Home

CHIPDRIVE CLOUD 4700F

1. CLOUD 47x0 F REFERENCE MANUAL 88 6 3 5 12 CONTACT GET SET WAITTIME This Escape command is used to get set the Character Block Waiting Time for smartcards The wait time is specified in terms of ETU Once set the new Wait time will take effect from the next card communication Input The input buffer contains the Escape code followed by an 8 bit GET SET identifier an 8 bit Wait time identifier and a 32 bit Wait time value BWT must be specified in units of 1 25ms and CWT in units of ETU ByteO Byte3 Byte4 Byte5 Byte6 Value Description Value Description Wait time in ETU Escape 0x01 SET Wait 0x00 CWT BIT31 23 BIT15 BIT7 code 0x81 time BIT24 BIT16 BIT8 BITO 0x01 BWT 0 00 GET Wait 0x00 CWT 5 E 2 time 0x01 BWT Output For both Get Set Wait time the output will be the following Byte0 Byte1 Byte2 Byte3 Wait time in ETU BIT31 BIT24 BIT23 BIT16 BIT15 BIT8 BIT7 BITO CLOUD 47x0 F REFERENCE MANUAL 89 6 3 5 13 CONTACT GET SET GUARDTIME This Escape command is used to get set the Character Block Guard Time of the reader The guard time is specified in terms of ETU Once set the new Guard time will take effect immediately Input The input buffer contains the Escape code followed by an 8 bit GET SET identifier an 8 bit guard time identifier and a 32 bit guard time value in ETU Byte0 Byte1 Byte
2. IDENTIVE Identive Infrastructure Reference Manual version 1 0 CLOUD 47x0 F Dual Interface Smartcard Readers Reference manual CLOUD 47x0 Dual Interface Smartcard Readers Identive GmbH Oskar Messter Strasse 13 85737 Ismaning Germany Phone 49 89 9595 5000 Fax 49 89 9595 5555 Document history Date Version Description of change 01 24 2013 Initial Version Contact information CLOUF 4700 F CLOUD 4710F For sales information please email sales identive infrastructure com Table of Contents 12 Eegal information ie rre eet doce de penu dd kee 9 Bis Bisclamers uie ex eni EU e 9 1 22 EICenses iieri rae eet t itu tert b tele 9 1 3 zBradematks 5 ite ete m e tie tif der e dert 9 2 Introduction to the manual enne enne enint 10 2 1 Objective of the 10 22 10 2 3 Product version corresponding to the 1 10 2 4 Definition of various terms nennen 11 2 5 References edite nga etate A ee ee 12 2 62 GOnVehltlofis xs ries a 13 3 General information about CLOUD 47 14 3 1 CLOUD 47x0 key benefits 14 3 2 CLOUD 47x0 F key 14 3 3 CLOUD 47x0 F ordering i
3. MIFARE 1507816 compliant contact smart card reader for ID 1 cards CLOUD 4700 F 1507816 compliant contact smart card reader for ID 000 cards CLOUD 4710 F PC SC v2 0 compliant Full CCID for both the contact and the contactless interfaces Secure in field SmartOS firmware upgrade Unique reader serial number which enables that CLOUD 47x0 F can be plugged into any USB slot on a PC without having to re install the driver Additionally the application S W running on the host can check for exact readers 249 bytes of non volatile user memory Cable exit in three directions to help you place the reader optimally Footstand for 40 angle available that could be used as wall mount adapter as well CLOUD 47x0 F REFERENCE MANUAL 15 3 3 CLOUD 47x0 F ordering information Item Part number CLOUD 4700 F 905320 CLOUD 4710 F 905324 Standing Base Kit 905412 3 4 Available options The Standing Base Kit consists of a stand and a wireholder It could be used to either place the reader on the desktop with an angle of 40 in regard to the desk or to mount it to a wall with a 40 angle in regard to that The wireholder keeps the contactless token in place when using this option 3 5 CLOUD 47x0 F customization options Upon request Identive GmbH can consider customizing e The color of the casing e The logo e The product label e The USB strings Terms and conditions apply please contact your local Identive representative or
4. Input The input buffer contains the escape code value 0 Escape code 0x05 Output Output buffer NULL CLOUD 47x0 F REFERENCE MANUAL 81 6 3 5 3 CONTACT EMV SINGLEMODE This Escape command lets the host perform a one shot EMV Loop back application as specified in the EMV Level 1 Testing Requirements document Input Byte0 Escape code 0x06 Output Output buffer NULL 6 3 5 4 CONTACT_EMV_TIMERMODE This Escape command lets the host perform a timer mode EMV Loop back application as specified in the EMV Level 1 Testing Requirements document Input The input buffer contains the escape code value Byte0 Escape code 0x07 Output Output buffer NULL CLOUD 47x0 F REFERENCE MANUAL 82 6 3 5 5 CONTACT APDU TRANSFER This Escape command exchanges a short APDU with the smart card The user has to ensure that a card is inserted and powered before issuing this Escape command This Escape command mostly is used by the MCard API to access synchronous memory cards Input The input buffer contains the Escape code value followed by the short APDU to be sent to the card Byte1 onwards Escape code 0x08 Short APDU to be sent to card Output Output buffer Response APDU 6 3 5 6 CONTACT_DISABLE_PPS This Escape command disables PPS done by the firmware device for smart cards This setting will take effect from the next card connect and remains effective till it is
5. 6 2 8 PAPDU MIFARE VALUE BLK OLD This command increments or decrements the data in a Value Block on a Mifare Classic card Command APDU Command Increment Decrement EF FO 00 1 Le Data OLD where P2 codes the block number The data field is structured as follows Byte Description B1 2 Block number B2 B5 a Value LSB first CLOUD 47x0 F REFERENCE MANUAL 39 Response APDU Status Word SW1 SW2 Example decrement block 4 by 1 key loading and authentication not shown block 4 has got to be set up as value block prior to executing this command see datasheet for Mifare Classic cards APDU FF BO 00 04 00 Read Block 4 SW12 9000 OK DataOut A9 AA AA AA 56 55 55 55 A9 AA AA AA 05 FA 05 FA 16 bytes APDU FF FO 00 04 06 CO 04 01 00 00 00 decrement block 4 by 1 SW12 9000 OK APDU FF BO 00 04 00 Read Block 4 SW12 9000 OK DataOut A8 AA AA 57 55 55 55 8 AA AA AA 05 FA 05 FA 16 bytes CLOUD 47x0 F REFERENCE MANUAL 40 6 2 9 PAPDU MIFARE VALUE BLK NEW This command increments or decrements the value ofa data object if the card supports it Refer to section 3 2 2 1 10 of PCSC3 AMD 1 for further details Command APDU Command CLA Increment BER peor ment FF C2 00 03 XX TLV 00 The data object consists of a TLV structure that defines which action should be performed which block the actions pertain to the destination s and whic
6. SCARD SHARE DIRECT SCARD PROTOCOL UNDEFINED amp CardHandle amp ActiveProtocol if ret SCARD S SUCCESS InByte 0 1 ret SCardControl CardHandle IOCTL CCID ESCAPE amp InByte 1 amp strReaderInfo Sizeof strReaderInfo amp BytesRead if SCARD S SUCCESS ret printf major version t t d d n strReaderInfo byMajorVersion amp OxF0 4 strReaderInfo byMajorVersion amp Ox0F printf minor version t t d d n strReaderInfo byMinorVersion amp OxF0 4 strReaderInfo byMinorVersion amp Ox0F amp ContextHandle printf modes t t t d n strReaderInfo bySupportedModes printf protocols t t 04x n strReaderInfo wSupportedProtocols printf input device t t 04x n strReaderInfo winputDevice printf personality t t d n strReaderInfo byPersonality printf maxslots t t d n strReaderInfo byMaxSlots printf serial no length t d n strReaderInfo bySerialNoLength printf serial no t t for i 0 i lt strReaderInfo bySerialNoLength i if strReaderInfo abySerialNumber i 0 printf c strReaderInfo abySerialNumber i else printf SCardControl failed 08X n ret else printf SCardConnect failed 08X n ret CLOUD 47x0 F REFERENCE MANUAL 94 ret SCardReleaseContext ContextHandle else printf n SCardEstablishContext failed with 81X ret printf npress any key to close the test too
7. e Windows Server 2008 32 amp 64 bit e Windows 7 32 amp 64 bit e Windows 8 32 amp 64 bit e MacOS X e Linux CLOUD 47x0 F REFERENCE MANUAL 5 3 3 PC SC 2 0 compliant ATR for contactless interface When a user credential is placed on the reader initialization anti collision is done The user credential is automatically activated and an ATR is built as defined in the PC SC specification For further information please refer to section 3 1 3 2 3 of PCSC3 and to PCSC3 SUP 5 3 3 1 ATR for contactless storage user tokens The ATR of the credential is composed as described in the table below In order to allow the application to identify the storage card properly it s Standard and Card name describing bytes must be interpreted according to the Part 3 Supplemental Document maintained by PC SC Credentials using technology like MIFARE are examples of this Byte Value Designation Description o ose inttatneader J init Ox8n TO n indicates the number of historical bytes in following ATR 2 0x80 TD1 upper nibble 8 indicates no TA2 TB2 TC2 lower nibble 0 means T 0 D2 i 3 0x01 T upper nibble 0 indicates no TB3 TC3 lower nibble 1 means T 1 4 3 n 0x80 A status indicator may be present in an optional TLV data object Optional TLV data object p oon 0000000000 XoRsalpeWusbyes Example of the ATR built for contactless storage tokens MIFARE Classic 4K MIFARE Ultralight E I
8. 6 2 1 PAPDU_MIFARE_READ_ 31 6 2 2 PAPDU MIFARE UPDATE 32 6 2 3 PAPDU MIFARE LOAD 5 33 6 2 4 MIFARE 35 6 2 5 PAPDU MIFARE READ 36 6 2 0 PAPDU MIFARE READ SECTOR 37 6 2 7 PAPDU MIFARE WRITE 38 6 2 8 PAPDU MIFARE VALUE BLK 38 6 2 9 PAPDU MIFARE VALUE 40 6 2 10 PAPDU TCL PASS THRU T CL Pass 41 6 2 11 PAPDU 15014443 PART3 PASS THRU Mifare Pass 42 6 2 12 PAPDU 15014443 PART4 SWITCH TCL Mifare Switch 42 6 219 PAPDU FELICA REQ C iiti tanien trina echas riae nsa Hte a eT 43 6 2 14 PAPDU FELICA REQ 43 6 2 15 PAPDU FELICA 44 6 2 16 PAPDU FELICA READ 44 6 2 17 PAPDU FELICA WRITE nnns 45 6 2 18 PAPDU FELICA SYS 45 6 2 19 PAPDU TYPE1 TAG 46 6 2 20 PAPDU TYPE1 TAG enne nennen nnns 46 6 2 24 PAPDU TYPE1 TAG 47 6 2 22 PAPDU TYPE1 TAG WRITE 47 6 2 23 PAPDU
9. TYPE1 TAG WRITE nennen 48 6 2 24 PAPDU TYPE1 TAG 5 49 6 2 25 PAPDU TYPE1 TAG 8 49 6 2 26 PAPDU TYPE1 TAG WRARITE 50 6 2 27 PAPDU TYPE1 TAG WARITE NEB8 seems 50 6 3 Escape commands for the CLOUD 47 nnns 51 6 3 1 Sending Escape commands to CLOUD 47x0 F 51 6 3 2 Escape command 52 6 3 8 for Contact and Contactless 52 6 3 3 1 READER SETMODE titre etre 52 6 3 3 2 READER GETMODBDE ih cie ca lel ert eite de 53 6 3 3 3 READER GET IEDTYPE 3 nisi aie gus 54 6 3 3 4 READER LED CONTRO ERR 54 6 3 3 5 READER GET INFO 55 7 6 3 3 6 READER LED CONTROL 56 6 3 3 7 READER RD WR USER AREA 56 6 3 3 8 READER GENERIC ESCAPE de d nte eie e RO 57 6 3 3 9 READER CONTROL CONTACT 58 6 3 4 Specific for Contactless 59 6 3 41 SONTLESS BETSCARDEINEOG c Ert eca 59 6 3 4 2 CNTLESS_GET_ATS_ATQB diete eet E eR 61 6 3 4 3 CNTLESS GONTROL PPS setup 61 6 3
10. 0x01 SW1 Sw2 6 2 14 PAPDU FELICA REQ SERVICE This command issues a REQ SERVICE as defined in JIS 9 6 2 P1 On receiving this command an NFC Forum tag type 3 will respond with the area key version of the specified area and the service key version of the specified service Command APDU Command FeliCa REQ 42 Number of 00 2 Service Code List Service services areas P1 Area Code List Response APDU Status Word 8 bytes IDm No of Service or areas n Service version or area version list 2 n SW1 SW2 CLOUD 47x0 F REFERENCE MANUAL 44 6 2 15 PAPDU FELICA REQ RESPONSE This command issues a REQ RESPONSE as defined in JIS 9 6 1 When an NFC Forum tag type 3 receives this command it responds with its current mode 0 1 2 Command APDU Command 44 00 00 00 Response Response APDU Status Word 8 bytes IDm Mode SW1 SW2 6 2 16 PAPDU FELICA READ BLK This command issues a READ as defined in JIS 9 6 3 e specifies the number of service 2 specifies the number of blocks e Data buffer specifies the service code and block list When an NFC Forum tag type 3 receives this command it responds with the record value of the specified service Command APDU Command Service Bs m FF 46 jc 2 P1 P2 Code List vole Block List Response APDU Status Word 8 bytes IDm Status Flag 1 Status Flag 2 No of blocks n Block data n 16 O
