CN104050424B - The realization of smartcard file access safety rights management and file access method - Google Patents
The realization of smartcard file access safety rights management and file access method Download PDFInfo
- Publication number
- CN104050424B CN104050424B CN201410300218.9A CN201410300218A CN104050424B CN 104050424 B CN104050424 B CN 104050424B CN 201410300218 A CN201410300218 A CN 201410300218A CN 104050424 B CN104050424 B CN 104050424B
- Authority
- CN
- China
- Prior art keywords
- file
- authority
- byte
- key
- record
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/604—Tools and structures for managing or administering access control systems
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices
Abstract
The invention discloses a kind of implementation method of smartcard file access safety rights management, system and file access method, device, the method includes：Create a control of authority file under private file DF file, each bar record in described control of authority file corresponds to a constituent instruments EF file under described DF file respectively；The each access rights recording for recording corresponding EF file, the access rights of described EF file refer to the logical relation of key；And write the recording mechanism of each record in the file header of corresponding EF file.Access right of the present invention controls the access rights to preserve EF file for the record in file, therefore access rights can be determined according to a record, thus solve the problems, such as to need certification multiple there is complicated ' with ', the key of ' or ' combination in any relation could obtain file access authority, and can use more number of keys.
Description
Technical field
The present invention relates to the communications field and in particular to a kind of implementation method of smartcard file access safety rights management,
System and file access method, device.
Background technology
The file type of smart card is divided into private file DF (Dedicated File) and constituent instruments EF (Elementary
File).The wherein effect of DF is similar to the catalogue in computer system or file, and EF is just used to data storage.
According to tree, in a card must one and only one root be：MF (Master File), also referred to as master control literary composition
Part.Other all of DF and EF are all located under MF.Each DF and EF have oneself file identification (File ID, referred to as
FID), FID is represented with two bytes, and wherein 3F00 is the special mark of MF, and FFFF is retention data cannot act as file
Mark.Except FID for EF, also short file identification (Short File Identifier, abbreviation SFI), by EF literary composition
The SFI of part can find this EF file；DF name is also had to may also be used for selecting this DF literary composition for DF in addition to FID
Part.
When carrying out the definition of card application data, generally the basic data file of same application is all defined on some
Under DF, thus this DF can also be referred to as application dedicated file ADF (Application DF).If this ADF is in separately
Under one DF, then that DF is just called catalogue DDF (Directory DF).In simple terms, if below a DF only
EF, then this DF just can be referred to as ADF, if existing DF has EF below a DF again, then this DF just can be referred to as
DDF.
Each file has the access rights of oneself, and including reading authority and modification authority, these authorities are by outer
Portion's certification to corresponding key authentication by rear acquisition, when the key that reading/modification authority is related to is few and relation is simple,
There are a lot of methods can connect reading/modification authority key associated therewith of different files, when needing that file is carried out
During operation, check whether association key passes through certification.But the corresponding cipher key number of reading/modification authority when a file
Mesh is more and relation complicated in the case of it is desirable to the problem of clearly reaction file access authority and cipher key relation, also become
Complex.
With the development of IC-card (smart card) technology, on card, the safety problem of application is increasingly paid close attention to by people, by
In the card storing in the form of a file more than application data, so the requirement for the access rights of file also becomes increasingly complex
Various, the management method that this needs exist for a set of perfect file access authority supports.
The main purpose of rights management is that prior art is to file with needing the key of certification to correspond file
The method of access rights management is corresponding close generally by some bytes direct specified file read operation in file header
Key and file modification operate corresponding key.
Key authentication is carried out by the authority of rear acquisition with 1 to 15 numbering, each numerical value represents corresponding with this numerical value
Key authentication represent a key by key is carried out with the numbering (decimal number) from 0 to 15, each numerical value, create
Pass through numerical value when file and specify the reading corresponding key of authority and the corresponding key of modification authority, EF file in file header
Defined in head, 2 bytes read authority bytes and 2 byte modification authority bytes, and wherein high byte represents and controlled by higher level's catalogue
Key authentication authority, low byte represents the key authentication authority being controlled by current directory, in addition safeguards a permissions mapping rule
Byte.Wherein, reading/modification authority byte is fixed as when ' EF ' representing and does not allow to read and write, and being fixed as ' 00 ' expression can freely read
Write, if the high byte in addition in reading/modification authority byte or low byte are XY (XY value all between 1 to 15, and X is big
In equal to Y, it is cipher key number) when, go to determine that reading/modification authority is key X and key Y further according to mapping ruler byte
(number discontinuous key) or key X to key Y (the continuous key of numbering from X to Y), and determine and between these keys be
Relation " ＆ " or relation " | ".
Prior art for a file, can only at most map multiple numbering continuous key or two numbering not
Continuous key, and can only simply represent between these keys it is the relation of single " ＆ " or the relation of single " | ", right
For simple application, file read-write authority is correspondingly simple, and this rights management mechanism can meet simple logic composition of relations should
Use demand.But, above-mentioned prior art cannot solve to the method for file access rights management to need that certification is multiple to have complexity
' with ', the key of ' or ' combination in any relation could obtain the problem of file access authority, and can use in prior art
Key number also more nervous.
Content of the invention
The technical problem to be solved in the invention is to provide a kind of realization side of smartcard file access safety rights management
Method, system and file access method, device, solve to need certification multiple have complicated ' with ', ' or ' combination in any relation close
Key could obtain the problem of file access authority, and can use more number of keys.
