WO2013149426A1

WO2013149426A1 - Method, device and system for authenticating access for application to smart card

Info

Publication number: WO2013149426A1
Application number: PCT/CN2012/075684
Authority: WO
Inventors: 曹岚健; 余万涛
Original assignee: 中兴通讯股份有限公司
Priority date: 2012-04-06
Filing date: 2012-05-17
Publication date: 2013-10-10
Also published as: CN103368735A; CN103368735B

Abstract

Disclosed are a method, device and system for authenticating the access for an application to a smart card, the method including: the smart card receives an access request transmitted by the application, and transmits the authentication information of the access request to the application; the smart card receives the authentication response of the authentication information, wherein the application obtains the authentication response from the card issuer server of the smart card and transmits the authentication response to the smart card; and when the authentication response is verified to be passed by the smart card , the application is allowed to access the smart card. The present invention solves the technical problem of prior art that there is no way to implement the authentication of the access for an application through a smart card so that the data or function of the smart card can not be used by the application of the terminal and the safety of the service can not be ensured, and implements that the smart card performs the access control of the application requesting the access to the smart card so that the terminal application can dispose the service authentication correlation data in the smart card and the safety of the service is improved.

Description

The present invention relates to the field of communications, and in particular to an authentication method, apparatus, and system for applying an access smart card. BACKGROUND With the upgrading of networks, mobile terminal applications and mobile services are also increasing, which makes the life of mobile users greatly facilitated. The popularity of these mobile services has made it increasingly important for users to securely authenticate and secure information, and users are increasingly concerned about the security of their own information. Systems such as mobile payments and enterprise informatization rely in particular on reliable authentication of user identities and security of information to ensure the security of transactions and information. The smart card is a high-destruction-proof security device and is easy to carry. It can also achieve a high level of security based on cryptography. Therefore, storing data related to mobile application authentication on a smart card and using a smart card to complete authentication is one. It is safer, more reliable and more convenient. At the same time, it can also realize the function of generating key pair and completing digital signature on the smart card. However, since the terminal does not have an open application to directly access the interface of the smart card, the data or function on the smart card cannot be called by the terminal application. At present, there is no way to perform authentication authentication of an application access through a smart card, which makes the data or functions stored on the smart card cannot be called by the application of the terminal, thereby causing waste of resources stored on the smart card. In response to the above problems, no effective solution has been proposed yet. SUMMARY OF THE INVENTION The embodiments of the present invention provide an authentication method, device, and system for applying an access smart card, so as to at least solve the problem that at least one authentication authentication that can complete application access through a smart card in the prior art, so that the smart card is stored. The technical problem of the data or function cannot be called by the application of the terminal. According to an embodiment of the present invention, an authentication method for an application access smart card is provided, including: the smart card receives an access request sent by an application, and sends the authentication information of the access request to the application; the smart card receives the authentication of the authentication information. In response, the application obtains an authentication response from the card issuer server of the smart card and sends the authentication response to the smart card; when the smart card verifies the authentication response, the application is allowed to access the smart card. Preferably, the applying the authentication response from the card issuer server of the smart card comprises: the application obtaining the authentication response from the card issuer server by using the application provider server. Preferably, the application obtains the authentication response from the card issuer server by using the application provider server, including: performing mutual authentication and establishing a first secure connection between the application and the application provider server, and the application sends the authentication information to the application by using the first secure connection. Provider server; mutual authentication between the application provider server and the card issuer server and establishing a second secure connection, the application provider server forwards the authentication information to the card issuer server through the second secure connection; the card issuer server receives the application The authentication information forwarded by the provider server; after the card issuer server verifies the authentication information, the card issuer server generates an authentication response according to the authentication information; the card issuer server sends the authentication response to the application provider server through the second secure connection, The authentication response is forwarded to the application by the application provider server over the first secure connection. Preferably, the card issuer server generates an authentication response according to the authentication information, including: the card issuer server searches for a root key corresponding to the smart card according to the smart card identifier, where the root key is a secret assigned by the card issuer server to each smart card Key information, the smart card corresponds to the root key one by one, the authentication information carries the smart card identifier of the smart card and the smart card is a random number generated by the application for the current access; the card issuer server generates the root key and the random number Certification response. Preferably, the authentication response carries the first authentication content and the first temporary session key, wherein the card issuer server encrypts the authentication response by using the first temporary session key. Preferably, after the smart card receives the authentication response of the authentication information, the method further includes: the smart card generating the second authentication content and the second temporary session key according to the random number in the authentication information and the root key thereof according to the card publisher server. The smart card decrypts the authentication response according to the second session key. If the decryption is successful, the decrypted first authentication content and the second authentication content are compared. If they are the same, the verification is successful. Preferably, the smart card accessing the application comprises: the smart card establishing a secure channel between itself and the application by using the first temporary session key and the second temporary session key; and the smart card interacts with the application through the secure channel. Preferably, after the smart card connects the application to the smart card, the method further includes: when the application is closed, the smart card releases the secure channel; and the smart card deletes the second temporary session key. Preferably, the authentication information carries a first serial number of the smart card when the current access is applied. Preferably, the first serial number is generated as follows: the smart card adds a predetermined value to the second serial number stored by itself, to obtain a third serial number; the smart card determines whether the third serial number is greater than a predetermined threshold; if yes, the preset The initial value is assigned to the first serial number and the second serial number; if not, the third serial number is assigned to the first serial number and the second serial number. Preferably, the card issuer server generates the authentication response according to the authentication information, including: the card issuer server obtains the first serial number and the smart card identifier from the authentication information; the card issuer server searches for the first stored corresponding to the smart card according to the smart card identifier The four serial number; the card issuer server verifies according to the first serial number and the fourth serial number, and after the verification is passed, the card issuer server generates an authentication response. Preferably, the card issuer server performs verification according to the first serial number and the fourth serial number, including: the card issuer server determines whether the first serial number is greater than or equal to the fourth serial number, and if greater than or equal to, the verification succeeds, the card is successful. The publisher server assigns the first serial number to the fourth serial number. Preferably, after the card issuer server assigns the first serial number to the fourth serial number, the method further includes: the card issuer server determining whether the first serial number plus the predetermined value is greater than a predetermined threshold, and if greater than, the card issuer server The preset initial value is assigned to the fourth serial number. According to another embodiment of the present invention, an authentication device for accessing a smart card is provided, which is located in a smart card, and includes: a first receiving unit, configured to receive an access request sent by an application, and authenticate the access request The information is sent to the application; the second receiving unit is configured to receive an authentication response of the authentication information, where the application obtains the authentication response from the card issuer server of the smart card and sends the authentication response to the smart card; and the access unit is configured to verify the authentication response when the smart card passes the authentication Allows the app to access the smart card. Preferably, the apparatus further includes: a first generating unit, configured to: when the authentication response carries the first authentication content and the first temporary session key, after receiving the authentication response of the authentication information, according to the random number in the authentication information The root key generates a second authentication content and a second temporary session key in a manner corresponding to the card issuer server; the decryption unit is configured to decrypt the authentication response according to the second session key, and if the decryption is successful, The decrypted first authentication content and the second authentication content are compared, and if they are the same, the verification is successful. Preferably, the access unit comprises: an