WO2013067793A1

WO2013067793A1 - System for executing security operations and method for same

Info

Publication number: WO2013067793A1
Application number: PCT/CN2012/072328
Authority: WO
Inventors: 曹岚健; 余万涛
Original assignee: 中兴通讯股份有限公司
Priority date: 2011-11-11
Filing date: 2012-03-14
Publication date: 2013-05-16
Also published as: CN103108323A; CN103108323B

Abstract

Disclosed in the present invention are a security operation execution system and method for same, the system comprising the addition to a mobile terminal of an intermediate security application module by means of which the terminal is able indirectly to invoke security information saved on a smart card and also to send commands to said smart card, thus enabling the intermediate security application module of the terminal, when receiving a security operation command from at least one mobile application module, jointly to execute with the smart card the security operation corresponding to said security operation command. The technical solution of the present invention can accelerate the promotion of smart card-based authentication while enhancing the security and reliability of mobile-terminal applications and services.

Description

TECHNICAL FIELD The present invention relates to the field of communications, and in particular to a security operation execution system and an execution method. BACKGROUND With the upgrading of networks, mobile terminal applications and mobile services are increasing, which makes the life of mobile users greatly facilitated. The popularity of these mobile services makes the security certification of users and the security protection of information more and more important, and users are more and more concerned about security issues. Mobile payment and enterprise information systems, in particular, require reliable authentication of users and security of information to ensure the security of transactions and information. Public Key Infrastructure (PKI) is a mature business authentication technology. ΡΚΙ refers to a versatile security infrastructure that implements and provides network information security services using public key concepts and technologies. ΡΚΙ Technology is the core of information security technology and the key and basic technology of e-commerce.

