CN105790946B - Method, system and related equipment for establishing data channel - Google Patents

Abstract

The invention discloses a method for establishing a data channel, which includes: an off-card entity obtains safety authentication information for applying for a data channel from a smart card management platform; the off-card entity sends an authentication registration message carrying the security authentication information to a smart card device; After the smart card device successfully verifies the security authentication information, it establishes a data channel with the entity outside the card. The invention also discloses an off-card entity, a smart card management platform, a smart card device and a system for establishing a data channel.

Description

Method, system and related equipment for establishing data channel

technical field

The invention relates to the field of data services, in particular to a method, a system and related equipment for establishing a data channel.

Background technique

With the popularization of mobile e-commerce, the data stored in smart cards is becoming more and more important. Smart cards can currently store sensitive information such as user identity information, bank card account information, and bank card account balances, so the security of smart cards is more important.

At present, smart card products support entities outside the card to access through various physical connection forms such as contactless card readers, data lines (contact type), and Bluetooth, and to exchange data with smart cards.

The security of the smart card depends on the smart card hardware device on the one hand, and on the data channel security mechanism between the smart card and the entity outside the card on the other hand.

As shown in Figure 1, at present, off-card entities (including card readers, mobile phones and other off-card entities) access the smart card through a physical channel established with the smart card, such as a contactless physical channel or a Bluetooth physical channel. However, the data channel established between the smart card and the entity outside the card has no security authentication mechanism, so the entity outside the card can access the smart card at will, which will cause attack damage to the smart card, thereby arbitrarily obtaining the sensitive information (user identity information, bank card information, bank account balance, etc.), modify the data on the smart card, etc.

SUMMARY OF THE INVENTION

In order to solve the existing technical problems, the embodiments of the present invention provide a method, a system and related equipment for establishing a data channel.

An embodiment of the present invention provides a method for establishing a data channel, including:

The off-card entity obtains the security authentication information of the application data channel from the smart card management platform;

The off-card entity sends an authentication registration message carrying the security authentication information to the smart card device;

After successfully verifying the security authentication information, the smart card device establishes a data channel with the entity outside the card.

In the above solution, the off-card entity obtains the security authentication information for the application data channel from the smart card management platform, including:

The off-card entity sends a data channel registration application carrying the corresponding application-related information to the smart card management platform;

After receiving the data channel registration application, the smart card management platform generates the security authentication information of the corresponding application by using the key or certificate stored by itself and according to the application-related information;

The smart card management platform sends the generated security authentication information to the off-card entity.

In the above solution, the smart card device verifies the security authentication information, including:

The smart card device generates the security authentication information of the corresponding application by using the key or certificate stored by itself and according to the relevant information of the corresponding application;

The generated security authentication information of the corresponding application is matched with the security authentication information carried in the authentication registration message.

In the above solution, after the data channel is established, the method further includes:

The smart card device adds the information of the corresponding application in its own application software registry.

In the above solution, after the data channel is established, the method further includes:

After receiving the application protocol data unit (APDU, Application Protocol Data Unit) instruction of the off-card entity, the smart card device performs a corresponding transaction operation when it is determined that the data channel corresponding to the APDU is valid.

In the above solution, the determining that the data channel corresponding to the APDU is valid is:

The smart card device determines that the data channel corresponding to the APDU is valid according to the information of the data channel corresponding to the APDU in the application software registry.

In the above scheme, the method also includes:

After the transaction operation is completed, the smart card device closes the data channel corresponding to the APDU; and deletes the corresponding information in the application software registry.

The embodiment of the present invention also provides an off-card entity, including: an acquisition unit, a first sending unit, and a data channel establishing unit; wherein,

The obtaining unit is used to obtain the security authentication information of the application data channel from the smart card management platform;

the first sending unit, configured to send an authentication registration message carrying the security authentication information to the smart card device;

The data channel establishing unit is configured to establish a data channel with the smart card after the smart card device successfully verifies the security authentication information.

