CN105592091B - Security application method for down loading - Google Patents

Security application method for down loading Download PDF

Info

Publication number
CN105592091B
CN105592091B CN201511009467.3A CN201511009467A CN105592091B CN 105592091 B CN105592091 B CN 105592091B CN 201511009467 A CN201511009467 A CN 201511009467A CN 105592091 B CN105592091 B CN 105592091B
Authority
CN
China
Prior art keywords
application
security application
client
security
contingency table
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201511009467.3A
Other languages
Chinese (zh)
Other versions
CN105592091A (en
Inventor
姜科
冀乃庚
傅宜生
田丰
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
China Unionpay Co Ltd
Original Assignee
China Unionpay Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by China Unionpay Co Ltd filed Critical China Unionpay Co Ltd
Priority to CN201511009467.3A priority Critical patent/CN105592091B/en
Publication of CN105592091A publication Critical patent/CN105592091A/en
Application granted granted Critical
Publication of CN105592091B publication Critical patent/CN105592091B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/10Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/107Network architectures or network communication protocols for network security for controlling access to devices or network resources wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/08Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0853Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal

Abstract

The invention proposes security application method for down loading, the described method includes: when the third party's client run in user terminal downloads request to the credible performing environment manager sending application of the user terminal, the credible performing environment manager determines the security application that the third party client can download based on first contingency table, third contingency table and the 4th contingency table, and the associated application installation package of security application is determined based on second contingency table, and then start the downloading process of targeted security application based on the selection of user.Security application method for down loading disclosed in this invention has high configurability.