11. 4 4 CNTLESS RF SWITGH n ente Ree e aint eins 62 6 3 4 5 CNTLESS SWITCH RF nnns 62 6 3 4 6 55 GET BAUDRATE ete dete Inde ci Ret edere 63 6 3 4 7 CNTLESS CONTROL RETRIES sse 64 6 3 4 8 CNTLESS CONTROL 65 6 3 4 9 CNTLESS GET CARD DETAILS essere 65 6 3 4 10 55 SET CONFIG 8 67 6 3 4 11 CNTLESS IS COLLISION 2 0 4 01 68 6 3 4 12 CNTLESS FELICA PASS THRU nennen 68 6 3 4 13 CNTLESS P2P SWITCH 1er ener enne nennen 69 6 3 4 14 CNTLESS P2P TARGET RECEIVE sse eene nennen nnns 72 6 3 4 15 CNTLESS P2P TARGET SEND nennen nnne nnne nnne 73 6 3 4 16 CNTLESS P2P INITIATOR DESELECT sss 73 6 3 4 17 CNTLESS P2P INITIATOR TRANCEIVE 4 6 74 6 3 4 18 CNTLESS SINGLESHOT sse eene nennen 75 6 3 4 19 CNTLESS sse aa enne enr nnne nennen 75 6 3 4 20 CNTLESS GET SET 68 444 76 6 3 4 21 CNTLESS GET P2P EXTERNAL RF 5 77 6 3 5 Specific for Contact 78 6
12. 89 80 01 4A 43 4F 50 33 31 56 32 32 4A Value hex 3B 89 80 01 4A 43 4F 50 33 31 56 32 32 JCOP31V22 4A Checksum Ww Identive CLOUD 4700 Contact Reader Identive CLOUD 4700 F Contactless Reader 188 ATR BE CPU card SCR3340 Express Card Reader 38 88 80 01 5 11 73 81 5 0003 Value hex Meaning 38 direct 88 8 historical characters 80 protocol 0 01 protocol 1 E1F3 5E 11 73 81 5 00 a6 s 03 Checksum CLOUD 47x0 F REFERENCE MANUAL 27 5 4 Firmware 5 4 1 CCID transport protocol CLOUD 47x0 F implements a transport protocol that is compliant with USB Device Class Smart Card CCID Specification for Integrated Circuit s Cards Interface Devices Revision 1 10 This paragraph describes the CCID specification features that are implemented 5 4 1 1 CCID class requests supported e Abort 5 4 1 2 CCID messages supported The following CCID messages are supported for the contact interface when received through bulk out endpoint e to e to to RDR GetSlotStatus e to RDR XfrBlock e to GetParameters e to ResetParameters e PC to RDR SetParameters e to Escape e to ICCClock PC to RDR TOAPDU e to Abort e to SetDataRateAndClockFrequency 5 4 1 3 CCID Error Codes Extensive error codes are reported on
13. Block READ BLOCK FF 5 00 Addr 2 Where P2 Block Address is Bit numbers Description b7 b0 General block 0x00 Response APDU Status Word 8 bytes of data SW1 SW2 CLOUD 47x0 F REFERENCE MANUAL 50 6 2 26 PAPDU NFC TYPE1 TAG WRITE E8 This command issues a WRITES to erase and then write a block of eight bytes Please note that this command only works on Topaz tags in dynamic memory model Command APDU Command TYPE1 Tag WRITE and FF 5E 00 08 Data ERASE BLOCK Where P2 Block Address is Bit numbers Description b7 b0 General block 0x00 OxFF Response APDU Status Word 8 bytes of data that have been written SW1 SW2 6 2 27 PAPDU_NFC_TYPE1_TAG_WRITE_NE8 This command issues a WRITE8 to write a block of eight bytes It does not erase the value of the targeted byte before writing the new data Using this command EEPROM bits can be set but not reset Please note that this command only works on Topaz tags in dynamic memory model Command APDU Command TYPE1 Tag Block WRITE and NO FF 60 00 Addr 08 Data ERASE BLOCK Where P2 Block Address is Bit numbers Description b7 b0 General block 0x00 OxFF Response APDU Status Word 8 bytes of data SW1 SW2 CLOUD 47x0 F REFERENCE MANUAL 51 6 3 Escape commands for the CLOUD 47x0 F With Amendment 1 of the PC SC specification Part 3 a method to define vendor spec
14. Field OFF when contact No Output card is present in the reader 1 Leave RF Field ON when contact Escape card is present in the reader code 0x9C 0x00 RF is OFF when contact OFF et current eid stato Rae card is present in the reader After the RF is turned off to turn the RF ON again card connect has to be done in direct mode CLOUD 47x0 F REFERENCE MANUAL 63 Output No response is returned for set state For Get State 1 byte response is received Output buffer NULL or current state 6 3 4 6 CNTLESS GET BAUDRATE This Escape command is used to get the current baud rate of card reader communication Input The first byte of input buffer contains the escape code ByteO Escape code 0x9E Output The output contains a byte with the following possible values 0 Description 106Kbps in both directions 106Kbps from PICC to PCD 212Kbps from PCD to PICC 106Kbps from PICC to PCD 424Kbps from PCD to PICC 106Kbps from PICC to PCD 848Kbps from PCD to PICC 212Kbps from PICC to PCD 106Kbps from PCD to PICC 212Kbps in both directions 212Kbps from PICC to PCD 424Kbps from PCD to PICC 212Kbps from PICC to PCD 848Kbps from PCD to PICC 424Kbps from PICC to PCD 106Kbps from PCD to PICC 424Kbps from PICC to PCD 212Kbps from PCD to PICC 424Kbps in both directions CLOUD 47x0 F REFERENCE MANUAL 64 6 3 4 7 CNTLESS CONTROL RETR
15. This command issues a RALL to read the two header ROM bytes and the whole of the static memory blocks 0 0 0 Command APDU Command TYPE1 Tag RALL FF 52 00 00 00 Response APDU Status Word HRO HR1 120 bytes Blocks 0 E SW1 SW2 CLOUD 47x0 F REFERENCE MANUAL 47 6 2 21 PAPDU NFC TYPE1 TAG READ This command issues a READ to read a single EEPROM memory byte within the static memory model area of blocks 0x0 OxE Command APDU Command TYPE1 Tag READ FF 54 00 Byte Addr 00 Where 2 codes the address of the memory byte in the following way Bit numbers Description b7 b3 Block value between 0x0 and OxE 02 00 Byte within the block value between 0 and 7 Response APDU Status Word Data returned by card SW1 SW2 6 2 22 PAPDU 1 TAG WRITE E This command issues a WRITE to erase and then write the value of 1 memory byte within the static memory model area of blocks 0x0 OxE Command APDU Command TYPE1 Tag WRITE ERASE FF 56 00 Byte 01 Data Where P2 codes the address of the memory byte in the following way Bit numbers Description b7 b3 Block value between 0x0 and OxE 02 00 Byte within the block value between 0 7 Response APDU Status Word Data returned by card SW1 SW2 CLOUD 47x0 F REFERENCE MANUAL 48 6 2 23 PAPDU NFC TYPE1 TAG WRITE NE This command issues a WRITE NE to write a
16. changed again or the next Reader power on Default mode is PPS enabled Input The first byte of the input buffer contains the Escape code and the following byte if 1 disables PPS and if 0 enables PPS ByteO Byte1 Escape code 0x0F PPS control byte 1 DISABLES PPS 0 ENABLES PPS Output Output buffer NULL CLOUD 47x0 F REFERENCE MANUAL 83 6 3 5 7 CONTACT EXCHANGE RAW This Escape command can be used to perform raw exchange of data with the card The user must ensure that a card is inserted and powered on before issuing this Escape command The Card is deactivated upon any reception error Input The input buffer for this command contains the Escape code low byte of the length of data to be sent high byte of length of data to be sent low byte of the length of expected data high byte of length of expected data and the command Byte1 5 onwards Escape LSB of send MSB of send LSB of expected MSB of Raw data to code 0x10 length length length expected the card length Output Output buffer Response APDU CLOUD 47x0 F REFERENCE MANUAL 84 6 3 5 8 CONTACT GET SET CLK FREQUENCY This Escape command is used to instruct the reader to change the clock for the smart card or to get the current Clock divisor used Once set the change in frequency will take effect immediately Default divisor value is 10 that is 4 8MHz Input The first byte of the input buffer contains
17. many conditions during all CCID responses Most of the error messages are reported by the CCID appropriately Some of the main error codes for the contact interface are e HW ERROR XFR PARITY ERROR e CC PROTOCOL NOT SUPPORTED BAD ATR TS BAD e MUTE CMD ABORTED e Command not supported CLOUD 47x0 F REFERENCE MANUAL 28 The following sub sections discuss when and why these error codes are returned 5 4 1 3 1 HW_ERROR This error code is returned when a hardware short circuit condition is detected during application of power to the card or if any other internal hardware error is detected 5 4 1 3 2 XFR_PARITY_ERROR This error code is returned when a parity error condition is detected This error will be reported in the response to to RDR XfrBlock message 5 4 1 3 3 PROTOCOL NOT SUPPORTED This error code is returned if the card is signaling to use a protocol other than T 0 or T 1 in its ATR 5 4 1 3 4 BAD ATR TS This error code is returned if the initial character of the ATR contains invalid data 5 4 1 3 5 BAD ATR This error code is returned if the check character of the ATR contains is invalid 5 4 1 3 6 ICC_MUTE This error code is returned when the card does not respond until the reader time out occurs This error will be reported in the response to PC to RDR XfrBlock message and PC to RDR messages 5 4 1 3 7 CMD ABORTED This err
18. parameter for the function ByteO Escape code 0x04 Byte1 Byte2 Value Description Starts with Class C voltage _ 1 8V 3V 5V order Starts with Class A voltage _ 0x01 5 1 8V order 0x08 Time delay between resets Delay value in milliseconds Bit Map of all Voltage Classes BitO Class Bit1 Class B Bit2 Class C Enable Disable Voltage 0x09 Glass Set bit to enable the Voltage class Clear bit to disable the Voltage class Retrieves all the Activation Configuration Retrieves the current Power up _ sequence CLOUD 47x0 F REFERENCE MANUAL 80 Output For retrieving all settings OxFE the output will be 0 Byte 1 Byte2 Value Description Starts with Class C voltage Bit Map of all Voltage 1 8V 3V 5V order Classes Between Class Bill e Starts with Class A voltage rasats i Class Bit2 Class C Ox01 5 1 8V order For retrieving current Power up sequence the output will be ByteO Value Description Starts with Class C voltage 1 8V 3V 5V order 0x00 T Starts with Class A voltage 5V 3V 1 8V order x 6 3 5 2 CONTACT EMV LOOPBACK This Escape command lets the host force the firmware to perform an EMV Loop back application
19. the Escape code the next byte contains the clock divisor value to set the clock frequency or OxFF to get the clock frequency Escape code 0x1F Clock divisor Description The value to be Set in the smartcard CLK divisor register OxFF Get current Clock divisor value Output Set clock frequency None Get clock frequency One byte value indicating the current Clock divisor Output buffer NULL or current divisor Clock Divisor values DIVISOR VALUE SCCLK Frequency 12 4 MHz 10 4 8 MHz 8 6 MHz 7 6 8 MHz 6 8 MHz 5 9 6 MHz 4 12 MHz 3 16 MHz CLOUD 47x0 F REFERENCE MANUAL 85 6 3 5 9 CONTACT CONTROL ATR VALIDATION This Escape command is used to enable or disable the ATR validation by the firmware in ISO IEC 7816 mode In case the card would emit an ATR that is not ISO IEC 7816 compliant the card reader may fail to power up the card In these cases disabling ATR validation will let you work with the card regardless of ISO conformity of the ATR By default ATR validation is enabled Input The first byte of the input buffer will contain the Escape code the next byte will contain the control byte Escape code 0x88 Byte1 Value Description 0x00 Enable ATR validation 0x01 Disable ATR validation Output Output buffer NULL CLOUD 47x0 F REFERENCE MANUAL 86 6 3 5 10 CONTACT GET SET