In the above solution, the obtaining unit further includes: a first sending module and a first receiving module; wherein,

The first sending module is configured to send a data channel registration application carrying relevant application-related information to the smart card management platform;

The first receiving module is configured to receive the security authentication information of the corresponding application sent by the smart card management platform; the security authentication information is stored by the smart card management platform using the key or certificate stored by itself, and Application related information is generated.

An embodiment of the present invention further provides a smart card management platform, including: a second receiving unit, an information generating unit, and a second sending unit; wherein,

The second receiving unit is used for the data channel registration application carrying the corresponding application-related information sent by the off-card entity;

The information generating unit is configured to generate the security authentication information of the corresponding application according to the application-related information by using the key or certificate stored by itself;

The second sending unit is configured to send the generated security authentication information to the off-card entity.

In the above solution, the information generating unit may further include: a storage module and a data channel security module; wherein,

the storage module for storing keys or certificates;

The data channel security module is configured to generate security authentication information of the corresponding application according to the key or certificate stored by the storage module and according to the application-related information.

An embodiment of the present invention further provides a smart card device, including: a third receiving unit and a data channel establishing unit; wherein,

The third receiving unit is configured to receive an authentication registration message carrying security authentication information sent by an off-card entity;

The data channel establishment unit is configured to establish a data channel with the off-card entity after successfully verifying the security authentication information.

In the above scheme, the data channel establishment unit further includes: an information generation module, a matching module and a data channel establishment module; wherein,

The information generation module is used to generate the security authentication information of the corresponding application according to the relevant information of the corresponding application by using the key or certificate stored by itself;

The matching module is configured to match the generated security authentication information of the corresponding application with the security authentication information carried in the authentication registration message, and trigger the data channel establishment module after matching;

The data channel establishment module is configured to establish a data channel with the off-card entity after receiving a trigger from the matching module.

In the above solution, the device further includes: an application software registry management unit, configured to add the information of the corresponding application in its own application software registry after the data channel is established.

In the above solution, the device may further include: an SE operation unit for establishing a data channel, and after receiving the APDU instruction of the off-card entity, when it is determined that the data channel corresponding to the APDU is valid, a corresponding transaction is performed operate.

In the above solution, the data channel establishment unit is further configured to close the data channel corresponding to the APDU after the transaction operation is completed;

Correspondingly, the application software registry management unit is further configured to delete the corresponding information in the application software registry.

An embodiment of the present invention further provides a system for establishing a data channel, including: a smart card management platform, an off-card entity, and a smart card device; wherein,

The off-card entity is used to obtain the security authentication information of the application data channel from the smart card management platform; and send an authentication registration message carrying the security authentication information to the smart card device;

The smart card device is configured to establish a data channel with the entity outside the card after verifying the security authentication information successfully.

In the above solution, the off-card entity is configured to send the data channel registration application carrying the corresponding application-related information to the smart card management platform; and receive the full authentication information sent by the smart card management platform;

The smart card management platform is used to generate the security authentication information of the corresponding application according to the application-related information by using the key or certificate stored by itself after receiving the data channel registration application; The authentication information is sent to the off-card entity.

In the above solution, the smart card device is also used to add the information of the corresponding application in its own application software registry after the data channel is established.

In the above solution, the smart card device is also used to perform a corresponding transaction operation when the data channel corresponding to the APDU is determined to be valid after the data channel is established and after receiving the APDU instruction from the off-card entity.

In the above solution, the smart card device is further configured to close the data channel corresponding to the APDU after the transaction operation is completed; and delete the corresponding information in the application software registry.

In the method, system and related equipment for establishing a data channel provided by the embodiments of the present invention, the off-card entity obtains the security authentication information for applying for the data channel from the smart card management platform; the off-card entity sends the authentication carrying the security authentication information to the smart card device Registration message; after the smart card device successfully verifies the security authentication information, it establishes a data channel with the entity outside the card, so that the smart card can be protected from attack and damage, thereby ensuring the security of the smart card device.

