Advanced Card Systems ACR3901U-S1 User manual

Subject to change without prior notice [e-mail]
www.acs.com.hk
Reference Manual V1.10
ACR3901U-S1
ACSSecureBluetooth®
ContactCardReader

ACR3901U-S1 – Reference Manual [e-mail]
Version 1.09 www.acs.com.hk
Page 2 of 96
Revision History
Release Date Revision Description Version Number
2015-07-10 ●Initial Release 1.00
2015-09-17
●Updated Product Marketing Name
●Updated Formatting
●Updated Section 5.4.2: Status LED
●Updated Section Section 6.2: Profile
Selection
●Updated Section 6.5.5.5:Sleep Mode Option
●Updated Section 6.5.6: Customer Master
Key Reset
1.01
2015-11-05
●Updated Section 5.4.2: Status LED
●Updated Section 6.2: Profile Selection
●Updated Section 6.3: Authentication
●Updated Section 6.5.6: Customer Master
Key Reset
●Updated Section 6.5.5.4: Rewrite Master
Key Command
●Updated Section 6.6: Mutual Authentication
Table
1.02
2016-09-16
●Updated Product Photo
●Updated Product Marketing Name
●Updated command examples with incorrect
checksum
1.03
2017-01-11
●Updated the Battery Life
●Added Section 6.5.5.7: Set Tx Power
●Added Section 6.5.5.8: Read Tx Power
value
●Added Section 6.5.7: Card Set Parameters
for Bluetooth mode
1.04
2017-11-02
●Changed Section 6.5.5.1 – Section 6.5.6:
(Escape Commands) to new Section 8.1
●Updated Section 6.3: Authentication
●Updated Section 6.6: Mutual Authentication
●Updated Section 6.6.1: SPH_to_RDR_ReqAuth
●Updated Section 6.6.3: SPH_to_RDR_AuthRsp
●Updated Section 6.6.4: RDR_to_SPH_AuthRsp2
●Updated Section 6.6.5: SPH_to_RDR_DataReq
●Updated Section 8.1.9: Customer Master
Key Reset Request
1.05

ACR3901U-S1 – Reference Manual [e-mail]
Version 1.09 www.acs.com.hk
Page 3 of 96
Release Date Revision Description Version Number
2017-12-28
●Updated Section 6.3: Authentication
●Updated Section 6.4.2: Bluetooth Frame
Format after Mutual Authentication
●Updated Section 6.6.1: SPH_to_RDR_ReqAuth
●Updated Section 6.6.3: SPH_to_RDR_AuthRsp
●Updated Section 6.6.5: SPH_to_RDR_DataReq
●Updated Section 8.1.4: Rewrite Master Key
Command
●Updated Section 8.1.9: Customer Master
Key Reset Request
1.06
2018-06-29
●Updated Section 6.3: Authentication
●Updated Section 6.5: Bluetooth
Communication Protocol
●Added Section 6.5.5: APDU2 Command
(From FW v1.20 and later)
●Updated Section 7.1.4: PC_to_RDR_XfrBlock
●Updated Section 7.2.1: RDR_to_PC_DataBlock
1.07
2018-12-17
●Updated Formatting on Section 6.0
Software Design
●Updated Formatting on Section 7.0 Host
Programming API
●Removed Section 10.0 Other Commands
Access via PC_to_RDR_XfrBlock
●Removed Appendix A. Supported Card
Types
1.08
2018-12-27
●Updated Section 6.1.6.2: RDR_to_SPH_AuthRsp1
●Updated Section 6.1.6.4: RDR_to_SPH_AuthRsp2
●Updated Section 6.1.6.5: SPH_to_RDR_DataReq
●Updated Section 6.1.6.6: RDR_to_SPH_DataRsp
●Updated Section 6.2.1.1: PC_to_RDR_IccPowerOn
●Added Section 6.2.1.8: PC_to_RDR_Escape
●Added Section 6.2.2.4: RDR_to_PC_Escape
1.09
2019-06-13 ●Updated Product Marketing Name 1.10

