Overview
This paper mainly describes the data structure and mutual relationship in various IC cards used in medical insurance systems, and is an important technical article of system composition.
In this system, according to the type of IC card can be divided into two types: CPU card and SLE4428 logical encryption card; according to its application functions, it can be divided into: total control card, key transmission card, key card and medical insurance card ( It can also be called a user card). In addition, due to the needs of system management, an administrator card (for logging in to the card issuance system) has been added.
Their relationship is as follows:
First, the CPU card
The CPU card used in this system is in line with the intelligent IC card stipulated by the Ministry of Labor and Social Security. The chip adopts domestically produced Huada chip that meets the social security requirements. It has an 8-bit microprocessor, and the data storage space is 8K. The CPU card operating system (COS A social security IC card operating system independently developed and certified by Guangdong Desheng Technology Co., Ltd. It has been widely used in Guangdong and Yunnan provinces.
All the information in the CPU card is saved in the form of a file, and the file is organized in the form of a directory. [In fact, in the CPU card, the directory is also called a file, called a dedicated file (DF), and the specific data is saved. The file is called the basic file (EF). When the file is created, you can set the operation limit for the file, such as allowing direct reading, allowing to be rewritten after security authentication, curing, and not rewriting.
In order to control the read and write control of different files, different keys (8/16 bytes in length) can be set. In other words, it can be set to read a certain file, and the key 1 needs to be verified. For the file, the key 2 needs to be verified, and to read another file, the authentication key 3 can be set. As a result, the security is significantly improved.
Second, logical encryption (SLE4442)
Logical encryption cards are often commonly referred to as IC cards, which control the reading/writing of card information through a logical security mechanism.
The 4428 card has a triple data security mechanism: card password, password error counter and data protection.
1. Card password: Controls the rewriting of the data in the data area of ​​the IC card, that is, to rewrite the information of the IC card, the password of the IC card must be verified - the data on the card is secured and not altered;
2. Card password error counter: When the IC card password verification fails, the counter is decremented by 1. If it is reduced to 0, the card amount is locked. If the verification is successful, the counter is restored to the initial value - preventing malicious tracking and attempting ;
3. Data protection refers to the write protection operation of the information written on the IC card, like the write protection switch of the disk. Once the write protection operation is successful, the data information cannot be changed (it can be write protected for one byte) - Prevent data modification and guarantee uniqueness.
The system adopts comprehensive and comprehensive security measures on the security planning of the IC card (that is, the medical insurance card), so that the security of the system is guaranteed to the maximum extent. The specific measures are as follows:
1. The biggest and most core, one card and one secret
First of all, in many IC card applications, the same password is used, and the length is generally 2-3 bytes. The security risk is that if someone breaks the password of an IC card, the whole system will be in danger.
One card and one secret solve this problem well. Its principle is to first read a (single, long enough, unchangeable) card serial number (SN) from the data protection area of ​​the IC card. It is 8 bytes, and then through a standard, securely authenticated, general encryption algorithm (3DES), the encryption operation (DEA) is performed to obtain an 8-byte ciphertext, and some fixed trade-off is made to the ciphertext. , you can get the password of the IC card.
The specific process is as follows:
2. The card serial number is unique and fixed
Relatively speaking, it is used in many applications, which can guarantee the legality of the card, and the other party can also facilitate the management of the IC card. Prevent some recycled cards from re-introducing non-normal channels into the application.
Additional explanation: The serial number can be either plain text or cipher text.
3. Data encryption
Data encryption is also a security measure that is applied more, because the principle of the IC card itself is that the information on the card can be read at any time. Imagine if an attacker can easily see your target and path. Then he must think about it anyway, but on the contrary, if an attacker is initially faced with darkness, it is almost impossible for him to keep going. (The above is only a personal idea)
4. Data check code and two check algorithms are used simultaneously
Data verification is to prevent malicious tampering by outsiders. This is also a common mode of information security and must be adopted.
The system uses two data verification algorithms, namely: weighted average and XOR check code length is 1 byte, divided into high and low 2 BCD codes, the high bit is the weighted average, and the low bit is XOR. The simultaneous application of the two algorithms adds to the scientific basis for the security of the system.
5. CPU card join
The CPU card is added to provide the greatest guarantee for the security of the system. The CPU card is mainly used in the calculation of the medical insurance card card password and the encryption/decryption of the data information in the data area on the card. The addition of CPU cards adds many features to the system, such as:
The system security control key is generated by the user's party and the system administrator. The card supplier and the software vendor cannot know the original key of the system.
The CPU card calculates and generates ciphertext information in the card, which avoids the uncertainty caused by the data encryption/decryption operation in the program;
The CPU card provides a strict management mechanism for its own security, and the system will design and develop the card issuance system strictly according to this mechanism.
