- PDF Free Download

Size: px

Start display at page:

Download "1.0 15 2 10"

ぜんぺいほうねん
7 years ago
Views:

3 DSRC EMV 2 EMV PIN I/F ICCR/W HMI DSRC EMV IP DSRC IP DSRC

4 EMV EMV EMV IC IP EMV IP EMV

5 1 DSRC Dedicated Short Range Communications IC EMV IC IC DSRC IC DSRC 3

6 2 IC IC DSRC IC 10 <> IC DSRC 4

7 3 DSRC 3.1 DSRC POS DSRC EMV 2 2 I/F DSRC I/F EMV 1 ICCR/W PIN HMI ICC EMV 2 ICC R/WPIN ISO

8 EMV 2 EMV 1 EMV EMVCo. EMV 1IC EMV EMV 2 EMV DSRC Dedicated Short Range Communications ARIB STD-T75DSRC 3.2.3PIN PINPersonal Identification Number PIN DSRC EMV DSRC PIN I/F DSRC DSRC 3.2.6ICCR/W ICC EMV HMI PIN 6

9 3.3 DSRC OSI DSRC ICCR/W PIN EMV 2 HMI I/F I/F L3L6 L1L2L7 L1L2L7 DSRC 3.3-1DSRC 7

10 3.4 DSRC ICC DSRC DSRC EMV 2 ICC EMV (V ) EMV 1 PIN EMV ICC DSRC EMV 2 (DSRC EMV ) EMV 3.4.3EMV ICC DSRC EMV 2 EMV 2 (SAM ) 8

11 4 4.1 EMV DSRC DSRC ISO International Organization for Standardization 7816EMV IC 10 IC DSRC IC DSRC EMV EMV DSRC <>IP DSRC IP IP DSRC DSRC DSRC DSRC IP IP EMV IP EMV IP 9

12 4.2 EMV3.1.1 IC DSRC IC DSRC IC EMV IC IC

13 4.4.2 EMV EMV IC XXX 1 XXXX PIN 11

14 (1) DSRC EMV (2) IC (3)APL IC (4)IC IC IC IC (5) IC (6) IC (7) IC (8) (9)PIN PIN (10) PIN (11) IC (12) TVR Terminal Action Code IC Issuer Action Code IC 12

15 (13) IC IC (14) IC IC DSRC 4.5 DSRC IC DSRC 4.6 DSRC IC 4.7 DSRC IC 4.8 DSRC IC 13

16 5 5.1 AP DSRC AP DSRC 14

17 5.2 DSRC DSRC IC 1 PIN 15

18 6 6.1IP IP TCP/IP IP DSRC DSRC ASL IP over DSRC IP IP 6.1.3DSRC DSRC ASL IP (1)TLS/IPsec TLSTransport Layer Security IPsec 16

19 (2) IP SOCKETTCP/IP A-DATA.req A-DATA..ind A-DATA.res A-DATA.cnf A-DATA.req A-DATA.ind A-DATA.res A-DATA.cnf A-DATA.req A-DATA.ind A-DATA.res A-DATA.cnf A-DATA.req A-DATA.ind A-DATA.res A-DATA.cnf

20 A-DATA.req A-DATA.res ASN.1 PER(Packed Encoding Rules) (1)DSRCCreditCommand DSRCCreditCommand DSRCCreditCommand::= SEQUENCE { versionindex Version, creditcommand CreditCommand } Version::= SEQUENCE { majorversion INTEGER(0..15), -- minorversion INTEGER(0..15) -- } CreditCommand::=CHOICE{ authenticatecommand [0] AuthenticateCommand, -- operationcommand [1] OperationCommand, dummy [2-254 ] NULL, -- obedenialresponse [255] ObeDenialResponse -- } (2)OperationCommand OperationCommand IC OperationCommand OperationCommand::=SEQUENCE{ opcommandtype OpCommandType, opsecurityprofile OpSecurityProfile, opcommandbody OCTET STRING(SIZE(0..261)) -- } OpCommandType::=ENUMERATED{ icccommand (0), -- pinentryrequest (1), --PIN endrequest (2), -- initrequest (3), -- reservedforfutureuse (4-127), -- iccresponse (128), --IC pinentryresponse (129), --PIN endresponse (130), -- initresponse (131), -- reservedforfutureuse ( ) -- } 18