20. to the host computer e Target On successful detection by the initiator the entire ATR_REQ buffer from the initiator device would be given to the host computer e Reader Mode The output buffer would be empty e Get Current A single byte response indicating the currently selected mode as described below o 0x00 gt 2 Initiator mode o 0 01 gt 2 Target mode o 0x02 gt Reader Writer mode CLOUD 47x0 F REFERENCE MANUAL 72 6 3 4 14 CNTLESS_P2P_TARGET_RECEIVE This Escape command is used to receive data from the initiator device Prior to using this command the device should have been successfully switched to target mode using CNTLESS P2P SWITCH MODES E9 Input Buffer Offset Description Detailed description 0 OxEA Target Receive 1 RFU 2 RFU 3 RFU 4 d i Chaining byte 1 Chaining 5 Timeout Low Byte 6 Timeout High Byte Output Buffer On successful reception the entire data from the initiator device would be returned from offset 0x04 Offset Description Detailed description 0 RFU 1 RFU 2 RFU 3 0 No Chaining Chaining 1 Chaining Offset 4 to N data bytes Bytes Received offset 4 N CLOUD 47x0 F REFERENCE MANUAL 73 6 3 4 15 CNTLESS P2P TARGET SEND This Escape command is used to send data to an initiator device Prior to using this command the device should have been successfully switched to targe
21. 060708 0AO0BOCOD 0 101112 then the following explains the steps needed to calculate the key for secure mode Default reader key 00010203 05060708 OAOBOCOD 0 101112 Mifare Key to be loaded DFEFFFFFFF FFFF Mifare key after padding FFFFFFFF 0 0A0A0A0A AES128 Encrypted 10229E33 189403FD A9C14110 1 02 4 Load keys command FF82406010 10229E33 189403FD A9C14110 2 4 Load Keys Reader Secure If the default AES128 reader is key is 00010203 05060708 0AO0BOCOD 0 101112 then the following explains the steps needed to change the reader key to 10111213 15161718 1A1B1C1D 1F202122 Reader old key A 00010203 05060708 0 0 0 0 101112 Reader new key B 10111213 15161718 1A1B1C1D 1F202122 C 10101010 10101010 10101010 10303030 D CRC16 C D 1 5 E 0x00 D E 1 should be appended in LSB order F AES Encrypt C F 886 0872 7BDA4996 D296FB46 09D2C75F Load Keys Command G FF82E00012 886B0872 7 4996 D296FB46 09D2C75F 1 CLOUD 47x0 F REFERENCE MANUAL 35 6 2 4 PAPDU_MIFARE_AUTHENTICATE This command is used to authenticate using the key number Refer to section 3 2 2 1 6 of PCSC3 for further details Command APDU Command CLA General Authenticate OxFF 0x86 0x00 0x00 0x05 data the data structure is defined as follows Byte Value Description EE B1 Block Number MSB always 0x00 for Mi
22. 2 Byte3 Byte4 Byte5 Byte 6 Value Description Value Description Guard time in ETU Escape 0x01 SET Guard 0x00 CGT BIT31 BIT23 BIT15 BIT7 code 0x82 time BIT24 BIT16 BIT8 BITO 0x01 BGT 0x00 GET Guard 0x00 CGT 3 time 0x01 BGT Output For Get Set guard time the output will be the Character Block Guard Time value Byte1 Byte2 Byte3 Character Guard time ETU BIT31 BIT24 BIT23 BIT16 BIT15 BIT8 BIT7 BITO CLOUD 47x0 F REFERENCE MANUAL 90 6 3 5 14 CONTACT_READ_INSERTION_COUNTER This Escape command is supported through the READER GENERIC ESCAPE command and retrieves the number of times a contact smart card has been inserted into the reader Input The first five bytes of the input buffer follow APDU structure as per PCSC3 AMD1 The 6 byte is the Escape code 0x00 to identify the command Byte0 Byte1 Byte2 Byte3 Byte4 Byte5 220 4 Insertion counter is a 4 byte OxFF 0x70 0 04 OxE6 0x01 Escape code value Output Byte1 Byte2 Byte3 Byte4 5 Insertion counter value SW1 SW2 BIT31 BIT24 BIT23 BIT16 BIT15 BIT8 BIT7 BITO 0x90 0x00 In case of any error only SW1 and SW2 set with error status will be returned CLOUD 47x0 F REFERENCE MANUAL 91 7 Annexes 7 1 Annex A Status words table MEMORY FAILURE LENGTH INCORRECT CLASS BYTE INCORRECT FUNCTION NOT SUPPORTED WRON
23. 3 5 1 CONTACT GET SET PWR UP 79 6 3 5 2 CONTACT 07 nennen nnne 80 6 3 5 3 CONTACT 0 2 4004 81 6 3 5 4 CONTACT EMV 81 6 3 5 5 CONTACT APDU 5 82 6 3 5 6 CONTACT DISABLE PPS ia 82 6 3 5 7 CONTACT EXCHANGE 83 6 3 5 8 CONTACT GET SET 84 6 3 5 9 CONTACT CONTROL ATR 85 6 3 5 10 CONTACT GET SET MCARD 86 6 3 5 11 CONTAC TAGE ha tee gnis 87 6 3 5 12 CONTACT GET SET WAITTIME 88 6 3 5 13 CONTACT GET SET 89 6 3 5 14 CONTACT READ INSERTION 90 LUCI 91 7 1 Status words table T IEEE 91 7 2 Annex Sample code using escape 92 7 3 Annex C Mechanical drawings sss 95 7 3 1 7 3 2 7 3 3 7 3 4 Outline and cable positions 95 Stand Reader mounted to Stand CLOUD 4710 F SAM slot CLOUD 47x0 F REFEREN
24. 816 4 ISO IEC 7816 4 1995 E ISO IEC 14443 3 Identification cards Contactless ISO IEC integrated circuit s cards Proximity cards Part 3 Initialization and anticollision ISO IEC 14443 4 Identification cards Contactless integrated ISO IEC circuit s cards Proximity cards Part 4 Transmission protocol ISO IEC 14443 4 2001 E Computer Systems v2 01 PCSC3 Interoperability Specification for ICCs and Personal PC SC Workgroup Computer Systems Part 3 Requirements for PC Connected Interface Devices Interoperability Specification for ICCs and Personal PC SC Workgroup PCSC3 AMD1 Computer Systems Part 3 Requirements for PC Connected Interface Devices Amendment 1 Interoperability Specification for ICCs and Personal PC SC Workgroup Computer Systems Part 3 Supplemental Document Interoperability Specification for ICCs and Personal PC SC Workgroup Identification cards Integrated circuit ISO IEC cards Part 3 Cards with contacts Electrical interface and transmission protocols Identification cards Integrated circuit s cards with ISO IEC contacts PCSC3 SUP2 Computer Systems Part 3 Supplemental Document for Contactless ICCs CCID Specification for Integrated Circuit s Cards USB IF Interface Devices 1 1 Universal Serial Bus Specification 2 0 USB IF EV1 cards Plus cards CLOUD 47x0 F REFERENCE MANUAL 13 2 6 Conven
25. CE MANUAL 1 Legal information 1 1 Disclaimers The content published in this document is believed to be accurate Identive Gmbh does not however provide any representation or warranty regarding the accuracy or completeness of its content and regarding the consequences of the use of information contained herein If this document has the status Draft its content is still under internal review and yet to be formally validated Identive GmbH reserves the right to change the content of this document without prior notice The content of this document supersedes the content of previous versions of the same document The document may contain application descriptions and or source code examples which are for illustrative purposes only Identive GmbH gives no representation or warranty that such descriptions or examples are suitable for the application that the reader may want to use them for Should you notice problems with the provided documentation please provide your feedback to support identive group com 1 2 Licenses If the document contains source code examples they are provided for illustrative purposes only and subject to the following restrictions e You MAY at your own risk use or modify the source code provided the document in applications you may develop You MAY distribute those applications ONLY in form of compiled applications e You MAY NOT copy or distribute parts of or the entire source code without prior wr
26. CNTLESS CONTROL PPS 0x99 define CNTLESS RF SWITCH 0x96 define CNTLESS SWITCH RF ON OFF 0x9C define CNTLESS GET BAUDRATE 0 9 define CNTLESS CONTROL RETRIES OxA7 define CNTLESS CONTROL POLLING OxAC define CNTLESS CARD DETAILS define CNTLESS SET CONFIG PARAMS 0 1 define CNTLESS IS COLLISION DETECTED OxE4 define CNTLESS FELICA PASS THRU OxF3 define CNTLESS P2P SWITCH MODES 0 9 define CNTLESS 2 TARGET RECEIVE OxEA define CNTLESS P2P TARGET SEND define CNTLESS P2P_IN TIATOR_TRANSCEIVE OxE7 define CNTLESS NFC SINGLESHOT OxEC define CNTLESS NFC LOOPBACK OxED ifdef cplusplus endif endif CLOUD 47x0 F REFERENCE MANUAL 93 File Name CLOUD 47x0 F Escape c include windows h include winbase h include lt stdio h gt include lt conio h gt include winscard h include winerror h include CLOUD 47x0F Escape h VOID main VOID SCARDCONTEXT ContextHandle SCARDHANDLE CardHandle ReaderInfoExtended StrReaderInfo BYTE InByte i DWORD BytesRead ActiveProtocol ULONG ret char SF char ReaderName Identive CLOUD 4700 Tdentive CLOUD 4700 F Contactless Reader 0 NULL F Contact Reader 0 BRK KKK RR KK HK A KR KK KK e e ContextHandle 1 ret SCardEstablishContext SCARD SCOPE USER NULL NULL if ret SCARD S SUCCESS s ReaderName 0 printf Connecting to reader s n s ret SCardConnect ContextHandle 5
27. D support my d move SLE 66RxxP my d move SLE 66RxxPN SLE 66RxxS SLE 55RxxE enabled Smart Phones and Tablets Cards supported ISO 1 4443A and B Yes compliant Number of slots Ejection mechanism 3 tested with available device during development amp qualification phase CLOUD 47x0 F REFERENCE MANUAL 24 5 Software modules 5 1 Installation On Operating Systems with a CCID driver pre installed no installation is necessary Where there s no CCID driver pre installed e g Linux systems or old Windows systems the driver has to be installed using distribution specific measures or using the available source packages Nevertheless due to some limitations of the available CCID drivers under some circumstances Identive does provide a dedicated driver for this reader as well which is available through Windows Update or on the Identive support pages 5 2 Utilities The following utilities are available A tool for testing the resource manager A tool called PCSCDiag capable of providing basic information about the reader and card through PC SC stack 5 3 Driver 5 3 1 CLOUD 47 0 F listing CLOUD 47X0 F is listed by PC SC applications as CLOUD 47X0 Contact Reader lIdentive CLOUD 47X0 Contactless Reader 5 3 2 Supported operating systems e Windows XP 32 amp 64 bit e Windows 2003 Server 32 amp 64 bit e Windows Vista 32 amp 64 bit
28. ESCAPE COMMAND ESCAPE CODE CNTLESS GETCARDINFO 0x11 CNTLESS_GET_ATS_ATQB 0x93 CNTLESS_CONTROL_PPS 0x99 CNTLESS_RF_SWITCH 0x96 CNTLESS_SWITCH_RF_ON_OFF 0 9 CNTLESS_GET_BAUDRATE Ox9E CNTLESS_CONTROL_RETRIES CNTLESS_CONTROL_POLLING 55 GET CARD DETAILS OxDA CNTLESS SET CONFIG PARAMS OxE1 CNTLESS IS COLLISION DETECTED OxE4 CNTLESS_FELICA_PASS_THRU CNTLESS_P2P_SWITCH_MODES OxE9 CNTLESS P2P TARGET RECEIVE OxEA CNTLESS P2P TARGET SEND OxEB CNTLESS P2P INITIATOR DESELECT OxE6 CNTLESS P2P INITIATOR TRANSCEIVE OxE7 CNTLESS_NFC_SINGLESHOT OxEC CNTLESS_NFC_LOOPBACK OxED CNTLESS GET SET NFC PARAMS READER ESCAPE GENERIC 0x04 CNTLESS GET P2P EXTERNAL RF STATE READER ESCAPE GENERIC 0x06 6 3 41 CNTLESS GET CARD INFO This Escape command is used to get information about the contactless card placed in the field of the reader Input The first byte of input buffer contains the escape code 0 Escape code 0x1 1 CLOUD 47x0 F REFERENCE MANUAL 60 Output ByteO Contactless card present 0x01 Byte1 Card to Reader communication baud rate OxNN see table below for details Byte2 Card Type Info Upper nibble indicates memory card T CL dual mode card Lower nibble indicates Type A Type B card See Table below for values Card to Reader communication baud rate BYTE is defined as follows 212kbps supported direction reader to car
29. G PARAMETER P1 P2 INVALID INSTRUCTION BYTE CLASS NOT SUPPORTED CLOUD 47x0 F REFERENCE MANUAL 7 2 Annex Sample code using escape commands File Name CLOUD 47x0 F Escape h ifndef CLOUD 47x0F ESCAPE H define CLOUD 47x0F ESCAPE H ifdef cplusplus extern C endif pragmapack 1 typedefstruct BYTE byMajorVersion BYTE byMinorVersion BYTE bySupportedModes WORD wSupportedProtocols WORD winputDevice BYTE byPersonality BYTE byMaxSlots BYTE bySerialNoLength BYTE abySerialNumber 28 ReaderInfoExtended pragmapack define IOCTL CCID ESCAPE SCARD CTL CODE OxDAC define READER SET MODE 0x01 define READER GET MODE 0x02 define READER GETIFDTYPE 0x12 define READER LED CONTROL 0x19 define READER LED CONTROL BY FW OxB2 define READER GETINFO EXTENDED Ox1E define READER RDWR USR AREA OxFO define CONTACT GET SET POWERUPSEQUENCE 0x04 define CONTACT EMV LOOPBACK 0x05 define CONTACT EMV SINGLEMODE 0x06 define CONTACT EMV TIMERMODE 0x07 define CONTACT APDU TRANSFER 0x08 define CONTACT CONTROL PPS OxOF define CONTACT EXCHANGE RAW 0x10 define CONTACT GET SET CLK FREQUENCY OxlF define CONTACT GET SET ETU 0x80 define CONTACT GET SET WAITTIME 0x81 define CONTACT GET SET GUARDTIME 0x82 define CONTACT GET SET MCARD TIMEOUT 0x85 define CONTACT CONTROL ATR VALIDATION 0x88 define CNTLESS GETCARDINFO 0x11 define CNTLESS GET ATS 0x93 define