The core of the 是 is the Certificate Authority (CA), which guarantees the security of the private key is the basis of the PKI system. Many people now store private keys and digital certificates in terminals (including: fixed terminals and mobile terminals), but this method is very insecure. A hacker may illegally steal the private key of a legitimate user, pretending to be a legitimate user to scam and illegally trade on the network; the terminal virus may also delete the data on the hard disk, resulting in the inability to use the PKI system; Bind to a specific terminal, users cannot easily use their own private key on other terminals. The development of smart card technology has made it possible to implement mobile digital signature technology. Smart cards are highly resistant to security devices and are easy to carry, and can achieve a high level of security based on cryptography. Therefore, it is safe to store the private key and digital certificate on the smart card and use the smart card to complete the authentication. Reliable and convenient, at the same time, it can also realize the function of generating key pair and completing digital signature on the smart card. Nowadays, the processing capacity of smart cards has been greatly enhanced, and the services carried on smart cards are also increasing. However, since existing mobile terminals do not have an open application to directly access the interface of the smart card, the data or function on the smart card is caused. Cannot be called by the mobile terminal. At the same time, due to the difference in the operating system of the terminal, the smart card with the authentication service needs to adapt the terminal, which causes great difficulty in the productization of the smart card-based service authentication technology. SUMMARY OF THE INVENTION The present invention provides a security operation execution system and an execution method to solve at least the problem that the mobile terminal in the related art lacks an interface for directly accessing the smart card, so that the security information on the smart card cannot be called by the mobile terminal. According to an aspect of the invention, a security operation execution system is provided. The security operation execution system according to the present invention comprises: a mobile terminal and a smart card; the mobile terminal comprises: at least one mobile application module configured to send a security operation instruction; an intermediate security application module corresponding to the smart card, configured to receive from the mobile The security operation instruction of the application module is combined with the smart card to implement the security operation corresponding to the security operation instruction; the smart card is set to store the security information required by the mobile application module, and is jointly implemented and safely operated with the intermediate security application module. The security operation corresponding to the instruction. In the above system, the mobile terminal further includes: a self-test module, configured to detect whether the intermediate security application module and the smart card are from the same publisher system, and is configured to ensure that only one intermediate security application exists in the terminal. In the above system, the intermediate security application module includes: a mobile application management unit configured to authenticate a mobile application module that needs to access an intermediate security application module; and a smart card access unit configured to obtain a security operation instruction from the smart card Corresponding first security operation information; the instruction execution unit is configured to perform a security operation on the security operation instruction according to the first security operation information. In the above system, the instruction execution unit includes: a file management unit, configured to: when the mobile application module is authorized to access the intermediate security application module, send, to the smart card, the first security operation information corresponding to the security operation instruction, And creating and deleting a secure storage domain for storing the first security operation information; the security storage unit is set to ensure that the secure storage domain created by the file management unit can only be accessed by the intermediate security application module; the security operation unit is set to be secure according to The first security operation information in the storage domain performs a security operation on the security operation instruction. In the above system, the first security operation information includes at least one of the following: a message related to the digital certificate, a random symmetric key generated by the application server, and a public key in the key pair generated by the smart card. In the above system, the smart card includes: a security data storage module, configured to store the second security operation information, where the second security operation information includes: the first security operation information and the private key generated by the smart card The access control module is configured to control the smart card to receive only the security operation instruction from the intermediate security application module; the security operation module is configured to perform the security operation corresponding to the security operation instruction. In the above system, the security operation instruction includes at least one of the following: an encryption instruction, a decryption instruction, an integrity protection instruction, an integrity verification instruction, a generation key pair instruction, and a secure delegation access request. In the above system, the security operation includes at least one of the following: an encryption operation, a decryption operation, an integrity protection operation, an integrity verification operation, a key pair operation, and a secure delegation access verification. According to another aspect of the present invention, a security operation execution method based on the above-described security operation execution system is provided. The security operation execution method according to the present invention includes: the intermediate security application module of the mobile terminal receives a security operation instruction from the at least one mobile application module; the intermediate security application module and the smart card jointly implement a security operation corresponding to the security operation instruction . In the foregoing method, before the intermediate security application module and the smart card jointly implement the security operation corresponding to the security