21 OpSecurityProfile::=SEQUENCE{ encryptionalgorithmid INTEGER(0..255), keynumber INTEGER(0..255) } (3) ObeDenialResponse ObeDenialResponse ObeDenialResponse ObeDenialResponse::=SEQUENCE{ status INTEGER(0..255), -- supplementinfo OCTET STRING(SIZE(0..127)) -- } status :PIN 02:ICC 03:ICC 04: 3263 IP 6495IP (4)opCommandBody (A)iCCCommand IC (B)iCCResponse IC (C)pinEntryRequest PIN 19

22 (D) pinentryresponse PIN (E)endRequest DRSC (F)endResponse DSRC (G)initRequest DSRC (H)initResponse DSRC 20

23 (initrequest) ATR (initrespons) SELECT (iccresponse) READRECORD(iCCCommand) READRECORD(iCCResponse) GET PROCESSING OPTION (iccommand) DATA (iccresponse) READ RECORD (iccommand) DATA (iccresponse) INTERNAL AUTHENTICATE (icccommand) AP (iccresponse ) DATA GET DATA (icccommand) DATA (iccresponse) PIN VERIFY (icccommand) (1) (1) DATA (iccresponse) (1)

24 GET DATA (icccommand) DATA (iccresponse) 1. GENERATE AC (icccommand) TC or ARQC or AAC (iccresponse) EXTERNAL UTHENTICATE (icccommand) EXTERNAL UTHENTICATE (iccresponse) 2. GENERATE AC (icccommand) TC or AAC (iccresponse) ISSURE SCRIPT ((icccommand) ISSURE SCRIPT (iccresponse) (endrequest) (endresponse)

25 6.2 IP IP DSRC Application Sub-Layer IP POS EMV (DSRC Application SubLayer) (DSRC Application SubLayer) DSRC IP (1)DSRC ASL IP DSRC ASL (A) IC PIN (B) IC PIN (2)DSRC ASL IP DSRC ASL DSRC ASL 1 DSRC 0x DSRC DSRC 23

26 DSRC (1) ARIB STD T-75 DSRC BST VST DSRC ASL DSRC ASL parameter IP LocalPort (2) (A) I/F DSRC ASL Notify ApplicationRSU ID VST VehicleProfile EID ID EID I/F I/F (B)DSRC DSRC DSRC DSRC DSRC DSRC DSRC 2 Invoke Invoke PDU 24

27 6.2.3 DSRC DSRC ASN.1 PER(Packed Encoding Rules) length Contents (1)DSRCCreditCommand DSRCCreditCommand DSRCCreditCommand::= SEQUENCE { versionindex Version, creditcommand CreditCommand } Version::= SEQUENCE { majorversion INTEGER(0..15), -- minorversion INTEGER(0..15) -- } CreditCommand::=CHOICE{ authenticatecommand [0] AuthenticateCommand, operationcommand [1] OperationCommand, dummy [2-254 ] NULL, -- obedenialresponse [255] ObeDenialResponse -- } (2)AuthenticateCommand AuthenticateCommand AuthenticateCommand AuthenticateCommand::=CHOICE{ authpath1 [0] OCTET STRING, authpath2 [1] OCTET STRING, authpath3 [2] OCTET STRING, authpath4 [3] OCTET STRING, dummy [4-255] NULL }