ACR3901U-S1 – Reference Manual [e-mail]
Version 1.09 www.acs.com.hk
Page 4 of 96
Table of Contents
1.0. Introduction .............................................................................................................6
1.1. Reference Documents...........................................................................................................6
1.2. Symbols and Abbreviations...................................................................................................6
2.0. Features ...................................................................................................................7
3.0. Smart Card Support ................................................................................................8
3.1. MCU Cards............................................................................................................................8
3.2. Memory-based Smart Cards..................................................................................................8
4.0. System Block Diagram............................................................................................9
5.0. Hardware Design...................................................................................................10
5.1. Battery..................................................................................................................................10
5.1.1. Battery charging..........................................................................................................10
5.1.2. Battery life...................................................................................................................10
5.2. Bluetooth Interface...............................................................................................................10
5.3. USB Interface ......................................................................................................................10
5.3.1. Communication Parameters .......................................................................................10
5.3.2. Endpoints ....................................................................................................................11
5.4. User Interface ......................................................................................................................11
5.4.1. Mode Selection Switch................................................................................................11
5.4.2. Status LED..................................................................................................................12
5.5. Smart Card Interface ...........................................................................................................12
5.5.1. Smart Card Power Supply VCC (C1)..........................................................................12
5.5.2. Programming Voltage VPP (C6).................................................................................12
5.5.3. Card Type Selection....................................................................................................13
5.5.4. Interface for Microcontroller-based Cards...................................................................13
5.5.5. Card Tearing Protection..............................................................................................13
6.0. Software Design ....................................................................................................14
6.1. Bluetooth Communication Protocol .....................................................................................14
6.1.1.Bluetooth Connection Program Flow..........................................................................14
6.1.2. Profile Selection..........................................................................................................15
6.1.3. Authentication .............................................................................................................17
6.1.4. Frame Format .............................................................................................................18
6.1.5. Bluetooth Communication Protocol.............................................................................19
6.1.6. Mutual Authentication and Encryption Protocol..........................................................32
6.2. USB Communication Protocol.............................................................................................38
6.2.1. CCID Bulk-OUT Messages.........................................................................................40
6.2.2. CCID Bulk-IN Messages.............................................................................................45
7.0. Host Programming API .........................................................................................48
7.1. Peripherals Control..............................................................................................................48
7.1.1. Get Serial Number Command.....................................................................................48
7.1.2. Get Random Number Command................................................................................49
7.1.3.Get Firmware Version Command ...............................................................................50
7.1.4. Rewrite Master Key Command...................................................................................51
7.1.5. Sleep Mode Option .....................................................................................................52
7.1.6. Get Device Address....................................................................................................53
7.1.7. Set Tx Power...............................................................................................................54
7.1.8. Read Tx Power value..................................................................................................55
7.1.9. Customer Master Key Reset Request ........................................................................56
7.2. Memory Card Command Set...............................................................................................57
7.2.1. Memory Card – 1, 2, 4, 8, and 16 kilobit I2C Card .....................................................57
7.2.2. Memory Card – 32, 64, 128, 256, 512, and 1024 kilobit I2C Card .............................60
7.2.3. Memory Card – ATMEL AT88SC153..........................................................................63