Description of drawings

In the drawings, which are not necessarily to scale, like reference numerals may describe like parts in the different views. Similar reference numbers with different letter suffixes may denote different instances of similar components. The accompanying drawings generally illustrate, by way of example and not limitation, the various embodiments discussed herein.

1 is a schematic diagram of a data channel of a related art smart card;

2 is a schematic flowchart of a method for establishing a data channel in Embodiment 1 of the present invention;

FIG. 3 is a schematic structural diagram of an off-card entity in Embodiment 2 of the present invention;

4 is a schematic structural diagram of a smart card management platform in Embodiment 2 of the present invention;

5 is a schematic structural diagram of a smart card device in Embodiment 2 of the present invention;

6 is a schematic structural diagram of a system for establishing a data channel in Embodiment 2 of the present invention;

FIG. 7 is a schematic diagram of a system architecture and interaction for establishing a data channel according to Embodiment 3 of the present invention.

Detailed ways

The present invention will be described in further detail below in conjunction with the accompanying drawings and embodiments.

In various embodiments of the present invention, the off-card entity obtains the security authentication information of the application data channel from the smart card management platform; the off-card entity sends an authentication registration message carrying the security authentication information to the smart card device; the smart card device After verifying the security authentication information successfully, establish a data channel with the off-card entity.

Example 1

This embodiment provides a method for establishing a data channel, which is applied to an off-card entity and includes the following steps:

Obtain the security authentication information of the application data channel from the smart card management platform;

sending an authentication registration message carrying the security authentication information to the smart card device;

And after the smart card device successfully verifies the security authentication information, it establishes a data channel with the smart card.

Wherein, the obtaining the security authentication information of the application data channel from the smart card management platform is specifically:

sending a data channel registration application carrying relevant application-related information to the smart card management platform;

The security authentication information of the corresponding application sent by the smart card management platform is received; the security authentication information is generated by the smart card management platform using the key or certificate stored by itself and according to the application-related information.

Here, the security authentication information may be a signature or a token (Token).

This embodiment also provides a method for establishing a data channel, which is applied to the smart card management platform and includes the following steps:

Receive the data channel registration application that carries the corresponding application-related information sent by the entity outside the card;

Using the key or certificate stored by itself, and according to the application-related information, generate the security authentication information of the corresponding application;

Send the generated security authentication information to the off-card entity.

Here, the security authentication information may be a signature or a token.

This embodiment also provides a method for establishing a data channel, which is applied to a smart card device and includes the following steps:

Receive an authentication registration message carrying security authentication information sent by an entity outside the card;

After verifying the security authentication information successfully, establish a data channel with the off-card entity.

Here, the verification of the security authentication information specifically includes:

Using the key or certificate stored by itself, and according to the relevant information of the corresponding application, generate the security authentication information of the corresponding application;

Match the generated security authentication information of the corresponding application with the security authentication information carried in the authentication registration message; if the two can match, it means that the smart card device has successfully verified the security authentication information. If they match, it means that the smart card device fails to verify the security authentication information. In this case, the smart card device will return an error message to the off-card entity.

The security authentication information may be a signature or a Token or the like.

After the data channel is established, the method may further include:

The smart card device adds the information of the corresponding application in its own application software registry. Here, the information of the corresponding application may include: the identity of the corresponding application, the status of the channel, and the assigned authority; wherein, the assigned authority may include: corresponding registration, logout, and security module (SE) operations, etc. .

After the data channel is established, the method may further include:

After the smart card device receives the APDU instruction from the off-card entity, and determines that the data channel corresponding to the APDU is valid, it performs a corresponding transaction operation.