In order to solve above-mentioned technical problem, the invention provides a kind of realization of smartcard file access safety rights management
Method, including：
Create a control of authority file under private file DF file, each bar record in described control of authority file divides
Dui Ying not a constituent instruments EF file under described DF file；Each records the access for recording corresponding EF file
Authority, the access rights of described EF file refer to the logical relation of key；
And write the recording mechanism of each record in the file header of corresponding EF file.
Further, described control of authority file is variable-length record file, each record of described control of authority file
Structure be TLV structure, be made up of 16 system sequences, T is label TAG, and value is fixed as the logical relation that 80, L is described key
Logical expression length, V is the content of described logical expression；
The display rule of described logical expression is：In logical expression content, key or cipher key relation respectively account for 1 word
Section；Wherein, the value of the key and cipher key relation bit according to described byte is defined as follows：
When the Bit7 of described byte is 1, this byte representation cipher key relation, when the Bit7 of described byte is 0, this byte representation
Key；
The Bit7 of described byte is 0, and when Bit6 is 1, this byte representation global secret；The Bit7 of described byte is 0, and
When Bit6 is 0, this byte representation partial secret key；Wherein, low 5 of the byte of the described key of expression represent this key in safe shape
Corresponding bit position in state machine.
Further, methods described also includes：
Safeguard the security state machine of a n byte for each catalogue file, each bit of described n byte is to should
The authentication state of 1 key under catalogue file, if the authentication state of this key is to pass through, corresponding bits position is 1, no
Then it is set to 0,1≤n≤4；
Wherein, described catalogue file includes parent directory file and current directory file, the described parent directory file maintenance overall situation
The security state machine of key, the security state machine of described current directory file maintenance partial secret key, described current directory file refers to
Described private file DF file.
Further, the access rights of described EF file include：Read authority and modification authority, the reading of described EF file
In authority and the corresponding record of modification authority record this EF file in described control of authority file, or it is separately recorded in
In the corresponding two different records of this EF file in described control of authority file；
The described recording mechanism by each record writes in the file header of corresponding EF file, including：
Respectively the recording mechanism of record that the reading authority of described EF file is located is write in the file header of corresponding EF file
Read in the second authority byte of authority byte, the recording mechanism of record that described modification authority is located is write corresponding EF file
In second authority byte of modification authority byte in file header.
Further, the short file identification SFI of described control of authority file is fixed as 0xFF.
In order to solve above-mentioned technical problem, present invention also offers a kind of access peace based on smartcard file as above
The smartcard file access method of the implementation method of full rights management, including：
When accessing the EF file under described DF file, read and in described EF file header, read authority byte and/or the power of amendment
Recording mechanism in second authority byte of limit byte, searches and this note according to described recording mechanism in described control of authority file
Record number corresponding record；
Obtain the logical table of the logical relation of key according to the access rights of EF file corresponding in the described record finding
Reach formula；
Judging whether to meet access rights according to described logical expression, if met, allowing described EF file is carried out
Access operation, otherwise, do not allow described EF file is conducted interviews operation.
Further, the described access rights according to EF file in described record obtain the logical table of the logical relation of key
Reach formula, including：
Structure according to described record and the rule of logical expression, described 16 system sequences are converted to patrolling of key
The logical expression of the relation of collecting.
Further, described judge whether to meet described access rights according to described logical expression, including：
Type according to described key and the corresponding bit position in corresponding security state machine, in described accordingly safe shape
The authentication state of described key is inquired about, described logical expression is converted to mathematics by the authentication state according to described key in state machine
Expression formula, if result of calculation is 1, meets access rights it is allowed to operation that described EF file is conducted interviews；If calculating knot
Fruit is 0, then be unsatisfactory for access rights, do not allow described EF file is conducted interviews operation.
Further, the described type according to described key and the corresponding bit position in corresponding security state machine,
The authentication state of described key is inquired about in described corresponding security state machine, including：
Described key is judged for global secret or partial secret key according to the display rule of logical expression, if the overall situation
Key, then inquire about the value of corresponding bit position in the security state machine of parent directory file maintenance, if partial secret key, is then working as
The value of corresponding bit position is inquired about, the value of corresponding bit position is 1 and represents that certification is led in the security state machine that front catalogue file is safeguarded
Cross, be that 0 expression certification is not passed through.
Further, read the second of authority byte and/or modification authority byte in described EF file header in described reading
Before the step of recording mechanism in individual authority byte, also include：
Whether the value judging to read two bytes of authority byte and/or modification authority byte in described EF file header be
' 00 ', if it is not, then whether judging the high nibble of first authority byte more than or equal to low nibble, if it is,
Read the recording mechanism in second authority byte reading authority byte and/or modification authority byte in described EF file header, no
Then do not read.
In order to solve above-mentioned technical problem, present invention also offers one kind realizes smartcard file access safety rights management
System, including：
Control of authority file maintenance module, for creating a control of authority file under private file DF file, described
Each bar record in control of authority file corresponds to a constituent instruments EF file under described DF file respectively；Each record is used
In the access rights of the corresponding EF file of record, the access rights of described EF file refer to the logical relation of key；
EF file maintenance module, for and by each record recording mechanism write corresponding EF file file header in.