operation instruction, the method further includes: the mobile terminal detecting whether the intermediate security application module and the smart card are from the same publisher system. In the foregoing method, before the intermediate security application module receives the security operation instruction from the mobile application module, the method further includes: the intermediate security application module authenticating the mobile application module that needs to access the intermediate security application module. In the above method, the intermediate security application module and the smart card jointly implement the security operation corresponding to the security operation instruction, including: the intermediate security application module acquires the first security operation information corresponding to the security operation instruction from the smart card; The application module performs a security operation on the security operation instruction according to the first security operation information. In the above method, performing security operations on the security operation instructions according to the first security operation information, further includes: when the mobile application module is authorized to access the intermediate security application module, the intermediate security application module sends the acquisition and security to the smart card. The first security operation information corresponding to the operation instruction, and the security storage domain for saving the first security operation information is created and deleted, wherein the security storage domain can only be accessed by the intermediate security application module; the intermediate security application module is based on security The first security operation information in the storage domain performs a security operation on the security operation instruction. In the above method, the first security operation information includes at least one of the following: a digital certificate related message, a random symmetric key generated by the application server, and a public key in the key pair generated by the smart card. In the above method, before the smart card and the intermediate security application module jointly implement the security operation corresponding to the security operation instruction, the method further includes at least one of the following: the smart card stores the second security operation information, where The second security operation information includes: first security operation information and a private key in the key pair generated by the smart card; and the smart card controls the smart card to receive only the security operation instruction from the intermediate security application module. In the above method, the security operation instruction comprises at least one of the following: an encryption instruction, a decryption instruction, an integrity protection instruction, an integrity verification instruction, opening a digital envelope instruction, generating a digital envelope instruction, and generating a key pair instruction. In the above method, the security operation includes at least one of the following: an encryption operation, a decryption operation, an integrity protection operation, an integrity verification operation, opening a digital envelope operation, generating a digital envelope operation, and generating a key pair operation. The present invention solves the problem that the mobile terminal in the related art lacks an interface for directly accessing the smart card by adding the intermediate security application module to the mobile terminal, so that the data or function on the smart card cannot be called by the mobile terminal. The problem, in turn, speeds up the promotion based on smart card service authentication, and improves the security and reliability of mobile terminal applications and services. BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are set to illustrate,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a block diagram showing the structure of a security operation execution system according to an embodiment of the present invention; FIG. 2 is a block diagram showing the structure of a security operation execution system according to a preferred embodiment of the present invention; A flowchart of a security operation execution method based on the security operation execution system shown in FIG. 1. FIG. 4 is a flowchart of automatic detection by the self-test module when the intermediate security application module is installed to the mobile terminal according to an example of the present invention. 5 is a flow chart of a method for a mobile application module to perform a service request according to an example of the present invention; and FIG. 6 is a flow chart of data communication between a mobile application and an application server according to an example of the present invention. BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, the present invention will be described in detail with reference to the accompanying drawings. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict. 1 is a block diagram showing the structure of a security operation execution system according to an embodiment of the present invention. As shown in FIG. 1 , the security operation execution system mainly includes: a mobile terminal 10 and a smart card 20, and the mobile terminal 10 may include: at least one mobile application module 100 configured to send a security operation instruction; and an intermediate security application module 102, The intermediate security application module corresponds to the smart card 20, and is a unified smart card security application interface, configured to receive a security operation instruction from the mobile application module 100, and the smart card 20 jointly implements a security operation corresponding to the security operation instruction; The smart card 20 is arranged to cooperate with the intermediate security application module 102 to implement security operations corresponding to security operational instructions. In the related art, the mobile terminal lacks an interface for directly accessing the smart card, so that data or functions on the smart card cannot be called by the mobile terminal. Using the system shown in FIG. 1, an intermediate security application module 102 is added to the mobile terminal 10, the intermediate security application module and the smart card 20 are from the same publisher system, and receive security operation instructions from the mobile application module 100. Then, the security operation corresponding to the security operation instruction is implemented in conjunction with the smart card 20, thereby accelerating the promotion based on the smart card service authentication, and improving the security