28 authpath1 authpath2 authpath3 authpath (3)OperationCommand OperationCommand IC OperationCommand OperationCommand::=SEQUENCE{ opcommandtype OpCommandType, opsecurityprofile OpSecurityProfile, opcommandbody OCTET STRING(SIZE(0..261)) -- } OpCommandType::=ENUMERATED{ icccommand (0), -- pinentryrequest (1), --PIN endrequest (2), -- initrequest (3), -- reservedforfutureuse (4-127), -- iccresponse (128), --IC pinentryresponse (129), --PIN endresponse (130), -- initresponse (131), -- reservedforfutureuse ( ) -- } 26

29 OpCommandType 0,128,129 opcommandbody OpSecurityProfile::=SEQUENCE{ encryptionalgorithmid INTEGER(0..255), keynumber INTEGER(0..255) } (4)ObeDenialResponse ObeDenialResponse ObeDenialResponse ObeDenialResponse::=SEQUENCE{ status INTEGER(0..255), -- supplementinfo OCTET STRING(SIZE(0..127)) -- } status :PIN 02:ICC 03:ICC 04: 3263 IP 6495IP (5)opCommandBody (A)iCCCommand IC (B)iCCResponse IC (C)pinEntryRequest PIN 27

30 (D) pinentryresponse PIN (E)endRequest DRSC (F)endResponse DSRC (G)initRequest DSRC (H)initResponse DSRC 28

31 7 7.1 EMV IC EMV POS IC APL APL PIN

32 7.2 (1) DSRC IC IC Reset POS (2)EMV IC ATR EMV (3)IC (4)APL EMV (5) (6) (7) (8)PIN IC PIN IC EMV (9) (10) (11) EMV (12) (13) (14) 30

33 8 8.1 EMV ISO EMV CLA INS '8x' '1E' APPLICATION BLOCK '8x' '18' APPLICATION UNBLOCK '8x' '16' CARD BLOCK '0x' '82' EXTERNAL AUTHENTICATE '8x' 'AE' GENERATE APPLICATION CRYPTOGRAM '0x' '84' GET CHALLENGE '8x' 'CA' GET DATA '8x' 'A8' GET PROCESSING OPTIONS '08' '88' INTERNAL AUTHENTICATE '8x' '24' PERSONAL IDENTIFICATION NUMBER (PIN) CHANGE/UNBLOCK '0x' 'B2' READ RECORD '0x' 'A4' SELECT '0x' '20' VERIFY '8x' 'Dx' RFU '8x' 'Ex' RFU '9x' 'xx' INS RFU 'Ex' 'xx' INS RFU

34 8.2 EMV EMV POS PIN POS POS PIN POS PIN POS POS EMV 32

35 8.5 IC User Interface Terminal Prompts Online Interfaces Message Formats Acquirer Settings Payment Scheme Functions Product Settings Communication Protocol Other Application(s) Purse Non-Financial Settings EMV Level 2 EMV Debit and Credit Application Application Selection Security Command Set EMV Level 1 Interface

36 9 IP IP 9.1IP IP TLS IPsec IP- EMV EMV EMVco EMV DSRC I/F TLS- DSRC TCP/IP(IPsec) ARIB ASL AID=18 DSRC DSRC L7 ARIB L2 T75TR-T16 L1 ICC R/W EMV EMVco IP (1)ICC R/W EMV EMV 34

37 (2) (3) 3 (1) ETC ARIB STD-T75DSRC ARIB TR-T16 DSRC L1STD-T75 L2L7 STD-T75 DSRC ASL DSRC ARIB TCP/IP I/F TLS/IPsec 9.1.5EMV EMV IC 35

38 9.2 IP IP IP IP- EMV EMV EMVco EMV DSRC I/F DSRC ASL ARIB DSRC AID=XX DSRC L7 ARIB L2 T75TR-T16 L1 ICC R/W EMV EMVco IP- EMV EMV EMVco EMV DSRC I/F DSRC ASL ARIB DSRC AID=XX DSRC L7 ARIB L2 T75TR-T16 L1 ICC R/W EMV EMVco IP (1)ICC R/W EMV EMV 36