ACR3901U-S1 – Reference Manual [e-mail]
Version 1.09 www.acs.com.hk
Page 5 of 96
7.2.4. Memory Card – ATMEL AT88C1608..........................................................................66
7.2.5. Memory Card – SLE4418/SLE4428/SLE5518/SLE5528............................................70
7.2.6. Memory Card – SLE4432/SLE4442/SLE5532/SLE5542............................................75
7.2.7. Memory Card – SLE 4406/SLE 4436/SLE 5536/SLE 6636........................................80
7.2.8. Memory Card – SLE 4404 ..........................................................................................85
7.2.9. Memory Card – AT88SC101/AT88SC102/AT88SC1003...........................................89
Appendix A. Error Codes...............................................................................................96
List of Figures
Figure 1 : ACR3901U-S1 Architecture...................................................................................................9
Figure 2 : Bluetooth Connection Flow..................................................................................................14
Figure 3 : nRFgo Studio GATT Setting Interface.................................................................................15
Figure 4 : Authentication Procedure.....................................................................................................17
List of Tables
Table 1 : Symbols and Abbreviations.....................................................................................................6
Table 2 : Estimated Battery Lifespan....................................................................................................10
Table 3 : USB Interface Wiring.............................................................................................................10
Table 4 : Mode Selection Switch ..........................................................................................................11
Table 5 : Status LED.............................................................................................................................12
Table 6 : ACR3901U-S1 Service Handles and UUID Information List.................................................16
Table 7 : Bluetooth Frame Format........................................................................................................18
Table 8 : Encrypted Frame Format after Mutual Authentication...........................................................18
Table 9 : Command Code Summary....................................................................................................19
Table 10 : Response Code Summary ..................................................................................................19
Table 11 : Summary of Mutual Authentication Commands..................................................................32
Table 12 : Error Code...........................................................................................................................96

ACR3901U-S1 – Reference Manual [e-mail]
Version 1.09 www.acs.com.hk
Page 6 of 96
1.0.Introduction
ACR3901U-S1 ACS Secure Bluetooth® Contact Card Reader acts as an interface for the
communication between a computer/mobile device and a smart card. Different types of smart cards
have different commands and different communication protocols which, in most cases, prevent direct
communication between a smart card and a computer/mobile device. ACR3901U-S1 ACS Secure
Bluetooth Contact Card Reader establishes a uniform interface from the computer/mobile device to
the smart card for a wide variety of cards. By taking care of the card’s particulars, it releases the
computer software programmer from being responsible with smart card operations’ technical details,
which in many cases, are not relevant to the implementation of a smart card system.
1.1. Reference Documents
The following related documents are available from www.usb.org
•Universal Serial Bus Specification 2.0 (also referred to as the USB specification), April 27,
2000
•Universal Serial Bus Common Class Specification 1.0, December 16, 1997
•Universal Serial Bus Device Class: Smart Card CCID Specification for Integrated Circuit(s)
Cards Interface Devices, Revision 1.1, April 22, 2005
The following related documents can be ordered through www.ansi.org
•ISO/IEC 7816-1; Identification Cards – Integrated circuit(s) cards with contacts - Part 1:
Physical Characteristics
•ISO/IEC 7816-2; Identification Cards – Integrated circuit(s) cards with contacts - Part 2:
Dimensions and Locations of the contacts
•ISO/IEC 7816-3; Identification Cards – Integrated circuit(s) cards with contacts - Part 3:
Electronic signals and transmission protocols
1.2. Symbols and Abbreviations
Abbreviation Description
ATR Answer-To-Reset
CCID Chip/Smart Card Interface Device
ICC Integrated Circuit Cards
IFSC Information Field Sized for ICC for protocol T=1
IFSD Information Field Sized for CCID for protocol T=1
NAD Node Address
PPS Protocol and Parameters Selection
RFU Reserved for future use1
TPDU Transport Protocol Data Unit
USB Universal Serial Bus
Table 1: Symbols and Abbreviations
1Must be set to zero unless stated differently.

ACR3901U-S1 – Reference Manual [e-mail]
Version 1.09 www.acs.com.hk
Page 7 of 96
2.0.Features
•USB Full Speed Interface
•Bluetooth Interface
•Plug and Play – CCID support brings utmost mobility
•Smart Card Reader:
oContact Interface:
Supports ISO 7816 Class A, B, and C (5 V, 3 V, 1.8 V) cards
Supports microprocessor cards with T=0 or T=1 protocol
Supports memory cards
Supports PPS (Protocol and Parameters Selection)
Features Short Circuit Protection
Supports AES-128 encryption algorithm
•Application Programming Interface:
oSupports PC/SC
oSupports CT-API (through wrapper on top of PC/SC)
•Built-in Peripherals:
oLEDs
•USB Firmware Upgradeability1
•Supports Android™ 4.3 and later2
•Supports iOS 8.0 and later3
•Compliant with the following standards:
oEN 60950/IEC 60950
oISO 7816
oBluetooth®
oEMV™ Level 1 (Contact)
oPC/SC
oCCID
oCE
oFCC
oRoHS 2
oREACH
oVCCI (Japan)
oMIC (Japan)
oMicrosoft® WHQL
1Applicable under PC-linked mode
2Uses an ACS-defined Android Library
3Uses an ACS-defined iOS Library