access module, configured to establish a secure channel between itself and the application by using the first temporary session key and the second temporary session key; and the interaction module is configured to perform information with the application through the secure channel Interaction. Preferably, the apparatus further includes: a second generating unit, configured to generate the authentication information carrying the first serial number of the smart card when the current access is applied. Preferably, the second generating unit includes: an adding module, configured to add a predetermined value to the second serial number stored by itself, to obtain a third serial number; and a determining module, configured to determine whether the third serial number is greater than a predetermined threshold; An assignment module is configured to assign a preset initial value to the first serial number and the second serial number when determining that the third serial number is greater than a predetermined threshold; the second assignment module is configured to determine that the third serial number is not When the threshold is greater than the predetermined threshold, the third serial number is assigned to the first serial number and the second serial number. According to still another embodiment of the present invention, another authentication device for accessing a smart card is provided, which is located in a card issuer server, and includes: a third receiving unit, configured to send authentication information, wherein the authentication information The smart card identifier and/or the smart card carrying the smart card is a random number generated by applying the current access; the third generating unit is configured to generate an authentication response according to the authentication information, and send the authentication response to the application. Preferably, the third generating unit includes: an obtaining module, configured to obtain a first serial number and a smart card identifier from the authentication information; and a second searching module, configured to search for a fourth serial number corresponding to the smart card stored by the smart card identifier according to the smart card identifier The verification module is configured to perform verification according to the first serial number and the fourth serial number, and after the verification is passed, generate an authentication response. Preferably, the third generating unit includes: a first searching module, configured to search for a root key corresponding to the smart card according to the smart card identifier, where the root key is key information allocated by the card issuer server for each smart card, The smart card has a one-to-one correspondence with the root key; the first generation module is configured to generate an authentication response according to the root key and the random number. Preferably, the third generating unit comprises: a second generating module, configured to generate an authentication response carrying the first authentication content and the first temporary session key; and an encryption module configured to perform the authentication response by using the first temporary session key encryption. According to still another embodiment of the present invention, an application access processing system is provided, including: the foregoing application access processing device located in a smart card, and an application access processing device located in a card issuer server. In the embodiment of the present invention, after receiving the access request of the application, the smart card generates authentication information corresponding to the current access of the application in response to the access request, and sends the authentication information to the application to trigger the application. The authentication response corresponding to the authentication information is obtained from the card issuer server, and the smart card allows the application to be accessed only after the application returns a matching authentication response to the smart card. In the above manner, the authentication authentication of the application access by the smart card is implemented, so that there is no way in the prior art that the authentication authentication of the application access can be completed by the smart card, so that the data or function on the smart card cannot be used by the terminal. The application is invoked, the security of the service is not guaranteed, and the application security access smart card is implemented, so that the terminal application can deploy the service authentication related data to the smart card, thereby improving the security of the service. BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are set to illustrate,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, In the drawings: FIG. 1 is a preferred flowchart of an application access processing method according to an embodiment of the present invention; FIG. 2 is an application for obtaining an authentication response from a card issuer server by using an application provider server according to an embodiment of the present invention; FIG. 3 is a block diagram of a preferred structure of an authentication device for accessing a smart card in an intelligent card according to an embodiment of the present invention; FIG. 4 is an application access smart card located in a smart card according to an embodiment of the invention; FIG. 5 is a block diagram showing a preferred block diagram of an access unit of an authentication device for accessing a smart card in a smart card according to an embodiment of the present invention; FIG. 6 is a block diagram of an access unit according to an embodiment of the present invention. Still another preferred structural block diagram of an authentication device for accessing a smart card by an application located in a smart card; FIG. 7 is a preferred configuration of a second generation unit of an authentication device for accessing a smart card by an application located in a smart card according to an embodiment of the present invention 8 is a block diagram of an authentication device for an application access smart card located in a card issuer server according to an embodiment of the present invention; FIG. 9 is a block diagram showing a preferred configuration of a third generation unit of an authentication device for accessing a smart card in an application in a card issuer server according to an embodiment of the present invention; FIG. 10 is a block diagram of a third generation unit according to an embodiment of the present invention. Another preferred structural block diagram of a third generating unit of an authentication device of an application access smart card located in a card issuer server; FIG. 11 is an authentication device for an application access smart card located in a card issuer server according to an embodiment of the present invention; Still another preferred structural block diagram of a third generating unit; FIG. 12 is another preferred flow chart of a method for applying an access smart card according to an embodiment of the present invention; 13 is a preferred flowchart of an application obtaining authentication information and an authentication response, and transmitting an authentication response request to the smart card according to an embodiment of the present invention; FIG. 14 is a smart card pair requesting access to a smart card according to an embodiment of the present invention; A preferred flowchart for applying access control is provided. FIG. 15 is a preferred flowchart of an application requesting access to a smart card according to an embodiment of the present invention, and the smart card performs access control on the application. BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, the present invention will be described in detail with reference to the accompanying drawings. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict. In the embodiment of the present invention, after the application is deployed on the terminal, no matter what operation is performed by the application, for example, the application needs to upgrade the security domain specific security domain, and for example, the application needs to use the smart card for service authentication related operations, and must first Obtain access to the smart card and access the smart card. That is to say, the smart card has an access control interface for an application attempting to access itself. In implementation, the key function of the access control interface is to control the access of the application when the application starts and requests access to the smart card, so as to restrict certain applications from accessing the smart card, and only allow authorized applications to access the smart card. After the smart card is authenticated, the smart card can be accessed. After the application obtains the access permission of the smart card (ie, the authentication is passed), the application always occupies the connection channel with the smart card; when the application is closed, the smart card and the application are released. The connection channel between the applications; the application must re-authorize the smart card when it starts up and requests access to the smart card. At the same time, if the application wants to access the smart card, it must send some information to the smart card that can prove its identity. The smart card can verify the information to prove whether the application that sent the information is an application that can be authorized to access the smart card, so that only the authorized legitimate application can access the smart card. To standardize the access control interface, it is necessary to first specify the information that the application needs to send to prove its identity, and must determine a method for the smart card to access the application requesting access to the smart card. The existing Smart Card Security API (Application Programming Interface) architecture proposes an architecture that enables mobile applications on the terminal to access the smart card securely and efficiently. The smart card security API architecture is divided into three levels: application layer, business authentication middle layer and business authentication service layer, and defines two APIs: API between smart card and terminal software system, API between terminal software system and application. The API between the smart card and the terminal software system focuses on converting the instructions of the mobile application to access the smart card into APDU commands that the smart card can recognize. The API between the terminal software system and the application focuses on how the application accesses through the interface. Ask the authentication service application on the smart card. The API between the terminal software system and the application should include the smart card management interface, the access control interface, the data encryption and decryption interface, the digital signature verification interface, and the identity authentication interface. In order to implement the access control of the smart card to the application for accessing the smart card, the embodiment of the present invention provides an authentication method for applying the access smart card. The method will be described in detail below in combination with several specific embodiments. Embodiment 1 The embodiment of the present invention provides an authentication method for an application access smart card. As shown in FIG. 1 , the method includes:

