bits of the TN parameter by the XOR (or exclusive) operation and using the 64-bit ERN and ITN parameter set as the machine's CBC mode initialization vector (IV) AES-128 encryption.

A secure communication system according to claim 171, characterized in that in another non-limiting embodiment of the implicit mutual authentication between an interrogator and a transponder, reading transponder identifying data protected by a cryptographic envelope using , as a non-limiting example, nonces RN, TN, ERN, and ITN, 64-bit in size, the ECB operating mode of the AES-128 cryptographic machine with the 128-bit AK secret key in the decryption function for data encryption in the form CEPH = DEC, with CIPH ^ ENC, to protect the confidentiality and integrity of the RN and IRN protocol parameters in the command, the form CD? H = DEC, allowing transponder decryption of data encrypted by the interrogator. ECB mode in the encryption function, then CIPH ^ ENC, removing the need for additional implementation of decryption mode in favor of single-mode encryption. the transponder, allowing, without limitation of the generality, in certain cases of cryptographic machine implementation, the reduction of the algorithm implementation chip area encryption and power consumption in the operation of the algorithm on passive transponders, and using the ECB operating mode of the AES-128 cryptographic machine with the 128-bit AK secret key in the encryption function for CIPHHENC data encryption with CIPH ^" ^{1 =} DEC, to protect the confidentiality and integrity of the parameters and TN and ITN in the response, using the CBC mode of the symmetric cryptographic algorithm encryption with the 128-bit SK secret key, to protect the confidentiality and integrity of nonces RN and TN, the vehicle identification number, which, without limitation, may be represented by the vehicle identification number (VTN) as per the international standard ISO 3779 of 128 bits, and the 64-bit SMAC static integrity and authenticity protection code , pre-calculated over VTN during transponder customization, with the SMAC parameter in the transponder response, and combined with the TN parameter , by the XOR (or exclusive) operation, and using the 64-bit IRN and ITN parameter set as the initialization vector (IV) for the initialization of CBC mode in the current communication session between interrogator and transponder, and using as a non-limiting example a 1 bit binary TC transmission counter in command and response messages for indicating new command and response transmissions and retransmissions, respectively, and command and response messages containing non-limiting examples of additional parameters, one non-encrypted 1-bit RFFU parameter intended for future introduction of new functionality in the engine without changing the basic command structure and corresponding response to maintain backward compatibility { backward compatibility) and interoperability of implementations of different versions of the secure transponder engine and interrogate pains.

SECURITY COMMUNICATION SYSTEM according to claim 176, characterized in that in a non-limiting embodiment of secure reading with request authentication between an interrogator and a transponder which uses nonces RN and TN as a non-limiting example in general. , 64-bit in size, a 64-bit logical memory area range descriptor to be read LMAR, the LMAR parameter in the interrogator command being combined with the RN parameter, by the XOR (or exclusive) operation, the operating mode AES-128 Cryptographic Machine Encryption ECB with 128-bit SK Session Secret Key in CIPEHENC form, with CIPH ^ DEC, to protect the confidentiality and integrity of nonces and 64-bit LMAR memory descriptor on command, and protect the confidentiality and integrity of nonces and the dynamic 64-bit integrity and authenticity protection DMAC code in the response, and the DMAC is calculated at runtime by transponder over n≥1 data blocks DWi to DW _n at 128 bits each, with the DW block _n containing a well-defined padding if the amount of data read and contained in the last block is less than block size, and the DMAC parameter in the transponder response being combined with the TN parameter by the XOR (or exclusive) operation, and using the AES-128 cryptographic machine's CTR mode to protect the confidentiality and integrity of DWi to DW data. _n read from the transponder memory in the case of successful authentication request.