In order to solve above-mentioned technical problem, present invention also offers a kind of being based on realizes smartcard file visit as above
Ask the smartcard file access mechanism of the system of security permission management, including：
Searching modul, reads authority for when accessing the EF file under described DF file, reading in described EF file header
Recording mechanism in second authority byte of byte and/or modification authority byte, according to described recording mechanism in described control of authority
Record corresponding with this recording mechanism is searched in file；
Cipher key logic expression formula acquisition module, for the access rights according to EF file corresponding in the described record finding
Obtain the logical expression of the logical relation of key；
Judging module, for judging whether to meet access rights according to described logical expression, if met, it is right to allow
Described EF file conducts interviews operation, and otherwise, do not allow described EF file is conducted interviews operation.
Compared with prior art, the smartcard file access safety authority pipe providing at least one embodiment of the present invention
The implementation method of reason, system and file access method, device, access right controls the visit to preserve EF file for the record in file
Ask authority, therefore access rights can be determined according to a record, thus solve need certification multiple have complicated ' with ',
The key of ' or ' combination in any relation could obtain the problem of file access authority, and can use more number of keys；
In one embodiment file is read/modification authority expressed in the form of variable-length record, gives specific record lattice
The method for designing of formula, not only easily realizes and understands, and can clearly express any logical combination of any number of keys
Form, and, it is directed to whether each key passes through certification in another embodiment, under each catalogue file, maintenance one is close
Key state machine, for 1 or 0, the value being directly viewable corresponding bits position in state machine would know that under this document, whether corresponding secret key leads to
Cross certification, then the logical expression parsing can be directly changed into mathematic(al) representation and be calculated, can by result of calculation
Whether met it is adaptable to various different application scenario with the reading/modification authority directly knowing file.
Brief description
Fig. 1 is the implementation method flow chart of smartcard file access safety rights management in embodiment；
Fig. 2 is the flow chart of smartcard file access method in embodiment；
Fig. 3 is the flow chart of smartcard file access method in an application example；
Fig. 4 is the system construction drawing realizing smartcard file access safety rights management in embodiment；
Fig. 5 is the structure chart of smartcard file access mechanism in embodiment.
Specific embodiment
For making the object, technical solutions and advantages of the present invention become more apparent, below in conjunction with accompanying drawing to the present invention
Embodiment be described in detail.It should be noted that in the case of not conflicting, in embodiment in the application and embodiment
Feature can mutual combination in any.
Embodiment：
As shown in figure 1, present embodiments providing a kind of implementation method of smartcard file access safety rights management, including
Following steps：
S101：A control of authority file EF is created under each private file DF fileARRFile, described control of authority
Each bar record in file corresponds to a constituent instruments EF file under described DF file respectively；Each records for recording
The access rights of corresponding EF file；
The access rights of described EF file refer to the logical relation of key, and described key is related to this EF file close
Key, is represented with 16 system sequences in this embodiment.Control of authority file EFARRThe recording mechanism of file from the beginning of 1, compile by order
Write, control of authority file EFARRThe SFI of file is fixed as 0xFF, in order to find.The access rights of described EF file include：Read
Weighting limit and modification authority, the same record in described reading authority described control of authority file corresponding with modification authority, or
Person corresponds to two different records in described control of authority file respectively；
Wherein, described control of authority file is variable-length record file, the knot of each record of described control of authority file
Structure is TLV structure, is made up of 16 system sequences, and T is label TAG, and value is fixed as patrolling of the logical relation that 80, L is follow-up key
Collect the length of expression formula, V is the content of described logical expression；
The display rule of described logical expression is：In logical expression content, key or cipher key relation respectively account for 1 word
Section；Wherein, the value of the key and cipher key relation bit according to described byte is defined as follows：
When the Bit7 of described byte is 1, this byte representation cipher key relation, as shown in table 1, when the Bit7 of described byte is 0,
This byte representation key；
Key includes global secret and partial secret key, and the Bit7 of described byte is 0, and when Bit6 is 1, this byte representation is complete
Office's key；The Bit7 of described byte is 0, and when Bit6 is 0, this byte representation partial secret key；Wherein, represent the byte of key
Low 5 of (as global secret and partial secret key) represent corresponding bit position in security state machine for this key.For example local is close
Bit7 in key RK (RK is the title of key) corresponding security state machine, the corresponding binary system of RK is exactly 00000111, and corresponding 16
System is exactly 07.
Table 1 cipher key relation corresponds to table
Additionally, safeguard the security state machine of a n byte, a bit pair of described n byte for each catalogue file
Should 1 key under catalogue file authentication state, if the authentication state of this key is to pass through, corresponding bits position is
1, otherwise it is set to 0, in this embodiment, it is preferred that, 1≤n≤4；
Wherein, described catalogue file includes parent directory file and current directory file, the described parent directory file maintenance overall situation
The security state machine of key, the security state machine of described current directory file maintenance partial secret key.In the present embodiment, each DF
File is exactly current directory file ADF, if this DF is under another DF, i.e. also parent directory, and parent directory is exactly DDF.
The byte number of security state machine can need to increase or decrease using the number of key according in application, at most permissible
Safeguard 4 bytes, that is, bit0～bit31 can be used to correspond the authentication state of 32 keys under this catalogue file.Also
It is to say, have 32 global secret, 32 partial secret key, at most can correspond to the authentication state of 64 keys.When requiring to look up
Whether certain key (global secret or partial secret key) is by, when certification, only checking this key in corresponding security state machine
Whether corresponding bit position is 1, illustrates that this key passes through certification if 1, is that this key of 0 explanation does not pass through certification.
