GM/T 0096-2020Guide for RFID anti-counterfeiting cipher application (English PDF)

3.3 Symmetric Cryptographic Algorithm

Symmetric cryptographic algorithm refers to the cryptographic algorithm that uses the same key for encryption and decryption.

3.4 Asymmetric Cryptographic Algorithm / Public Key Cryptographic

Algorithm

Asymmetric cryptographic algorithm / public key cryptographic algorithm refers to the cryptographic algorithm that uses different keys for encryption and decryption. One of the keys (public key) may be disclosed, while the other key (private key) must be confidential, and it is infeasible to calculate the private key from the public key.

3.5 Confidentiality

Confidentiality refers to the nature of ensuring that information is not leaked to unauthorized individuals, processes and other entities.

3.10 Cryptographic Module

Cryptographic module refers to a collection of hardware, software and / or firmware that implements security functions, and is included in the cryptographic boundary.

6.1 Security Level

In accordance with the different requirements of RFID anti-counterfeiting system for cryptographic security technology, the security level of the anti-counterfeiting system may be divided into two categories, namely, Category-A and Category-B.

6.3 Category-B System

Category-B anti-counterfeiting cryptographic security system (hereinafter referred to as Category-B system) shall comply with the requirements of Level-4 security specified in 6.2.4 of GB/T 37033.1-2018.The random number in the system shall comply with the requirements of GB/T 32915.

7.1.1 System architecture

Category-A system adopts symmetric cryptographic algorithm, and through the authentication of the electronic tag by the reader, or through the bidirectional authentication between the reader and the electronic tag, it improves the security and anti-counterfeiting capabilities of the RFID tag.

7.1.2 Tag issuance system

Issue a key for the anti-counterfeiting tag, and after the issuance is completed, associate the commodity traceability-related information with the anti-counterfeiting tag (UID); store it in the information process system, which makes it convenient for consumers to carry out commodity traceability and anti-counterfeiting.

7.2.1.1 Cryptographic security requirements

The RFID electronic tag used in Category-A system shall satisfy the following cryptographic security requirements.

7.2.1.2 Optional cryptographic security requirements

In accordance with the demands of application, the RFID electronic tag used in Category-A system may optionally support the following cryptographic security requirements.

6.3.4 of GM/T 0040-2015.

e) Identity authentication. it may optionally support the identity authentication of the reader by the electronic tag. The mode, in which, the identity authentication of the reader by the electronic tag is realized, is shown in 8.3.2.1 of GB/T 37033.2-2018.The identity authentication of the reader by the electronic tag shall be tested in accordance with 6.2 and 6.3 of GM/T 0040-2015.The mode, in which, the bidirectional authentication between the reader and the electronic tag is realized, is shown in 8.3.3.1 of GB/T 37033.2-2018.

7.2.2.1 Cryptographic security requirements

The RF reader of cryptographic security functions used in Category-A system may satisfy the following cryptographic security requirements.

7.2.2.2 Optional cryptographic security requirements

In accordance with the demands of application, the RF reader of cryptographic security functions used in Category-A system may optionally support the following cryptographic security requirements.

7.3.1 Information processing system

Use secure network and gateway products to ensure the transmission security of the information processing system; ensure the storage and access security of the information processing system, see GB/T 37092 and GM/T 0039.

7.3.4 Requirements for transparent transmission channel - reader

During the RFID tag issuance and anti-counterfeiting authentication process, if the reader is used as a transparent transmission channel for information, the tag realizes anti-counterfeiting authentication through the middleware or the information processing system, and there is no cryptographic security requirement for the reader.

8.1.1 System architecture

Category-B system adopts the asymmetrical key system.

For Category-B system, adopt asymmetrical encryption method for identity authentication and authority control; prevent data falsification in each link of commodity production, circulation and sales; realize the whole-process tracking of commodities.

8.1.2 Tag issuance system

Issue a key for the anti-counterfeiting tag, and after the issuance is completed, associate the commodity traceability-related information with the anti-counterfeiting tag (UID); store it in the information process system, which makes it convenient for consumers to carry out commodity traceability and anti-counterfeiting.

8.1.4 Information processing system

Information processing system is a processing system that includes multiple types of information, such as. commodity production, storage, transportation and sales, etc.