30. IES This Escape command is used to enable disable CRC PROTOCOL TIMEOUT error retries which are enabled by default for contactless cards Input The first byte of input buffer contains the escape code The second byte either sets the mode or contains a code to retrieve the setting Input Byte1 Description 0x00 Enable RNAK retries No Output Escape 0x01 code 0xA7 Disable RNAK retries No Output OxFF 0x00 Retries are enabled Get current state of retries 0x01 Retries are disabled Output No response is returned for set state For Get State 1 byte response is received Output buffer NULL or current state CLOUD 47x0 F REFERENCE MANUAL 65 6 3 4 8 CNTLESS CONTROL POLLING This Escape command is used to enable disable firmware polling for contactless cards Input The first byte of input buffer contains the escape code The second byte either sets the mode or contains a code to retrieve the setting Input Byte1 Description 0x00 Enable polling No output Escape 0x01 Disable polling No output code 0xAC Get current state of 0x00 Polling enabled polling 0x01 Polling disabled Output No response is returned for set state For Get State 1 byte response is received Output buffer NULL or current state 6 3 4 9 CNTLESS GET CARD DETAILS This Escape command is used to get details about the PICC placed in the field of the reader Inpu
31. LOUD 47x0 F REFERENCE MANUAL 68 6 3 4 11 CNTLESS IS COLLISION DETECTED This Escape command is used to identify if multiple Type A cards are detected in the field Input The first byte of input buffer contains the escape code 0 Escape 4 Output 0 Value Description 0x00 0x01 Collision is detected Collision is not detected 6 3 4 12 CNTLESS FELICA PASS THRU This Escape command is used as a pass through to send FeliCa commands to FeliCa cards Input The first byte of input buffer contains the escape code followed by FeliCa command to be sent to the card At least 1 byte of command is required to be sent to the card Otherwise an error will be reported 0 Byte1 onwards Escape code 0 FeliCa command bytes Output The response received from the FeliCa card is sent as output for this escape command CLOUD 47x0 F REFERENCE MANUAL 6 3 4 13 CNTLESS P2P SWITCH MODES This Escape command is used to switch the device between the reader writer and P2P modes of operation and to query the current mode By default the device is in the reader writer mode Input The first byte of input buffer contains the escape code The second byte either sets the mode or contains a code to retrieve the setting Additional data bytes will be needed for Initiator Target mode Offset Description Detailed descripti
32. MANUAL 57 Input The first byte of the input buffer contains the escape code The second byte specifies if user area is to be read or written as described below Byte1 Byte2 to Byte251 Value Description Escape code 0xF0 1 Read 249 bytes of user data None 2 Write 249 bytes of user data Data to be written Output Read 249 bytes of user data Write No bytes returned 6 3 3 8 READER_GENERIC_ESCAPE This Escape command is used to invoke newly defined escape functions and send proprietary commands to the reader It is defined in line with vendor specific generic command defined in PCSC3 AMD1 Input The first five bytes of the input buffer shall follow APDU structure as per PCSC3 AMD1 67 byte shall be the command code used to identify the specific command From Byte5 up to Lc bytes ByteO Byte1 Byte2 Byte3 Byte4 Byte 5 Byte 6 onwards ByteLc 5 Lc always Cmd Command Le gt 0 Opcode parameters or data optional OxFF 0x70 0x04 OxE6 Output Depending on the command the output shall be Le bytes of data SW1 SW2 or SW1 SW2 The escape message shall at least return 2 bytes status word SW1 SW2 In case of success SW1 0x90 and SW2 0x00 shall be returned In error scenario appropriate error status shall be returned as defined in Error Code section 8 0 CLOUD 47x0 F REFERENCE MANUAL 58 6 3 3 9 READER CONTROL CONTACT SLOT This Escape command is
33. MCARD TIMEOUT This Escape command is used to get or set the delay which is applied after a Write operation to memory cards The delay is specified in milliseconds Input The first byte of the input buffer will contain the Escape code the next byte will contain the memory card write delay in seconds ByteO Byte1 Value Description Escape 0x01 Delay in milliseconds for memory card Write code 0x85 Any value other than 1 Read the current applied delay for memory card Write Output Write delay No response byte Read delay value A byte value specifying the current delay applied during memory card Write in milliseconds 0 Null or Delay in ms CLOUD 47x0 F REFERENCE MANUAL 87 6 3 5 11 CONTACT GET SET ETU This Escape command is used by the HOST to get set the current ETU for smart cards Once set the new ETU value will take effect immediately Input The input buffer contains the Escape code followed by an 8 bit GET SET identifier For SET ETU DWORD specifying the value to be set is following Byte1 4 Value Description Wait time Escape 0 01 SET ETU BIT31 BIT23 BIT15 BIT7 code 0x80 BIT24 BIT16 BIT8 BITO 0x00 GET ETU Output For both Set and Get ETU the output will be the following 0 Byte1 Byte2 Byte3 ETU value BIT31 BIT24 BIT23 BIT16 BIT15 BIT8 BIT7 BITO
34. MSB first CLOUD 47x0 F REFERENCE MANUAL 56 6 3 3 6 READER LED CONTROL BY FW This Escape command is used to enable disable LED control by firmware Input The first byte of the input buffer contains the escape code The second byte specifies if LED control by firmware should be disabled or enabled The output buffer is NULL Byte1 ByteO X Description Escape 0 Enable LED Control by firmware code 0xB2 1 Disable LED Control by firmware Get State FF 0 LED control by firmware enabled 1 LED control by firmware disabled Output No response is returned for set state For Get State 1 byte response is received Output buffer NULL or current state 6 3 3 7 READER RD WR USER AREA This Escape command is used to access the user data area in the reader The user area is located in the non volatile memory of the reader and hence data will be retained even after power cycle Note e Frequent writes should be avoided The non volatile memory supports only 100K writing cycles Amaximum of 249 bytes can be read and written The sector be read and written only as a whole e f complete data 249 bytes is not given during write operation then random data will be padded to the given data and then written If you want to modify only part of the data read the entire 249 bytes modify the data you want to change and then write it back to the reader CLOUD 47x0 F REFERENCE
35. N LED state 0 OFF 1 ON Output Output buffer NULL CLOUD 47x0 F REFERENCE MANUAL 55 6 3 3 5 READER GET INFO EXTENDED This Escape command is used to get the firmware version reader capabilities and Unicode serial number of the reader Input The first byte of the input buffer contains the escape code Byte0 Escape code 0x1E Output The firmware will return data as per structure SCARD READER GETINFO PARAMS EX mentioned below Field Size Field Name Field Description Value Default byMajorVersion Major Version in BCD Based current firmware version byMinorVersion Minor Version in BCD bySupportedModes Bit map indicating the supported modes of the reader 0x01 2 EMV mode 0x02 gt Memory card mode 0x04 gt Nfc test mode 0x07 for Contact Contactless readers 0x03 for only readers Note ISO mode is not indicated as it is always supported Contact Protocols supported by the Reader 2 wSupportedProtocols Bit 0 TO 088003 Bit 1 T1 Received as LSB first DEV NONE 0x00 2 winputDevice DEV KEYPAD 0 01 920000 IO_DEV_BIOMETRIC 0x02 Received as LSB first 1 byPersonality Reader Personality Not Used 0x00 1 byMaxSlots Maximum number of slots contactless 1 bySerialNoLength Serial number length 0x1C 0 1 Reader serial number 28 abySerialNumber Unicode serial number Received as
36. NT Mie CLOUD 47x0 F REFERENCE MANUAL 45 6 2 17 PAPDU FELICA WRITE BLK This command issues a WRITE as defined in JIS 9 6 4 e specifies the number of service e 2 specifies the number of blocks When an NFC Forum tag type 3 receives this command it writes the records of the specified service Command APDU Command 2 P1 Service Code FeliCa Write Number Number f 0x48 2 16 List Block List Block of service of blocks P2 Block Data Response APDU Status Word 8 bytes IDm Status Flag 1 Status Flag 2 SW1 SW2 6 2 18 PAPDU_FELICA_SYS CODE This command issues a REQ SYSTEM CODE as defined in RC S850 860 Command Ref Manual Section 6 1 7 Command APDU Command FeliCa REQ SYSTEM FF 4A 00 00 00 CODE Response APDU Data Status Word 8 bytes IDm No of AUS n System Code SW1 SW2 CLOUD 47x0 F REFERENCE MANUAL 46 6 2 19 PAPDU_NFC_TYPE1_TAG_RID This command issues a RID to get the tag s identification data Command APDU Command TYPE1 Tag RID FF 50 00 00 00 Response APDU Status Word HRO HR1 UIDO UID1 UID2 UID3 SW1 SW2 Where HRO and HR1 are the 2 bytes Header ROM which identify the tag e through UID3 are the first bytes of the tag s UID Topaz tags have a 7 bytes long UID which can be fully fetched using the GET UID APDU described earlier in this manual 6 2 20 PAPDU NFC TYPE1 TAG RALL
37. U 115 00 RFU Qs 68 Checksum 00 RFU T15 00 RFU Checksum 25 CLOUD 47x0 F REFERENCE MANUAL 26 5 3 3 2 ATR for ISO IEC 14443 4 user tokens The credential exposes its ATS or application information which is mapped to an ATR The table describes how this mapping is done Byte Value Designation pO O9 n indicates the number of historical bytes in following ATR 2 0x80 TD Description 1 upper nibble 8 indicates no TA2 TB2 TC2 lower nibble 0 means T 0 0x01 TD2 upper nibble 0 indicates no TA3 TB3 TC3 lower nibble 1 means T 1 4 3 n Historical Type A the historical bytes from the ATS up to 15 bytes bytes Type B 8 bytes e Byte 0 through 3 application data from ATQB e Byte 4 through 6 protocol info byte from ATQB e Byte 7 highest nibble is the MBLI maximum buffer length index from ATTRIB lowest nibble is 0 0 em TeK KORo al previous bytes Example of the ATR built for an ISO14443 4 credential Type A Type B r bd Identive Smartcard Commander 2 22 Identive Smartcard Commander jy gy imi File Edit Settings Help File Edit Settings Help Hardware Hardware 4 8 System 4 4 System Identive CLOUD 4700 F Contact Reader Identive CLOUD 4700 F Contactless Reader 188 ATR CPU card SCR3340 Express Card Reader 3B
38. Update Binary OxFF OxD6 Addr MSB Addr LSB data For a description of P1 and P2 see PAPDU MIFARE READ BINARY Lc has got to match the block size of the used card 16 bytes for Mifare Classic 4 bytes for Mifare UL and UL C Response APDU Status Word SW1 SW2 Example To write the bytes 55 55 55 55 AA 55 55 AA 55 AA 55 to block 7 of a Mifare Classic 1K the following command has got to be issued APDU FF D6 00 06 10 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 SW12 9000 OK Resulting in this content on the card Mifare Standard Cardtype Mifare Standard Memory size 1024 Bytes Unique ID 1A E3 B3 39 4100 3106 0000 0000 0000 0000 FFFF FFFF 0000 0000 OEOF 55 55 pol Sl i baal FFFF CLOUD 47x0 F REFERENCE MANUAL 33 6 2 3 PAPDU_MIFARE_LOAD_KEYS This command is used to load the key to the volatile memory of the reader It can be used for all kinds of contactless cards Refer to section 3 2 2 1 4 of PCSC3 for further details Command APDU Command CLA INS Load Keys OxFF 0x82 Key Struct Key Num data Key The Key Structure P1 is defined as follows b7 b6 bb b4 b3 b2 bi bO Description 0 Card Key 1 Reader Key d a 0 Plain Transmission 1 Secured Transmission 0 Keys are loaded into