ACR3901U-S1 – Reference Manual [e-mail]
Version 1.09 www.acs.com.hk
Page 8 of 96
3.0.Smart Card Support
3.1. MCU Cards
ACR3901U-S1 is a PC/SC-compliant smart card reader that supports ISO 7816 Class A, B, and C (5
V, 3 V, and 1.8 V) smart cards. It also works with MCU cards following either the T=0 and T=1
protocol.
The card ATR indicates the specific operation mode (TA2 present; bit 5 of TA2 must be 0) and when
that particular mode is not supported by the ACR3901U-S1, it will reset the card to negotiable mode. If
the card cannot be set to negotiable mode, the reader will then reject the card.
When the card ATR indicates the negotiable mode (TA2 not present) and communication parameters
other than the default parameters, the ACR3901U-S1 will execute the PPS and try to use the
communication parameters that the card suggested in its ATR. If the card does not accept the PPS,
the reader will use the default parameters (F=372, D=1).
For the meaning of the aforementioned parameters, please refer to ISO 7816-3.
3.2. Memory-based Smart Cards
ACR3901U-S1 works with several memory-based smart cards such as:
•Cards following the I2C bus protocol (free memory cards) with maximum 128 bytes page with
capability, including:
oAtmel®: AT24C01/02/04/08/16/32/64/128/256/512/1024
oSGS-Thomson: ST14C02C, ST14C04C
oGemplus: GFM1K, GFM2K, GFM4K, GFM8K
•Cards with secure memory IC with password and authentication, including:
oAtmel®: AT88SC153 and AT88SC1608
•Cards with intelligent 1 KB EEPROM with write-protect function, including:
oInfineon®: SLE4418, SLE4428, SLE5518 and SLE5528
•Cards with intelligent 256 bytes EEPROM with write-protect function, including:
oInfineon®: SLE4432, SLE4442, SLE5532 and SLE5542
•Cards with ‘104’ type EEPROM non-reloadable token counter cards, including:
oInfineon®: SLE4406, SLE4436, SLE5536 and SLE6636
•Cards with Intelligent 416-bit EEPROM with internal PIN check, including:
oInfineon®: SLE4404
•Cards with Security Logic with Application Zone(s), including:
oAtmel®: AT88SC101, AT88SC102 and AT88SC1003

ACR3901U-S1 – Reference Manual [e-mail]
Version 1.09 www.acs.com.hk
Page 9 of 96
4.0.System Block Diagram
Figure 1: ACR3901U-S1 Architecture
ACR3901U-S1
Power
Management
MCU
Bluetooth
Mobile device or
Computer
LEDs
Full-sized
Card
Rechargeable
Battery
Bluetooth Module
USB
Computer