S102：And write the recording mechanism of each record in the file header of corresponding EF file.
Wherein, when setting up a common EF file under this DF, safeguard there is the reading of two bytes in this EF file header
The modification authority byte of authority byte and two bytes, unlike the prior art, in the present embodiment, by each record
Read in authority byte and the second authority byte of modification authority byte in the file header of the recording mechanism corresponding EF file of write, tool
Body includes：
Respectively the recording mechanism of record that the reading authority of described EF file is located is write in the file header of corresponding EF file
Read in the second authority byte of authority byte, will be corresponding for the recording mechanism write of record that the modification authority of described EF file is located
In second authority byte of modification authority byte in the file header of EF file.
Read authority and modification authority can identical (reading authority same recording mechanism corresponding with modification authority) it is also possible to
Different (read authority and modification authority corresponds to two different records in described control of authority file respectively), read authority note
Record number write EF file header the 14th byte (reading the 2nd byte of authority byte), modification authority recording mechanism writes EF file header
16th byte (i.e. the 2nd byte of modification authority byte).
For example, control of authority file EFARRThe access rights record of one EF08 file of file generated, the reading of EF08 file
2nd byte of authority word is 05, and that is, the read right corresponding authority of EF08 file controls file EFARRRecording mechanism in file is 05
The represented key of record between logical expression.Control of authority file EFARRIn file, recording mechanism is 05 this record institute
The cipher key logic relation representing is as follows：UK | (PIN＆RK), it is assumed that PIN is global secret, corresponds to security state machine
Bit4, RK, UK are partial secret key, correspond to bit7, bit8 in security state machine respectively, by this reading authority according to TLV structure
Correspondence obtains 16 system sequence write EFARRIn this record of file, this 16 system sequence is
(800708828344810784), wherein, " 80 " are TAG value, and " 07 " is the length of the logical expression of logical relation of key,
Represent that key encrypting key relation accounts for 7 bytes altogether, " 08 " is UK, and UK is partial secret key, Bit7 and Bit6 is 0, low 5 correspondences
Bit8 in security state machine, is represented in binary as 00001000, and hexadecimal is exactly 08；Then correspond in table 1, can obtain
Arrive, " | " corresponding hexadecimal is 82, " (" corresponding hexadecimal is 83；Followed by PIN, PIN is global secret, and Bit7 is 0
It is 1, the bit4 of low 5 corresponding security state machines with Bit6, be represented in binary as 01000100, hexadecimal is exactly 44；Then
In corresponding table 1, can obtain, " ＆ " corresponding hexadecimal is 81, identical algorithm, the corresponding binary system of RK is exactly 00000111, right
Hexadecimal is answered to be exactly 07, ") " corresponding hexadecimal is 84, the expression rule of the TLV structure according to record and logical expression
Then obtain above-mentioned 16 system sequences.Finally, by control of authority file EFARRThe recording mechanism 05 of this record in file writes
Read in the file header of EF08 file in the second authority byte of authority byte.
As shown in Fig. 2 present embodiments providing a kind of realization based on above-mentioned smartcard file access safety rights management
The smartcard file access method of method, comprises the following steps：
S201：When accessing the EF file under described DF file, read respectively in described EF file header read authority byte and/
Or the recording mechanism in second authority byte of modification authority byte；
When being read to this EF file, read EF file header and read authority byte the 2nd byte (EF file header the
14 bytes) obtain and read authority in control of authority file EFARRRecording mechanism in file；When operation that this EF file is modified
When, read EF file header modification authority byte the 2nd byte (EF file header the 16th byte) and obtain modification authority in control of authority literary composition
Part EFARRRecording mechanism in file.Mainly see that what access operation is, read operation then reads EF file header and reads authority in this way
Byte, if modification operation, then read operation then reads EF file header modification authority byte, if be read out and repair simultaneously
Change operation, then read EF file header simultaneously and read authority byte and modification authority byte, to obtain corresponding recording mechanism.
S202：According to described recording mechanism in described control of authority file EFARRNote corresponding with this recording mechanism is searched in file
Record；
Here, the 2nd byte of the 2nd byte and modification authority byte that read authority byte in EF file header can be right respectively
Answer in control of authority file two records it is also possible to a corresponding record (corresponds to the reading of a record declaration this document, repaiies
Change authority identical).
S203：Obtain the logical table of the logical relation of key according to the access rights of EF file corresponding in the record finding
Reach formula；
Wherein, the access rights of described EF file are 16 system sequences of the logical relation of an expression key, according to institute
State the structure of record and the rule of logical expression, described 16 system sequences are converted to the logical table of the logical relation of key
Reach formula.
Or, the access rights of EF file are 16 system sequences taking that example above as a example
(800708828344810784), according to structure TLV recording it may be determined that 80 is TAG value, 07 is the length of logical expression
Degree, then, is converted to 16 system sequence identical rules with from logical expression, the corresponding table of comparison cipher key relation can be in turn
Obtaining logical expression is exactly：UK|(PIN&RK).
S204：Judging whether to meet access rights according to described logical expression, if met, allowing to described EF literary composition
Part conducts interviews operation, and otherwise, do not allow described EF file is conducted interviews operation.