Others are not discussed in detail here.
Third, the total control card
The master control card mainly completes the security control of all CPU cards, including the security authentication of the key transmission card through it, thereby initiating the issuance of the general key card; unlocking the operation password on the key card through it; The CPU card washes the card, thereby clearing the security data in the CPU and the like.
The master control card is generated by the system administrator entering a string of 16-byte system card master control keys. The master control key should be distributed to each key card as the basis for the validity of the key card.
The specific relationship diagram is as follows:
Note: Since the key card card master key stored in the master control is the legality of the check key card to make it different from the CPU card in other applications, its security is not critical. Therefore, its production and management is relatively simple.
Fourth, the key transmission card
Its importance lies in the fact that it stores two sets of keys for real data encryption calculation and medical card card password calculation in the key card, and also stores the original code string generated by the key (that is, the input of the leader responsible for the input). The original two sets of original code strings and the scatter factor entered by the system administrator) will be the source of system security.
The key transfer card is issued by the master control card, as shown in the following figure:
Information structure in the key transfer card:
1. The user in charge directly inputs two groups of 16 characters and converts them into BCD codes through the system. And the system administrator inputs two sets of scatter factors (length is 8 bytes), which are card cipher calculation key scatter factor (PSUB) and card data encryption calculation key scatter factor (DSUB);
2. The strings entered by the above three people will be saved in three sequential files: 0004, 0005, 0006;
3. The above three people also require to input their respective passwords, respectively: Pin1, Pin2, Pin3, and the length is 2-8 bytes, and the password controls the reading of the original code information;
4. The original code string input by the leader I is dispersed to the PSUB to obtain an 8-byte temporary ciphertext I: PkeyL;
5. The original code string input by the leader II is dispersed to the PSUB to obtain an 8-byte temporary ciphertext II: PkeyR;
6. PkeyL & PkeyR=Pkey (card password calculation key);
7. The original code string input by the leader I is dispersed to the DSUB to obtain an 8-byte temporary ciphertext I: DkeyL;
8. The original code string input by the leader II is dispersed to the DSUB to obtain an 8-byte temporary ciphertext II: DkeyR;
9.DkeyL & DkeyR=Dkey (card data information encryption/decryption calculation key);
10. Save the card data encryption/decryption calculation key (Dkey) to the file EF01, the read/write control of the file is: rewrite: not allowed; read: card master key authentication and line encryption;
11. Save the card password calculation key (Pkey) to the file EF02. The read/write control of the file is: rewrite: not allowed; read: card master key authentication and line encryption.
The logical structure diagram is as follows:
Some of the security features of the key transport card are as follows:
1. The use of the master control card must be authenticated (certified card master key), and the card master key (MK) of all key cards in the system is consistent. The key is a valid authentication of the card's legality;
2. The key transmission card is a system security data source, and it has effective management, that is, management of system security. It is the system's original key;
3. The rewriting permission of the original key data of the key transmission card is not allowed, and the read operation requires verification of the PIN of the corresponding person. At the same time, the data is encrypted by the line encryption technology during the transmission process of the card and the terminal to prevent others from intercepting.
Five, administrator card
The addition of the administrator card is mainly to strengthen the effective management of the medical insurance card issuance system, and to control the issuance of the medical insurance card to generate the security of the key card.
The administrator card is divided into the system administrator card and the card issuing administrator card according to the different permissions. The former has all the operating rights of the card issuing system, while the latter can only complete the operations related to issuing the medical insurance IC card, such as data link and medical insurance. Issuance, rewriting, and data clearing of IC cards.
The administrator card is generated under the control of the master control card and the key transmission card. The specific process is as follows:
Security features of the administrator card:
1. The administrator password controls the usage rights of the two sets of keys.
2. The security management of the terminal by the terminal administrator is the management of the key card. At the same time, the key card becomes the terminal administrator identity card.
3. The basic information of the terminal administrator can be expanded according to the needs of the application.
The data structure of the management card is as follows:
Sixth, key card (terminal application)
The data structure of the key card and the administrator card are almost the same, except that an identification file is added to the root directory of the key card. For details, see the administrator card.
Seven, medical insurance IC card
The data structure of the medical insurance IC card is mainly divided into three parts: the first 32 bytes of the card serial number (card number), the cardholder basic information, and the transaction record.
This paper mainly describes the data structure and mutual relationship in various IC cards used in medical insurance systems, and is an important technical article of system composition.
In this system, according to the type of IC card can be divided into two types: CPU card and SLE4428 logical encryption card; according to its application functions, it can be divided into: total control card, key transmission card, key card and medical insurance card ( It can also be called a user card). In addition, due to the needs of system management, an administrator card (for logging in to the card issuance system) has been added.