Description

Security application method for down loading
Technical field
The present invention relates to the methods of application downloading, more particularly, to security application method for down loading.
Background technique
Currently, increasingly extensive and different field the type of business applied with computer and networks becomes increasingly abundant, For safety barrier (SE) downloading under the credible performing environment (TSM) resided in user terminal (such as mobile terminal or) Security application (such as payment application in financial field) becomes more and more important.
In existing technical solution, generallys use APDU instruction defined in GP specification and complete under security application Carry operation.
However.There are the following problems for above-mentioned existing technical solution: (1) it is difficult to assure that safety barrier and application installation package with And installation parameter is adapted conjunction association;(2) it is difficult to control the third party's client run on user terminal to security application Access and download permission;(3) flexible configuration application downloading mode and customizing mode are difficult to.
Accordingly, there exist following demands: providing the security application method for down loading with high configurability.
Summary of the invention
In order to solve the problems existing in the prior art scheme, the invention proposes the peaces with high configurability Full property application method for down loading.
The purpose of the present invention is what is be achieved through the following technical solutions:
A kind of security application method for down loading, the security application method for down loading include the following steps:
(A1) the first contingency table, the second contingency table, third contingency table and the 4th contingency table are constructed, and described first is associated with Table, the second contingency table, third contingency table and the 4th contingency table are stored in database profession, wherein first contingency table refers to Show incidence relation, second contingency table instruction security application and the application peace between security application and safety barrier type Incidence relation between dress packet, the association between third contingency table instruction third party's client and safety barrier type are closed System, the incidence relation between the 4th contingency table instruction third party's client and security application;
(A2) in the third party's client run in user terminal to the credible performing environment manager of the user terminal When sending application downloading request, the credible performing environment manager is based on first contingency table, third contingency table and the 4th Contingency table determines the security application that the third party client can download, and determines that safety is answered based on second contingency table With associated application installation package, and then start the downloading process of targeted security application based on the selection of user.
In scheme disclosed above, it is preferable that a security application can be associated with multiple safety barrier types, and And a safety barrier type can be associated with multiple security applications, and a security application can be associated with multiple application peaces Dress packet, an and application installation package can be associated with multiple security applications, and third party's client can be associated with it is more A safety barrier type, and a safety barrier type can be associated with multiple third party's clients.An and third party visitor Family end can be associated with multiple security applications, and a security application can be associated with multiple third party's clients.
In scheme disclosed above, it is preferable that the 4th contingency table passes through security application identifier and third Square client identifier is associated with security application and third party's client, and first contingency table passes through security application and identify Symbol is associated with security application and safety barrier type with safety barrier type identifier, and second contingency table passes through safety Application identifier is associated with security application and application installation package with application installation package identifier and the third contingency table is logical Third party's client identifier is crossed with safety barrier type identifier to be associated with third party's client and safety barrier type.
In scheme disclosed above, it is preferable that the security application identifier is by application identification code and applies version This number composition, the safety barrier type identifier are made of safety barrier publisher code and safety barrier class code, The application installation package identifier is made of application installation package identification code and application installation package version number and third party visitor Family end identifier is made of client packet name and client hash value.
In scheme disclosed above, it is preferable that database maintenance side can be by way of configuring to described first Contingency table, the second contingency table and third contingency table execute newly-increased record operation, deletion record operation and modification record operation.
In scheme disclosed above, it is preferable that database maintenance side can by configure second contingency table come Manage and maintain the incidence relation between security application and application installation package.
In scheme disclosed above, it is preferable that after receiving the application downloading request, the credible execution ring Border manager is by executing matching operation and to the application to client packet name included in application downloading request Client hash value included in downloading request executes verification operation to verify the third party for sending the application downloading request The identity of client, and if the verification passes, then the list for the security application that can be downloaded is provided it, otherwise, refusal The application downloading request.
In scheme disclosed above, it is preferable that the credible performing environment manager is in the following way to transmission Third party's client of the application downloading request provides the list for the security application that it can be downloaded: (1) answering according to The third contingency table is inquired with the third party's client identifier and safety barrier type identifier that include in downloading request To determine whether current safety carrier type supports that sending the application downloads the third party's client requested;(2) if it is determined that Current safety carrier type supports to send third party's client of application downloading request, then inquire first contingency table with The set and inquiry the 4th contingency table for determining the security application that current safety carrier type is supported are supported with determining Send the set of the security application of third party's client of the application downloading request;(3) current safety carrier type is determined The set for the security application supported and the security application for supporting to send third party's client of the application downloading request Intersection of sets collection answered with obtaining sending the safety that third party's client of the application downloading request is able to access that and downloads List.