39 (2) () () (3) 3 (1) ETC ARIB STD-T75DSRC ARIB TR-T16 DSRC L1STD-T75 L2L7 STD-T75 DSRC ASL DSRC ARIB I/F () () 9.2.5EMV EMV IC 37

40 10 ISO/IEC Identification cards - Integrated circuit(s) cards with contacts - Part 1Physical characteristics ISO/IEC Information technology - Identification cards Integrated circuit(s) cards with contacts - Part 2Dimensions and location of the contacts ISO/IEC Information technology - Identification cards Integrated circuit(s) cards with contacts Part 3Electronic signals and transmission protocols ISO/IEC Information technology - Identification cards Integrated circuit(s) cards with contacts - Part 4Interindustry commands for interchange ISO/IEC /Amd secure messaging on the structures of APDU messages ISO/IEC Identification cards - Integrated circuit(s) cards with contacts - Part 5Numbering system and registration procedure for application identifiers ISO/IEC /Amd ISO/IEC Identification cards - Integrated circuit(s) cards with contacts - Part 6 Interindustry data elements ISO/IEC /Amd IC manufacturer registration ISO/IEC Identification cards - Integrated circuit(s) cards with contacts - Part 8Security related interindustry commands ISO/IEC Identification cards -Integrated circuit(s) cards with contacts - Part 9Additional interindustry commands and security attributes ISO/IEC Identification cards - Integrated circuit(s) cards with contacts - Part 10 Electronic signals and answer to reset for synchronous cards EMV2000 EMV2000 Integrated Circuit Card Specification for Payment Systems Book 1 - Application Independent ICC to Terminal Interface Requirements Ver4.0 EMV2000 EMV2000 Integrated Circuit Card Specification for Payment Systems Book 2 - Security and Key Management Ver4.0 EMV2000 EMV2000 Integrated Circuit Card Specification for Payment Systems Book 3 - Application Specification Ver4.0 EMV2000 EMV2000 Integrated Circuit Card Specification for Payment Systems Book 4 - Cardholder, Attendant, and Acquirer Interface Requirements Ver4.0 EMV2000 EMVCo Type Approval Terminal Level 1 Administrative Process EMV2000 EMVCo Type Approval Terminal Level 1 Requirements Process EMV2000 EMVCo Type Approval Terminal Level 1 Test Cases Process EMV2000 EMVCo Type Approval Terminal Level 2 Requirements EMV2000 EMVCo Type Approval Terminal Level 2 Test Cases IC EMV2000 EMV2000 IC JPO 1.2 JPO 1.2 JPO

41 MasterCard International MasterCard Chip-Recommended Specifications for Debit and Credit Version4 MasterCard InternationalMasterCard Chip-Minimum Card Requirements for Debit and Credit Version4 MasterCard InternationalMasterCard Chip-Terminal Requirements for Debit and Credit Version4 Visa International2001 Visa Integrated Circuit Card Application Overview Version Visa International2001 Visa Integrated Circuit Card Card Specification Version Visa International2001 Visa Integrated Circuit Card Terminal Specification Version IC 1.1 ARIB 2001 ARIB STD-T75 DSRC 1.0 ARIB 2001 ARIB TR-T16 DSRC 1.0 HIDO 2002 DSRC JIS X ASN.1 JIS X PER 39

ICカード利用システムにおいて新たに顕現化したPre-play attackとその対策

ICカード利用システムにおいて新たに顕現化したPre-play attackとその対策 IC Pre-play attack IC IC IC EMV EMV 1 IC IC Pre-play attack ATM Pre-play attack Pre-play attack IC EMV Pre-play attack... E-mail: hidemitsu.izawa@boj.or.jp E-mail: katsuhisa.hirokawa@boj.or.jp / /2015.10