S102: The smart card receives an access request sent by the application, and sends the authentication information of the access request to the application.

S104: The smart card receives the authentication response of the authentication information, where the application obtains the authentication response from the card issuer server of the smart card and sends the authentication response to the smart card. S106: Allow the application to access the smart card when the smart card verifies the authentication response. In the preferred embodiment, after receiving the access request of the application, the smart card generates authentication information corresponding to the current access of the application in response to the access request, and sends the authentication information to the application to trigger the application. The authentication response corresponding to the authentication information is obtained from the card issuer server, and the smart card accesses the application only after the application returns a matching authentication response to the smart card. In the above manner, the authentication authentication of the application access by the smart card is implemented, so that there is no way in the prior art that the authentication authentication of the application access can be completed by the smart card, so that the data or function on the smart card cannot be used by the terminal. The application is invoked, and the security of the service is not guaranteed. The smart card implements access control for the application that requests the access to the smart card, so that the terminal application can deploy the service authentication related data to the smart card, thereby improving the security of the service. . In the preferred embodiment of the present invention, the authentication information may be carried by the smart card identifier and/or the smart card of the smart card. The authentication information is used to obtain the authentication response of the smart card from the card issuer server. Apply the random number generated by this access. At the time of implementation, the application has been registered at its own application provider server, and there is a certain contract relationship between the application provider server and the card issuer server. Therefore, the application can pass the card issuer with the contract relationship with the application provider server. The server obtains an authentication response. In a preferred embodiment, the application obtains the authentication response from the card issuer server of the smart card, the method comprising: the application obtaining the authentication response from the card issuer server by using the application provider server. Specifically, the step of the application obtaining the authentication response from the card issuer server by using the application provider server, as shown in FIG. 2, includes: S202: The application and the application provider server perform mutual authentication and establish a first secure connection, and the application sends the authentication information to the application provider server by using the first secure connection;

S204: Perform mutual authentication and establish a second secure connection between the application provider server and the card issuer server, and the application provider server forwards the authentication information to the card issuer server through the second secure connection; S206: the card issuer server receives the application Authentication information forwarded by the provider server;

S208: After the card issuer server verifies the authentication information, the card issuer server generates an authentication response according to the authentication information.

S210: The card issuer server sends the authentication response to the application provider server through the second secure connection, and the application provider server forwards the authentication response to the application through the first secure connection. In the above step S208, the card issuer server generates the authentication response according to the authentication information, including: the card issuer server searches for the root key corresponding to the smart card according to the smart card identifier, where the root key is the card issuer server for each smart card The assigned key information, the smart card corresponds to the root key one by one; the card issuer server generates an authentication response according to the root key and the random number. In the above preferred embodiment, the card issuer server assigns a smart key (KIC) to each smart card when issuing the smart card, the root key may be a 128-bit symmetric key, and the smart card identification (ICCID) with the smart card ) Corresponding. Preferably, the card issuer server saves the root key and the ICCID, and the card issuer server can query the root key KIC of the smart card through the ICCID of the smart card, and the root key KIC of the smart card is already saved in the smart card when the smart card is issued. The smart card root key can only exist in the card issuer server and smart card, and is prohibited from being read. In order to ensure the security of the application access, in a preferred embodiment, the card issuer server also carries the first temporary session key while carrying the first authentication content in the authentication response, wherein the card issuer server utilizes the first A temporary session key encrypts the authentication response. At the same time, the first temporary session key is also used for data encryption of the interaction of data after subsequent channel establishment. Correspondingly, on the smart card side, the corresponding second temporary session key and the second authentication content are also generated in the same manner as the card issuer server. In a preferred embodiment, after receiving the authentication response of the authentication information, the smart card Generating the second authentication content and the second temporary session key by using the random number in the authentication information and the root key thereof in a manner corresponding to the card issuer server; the smart card decrypts the authentication response according to the second session key, if If the decryption is successful, the first authentication content obtained by the decryption is compared with the second authentication content. If they are the same, the verification is successful. In the process of the smart card accessing the application, the corresponding secure channel may be established according to the first temporary session key and the second temporary session key, and the information is performed by using the first temporary session key and the second temporary session key. Interaction, in a preferred embodiment, the step of the smart card accessing the application comprises: first, the smart card establishes a secure channel between itself and the application by using the first temporary session key and the second temporary session key; secondly, the smart card passes the security The channel interacts with the application for information. In order to reduce the unnecessary waste of resources and reduce the redundancy of data, when the application is closed or other reasons cause the application to exchange information with the smart card, the secure channel corresponding to the application can be released, and the temporary session key is deleted. In a preferred embodiment, after the smart card connects the application to the smart card, the method further includes: when the application is closed, the smart card releases the secure channel, and then the smart card deletes the second temporary session key. In the above preferred embodiment, each time a smart card is accessed, a secure channel is established, and a pair of temporary session keys are generated for the access, which reduces resource waste and ensures secure access of the terminal application. . In a preferred embodiment of the present invention, the authentication information further carries a first serial number of the smart card when the current access is applied. The first serial number is generated as follows: the smart card adds a predetermined value to the second serial number stored by itself, and obtains a third serial number; the smart card determines whether the third serial number is greater than a predetermined threshold; if yes, assigns a preset initial value Giving the first serial number and the second serial number; if not, assigning the third serial number to the first serial number and the second serial number. For example, the above predetermined value may be set to 1, and the preset initial value is 0. At this time, the smart card stores a serial number (SQNIC) in advance, and the smart card adds 1 to its own SQNIC when the smart card needs to generate authentication information. When the SQNIC count saved in the smart card overflows, SQNIC will be reset to the initial value of 0. The serial number SQRSER corresponding to the SQNIC is also stored on the card issuer server side. In a preferred embodiment, the authentication response is generated according to the authentication information, including: the card issuer server obtains the first serial number (SQNIC) and the smart card from the authentication information. The card issuer server searches for a fourth serial number (SQRSER) corresponding to the smart card stored by the card issuer server according to the smart card identifier; the card issuer server performs verification according to the first serial number and the fourth serial number, and after the verification is passed, the card is issued The merchant server generates an authentication response. The card issuer server performs verification according to the first serial number and the fourth serial number, including: the card issuer server determines whether the first serial number is greater than or equal to the fourth serial number, and if greater than or equal to, the verification succeeds, the card issuer server Assigning the first serial number to the fourth serial number; the card issuer server determines whether the first serial number plus the predetermined value is greater than a predetermined threshold, and if greater, the card issuer server assigns the preset initial value to the fourth serial number . Now, the predetermined value is 1 and the preset initial value is 0. The card issuer server saves different SQNSER for each self-issued smart card. If the SQMC is greater than or equal to SQNSER, the SQN is verified. Update SQNSER, assign the value of the received SQNIC to SQNSER, and then proceed The following authentication steps; if the SQNIC is less than SQNSER, the SQN fails to be verified, and the card issuer refuses to generate an authentication response. If the verification is successful, the card issuer server should also check whether the SQNSER has reached the maximum value, that is, whether SQNSER plus 1 will overflow. If yes, assign SQNSER=0.