A secure communication system according to claim 176, characterized in that in another non-limiting embodiment of secure reading with request authentication between an interrogator and a transponder, which uses nonces RN and nonces as a general example. 64-bit TN, a data descriptor. 64-bit LMAR logical range to be read, the LMAR parameter on the interrogator command being combined with the RN parameter by the XOR (or exclusive) operation using the AES-128 cryptographic machine keyed ECB operating mode 128-bit SK secret code in the form CIPH = ENC with CIPH ^ DEC to protect the confidentiality and integrity of the 64-bit nonces and LMAR memory descriptor in the interrogator command and using the AES-CTR mode CTR mode. 128 to 128 bit SK secret key to protect the privacy of the nonces RN and TN data DWI DW _n read from the transponder memory, and dynamic code CPCR integrity type CRC-16 of 16 bits, in response, the RCRC being calculated at runtime by the transponder over n> 1 data blocks DWi to DW _n at 128 bits each, with the DW block _n containing a well-defined padding if the amount of data read and contained in last block is smaller than size block, the RCRC parameter in the transponder response being combined with the least significant 16 bits of the TN parameter by the XOR (or exclusive) operation, and using as a non-limiting example a 1 bit binary TC transmission counter in the transmission messages. command and response to indicate new transmissions and retransmissions.

A secure communication system according to claim 176, characterized in that in another non-limiting embodiment of secure reading with request authentication between an interrogator and a transponder, which uses nonces RN and nonces as a general example. 64-bit TN, a 64-bit logical memory area range descriptor to be read LMAR, the LMAR parameter in the interrogator command being combined with the RN parameter, by the XOR (or exclusive) operation, the mode operational AES-128 Cryptographic Machine CBC with 128-bit SK Secret Key in CIPHHENC Form, with CIPH ^ DEC, to Protect the Confidentiality and Integrity of the 64-bit Nonces and LMAR Memory Descriptor in the Interrogator Command, and Protect the nonces confidentiality and integrity, the read data DWi to DW _n , and the 16-bit CRC-16 dynamic integrity code RCRC in the response, the RCRC being calculated at runtime by the transponder over the n≥ 1 data blocks DWi to DW _n at 128 bits each, with the DW block _n containing a well-defined padding, if the amount of data read and contained in the last block is smaller than the block size, the RCRC parameter in the data response. transponder being combined with the least significant 16 bits of the TN parameter by the XOR (or exclusive) operation, using in the command and response messages, as a non-limiting example of additional parameters, the 1-bit RFFU parameter, reserved for future use and not pr encrypted, and using a dynamic integrity and authenticity protection code DMAC of predefined size and type or defined by an auxiliary parameter included in the LMAR parameter, and the DMAC being calculated at run time by the transponder over the blocks of CBC mode encrypted data contained in the transponder response.

SECURE COMMUNICATION SYSTEM according to claim 176, characterized in that in another non-limiting embodiment of secure reading with request authentication between an interrogator and a transponder, which uses nonces RN and nonces as a general example. 64-bit TN, a 64-bit logical memory area interval descriptor to be read LMAR, the LMAR parameter in the interrogator command being concatenated with the TN and RN parameters, the ECB operating mode of the cryptographic machine AES-192 with 192-bit SK secret key in form CIPH = DEC, with CrPH ^{~ 1 =} ENC, to protect the confidentiality and integrity of nonces and the LMAR memory descriptor in the interrogator command, and using the CBC mode of the cryptographic machine. AES-192 with the secret key SK 192 bits as CIPH = forward with CIPH ^ DEC, to protect in response to confidentiality and integrity of nonces, data DWI DW read _n of the transponder memory and the DMAC dynamic code 64-bit integrity and authenticity protection, the DMAC being calculated at runtime by the transponder over n≥ 1 data blocks DW _t to DW _n at 192 bits each, with the DW block _n containing a well-defined padding , if the amount of data read and contained in the last block is smaller than the block size, the DMAC parameter in the transponder response being concatenated with the RN and TN parameters, and the DMAC type being predefined or defined by a parameter. auxiliary included in the the LMAR.

Secure communication system according to claim 176, characterized in that in another non-limiting embodiment of secure reading with request authentication, between an interrogator and a transponder, optimized for secure and authenticated reading of a single block of the transponder memory, containing up to 64 bits of data, using, as a non-limiting example, 64-bit nonces RN and TN, a 64-bit logical memory area range descriptor to be read for addressing up to 64 bits of data to be read from the transponder memory, the LMAR parameter in the interrogator command being concatenated with the TN and RN parameters using the ECB operating mode of the 192-bit SK secret key AES-192 cryptographic machine in the form CIPH = ENC, with dPH ^{"1 =} DEC, to protect the confidentiality and integrity of nonces TN and RN and the LMAR memory descriptor in the interrogator command, and protect the confidentiality and integrity of nonces RN and TN and the 64-bit DW64 single read data block in the reply message, the DW64 block containing a well-defined padding, if the amount of data to be read is less than 64 bits.