Their relationship is as follows:
First, the CPU card
The CPU card used in this system is in line with the intelligent IC card stipulated by the Ministry of Labor and Social Security. The chip adopts domestically produced Huada chip that meets the social security requirements. It has an 8-bit microprocessor, and the data storage space is 8K. The CPU card operating system (COS A social security IC card operating system independently developed and certified by Guangdong Desheng Technology Co., Ltd. It has been widely used in Guangdong and Yunnan provinces.
All the information in the CPU card is saved in the form of a file, and the file is organized in the form of a directory. [In fact, in the CPU card, the directory is also called a file, called a dedicated file (DF), and the specific data is saved. The file is called the basic file (EF). When the file is created, you can set the operation limit for the file, such as allowing direct reading, allowing to be rewritten after security authentication, curing, and not rewriting.
In order to control the read and write control of different files, different keys (8/16 bytes in length) can be set. In other words, it can be set to read a certain file, and the key 1 needs to be verified. For the file, the key 2 needs to be verified, and to read another file, the authentication key 3 can be set. As a result, the security is significantly improved.
Second, logical encryption (SLE4442)
Logical encryption cards are often commonly referred to as IC cards, which control the reading/writing of card information through a logical security mechanism.
The 4428 card has a triple data security mechanism: card password, password error counter and data protection.
1. Card password: Controls the rewriting of the data in the data area of ​​the IC card, that is, to rewrite the information of the IC card, the password of the IC card must be verified - the data on the card is secured and not altered;
2. Card password error counter: When the IC card password verification fails, the counter is decremented by 1. If it is reduced to 0, the card amount is locked. If the verification is successful, the counter is restored to the initial value - preventing malicious tracking and attempting ;
3. Data protection refers to the write protection operation of the information written on the IC card, like the write protection switch of the disk. Once the write protection operation is successful, the data information cannot be changed (it can be write protected for one byte) - Prevent data modification and guarantee uniqueness.
The system adopts comprehensive and comprehensive security measures on the security planning of the IC card (that is, the medical insurance card), so that the security of the system is guaranteed to the maximum extent. The specific measures are as follows:
1. The biggest and most core, one card and one secret
First of all, in many IC card applications, the same password is used, and the length is generally 2-3 bytes. The security risk is that if someone breaks the password of an IC card, the whole system will be in danger.
One card and one secret solve this problem well. Its principle is to first read a (single, long enough, unchangeable) card serial number (SN) from the data protection area of ​​the IC card. It is 8 bytes, and then through a standard, securely authenticated, general encryption algorithm (3DES), the encryption operation (DEA) is performed to obtain an 8-byte ciphertext, and some fixed trade-off is made to the ciphertext. , you can get the password of the IC card.
The specific process is as follows:
2. The card serial number is unique and fixed
Relatively speaking, it is used in many applications, which can guarantee the legality of the card, and the other party can also facilitate the management of the IC card. Prevent some recycled cards from re-introducing non-normal channels into the application.
Additional explanation: The serial number can be either plain text or cipher text.
3. Data encryption
Data encryption is also a security measure that is applied more, because the principle of the IC card itself is that the information on the card can be read at any time. Imagine if an attacker can easily see your target and path. Then he must think about it anyway, but on the contrary, if an attacker is initially faced with darkness, it is almost impossible for him to keep going. (The above is only a personal idea)
4. Data check code and two check algorithms are used simultaneously
Data verification is to prevent malicious tampering by outsiders. This is also a common mode of information security and must be adopted.
The system uses two data verification algorithms, namely: weighted average and XOR check code length is 1 byte, divided into high and low 2 BCD codes, the high bit is the weighted average, and the low bit is XOR. The simultaneous application of the two algorithms adds to the scientific basis for the security of the system.
5. CPU card join
The CPU card is added to provide the greatest guarantee for the security of the system. The CPU card is mainly used in the calculation of the medical insurance card card password and the encryption/decryption of the data information in the data area on the card. The addition of CPU cards adds many features to the system, such as:
The system security control key is generated by the user's party and the system administrator. The card supplier and the software vendor cannot know the original key of the system.
The CPU card calculates and generates ciphertext information in the card, which avoids the uncertainty caused by the data encryption/decryption operation in the program;
The CPU card provides a strict management mechanism for its own security, and the system will design and develop the card issuance system strictly according to this mechanism.
Others are not discussed in detail here.
Third, the total control card
The master control card mainly completes the security control of all CPU cards, including the security authentication of the key transmission card through it, thereby initiating the issuance of the general key card; unlocking the operation password on the key card through it; The CPU card washes the card, thereby clearing the security data in the CPU and the like.
The master control card is generated by the system administrator entering a string of 16-byte system card master control keys. The master control key should be distributed to each key card as the basis for the validity of the key card.