Embodiment 2 The embodiment of the present invention further provides an authentication device for accessing a smart card, which is located in a smart card. As shown in FIG. 3, the method includes: a first receiving unit 302, configured to receive an access request sent by an application, and connect The authentication information of the incoming request is sent to the application; the second receiving unit 304 is configured to receive an authentication response of the authentication information, wherein the application obtains the authentication response from the card issuer server of the smart card and sends the authentication response to the smart card; and the access unit 306 is configured to be When the smart card verifies the authentication response, the application is allowed to access the smart card. In the preferred embodiment, after receiving the access request of the application, the smart card generates authentication information corresponding to the current access of the application in response to the access request, and sends the authentication information to the application to trigger the application. The authentication response corresponding to the authentication information is obtained from the card issuer server, and the smart card accesses the application only after the application returns a matching authentication response to the smart card. In the above manner, the authentication authentication of the application access by the smart card is implemented, so that there is no way in the prior art that the authentication authentication of the application access can be completed by the smart card, so that the data or function on the smart card cannot be used by the terminal. The application is invoked, the security of the service is not guaranteed, and the application security access smart card is implemented, so that the terminal application can deploy the service authentication related data to the smart card, thereby improving the security of the service. In the preferred embodiment of the present invention, the authentication information carries: the smart card identifier of the smart card and/or the smart card is configured to obtain the authentication response of the smart card from the card issuer server. Apply the random number generated by this access. The device needs to interact with the above application to implement application access, the application has been registered at its own application provider server, and the application provider server and the card issuer server have a certain contract relationship, so the application can pass The card issuer server that has a contractual relationship with the application provider server registered by itself acquires the authentication response. In order to ensure the security of the application access, the card issuer server also carries the first temporary session key while carrying the first authentication content in the authentication response, corresponding to the smart card side, in a preferred embodiment, as shown in the figure As shown in FIG. 4, the apparatus further includes: a first generating unit 402, configured to: when the authentication response carries the first authentication content and the first temporary session key, after receiving the authentication response of the authentication information, according to the randomness in the authentication information The number and its own root key generate a second authentication content and a second temporary session key in a manner corresponding to the card issuer server; the decryption unit 404 is configured to decrypt the authentication response according to the second session key, if decrypted into The function compares the first authentication content obtained by the decryption with the second authentication content. If they are the same, it indicates that the verification is successful. In the process of the smart card accessing the application, the corresponding secure channel may be established according to the first temporary session key and the second temporary session key, and the information is performed by using the first temporary session key and the second temporary session key. Interaction, in a preferred embodiment, as shown in FIG. 5, the access unit includes: an access module 502, configured to establish a security between itself and an application using the first temporary session key and the second temporary session key The channel; the interaction module 504 is configured to perform information interaction with the application through the secure channel. In order to reduce the unnecessary waste of resources and reduce the redundancy of data, when the application is closed or other reasons cause the application to exchange information with the smart card, the secure channel corresponding to the application can be released, and the temporary session key is deleted. In a preferred embodiment, the apparatus further comprises: a release unit configured to release the secure channel when the application is closed; and a deletion unit configured to delete the second temporary session key. In the above preferred embodiment, each time a smart card is accessed, a secure channel is established, and a pair of temporary session keys are generated for the access, which reduces resource waste and ensures secure access of the terminal application. In a preferred embodiment of the present invention, the authentication information further carries a first serial number of the smart card when the current access is applied. In a preferred embodiment, as shown in FIG. 6, the apparatus further includes: a second generating unit 602, configured to generate authentication information carrying a first serial number of the smart card when the current access is applied. In a preferred embodiment of the present invention, as shown in FIG. 7, the foregoing second generating unit 602 includes: an adding module 702, configured to add a predetermined value to the second serial number stored by itself, to obtain a third serial number; The module 704 is configured to determine whether the third serial number is greater than a predetermined threshold. The first assigning module 706 is configured to assign the preset initial value to the first serial number and the second sequence when determining that the third serial number is greater than a predetermined threshold. The second assignment module 708 is configured to assign the third serial number to the first serial number and the second serial number when determining that the third serial number is not greater than a predetermined threshold. For example, the above predetermined value may be set to 1, and the preset initial value is 0. At this time, the smart card stores a serial number (SQNIC) in advance, and the smart card adds 1 to its own SQNIC when the smart card needs to generate authentication information. When the SQNIC count saved in the smart card overflows, SQNIC will be reset to the initial value of 0. The embodiment of the present invention further provides another authentication device for accessing the smart card, which is located in the card issuer server. As shown in FIG. 8, the method includes: a third receiving unit 802, configured to send authentication information, wherein the authentication The information carries the smart card identifier of the smart card and/or the smart card is a random number generated by applying the current access; the third generating unit 804 is configured to authenticate the response according to the authentication information, and send the authentication response to the application. In a preferred embodiment, as shown in FIG. 9, the third generating unit includes: a first searching module 902, configured to: search for a root key corresponding to the smart card according to the smart card identifier, where the root key is a card issuer server For each key card assigned to the smart card, the smart card has a one-to-one correspondence with the root key; the first generating module 904 is configured to generate an authentication response according to the root key and the random number. In the above preferred embodiment, the card issuer server assigns a smart key (KIC) to each smart card when issuing the smart card, the root key may be a 128-bit symmetric key, and the smart card identification (ICCID) with the smart card ) Corresponding. Preferably, the card issuer server saves the root key and the ICCID, and the card issuer server can query the root key KIC of the smart card through the ICCID of the smart card, and the root key KIC of the smart card is already saved in the smart card when the smart card is issued. The smart card root key can only exist in the card issuer server and smart card, and is prohibited from being read. In order to ensure the security of the application access, in a preferred embodiment, the card issuer server also carries the first temporary session key while carrying the first authentication content in the authentication response, wherein the card issuer server utilizes the first A temporary session key encrypts the authentication response. At the same time, the first temporary session key is also set to data encryption of the interaction of the data after the subsequent channel establishment. In a preferred embodiment of the present