Secure communication system according to claim 176, characterized in that in a non-limiting embodiment of secure writing with explicit request authentication between an interrogator and a transponder, which uses nonces as a non-limiting example generally RN and TN, 64-bit in size, a logical memory area range descriptor to be written LMAR48, 48-bit, LMAR48 being concatenated with a 16-bit CRC-16 integrity integrity code WCRC, the WCRC being calculated, at run time, by the interrogator on n≥ 1 data blocks DW] to DW _n at 128 bits each, with the DW block „containing a well-defined padding, if the amount of data to be written in the latter block is smaller than the block size, and with this padding being removed by the transponder before writing the data DWi to DW _n into internal memory at the addresses specified by the LMAR48 parameter, in case of successful authentication. of the command by analyzing the validity and correctness of the TN, RN, WCRC values, and any additional integrity code contained in parameter LMAR48 by the transponder, the set of LMAR48 and WCRC parameters concatenated in the interrogator command being combined with the RN parameter , by XOR (or exclusive) operation, and using the CBC mode of the AES-128 cryptographic machine with the 128-bit WK write secret key, to protect on command the confidentiality and integrity of nonces RN and TN, parameters LMAR48 and WCRC , and n≥1 data blocks DW] to DW _n and to be written to the memory of the using the AES-128 encryption machine CBC encryption mode with the 128-bit WK write secret key to protect the confidentiality and integrity of the nonces RN and TN and the WCRC * parameter in the transponder reply message. WCRC * is a 16-bit CRC-16 dynamic integrity code, calculated by the transponder, at run time, over the actual written memory area, with the WCRC * parameter in the 16-bit transponder response combined of the TN parameter by XOR (or exclusive) operation and using as a non-limiting example a 1-bit binary TC transmission counter in command and response messages to indicate new command and response transmissions and retransmissions .

Secure communication system according to claim 182, characterized in that in another non-limiting embodiment of secure writing with explicit request authentication, between an interrogator and a transponder, which uses, as a non-limiting example of the generality, a optional 64-bit dynamic integrity and authenticity protection code DMAC, a DMD parameter being, without limitation, a 4-bit descriptor indicating the presence and type and size of the DMAC, the value being used, without limitation, '0000' of the DMD, in binary notation, to indicate the absence of the DMAC, corresponding to a zero-bit size of the DMAC, and using the remaining DMD values to describe the DMAC algorithm size and type and the key index. used by the interrogator to generate the DMAC at run time on the encrypted data blocks in CTR mode with the WK secret key and on the d WK secret key encrypted data in ECB mode contained in the command message using nonce RN and TN size, an interval descriptor of the logical memory area to be written LMAR, 64 bits, and optionally containing an additional integrity dynamic code internally, being calculated at run time by the interrogator on the n ≥ 1 memory blocks. data DWI DW _No of 128 bits each, with the DW block "containing a well defined padding, if the amount of data in the last block to be written is smaller than the block size, and this padding being removed by the transponder before write the DWi to DW _{n data} in the internal memory at the addresses specified by the LMAR parameter, in case of successful command authentication, through the transponder analysis of the validity and correctness of the DMAC, TN, and RN values, and any integrity contained in the LMAR parameter, the LMAR parameter in the interrogator command being combined with the RN parameter, by the XOR (or exclusive) operation, and using the ECB mode of the cryptographic machine. ca AES-128 with the 128-bit WK secret write key in the decryption function for encrypting data in the form CIPH = DEC, with dPH ^{"1 =} ENC, to protect the confidentiality and integrity of TN, RN, and LMAR on command, and using the AES-128 cryptographic machine's CTR mode with the 128-bit WK secret write key, to protect the confidentiality and integrity of the n≥ 1 data blocks DWj to DW _not contained in the command and intended to be written to the transponder memory upon successful request authentication and using the ECB encryption mode of the AES-128 encryption machine with the 128-bit WK secret write key in the encryption function for data encryption in the form of CIPH ^ ENC, with CIPH ^ DEC, to protect the confidentiality and integrity of nonces RN and TN and the WCRC parameter in the transponder reply message, WCRC being a 16-bit CRC-16 dynamic integrity code calculated by the transponder, at run time, over the area of memory that was actually written, and being the WCRC parameter in the transponder response combined with the least significant 16 bits of the TN parameter by the XOR (or exclusive) operation.