8.1.6 Certificate issuance and identity authentication system

The cryptographic module is integrated in the devices of each link of the electronic tag and the anti-counterfeiting system.

8.2.1.1 Cryptographic security requirements

The RFID electronic tag used in Category-B system shall satisfy the following cryptographic security requirements.

8.3.3.4 Sales management certificate system's issuance of sales management

certificate

8.3.4 Requirements for transparent transmission channel - reader

During the RFID tag issuance and anti-counterfeiting authentication process, if the reader is used as a transparent transmission channel for information, the tag realizes anti-counterfeiting authentication through the middleware or the information processing system, and there is no cryptographic security requirement for the reader.

8.4 Application Scheme

Category-B RFID anti-counterfeiting cryptographic application scheme is shown in Appendix C.

GM/T 0096-2020

CRYPTOGRAPHY INDUSTRY STANDARD ICS 35.040 CCS L 80 Guide for RFID Anti-counterfeiting Cipher Application Issued on. DECEMBER 28, 2020 Implemented on. JULY 1, 2021 Issued by. State Cryptography Administration

Table of Contents

Foreword... 4

1 Scope... 5

2 Normative References... 5

3 Terms and Definitions... 6

4 Abbreviations... 7

5 Overview... 8

6 Security Category... 9

7 Category-A System Planning and Implementation... 10

8 Category-B System Planning and Implementation... 17 Appendix A (informative) Bidirectional Authentication Realization Mode... 26 Appendix B (informative) Category-A RFID Anti-counterfeiting Cryptographic Application Scheme... 27 Appendix C (informative) Category-B RFID Anti-counterfeiting Cryptographic Application Scheme... 39

1 Scope

This Standard specifies the security category, system planning and implementation of RFID anti-counterfeiting application.

This Standard is applicable to cryptographic security scheme design, cryptographic product selection and system implementation in RFID anti-counterfeiting application.

2 Normative References the content of the following documents constitutes indispensable clauses of this document through normative references in the text. In terms of references with a specified date, only versions with a specified date are applicable to this document. In terms of references without a specified date, the latest version (including all the modifications) is applicable to this document.

GB/T 28925 Information Technology - Radio Frequency Identification - Air Interface Protocol at 2.45 GHz GB/T 29768 Information Technology - Radio Frequency Identification - Air Interface Protocol at 800/900 MHz GB/T 32915 Information Security Technology - Binary Sequence Randomness Detection Method GB/T 37033.1-2018 Information Security Technology - Technical Requirements for Cryptographic Application for Radio Frequency Identification Systems - Part 1.

Cryptographic Protection Framework and Security Levels GB/T 37033.2-2018 Information Security Technology - Technical Requirements for Cryptographic Application for Radio Frequency Identification Systems - Part 2.

Technical Requirements for Cryptographic Application for RF Tag, Reader and Communication

3 Terms and Definitions What is defined in GB/T 37033.1-2018 and GM/Z 4001-2013 (TRANSLATOR NOTE.

it should be GM/Z 0001-2013), and the following terms and definitions are applicable to this document.

3.3 Symmetric Cryptographic Algorithm Symmetric cryptographic algorithm refers to the cryptographic algorithm that uses the same key for encryption and decryption.

3.4 Asymmetric Cryptographic Algorithm / Public Key Cryptographic Algorithm Asymmetric cryptographic algorithm / public key cryptographic algorithm refers to the cryptographic algorithm that uses different keys for encryption and decryption. One of the keys (public key) may be disclosed, while the other key (private key) must be confidential, and it is infeasible to calculate the private key from the public key.

3.5 Confidentiality

Confidentiality refers to the nature of ensuring that information is not leaked to unauthorized individuals, processes and other entities.

3.10 Cryptographic Module Cryptographic module refers to a collection of hardware, software and / or firmware that implements security functions, and is included in the cryptographic boundary.

4 Abbreviations

The following abbreviations are applicable to this document.

CA. Certificate Authority

5 Overview

The cryptographic application framework based on the RFID anti-counterfeiting system is shown in Figure 1.It is composed of tag issuance, anti-counterfeiting authentication, middleware, information processing system, gateway, key management system and CA. Among them, CA and middleware are optional parts, which may be selected in accordance with the demands of application.