In scheme disclosed above, it is preferable that a security application is only associated with an application provider.
In scheme disclosed above, it is preferable that each application provider can be by inquiring the database simultaneously It configures this and applies the current downloading mode parameter of provider the current downloading mode for applying provider is arranged.
In scheme disclosed above, it is preferable that the current downloading mode is a key downloading mode and asynchronous audit One in downloading mode.
In scheme disclosed above, it is preferable that the workflow of the key downloading mode includes at least: (1) using The transmission of family triggering application downloading application;(2) using the synchronous audit application downloading application of provider;(3) if application application is examined Core passes through, then downloads target application;(4) target application downloaded is installed.
In scheme disclosed above, it is preferable that the workflow of the asynchronous audit mode includes at least: (1) using The transmission of family triggering application downloading application;(2) it using the asynchronous audit application downloading application of provider, and is notified by auditing result Inform auditing result;(3) auditing result of record application application, terminates application process therewith;(4) if application application audit is logical It crosses, the down operation of target application is triggered by user and the target application downloaded is installed therewith.
In scheme disclosed above, it is preferable that each application provider can be by inquiring the database simultaneously It configures this and applies the current Personalized operation mode parameter of provider the current Personalized operation mould for applying provider is arranged Formula.
In scheme disclosed above, it is preferable that the current Personalized operation mode is DP document personalization operations One in mode and online individual operation mode.
In scheme disclosed above, it is preferable that the DP document personalization operations mode is passed using DP files in batch Defeated personal data.
In scheme disclosed above, it is preferable that the online individual operation mode is obtained a by online request Peopleization data.
Security application method for down loading disclosed in this invention has the advantage that with high configurability, expansible Property and compatibility.
Detailed description of the invention
In conjunction with attached drawing, technical characteristic of the invention and advantage will be more fully understood by those skilled in the art, in which:
Fig. 1 is the flow chart of the security application method for down loading of embodiment according to the present invention.
Specific embodiment
Fig. 1 is the flow chart of the security application method for down loading of embodiment according to the present invention.As shown in Figure 1, of the invention Disclosed security application method for down loading includes the following steps: that (A1) constructs the first contingency table, the second contingency table, third association Table and the 4th contingency table, and first contingency table, the second contingency table, third contingency table and the 4th contingency table are stored in In database, wherein incidence relation between first contingency table instruction security application and safety barrier type, described the Two contingency tables indicate that the incidence relation between security application and application installation package, the third contingency table indicate third party client Incidence relation between end and safety barrier type, between the 4th contingency table instruction third party's client and security application Incidence relation;(A2) in the third party's client run in user terminal (such as mobile terminal) to the user terminal can Believe performing environment manager sending application downloading request when, the credible performing environment manager be based on first contingency table, Third contingency table and the 4th contingency table determine security application that the third party client can download (such as the branch in financial field Pay application), and the associated application installation package of security application is determined based on second contingency table, and then based on user's It selects to start the downloading process of targeted security application.
Preferably, in security application method for down loading disclosed in this invention, a security application can be associated with more A safety barrier type, and a safety barrier type can be associated with multiple security applications.
Preferably, in security application method for down loading disclosed in this invention, a security application can be associated with more A application installation package, and an application installation package can be associated with multiple security applications.
Preferably, in security application method for down loading disclosed in this invention, third party's client can be associated with Multiple safety barrier types, and a safety barrier type can be associated with multiple third party's clients.
Preferably, in security application method for down loading disclosed in this invention, third party's client can be associated with Multiple security applications, and a security application can be associated with multiple third party's clients.
Preferably, in security application method for down loading disclosed in this invention, the 4th contingency table passes through safety Application identifier is associated with security application and third party's client with third party's client identifier.
Preferably, in security application method for down loading disclosed in this invention, first contingency table passes through safety Application identifier is associated with security application and safety barrier type with safety barrier type identifier.
Preferably, in security application method for down loading disclosed in this invention, second contingency table passes through safety Application identifier is associated with security application and application installation package with application installation package identifier.
Preferably, in security application method for down loading disclosed in this invention, the third contingency table passes through third party Client identifier is associated with third party's client and safety barrier type with safety barrier type identifier.