SECURE COMMUNICATION SYSTEM according to claim 182, characterized in that in another non-limiting embodiment of secure writing with explicit request authentication between an interrogator and a transponder, which uses nonces RN as a general non-limiting example. and 64-bit TN, a 64-bit LMAR logical memory area interval descriptor to be written, internally containing an additional 16-bit CRC-16 dynamic integrity code, which is calculated in execution time, by the interrogator about n> 1 data blocks DWi to DW _n at 192 bits each, with the DW block _n containing a well-defined padding, if the amount of data in this last block to be written is less than block size, and with this padding being removed by the transponder, before writing the data DWi to DW „into internal memory at the addresses specified by the LMAR parameter, in case of successful authentication of the block. By means of the transponder analysis of the validity and correctness of the TN, and RN values, and any additional integrity codes contained in the LMAR parameter, the LMAR parameter in the interrogator command is concatenated with the TN and RN parameters and using the ECB of AES-192 cryptographic machine with 192-bit WK secret write key in encryption function for CIPEHENC data encryption with CIPH ^ DEC to protect the confidentiality and integrity of TN, RN, and LMAR data on using the CTR mode of the AES-192 encryption machine with the 192-bit WK secret write key to protect confidentiality and integrity of n≥ 1 data blocks DWi to DW _not contained in the command and intended to be written to the transponder memory upon successful request authentication, and using the AES-192 encryption machine ECB encryption mode with the passcode secret. 192-bit WK write in the encryption function for data encryption in the form CIPH = ENC, with CEPH ^{"1 =} DEC, to protect the confidentiality and integrity of nonces RN and TN and the LMAR * parameter in the transponder reply message, being 64-bit LMAR *, the range descriptor of the logical memory area that was actually written, internally containing the additional 16-bit CRC-16 dynamic integrity code, recalculated at run time by the transponder over the content of that data area in the transponder memory that was actually written, and being the LMAR * parameter in the transponder response concatenated with the RN and TN parameters.

A secure communication system according to claim 182, characterized in that in another non-limiting embodiment of secure writing with explicit request authentication between an interrogator and a transponder optimized for the secure and authenticated writing of a block of data. transponder memory, which uses, as a general non-limiting example, 64-bit size nonce RN and TN, a 16-bit size block DW16, an interval descriptor of the logical memory area to be 48-bit LMAR48 write, LMAR48 being concatenated with the DW16 block to be written, if the command authentication succeeds, through the transponder analysis of the TN value validity and correction, and any additional integrity codes contained in the LMAR48 parameter , with the set of parameters LMAR48 and DW16 in the interrogator command being combined with the RN parameter by the XOR (or exclusive) operation, and using the AES-128 encryption machine ECB mode with the 128-bit WK secret write key in the encryption function for CIPH = ENC data encryption with CIPH ^ DEC to protect the confidentiality and integrity of TN data, RN, LMAR48, and DW16 in command, and using the AES-128 encryption machine ECB encryption mode with the 128-bit WK write secret key in the CIPHHENC data encryption function with CEPH ^ DEC, to protect the confidentiality and integrity of nonces RN and TN and parameter DW16 * in the transponder response message, DW16 * being the data block read back by the transponder of the logical memory area that was actually written, and parameter DW16 * in the transponder response combined with the least significant 16 bits of the TN parameter by the XOR (or exclusive) operation.