and reliability of the mobile terminal application and service. It should be noted that the mobile terminal may include multiple mobile application modules, which are provided by different application providers, and the intermediate security application module is released by the card issuer system corresponding to the smart card. Different card issuer systems issue their own intermediate security applications in accordance with the security delegation system architecture and security delegation method, and provide access to the smart cards to which the card issuer system belongs. In order to ensure the security of the information stored on the smart card, various application modules installed in the mobile terminal cannot access the smart card directly except the intermediate security application module. The mobile application module may send a command to the intermediate security application module to request the intermediate security application module to read the security related information of the mobile application module stored on the smart card, but the security related information cannot leave the intermediate security application module and the smart card. The security-related information does not include the user's private key, and the user's private key cannot leave the smart card. The mobile application module can entrust the intermediate security application module and the smart card to perform security operations, such as encryption, decryption, integrity protection, and integrity verification, on the data and signaling of the mobile application module interacting with the external network. In a preferred implementation, the security operation instructions may include, but are not limited to, at least one of the following: an encryption instruction, a decryption instruction, an integrity protection instruction, an integrity verification instruction, a generation key pair instruction, and a secure delegation access request. The above security operations may include, but are not limited to, at least one of the following: an encryption operation, a decryption operation, an integrity protection operation, an integrity verification operation, a key pair operation, and a secure delegation access verification. Preferably, as shown in FIG. 2, the mobile terminal further includes: a self-test module 104, configured to detect whether the intermediate security application module and the smart card are from the same publisher system, and ensure that only one intermediate security application exists in the terminal. In a preferred implementation process, whether the intermediate security application module corresponds to the smart card may be detected by setting a separate self-test module in the mobile terminal, and the foregoing detection function may be integrated into other modules of the mobile terminal, or may be connected in the smart card. When the mobile terminal is triggered, the above automatic detection is triggered, and it is within the protection scope of the present invention to realize whether the intermediate security application module and the smart card are from the same publisher system and ensure that only one intermediate security application exists in the terminal. Preferably, as shown in FIG. 2, the intermediate security application module 102 may include: a mobile application management unit 1020 configured to authenticate the mobile application module 100 that needs to access the intermediate security application module 102, and control at least one mobile application module. 100 accessing the intermediate security application; the smart card access unit 1022 is configured to acquire first security operation information corresponding to the security operation instruction from the smart card; the instruction execution unit 1024 is configured to perform security operation according to the first security operation information The instruction performs security operations. In a preferred implementation process, the foregoing first security operation information may include, but is not limited to, at least one of the following: a message related to the digital certificate, a random symmetric key generated by the application server, and a public key in the key pair generated by the smart card. In a preferred implementation, the mobile application management unit 1020 provides management of the mobile application module accessing the intermediate security application module within the mobile terminal. Other mobile application modules in the mobile terminal want to access the intermediate security application module and perform security delegation, and should be allowed to access after the authentication of the intermediate security application module. The mobile application management unit also needs to provide some signaling for the mobile application module to instruct the intermediate security application module to perform certain operations, such as encrypting the information, decrypting the information, protecting the integrity of the information, and Perform integrity verification, encapsulate information, generate key pairs, and more. In a preferred implementation process, the smart card access unit 1022 functions that the mobile terminal can only access the smart card through the smart card access unit of the intermediate security application module, including reading information of a specific area on the smart card, and deleting information of a specific area on the smart card, Information is written to a specific area in the smart card, etc. The smart card access unit also needs to provide commands for entrusting the smart card to perform some security operations, such as generating a key pair required by the mobile application user, requesting a digital signature, encrypting and decrypting data, opening a digital envelope, and the like. Preferably, the instruction execution unit 1024 may further include: a file management unit (not shown) configured to send the acquisition to the smart card corresponding to the security operation instruction when the mobile application module is authorized to access the intermediate security application module. The first security operation information, and create and delete a secure storage domain for storing the first security operation information; a secure storage unit (not shown), which is set to ensure that the secure storage domain created by the file management unit can only Accessed by the intermediate security application module; the security operation unit (not shown) is configured to perform security operations on the security operation instructions according to the first security operation information in the secure storage domain. In a preferred implementation process, the file management unit functions to manage the temporary secure storage area to which the intermediate