S50 contactless IC card Study Notes

S50Non-contactICCard Performance Overview (M1)

I,Main indicators

L size: 8 K-bit EEPROM (1 K bytes)

L divided into 16 sectors, each of which is 4 blocks, each with 16 bytes, block as the unit of access

L each slice has an independent set of passwords and Access Control

L each card has a unique serial number of 32 characters.

L conflict prevention mechanism, supporting multi-Card Operations

L no power supply, built-in antenna, including encryption control logic and communication logic circuit

L The data retention period is 10 years. The data can be rewritten for 0.1 million times and read unlimited times.

L operating temperature:-20 ℃ ~ 50 ℃ (humidity: 90%)

L operating frequency: 13.56 MHz

L communication rate: 106 kbps

L read/write distance: less than 10 cm (related to the reader)

III,Storage Structure

The mf1 card is divided into 16 sectors, with 4 blocks per zone (blocks 0 ~ Block 3), 64 blocks in total, with the block number as 0 ~ 63. Block 0 of the 0th sector (absolute address block 0) is used to store the Code related to the chip dealer and Card dealer, which has been fixed and cannot be changed. Block 0, Block 1, and block 2 of other sectors are data blocks used to store user data. Block 3 is the control block of each sector, it is used to store Password A, access control condition settings, and password B. The structure of each region's control block is the same. The size shown in 1 is 16: zone * 4*16 bytes = 1024 bytes.

1. Shows the storage structure:

	Block 0	IC card manufacturer information	Data Block	0
Sector 0	Block 1		Data Block	1
	Block 2		Data Block	2
	Block 3	Password A access control password B	Control Block	3
	Block 0		Data Block	4
Sector 1	Block 1		Data Block	5
	Block 2		Data Block	6
	Block 3	Password A access control password B	Control Block	7
		: : :
	0		Data Block	60
Sector 15	1		Data Block	61
	2		Data Block	62
	3	Password A access control password B	Control Block	63

2. The Block 0 in The 0th sector (that is, the absolute address 0 block) is used to store the vendor code, which has been fixed and cannot be changed.

3. Block 0, Block 1, and block 2 for each sectorData BlockCan be used to store data.

Data BlockTwo applications are available:

★Can be used for general data storage.Read,WriteOperation.

★Can be used as a data value.Initialization value, value-added value, impairment value, and read valueOperation.

4. The block 3 of each slice isControl BlockIncluding Password A, access control, and password B. The specific structure is as follows:

Password A (6 bytes) Access Control (4 bytes) password B (6 bytes)

5. The password and access control for each sector are independent. You can set your own password and access control as needed. The access control is 4 bytes, with a total of 32 bits. The access conditions for each block (including the data block and the control block) in the slice are jointly determined by the password and access control.Access ControlEach block has a correspondingThree control bitsIs defined as follows:

Block 0: C10 C20 C30

Block 1: C11 C21 C31

Block 2: C12 c22 c32

Block 3: C13 C23 c33

For example, C code in C10 is a control bit. 1 represents the first and 0 represents the control bit of Block 0.

The three control BITs exist in the access control byte in the form of positive and inverse, which determines the access permission of the block (such

Key A must be verified for impairment operations, key B must be verified for value-added operations, and so on ). Three Controls

1. The content of "()" is the default factory value of M1 card;

2. Red indicates that reverse lookup is required for use (Table search;

3. The control bit is stored in two types of values, namely, inverse (0-3bit) and non-inverse (4-7bit ).

6,Data Block(Block 0, Block 1, Block 2) access control is as follows:

Control bit (x = 0 .. 2)	Access items (0, 1, and 2 for data blocks)
C1x	C2x	C3x	Read	Write	Increment	Decrement, transfer, Restore
0	0	0	Keya | B	Keya | B	Keya | B	Keya | B
0	1	0	Keya | B	Never	Never	Never
1	0	0	Keya | B	Keyb	Never	Never
1	1	0	Keya | B	Keyb	Keyb	Keya | B
0	0	1	Keya | B	Never	Never	Keya | B
0	1	1	Keyb	Keyb	Never	Never
1	0	1	Keyb	Never	Never	Never
1	1	1	Never	Never	Never	Never

(Keya | B Indicates Password A or password B, and never indicates that it cannot be implemented under any conditions)

For example, when the Block 0 access control bit C10 C20 C30 = 1 0 0, verify that password a or password B is correct and then read;

After verifying that password B is correct, it can be written. You cannot perform value-added or impairment operations.

7,Control BlockBlock 3 access control andData Block(Block 0, 1, and 2) Different, its access control is as follows:

			Password	Access Control	Password B
C13	C23	C33	Read	Write	Read	Write	Read	Write
0	0	0	Never	Keya | B	Keya | B	Never	Keya | B	Keya | B
0	1	0	Never	Never	Keya | B	Never	Keya | B	Never
1	0	0	Never	Keyb	Keya | B	Never	Never	Keyb
1	1	0	Never	Never	Keya | B	Never	Never	Never
0	0	1	Never	Keya | B	Keya | B	Keya | B	Keya | B	Keya | B
0	1	1	Never	Keyb	Keya | B	Keyb	Never	Keyb
1	0	1	Never	Never	Keya | B	Keyb	Never	Never
1	1	1	Never	Never	Keya | B	Never	Never	Never

For example, when block 3's access control bit C13 C23 c33 = 1 0 0, it indicates:

Password A: it cannot be read. After verifying that Keya or keyb is correct, it can be written (changed ).

Access Control: after verifying that Keya or keyb is correct, it is readable and writable.

Password B: after verifying that Keya or keyb is correct, it is readable and writable.

II,Working Principle

The electrical part of the card consists of only one antenna and ASIC.

Antenna: The card antenna is a set of winding coils that are suitable for encapsulation into is0 cards.

ASIC: The card ASIC consists of a high-speed (106kb baud rate) rfinterface, a control unit and

8 K-bit EEPROM.

Working principle: the reader sends a set of Fixed-frequency electromagnetic waves to the M1 card. The card contains an LC series resonance circuit, which is the same as the frequency of the reader's launch, the LC resonance circuit generates resonance, so that the capacitor has a charge. At the other end of the capacitor, a one-way conduction electronic pump is connected to send the charge in the capacitor to another capacitor for storage, when the accumulated charge reaches 2 V, this capacitor can be used as a power supply to provide the operating voltage for other circuits, transmitting the data in the card or receiving the reader data.

III,M1Communication between RF Card and Reader

Reset response(Answer to request)

The communication protocol and the baud rate of the M1 RF Card are defined. When a card enters the operation range of the reader, the reader communicates with the card through a specific protocol to determine whether the card is an M1 RF Card, that is, the card type of the verification card.

Conflict prevention mechanism(Anticollision loop)

When multiple cards enter the reader operation range, the anti-conflict mechanism selects one of them for the operation. If not selected, the system is in idle mode and waits for the next card selection, this process returns the serial number of the selected card.

Select card(Select tag)

Select the serial number of the selected card and return the capacity code of the card.

Mutual confirmation(3 pass authentication)

After selecting the card to be processed, the reader determines the sector number to be accessed and verifies the password of the sector. After three mutual authentication, the reader can communicate through the encrypted stream. (When selecting another partition, you must verify the password of another sector .)

Operations on data blocks

Read(Read): Read a block;

Write(Write): Write a block;

Add(Increment): adds a value to a value block;

Subtraction(Decrement): impairment of numeric blocks;

Storage(Restore): stores the content in the block in the data register;

Transmission(Transfer): Write the content in the data register to the block;

Abort(Halt): place the card in the paused state;