invention, as shown in FIG. 10, the third generating unit includes: a second generating module 1002, configured to generate an authentication response carrying the first authentication content and the first temporary session key; Module 1004, is configured to encrypt the authentication response with the first temporary session key. The serial number SQRSER corresponding to the SQNIC is also stored on the card issuer server side. In a preferred embodiment, as shown in FIG. 11, the third generating unit includes: an obtaining module 1102, configured to obtain the first serial number from the authentication information. And the smart card identifier; the second search module 1104 is configured to search, according to the smart card identifier, the fourth serial number corresponding to the smart card stored by the smart card identifier; the verification module 1106 is configured to perform verification according to the first serial number and the fourth serial number, and verify After passing, an authentication response is generated. Now, the predetermined value is 1 and the preset initial value is 0. The card issuer server stores different SQNSER for each self-issued smart card. If the SQNIC is greater than or equal to SQNSER, the SQN is verified to be successful. Update SQNSER, assign the value of the received SQNIC to SQNSER, and then perform the following authentication steps; if SQNIC is less than SQNSER, verify that SQN fails, and the card issuer refuses to generate an authentication response. If the verification is successful, the card issuer server should also Check if SQNSER has reached the maximum value, that is, whether SQNSER adds 1 or not, if yes, assign SQNSER=0. According to the authentication device of the application access smart card shown in FIG. 3 to FIG. 11 , an embodiment of the present invention further provides an authentication system for accessing a smart card, comprising: the above-mentioned authentication device for accessing the smart card by the application located in the smart card, An authentication device that accesses the smart card with an application located in the card issuer server. Example 3 The present invention has been described in terms of a preferred embodiment of the present invention, but it is to be understood that the preferred embodiment is only for the purpose of describing the present invention. The embodiment of the present invention describes a method for applying the method for accessing a smart card. As shown in FIG. 12, the method includes the following steps: Step S1202: The terminal application requests access to the smart card. Specifically, the terminal application initiates an access request to the smart card, and requests the smart card to generate. Certification Information. Step S1204: After receiving the access request initiated by the application, the smart card generates the authentication information, and returns the authentication information to the application, and requires the application to carry the authentication response corresponding to the authentication information to access the smart card. Step S1206: After receiving the authentication information sent by the smart card, the application requests the authentication response corresponding to the authentication information to the card issuer server through the application provider server. Among them, the application provider is the application provider that publishes the application, and the card issuer is the manufacturer of the smart card. Preferably, the application provider and the card issuer have a contractual relationship, and the application issued by the application provider can use the service authentication function of the smart card issued by the card issuer, and the application requests the authentication response message from the card issuer server in the secure channel. Transfer. Step S1208: After the card issuer server generates the authentication response, the application provider server sends the authentication response to the legitimate application, and the application carries the authentication response to access the smart card, and the smart card verifies the authentication response, so as to perform access control on the application. The embodiment also provides an application process for obtaining the authentication information and the authentication response, and sending the authentication response request to the smart card to access the smart card. As shown in FIG. 13, the method includes the following steps: Step S1302: The application provider and the card issuer sign the contract. . Applications published by application providers can authorize the use of smart cards issued by card issuers for business authentication related operations. The specific signing process and the signing in the prior art may be in the same manner, and are not described herein again. Step S1304: After the application is started, if the application needs to access the smart card, first send an access request to the smart card, requesting the smart card to generate the authentication information. Step S1306: After receiving the access request sent by the application, the smart card generates the authentication information, and sends the authentication information to the application, and requests the application to provide an authentication response corresponding to the authentication information. The authentication information includes an ICCIDCIC Card Identity of the smart card, and an IC card identifier. Preferably, the ICCID is the card number of the smart card, reflecting the information of the issuing country, the network number, the issuing area, the issuing time, the manufacturer, etc. The ICCID exists in the EFECCID of the smart card and is always readable but cannot be changed. Step S1308: The application initiates a connection request to the application provider server, and the application provider server and the application perform mutual authentication. The above step S1308 is mainly to ensure that the application is a legitimate application published by the application provider. Preferably, a secure channel should be established between the application and the application provider server, and all information interaction between the application and the application provider server should be encrypted and integrity protected to prevent an attacker from interfacing between the application and the application provider server. Stealing information. In this step, the establishment of the authentication and secure channel between the application and the application provider server should be regulated by the application provider. Step S1310: The application initiates an acquisition authentication response request to the application provider server, requesting the application provider to request an authentication response. In the request, the application sends the authentication information generated by the smart card, and the authentication response request should be transmitted in the secure channel between the application and the application provider server, encrypted and integrity protected. In step S1312, the application provider server initiates a connection request to the card issuer server, and the application provider server and the card issuer server perform mutual authentication. In the above step S1312, a secure channel should be established between the application provider server and the card issuer server, and all information interaction between the application provider server and the card issuer server should be encrypted and integrity protected to prevent an attacker. Stealing information on the interface between the application provider server and the card issuer server. In this step, mutual authentication and establishment of a secure channel between the application provider server and the card issuer server should be regulated by a contract between the application provider and the card issuer. In step S1314, after the application provider server passes the decryption and integrity verification of the message in step S1310, the authentication information in the request of step S1310 is sent to the card issuer server, and the authentication response is requested. The information sent by the application provider server to the card issuer server is transmitted in a secure channel between the application provider server and the card issuer server, encrypted and integrity protected. Step S1316, if the card issuer server considers that the application provider server has a contractual relationship with itself, the card issuer server decrypts the message sent in step S1314 and performs integrity verification, and queries according to the ICCID sent in step S1314. The root key KIC of the smart card, and generates an authentication response (the authentication response here corresponds to the first authentication content in the claims) and the application temporary session key according to the root key and other authentication information sent in step S1314 (here) The application temporary session key corresponds to the first temporary session key in the claim). The temporary session key is applied to establish a temporary secure channel for communication between the application and the smart card. The temporary session key is applied as a symmetric