security application module belongs. These secure storage domains store mobile application module security related information, including related information in the digital certificate, a random symmetric key generated by the application server, a public key in the key pair generated by the smart card, etc., but excluding the user private key, the user The private key cannot leave the smart card. When the mobile application is authorized to access the intermediate security application module, the intermediate security application module sends a command to the smart card to read the security related information of the mobile application module stored in the smart card, and creates a temporary secure storage domain in the terminal, and stores these Security information; When the mobile application module is closed, the mobile application module disconnects from the intermediate security application module, and the intermediate security application module subsequently deletes the temporary secure storage domain created for the mobile application. Therefore, the role of the file management unit is to create a temporary secure storage domain or delete a temporary secure storage domain for a mobile application with a secure delegate. In a preferred implementation, the security storage unit functions to provide storage security of the mobile application module security related information within the mobile terminal. The temporary secure storage domains created by the intermediate security application module for storing the security information related to the mobile application modules read from the smart card can only be accessed by the intermediate security application module, and all information created and stored by the intermediate security application module is The other mobile application modules in the mobile terminal are closed and cannot be accessed and operated by other mobile application modules in the mobile terminal. In a preferred implementation, the security computing unit functions to provide security operations for securely entrusted mobile application modules, including data encryption, decryption, integrity protection, and integrity verification. If the intermediate security application module authorizes the mobile application access module, the intermediate security application module creates a temporary secure storage domain for the mobile application module, and reads the security information associated with the mobile application module from the smart card and stores it in the created security. Storage domain. The security related information includes related information in the digital certificate, a random symmetric key generated by the application server, a public key in the key pair generated by the smart card, and the like. The secure computing function of the intermediate security application module identifies the public key, security algorithm identifier, or runnable code in the digital certificate. The secure computing unit can use these security related information to perform secure operations, secure encapsulation, and the like on data from the mobile application module. Preferably, as shown in FIG. 2, the smart card 20 includes: a secure data storage module 202 configured to store second security operation information, where the second security operation information includes: first security operation information and a secret generated by the smart card The private key in the key pair; the access control module 204 is configured to control the smart card to receive only the security operation instruction from the intermediate security application module; the security operation module 206 is configured to perform the security operation corresponding to the security operation instruction . In the preferred implementation process, the function of the secure data storage module is that the mobile application module that performs the security delegation stores its own private key and digital certificate in the smart card, and the smart card establishes a secure storage domain for the mobile application module, and saves the mobile application module. Security related information, including private keys and digital certificates. Secure storage domain is Refers to the secure storage domain located in the smart card, and the smart card can receive commands from the intermediate security application module to create or delete the above secure storage domain. In a preferred implementation process, the function of the access control module is that the smart card only accepts read and write operations and other control signaling from the intermediate security application module, and prohibits other application modules in the terminal from accessing the smart card. In a preferred implementation process, the function of the security computing module is that after receiving the instruction from the intermediate security application module to generate the key pair, the smart card can use the security computing module to help the mobile application module generate the key pair; the smart card can generate the digital signature. And send it to the intermediate security application module; the smart card can open the digital envelope sent by the intermediate security application module; the smart card can also perform some data encryption and decryption processing. FIG. 3 is a flowchart of a security operation execution method based on the security operation execution system illustrated in FIG. 1 according to an embodiment of the present invention. As shown in FIG. 3, the method may include the following steps: Step S302: The intermediate security application module of the mobile terminal receives a security operation instruction from the at least one mobile application module; Step S304: The intermediate security application module and the smart card jointly implement and secure The security operation corresponding to the sexual operation instruction. In the related art, the mobile terminal lacks an interface capable of directly accessing the smart card, so that data or functions on the smart card cannot be called by the mobile terminal. The method shown in FIG. 3 is adopted to add an intermediate security application module to the mobile terminal, so that the mobile terminal can indirectly call the security information stored on the smart card through the intermediate security application module, thereby solving the problem that the mobile terminal lacks direct access to the smart card. The interface, so that the security information on the smart card cannot be called by the mobile terminal, thereby accelerating the promotion based on the smart card service authentication, and improving the security and reliability of the mobile terminal application and service. In a preferred implementation, the security operation instructions may include, but are not limited to, at least one of the following: an encryption instruction, a decryption instruction, an integrity protection instruction, an integrity verification instruction, a generation key pair instruction, and a secure delegation access request. The above security operations may include, but are not limited to, at least one of the following: an encryption operation, a decryption operation, an integrity protection operation, an integrity verification operation, a key pair operation, and a secure delegation access verification. Preferably, before performing step S304, the method further includes: the mobile terminal detecting whether the intermediate security application module and the smart card are from the same publisher system, and ensuring that only one intermediate security application exists in the terminal. The following describes an example of the automatic detection process of the self-test module described above with an example. 