Preferably, in security application method for down loading disclosed in this invention, the security application identifier is by answering It is constituted with identification code and application version number.
Preferably, in security application method for down loading disclosed in this invention, the safety barrier type identifier by Safety barrier publisher code and safety barrier class code are constituted.
Preferably, in security application method for down loading disclosed in this invention, the application installation package identifier is by answering It is constituted with installation packet identifier and application installation package version number.
Preferably, in security application method for down loading disclosed in this invention, third party's client identifier by Client packet name and client hash value are constituted.
Preferably, in security application method for down loading disclosed in this invention, database maintenance side, which can pass through, to be configured Mode to first contingency table, the second contingency table and third contingency table execute newly-increased record operation, deletion record operation with And modification record operation.
Preferably, in security application method for down loading disclosed in this invention, database maintenance side, which can pass through, to be configured Second contingency table manages and maintains the incidence relation between security application and application installation package (for example, a safety Property may be split and assign in multiple installation kits using corresponding loading module, i.e., it is associated with multiple installation kits).
Preferably, in security application method for down loading disclosed in this invention, the application downloading request is being received Afterwards, the credible performing environment manager is by executing matching behaviour to client packet name included in application downloading request Make and verification operation is executed to client hash value included in application downloading request to verify the transmission application The identity of third party's client of request is downloaded, and if the verification passes, then provides it the security application that can be downloaded List, otherwise, refuse the application downloading request.
Preferably, in security application method for down loading disclosed in this invention, the credible performing environment manager is logical The third party's client for crossing the application downloading request as described under type to transmission provides the column for the security application that it can be downloaded Table: (1) it according to the third party client identifier and safety barrier type identifier that in application downloading request include is looked into The third contingency table is ask to determine whether current safety carrier type supports the third party for sending the application downloading request objective Family end;(2) it if it is determined that current safety carrier type is supported to send third party's client of the application downloading request, then inquires First contingency table with determine security application that current safety carrier type is supported set (i.e. with current safety carrier The associated security application of type) and the 4th contingency table is inquired to determine that support sends what the application downloading was requested The set of the security application of third party's client is (i.e. associated with the third party's client for sending the application downloading request Security application);(3) it determines the set for the security application that current safety carrier type is supported and supports to send the application The intersection of sets collection of the security application of third party's client of request is downloaded to obtain sending the of the application downloading request The list for the security application that tripartite's client is able to access that and downloads.
Preferably, in security application method for down loading disclosed in this invention, a security application is only answered with one It is associated with provider.
Preferably, in security application method for down loading disclosed in this invention, each application provider can pass through It inquires the database and configures this and apply the current downloading mode parameter of provider this is arranged using provider when front lower Load mode.
Preferably, in security application method for down loading disclosed in this invention, the current downloading mode is under a key One in load mode and asynchronous audit downloading mode.
Preferably, in security application method for down loading disclosed in this invention, the workflow of the key downloading mode Journey includes at least: (1) user triggers the transmission of application downloading application;(2) using the synchronous audit application downloading application of provider; (3) if application application audit passes through, target application is downloaded;(4) target application downloaded is installed.
Preferably, in security application method for down loading disclosed in this invention, the workflow of the asynchronous audit mode Journey includes at least: (1) user triggers the transmission of application downloading application;(2) using the asynchronous audit application downloading application of provider, and It notifies to inform auditing result by auditing result;(3) auditing result of record application application, terminates application process therewith;(4) such as Fruit application application audit passes through, and triggers the down operation of target application by user and installs the target application downloaded therewith.
Preferably, in security application method for down loading disclosed in this invention, each application provider can pass through It inquires the database and configures this and apply the current Personalized operation mode parameter of provider this is arranged using provider's Current Personalized operation mode.
Preferably, in security application method for down loading disclosed in this invention, the current Personalized operation mode is One in DP document personalization operations mode and online individual operation mode.
Preferably, in security application method for down loading disclosed in this invention, the DP document personalization operations mode Personal data is transmitted using DP files in batch.
Preferably, in security application method for down loading disclosed in this invention, the online individual operation mode is logical It crosses online request and obtains personal data.
Therefore security application method for down loading disclosed in this invention has the advantage that and can configure with high Property, scalability and compatibility.
Although the present invention is described by above-mentioned preferred embodiment, way of realization is not limited to Above-mentioned embodiment.It will be appreciated that in the case where not departing from spirit and scope of the present invention, those skilled in the art can be with Different change and modification are made to the present invention.