39. ader intended to be used on the machine in question The reader has got to be plugged in at least once for the mentioned key to exist and the driver has got to be restarted for this setting to take effect Unplug and re plug the reader To be able to work with synchronous memory cards using our MCard API the same setting will have to be established See appendix B for some sample code sending Escape commands to the reader CLOUD 47x0 F REFERENCE MANUAL 52 6 3 2 Escape command codes Escape commands can be used by an application to configure CLOUD 47x0 F to function in a mode that is not its default configured mode or to get specific information To put the CLOUD 47x0 F back into its default mode it either has to be unplugged and plugged again or the application can send the same Escape command again The following Escape commands are supported by CLOUD 47x0 F 6 3 3 Common for Contact and Contactless Interfaces ESCAPE COMMAND ESCAPE CODE READER_SETMODE 0x01 READER_GETMODE 0x02 READER_GETIFDTYPE 0x12 READER_LED_CONTROL 0x19 READER_GETINFO_EXTENDED Ox1E READER_LED_CONTROL_BY_FW 0 2 READER_RDWR_USR_AREA OxFO READER GENERIC ESCAPE FF 70 04 E6 XX 6 3 3 1 READER SETMODE This Escape command sets the current mode of the reader Applications may call this function to set the desired mode Typically this call is used to switch between the 1507816 Memory card and NFC test mode opera
40. byte 0 Enable No Output code 0x99 0 PPS is enabled FF Get current status 1 PPS is disabled Output No response is returned for set state For Get State 1 byte response is received Output buffer NULL or current state CLOUD 47x0 F REFERENCE MANUAL 62 6 3 4 4 CNTLESS RF SWITCH This Escape command can be used to switch the RF field ON or OFF Input The first byte of input buffer contains the escape code The second byte either sets the mode or contains a code to retrieve the setting 1 Output Byte0 Value Description 0 0 00 Switch RF Field OFF No Output 0x01 Switch RF Field ON No Output 0 RF field is ON 1 RF field is OFF Escape code 0x96 OxFF Get current field state Output No response is returned for set state For Get State 1 byte response is received Output buffer NULL or current state 6 3 4 5 CNTLESS SWITCH RF ON OFF This Escape command is used to switch the RF field ON or OFF when a contact smart card is inserted into the reader By default the RF field is always in the ON state and when a contact smart card is inserted in the reader the RF field is turned OFF Input The first byte of input buffer contains the escape code The second byte either sets the mode or contains a code to retrieve the setting Byte1 Output Description Byte 0 Byte0 Ox00 Switch RF
41. byte value to one byte within the static memory model area of blocks It does not erase the value of the targeted byte before writing the new data Execution time of this command for NFC Forum tags type 1 is approximately half that of the normal write command WRITE E Using this command EEPROM bits can only be set not reset Command APDU Command TYPE1 Tag WRITE No ERASE FF 58 00 Byte 01 Data Where P2 codes the address of the memory byte in the following way Bit numbers Description b7 b3 Block value between 0x0 and OxE b2 b0 Byte within the block value between 0 and 7 Response APDU Status Word Data returned by card SW1 SW2 CLOUD 47x0 F REFERENCE MANUAL 49 6 2 24 PAPDU 1 TAG RSEG This command issues a RSEG to read out a complete segment or block of the memory within dynamic memory model Please note that this command works only on specific Topaz tags in the dynamic memory model Command APDU Command TYPE1 Tag READ SEGMENT FF 5A 00 SegAddr 00 Where P2 Segment Address is Bit numbers Description b7 b4 Segment 0x0 0xF lm we Response APDU Status Word 128 bytes of data SW1 SW2 6 2 25 PAPDU_NFC_TYPE1_TAG_READ8 This command issues a READ8 to read out a block of eight bytes Please note that this command only works on Topaz tags in dynamic memory model Command APDU Command TYPE1 Tag
42. d b1 424kbps supported direction reader to card b2 848kbps supported direction reader to card b3 always 0 04 212kbps supported direction card to reader b5 424kbps supported direction card to reader b6 848kbps supported direction card to reader b7 1 indicates same baud rate in both directions 0 indicates different baud rates in both directions Example If OXNN 0x77 the card supports all baud rates namely 106 212 424 and 848 kbps in both directions If OXNN 0xB3 the card supports 106 212 and 424 kbps in both directions Card Type Info Upper Nibble Value Description Lower Nibble Value 0 0 Memory card 1 T CL card 2 Dual mode card Type A card 1 Type B card CLOUD 47x0 F REFERENCE MANUAL 61 6 3 4 2 CNTLESS GET ATS This Escape command retrieves the ATS for Type A T CL or the ATQB for Type B cards Input The first byte of input buffer contains the escape code ByteO Escape code 0x93 Output The output buffer contains the ATS bytes or the ATQB bytes depending on the type of PICC placed on the reader 6 3 4 3 CNTLESS CONTROL PPS This Escape command disables the automatic PPS done by the firmware device for contactless cards Input The first byte of input buffer contains the escape code The second byte either sets the mode or contains a code to retrieve the setting Input Byte1 PPS control
43. dentive Smartcard Commander 00 0 crm z 88 Identive Smartcard Commander File Edit Settings Help File Edit Settings Help Hardware Hardware 4 System 4 System Identive CLOUD 4700 F Contact Reader Identive CLOUD 4700 F Contactless Reader B Mifare Ultralight E V Identive CLOUD 4700 F Contact Reader 4 amp Identive CLOUD 4700 F Contactless Reader Bi Mifare Standard 188 ATR Tag 3E CPU card 188 ATR SCR3340 Express Card Reader CPU card SCR3340 Fxnress Card Reader 58 8F 80 01 80 4F 0 0 00 00 03 06 03 00 03 00 00 00 00 68 3B 80 01 80 0 00 00 03 06 03 00 02 00 00 00 00 6 Byte Value hex Meaning TS 38 direct oF 15 historical characters TDi 80 protocol 0 TD2 01 protocol i Ti 80 Category indicator byte T2 4F AID presence indicator T3 oc Length of following data T4 T8 00 00 03 06 RID PC SC Workgroup T9 03 Card standard ISO 14443 A part 3 T10 T11 0002 Card name Mifare Standard 4K RFU Byte Value hex Meaning 38 direct TO 15 historical characters TDi 80 protocol 0 TD2 01 protocol 1 Ti 80 Category indicator byte T2 AID presence indicator T3 oc Length of following data T4 T8 0 00 00 03 06 RID PC SC Workgroup T9 03 Card standard ISO 14443 A part 3 T10 T11 0003 Card name Mifare Ultra light 12 00 RFU 00 RFU T14 00 RF
44. e ESCAPE COMMAND Escape code CONTACT_GET_SET_PWR_UP_SEQUENCE 0x04 CONTACT_EMV_LOOPBACK 0x05 CONTACT_EMV_SINGLEMODE 0x06 CONTACT EMV TIMERMODE 0x07 CONTACT APDU TRANSFER 0x08 CONTACT DISABLE PPS OxOF CONTACT EXCHANGE RAW 0x10 CONTACT GET SET CLK FREQUENCY Ox1F CONTACT_CONTROL_ATR_VALIDATION 0x88 CONTACT GET SET MCARD TIMEOUT 0x85 CONTACT GET SET ETU 0x80 CONTACT GET SET WAITTIME 0x81 CONTACT GET SET GUARDTIME 0x82 CONTACT READ INSERTION COUNTER READER ESCAPE GENERIC 0x00 CLOUD 47x0 F REFERENCE MANUAL 79 6 3 5 1 CONTACT GET SET PWR UP SEQUENCE This Escape command is used to get or set the following parameters e Smart card Power on sequence e Delay between successive Activation retires e Enable Disable any Voltage Class As soon as card insertion is detected and Power ON message is received from the host the firmware will start Activation with the configured voltage sequence If the Activation fails it will wait for the configured Activation delay and then retry with the next enabled Voltage class If power up succeeds at an operating voltage the firmware will continue card communication at that voltage If power up fails in all the enabled operating voltages then the firmware will report an error Input The first byte of the input buffer will contain the escape code The next byte shall contain the function to be performed Third byte shall contain the
45. e current mode of the reader Input The input buffer contains the escape code value Escape code 0x02 Output The currently active reader mode will be returned as a byte value Mode Value Remarks ISO 0x00 ISO 7816 mode EMV 0x01 EMV mode Synchronous 0x02 Memory card mode synchronous NFC Test 0x04 NFC Test Mode CLOUD 47x0 F REFERENCE MANUAL 54 6 3 3 3 READER_GET_IFDTYPE This Escape command is used to get the current IFD type from the reader Input The first byte of the input buffer contains the escape code 0 Escape code 0x12 Output The reader returns its PID LSB first PID value Description B1 0x20 0x57 Identive CLOUD 4700 F Dual Interface Reader 0 21 0x57 Identive CLOUD 4710 F Contactless SAM Reader 0x10 0x57 Identive CLOUD 2700 F Smart Card Reader 0x50 0x57 Identive CLOUD 2910 F Smart Card Keyboard Reader 6 3 3 4 READER LED CONTROL This Escape command is used to toggle the LED state LED control by firmware should be disabled using the escape command READER LED CONTROL BY FW to see proper LED change when using this IOCTL Input The first byte of the input buffer contains the escape code followed by LED number if more than one LED is present else set to 0 and then desired LED state This will be required for production purpose ByteO Byte 1 Byte2 Escape code 0x19 LED number 0 RED 1 GREE
46. e of multiple user credentials in the field also interferes with the communication When several user credentials are in the field of the reader load of the field increases which implies that less energy is available for each of them and that the system is detuned For this reason Identive has implemented in its driver only one slot It is recommended to present only one user credential at a time in front of oY CLOUD 47x0 F The communication between the reader and the credential is sensitive to the geometry of the system reader credential Parameters like the geometry and especially the relative size of the reader s and credential s antennas directly influence the inductive coupling and therefore the communication CLOUD 47x0 F was designed and optimized to function with user credentials of various technologies and sizes It may happen that CLOUD 47x0 F is not capable of communicating with extremely large or extremely small credentials In order to optimize the coupling between the reader and the credential it is recommended to put both antennas as parallel as possible to each other In order to optimize transaction speed between the reader and the card it is recommended to place the credential as close as possible to the reader This will increase the amount of energy supplied to the user credential which will then be able to use its microprocessor at higher speeds 3 7 Applications 3 7 1 General CLOUD 4700 F is a
47. es CLOUD 47x0 F REFERENCE MANUAL 37 6 2 6 PAPDU_MIFARE_READ_SECTOR_EX This command read the specified sector from a Mifare Classic card all the 4 blocks of the sector including the Key block or the entire content of Mifare UL UL C cards Command APDU Read Sector Extended FF B3 Addr MSB Addr LSB 0 Response APDU Status Word Mifare classic 64 bytes of sector data read from card Mifare UL Entire card data is returned 64 bytes SW1 SW2 Example Read sector 1 of a Mifare Classic 1K APDU FF 00 O1 10 SW12 9000 OK DataOut 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 OA OB OC OD OE OF AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 00 00 00 00 00 00 FF 07 80 69 FF FF FF FF FF FF 64 bytes CLOUD 47x0 F REFERENCE MANUAL 38 6 2 7 PAPDU MIFARE WRITE SECTOR This command writes the contained data to the specified sector of a Mifare classic or Mifare UL UL C card first blocks of the sector excluding the Key block are written in case of Mifare Classic Command APDU Write Sector FF D7 AddrMsb AddrLsb Lc Data Lc P3 has got to be 0x30 when writing to the small sectors of a Mifare Classic and OxFO when writing to the large sectors of a Mifare Classic 4K Lc has got to be 0x30 for Mifare UL and the data will get written from block 4 till the end of the memory Response APDU Status Word SW1 SW2