Wherein, step S204 specifically includes：
S2041：Type according to key and the corresponding bit position in corresponding security state machine, in corresponding safe condition
The authentication state of described key is inquired about in machine；
Wherein, described key is judged for global secret or partial secret key according to the display rule of logical expression, if
For global secret, then inquire about the value of corresponding bit position in the security state machine of parent directory file maintenance, if partial secret key,
In the security state machine of current directory file maintenance, then inquire about the value of corresponding bit position, the value of corresponding bit position is 1 expression
Certification is passed through, and is that 0 expression certification is not passed through.
S2042：Described logical expression is converted to mathematic(al) representation by the authentication state according to described key；
Or, when 16 systems are converted to binary system, when the Bit7 of byte is 0, this is described taking that example above as a example
Byte is key, and the Bit6 of this byte is 1, illustrates that this key is global secret, is 0, illustrates that this key is partial secret key.Example
As " 08 " correspondence is represented in binary as 00001000, Bit7 and Bit6 and is 0, judges UK for partial secret key, its corresponding current mesh
Bit8 in the security state machine that record is safeguarded, the security state machine that therefore, it can current directory maintenance inquires about the value of bit8 position
Whether it is 1, parent directory can be DDF/MF, current directory can be current ADF (i.e. current DF file), in the present embodiment,
Assume that PIN did certification, RK, UK are not authenticated, therefore, then mathematic(al) representation corresponding with this record is 0 | (1＆0).
S2043：Calculate this mathematic(al) representation, if result of calculation is 1, meet access rights it is allowed to carry out to file
Access operation；If result of calculation is 0, it is unsatisfactory for access rights, do not allow file is conducted interviews operation.
Calculate mathematic(al) representation above, result of calculation is 0, that is, authority is unsatisfactory for it is assumed that this UK passes through certification, this
When mathematic(al) representation be 1 | (1＆0), check out 1 | (1＆0)=1 can determine that authority meet.
Wherein it is preferred to, in step S201, read and in described EF file header, read authority byte and/or modification authority word
Before recording mechanism in second authority byte of section, also include：
Whether the value judging to read two bytes of authority byte and/or modification authority byte in described EF file header be
' 00 ', if it is not, then whether judging the high nibble of first authority byte more than or equal to low nibble, if it is,
Read the recording mechanism in second authority byte reading authority byte and/or modification authority byte in described EF file header, no
Then do not read.
The above-mentioned judgement for reading authority byte and modification authority byte, when needs are read to this EF file
When, then read the reading authority byte of EF file header, judge whether the value reading two bytes of authority byte is ' 00 ', such as
Fruit is not then to judge whether the high nibble of first authority byte is more than or equal to low nibble, if it is, reading described
Read the recording mechanism in second authority byte of authority byte in EF file header, otherwise do not read, in the same manner, when needs are to this EF
File is modified when operating, then read the modification authority byte of EF file header, it is carried out judge to go to read second authority again
Recording mechanism in byte.
In an application example, or, by control of authority file EF taking that example above as a exampleARRIn file
Read in the file header of recording mechanism 05 write EF08 file of this record in the second authority byte of authority byte.With to this EF
File is modified as a example operation, as shown in figure 3, smartcard file access method, comprises the following steps：
S301：Choose the EF08 file under DF file, read the reading authority byte of this EF File head；
S302：Judge whether the value reading two bytes of authority byte is ' 00 ', if it is, execution step
S308；If it is not, then execution step S303；
S303：Judge whether the high nibble reading first authority byte of authority byte is more than or equal to low half-word
Section, if it is, execution step S304；Otherwise, execution step S309；
S304：Read the recording mechanism 05 in second authority byte reading authority byte in described EF file header；
S305：According to described recording mechanism 05 in described control of authority file EFARRSearch corresponding with this recording mechanism in file
This record；
S306：Obtain the logical table of the logical relation of key according to the access rights of EF file corresponding in the record finding
Reach formula；Search security state machine, this logical expression is converted to mathematic(al) representation；
According to recording mechanism be 05 this logical expression in recording and the corresponding secret key in logical expression is to deny
Card passes through, and show that the value of logical expression is 1 or is 0, if the value of logical expression is the reading that 1 expression meets EF08 file
Authority, if the value of logical expression is the read right of 0 sufficient EF08 file with thumb down.For example, in above-mentioned example, first will
16 system sequences (800708828344810784) are converted to the expression formula of the logical relation of key, UK | and (PIN＆RK)；Correspond to again
Be converted to mathematic(al) representation 0 | (1＆0).
S307：Calculate this mathematic(al) representation, whether judged result is 0, if 0, be then unsatisfactory for access rights, do not allow
Conduct interviews operation to file, execution step S309；If 1, then meet access rights it is allowed to behaviour that file is conducted interviews
Make, execution step S308；
S308：Read this EF08 file；
S309：Authority is unsatisfactory for it is impossible to be read out the operation of this EF file.
If additionally, operation that this EF file is modified, the write permission corresponding authority control file EF of EF08 fileARR
(wherein xx is control of authority file EF to the record for xx for the recording mechanism in fileARRAny one record in file), in the same manner,
Judge whether that the write permission meeting EF08 file requires according to recording mechanism for the value of the logical expression in the record of xx.