Claims (17)

1. a kind of security application method for down loading, the security application method for down loading includes the following steps:
(A1) construct the first contingency table, the second contingency table, third contingency table and the 4th contingency table, and by first contingency table, Second contingency table, third contingency table and the 4th contingency table are stored in database profession, wherein the first contingency table instruction peace Incidence relation, second contingency table instruction security application and application installation package between full property application and safety barrier type Between incidence relation, the incidence relation between third contingency table instruction third party's client and safety barrier type, institute State the incidence relation between the 4th contingency table instruction third party's client and security application;
(A2) it is sent in the third party's client run in user terminal to the credible performing environment manager of the user terminal When using downloading request, the credible performing environment manager is based on first contingency table, third contingency table and the 4th association Table determines the security application that the third party client can download, and determines that security application is closed based on second contingency table The application installation package of connection, and then start the downloading process of targeted security application based on the selection of user.
2. security application method for down loading according to claim 1, which is characterized in that a security application can be associated with Multiple safety barrier types, and a safety barrier type can be associated with multiple security applications, and a safety is answered With can be associated with multiple application installation packages, and an application installation package can be associated with multiple security applications, and one Tripartite's client can be associated with multiple safety barrier types, and a safety barrier type can be associated with multiple third party clients End and third party's client can be associated with multiple security applications, and a security application can be associated with it is multiple Third party's client.
3. security application method for down loading according to claim 2, which is characterized in that the 4th contingency table passes through safety Property application identifier is associated with security application and third party's client, first contingency table with third party's client identifier Security application and safety barrier type are associated with safety barrier type identifier by security application identifier, described Two contingency tables are associated with security application and application installation package with application installation package identifier by security application identifier, with And the third contingency table is associated with third party's client with safety barrier type identifier by third party's client identifier With safety barrier type.
4. security application method for down loading according to claim 2, which is characterized in that the security application identifier by Application identification code and application version number are constituted, and the safety barrier type identifier is by safety barrier publisher code and safety Carrier type code is constituted, and the application installation package identifier is by application installation package identification code and application installation package version number structure At and third party's client identifier be made of client packet name and client hash value.
5. security application method for down loading according to claim 4, which is characterized in that database maintenance side can be by matching The mode set executes newly-increased record operation to first contingency table, the second contingency table and third contingency table, deletion record operates And modification record operation.
6. security application method for down loading according to claim 5, which is characterized in that database maintenance side can be by matching Second contingency table is set to manage and maintain the incidence relation between security application and application installation package.
7. security application method for down loading according to claim 6, which is characterized in that asked receiving the application downloading After asking, the credible performing environment manager is by executing matching to client packet name included in application downloading request It operates and verification operation is executed to client hash value included in application downloading request and answered described in transmission to verify With the identity of third party's client of downloading request, and if the verification passes, then the safety that providing it can download is answered Otherwise list refuses application downloading request.
8. security application method for down loading according to claim 7, which is characterized in that the credible performing environment manager Security application that it can be downloaded is provided to the third party's client for sending application downloading request in the following way List: (1) according to the third party's client identifier and safety barrier type identifier for including in application downloading request The third contingency table is inquired to determine whether current safety carrier type supports that sending the application downloads the third party requested Client;(2) it if it is determined that current safety carrier type is supported to send third party's client of the application downloading request, then looks into First contingency table is ask to determine the set and inquiry described the of security application that current safety carrier type is supported Four contingency tables are to determine that support sends the set of the security application of third party's client of the application downloading request;(3) really The set for the security application that settled preceding safety barrier type is supported and the third party for supporting to send the application downloading request The intersection of sets collection of the security application of client can be visited with the third party's client for obtaining sending the application downloading request The list for the security application asked and downloaded.
9. security application method for down loading according to claim 8, which is characterized in that a security application only with one It is associated using provider.
10. security application method for down loading according to claim 9, which is characterized in that each application provider can The current downloading mode parameter of provider is applied to apply working as provider this is arranged by inquiring the database and configuring this Preceding downloading mode.
11. security application method for down loading according to claim 10, which is characterized in that the current downloading mode is one One in key downloading mode and asynchronous audit downloading mode.
12. security application method for down loading according to claim 11, which is characterized in that the work of the key downloading mode Include at least as process: (1) user triggers the transmission of application downloading application;(2) using the synchronous audit application downloading Shen of provider Please;(3) if application application audit passes through, target application is downloaded;(4) target application downloaded is installed.
13. security application method for down loading according to claim 12, which is characterized in that the work of the asynchronous audit mode Include at least as process: (1) user triggers the transmission of application downloading application;(2) using the asynchronous audit application downloading Shen of provider Please, it and notifies to inform auditing result by auditing result;(3) auditing result of record application application, terminates application process therewith; (4) it if application application audit passes through, is triggered the down operation of target application by user and the target downloaded is installed therewith and answered With.
14. security application method for down loading according to claim 13, which is characterized in that each application provider can The current Personalized operation mode parameter of provider is applied to provide the application is arranged by inquiring the database and configuring this The current Personalized operation mode of side.
15. security application method for down loading according to claim 14, which is characterized in that the current Personalized operation mould Formula is one in DP document personalization operations mode and online individual operation mode.
16. security application method for down loading according to claim 15, which is characterized in that the DP document personalization operations Mode transmits personal data using DP files in batch.
17. security application method for down loading according to claim 16, which is characterized in that the online individual operation mould Formula obtains personal data by online request.
CN201511009467.3A 2015-12-30 2015-12-30 Security application method for down loading Active CN105592091B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201511009467.3A CN105592091B (en) 2015-12-30 2015-12-30 Security application method for down loading