key, and the card issuer server generates an application temporary session key, which is transmitted to the legitimate application that initiated the request through the secure connection; the smart card generates the application temporary session key according to the authentication data. If the application successfully accesses the smart card, a secure channel will be established between the application and the smart card, and the information interaction between the application and the smart card will be applied with temporary session key encryption and integrity protection. When the application releases the connection channel with the smart card, the application temporary session key will be invalidated, and the smart card deletes the application temporary session key. Step S1318: After generating the authentication response and applying the temporary session key, the card issuer server sends the authentication response and the temporary session key to the application provider server through a secure channel between the card issuer server and the application provider server. The authentication response and application temporary session key are encrypted and integrity protected. Step S1320: After the application provider server decrypts the message of step S1318 and completes the integrity verification, the authentication response and the application temporary session key are sent to the application through a secure channel between the application provider server and the application. The authentication response and application temporary session key are encrypted and integrity protected to prevent an attacker from stealing the authentication response and applying the temporary session key. Step S1322: After the application decrypts the message and integrity verification in step S1320, the application sends the authentication response information to the smart card, where the authentication response message includes an authentication response, and the smart card is requested to verify the authentication response. The authentication response information is applied with temporary session key encryption and integrity protection. Step S1324: The smart card generates an application temporary session key on the smart card side according to the authentication information corresponding to the application, and generates a response message desired by the smart card. After the smart card decrypts and integrity verifies the authentication response information, it authenticates the authentication response. Step S1326: If the smart card considers that the application is an application authorized to access the smart card (ie, the authentication passes), the application is allowed to access the smart card, and the secure channel is established by using the symmetric application temporary session key saved by the application and the smart card. The information exchanges with the smart card for encryption and integrity protection. The embodiment of the present invention further provides a specific method for the smart card to perform access control on the application for accessing the smart card. As shown in FIG. 14, the method includes: Step S1402: The application requests access to the smart card. Step S1404, the smart card generates authentication information, and the authentication information may include the following information: ICCID, random number (RAND), SQN® AK. RAND is a 128-bit random number generated by the smart card, SQN (Sequence Number) is a 48-bit serial number generated by the smart card, and AK (Anonymity Key) is a 48-bit anonymous secret generated by the smart card. key. Among them, ® is an exclusive OR operation. The SQN is a serial number saved by the smart card and the card issuer server, and the purpose is to enable the card issuer server to authenticate the SQN generated by the smart card, and ensure that the authentication information generated by the smart card is not used by the attacker to use the card issuer server. Perform a replay attack. The serial number generated by the smart card is recorded as SQNIC, and the card issuer's record is SQNSER. After the smart card generates SQNIC ® AK, the SQNIC in the smart card must be incremented by 1. When the SQNIC count saved in the smart card overflows, SQNIC will be reset to 0. The above AK is an anonymous key generated by the smart card, and the generated method is AK=f5(KIC, RAND), wherein the f5 algorithm is the same as the f5 algorithm held in the UICC card in the AKA process in the 3G security architecture. The above RAND and AK should be saved in the smart card. After the application releases the connection channel with the smart card, the corresponding AK and RAND should be deleted. When the application applies for access to the smart card again, the smart card should regenerate the AK, RA Do. The authentication information generated by the smart card can be RAND||SQNIC ® AK||ICCID. However, it is worth noting that the above-described algorithms and formulas for generating authentication information are merely preferred implementations, and the present invention is not limited thereto. Step S1406: The smart card sends the authentication information to the application on the terminal. In step S1408, the application requests the authentication response from the card issuer server in some manner, and passes the authentication information to the card issuer server. The card issuer server ensures that the application is a legitimate application issued by the contracted application provider by using some means. The publisher server passes the authentication response to the legitimate application published by the contracted application provider. Step S1410, the card issuer server first queries the KIC corresponding to the smart card by using the ICCID in the authentication message; then, the card issuer server generates the anonymous key AK by using the KIC and the RAND in the authentication information, AK=f5(KIC, RAND) Then, the card issuer server obtains SQNIC, SQMC=AK® (SQMC ® AK) using the anonymous key AK and SQMC ® AK in the authentication information; the card issuer server authenticates the SQNIC to prevent replay attacks. The authentication method in step S1410 is specifically: comparing SQNIC and SQNSER saved by the card issuer server, SQNSER and ICCID, and the card issuer server stores different SQNSERs for each self-issued smart card. If the SQNIC is greater than or equal to SQNSER, then the SQN is verified to be successful. At this time, the card issuer server updates the SQNSER, and assigns the value of the received SQNIC to the SQNSER, and proceeds to the following authentication step; if the SQNIC is smaller than the SQNSER, the verification of the SQN fails. The card issuer refuses to generate an authentication response. Preferably, if the verification SQN is successful, the card issuer server should also check if the SQNSER has reached the maximum value, that is, whether SQNSER is incremented by 1 or not, and if so, assign SQNSER=0. It should be noted that the initial value of 0 is only a schematic expression, and the present invention is not limited thereto, and any value smaller than the maximum value may be used as the initial value. In step S1412, if the verification SQN is successful, the card issuer server generates an authentication response (RES), which is RES=£2CKIC, RAND). The £2 algorithm is the same as the £2 algorithm held in the AKA process UICC card in the 3G security architecture. Moreover, the card issuer server also generates application temporary session keys KENC and KINC, KENC for data encryption between the application and the smart card, and KINC for data integrity protection between the application and the smart card. KENC=fi(RA D,K) _; KINC=f4(RA D,K). The β and f4 algorithms are the same as the β and f4 algorithms held in the AKA process UICC card in the 3G security architecture. In step S1414, the card issuer server will pass the authentication response RES, the application temporary session key KENC and the KINC to the application in some manner. The card issuer server passes the authentication response, the application temporary session keys KENC and KINC to the legitimate application published by the contracted application provider. Preferably, the card issuer server only sends the authentication response to the application provider that is contracted with itself to ensure that the accessed application is a legitimate application, thereby improving data security. In step S1416, the application encrypts and integrity protects the authentication response RES using the application temporary session keys KENC and KINC. Step S1418: The application sends the authentication response of the encryption and integrity protection to the smart card to request access to the smart card. In step S1420, the smart card generates an application temporary session key KENC and KINC according to the saved RAND and smart card root key KIC corresponding to the application, and decrypts the authentication response and integrity verification using KENC and KINC. The smart card generates the desired XRES according to the saved RAND and smart card root key KIC corresponding to the application, XRES= £2(KIC, RAND) _{0 The} smart card compares the expected XRES and the authentication response RES, and