ACR3901U-S1 – Reference Manual [e-mail]
Version 1.09 www.acs.com.hk
Page 10 of 96
5.0.Hardware Design
5.1. Battery
ACR3901U-S1 is using a rechargeable Lithium-ion battery which has a capacity of 320 mAh.
5.1.1. Battery charging
Once the battery of ACR3901U-S1 runs out, it may be charged in any of the following modes: OFF,
USB, Bluetooth; as long as it is connected to a power outlet.
5.1.2. Battery life
The battery life is dependent on the usage of the device. Below is an estimate of the battery life
depending on the various work conditions:
Mode Estimated Battery Life
Working Mode 24 days*(1)
Standby Mode 28 days(2)
OFF Mode 2 years
Table 2: Estimated Battery Lifespan
*Note: Results may vary as it depends on the smart card used.
(1) In Bluetooth mode, run 10 operations per day with 1 minute operation run.
(2) In Bluetooth mode, set sleep time as 60 seconds and wake up once per day.
5.2. Bluetooth Interface
ACR3901U-S1 uses Bluetooth Low Energy (LE) 4.0 as the medium to pair the device with
computers/mobile devices.
5.3. USB Interface
The micro-USB port is used to connect the ACR3901U-S1 to the computer as battery charging port.
This port is also used in order for the ACR3901U-S1 to operate in PC-linked mode.
5.3.1. Communication Parameters
ACR3901U-S1 is connected to a computer through USB as specified in the USB Specification 2.0.
ACR3901U-S1 is working in full speed mode, i.e. 12 Mbps.
Pin Signal Function
1 VBUS +5 V power supply for the reader
2 D- Differential signal transmits data between ACR3901U-S1 and computer
3 D+ Differential signal transmits data between ACR3901U-S1 and computer
4 GND Reference voltage level for power supply
Table 3: USB Interface Wiring

ACR3901U-S1 – Reference Manual [e-mail]
Version 1.09 www.acs.com.hk
Page 11 of 96
5.3.2. Endpoints
ACR3901U-S1 uses the following endpoints to communicate with the host computer:
Control Endpoint For setup and control purpose
Bulk OUT For command to be sent from host to ACR3901U-S1
(data packet size is 64 bytes)
Bulk IN For response to be sent from ACR3901U-S1 to host
(data packet size is 64 bytes)
Interrupt IN For card status message to be sent from ACR3901U-S1 to host
(data packet size is 8 bytes)
5.4. User Interface
5.4.1. Mode Selection Switch
ACR3901U-S1 has three modes: USB, Off, and Bluetooth. User can select one mode at a time as a
data transmission interface.
Symbol Switch Active Mode
USB PC-linked
Off No power
Bluetooth Bluetooth
Table 4: Mode Selection Switch

ACR3901U-S1 – Reference Manual [e-mail]
Version 1.09 www.acs.com.hk
Page 12 of 96
5.4.2. Status LED
ACR3901U-S1 has three LEDs to show the various operation status, where:
•Red LED - Battery status
•Blue LED - Card and reader status under Bluetooth mode
•Green LED - Card and reader status under USB mode
Color LED Activity Status
Red On The battery is charging (will turn OFF after battery is fully charged)
Slow flash
(1 second/flash) The battery needs to be charged
Blue
Fast–Slow flash
(Fast: 250 ms/flash;
Slow: 500 ms/flash)Ready for Bluetooth device pairing
Slow flash
(2 seconds/flash) Bluetooth device connected and no card operation
Fast flash Data transferring between the reader and mobile device
On Card is connected and powered on
Green
Slow flash
(2 seconds/flash) No card operation and the reader is waiting for PC instructions
Fast flash Data transferring between the reader and PC
On Card is connected and powered on
Table 5: Status LED
Note: When red, blue and green LEDs are OFF, the reader is powered off. Both blue and green LEDs
will light for 1 second, and then will turn off when the reader received some critical error codes from
the Bluetooth module.
5.5. Smart Card Interface
The interface between the ACR3901U-S1 and the inserted smart card follows the specification of ISO
7816-3 with certain restrictions or enhancements to increase the practical functionality of ACR3901U-
S1.
5.5.1. Smart Card Power Supply VCC (C1)
The current consumption of the inserted card must not be higher than 50 mA.
5.5.2. Programming Voltage VPP (C6)
According to ISO 7816-3, the smart card contact C6 (VPP) supplies the programming voltage to the
smart card. Since all common smart cards in the market are EEPROM-based and do not require the
provision of an external programming voltage, the contact C6 (VPP) has been implemented as a
normal control signal in the ACR3901U-S1. The electrical specifications of this contact are identical to
those of the signal RST (at contact C2).

