ACR3901T-W1 – Reference Manual
Version 1.02
www.acs.com.hk
Page 17 of 100
6.1.4.
Frame Format
6.1.4.1.
Bluetooth Frame Format
HID Frame
Length (Bytes)
Description
Identifiers
1
Commands
Length
2
Length {Checksum}
Payload
0-N
Data
Checksum
1
XOR {Identifiers,Length,Payload}
Table 6
: Bluetooth Frame Format
The frame format should be:
Iden LEN1 + LEN2 + N-bytes P Checksum
If the total command length, including identifier, length, and payload, is greater than 20 bytes, then the
reader or the paired device will automatically divide it into several frames.
Data checksum is used in detecting errors that may have been introduced during wireless data
transmission. To calculate the data checksum: XOR {Identifiers,Length,Payload}.
Example:
62010063 => Checksum = 63h
6.1.4.2.
Bluetooth Frame Format after Mutual Authentication
Mutual authentication was introduced to avoid man-in-the-middle attacks through the Bluetooth
communication channel. After a successful mutual authentication, the Bluetooth Frame Format in
will be encrypted and packed with 1 byte header byte, 2 Len byte, and 1 check byte. The
frame format after mutual authentication should look like the structure below:
Len + (Ident P Checksum)* + Check byte
Note: Each 16 bytes of data will be encrypted with the Session Key using the AES-128 CBC
cipher mode. The initial vector is 16 bytes (00h) in AES-128 CBC cipher mode.
HID Frame
Length (bytes)
Description
Header byte
1
Value: 72h / 22h
Len
2
Length {Ident P Ch
Check + Stop byte}
Identifiers
1
Commands
Encrypted data of
the Bluetooth frame
format;
The final data length
of this part is 16*N
bytes (N>0)
Length
2
Length {P Checksum}
Payload
0-N
Data
Checksum
1
XOR {Identifiers, Length, Payload}
Check byte
1
XOR {Header, Len, Encrypted(Identifiers, Length, Payload,
Checksum)}
Table 7
: Encrypted Frame Format after Mutual Authentication