if the two are equal, the application is allowed to access. Smart card; if the two are not equal, the application is denied access to the smart card. Step S1422: If the application successfully accesses the smart card, the application establishes a secure channel by using the symmetric application temporary session keys KENC and KINC stored by the smart card, and encrypts and protects the information interaction between the application and the smart card. The embodiment of the present invention further describes a specific implementation manner in which an application requests access to a smart card, and the smart card performs access control on the application. The specific steps are as shown in FIG. 15 , including: Step S1502 : The application provider and the card issuer perform signing. Step S1504: After the application is started, if the application needs to access the smart card, first send an access request to the smart card, requesting the smart card to generate the authentication information. Step S1506: After receiving the access request from the application, the smart card generates the authentication information, where the authentication information carries the ICCID, the random number RAND, and the SQN ten AK. Step S1508: The smart card authentication information is sent to the application, and the application is required to provide an authentication response corresponding to the authentication information. In step S1510, the application initiates a connection request to the application provider server, and the application provider server and the application perform mutual authentication to ensure that the application is a legitimate application issued by the application provider. A secure channel should be established between the application and the application provider server. All information interaction between the application and the application provider server should be protected by encryption and integrity to prevent the attacker from interfacing between the application and the application provider server. Steal information. Step S1512: The application initiates a request for obtaining an authentication response to the application provider server, for requesting the application provider to request an authentication response for the application. In the request, the application sends the authentication information generated by the smart card, wherein the authentication information includes an ICCID, a random number RAND, and an SQN® AK. The get authentication response request should be transmitted in the secure channel between the application and the application provider server, encrypted and integrity protected. In step S1514, the application provider server initiates a connection request to the card issuer server, and the application provider server and the card issuer server perform mutual authentication. A secure channel should be established between the application provider server and the card issuer server. All information interaction between the application provider server and the card issuer server should be encrypted and integrity protected to prevent the attacker from being on the application provider server. Stealing information on the interface with the card publisher server. Step S1516, after the application provider server decrypts the message and integrity verification in step S1512, sends the authentication information (including ICCID, random number RAND, SQN® AK) in the request of step S1512 to the card issuer server, and requests authentication. response. The information sent by the application provider server to the card issuer server is transmitted in a secure channel between the application provider server and the card issuer server, encrypted and integrity protected. Step S1518, if the card issuer server considers that the application provider server has a contractual relationship with itself, the card issuer server decrypts the message sent in step S1516 and performs integrity verification to obtain an ICCID, a random number RAND, and an SQN® AK. The card issuer server first queries the pair with the ICCID in the authentication message. The KIC; then the card issuer server uses the KIC and RAND in the authentication information to generate the anonymous key AK, AK=f5(KIC, RAND); then the card issuer server utilizes the anonymous key AK and the SQMC ® AK in the authentication information Get SQMC, SQMC=AK® (SQMC ® AK); The card issuer server authenticates the SQNIC to prevent replay attacks. Step S1520, if the verification SQN is successful, the card issuer server generates an authentication response RES, and the authentication response can be obtained according to the following formula, RES=£2(KIC, RAND) _0, and the card issuer server generates the application temporary session key KENC. And KINC, step S1522, after the card issuer server generates the authentication response (RES) and applies the temporary session key (KENC and KINC), the RES and KENC, KINC are passed between the card issuer server and the application provider server. The secure channel is sent to the application provider server. RES and KENC, KINC are encrypted and integrity protected. In step S1524, after the application provider server decrypts the message and integrity verification in step S1522, the RES and KENC and KINC are sent to the application through a secure channel between the application provider server and the application. RES and KENC KINC are encrypted and integrity protected to prevent attackers from stealing RES and KENC, KINC. Step S1526, after the application decrypts the message and integrity verification in step S1524, the application sends the authentication response information to the smart card, including the RES, and requests the smart card to verify the authentication response. The authentication response information is protected by KENC, KINC encryption and integrity. Step S1528: The smart card generates an application temporary session key KENC KINC on the smart card side according to the authentication information corresponding to the application, and generates a desired XRES. After the smart card decrypts and completes the authentication response information, it authenticates the RES. In step S1528, the smart card generates a desired XRES according to the saved RAND and smart card root key KIC corresponding to the application, XRES=£2(KIC, RA D) _{0, the} smart card compares the expected XRES and the authentication response RES, if two If the two are equal, the authentication succeeds, and the application is allowed to access the smart card. If the two are not equal, the authentication fails, and the application is denied access to the smart card. Step S1530: If the smart card considers that the application is an application authorized to access the smart card, the application is allowed to access the smart card, and the secure channel is established by using the symmetric application temporary session key saved by the application and the smart card, and if the application successfully accesses the smart card, Then, the secure channel is established by using the symmetric application temporary session keys KENC and KINC held by the application and the smart card, and the information interaction between the application and the smart card is encrypted and integrity protected. Encryption and integrity protection for information interaction between applications and smart cards. From the above description, it can be seen that the present invention achieves the following technical effects: after receiving an access request of an application, the smart card generates authentication information corresponding to the current access of the application in response to the access request, and The authentication information is sent to the application to trigger the application to obtain an authentication response corresponding to the authentication information to the card issuer server, and the smart card accesses the application only after the application returns a matching authentication response to the smart card. In the above manner, the authentication authentication of the application access by the smart card is implemented, so that there is no way in the prior art that the authentication authentication of the application access can be completed by the smart card, so that the data or function on the smart card cannot be used by the terminal. The application is invoked, and the security of the service is not guaranteed. The smart card implements access control for the application that requests the access to the smart card, so that the terminal application can deploy the service authentication related data to the smart card, thereby improving the security of the service. . Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general-purpose computing device, which can be concentrated on a single computing device or distributed over a network composed of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device, such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein. The steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps are fabricated as a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software. The above are only the preferred embodiments of the present invention, and are not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