ACR3901U-S1 – Reference Manual [e-mail]
Version 1.09 www.acs.com.hk
Page 13 of 96
5.5.3. Card Type Selection
The controlling computer must always select the card type through the proper command sent to the
ACR3901U-S1 prior to activating the inserted card. This includes both the memory cards and MCU-
based cards.
For MCU-based cards, the reader allows to select the preferred protocol, T=0 or T=1. However, this
selection is only accepted and carried out by the reader through the PPS when the card inserted in
the reader supports both protocol types. Whenever an MCU-based card supports only one protocol
type, T=0 or T=1, the reader automatically uses that protocol type, regardless of the protocol type
selected by the application.
5.5.4. Interface for Microcontroller-based Cards
For microcontroller-based smart cards, only the contacts C1 (VCC), C2 (RST), C3 (CLK), C5 (GND)
and C7 (I/O) are used. A frequency of 4.8 MHz is applied to the CLK signal (C3).
5.5.5. Card Tearing Protection
The ACR3901U-S1 provides a mechanism to protect the inserted card when it is suddenly withdrawn
while it is powered up. The power supply to the card and the signal lines between the ACR3901U-S1
and the card is immediately deactivated when the card is being removed.However, as a rule to avoid
any electrical damage, a card should only be removed from the reader while it is powered down.
Note: ACR3901U-S1 never switches on the power supply to the inserted card by itself. The
controlling computer through the proper command sent to the reader must explicitly do this.

ACR3901U-S1 – Reference Manual [e-mail]
Version 1.09 www.acs.com.hk
Page 14 of 96
6.0.Software Design
6.1. Bluetooth Communication Protocol
6.1.1. Bluetooth Connection Program Flow
The program flow of a Bluetooth connection is shown below:
Figure 2: Bluetooth Connection Flow
Yes
No
Bluetooth Start
(Reset/Power up)
Successful Connection?
No
Enable Service
Disconnect?
Reset
Power Off
Authentication
Smart Card Operation with Security Channel
Successful Authentication?
Yes

ACR3901U-S1 – Reference Manual [e-mail]
Version 1.09 www.acs.com.hk
Page 15 of 96
6.1.2. Profile Selection
ACR3901U-S1 is a smart card reader that is designed to use Bluetooth technology as an interface to
transmit data. A customized service called Commands Communication with three pipes is used: one
pipe is used for command request, second pipe is for command response, and the third pipe is used
to notify the paired device about the card and sleep mode status.
Also, the current reader’s battery status is significant when the reader is operating in Bluetooth mode,
hence, a customized battery service is used to notify the paired device about the current battery
status. When there is a change in the battery status, the reader will notify the paired device through a
specific pipe. To simplify, the battery levels are divided into three groups, below is a table
summarizing the battery level and its corresponding return value:
Status Voltage Return Value
Sufficient battery ≥ 3.3 V FEh
Low battery <3.3 V and ≥ 2.9 V Value other than FFh/FEh/00h
No battery <2.9 V 00h
USB mode FFh
In Card Status Notification service, it will notify the paired device on any changes on the card status or
when the reader enters sleep mode. Below is a list of the status and the corresponding return value:
Status Return Value
No card present 50 02h
Card present 50 03h
Reader has entered sleep mode 50 04h
Finally, to provide more reader information to the user, a customized Device Information service was
added. This can only be read manually, or by an application request. The characteristics include
Manufacturer Name, Firmware Revision, Model Number, and Serial Number.
Figure 3: nRFgo Studio GATT Setting Interface