48. etween the reader and the credential It is also used as a fundamental clock input for the integrated circuit microprocessor to function To send data to the user credential the reader modulates the amplitude of the field There are several amplitude modulation and data encoding rules defined in ISO IEC 14443 The reader should refer to the standard for further details To answer the reader the integrated circuit card of the user credential modulates its way of loading impedance the field generated by the reader Here also further details can be found in ISO IEC 14443 1 In the ISO IEC 14443 standard the reader is called the proximity coupling device PCD 7In the ISO IEC 14443 standard the user credential is called proximity integrated chip card PICC CLOUD 47x0 F REFERENCE MANUAL 3 6 3 Recommendations The communication between the reader and the user credential is sensitive to the presence of material or objects interfering with the magnetic field generated by the reader The presence of conductive materials like metal in the vicinity of the reader and the user credential can significantly degrade the communication and even make it impossible The magnetic field of the reader generates Eddy or Foucault s currents in the conductive materials the field is literally absorbed by that kind of material It is recommended for proper communication to avoid putting CLOUD 47x0 F e in close proximity of conductive materials The presenc
49. fare Classic cards Block Number LSB Mifare Classic Key A B3 Mifare Classic Key B BA Key number shall be set to 0x01 Response APDU Status Word SW1 SW2 Example Load Key A unencrypted and authenticate for block 6 sector 1 actually with that key APDU FF 82 00 60 06 FF FF FF FF FF FF SW12 9000 OK APDU FF 86 00 00 05 O1 00 06 60 01 SW12 9000 OK CLOUD 47x0 F REFERENCE MANUAL 36 6 2 5 PAPDU_MIFARE_READ_SECTOR This command reads the specified sector from a Mifare Classic card first 3 blocks of the sector excluding the Key block or the entire content of Mifare UL UL C cards Command APDU Command Read Sector FF B1 Addr MSB Addr LSB 0 Response APDU Status Word Mifare classic 48 bytes of sector data read from card Mifare UL Entire card data is returned 64 bytes SW1 SW2 Example Read sector 1 of a Mifare Classic 1K APDU FF B1 00 01 00 SW12 9000 OK DataOut 00 00 00 00 00 00 00 00 00 00 00 OO 00 00 00 01 02 03 04 05 06 07 08 09 OA OB OC OD OE OF AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 48 bytes Read entire content of a Mifare UL APDU FF 1 00 01 10 SW12 9000 OK DataOut 04 6B 5D BA 09 01 80 70 48 00 00 1 10 06 00 00 01 02 03 1D 6E 6F 6B 69 61 2E 63 6F 6D 62 74 01 00 11 67 9F 5F B6 04 06 80 30 30 30 30 00 00 00 00 OO 02 42 54 FE 00 64 byt
50. h value should be applied for the action Tags for the action include OxAO Increment OxA1 Decrement The Tag to define the destination is 0x80 Destination The Tag to define the value is 0x81 value to increment or decrement Destination by LSB first Example Increment block 5 by 100 FF C2 00 03 OB 0 09 increment 80 01 05 block 5 81 04 64 00 00 00 by 100 00 This command returns a Response APDU according to section 2 2 of PCSC3 SUP2 Response APDU Status Word SW1 SW2 card itself CO 03 Error status see below will send SW1 SW2 CLOUD 47x0 F REFERENCE MANUAL 41 Error Status Description XX SW1 SW2 XX number of the bad data object in the APDU 00 general error of APDU 01 error in the 1 data object 02 error in the 2 object etc XX 62 82 Data object XX warning requested information not available 6 2 10 PAPDU TCL PASS THRU T CL Pass Thru This command can be used to send raw data using T CL protocol to a card Please refer to the status words defined by the PICC manufacturer for a description of the status words Command APDU Command Pass through FF FE 00 00 Lc Data Response APDU Status Word SW1 SW2 card itself PICC response data will send SW1 SW2 CLOUD 47x0 F REFERENCE MANUAL 42 6 2 11 PAPDU 15014443 PASS THRU Mifare Pass Thru This command is used to send raw data using Type A standard framing to a card CRC byte
51. ific commands has been introduced CLOUD 47x0 F provides the command READER GENERIC ESCAPE to send commands using this method However most of the escape commands listed here are not defined according to this method because of backward compatibility reasons All newly defined commands will adhere to this new standard See the command CONTACT READ INSERTION COUNTER as an example 6 3 1 Sending Escape commands to CLOUD 47x0 F A developer can use the following methods to send Escape commands to CLOUD 47x0 F SCardControl method defined in PC SC e SCardTransmit method defined in PC SC API in conjunction with the Escape command APDU defined in this manual Please note that SCardTransmit will only work when connected to a card In Windows in order to be able to send Escape commands for the CLOUD 47x0 F the feature has got to be enabled by setting a REG DWORD value named EscapeCommandEnable in the registry to a value of 1 For Windows XP and Windows Vista the key to hold the value would be HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Enum USB VID_O04E6 amp PID_58 10 Device Instance xxxx Device Parameters For Windows 7 and Windows 8 that would be HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Enum USB VID_04E6 amp PID_58 10 Device Instance xxxx Device Parameters WUDFUsbccidDriver Device Instance xxxx has got to be equal to the serial number of the reader used so this modification has got to be made for every physical re
52. in Le CLA INS P1 P2 OxFF 0xCC 0x00 0x00 Length Escape of data Command Buffer Response APDU Data Status Word Reader Response SW1 SW2 CLOUD 47x0 F REFERENCE MANUAL 30 Example 1 Note 2 To issue the READER GETIFDTYPE 0 12 escape command this pseudo APDU would be used Command APDU FF CC 00 00 01 12 Response 20 57 90 00 To issue the READER_SETMODE 0X01 escape command this pseudo APDU would be used Command APDU FF 00 00 02 01 01 to set to EMV mode Response APDU 90 00 To send Escape commands using this method the reader should be connected in shared mode using TO or T1 protocol Only then would the resource manager allow SCardTransmit As the escape commands defined using READER GENERIC ESCAPE have ISO 7816 APDU format they can be sent using SCardTransmit without having any need to prepend CC 00 00 P3 CLOUD 47x0 F REFERENCE MANUAL 31 6 2 Supported Pseudo APDU Contactless Interface All Pseudo APDUs specific to Contactless Interface supported in the reader are explained in this section 6 2 1 PAPDU_MIFARE_READ_BINARY This command is used to read data from a Mifare card Refer to section 3 2 2 1 8 of PCSC3 for details Command APDU Command CLA DE Read Binary OxFF 0 0 Addr Addr LSB P1 and P2 represent the block number of the block to be read starting with 0 for sector 0 block 0 continuing with 4 for
53. inition of various terms and acronyms Term Expansion APDU Application Protocol Data Unit Answer to Reset defined in ISO7816 Answer to select defined in ISO IEC 14443 Group of 8 bits CCID Chip Card Interface Device Card Identifier Device Firmware Upgrade Divider receive used to determine the baud rate between the reader to the card Divider send used to determine the baud rate between the card to the reader Light emitting diode MIFARE The 15014443 A with extensions for security NXP Not applicable NAD Node Address Group of 4 bits 1 digit of the hexadecimal representation of a byte Example is represented in binary as 1010001 1 b The least significant nibble is 0x3 or 0011 b and the most significant nibble is OxA or 1010 b Proximity Coupling Device PC SC Personal Computer Smart Card software interface to communicate between a PC and a smart card PICC Proximity Integrated Chip Card Product ID Proximity Distance coverage till 10 cm PUPI Pseudo unique PICC identifier Radio Frequency Reserved for future use Universal Serial Bus VID Vendor ID xyz b Binary notation of a number x y z 0 1 OxYY The byte value YY is represented in hexadecimal 2 2 79 Z VIO O gt gt Q gt Min aSo ik CLOUD 47x0 F REFERENCE MANUAL 2 5 References Doc ref in the Description Issuer manual ISO IEC 7816 3 Part 4 Interindustry commands for interchange ISO IEC 7
54. itten consent from Identive GmbH e You MAY NOT combine or distribute the source code provided with Open Source Software or with software developed using Open Source Software in a manner that subjects the source code or any portion thereof to any license obligations of such Open Source Software If the document contains technical drawings related to Identive GmbH products they are provided for documentation purposes only Identive GmbH does not grant you any license to its designs 1 3 Trademarks MIFARE is a registered trademark of NXP Semiconductors BV Windows is a trademark of Microsoft Corporation CLOUD 47x0 F REFERENCE MANUAL 10 2 Introduction to the manual 2 1 Objective of the manual This manual provides an overview of the hardware and software features of the CLOUD 47x0 F dual interface smart card readers CLOUD 4700 F and CLOUD 4710 F This manual describes in detail interfaces and supported commands available for developers using CLOUD47x0 F in their applications 2 2 Target audience This document describes the technical implementation of CLOUD 47x0 F The manual targets software developers It assumes knowledge about ISO 7816 13 56 MHz contactless technologies like ISO IEC 14443 and commonly used engineering terms Should you have questions you may send them to support identive group com 2 3 Product version corresponding to the manual Version CLOUD 47x0 F REFERENCE MANUAL 2 4 Def
55. l n getch CLOUD 47x0 F REFERENCE MANUAL 95 7 3 Annex Mechanical drawings 7 3 1 Outline and cable positions Wireholder insertion holes Option 1 Is LEEG e Vac SIT LU Wireholder insertion holes Option 2 CLOUD 47x0 F REFERENCE MANUAL 96 7 3 2 Stand f VU IL Ww Wall mounting the reader Screw max diameter 5mm CLOUD 47x0 F REFERENCE MANUAL 97 7 3 3 Reader mounted to Stand Reader clipped onto the stand 4 possible ways of clipping reader on the stand Only 2 are compatible with the use of the wireholder Wireholder 2 positioning options CLOUD 47x0 F REFERENCE MANUAL 98 7 3 4 CLOUD 4710 F SAM slot S m Recess for securit Door to access the SAM slot 22
56. les teet Ett it tus Lester ores 24 hstallatioizt inermem UI uae 24 b 2 tt ee etd ee tee dela diee tds tg 24 BBC 24 5 21 GEOUD 47x0 F listinig ic ide e n tee etd ie iria 24 5 3 2 Supported operating 24 5 3 8 5 2 0 compliant ATR for contactless interface 25 5 3 3 1 ATR for contactless storage 25 5 3 3 2 ATR for ISO IEC 14443 4 user 4 000 26 sf tc ches etd ae btt amet 27 5 4 1 CCID transport 27 5 4 1 1 CCID class requests supported 2 44440040 27 5 4 1 2 CCID messages 27 5 4 1 3 GGID Error Godes Ide 27 COMMANAS AESCHIPU OM Ya ua dito v 29 Genetic APDU 3 niti eni a d ette dud eta dli cate Cu 29 6 1 1 Working with DESFire and MIFARE Plus 29 6 1 2 PAPDU GET UID hte Gleis riot nites Peden 29 6 1 3 PAPPU E SOA PE OMD erede ERE iu 29 6 2 Supported Pseudo APDU Contactless 31
57. mand syntax is ByteO Byte1 Byte2 Byte3 Byte4 Byte5 Byte6 Byte7 Byte 8 Le CLA INS P1 P2 4 d 0 04 0x01 OxFF 70 0x04 OxE6 0x04 opcode SET Parameter Value 00 To get the parameters the command syntax is Byte0 Byte1 Byte2 Byte3 Byte4 Byte5 Byte6 CLA 1 2 Lc 0 70 0x04 oxE6 0 04 00 Parameter The value of byte 7 is interpreted from this table Byte 7 Value Description 0x00 DID Device Identification Number 0x01 Length Reduction field 0x02 REQ BRS BRS used in PSL_REQ 0x03 PS_REQ_FSL FSL used in PSL_REQ CLOUD 47x0 F REFERENCE MANUAL 77 6 3 4 21 CNTLESS_GET_P2P_EXTERNAL_RF_STATE This Escape command is supported through the READER GENERIC ESCAPE message This command is used to check if external RF is reset after the reader got detected in target mode Input ByteO Bytel Byte2 Byte3 Byte4 CLA INS P1 P2 Lc Byte5 OxFF 0x70 0x04 OxE6 0x01 0x06 opcode 00 Output If the command is successful a single byte is returned This byte indicates the value of parameter Bit gt Set to logic 1 when a present external RF field is switched off Bit 1 2 Set to logic 1 when an external RF field is detected Bit 2 to Bit 7 gt RFU bits always read as 0 CLOUD 47x0 F REFERENCE MANUAL 78 6 3 5 Specific for Contact Interfac