As shown in figure 4, present embodiments providing a kind of system realizing smartcard file access safety rights management, bag
Include：
Control of authority file maintenance module, for creating a control of authority file under private file DF file, described
Each bar record in control of authority file corresponds to a constituent instruments EF file under described DF file respectively；Each record is used
In the access rights of the corresponding EF file of record, the access rights of described EF file refer to the logical relation of key；
EF file maintenance module, for and by each record recording mechanism write corresponding EF file file header in.
As shown in figure 5, present embodiments providing a kind of being based on to realize smartcard file access safety authority as above
The smartcard file access mechanism of the system of management, including：
Searching modul, reads authority for when accessing the EF file under described DF file, reading in described EF file header
Recording mechanism in second authority byte of byte and/or modification authority byte, according to described recording mechanism in described control of authority
Record corresponding with this recording mechanism is searched in file；
Cipher key logic expression formula acquisition module, for the access rights according to EF file corresponding in the described record finding
Obtain the logical expression of the logical relation of key；
Judging module, for judging whether to meet access rights according to described logical expression, if met, it is right to allow
Described EF file conducts interviews operation, and otherwise, do not allow described EF file is conducted interviews operation.
From above-described embodiment as can be seen that with respect to prior art, the smartcard file providing in above-described embodiment accesses
The implementation method of security permission management and file access method, solving needs that certification is multiple to have complicated ' with ', ' or ' arbitrarily
The key of syntagmatic could obtain the problem of file access authority, and can use more number of keys；In a reality
Apply in example file is read/modification authority expressed in the form of variable-length record, gives the design of specific record format
Method, not only easily realizes and understands, and can clearly express any logical combination form of any number of keys, and
And, it is directed to whether each key passes through certification in another embodiment, safeguard a key state under each catalogue file
Machine, for 1 or 0, the value being directly viewable corresponding bits position in state machine would know that under this document, whether corresponding secret key is by recognizing
The logical expression parsing can be directly changed into mathematic(al) representation and be calculated by card then, can be straight by result of calculation
Obtain and know whether the reading/modification authority of file meets, realize efficiency high it is adaptable to various no application scenario, and energy
The key number representing can also be expanded.
One of ordinary skill in the art will appreciate that all or part of step in said method can be instructed by program
Related hardware completes, and described program can be stored in computer-readable recording medium, such as read only memory, disk or CD
Deng.Alternatively, all or part of step of above-described embodiment can also be realized using one or more integrated circuits.Accordingly
Ground, each module/unit in above-described embodiment can be to be realized in the form of hardware, it would however also be possible to employ the shape of software function module
Formula is realized.The present invention is not restricted to the combination of the hardware and software of any particular form.
The foregoing is only the preferred embodiments of the present invention, be not intended to limit protection scope of the present invention.According to
The content of the invention of the present invention, also can have other various embodiments, in the case of without departing substantially from present invention spirit and its essence, be familiar with
Those skilled in the art when can according to the present invention make various corresponding change and deform, all in the spirit and principles in the present invention
Within, any modification, equivalent substitution and improvement made etc., should be included within the scope of the present invention.
Claims (11)
1. a kind of implementation method of smartcard file access safety rights management, including：
Create a control of authority file under private file DF file, each bar record in described control of authority file is right respectively
Answer a constituent instruments EF file under described DF file；Each records the access right for recording corresponding EF file
Limit, the access rights of described EF file refer to the logical relation of key；
And write the recording mechanism of each record in the file header of corresponding EF file；
Wherein, described control of authority file is variable-length record file, and the structure of each record of described control of authority file is
TLV structure, is made up of 16 system sequences, and T is label TAG, and value is fixed as the logical table of the logical relation that 80, L is described key
Reach the length of formula, V is the content of described logical expression；
The display rule of described logical expression is：In logical expression content, key or cipher key relation respectively account for 1 byte；
Wherein, the value of the key and cipher key relation bit according to described byte is defined as follows：
When the Bit7 of described byte is 1, this byte representation cipher key relation, when the Bit7 of described byte is 0, this byte representation is close
Key；
The Bit7 of described byte is 0, and when Bit6 is 1, this byte representation global secret；The Bit7 of described byte is 0, and Bit6
During for 0, this byte representation partial secret key；Wherein, low 5 of the byte of the described key of expression represent this key in security state machine
In corresponding bit position.
2. the method for claim 1 it is characterised in that：Methods described also includes：
Safeguard the security state machine of a n byte for each catalogue file, each bit of described n byte is to should catalogue
The authentication state of 1 key under file, if the authentication state of this key is to pass through, corresponding bits position is 1, otherwise puts
For 0,1≤n≤4；
Wherein, described catalogue file includes parent directory file and current directory file, described parent directory file maintenance global secret
Security state machine, the security state machine of described current directory file maintenance partial secret key, described current directory file refers to described
Private file DF file.
3. the method for claim 1 it is characterised in that：
The access rights of described EF file include：Read authority and modification authority, the reading authority of described EF file and the power of amendment
In the corresponding record of limit record this EF file in described control of authority file, or it is separately recorded in described control of authority
In the corresponding two different records of this EF file in file；
The described recording mechanism by each record writes in the file header of corresponding EF file, including：
Read in the file header respectively recording mechanism of record that the reading authority of described EF file is located being write corresponding EF file
In second authority byte of authority byte, the recording mechanism of record that described modification authority is located is write the file of corresponding EF file
In second authority byte of modification authority byte in head.
4. the method for claim 1 it is characterised in that：
The short file identification SFI of described control of authority file is fixed as 0xFF.
