linux - 使用 pr533 jmrtd 和 pcsc-lite 在 phyflex i.MX6 上读取护照失败

Question

我们目前正在使用此设置:

硬件:

• phyFlex i.MX6 (Fsl ARM) 板。
• 液晶显示器
• PR533 USB 评估板(ccid 兼容)

软件:

• yocto poky/oe 1.7，当前 dizzy fsl 层
• pcsc-lite(1.8.6 也用 1.8.13 测试过)
• ccid(1.4.8 也用 1.4.18 测试过
• fsl 社区 3.18
• matchbox-sato 作为 x11 session 管理器
• JMRTD 0.4.9(使用jar应用测试)

我们想使用 pcsc-lite 和 JMRTD 读取护照(以测试加密狗)。该设置使用标准 linux (Mint) 工作站工作，但无法使用嵌入式版本读取护照(可能是由于超时？)

看起来它失去了与护照的连接(状态词 0x6600 或 0x6F01 和 0x6F00)，而在工作站上这仅发生一次或两次，直到它成功连接。我们还尝试了更新版本的 pcsc 或 ccid，但没有任何改变。

您可以在下面找到主机和目标的详细日志。

关于为什么会发生这种情况有什么建议吗？

主机日志:

00000004 Card ATR: 3B 80 80 01 01 
00000003 ifdhandler.c:291:IFDHPolling() usb:1fc9/010b:libudev:0:/dev/bus/usb/003/009 (lun: 0) 5000 ms
00000003 ccid_usb.c:1202:InterruptRead() before (0)
00052371 winscard_svc.c:319:ContextThread() Received command: CMD_GET_READERS_STATE from client 14
00001788 winscard_svc.c:319:ContextThread() Received command: CMD_GET_READERS_STATE from client 14
00000056 winscard_svc.c:319:ContextThread() Received command: STATUS from client 14
00000014 readerfactory.c:772:RFReaderInfoById() RefReader() count was: 1
00000004 winscard.c:1291:SCardStatus() UnrefReader() count was: 2
00000003 winscard_svc.c:561:ContextThread() STATUS rv=0x80100069 for client 14
00000121 winscard_svc.c:319:ContextThread() Received command: CONNECT from client 14
00000018 winscard.c:235:SCardConnect() Attempting Connect to NXP PR533 (3.60) 00 00 using protocol: 3
00000004 readerfactory.c:745:RFReaderInfo() RefReader() count was: 1
00000003 winscard.c:330:SCardConnect() powerState: POWER_STATE_INUSE
00000003 prothandler.c:87:PHSetProtocol() Attempting PTS to T=1
00000005 ifdhandler.c:668:IFDHSetProtocolParameters() protocol T=1, usb:1fc9/010b:libudev:0:/dev/bus/usb/003/009 (lun: 0)
00000002 ifdhandler.c:682:IFDHSetProtocolParameters() Timeout: 3000 ms
00000002 winscard.c:409:SCardConnect() Active Protocol: T=1
00000004 winscard.c:429:SCardConnect() hCard Identity: 64aa6fd3
00000004 winscard.c:490:SCardConnect() UnrefReader() count was: 2
00000004 winscard_svc.c:453:ContextThread() CONNECT rv=0x0 for client 14
00000053 winscard_svc.c:319:ContextThread() Received command: CMD_GET_READERS_STATE from client 14
00000037 winscard_svc.c:319:ContextThread() Received command: STATUS from client 14
00000011 readerfactory.c:772:RFReaderInfoById() RefReader() count was: 1
00000003 winscard.c:1291:SCardStatus() UnrefReader() count was: 2
00000003 winscard_svc.c:561:ContextThread() STATUS rv=0x0 for client 14
00000096 winscard_svc.c:319:ContextThread() Received command: TRANSMIT from client 14
00000020 readerfactory.c:772:RFReaderInfoById() RefReader() count was: 1
00000005 winscard.c:1587:SCardTransmit() Send Protocol: T=1
00000006 APDU: 00 A4 04 0C 07 A0 00 00 02 47 10 01 
00000003 ifdhandler.c:1266:IFDHTransmitToICC() usb:1fc9/010b:libudev:0:/dev/bus/usb/003/009 (lun: 0)
00000004 commands.c:1513:CmdXfrBlockAPDU_extended() T=0 (extended): 12 bytes
00000007 -> 000000 6F 0C 00 00 00 00 1B 00 00 00 00 A4 04 0C 07 A0 00 00 02 47 10 01 
00078174 <- 000000 80 02 00 00 00 00 1B 00 00 00 90 00 
00000020 SW: 90 00 
00000006 winscard.c:1632:SCardTransmit() UnrefReader() count was: 2
00000006 winscard_svc.c:608:ContextThread() TRANSMIT rv=0x0 for client 14
00000169 winscard_svc.c:319:ContextThread() Received command: TRANSMIT from client 14
00000018 readerfactory.c:772:RFReaderInfoById() RefReader() count was: 1
00000005 winscard.c:1587:SCardTransmit() Send Protocol: T=1
00000004 APDU: 00 A4 02 0C 02 01 1E 
00000004 ifdhandler.c:1266:IFDHTransmitToICC() usb:1fc9/010b:libudev:0:/dev/bus/usb/003/009 (lun: 0)
00000002 commands.c:1513:CmdXfrBlockAPDU_extended() T=0 (extended): 7 bytes
00000006 -> 000000 6F 07 00 00 00 00 1C 00 00 00 00 A4 02 0C 02 01 1E 
00017077 <- 000000 80 02 00 00 00 00 1C 00 00 00 69 82 
00000019 SW: 69 82

目标日志:

00000140 readerfactory.c:795:RFReaderInfoById() RefReader() count was: 1
00000042 winscard.c:1314:SCardStatus() UnrefReader() count was: 2
00000034 winscard_svc.c:606:ContextThread() STATUS rv=0x80100069 for client 14
00000483 winscard_svc.c:353:ContextThread() Received command: CONNECT from client 14
00000141 winscard_svc.c:484:ContextThread() Authorized client for 'NXP PR533 (3.60) 00 00'
00000038 winscard.c:258:SCardConnect() Attempting Connect to NXP PR533 (3.60) 00 00 using protocol: 3
00000033 readerfactory.c:768:RFReaderInfo() RefReader() count was: 1
00000028 winscard.c:353:SCardConnect() powerState: POWER_STATE_INUSE
00000029 prothandler.c:110:PHSetProtocol() Attempting PTS to T=1
00000039 ifdhandler.c:682:IFDHSetProtocolParameters() protocol T=1, usb:1fc9/010b:libudev:0:/dev/bus/usb/001/003 (lun: 0)
00000028 ifdhandler.c:696:IFDHSetProtocolParameters() Timeout: 3000 ms
00000022 winscard.c:432:SCardConnect() Active Protocol: T=1
00000039 winscard.c:452:SCardConnect() hCard Identity: 31739a24
00000036 winscard.c:513:SCardConnect() UnrefReader() count was: 2
00000035 winscard_svc.c:498:ContextThread() CONNECT rv=0x0 for client 14
00000232 winscard_svc.c:353:ContextThread() Received command: CMD_GET_READERS_STATE from client 14
00000202 winscard_svc.c:353:ContextThread() Received command: STATUS from client 14
00000132 readerfactory.c:795:RFReaderInfoById() RefReader() count was: 1
00000040 winscard.c:1314:SCardStatus() UnrefReader() count was: 2
00000031 winscard_svc.c:606:ContextThread() STATUS rv=0x0 for client 14
00000450 winscard_svc.c:353:ContextThread() Received command: TRANSMIT from client 14
00000222 readerfactory.c:795:RFReaderInfoById() RefReader() count was: 1
00000042 winscard.c:1610:SCardTransmit() Send Protocol: T=1
00000050 APDU: 00 A4 04 0C 07 A0 00 00 02 47 10 01 
00000031 ifdhandler.c:1283:IFDHTransmitToICC() usb:1fc9/010b:libudev:0:/dev/bus/usb/001/003 (lun: 0)
00000028 commands.c:1590:CmdXfrBlockAPDU_extended() T=0 (extended): 12 bytes
00000066 -> 000000 6F 0C 00 00 00 00 35 00 00 00 00 A4 04 0C 07 A0 00 00 02 47 10 01 
02712060 <- 000000 80 02 00 00 00 00 35 01 00 00 6F 01 
00000058 SW: 6F 01 
00000030 winscard.c:1655:SCardTransmit() UnrefReader() count was: 2
00000033 winscard_svc.c:653:ContextThread() TRANSMIT rv=0x0 for client 14
00004692 winscard_svc.c:353:ContextThread() Received command: CMD_GET_READERS_STATE from client 14
00000241 winscard_svc.c:353:ContextThread() Received command: CMD_GET_READERS_STATE from client 14
00000287 winscard_svc.c:353:ContextThread() Received command: CMD_GET_READERS_STATE from client 14
00115382 ccid_usb.c:1254:InterruptRead() after (0) (0)
00000060 NotifySlotChange: 50 02 
00000039 ifdhandler.c:1787:IFDHICCPresence() usb:1fc9/010b:libudev:0:/dev/bus/usb/001/003 (lun: 0)
00000046 -> 000000 65 00 00 00 00 00 36 00 00 00 
00001206 <- 000000 81 00 00 00 00 00 36 02 00 00 
00000040 ifdhandler.c:1908:IFDHICCPresence() Card absent
00000056 eventhandler.c:358:EHStatusHandlerThread() Card Removed From NXP PR533 (3.60) 00 00
00000043 ifdhandler.c:304:IFDHPolling() usb:1fc9/010b:libudev:0:/dev/bus/usb/001/003 (lun: 0) 600000 ms
00000027 ccid_usb.c:1210:InterruptRead() before (0)

Answer 1

您没有发布任何代码，所以我无法确定错误的确切原因。它可能只与设置太短的超时或您正在阅读的芯片上的电压不足有关，但引起我注意的日志中的状态字是 0x6982。

---

0x6982 是什么意思？

基本上 0x6982 意味着存在某种未经授权的访问。来自文档:

An MRtd’s contactless IC that supports Basic Access Control MUST respond to unauthenticated read attempts (including selection of (protected) files in the LDS) with “Security status not satisfied” (0x6982) once the Secure Channel is established. Sending an unsecured SELECT in the Secure Channel will result in abortion of the Secure Channel. When an unsecured SELECT is sent before the Secure Channel is established, or when the Secure Channel has been aborted, both 6982 and 9000 are ICAO compliant responses.

0x6982 被用作对许多命令的响应，根据您收到状态字的确切上下文，它的含义略有不同，但基本含义保持不变:存在某种安全性问题。例如，这里有一些更具体的 0x6982 定义:

在通用身份验证命令的上下文中，它意味着:

Security status not satisfied.
The terminal is not authorized to perform the protocol (e.g. the password is blocked, deactivated, or suspended).

在 Verify 命令的上下文中，它意味着:

Security status not satisfied
The terminal is not authorized to perform verification.

在激活或停用命令的上下文中，它表示:

Security status not satisfied
The terminal is not authorized to change the PIN state.

我无法从您发布的日志中判断错误是在哪个上下文中发生的，但正如您所见，一般主题始终相同。

---

0x6F01、0x6F00 和 0x6600 呢？

我认为您在问题中突出显示的状态词无关紧要。 0x6600 和 0x6F01 均未在官方文档中使用，这意味着它们是操作系统相关错误。在大多数情况下，此类错误仅表示协议(protocol)步骤失败。换句话说，这些很可能只是因为有错误而返回，并且它们不应该指示任何特定错误。

另一方面，

0x6F00 仅指示未知错误。这种情况更加可信，机读旅行证件芯片上存​​在断电的可能性，但如果您使用与工作站相同的读卡器硬件和主板，则不太可能出现断电。

---

你能做些什么？

我的建议很简单:尝试阅读不同的机读旅行证件，检查主板或硬件是否真的有问题，或者只是机读旅行证件本身有问题。
在您发布任何代码或提供更多信息或上下文之前，我无法给您更具体的答案。