4 is a flow chart showing automatic detection of a self-test module when an intermediate security application module is installed to a mobile terminal according to an example of the present invention. As shown in FIG. 4, the self-test module in the mobile terminal runs a self-test program to detect whether a new smart card is inserted in the mobile terminal, and detects whether the intermediate security application module on the mobile terminal is a card issuer system corresponding to the inserted smart card. The intermediate security application module is released, the purpose of which is to ensure that as long as a smart card is inserted into the mobile terminal, there must be an intermediate security application module in the mobile terminal, and only one intermediate security application module exists. The automatic detection process may include the following processing steps: Step S402: The self-test module in the mobile terminal starts the self-test program. The self-test program should have the function of auto-starting, and it will start automatically every time the mobile terminal is turned on, and when the mobile terminal is running, if the smart card is plugged in, it will start itself; Step S404: The self-test module first determines whether the mobile terminal is inside There is a smart card insertion, if there is a smart card insertion, proceed to step S406 to detect whether the inserted smart card is from the same card issuer system as the smart card last inserted into the mobile terminal recorded by the self-test module; if there is no smart card insertion, go to the step S416. The intermediate security application module is notified that the security delegation operation cannot be performed. Step S406: The self-test module detects whether a new smart card is inserted into the mobile terminal. The new smart card refers to the smart card inserted into the mobile terminal and the smart card inserted into the mobile terminal recorded by the last self-test module belong to two different card issuer systems. If the self-test module detects that there is no smart card insertion, the self-test module notifies the intermediate security application module that no smart card is inserted, and the mobile application module cannot perform the security delegation operation; if the self-test module detects the smart card inserted into the mobile terminal and If the smart card inserted into the mobile terminal recorded by the last self-test module belongs to the same card issuer system, then the process goes to step S418, and the self-test module notifies the intermediate security application module to perform security delegation; if the self-test module finds the insertion The smart card and the self-test module record the smart card inserted into the mobile terminal last time belong to two different card issuer systems, and then proceed to step S408; Step S408: The self-test module further checks whether there is intermediate security in the mobile terminal Application module. If there is no intermediate security application module in the mobile terminal, proceeding to step S414, the self-test module notifying the mobile terminal to download and install the intermediate security application module issued by the card issuer system to which the smart card inserted into the mobile terminal belongs; The detecting module detects that there is a new smart card insertion in the mobile terminal and the intermediate security application module exists in the mobile terminal, and then performs step S410; Step S410: The self-test module further checks whether the intermediate security application module is inserted into the mobile terminal. The intermediate security application module issued by the card issuer system to which the smart card belongs. If yes, go to step S418, notify the intermediate security application module to perform security delegation; if not, proceed to step S412, the self-test module Notifying the mobile terminal to uninstall the intermediate security application module, and downloading and installing the intermediate security application module issued by the card issuer system to which the smart card inserted into the mobile terminal belongs; Step S412: If the mobile terminal receives the uninstallation from the self-test module The instruction of the intermediate security application module, the mobile terminal uninstalls the intermediate security application module; Step S414: If the mobile terminal receives an instruction to download and install a new intermediate security application module from the self-test module, the mobile terminal downloads the installation by inserting into the The intermediate security application module issued by the card issuer system to which the smart card belongs in the mobile terminal; it should be noted that the mobile terminal needs to download from the application server of the card issuer system through the network and the smart card inserted into the mobile terminal belongs to Intermediate security application module released by the card issuer system. Step S416: If the intermediate security application module receives the report from the self-test module that cannot perform the security delegation, the intermediate security application module closes the security delegation service; step S418: if the intermediate security application module receives the self-test module The security entrustment service is implemented, and the intermediate security application module and the smart card can normally perform security entrustment services for the mobile application module. Preferably, before performing step S304, the method further includes: the intermediate security application module authenticating the mobile application module that needs to access the intermediate security application module. Preferably, step S304 may include the following processing:

(1) The intermediate security application module acquires the first security operation information corresponding to the security operation instruction from the smart card;

(2) The intermediate security application module performs a security operation on the security operation instruction according to the first security operation information. The first security operation information during the preferred implementation includes at least one of the following: a digital certificate related message, a random symmetric key generated by the application server, and a public key in the key pair generated by the smart card. Preferably, the performing the security operation on the security operation instruction according to the first security operation information may further include the following processing: (1) when the mobile application module is authorized to access the intermediate security application module, the intermediate security application module sends the smart security application module to the smart card. Obtaining first security operation information corresponding to the security operation instruction, and creating and deleting a security storage domain for saving the first security operation information, wherein the security storage domain can only be accessed by the intermediate security application module; (2) The intermediate security application module performs a security operation on the security operation instruction according to the first security operation information in the secure storage domain. Preferably, before performing step S304, at least one of the following processes may be included: but the smart card stores the second security operation information, where the second security operation information includes: the first security operation information and the smart card The private key in the generated key pair; the smart card controls the smart card to receive only security operational commands from the intermediate security application module. The above security operation execution method will be further described below in conjunction with two examples. 5 is a flow chart of a method for a mobile application module to make a service request in accordance with an example of the present invention. As shown in FIG. 5, the mobile application module sends a security operation instruction to the smart card and the intermediate security application module for processing, thereby performing security delegation. The method may include the following processing steps: Step S502: The intermediate security application module performs authentication and authentication on the mobile application module, and determines whether to allow the mobile application module to access the intermediate security application module; the intermediate security application module sends a query instruction to the smart card, and queries the smart card. Whether there is a security domain related to the mobile application module; the intermediate security application module reads the security related information of the mobile application user from the smart card related security domain, including related information in the digital certificate, but does not include the private key, and the private key cannot leave the smart card Step S504: The mobile application module generates a service authentication request and sends it to the intermediate security application module, where the intermediate security application module is instructed to process the service request message by encryption, integrity protection, and additional digital signature; S506: After receiving the service authentication request from the mobile application module, the intermediate security application module sends a digital signature request to the smart card according to the operation instruction of the mobile application module, requesting the smart card to generate a digital signature; Step S508: the smart card is After the digital signature request from the intermediate security application, the digital signature is generated by using the user private key, and a digital signature response is sent to the intermediate security application, and the digital signature is sent to the intermediate security application; Step S510: The intermediate security application module receives the After the digital signature of the smart card is responded, the digital signature is appended to the service authentication request according to the operation instruction of the mobile application module received in step S506, and the encryption and integrity protection algorithm is read from the digital certificate, and the digital certificate is obtained from the digital certificate. Read out the public key to encrypt and protect the message; Step S512: The intermediate security application module forwards the service authentication request to the application server, and sends the security-processed service authentication request to the application server. The application server refers to the user performing mobile payment, online shopping, and the like. , an application server of an application provider corresponding to the mobile application module. Step S514: After receiving the forwarding service authentication request from the intermediate security application module, the application server decrypts the message and performs integrity verification. If the decryption and integrity verification succeeds, the application server extracts the digital signature and authenticates the user. Step S516: After the application server authenticates the user, generates a random key, and uses the random key to respond to the service authentication request. Encryption and integrity protection; Step S518: The application server then uses the user's public key to generate a digital envelope, protects the encryption and integrity protected random key, and attaches it after the service authentication request response; Step S520: The application server The intermediate security application module sends a service authentication request response indicating whether the authentication succeeds or the authentication fails, and a digital envelope protecting the random key is attached. If the authentication succeeds, the user is allowed to access. If the authentication fails, the reason for the failure is indicated, and the connection is abandoned. Step S522: After receiving the service authentication request response from the application server, the intermediate security application module extracts the digital envelope therein. The intermediate security application module sends an open digital envelope request to the smart card, instructing the smart card to open the digital envelope, and extracting the random key therein; Step S524: After receiving the request for opening the digital envelope from the intermediate security application module, the smart card uses the user private key Open the digital envelope and remove the random key from it. The smart card then sends an open digital envelope response to the intermediate security application module, and sends the random key in the digital envelope to the intermediate security application module; Step S526: After the intermediate security application module receives the open digital envelope response from the smart card, the slave digital The decryption and integrity verification algorithm is read in the certificate, and the service authentication request response is decrypted and integrity verified using the random key sent by the smart card; Step S528: The intermediate security application module sends a service authentication response to the mobile application module, A service authentication request response signal including decryption and integrity verification. 6 is a flow diagram of data communication between a mobile application and an application server in accordance with an example of the present invention. As shown in FIG. 6, the mobile application module sends a security operation instruction to the smart card and the intermediate security application module for processing, thereby performing security delegation. The method can include the following processing steps: Step S602: The intermediate security application module has permitted the mobile application module to access the intermediate security application module, and the security related information of the mobile application module already exists in the intermediate security application module, including related information in the digital certificate, but does not include private The key, the private key cannot leave the smart card; Step S604: The mobile application module sends a data processing request to the intermediate security application module, where the method includes indicating that the intermediate security application module processes the data as encryption and integrity protection; Step S606: Intermediate security The application module reads the encryption and integrity protection algorithm from the digital certificate according to the indication, and reads the public key from the digital certificate to encrypt and protect the data. Step S608: The intermediate security application module forwards the data to the application server. Sending the security-processed data to the application server; Step S610: After receiving the forwarding data from the intermediate security application module, the application server decrypts the message and performs integrity verification; Step S612: The application server subsequently generates a random key. Use this The random key encrypts and integrity protects the response data; Step S614: The application server then uses the public key of the user to generate a digital envelope, protects the encryption and integrity protected random key, and attaches it to the response data; S616: The application server sends the response data to the intermediate security application module, and the digital envelope protecting the random key is attached; Step S618: After receiving the response data from the application server, the intermediate security application module extracts the digital envelope therein. The intermediate security application module sends an open digital envelope request to the smart card, instructing the smart card to open the digital envelope, and extracting the random key therein; Step S620: The smart card uses the user private key after receiving the request for opening the digital envelope from the intermediate security application module Open the digital envelope and remove the random key from it. The smart card then sends an open digital envelope response to the intermediate security application module, and sends the random key in the digital envelope to the intermediate security application module; Step S622: After the intermediate security application module receives the open digital envelope response from the smart card, the slave digital The decryption and integrity verification algorithm is read in the certificate, and the response data is decrypted and integrity verified using the random key sent by the smart card; Step S624: The intermediate security application module sends a forwarding response data to the mobile application module, including decryption And response data after integrity verification. From the above description, it can be seen that the present invention achieves the following technical effects: By adding an intermediate security application module to the mobile terminal, the mobile terminal can access the smart card, and the mobile terminal in the related art lacks an interface for directly accessing the smart card. Therefore, the data or function on the smart card cannot be called by the mobile terminal, thereby accelerating the promotion based on the smart card service authentication, and improving the security and reliability of the mobile terminal application and service. Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general-purpose computing device, which can be concentrated on a single computing device or distributed over a network composed of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device, such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein. The steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps are fabricated as a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software. The above are only the preferred embodiments of the present invention, and are not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