5. the realization based on the smartcard file access safety rights management as described in Claims 1 to 4 any one claim
The smartcard file access method of method, including：
When accessing the EF file under described DF file, read and in described EF file header, read authority byte and/or modification authority word
Recording mechanism in second authority byte of section, searches and this recording mechanism according to described recording mechanism in described control of authority file
Corresponding record；
Obtain the logical expression of the logical relation of key according to the access rights of EF file corresponding in the described record finding；
Judging whether to meet access rights according to described logical expression, if met, allowing described EF file is conducted interviews
Operation, otherwise, do not allow described EF file is conducted interviews operation.
6. method as claimed in claim 5 it is characterised in that：
The described access rights according to EF file in described record obtain the logical expression of the logical relation of key, including：
Structure according to described record and the rule of logical expression, the logic that described 16 system sequences are converted to key is closed
The logical expression of system.
7. method as claimed in claim 5 it is characterised in that：
Described judge whether to meet described access rights according to described logical expression, including：
Type according to described key and the corresponding bit position in corresponding security state machine, in described corresponding security state machine
The middle authentication state inquiring about described key, described logical expression is converted to mathematical expression by the authentication state according to described key
Formula, if result of calculation is 1, meets access rights it is allowed to operation that described EF file is conducted interviews；If result of calculation is
0, then it is unsatisfactory for access rights, do not allow described EF file is conducted interviews operation.
8. method as claimed in claim 7 it is characterised in that：
The described type according to described key and the corresponding bit position in corresponding security state machine, in described accordingly safe shape
The authentication state of described key is inquired about in state machine, including：
Described key is judged for global secret or partial secret key according to the display rule of logical expression, close if the overall situation
Key, then inquire about the value of corresponding bit position, if partial secret key, then current in the security state machine of parent directory file maintenance
The value of corresponding bit position is inquired about, the value of corresponding bit position is 1 and represents that certification is passed through in the security state machine that catalogue file is safeguarded,
Do not pass through for 0 expression certification.
9. method as claimed in claim 5 it is characterised in that：
In described second authority byte reading and reading authority byte and/or modification authority byte in described EF file header
Before the step of recording mechanism, also include：
Whether the value judging to read two bytes of authority byte and/or modification authority byte in described EF file header be
' 00 ', if it is not, then whether judging the high nibble of first authority byte more than or equal to low nibble, if it is,
Read the recording mechanism in second authority byte reading authority byte and/or modification authority byte in described EF file header, no
Then do not read.
10. a kind of system realizing smartcard file access safety rights management, including：
Control of authority file maintenance module, for creating a control of authority file, described authority under private file DF file
The each bar record in file is controlled to correspond to a constituent instruments EF file under described DF file respectively；Each records for remembering
The access rights of the corresponding EF file of record, the access rights of described EF file refer to the logical relation of key；
EF file maintenance module, for and by each record recording mechanism write corresponding EF file file header in；
Wherein, described control of authority file is variable-length record file, and the structure of each record of described control of authority file is
TLV structure, is made up of 16 system sequences, and T is label TAG, and value is fixed as the logical table of the logical relation that 80, L is described key
Reach the length of formula, V is the content of described logical expression；
The display rule of described logical expression is：In logical expression content, key or cipher key relation respectively account for 1 byte；
Wherein, the value of the key and cipher key relation bit according to described byte is defined as follows：
When the Bit7 of described byte is 1, this byte representation cipher key relation, when the Bit7 of described byte is 0, this byte representation is close
Key；
The Bit7 of described byte is 0, and when Bit6 is 1, this byte representation global secret；The Bit7 of described byte is 0, and Bit6
During for 0, this byte representation partial secret key；Wherein, low 5 of the byte of the described key of expression represent this key in security state machine
In corresponding bit position.
