WS/T 543.4-2017Resident health card technical specifications - Part 4: Command set of the user card (English PDF)

5.1 Overview

In the process of reading and writing the card, the card is in the idle state (the card has not obtained the read and write permission) or the safe state (the card has obtained certain reading Write authorization, read and write operations can be performed), the execution of commands in different states is different. A "firewall" is built between different applications on the card to Prevent illegal access across applications. The card gets a certain read and write authorization through the EXTERNAL AUTHENTICATION command, when when the card receives a command from the terminal, it must first check whether the current state allows the command to be executed. After the command is executed successfully, the card the film will enter the specified state. The status changes after the command is successfully executed are shown in Table 1.The whole table shows the status of a command in the current state after a successful execution.

The first line indicates the current state of the card when the command is issued, the first column indicates the issued command, and N/A indicates that the command is invalid.

5.2 Command APDU format

5.3 Response APDU format

The response APDU format consists of a variable-length condition body followed by a two-byte mandatory trailer, as shown in Table 5.

5.4 Basic commands

5.4.1 APPLICATION BLOCK command

5.4.1.1 Definition and scope

The APPLICATION BLOCK command invalidates the currently selected application.

When the APPLICATION BLOCK command is successfully completed, use the SELECT command to select a temporarily locked application, a status will be returned the status code is 6283' (the selected file is invalid), and FCI is returned at the same time.

The impact on other commands depends on different applications.

5.4.1.2 Command message

See Table 7 for the message encoding of APPLICATION BLOCK command.

5.4.1.3 Command message data field

The command message data field includes the message authentication code (MAC) data encoded according to the provisions of WS/T 543.2-2017 Chapter 8.4.2 yuan.

5.4.1.4 Response message data field

The data field of the response message does not exist.

5.4.1.5 Response message status code

Regardless of whether the application has expired, the status code for successful execution of this command is 9000'.

The error status codes that the IC card may return are shown in Table 8.

5.4.2 APPLICATION UNBLOCK command

5.4.2.1 Definition and scope

The APPLICATION UNBLOCK command can unlock temporarily locked applications. When the APPLICATION UNBLOCK command becomes After the work is completed, the application can be correctly selected with the SELECT command, and the application function will be restored at the same time.

5.4.2.2 Command message

See Table 9 for the encoding of the APPLICATION UNBLOCK command message.

5.4.2.3 Command message data field

5.4.2.4 Response message data field

The data field of the response message does not exist.

5.4.2.5 Response message status code

The status code for successful execution of this command is 9000'.

The error status codes that the IC card may return are shown in Table 10.

5.4.3 CARD BLOCK command

5.4.3.1 Definition and scope

The CARD BLOCK command disables all applications in the card permanently.

When the CARD BLOCK command is successfully completed, all subsequent commands will return the status code "This function is not supported." Yes" (SW1SW2=6A81'), and does not perform any other operations.

5.4.3.2 Command message

The message encoding of CARD BLOCK command is shown in Table 11.

5.4.3.3 Command message data field

The command message data field includes the message authentication code (MAC) data encoded according to the provisions of WS/T 543.2-2017 Chapter 8.4.2 yuan.

5.4.3.4 Response message data field

The data field of the response message does not exist.

5.4.3.5 Response message status code

The status code for successful execution of this command is 9000'.

The error status codes that the IC card may return are shown in Table 12.

5.4.4 EXTERNAL AUTHENTICATION command

5.4.4.1 Definition and scope

The EXTERNAL AUTHENTICATION command requires the application in the IC card to verify the validity of the security module in the interface device, so that the interface device gets some kind of authorization.

The response of the IC card includes the return of the command processing status.

5.4.4.2 Command message

See Table 13 for EXTERNAL AUTHENTICATION command message encoding.

5.4.4.3 Command message data field

The data field of the command message contains 17 bytes of data.

--The first to eighth bytes are authentication data;

--The 9th to 16th bytes are the original information needed for authentication;

--The 17th byte represents the key version.

Among them, the authentication data is coded according to 8.7.3 in WS/T 543.2-2017.

5.4.4.4 Response message data field

The data field of the response message does not exist.

5.4.4.5 Response message status code

The status code for successful execution of this command is 9000'.

The warning status codes that the IC card may return are shown in Table 15.

5.4.5 GET CHALLENGE command

5.4.5.1 Definition and scope

The GET CHALLENGE command requests a random number for security-related processes (for example. security messages, security authentication).

The random number becomes invalid after use and cannot be used again by the next command.

5.4.5.2 Command message

The GET CHALLENGE command message encoding is shown in Table 17.

5.4.5.3 Command message data field

The command message data field does not exist.

5.4.5.4 Response message data field

The data field of the response message includes a random number and the length is 8 bytes.

5.4.5.5 Response message status code

5.4.6.3 Command message data field

The content of the command message data field is card or application-specific authentication data, including 17 bytes of data.

--The first to eighth bytes are the data used in the process key calculation, which is generated by the terminal;

--The 9th to 16th bytes are the original information needed for authentication;

--The 17th byte represents the key version.

5.4.6.4 Response message data field

The content of the data field of the response message is related authentication data, and its value is calculated according to the provisions in Chapter 8.7.3 of WS/T 543.2-2017.

5.4.6.5 Response message status code

The status code for successful execution of this command is 9000'.

The warning status codes that the IC card may return are shown in Table 20.