58. nd standby OFF OFF Reader powered Contact card IN but not powered ON OFF Reader powered Contactless card IN but not powered ON ON Contact card powered 500ms ON OFF communication 500ms OFF Contactless card powered 500ms ON 500ms ON communication 500ms OFF 500ms OFF 100ms ON Reader card errors OFF 100ms OFF Dual interface card powered in 500 5 ON OFF contact Slot 500ms OFF Dual interface card powered 500ms ON 500ms ON Keng 500ms OFF 500ms OFF 4 2 3 Other data 4 2 3 1 General Parameter Value Description Clock of the device 8MHz controller PC SC 2 0 Operating temperature 0 to 50 Operating humidity Up to 95 RH non condensing range Certifications CLOUD 47x0 F REFERENCE MANUAL 23 4 2 3 2 USB Parameter Value Description High bus powered CLOUD 47x0 F draws power from USB bus Voltage 5V Avg Current 110mA RF on no cards present Suspend Current 400A PID ________ DC characteristics 4 2 3 3 Contact card interface Parameter Value Description Maximum supported Synchronous smart cards Number of slots Single smart card slot Ejection mechanism 4 2 3 4 Contactless interface Parameter Value Description Maximum supported MIFARE Classic 1K and 4K DESFire DESFire EV1 Ultralight Ultralight C MIFARE mini and MIFARE Plus FeliCa 212 and 424 Kbps support FeliCa Standard Lite NFC forum tag type 1 2 3 4 iCLASS UI
59. nformation ssssssssssseseeneeeenen nennen 15 3 4 Available 2 4 4 0 2 1 1000 15 3 5 CLOUD 47x0 F customization options 15 3 6 Contactless communication principles and CLOUD 47x0 F usage recommendations 16 361 Power Supply iiie ec de Ue du gd Hid d Cdp eaa 16 3 6 2 Data exchange iiec acd e Ht ed tero He de Capp ua 16 3 6 3 Recommendations ed e Leute Fri Roa da didis 17 3 4 Applications indita reg ine qai e ee deed 17 Sud Generales shots exe oA 17 3 7 2 Applications provided by Identive 2 18 4 CLOUD 47x0 F 5 19 4 1 CLOUD 47x0 F high level architecture 2 0 19 43 1 Block diagram nicer Aiea dde nu dude 19 4 1 2 Software 20 4 2 Quick reference 24022 4 2 00 00 21 4 2 1 CLOUD 47x0 F 21 429 LED 22 45253 0 22 4 2 3 1 os itm tun eU RR E 22 4 2 3 2 je IDEE 23 4 2 3 3 Corntact card Interface eerte n enm 23 4 2 3 4 Contactless interface eMe 23 Software modu
60. ny tools provided here are two of them e The Simple Tag Editor is part of our NFC NDEF Editor Kit that enables the user to read and write NFC forum compliant records from to NFC forum compatible tags It is an easy to use tool to configure forum tag demonstrations rapidly available in our web shop e Smart card commander version 1 3 provides capabilities to identify most common cards in the field and display the content of them as well as scripting functionality which can be very useful for developers to develop and debug their applications This tool is as well part of all our SDKs and available as a stand alone product CLOUD 47x0 F REFERENCE MANUAL 19 4 CLOUD 47x0 F characteristics 4 1 CLOUD 47x0 F high level architecture 4 1 1 Block diagram The link between CLOUD 47 0 F and the host to which it is connected is the USB interface providing both the power and the communication channel 1507816 contact smart card interface EMC filter Device controller C RF front end o Matching circuitry e LED Antenna The device controller has several interfaces available In the CLOUD 47x0 F implementation three peripherals are connected to the device controller e LED for reader status indication e A contact smart card interface e RF front end that handles the RF communication The controller embeds flash memory that contains the firmware developed by Identive to handle all the 1807816 contact pr
61. on 0 OxE9 Switch mode 0 P2P Initiator mode 1 P2P Target mode For the switch to Initiator Target mode the 1 bytes from offset 0x02 give additional 2 Reader writer mode information as described below OxFF Get current mode Offset Initiator Mode Bytes Detailed description 2 RFU 3 RFU 4 Timeout Low Byte 5 Timeout High Byte 6 N Number of General Bytes ITE CLOUD 47x0 F REFERENCE MANUAL 70 Target Mode Bytes Offset Detailed description Sample Values 2 0x00 RFU 3 0x00 RFU 4 0x04 SENS_RES 5 0x03 SENS_RES 6 0x01 NFCID1 7 OxFE NFCID1 8 OxOF NFCID1 9 0x40 SEL RES 10 0x01 NFCID2 11 OxFE NFCID2 12 OxOF NFCID2 13 0xBB NFCID2 14 NFCID2 15 OxA6 NFCID2 16 OxC9 NFCID2 17 0x89 NFCID2 18 FeliCa Padding Bytes 19 C1 FeliCa Padding Bytes 20 C2 FeliCa Padding Bytes 21 C3 FeliCa Padding Bytes 22 C4 FeliCa Padding Bytes 23 C5 FeliCa Padding Bytes 24 C6 FeliCa Padding Bytes 25 C7 FeliCa Padding Bytes 26 FF FeliCa System Code 27 FF FeliCa System Code 28 0x00 of 0 08 3 bytes of 29 0x88 Timeout Low Byte 30 0x13 Timeout High Byte 31 N Number of G bytes in ATR RES 32 to 32 A RES to be sent in CLOUD 47x0 F REFERENCE MANUAL 71 Output Buffer e Initiator On successful detection of target the entire ATR RES buffer from the target device would be given
62. or code is returned if the command issued has been aborted by the control pipe 5 4 1 3 8 Command not supported This error would be returned if the command would not be supported by the reader CLOUD 47x0 F REFERENCE MANUAL 29 6 Commands description 6 1 Generic APDU 6 1 1 Working with DESFire and MIFARE Plus tokens To work with DESFire EV1 and MIFARE Plus tokens please refer to the according application notes AN337 and AN338 respectively Please note that since these application notes contain information available only under NDA with NXP you d need to sign an NDA with NXP to be allowed to receive them 6 1 2 PAPDU GET UID GET UID will retrieve the UID or SNR or PUPI of the user token This command can be used for all supported technologies Command APDU CLA INS P1 P2 Data in Le pene Setting Le 0x00 can be used to request the full UID or PUPI is sent back e g for ISO14443A single 4 bytes double 7 bytes triple 10 bytes for ISO14443B 4 bytes PUPI Response APDU Data Status Word SW1 SW2 Requested bytes of UID 6 1 3 PAPDU ESCAPE CMD Usually escape commands are transmitted through SCardControl as defined in PCSC API using IOCTL CCID ESCAPE But on some environments the driver will block this IOCTL unless the registry has been edited to allow it Hence this vendor specific APDU was defined to transmit Escape commands to the reader as below Command APDU Data
63. otocol the RF communication protocols and the PC SC communication protocol with the host The flash can be upgraded once the device is deployed in the field hence enabling firmware upgrades to add and potentially patch features The RF front end ensures the coding decoding framing modulation demodulation required for the RF communication It is controlled by the device controller through registers The matching circuitry provides the transmission and receiver paths adaptation for the antenna to function properly CLOUD 47x0 F REFERENCE MANUAL 20 4 1 2 Software architecture Applications can interface with the driver directly through the PC SC interface Contactless Contact Reader Reader PSS E PC SC Layer Driver Driver Contact Smart Card Contactless Card Reader Reader we T 0 T 1 TCE FIRMWARE LAYER SLOT 0 SLOT 1 CLOUD 47x0 F Reader ICC PICC The CLOUD 47x0 F leverages a PC SC CCID driver that is freely available for all supported operating systems Windows MacOSX and Linux With current Windows versions starting with Windows Vista and MacOSX this driver is already included in the basic installation With the diverse Linux derivatives there may be distribution specific drivers that should get installed using the install mechanism of the used distribution If there is none the driver may always be downloaded from the
64. s will be appended automatically The reader will not add transport protocol data to the raw data e g PCB NAD CID etc Command APDU Command Part 3 Pass Transmit through FF EF CRC 00 Le Data P1 0x00 will transmit the CRC bytes form the card as is to the application P1 0x01 will discard the CRC bytes Response APDU Status Word Data returned by card SW1 SW2 6 2 12 PAPDU 15014443 4 PART3 SWITCH TCL Mifare Switch This command switches the card state between TCL and MIFARE modes Command APDU Command Part 4 Part 3 Switch FF F8 P1 00 00 E P1 0x00 switches from MIFARE mode to TCL mode P1 0x01 switches from TCL mode to MIFARE mode Response APDU Status Word SW1 SW2 NOTE This command is mainly targeted at Mifare plus SO cards Mifare plus card at SO level get detected as Mifare memory card In order to personalize these cards first it needs to be switched to Part 4 mode For this purpose this user command needs to be issued using SCardTransmit function CLOUD 47x0 F REFERENCE MANUAL 43 6 2 13 PAPDU FELICA REQC This command Issues REQC as defined in JIS 7 5 1 It is used to detect the presence of a NFC Forum tag type 3 in the field Command APDU Command 2 bytes of system code FeliCa REQC FF 40 00 00 04 1 byte RFU 1 byte TSN Response APDU Status Word 16 bytes of NFCID2 2 bytes of System Code sent only if the RFU byte is
65. sector 1 block 0 sector no x 4 block no Regardless of the value given in Le this command will always return the entire block content 16 bytes for Mifare Classic 4 bytes for Mifare UL and UL C Response APDU Data Status Word N bytes of block data SW1 SW2 Example For a Mifare Classic 1K card with the following content Card type Mifare Standard Memory size 1024 Bytes Unique ID 1 39 Block Sector Hex ASCII Read Write Inc Dec 0 1 B339 7388 0400 47 1 25 8 4100 3106 479s GAS A 1 AIB AIB AJB Ala 0000 0000 0000 0000 0000 0000 0000 0000 AIB AIB AJB Al 0000 0000 0000 0000 0000 0000 0000 0000 AIB AJB Al FFFF FFFF FFFF FF07 8069 FFFF FFFF FFFF 1 0000 0000 0000 0000 0000 0000 0000 0000 AIB AIB Al 0001 0203 0405 0607 0809 OAOB OCOD OEOF AJIB Al 0000 0000 0000 0000 0000 0000 0000 0000 AIB Al The following command will read the sixth block and yield the mentioned output APDU FF BO 00 05 02 SW12 9000 OK DataOut 00 01 02 03 04 05 06 07 08 09 OA OB OC OD OE OF 16 bytes CLOUD 47x0 F REFERENCE MANUAL 32 6 2 2 PAPDU MIFARE UPDATE BINARY This command is used to update the non volatile memory of a Mifare card Refer to section 3 2 2 1 9 of PCSC3 for further details Command APDU Command CLA
66. send an email to sales identive infrastructure com CLOUD 47x0 F REFERENCE MANUAL 16 3 6 Contactless communication principles and CLOUD 47x0 F usage recommendations CLOUD 47 0 F is a dual interface reader capable of reading both contact smart cards contactless user tokens The following paragraph focuses on a few specifics of contactless communication to outline usage recommendations in order to ensure best user experience CLOUD 47x0 is a contactless reader designed to communicate with user credentials User tokens User credentials are made of a contactless AN integrated circuit chip connected to an NN X User credentials can take several form S 11 factors Os e Credit card sized smart card CLOUD 47x0 F e Key fob e USB token e NFC mobile phone etc Communication between CLOUD 47x0 F and user credentials uses magnetic field inductive coupling The magnetic field generated by CLOUD 47x0 F has a carrier frequency of 13 56MHz 3 6 1 Power supply When the user credential is put in the magnetic field of the reader its antenna couples with the reader and an induction current appears in the antenna thus providing power to the integrated circuit The generated current is proportional to the magnetic flux going through the antenna of the user credential 3 6 2 Data exchange The carrier frequency of the magnetic field is used as a fundamental clock signal for the communication b