Claim

1. A security operation execution system, comprising: a mobile terminal and a smart card;

The mobile terminal includes:

At least one mobile application module configured to send a security operation instruction;

And an intermediate security application module, corresponding to the smart card, configured to receive the security operation instruction from the mobile application module, and the smart card jointly implements a security operation corresponding to the security operation instruction;

The smart card is configured to store security information required by the mobile application module, and cooperate with the intermediate security application module to implement a security operation corresponding to the security operation instruction.

2. The system according to claim 1, wherein the mobile terminal further comprises:

The self-test module is configured to detect whether the intermediate security application module and the smart card are from the same publisher system, and is configured to ensure that only one intermediate security application exists in the terminal.

3. The system according to claim 1, wherein the intermediate security application module comprises:

a mobile application management unit, configured to authenticate a mobile application module that needs to access the intermediate security application module;

a smart card access unit configured to acquire, from the smart card, first security operation information corresponding to the security operation instruction;

The instruction execution unit is configured to perform the security operation on the security operation instruction according to the first security operation information.

4. The system according to claim 3, wherein the instruction execution unit comprises:

a file management unit, configured to: when the mobile application module is authorized to access the intermediate security application module, send, to the smart card, the first security operation information corresponding to the security operation instruction, and Creating and deleting a secure storage domain for saving the first security operation information; a secure storage unit, configured to ensure that the secure storage domain created by the file management unit can only be accessed by the intermediate security application module;

And a security operation unit configured to perform the security operation on the security operation instruction according to the first security operation information in the secure storage domain.

The system according to claim 3, wherein the first security operation information comprises at least a message related to the digital certificate, a random symmetric key generated by the application server, and a key pair generated by the smart card. key.

6. The system according to claim 3, wherein the smart card comprises:

The security data storage module is configured to store the second security operation information, where the second security operation information includes: the first security operation information and a private key in a key pair generated by the smart card;

An access control module, configured to control the smart card to receive only the security operation instruction from the intermediate security application module;

The security computing module is configured to perform a security operation corresponding to the security operation instruction.

The system according to any one of claims 1 to 6, wherein the security operation instruction comprises at least one of: an encryption instruction, a decryption instruction, an integrity protection instruction, an integrity verification instruction, a generation key Request for access to instructions, security.

The system according to any one of claims 1 to 6, wherein the security operation comprises at least one of: an encryption operation, a decryption operation, an integrity protection operation, an integrity verification operation, generating a key pair Operation, secure delegation access verification.

The security operation execution method of the security operation execution system according to any one of claims 1 to 6, comprising:

The intermediate security application module of the mobile terminal receives a security operation instruction from the at least one mobile application module;

The intermediate security application module and the smart card jointly implement security operations corresponding to the security operation instructions.

The method according to claim 9, wherein before the intermediate security application module and the smart card jointly implement the security operation corresponding to the security operation instruction, the method further includes:

The mobile terminal detects whether the intermediate security application module and the smart card are from the same publisher system.

The method according to claim 9, wherein before the intermediate security application module receives the security operation instruction from the mobile application module, the method further includes: The intermediate security application module authenticates a mobile application module that needs to access the intermediate security application module.

The method according to claim 9, wherein the intermediate security application module and the smart card jointly implement a security operation corresponding to the security operation instruction, including:

The intermediate security application module acquires first security operation information corresponding to the security operation instruction from the smart card;

The intermediate security application module performs the security operation on the security operation instruction according to the first security operation information.

13. The method of claim 12, wherein performing the security operation on the security operation instruction according to the first security operation information further comprises:

When the mobile application module is authorized to access the intermediate security application module, the intermediate security application module sends the first security operation information corresponding to the security operation instruction to the smart card, and Creating and deleting a secure storage domain for saving the first security operation information, where the secure storage domain can only be accessed by the intermediate security application module;

The intermediate security application module performs the security operation on the security operation instruction according to the first security operation information in the secure storage domain.

The method according to claim 12, wherein the first security operation information comprises at least a digital certificate related message, a random symmetric key generated by an application server, and a public key in a key pair generated by the smart card.

The method according to claim 12, further comprising at least one of the following: before the smart card and the intermediate security application module jointly implement a security operation corresponding to the security operation instruction: The second security operation information is stored, where the second security operation information includes: the first security operation information and a private key in a key pair generated by the smart card; the smart card controls the smart card to receive only The security operation instruction from the intermediate security application module.

The method according to any one of claims 9 to 15, wherein the security operation instruction comprises at least one of: an encryption instruction, a decryption instruction, an integrity protection instruction, an integrity verification instruction, opening a digital envelope Instructions, generate digital envelope instructions, generate key pair instructions.

The method according to any one of claims 9 to 15, wherein the security operation comprises at least one of: an encryption operation, a decryption operation, an integrity protection operation, an integrity verification operation, an open digital envelope operation , generating digital envelope operations, generating key pair operations.