The determining that the data channel corresponding to the APDU is valid is specifically:

According to the information of the data channel corresponding to the APDU in the application software registry, it is determined that the data channel corresponding to the APDU is valid.

Specifically, if in the information of the data channel corresponding to the APDU in the application software registry, the status of the data channel is valid, it means that the data channel corresponding to the APDU is valid; correspondingly, if the status of the data channel is invalid , the data channel corresponding to the APDU is invalid.

When it is determined that the data channel corresponding to the APDU is invalid, the smart card device refuses to perform the operation related to the APDU instruction.

The method may also include:

After the transaction operation is completed, the smart card closes the data channel corresponding to the APDU; and deletes the corresponding information in the application software registry.

The method for establishing a data channel provided by this embodiment, as shown in FIG. 2 , includes the following steps:

Step 201: the off-card entity obtains the security authentication information of the application data channel from the smart card management platform;

Specifically, the off-card entity sends a data channel registration application carrying the corresponding application-related information to the smart card management platform;

After receiving the data channel registration application, the smart card management platform generates the security authentication information of the corresponding application by using the key or certificate stored by itself and according to the application-related information;

The smart card management platform sends the generated security authentication information to the off-card entity.

Wherein, the physical form of the off-card entity may be various, for example, it may be a non-contact IC card, a contact IC card, a Bluetooth card, and the like.

The security authentication information may be a signature or a Token or the like.

Step 202: the off-card entity sends an authentication registration message carrying the security authentication information to the smart card device;

Step 203: After the smart card device successfully verifies the security authentication information, it establishes a data channel with the entity outside the card.

Here, the smart card device verifies the security authentication information, specifically including:

The smart card device generates the security authentication information of the corresponding application by using the key or certificate stored by itself and according to the relevant information of the corresponding application;

Match the generated security authentication information of the corresponding application with the security authentication information carried in the authentication registration message; if the two can match, it means that the smart card device has successfully verified the security authentication information. If they match, it means that the smart card device fails to verify the security authentication information. In this case, the smart card device will return an error message to the off-card entity.

After the data channel is established, the method may further include:

The smart card device adds the information of the corresponding application in its own application software registry. Here, the information of the corresponding application may include: the identifier of the corresponding application, the status of the channel, and the assigned authority; wherein, the assigned authority may include: corresponding registration, logout, and SE operation.

After the data channel is established, the method may further include:

After the smart card device receives the APDU instruction from the off-card entity, and determines that the data channel corresponding to the APDU is valid, it performs a corresponding transaction operation.

The determining that the data channel corresponding to the APDU is valid is specifically:

The smart card device determines that the data channel corresponding to the APDU is valid according to the information of the data channel corresponding to the APDU in the application software registry.

Specifically, if in the information of the data channel corresponding to the APDU in the application software registry, the status of the data channel is valid, it means that the data channel corresponding to the APDU is valid; correspondingly, if the status of the data channel is invalid , the data channel corresponding to the APDU is invalid.

When it is determined that the data channel corresponding to the APDU is invalid, the smart card device refuses to perform the operation related to the APDU instruction.

The method may also include:

After the transaction operation is completed, the smart card device closes the data channel corresponding to the APDU; and deletes the corresponding information in the application software registry.

In the method for establishing a data channel provided in this embodiment, an off-card entity acquires the security authentication information for applying for a data channel from a smart card management platform; the off-card entity sends an authentication registration message carrying the security authentication information to a smart card device; the smart card After the device successfully verifies the security authentication information, it establishes a data channel with the entity outside the card. In this way, the smart card can be protected from attack and damage, thereby ensuring the security of the smart card device.

In addition, after the smart card device receives the APDU instruction from the off-card entity, and determines that the data channel corresponding to the APDU is valid, the corresponding transaction operation is performed; in this way, the security of the smart card device is further ensured.