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201511009467.3A CN105592091B (en) 2015-12-30 2015-12-30 Security application method for down loading

Publications (2)

Publication Number Publication Date
CN105592091A CN105592091A (en) 2016-05-18
CN105592091B true CN105592091B (en) 2018-12-25

Family

ID=55931305

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201511009467.3A Active CN105592091B (en) 2015-12-30 2015-12-30 Security application method for down loading

Country Status (1)

Country Link
CN (1) CN105592091B (en)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107169762B (en) 2017-05-24 2020-02-07 中国银联股份有限公司 Configuration method and device of security carrier
CN107454112A (en) * 2017-09-29 2017-12-08 恒宝股份有限公司 A kind of method and its system for accessing trusted application
CN107682159B (en) * 2017-10-12 2021-02-02 北京握奇智能科技有限公司 Trusted application management method and trusted application management system of intelligent terminal
CN110278267B (en) * 2019-06-21 2021-10-29 浙江蓝卓工业互联网信息技术有限公司 Method and system for limiting use of industrial internet APP
CN114760276B (en) * 2022-06-13 2022-09-09 深圳市汇顶科技股份有限公司 Method and device for downloading data and secure element

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104301289A (en) * 2013-07-17 2015-01-21 中国银联股份有限公司 Apparatus for security information interaction
CN104702615A (en) * 2015-03-20 2015-06-10 武汉天喻信息产业股份有限公司 Multi-service realizing system and method based on security terminal
CN104901979A (en) * 2014-03-04 2015-09-09 北京奇虎科技有限公司 Method and device for downloading application program files

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104301289A (en) * 2013-07-17 2015-01-21 中国银联股份有限公司 Apparatus for security information interaction
CN104901979A (en) * 2014-03-04 2015-09-09 北京奇虎科技有限公司 Method and device for downloading application program files
CN104702615A (en) * 2015-03-20 2015-06-10 武汉天喻信息产业股份有限公司 Multi-service realizing system and method based on security terminal

Also Published As

Publication number Publication date
CN105592091A (en) 2016-05-18

Similar Documents

Publication Publication Date Title
CN105592091B (en) Security application method for down loading
US11601273B2 (en) Systems, methods, and computer program products for interfacing multiple service provider trusted service managers and secure elements
JP6338615B2 (en) System, method and computer readable storage medium for managing safety elements
EP3337219A1 (en) Carrier configuration processing method, device and system, and computer storage medium
CN106664112A (en) Data updating method and apparatus, and embedded universal integrated circuit card
US9286049B2 (en) Systems, methods, and computer program products for managing service installation
CN103870727B (en) A kind of method and system for being managed collectively authority
CN106161733A (en) A kind of system switching method, device and mobile terminal
CN103179565A (en) Safety information interaction system, terminal, server and method based on thin terminal mode
AU2016203535B2 (en) Systems, methods, and computer program products for managing secure elements

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant