IC card of "gate" is breaking security technology needs to be upgraded

Recently, the Ministry of industry and information technology issues on the part of IC card to cope with a serious security vulnerability circular requesting for IC card usage for investigation and response.

This reporter has learned that the notification is applied to the back of IC card system MI chip security encryption has been cracked, unscrupulous elements the cracking method to very low economic cost to adopt various MI chip IC card such as the bus card, such as illegal access control card recharge or copy, to the application of the unit formed a major threat to public safety. Currently 170 cities about 1.4 billion pieces of applying this technology in IC card there is a potential security risk.

MI chip IC card is no longer safe

IC card, IC card, is the most commonly used in real life, a micro-payment card, there are two major categories: one category is non-contact card, such as public transportation card, an access card, parking cards, etc.; one is the contact class IC card, such as the daily use of purchase card, gas cards, phone cards, etc.

Where non-contact IC card application is very broad, from the Ministry of construction IC card application service center data suggests that as of November 2008, a total of 170 cities in public transportation has established a different scale of IC card applications, 90 percent of the city for the city of IC card smart card. Issuing volume has more than 1.5 billion, of which 95% of the tickets of the city in the application of the IC card system is the option of using a MI chip production of non-contact IC cards, which means that about 1.4 billion Zhang uses MI chip IC card in my city utility application in the IC card system, its scope of application are covered by public transportation, Metro, taxi, water, gas and retail consumption etc. Most people may not expect, these cards security algorithm MI chip has been cracked.

Germany researchers Henryk · ploc and Virginia in computer science in Ph. Carlsten · Knoll at the end of last year issued a study results that they use the computer successfully solved NXP's MI classic chip ("MI chip) security algorithms, MI chip security algorithm is currently the world's most widely used non-contact IC card security algorithms.

However, considering that this outcome if criminals to malicious use, most access control system, public payment system, will face a huge security risk, therefore, two scientists announced in the first instance in no way disclose his crack results.

In fact, this is not the first time to crack the password for the IC card, in 2002, the New York Times has reported that Cambridge two computer security experts in the United States shows a clever and cheap solution to IC card chip data technology: you only need a Flash and a microscope.

Once compromised, IC card can be blatant copy and modify the information.

The present city of IC card a smart card. For example, in Beijing, public transport IC card can be part of the hotel and supermarket consumer, once criminals copy card after malicious to reselling or auto-recharge, the consequences will be disastrous.

Reporters also found that there are many online selling IC card password cracking techniques, a few hundred dollars to several thousand dollars in the price.

IC card upgrade is the trend

MI card algorithm was broken after the Chinese urban utility IC card system security has caused a great risk.

How to solve this security vulnerability that prevent harm to occur, is an important issue to be solved.

In order to avoid being cracked MI card algorithm to city utilities after IC card system security threat, the Ministry of construction IC card application service center to highlight a couple of scenarios: one is to strengthen the security of application system MI card programme, the second is compatible with the CPU card MI card application system, the third is using CPU cards replace MI card application system, and the programme commenced a detailed justification.

China information industry trade association professional Committee of smart cards Unilever, Professor, President of the Pan, effective protection against root-MI algorithm explains the solution is to upgrade existing IC card system, and will replace MI card CPU card.

Compared to the MI card, although the CPU card began relatively late, but CPU cards have independent CPU processor and chip operating system, can be more flexible to support a variety of applications, transactions and more secure. Its advantages in data security and higher, more flexible, application capabilities more respect. At present, European countries have already adopted the bank card CPU technology, has not been cracked and attacks, and other serious incidents, fully illustrates the advantages of CPU card.

"The relative use of MI chip IC card, CPU card break up the difficulty will be very big, but the system card cost is much higher.

"Beijing ºô¶³ì¼î¾ business management technology Institute experts BC wins in interview, says.

This reporter has learned that the Beijing Municipal traffic card company in accordance with the requirements of the relevant State departments, is gradually replaced now enabled CPU card MI card, currently of the public in a cartoon for sale card point new buy cards is already a CPU card.

It is understood that the relevant national departments in IC card upgrade has done a lot of work, the Ministry of construction IC card application service center in 2008 on the development of two national industry standards, and to the Ministry of construction to declare three urban interconnection card series standard, as the CPU card widely used and implemented national interconnection and establish the standard system.

Experts say that although upgrading existing IC card system, and will replace MI card CPU card is a trend, but because of our large base of MI card, mass upgrade system and replacement of card funding nor is it a small amount, plus any other work, changing card work is bound to be a gradual process.

Proper use of the guarantee card security

On being informed that IC card security troubles, many consumers have expressed a concern.

And related experts believe, although some people break out IC card security algorithms, but take precautions can beTo prevent, in theory, criminals can use this technology to make any changes in the card information, but as most IC card trading company and related units are set up background management system that can detect suspicious IC card data changes, consumers who found exception shall promptly take measures to inform the issuing Department, or reports to the police.

Current IC card security vulnerability is not in dispute, how to prevent your card information is stolen? Zhao Sheng to consumers give ideas: first, do not use the card at lent to others, so that the card information being copied; second, when using the card to pay attention to the surrounding environment, do not let the cards out of sight; third, usually out of Office, not to the credit card for the convenience of the cards randomly placed on the outer package and on the phone, clothing, so that the card information unknowingly be read; fourth, for stored-value cards, an amount not to too many cichongzhi, once the loss or theft, the loss would not be too large.