Embodiment 2

To implement the method of Embodiment 1, this embodiment provides an off-card entity. As shown in FIG. 3 , the off-card entity includes: an acquisition unit 31, a first sending unit 32, and a data channel establishing unit 33; wherein,

The obtaining unit 31 is configured to obtain the security authentication information of the application data channel from the smart card management platform;

The first sending unit 32 is configured to send an authentication registration message carrying the security authentication information to the smart card device;

The data channel establishing unit 33 is configured to establish a data channel with the smart card after the smart card device successfully verifies the security authentication information.

Wherein, the obtaining unit 31 may further include: a first sending module and a first receiving module; wherein,

The first sending module is configured to send a data channel registration application carrying relevant application-related information to the smart card management platform;

The first receiving module is configured to receive the security authentication information of the corresponding application sent by the smart card management platform; the security authentication information is stored by the smart card management platform using the key or certificate stored by itself, and Application related information is generated.

Here, the security authentication information may be a signature or a Token.

In practical application, the acquisition unit 31 may be a central processing unit (CPU, Central Processing Unit), a microprocessor (MCU, Micro Control Unit), a digital signal processor (DSP, Digital Signal Processor) or a programmable logic array (FPGA, Field -Programmable Gate Array) is realized in combination with transceivers; the first sending module of the first sending unit 32 can be realized by the transmitter in the off-card entity, and the data channel establishment unit 33 can be realized by the CPU, MCU, DSP or FPGA of the off-card entity Implemented in conjunction with a transceiver; the first receiving module can be implemented by a receiver in an off-card entity.

To implement the method of the first embodiment, this embodiment further provides a smart card management platform, as shown in FIG. 4 , including: a second receiving unit 41, an information generating unit 42 and a second sending unit 43; wherein,

The second receiving unit 41 is used for the data channel registration application carrying the corresponding application-related information sent by the off-card entity;

The information generation unit 42 is used to generate the security authentication information of the corresponding application according to the application-related information by using the key or certificate stored by itself;

The second sending unit 43 is configured to send the generated security authentication information to the off-card entity.

Here, the security authentication information may be a signature or a token.

The information generating unit 42 may further include: a storage module and a data channel security module; wherein,

the storage module for storing keys or certificates;

The data channel security module is configured to generate security authentication information of the corresponding application according to the key or certificate stored by the storage module and according to the application-related information.

In practical application, the second receiving unit 41 can be realized by the receiver in the smart card management platform; the information generating unit can be realized by the CPU, MCU, DSP or FPGA in the smart card management platform combined with the memory; the second sending unit 43 It can be realized by the transmitter in the smart card management platform; the storage module can be realized by the memory in the smart card management platform; the data channel security module can be realized by CPU, MCU, DSP or FPGA in the smart card management platform.

To implement the method of the first embodiment, this embodiment further provides a smart card device, as shown in FIG. 5 , including: a third receiving unit 51 and a data channel establishing unit 52; wherein,

The third receiving unit 51 is configured to receive an authentication registration message carrying security authentication information sent by an off-card entity;

The data channel establishing unit 52 is configured to establish a data channel with the off-card entity after successfully verifying the security authentication information.

Here, the data channel establishment unit 52 may further include: an information generation module, a matching module and a data channel establishment module; wherein,

The information generation module is used to generate the security authentication information of the corresponding application according to the relevant information of the corresponding application by using the key or certificate stored by itself;

The matching module is configured to match the generated security authentication information of the corresponding application with the security authentication information carried in the authentication registration message, and trigger the data channel establishment module after matching;

The data channel establishment module is configured to establish a data channel with the off-card entity after receiving a trigger from the matching module.

Wherein, when the matching module matches the generated security authentication information of the corresponding application with the security authentication information carried in the authentication registration message, if the two can match, it means that the verification of the security authentication information is successful. If the two cannot match, it means that the verification of the security authentication information fails. In this case, the matching module will return an error message to the off-card entity.

The security authentication information may be a signature or a Token or the like.