ACR3901U-S1 – Reference Manual [e-mail]
Version 1.09 www.acs.com.hk
Page 16 of 96
nRFgo-Studio Configuration adds one service, and there will be totally 10 services:
#define PIPE_GAP_DEVICE_NAME_SET 1
#define PIPE_COMMANDS_COMMUNICATION_COMMANDS_RESPONSE_TX 2
#define PIPE_COMMANDS_COMMUNICATION_COMMANDS_REQUEST_RX 3
#define PIPE_COMMANDS_COMMUNICATION_CARD_STATUS_NOTIFICATION_TX 4
#define PIPE_BATTERY_BATTERY_LEVEL_TX 5
#define PIPE_BATTERY_BATTERY_LEVEL_SET 6
#define PIPE_DEVICE_INFORMATION_MANUFACTURER_NAME_STRING_SET 7
#define PIPE_DEVICE_INFORMATION_FIRMWARE_REVISION_STRING_SET 8
#define PIPE_DEVICE_INFORMATION_MODEL_NUMBER_STRING_SET 9
#define PIPE_DEVICE_INFORMATION_SERIAL_NUMBER_STRING_SET 10
#define NUMBER_OF_PIPES 10
#define PIPE_GAP_DEVICE_NAME_SET is used to change the device name at runtime by the
application controller. So that in Bluetooth mode, the advertising name will be in the format of
“ACR3901U-S1XXXXXXX”, where “XXXXXXX” is the last 7 bytes of reader’s serial number.
In order to make the advertising name be “ACR3901U-S1XXXXXXX”, Bluetooth Mode Start operation
should be implemented first.
Bluetooth Mode Start:
1. Setup (06h) uploads the configuration to Bluetooth module.
2. Use pipe 1 to set the device name in the format of “ACR3901U-S1XXXXXXX”
(PIPE_GAP_DEVICE_NAME_SET).
3. Connect (0Fh).
4. Advertising.
Attribute Name UUID Handle
DeviceName 2A00 03h
Send (Reader →Paired device) 8002 0Bh
Receive
(Paired device →Reader) 8003 0Eh
CardStatus 8004 10h
BatteryLevel 2A19 14h
Manufacturer 2A29 18h
FW_Version 2A26 1Bh
ModelNumber 2A24 1Eh
SerialNumber 2A25 21h
Table 6: ACR3901U-S1 Service Handles and UUID Information List

ACR3901U-S1 – Reference Manual [e-mail]
Version 1.09 www.acs.com.hk
Page 17 of 96
6.1.3. Authentication
Before any sensitive data can be loaded into ACR3901U-S1, the data processing server must be
authenticated by ACR3901U-S1 for the privilege to modify the secured data inside reader. In
ACR3901U-S1, a mutual authentication method is being used.
For better pictorial illustration, please refer to figure below (The picture below has omitted the bridging
device for simplicity and better illustration):
Figure 4: Authentication Procedure
After successful authentication, a 16-byte Session Key is generated in both ACR3901U-S1 and the
data server.
Default Customer Master Key (Hex): FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
Note: The reader will be locked and unusable once incorrect authentication keys are entered more
than six (6) times.
For more detailed information, you may contact an ACS sales representative.
1.
Send authentication
request message
2.
Answer to the request
message
3.
Send authentication
response message
4.
Answer to the
authentication response
message
Transmitted
through the
bridging device

ACR3901U-S1 – Reference Manual [e-mail]
Version 1.09 www.acs.com.hk
Page 18 of 96
6.1.4. Frame Format
6.1.4.1. Bluetooth Frame Format
HID Frame Length (Bytes) Description
Identifiers 1 Commands
Length 2 Length {Payload+Checksum}
Payload 0-N Data
Checksum 1 XOR {Identifiers,Length,Payload}
Table 7: Bluetooth Frame Format
The frame format should be:
Identifier + LEN1 + LEN2 + N-bytes Payload + Checksum
If the total command length, including identifier, length, and payload, is greater than 20 bytes, then the
reader or the paired device will automatically divide it into several frames.
Data checksum is used in detecting errors that may have been introduced during wireless data
transmission. To calculate the data checksum: XOR {Identifiers,Length,Payload}.
Example: 62010063 => Checksum = 63h
6.1.4.2. Bluetooth Frame Format after Mutual Authentication
Mutual authentication was introduced to avoid man-in-the-middle attack through the Bluetooth
communication channel. After a successful mutual authentication, the Bluetooth Frame Format in
Table 7 will be encrypted and packed with 1 byte header byte, 2 Len byte, and 1 check byte. The
frame format after mutual authentication should look like the structure below:
Header + Len + (Identifiers + Length + Payload + Checksum)* + Check byte
Note: Each 16 bytes of data will be encrypted with the Session Key using the AES-128 CBC
cipher mode. The initial vector is 16 bytes (00h) in AES-128 CBC cipher mode.
HID Frame Length (bytes) Description
Header byte 1 Value: 72h / 22h
Len 2 Length {Identifiers + Length + Payload + Checksum +
Check + Stop byte}
Identifiers 1 Commands
Encrypted data of
the Bluetooth frame
format;
The final data length
of this part is 16*N
bytes (N>0)
Length 2 Length {Payload + Checksum}
Payload 0-N Data
Checksum 1 XOR {Identifiers, Length, Payload}
Check byte 1 XOR {Header, Len, Encrypted(Identifiers, Length, Payload,
Checksum)}
Table 8: Encrypted Frame Format after Mutual Authentication

ACR3901U-S1 – Reference Manual [e-mail]
Version 1.09 www.acs.com.hk
Page 19 of 96
6.1.5. Bluetooth Communication Protocol
ACR3901U-S1 communicates to the paired device using the Bluetooth interface with a predefined
protocol. The protocol is similar to the formats of the CCID Command Pipe and Response Pipe.
Command Mode supported Sender Description
62h Authenticated Paired
device ICC Power On
63h Authenticated Paired
device ICC Power Off
65h Authenticated Paired
device Get Card Presence
6Fh Authenticated Paired
device Exchange APDU
67h Authenticated Paired
device Exchange APDU2
61h Authenticated Paired
device Set Parameters
6Bh Authenticated Paired
device Peripheral Commands
70h Connected/Authenticated Paired
device SPH_to_RDR_ReqAuth*
71h Connected/Authenticated Paired
device SPH_to_RDR_AuthRsp*
Table 9: Command Code Summary
Command Mode Supported Sender Description
12h Authenticated Reader Response to ICC Power On
13h Authenticated Reader Response to ICC Power Off
14h Authenticated Reader Response to Get Card Presence
11h Authenticated Reader Response to Exchange APDU
17h Authenticated Reader Response to Exchange APDU2
16h Authenticated Reader Response to Set Parameters
15h Authenticated Reader Response to Peripheral Commands
20h Connected/Authenticated Reader RDR_to_SPH_AuthRsp1*
21h Connected/Authenticated Reader RDR_to_SPH_AuthRsp2*
Table 10: Response Code Summary
*Note: These command/response codes are the communication codes being used in Mutual
Authentication.

ACR3901U-S1 – Reference Manual [e-mail]
Version 1.09 www.acs.com.hk
Page 20 of 96
6.1.5.1. Card Power On
This command sends a power on request to the reader.
Command Format
Offset Field Size Value Description
0 bMessageType 1 62h -
1 LEN1 LEN2 (wLength) 2 0100h
Number of extra bytes starting from
the next field for this message, and is
expressed in two bytes, and LEN1 is
LSB while LEN2 is MSB
3 CSUM (wChecksum) 1 63h CSUM means the XOR values of all
bytes in the command
Response Data Format
Offset Field Size Value Description
0 bMessageType 1 12h -
1 LEN1 LEN2 (wLength) 2
Number of extra bytes starting from
the next field for this message. It is
expressed in two bytes long. LEN1 is
LSB while LEN2 is MSB.
3 N byte ATR N - Card Answer-To-Reset
3+N CSUM (wChecksum) 1 - CSUM means the XOR values of all
bytes in the command
Response Data Format (Error)
Offset Field Size Value Description
0 bMessageType 1 92h -
1 LEN1 LEN2 (wLength) 2 0200h
Number of extra bytes starting from
the next field for this message. It is
expressed in two bytes long. LEN1 is
LSB while LEN2 is MSB.
3 Error Code (bErrorCode) 1 - Error Code. Refer to Appendix A
4 CSUM (wChecksum) 1 - CSUM means the XOR values of all
bytes in the command
Example:
Request = 62 01 00 63
Response = 12 14 00 3B BE 11 00 00 41 01 38 00 00 00 00 12 34 56 78 01
90 00 73
ATR = 3B BE 11 00 00 41 01 38 00 00 00 00 12 34 56 78 01