通过Android USB主机与智能卡读卡器通信

我正在尝试向智能卡发送命令。我用一个金雅拓 IDBridge CT30（PC TWIN 读卡器） http://www.smartcardfocus.com/images/content/GEMTR.jpg and a ID桥K30 http://cartesapuce-discount.com/76-371-thickbox/lecteur-de-cartes-a-puce-usb-gempc-tr.jpg通过 USB 连接到 Android 设备。

我尝试通过 USB 发送 SELECT APDU 命令：

boolean claim = openedConnection.claimInterface(usbInterface, true);
byte[] data = new byte[]{
        (byte) 0x00, (byte) 0xA4, (byte) 0x04, (byte) 0x0C,
        (byte) 0x07, (byte) 0xA0, (byte) 0x00, (byte) 0x00,
        (byte) 0x01, (byte) 0x18, (byte) 0x45, (byte) 0x4E};

之后我收到了答复：

final int dataTransferred = this.openedConnection.bulkTransfer(endPointOut, data, data.length, TIMEOUT_MS);
if(!(dataTransferred == 0 || dataTransferred == data.length)) {
    throw new Exception("Error durring sending command [" + dataTransferred + " ; " + data.length + "]"); //$NON-NLS-1$ //$NON-NLS-2$ //$NON-NLS-3$
}

final byte[] responseBuffer = new byte[endPointIn.getMaxPacketSize()];
final int dataTransferred = this.openedConnection.bulkTransfer(this.endPointIn, responseBuffer, responseBuffer.length, TIMEOUT_MS);
Console.writeLine("USB Retrieve: " + dataTransferred + " " + responseBuffer.length);
if(dataTransferred >= 0){
    return responseBuffer;
}
throw new Exception("Error durring receinving response [" + dataTransferred + "]");

那个答案是

0x00 0x00 0x00 0x00 0x00 0xA0 0x00 0x41 0x03 0x00

但是，我应该得到一个答案0x90 0x00根据测试项目在这里 http://labs.a-trust.at/developer/ShowSource.aspx?id=114.

我究竟做错了什么？有谁能够帮助我？我使用正确的方法吗？我没有使用默认的包类javax.smartcardio。我使用 USB 接口类（例如USB设备 https://developer.android.com/reference/android/hardware/usb/UsbDevice.html） 直接地。

您的读卡器设备通过 USB 接口使用 CCID。您不能简单地通过批量输出端点发送 APDU（智能卡命令）并期望通过批量输入端点接收响应 APDU。相反，您需要实现 CCID 设备类协议（请参阅USB 设备类规范 http://www.usb.org/developers/docs/devclass_docs/）。步骤是这样的：

1. 发送PC_to_RDR_IccPowerOn命令激活卡。

   
   
   62 00000000 00 00 00 0000 
   |  |        |  |  |  |    |
   |  |        |  |  |  |    \--> Empty data field
   |  |        |  |  |  \-------> Unused, set to 0x0000
   |  |        |  |  \----------> Power select: 0x00 indicates automatic selection
   |  |        |  \-------------> Sequence number (increment for each command)
   |  |        \----------------> Slot number (seems to be zero for your device)
   |  \-------------------------> Length of data field (LSB first)
   \----------------------------> Message type: 0x62 indicates PC_to_RDR_IccPowerOn
     

2. 通过 RDR_to_PC_DataBlock 接收 ATR。

   
   
   80 18000000 00 00 00 00 00 3BBF11008131FE45455041000000000000000000000000F1 
   |  |        |  |  |  |  |  |
   |  |        |  |  |  |  |  \--> Data field: ATR
   |  |        |  |  |  |  \-----> Level parameter
   |  |        |  |  |  \--------> Error register (should be zero on success)
   |  |        |  |  \-----------> Status register (should be zero on success)
   |  |        |  \--------------> Sequence number (matches the sequence number of the command)
   |  |        \-----------------> Slot number (matches the slot number of the command)
   |  \--------------------------> Length of data field (LSB first)
   \-----------------------------> Message type: 0x80 indicates RDR_to_PC_DataBlock
     

3. 发送命令 APDU 封装在 PC_to_RDR_XfrBlock 命令中

   
   
   6F 0C000000 00 01 00 0000 00A4040C07A000000118454E
   |  |        |  |  |  |    |
   |  |        |  |  |  |    \--> Data field: Command APDU
   |  |        |  |  |  \-------> Level parameter (0x0000 for normal length APDUs)
   |  |        |  |  \----------> Block waiting timeout
   |  |        |  \-------------> Sequence number (increment for each command)
   |  |        \----------------> Slot number (seems to be zero for your device)
   |  \-------------------------> Length of data field (LSB first)
   \----------------------------> Message type: 0x6F indicates PC_to_RDR_XfrBlock
     

4. 通过 RDR_to_PC_DataBlock 接收响应 APDU。

   
   
   80 02000000 00 01 00 00 00 9000 
   |  |        |  |  |  |  |  |
   |  |        |  |  |  |  |  \--> Data field: Response APDU
   |  |        |  |  |  |  \-----> Level parameter
   |  |        |  |  |  \--------> Error register (should be zero on success)
   |  |        |  |  \-----------> Status register (should be zero on success)
   |  |        |  \--------------> Sequence number (matches the sequence number of the command)
   |  |        \-----------------> Slot number (matches the slot number of the command)
   |  \--------------------------> Length of data field (LSB first)
   \-----------------------------> Message type: 0x80 indicates RDR_to_PC_DataBlock
     

5. 对每个 APDU 交换重复步骤 3 和 4（不要忘记增加序列号）。

由于 ATR 指示 T=1 作为第一个协议，因此您可能需要将 APDU 包装为 T=1 TPDU（取决于读卡器配置）。第一个 APDU 的 I 块看起来像：

00 00 0C 00A4040C07A000000118454E 15
|  |  |  |                        |
|  |  |  |                        \--> LRC (due to missing TC in ATR): XOR checksum over all other bytes
|  |  |  \---------------------------> INF: APDU
|  |  \------------------------------> LEN: length of INF field
|  \---------------------------------> PCB: toggle between 0x00 and 0x40 for every other I-block
\------------------------------------> NAD: node addressing
  

因此，您的 PC_to_RDR_XfrBlock 命令如下所示：

6F 10000000 00 01 00 0000  00 00 0C 00A4040C07A000000118454E 15
  

然后，您将收到包含在 I 块或 R 或​​ S 块中的答案，表明需要进行一些特殊/错误处理。