The smart card device may further include: an application software registry management unit, configured to add the information of the corresponding application in its own application software registry after the data channel is established. Here, the information of the corresponding application may include: the identifier of the corresponding application, the status of the channel, and the assigned authority; wherein, the assigned authority may include: corresponding registration, logout, and security operations.

The smart card device may further include: an SE operation unit for establishing a data channel, and after receiving the APDU instruction from the off-card entity, when it is determined that the data channel corresponding to the APDU is valid, a corresponding transaction operation is performed.

The determining that the data channel corresponding to the APDU is valid is specifically:

According to the information of the data channel corresponding to the APDU in the application software registry, it is determined that the data channel corresponding to the APDU is valid.

Specifically, if in the information of the data channel corresponding to the APDU in the application software registry, the status of the data channel is valid, it means that the data channel corresponding to the APDU is valid; correspondingly, if the status of the data channel is invalid , the data channel corresponding to the APDU is invalid.

When it is determined that the data channel corresponding to the APDU is invalid, the SE operating unit refuses to perform the operation related to the APDU instruction.

The data channel establishment unit 52 is further configured to close the data channel corresponding to the APDU after the transaction operation is completed;

Correspondingly, the application software registry management unit is further configured to delete the corresponding information in the application software registry.

In practical application, the third receiving unit 51 can be realized by the receiver in the smart card device; the data channel establishment unit 52 and the data channel establishment module can be realized by the CPU, MCU, DSP or FPGA in the smart card device in combination with the transceiver; The information generation module, matching module, application software registry management unit and SE operation unit can be realized by CPU, MCU, DSP or FPGA in the smart card device.

In order to implement the method of the first embodiment, this embodiment also provides a system for establishing a data channel. As shown in FIG. 6 , the system includes: a smart card management platform 61 , an off-card entity 62 and a smart card device 63 ; wherein,

The off-card entity 62 is used to obtain the security authentication information of the application data channel from the smart card management platform 61; and send an authentication registration message carrying the security authentication information to the smart card device 63;

The smart card device 63 is configured to establish a data channel with the off-card entity 62 after successfully verifying the security authentication information.

Wherein, the off-card entity 62 is used to send the data channel registration application carrying the corresponding application-related information to the smart card management platform 61; and receive the full authentication information sent by the smart card management platform 61;

The smart card management platform 61 is used to generate the security authentication information of the corresponding application according to the application-related information by using the key or certificate stored by itself after receiving the data channel registration application; The security authentication information is sent to the off-card entity 62 .

The physical form of the off-card entity 62 can be various, for example, it can be a non-contact IC card, a contact IC card, a Bluetooth card, and the like.

The security authentication information may be a signature or a Token or the like.

Here, the smart card device 63 verifies the security authentication information, which specifically includes:

The smart card device 63 generates the security authentication information of the corresponding application according to the key or certificate stored by itself and according to the relevant information of the corresponding application;

Match the generated security authentication information of the corresponding application with the security authentication information carried in the authentication registration message; if the two can match, it means that the smart card device 63 checks the security authentication information successfully, if both If they cannot match, it means that the smart card device 63 fails to verify the security authentication information. At this time, the smart card device 63 will return an error message to the off-card entity 62 .

The smart card device 63 is also used to add the information of the corresponding application in its own application software registry after the data channel is established. Here, the information of the corresponding application may include: the identifier of the corresponding application, the status of the channel, and the assigned authority; wherein, the assigned authority may include: corresponding registration, logout, and SE operation.

The smart card device 63 is further configured to perform a corresponding transaction operation when it is determined that the data channel corresponding to the APDU is valid after the data channel is established and after receiving the APDU instruction from the off-card entity.

The determining that the data channel corresponding to the APDU is valid is specifically:

The smart card device 63 determines that the data channel corresponding to the APDU is valid according to the information of the data channel corresponding to the APDU in the application software registry.