67. supported through the READER GENERIC ESCAPE message This command can be used to disable the contact slot until it is re enabled through the same command or until the reader is re plugged When a dual interface card is placed in the contact slot it will get detected in both contact and contactless mode To enable applications to actively switch the detection from contact only mode to contactless only mode this Escape command can be used along with CNTLESS SWITCH RF ON OFF Input To Enable Disable Get Current Status of Contact Slot ByteO Byte1 Byte2 Byte3 Byte4 Byte5 Byte6 Byte7 CLA INS P1 P2 Le y yt 0 70 0 04 6 0 05 Mil 00 x xX X Xx X x opcode 0x00 to disable 0x05 0x00 to get current contact OxFF 0x70 0x04 OxE6 0x02 opcode status 00 Byte2 and Byte3 constitute the world wide unique vendor ID as assigned by the USB organization For Identive based readers Byte2 0x04 and Byte3 OxE6 since it USB Vendor ID is 0 04 6 Output If the command is successful a single byte is returned This byte indicates the status of contact slot which needs to be interpreted as below Byte 0 Description 0x01 Contact slot is enabled 0x00 Contact slot is disabled CLOUD 47x0 F REFERENCE MANUAL 59 6 3 4 Specific for Contactless Interface
68. t The first byte of input buffer contains the escape code 0 Escape code 0xDA CLOUD 47x0 F REFERENCE MANUAL 66 Description Type A card Type B card FeliCa 212 FeliCa 424 NE p maed 7 7 i Class xx is the PUPI UID Length THEN EITHER PUPI UID bytes 0x00 byte padding used if length smaller than 10 CID not supported CID supported 0x00 a 8859 or D L OR Request service command response time parameter see JIS 6319 specification sto conn ae TRA ata coa spo ve Na 54 rt soning ti ___ ite sean pone rater CLOUD 47x0 F REFERENCE MANUAL 67 6 3 4 10 CNTLESS SET CONFIG PARAMS This Escape command is used to configure RXGAIN and RXTHRESHOLD of the RF receiver for different baud rates and card types All configured parameters are volatile Input The first byte of input buffer contains the escape code The following 16 bytes contain the below defined parameters Byte Value Description Bo Escape code Type A RXGAIN for polling or 106Kbps Type A RXGAIN for 212 Kbps Type A RXGAIN for 424 Kbps Type A RXGAIN for 848 Kbps Type A RX THRESHOLD for polling or 106Kbps Type A RX THRESHOLD for 212 Kbps Type A RX THRESHOLD for 424 Kbps Type A RX THRESHOLD for 848 Kbps ES ues eer Type B RXGAIN for 424 Kbps Output Output buffer NULL C
69. t device Output On successful reception of data from the target the entire data would be available from offset 0x04 Presence of additional data is indicated by the chaining byte Offset Description Detailed description 0 RFU 1 RFU 2 RFU 3 0 No Chaining Chaining 1 Chaining Offset 4 to N data bytes Bytes Received offset 4 N CLOUD 47x0 F REFERENCE MANUAL 75 6 3 4 18 CNTLESS NFC SINGLESHOT This Escape command is used to switch the device to Single shot mode Input Offset Description Detailed description 0 Single shot DEP supported 9x81 If a value other than 0 01 is given DEP is not supported in the preceding I Blocks Output Output buffer NULL 6 3 4 19 CNTLESS NFC LOOPBACK This Escape command is used to switch the device to Loop back mode Input Offset Description Detailed description 0 OxED NFC Loop back DEP supported 1 0x01 If a value other than 0x01 is given DEP is not supported in the preceding I Blocks Output Output buffer NULL CLOUD 47x0 F REFERENCE MANUAL 76 6 3 4 20 CNTLESS GET SET PARAMS This Escape command is supported through the READER GENERIC ESCAPE command During operation number parameters like DID PSL BRS and PSL FSL can be controlled from application Input To set the parameters the com
70. t mode using CNTLESS P2P SWITCH MODES E9 Input Offset Description Detailed description 0 OxEB Target Send 1 0x00 RFU 2 0x00 RFU 3 0x00 RFU 4 d M Chaining byte 1 Chaining 5 Timeout Low Byte 6 Timeout High Byte 2 2 data bytes Bytes to be sent to Initiator device Output Once the data bytes are sent successfully the firmware would indicate if it is ready to send more bytes through the chaining byte Offset Description Detailed description 0 RFU 1 RFU 2 RFU 3 0 No Chaining Chaining 1 Chaining 6 3 4 16 CNTLESS P2P INITIATOR DESELECT This escape command is used by the application to deselect the target device towards the end of P2P communication Input Byte0 Escape code 0xE6 Output The deselect response as received from the target will be sent in the response buffer from offset 0x00 CLOUD 47x0 F REFERENCE MANUAL 74 6 3 4 17 CNTLESS P2P INITIATOR TRANCEIVE This Escape command is used to send data to a target device Prior to using this command the device should have been successfully switched to initiator mode using CNTLESS P2P SWITCH MODES E9 Input Offset Description Detailed description 0 OxE7 Initiator transceive 1 0x00 RFU 2 0x00 RFU 3 0x00 RFU 0 No Chaining Chaining 1 Chaining 5 Timeout Low Byte 6 zs Timeout High Byte uin ta N bytes of data Bytes to be sent to targe
71. the volatile memory 1 Keys are loaded into the non volatile memory RU XXXX If b6 is set it is the Reader Key number that has been used for the encryption else it is ignored Only one reader key 0x00 is supported by CLOUD 47x0 F Notes 1 Card keys can be loaded in both secure and non secure mode Card keys can only be loaded to the Volatile memory of the reader 2 Toload the card keys in secure mode the application developer has to know the 128 bit AES key of the reader The default key is 00010203 05060708 0A0BOCOD 0F101112 As a Mifare key is only 6 bytes in length data needs to be padded as per pkcs7 padding scheme see example below 3 The Reader key can only be loaded in the secure mode to the non volatile memory of the reader The new key is first XORed with the old key and encrypted with the old key In order to validate the integrity of the processed key data a 2 byte CRC has got to be sent following the key data Refer to the example Load Keys Reader Secure for details 4 The CRC16 is calculated as defined in CRC 16 CCITT polynomial 0x8408 with an initial value of 0x0000 Response APDU Status Word SW1 SW2 CLOUD 47x0 F REFERENCE MANUAL 34 Examples Load Keys Card Non Secure The command to load Mifare key FFFFFFFFFF is FF82006006 FFFFFFFFFFFF Load Keys Card Secure If the default AES128 reader is key is 00010203 05
72. tions Bits are represented by lower case b where followed by a numbering digit Bytes are represented by upper case B where followed by a numbering digit Bit number 5 Y Bit number 0 Y b7 b6 b5 b4 b3 b2 b1 50 Most significant lt Least significant nibble J9 1 Byte 8 bits 2 nibbles _ _ gt Byte number 2 gt Byte number 11 lt String of 12 bytes Example 163 decimal number is represented e in hexadecimal as 0xA3 in binary as 1010001 1 b The least significant nibble of is 0 3 in hexadecimal 0011 b in binary The most significant nibble of xA3 is in hexadecimal 1010 b in binary CLOUD 47x0 F REFERENCE MANUAL 14 3 General information about CLOUD 47x0 F 3 1 CLOUD 47x0 F key benefits With its combination of a modern slim design and its state of the art feature set CLOUD 4700 F is the perfect desktop reader choice for environments where both contact and contactless smart card support is required while CLOUD 4710 F perfectly fits environments where access to contactless cards with simultaneous access to a contact SAM card is required As for all Identive GmbH products CLOUD 47x0 F is designed to offer best in class interoperability 3 2 CLOUD 47x0 F key features 13 56MHz contactless reader 15014443 type A amp B
73. tions Upon power on the reader will reset to the default 1507816 mode Input The first byte of the input buffer contains the escape code value and the second one contains the value for the desired mode of operation The output buffer field shall be NULL 0 Byte1 Escape code 0x01 Mode CLOUD 47x0 F REFERENCE MANUAL 53 The following table defines the values for the Mode parameter Value Remarks ISO 7816 mode Applicable for both contact slot and contactless ISO 7816 0x00 slot EMV Applicable only for contact slot and ignored by contactless EMV 0x01 interface Memory card mode Synchronous Applicable only for contact Sy nehtenous 0x02 slot and ignored by contactless interface Test 0x04 Test Mode Applicable only for contactless interface ISO mode uses APDU mode of data transfer and is used for normal operation This is the default mode of the reader on Power up EMV mode also uses APDU mode of data transfer and is used for EMV test purposes This mode has more stringent checks for Smartcard detection and Communication as per EMV4 2 spec Synchronous mode is used for communicating only with Memory cards NFC test mode is used to ignore deactivate activate sequence during SCardConnect PC_TO_RDR_ICCPOWERON 0x62 and PC_TO_RDR_ICCPOWEROFF 0x63 Output Output buffer NULL 6 3 3 2 READER GETMODE This Escape command retrieves th
74. transparent reader designed to interface a personal computer host supporting PC SC interface with 13 56MHz user tokens like public transport cards contactless banking cards electronic identification documents e g e passports e ID cards driving licenses etc and smartcards according to 1507816 as well as synchronous memory cards like CAC and PKI cards and health insurance cards User credentials can have several form factors like credit cards key fobs NFC mobile phones or USB dongles like our SCTxxxx or 9MAXX products CLOUD 4710 F incorporates a SAM slot for SIM sized cards instead of the standard card slot for ID 1 sized cards of the CLOUD 4700 F 17 CLOUD 47x0 F REFERENCE MANUAL 18 link 13 56MHz USB link 15014443 interface PC SC interface Smartcard contacts 1507816 2 CLOUD 4700 CLOUD 4710 Host CLOUD 47x0 F Credentials SAM Application logic Interface device Application logic User personal data for given set of applications CLOUD 47x0 F itself handles the communication protocol but not the application related to the token or card The application specific logic has to be implemented by software developers on the host 3 7 2 Applications provided by Identive GmbH Identive GmbH does not provide payment or transport applications or PKI or CAC applications Identive GmbH provides a few applications for development and evaluation purposes that can function with CLOUD 47X0 F There are ma
75. webpage of the maintainer Ludovic Rousseau hitps alioth debian org frs group id 30105 Additionally Identive provides a proprietary driver for all the supported OSs CLOUD 47x0 F REFERENCE MANUAL 21 4 2 Quick reference data 4 2 1 CLOUD 47x0 F dimensions Item Characteristic Value 2 143g without stand Weight Stand 52g External 126 mm X 93 mm X 22 mm dimensions CLOUD 4700 F Cable length 1 5 meter long with USB type A connector Default color White and grey 33mm 522 AD Identive CLOUD 4700 F 33mm BAR CODE TYPE 128 REACH Default label 5320Y YWWMNNNNN exei S N 5320Y YWWMNNNNN P N 905320 ID MBPCLOUD47X0F 001 Made In Singapore by identive Cable length 1 5 meter long with USB type A connector Identive CLOUD 4710 F 3 3mm Default color White and grey BAR CODE TYPE 128 REACH 5324 YYWWMNNNNN mS S N 5324YYWWMNNNNN 905324 FCC ID MBPCLOUD47X0F 001 Made Singapore by identive i 157g without stand oe Stand 52g External dimensions 113 mm X 93 mm X 22 mm CLOUD 4710 F Drawing with dimensions of the CLOUD 47X0 F and accessories can be found in annex CLOUD 47x0 F REFERENCE MANUAL 4 2 2 LED behavior CLOUD 47X0 F is equipped with one bicolor LED Its behavior is described in the table below Reader states GREEN RED Just after plug in with drivers already installed ON OFF Just after DFU operation ON OFF Suspe

CHIPDRIVE CLOUD 4700F

Contents

Download Pdf Manuals

Related Search

Related Contents