The specific relationship diagram is as follows:
Note: Since the key card card master key stored in the master control is the legality of the check key card to make it different from the CPU card in other applications, its security is not critical. Therefore, its production and management is relatively simple.
Fourth, the key transmission card
Its importance lies in the fact that it stores two sets of keys for real data encryption calculation and medical card card password calculation in the key card, and also stores the original code string generated by the key (that is, the input of the leader responsible for the input). The original two sets of original code strings and the scatter factor entered by the system administrator) will be the source of system security.
The key transfer card is issued by the master control card, as shown in the following figure:
Information structure in the key transfer card:
1. The user in charge directly inputs two groups of 16 characters and converts them into BCD codes through the system. And the system administrator inputs two sets of scatter factors (length is 8 bytes), which are card cipher calculation key scatter factor (PSUB) and card data encryption calculation key scatter factor (DSUB);
2. The strings entered by the above three people will be saved in three sequential files: 0004, 0005, 0006;
3. The above three people also require to input their respective passwords, respectively: Pin1, Pin2, Pin3, and the length is 2-8 bytes, and the password controls the reading of the original code information;
4. The original code string input by the leader I is dispersed to the PSUB to obtain an 8-byte temporary ciphertext I: PkeyL;
5. The original code string input by the leader II is dispersed to the PSUB to obtain an 8-byte temporary ciphertext II: PkeyR;
6. PkeyL & PkeyR=Pkey (card password calculation key);
7. The original code string input by the leader I is dispersed to the DSUB to obtain an 8-byte temporary ciphertext I: DkeyL;
8. The original code string input by the leader II is dispersed to the DSUB to obtain an 8-byte temporary ciphertext II: DkeyR;
9.DkeyL & DkeyR=Dkey (card data information encryption/decryption calculation key);
10. Save the card data encryption/decryption calculation key (Dkey) to the file EF01, the read/write control of the file is: rewrite: not allowed; read: card master key authentication and line encryption;
11. Save the card password calculation key (Pkey) to the file EF02. The read/write control of the file is: rewrite: not allowed; read: card master key authentication and line encryption.
The logical structure diagram is as follows:
Some of the security features of the key transport card are as follows:
1. The use of the master control card must be authenticated (certified card master key), and the card master key (MK) of all key cards in the system is consistent. The key is a valid authentication of the card's legality;
2. The key transmission card is a system security data source, and it has effective management, that is, management of system security. It is the system's original key;
3. The rewriting permission of the original key data of the key transmission card is not allowed, and the read operation requires verification of the PIN of the corresponding person. At the same time, the data is encrypted by the line encryption technology during the transmission process of the card and the terminal to prevent others from intercepting.
Five, administrator card
The addition of the administrator card is mainly to strengthen the effective management of the medical insurance card issuance system, and to control the issuance of the medical insurance card to generate the security of the key card.
The administrator card is divided into the system administrator card and the card issuing administrator card according to the different permissions. The former has all the operating rights of the card issuing system, while the latter can only complete the operations related to issuing the medical insurance IC card, such as data link and medical insurance. Issuance, rewriting, and data clearing of IC cards.
The administrator card is generated under the control of the master control card and the key transmission card. The specific process is as follows:
Security features of the administrator card:
1. The administrator password controls the usage rights of the two sets of keys.
2. The security management of the terminal by the terminal administrator is the management of the key card. At the same time, the key card becomes the terminal administrator identity card.
3. The basic information of the terminal administrator can be expanded according to the needs of the application.
The data structure of the management card is as follows:
Sixth, key card (terminal application)
The data structure of the key card and the administrator card are almost the same, except that an identification file is added to the root directory of the key card. For details, see the administrator card.
Seven, medical insurance IC card
The data structure of the medical insurance IC card is mainly divided into three parts: the first 32 bytes of the card serial number (card number), the cardholder basic information, and the transaction record.
Advantages Of Eva Kid Furniture
EVA kid furniture
|
Material |
EVA |
|
Hardness |
Normally Shore C 38 |
|
Color |
Panton Color |
|
Item |
Number / letter /fruit /animal / vehicle |
|
thickness |
10mm thickness |
|
Style |
Interlocked mats and puzzle |
|
Ideal for use |
Home, gym, children' playroom, playground, activity area,Yoga centers, Gymnastics centers |
|
Features |
Good flexibility,soft feeling,easy to clean,eco-friendly,textured finish for barefoot use, easy to install and dismantle,large interlocking tabs ensure secure footing once fix |
EVA Kid Furniture,EVA Kid Furniture Toy,EVA Kids Table,EVA Kids Chair
Ji An Chi Cai Gift and Packaging Product Co., Ltd. , http://www.chicaieva.com