11. smartcard file based on the system realizing smartcard file access safety rights management as claimed in claim 10
Access mechanism, including：
Searching modul, reads authority byte for when accessing the EF file under described DF file, reading in described EF file header
And/or the recording mechanism in second authority byte of modification authority byte, according to described recording mechanism in described control of authority file
Middle lookup record corresponding with this recording mechanism；
Cipher key logic expression formula acquisition module, for obtaining according to the access rights of EF file corresponding in the described record finding
The logical expression of the logical relation of key；
Judging module, for judging whether to meet access rights according to described logical expression, if met, allows to described
EF file conducts interviews operation, and otherwise, do not allow described EF file is conducted interviews operation.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410300218.9A CN104050424B (en) | 2014-06-26 | 2014-06-26 | The realization of smartcard file access safety rights management and file access method |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410300218.9A CN104050424B (en) | 2014-06-26 | 2014-06-26 | The realization of smartcard file access safety rights management and file access method |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN104050424A CN104050424A (en) | 2014-09-17 |
| CN104050424B true CN104050424B (en) | 2017-03-01 |
Family
ID=51503239
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201410300218.9A Active CN104050424B (en) | 2014-06-26 | 2014-06-26 | The realization of smartcard file access safety rights management and file access method |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN104050424B (en) |
Families Citing this family (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106572086A (en) * | 2016-10-19 | 2017-04-19 | 盛科网络（苏州）有限公司 | Method and method of realizing network protocol key dynamic updating based on chip |
| CN108376227B (en) * | 2017-12-29 | 2021-07-20 | 北京智芯微电子科技有限公司 | File access method and system of security chip |
| CN108537067B (en) * | 2018-02-28 | 2022-02-11 | 北京智芯微电子科技有限公司 | Chip safety protection method and system |
| CN109005275A (en) * | 2018-08-31 | 2018-12-14 | 阿里巴巴集团控股有限公司 | A kind of managing contact information system and method |
| CN109710373B (en) * | 2018-11-22 | 2021-02-12 | 海光信息技术股份有限公司 | Method and device for realizing memory and external memory exchange function and security processor |
| CN111079187B (en) * | 2019-12-23 | 2022-04-01 | 恒宝股份有限公司 | Smart card and file management method thereof |
| CN111367476B (en) * | 2020-03-11 | 2024-01-30 | 楚天龙股份有限公司 | Data reading method and device of SIM card |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2003288258A (en) * | 2002-03-28 | 2003-10-10 | Toppan Printing Co Ltd | Ic card and memory management method for it |
| JP4301465B2 (en) * | 1998-10-13 | 2009-07-22 | 大日本印刷株式会社 | IC card with backup memory |
| CN101520854A (en) * | 2008-02-29 | 2009-09-02 | 凤凰微电子（中国）有限公司 | Smart memory card, data safety control system and method thereof |
| CN102663473A (en) * | 2012-04-25 | 2012-09-12 | 山东神思电子技术股份有限公司 | Method for realizing chip operating system (COS) safety mechanism of intelligent card |
-
2014
- 2014-06-26 CN CN201410300218.9A patent/CN104050424B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP4301465B2 (en) * | 1998-10-13 | 2009-07-22 | 大日本印刷株式会社 | IC card with backup memory |
| JP2003288258A (en) * | 2002-03-28 | 2003-10-10 | Toppan Printing Co Ltd | Ic card and memory management method for it |
| CN101520854A (en) * | 2008-02-29 | 2009-09-02 | 凤凰微电子（中国）有限公司 | Smart memory card, data safety control system and method thereof |
| CN102663473A (en) * | 2012-04-25 | 2012-09-12 | 山东神思电子技术股份有限公司 | Method for realizing chip operating system (COS) safety mechanism of intelligent card |
Also Published As
| Publication number | Publication date |
|---|---|
| CN104050424A (en) | 2014-09-17 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN104050424B (en) | The realization of smartcard file access safety rights management and file access method | |
| CN100547590C (en) | DPS (Document Processing System) | |
| KR100371124B1 (en) | Storing data objects in a smart card memory | |
| CA2437645C (en) | Electronic document management system with the use of signature technique capable of masking | |
| CN101908120B (en) | Method for realizing all-in-one function of single intelligent card | |
| EP2631841A2 (en) | Provisioning authorization claims using attribute-based access-control policies | |
| CN1979478B (en) | File processing system and file processing method | |
| CN106529349A (en) | Security chip and access control method thereof | |
| US20120030243A1 (en) | Policy generation and conversion system, policy distribution system, and method and program therefor | |
| CN102184365A (en) | External data security memory architecture based on system on chip (SoC) and access control method | |
| CN104484628B (en) | It is a kind of that there is the multi-application smart card of encrypting and decrypting | |
| CN1979511A (en) | File data safety management system and method | |
| Grummt et al. | Fine-grained access control for EPC information services | |
| WO2023005862A1 (en) | Data governance apparatus and method, computer device, and storage medium | |
| CN104732123A (en) | Function operation authority control method based on JSON format | |
| CN113918999B (en) | Method and device for establishing safe ferry channel, network disk and storage medium | |
| JP5425307B2 (en) | Keyword conversion apparatus, keyword conversion program, recording medium, and keyword conversion method | |
| CN106529323B (en) | A kind of Multilevel Security Models access control data fusion method | |
| Washizaki et al. | Taxonomy and literature survey of security pattern research | |
| WO2019138542A1 (en) | Countermeasure formulation assistance device, countermeasure formulation assistance method, and countermeasure formulation assistance program | |
| CN102663473B (en) | Method for realizing chip operating system (COS) safety mechanism of intelligent card | |
| CN101751450B (en) | Information sharing realizing method for CPU card with multi-application COS | |
| CN110113151A (en) | A kind of non-intrusion type real-time encryption and decryption method of pair of ELF format program | |
| CN104751080A (en) | USB (Universal Serial Bus) flash disk encryption-based data access method and system | |
| CN108614977A (en) | A kind of vehicle-mounted sensitive data method for secure storing and its system for supporting HSM |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| TR01 | Transfer of patent right | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20180111 Address after: The 300463 Tianjin Tianjin FTA test area (Dongjiang Bonded Port) No. 6865 North Road, 1-1-1802-7 financial and trade center of Asia Patentee after: Core leasehold (Tianjin) limited liability company Address before: 100094 Yongjia North Road, Beijing, No. 6, No. Patentee before: Datang Microelectronics Technology Co., Ltd. |
|
| TR01 | Transfer of patent right | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20201020 Address after: 100094 No. 6 Yongjia North Road, Beijing, Haidian District Patentee after: DATANG MICROELECTRONICS TECHNOLOGY Co.,Ltd. Address before: 300463 Tianjin Tianjin free trade pilot area (Dongjiang Bonded Port), Asia Road 6865 financial and Trade Center North District 1-1-1802-7 Patentee before: Xinjin Leasing (Tianjin) Co.,Ltd. |