SECURE COMMUNICATION SYSTEM according to claim 182, characterized in that in a non-limiting embodiment of the combination, in a single command, of the functionality of authenticated secure writing and authenticated secure reading, optimized for secure reading is authenticated from a single data block RDW128 and the secure and authenticated write of a single WDW32 data block into transponder memory, which uses, as a non-limiting example, nonces RN and TN, a 64-bit size descriptor RLMAR48 48-bit logical memory range interval reader, a 48-bit WLMAR48 logical memory area slot descriptor to write, and a 32-bit WDW32 data block to be written to the memory specified by parameter WLMAR48, and using the ECB mode of the AES-256 cryptographic machine with the 256-bit secret key Kl in the encryption function for data encryption in the form. CIPH = ENC, with CIPH -DEC, to protect the Confidentiality and integrity of data TN, RN, RLMAR48, WLMAR48, and WDW32 on command, and using the AES-256 encryption machine ECB mode with 256-bit K2 write secret key in data encryption encryption function in the form CIPH = ENC, with CIPH ^ HDEC, to protect in the transponder reply message the confidentiality and integrity of nonces RN and TN, WCRC parameter, 32-bit, and 128-bit RDW128 data block read from area specified by the RLMAR48 parameter, where WCRC is a 32-bit CRC-32 dynamic integrity code calculated by the transponder at run time over the actual memory area, and the WCRC parameter in the response of transponder combined with the most significant 32 bits of the TN parameter by the XOR (or exclusive) operation.

SAFE COMMUNICATION SYSTEM according to claim 1, characterized in that, unlike the ISO 18000-6C protocol, it covers implementations on all types of transponders, including passive transponders, which receive both information and energy for the signal operation itself. RF interrogator; semi-active (or semi-passive) transponders that use their own power source for internal integrated circuit operation and only draw power from the interrogator's RF signal to return information to the interrogator by modulating an RF signal over the carrier of the interrogator, and active transponders that use their own power source for both internal circuit operation and for transmitting information to the interrogator by modulating an RF signal generated by the transponder itself.

188 SAFE COMMUNICATION SYSTEM according to claim 187, characterized in that it covers all types of interrogators and transponders that implement the ISO 18000-6C protocol, fully or in part, with full reverse compatibility, and derivatives of the ISO 18000-6C protocol, with restricted reverse compatibility.

SAFE COMMUNICATION SYSTEM according to claim 1, characterized in that it covers all application domains of the ISO 18000-6C protocol, and also covers any radio frequency identification application that benefits in any way from the mechanisms described herein. including, but not limited to, electronic registration, identification, location, and tracking, as well as protection against forgery, imitation, theft, and theft of vehicles, truck fleets, and other means and assets of transportation, as well as , cargo, animals, manufactured goods, raw materials, valuables, medicines, documents, packaging, boxes, pallets, and containers, and asset and document protection from counterfeiting, imitation, theft, and theft, replacing or complementing without limitation of generality, vehicular information stored in transponders with electronic product codes (EPC) or other data s identifiers according to process and application needs.

190. SECURE COMMUNICATION SYSTEM according to claim 1, characterized in that, without limitation of generality, the present secure communication system explicitly covers all application domains linked to radio frequency identification, tracking and authentication ( RFID), including all applications requiring one or more secure mechanisms of this secure communication system, for the secure and efficient identification and authentication of products, documents, persons, and vehicles, including the secure recording of data on transponders, with emphasis on situations in The time available for RFED identification and authentication is limited because of the mobility of the objects or persons to be tracked, or because of the mobility of the reading equipment (interrogator / reader).

A secure communication system according to claim 190, characterized in that as a non-limiting reference to the generality of the present secure communication system, such applications linked to the Brazil-ID system and covered by the present secure communication system include the identification , authentication, and writing of low-speed, high-volume product transponders, or low-speed, high-volume product transponders, so that the time available to complete a secure reader-transponder interaction is limited and critical given the high complexity. processing to be performed on transponders because of cryptographic mechanisms.

SECURE COMMUNICATION SYSTEM according to claim 1, characterized in that as a non-limiting reference to the generality of the present secure communication system, the present secure communication system also covers all applications which generally require a security mechanism. authentication with a high level of cryptographic protection to ensure the authenticity of goods, components, products, documents, people, means of transport, and physical places (without limitation, represented by global GPS coordinates, names and mas numbers, or by other means) and logical (without limitation in general, exemplified by logical locations such as "shipping zone", "receiving zone", and others, depending on particular tracking and identification and authentication process and application).