Claim

1. An authentication method for an application access smart card, including:

Receiving, by the smart card, an access request sent by the application, and sending the authentication information of the access request to the application;

Receiving, by the smart card, an authentication response of the authentication information, where the application acquires the authentication response from a card issuer server of the smart card and sends the authentication response to the smart card;

When the smart card verifies the authentication response, the application is allowed to access the smart card.

2. The method according to claim 1, wherein the obtaining, by the application, the authentication response from a card issuer server of the smart card, comprises: the application acquiring an application from the card issuer server by using an application provider server Describe the certification response.

The method according to claim 2, wherein the application acquires the authentication response from the card issuer server by using an application provider server, including:

Performing mutual authentication and establishing a first secure connection between the application and the application provider server, and the application sends the authentication information to the application provider server by using the first secure connection;

Mutual authentication and establishment of a second secure connection between the application provider server and the card issuer server, the application provider server forwarding the authentication information to the card issuer through the second secure connection Server

Receiving, by the card issuer server, the authentication information forwarded by the application provider server; after the card issuer server verifies the authentication information, the card issuer server generates the Certification response;

Sending, by the card issuer server, the authentication response to the application provider server via the second secure connection, and forwarding, by the application provider server, the authentication response to the application.

The method according to claim 3, wherein the card issuer server generates the authentication response according to the authentication information, including: The card issuer server searches for a root key corresponding to the smart card according to the smart card identifier, where the root key is key information allocated by the card issuer server for each smart card, and the smart card and the smart card Corresponding to the root key, the authentication information carries the smart card identifier of the smart card and the smart card is a random number generated by the application for the current access;

The card issuer server generates the authentication response based on the root key and the random number. The method according to claim 4, wherein the authentication response carries a first authentication content and a first temporary session key, wherein the card issuer server uses the first temporary session key to authenticate the The response is encrypted. The method according to claim 5, wherein, after the smart card receives the authentication response of the authentication information, the method further includes:

The smart card generates a second authentication content and a second temporary session key according to a random number in the authentication information and a root key thereof according to the card issuing server.

The smart card decrypts the authentication response according to the second session key, and if the decryption is successful, compares the decrypted first authentication content and the second authentication content, and if they are the same, indicates verification success. The method according to claim 6, wherein the smart card accessing the application comprises: the smart card using the first temporary session key and the second temporary session key in itself and the application Establish a secure channel;

The smart card interacts with the application through the secure channel. The method according to claim 7, wherein, after the smart card connects the application to the smart card, the method further includes:

The smart card releases the secure channel when the application is closed;

The smart card deletes the second temporary session key. The method according to claim 1, wherein the authentication information carries a first serial number of the smart card when the application is accessed this time. The method according to claim 9, wherein the first serial number is generated as follows: the smart card adds a predetermined value to a second serial number stored by itself, to obtain a third serial number; the smart card determines the Whether the third serial number is greater than a predetermined threshold; If yes, assigning a preset initial value to the first serial number and the second serial number; if not, assigning the third serial number to the first serial number and the second serial number .

11. The method of claim 10, wherein the card issuer server generates an authentication response based on the authentication information, comprising:

The card issuer server acquires the first serial number and the smart card identifier from the authentication information;

The card issuer server searches for a fourth serial number corresponding to the smart card stored by itself according to the smart card identifier;

The card issuer server verifies according to the first serial number and the fourth serial number, and after the verification is passed, the card issuer server generates the authentication response.

12. The method according to claim 11, wherein the card issuer server performs verification according to the first serial number and the fourth serial number, including:

Determining, by the card issuer server, whether the first serial number is greater than or equal to the fourth serial number, if the verification is successful, the card issuer server assigns the first serial number to the The fourth serial number.

13. The method according to claim 12, wherein after the card issuer server assigns the first serial number to the fourth serial number, the method further comprises:

Determining, by the card issuer server, whether the first serial number is greater than the predetermined threshold after adding the predetermined value, and if greater than, the card issuer server assigns the preset initial value to the fourth serial number.

14. An authentication device for accessing a smart card, located in a smart card, comprising:

The first receiving unit is configured to receive an access request sent by the application, and send the authentication information of the access request to the application;

a second receiving unit, configured to receive an authentication response of the authentication information, where the application obtains the authentication response from a card issuer server of the smart card and sends the authentication response to the smart card;

The access unit is configured to allow the application to access the smart card when the smart card verifies the authentication response.

The device according to claim 14, further comprising: a first generating unit, configured to: when the authentication response carries the first authentication content and the first temporary session key, after receiving the authentication response of the authentication information, according to the random number in the authentication information and the self Generating a second authentication content and a second temporary session key in a manner corresponding to the card issuer server;

a decryption unit, configured to decrypt the authentication response according to the second session key, and if the decryption is successful, compare the decrypted first authentication content and the second authentication content, if they are the same, Indicates that the verification is successful.

16. The apparatus according to claim 15, wherein the access unit comprises: an access module, configured to use the first temporary session key and the second temporary session key in itself and the application Establish a secure channel between them;

An interaction module is configured to perform information interaction with the application through the secure channel.

The device according to claim 14, further comprising: a second generating unit, configured to generate the authentication information carrying the first serial number of the smart card when the application is accessed this time.

The device according to claim 17, wherein the second generating unit comprises:

Adding a module, being set to increase a predetermined value on the second serial number stored by itself, to obtain a third serial number;

a determining module, configured to determine whether the third serial number is greater than a predetermined threshold; the first assigning module is configured to: assign a preset initial value to the first sequence when determining that the third serial number is greater than a predetermined threshold Number and the second serial number;

The second assignment module is configured to assign the third serial number to the first serial number and the second serial number when determining that the third serial number is not greater than the predetermined threshold.

19. An authentication device for accessing a smart card, located in a card issuer server, comprising:

The third receiving unit is configured to send the authentication information sent by the application, where the authentication information carries the smart card identifier of the smart card and/or the smart card is a random number generated by the application for the current access; the third generating unit, It is configured to generate an authentication response according to the authentication information, and send the authentication response to the application.

The device according to claim 19, wherein the third generating unit comprises: a first search module, configured to search for a root key corresponding to the smart card according to the smart card identifier, where the root key is key information allocated by the card issuer server for each smart card, where The smart card has a one-to-one correspondence with the root key;

The first generation module is configured to generate the authentication response according to the root key and the random number.

The device according to claim 19, wherein the third generating unit comprises:

a second generating module, configured to generate the authentication response that carries the first authentication content and the first temporary session key;

An encryption module is configured to encrypt the authentication response with the first temporary session key.

The device according to claim 19, wherein the third generating unit comprises: an acquiring module, configured to obtain a first serial number and a smart card identifier from the authentication information; and a second searching module, configured to The smart card identifier finds a fourth serial number corresponding to the smart card stored by itself;

The verification module is configured to perform verification according to the first serial number and the fourth serial number, and after the verification is passed, generate the authentication response.

An authentication system for accessing a smart card, comprising the authentication device of the application access smart card located in the smart card according to any one of claims 14-18, and the method of any one of claims 19-22 An authentication device for accessing a smart card by an application located in the card issuer server.