《PBOC 3.0》中的安全缺陷与改进方案  

A SECURITY HOLE IN “PBOC 3.0” AND ITS FIXING APPROACH

作　　者：刘俊 

机构地区：[1]上海华申智能卡应用系统有限公司,上海200031

出　　处：《计算机应用与软件》2014年第11期330-333,共4页Computer Applications and Software

摘　　要：《中国金融集成电路(IC)卡规范》(JR/T 0025,简称PBOC)是由中国人民银行发布的针对我国金融IC卡的实施技术规范性文件。JR/T 0025.16—2013中规定的IC卡互联网终端与金融机构处理中心间的安全通信方式存在可导致中间人攻击的安全缺陷,使按照规范设计的IC卡互联网终端产品存在被仿冒的风险。描述和分析这个位于安全通道握手过程中的安全缺陷,并提供了攻击流程和改进方案。＂China Financial Integrated Circuit Card Specifications＂（ JR / T 0025,referred to as＂PBOC＂） is the technical specifications for financial IC card issued by the People＇s Bank of China.The secure communication method between IC card internet terminal and the processing centres of financial institutions specified by JR / T 0025.16—2013 has a man-in-the-middle attack security hole.All the IC card internet terminal products satisfying JR / T 0025.16—2013 have the risk of being counterfeited.This article describes and analyses the security hole in secure channel handshake process,and provides the attack process and fixing approach.

关 键 词：金融IC卡 PBOC 安全缺陷 中间人攻击 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]