6 Security Category

6.1 Security Level

In accordance with the different requirements of RFID anti-counterfeiting system for cryptographic security technology, the security level of the anti-counterfeiting system may be divided into two categories, namely, Category-A and Category-B.

6.3 Category-B System Category-B anti-counterfeiting cryptographic security system (hereinafter referred to as Category-B system) shall comply with the requirements of Level-4 security specified in 6.2.4 of GB/T 37033.1-2018.The random number in the system shall comply with the requirements of GB/T 32915.

7 Category-A System Planning and Implementation

7.1 System Planning

7.1.1 System architecture Category-A system adopts symmetric cryptographic algorithm, and through the authentication of the electronic tag by the reader, or through the bidirectional authentication between the reader and the electronic tag, it improves the security and anti-counterfeiting capabilities of the RFID tag.

7.1.2 Tag issuance system Issue a key for the anti-counterfeiting tag, and after the issuance is completed, associate the commodity traceability-related information with the anti-counterfeiting tag (UID); store it in the information process system, which makes it convenient for consumers to carry out commodity traceability and anti-counterfeiting.

7.2 Product Selection

7.2.1 RFID electronic tag

7.2.1.1 Cryptographic security requirements the RFID electronic tag used in Category-A system shall satisfy the following cryptographic security requirements.

7.2.1.2 Optional cryptographic security requirements in accordance with the demands of application, the RFID electronic tag used in Category-A system may optionally support the following cryptographic security requirements.

6.3.4 of GM/T 0040-2015.

e) Identity authentication. it may optionally support the identity authentication of the reader by the electronic tag. The mode, in which, the identity authentication of the reader by the electronic tag is realized, is shown in 8.3.2.1 of GB/T 37033.2-2018.The identity authentication of the reader by the electronic tag shall be tested in accordance with 6.2 and 6.3 of GM/T 0040-2015.The mode, in which, the bidirectional authentication between the reader and the electronic tag is realized, is shown in 8.3.3.1 of GB/T 37033.2-2018.

7.2.2 RF reader

7.2.2.1 Cryptographic security requirements the RF reader of cryptographic security functions used in Category-A system may satisfy the following cryptographic security requirements.

7.2.2.2 Optional cryptographic security requirements in accordance with the demands of application, the RF reader of cryptographic security functions used in Category-A system may optionally support the following cryptographic security requirements.

7.3 Implementation Suggestions

7.3.1 Information processing system Use secure network and gateway products to ensure the transmission security of the information processing system; ensure the storage and access security of the information processing system, see GB/T 37092 and GM/T 0039.

7.3.4 Requirements for transparent transmission channel - reader During the RFID tag issuance and anti-counterfeiting authentication process, if the reader is used as a transparent transmission channel for information, the tag realizes anti-counterfeiting authentication through the middleware or the information processing system, and there is no cryptographic security requirement for the reader.

8 Category-B System Planning and Implementation

8.1.1 System architecture

Category-B system adopts the asymmetrical key system.

For Category-B system, adopt asymmetrical encryption method for identity authentication and authority control; prevent data falsification in each link of commodity production, circulation and sales; realize the whole-process tracking of commodities.

8.1.2 Tag issuance system

Issue a key for the anti-counterfeiting tag, and after the issuance is completed, associate the commodity traceability-related information with the anti-counterfeiting tag (UID); store it in the information process system, which makes it convenient for consumers to carry out commodity traceability and anti-counterfeiting.

8.1.4 Information processing system

Information processing system is a processing system that includes multiple types of information, such as. commodity production, storage, transportation and sales, etc.

8.1.6 Certificate issuance and identity authentication system

The cryptographic module is integrated in the devices of each link of the electronic tag and the anti-counterfeiting system.

8.2.1.1 Cryptographic security requirements

The RFID electronic tag used in Category-B system shall satisfy the following cryptographic security requirements.

8.3.3.4 Sales management certificate system's issuance of sales management

certificate

8.3.4 Requirements for transparent transmission channel - reader

During the RFID tag issuance and anti-counterfeiting authentication process, if the reader is used as a transparent transmission channel for information, the tag realizes anti-counterfeiting authentication through the middleware or the information processing system, and there is no cryptographic security requirement for the reader.

8.4 Application Scheme

Category-B RFID anti-counterfeiting cryptographic application scheme is shown in Appendix C.