Specifically, if in the information of the data channel corresponding to the APDU in the application software registry, the status of the data channel is valid, it means that the data channel corresponding to the APDU is valid; correspondingly, if the status of the data channel is invalid , the data channel corresponding to the APDU is invalid.

When it is determined that the data channel corresponding to the APDU is invalid, the smart card device 63 refuses to execute the operation related to the APDU instruction.

The smart card device 63 is further configured to close the data channel corresponding to the APDU after the transaction operation is completed; and delete the corresponding information in the application software registry.

In the system for establishing a data channel provided in this embodiment, the off-card entity 62 obtains the security authentication information for applying for the data channel from the smart card management platform 61; the off-card entity 62 sends an authentication registration message carrying the security authentication information to the smart card device 63 After the smart card device 63 successfully checks the security authentication information, it establishes a data channel with the off-card entity 62, so that the smart card can be protected from attack and damage, thereby ensuring the security of the smart card device.

In addition, after receiving the APDU instruction from the off-card entity, the smart card device 63 determines that the data channel corresponding to the APDU is valid, and then performs the corresponding transaction operation; in this way, the security of the smart card device is further ensured.

Embodiment 3

The system for establishing a data channel in this embodiment, as shown in FIG. 7 , includes a smart card management platform 71, an off-card entity 72 and a smart card 73; wherein,

The smart card management platform 71 is mainly responsible for generating a signature or token (Token) of the application software according to the application software information, and may include a data channel key or certificate storage module 711 (the function of which is equivalent to the function of the storage module in the second embodiment) and a data channel. The security module 712 (its function is equivalent to the sum of the functions of the second receiving unit, the second transmitting unit and the data channel security module in the second embodiment). Here, the data channel key or certificate storage module 711 is used to store the key or certificate of the data channel; the data channel security module 712 is used to generate the signature or Token of the application software.

The off-card entity 72 includes smart card management software 721 (the function of which is equivalent to the sum of the functions of the first sending module, the first receiving module, the first sending unit and the data channel establishment unit in the second embodiment), application software 722 and the underlying chip 723, mainly responsible for authenticating and registering the application software of the off-card entity 72 on the smart card 73; specifically, sending the registration application of the application software to the smart card management platform 71; sending the signature or Token of the application software returned by the smart card management 71 platform to the The smart card 73 performs authentication and registration; and informs the application software of the authentication and registration result in the smart card 73 . In practical application, the physical form of the off-card entity 72 can be various, for example, it can be a non-contact IC card, a contact IC card, a Bluetooth card, and the like.

The smart card 73 is a smart card device that can safely manage a data channel. Compared with the existing smart card, the smart card of this embodiment is additionally provided with a data channel management unit 731, which specifically includes: a key or certificate storage module 7311, an entity outside the card The application software authentication module 7312 (its function is equivalent to the sum of the functions of the third receiving unit, the information generation module and the matching module in the second embodiment), the off-card entity application software registry management module 7313 (its function is equivalent to that in the second embodiment) The functions of the application software registry management unit), the data channel life cycle management module 7314 and the SE operation module 7315 (the functions of which are equivalent to the functions of the SE operation unit in the second embodiment).

Here, the key or certificate storage module 7311 stores a key or certificate for authenticating application software.

The off-card entity application software authentication module 7312 verifies whether the security authentication information (signature or Token) of the off-card entity 72 application software is valid.

The off-card entity application software registry management module 7313 stores the certified application software identifiers and assigns application software permissions; and deletes the application software identifiers from the off-card entity application software registry after the data channel is closed. The permissions of the application software include: software registration (the permission is only assigned to the smart card management software), software cancellation (the permission is only assigned to the smart card management software), SE operation (the permission can be assigned to the smart card management software and the application software).

The data channel life cycle management module 7314 is used to maintain the state of the life cycle of each data channel, including: the creation, closing and other states of the data channel; after the data channel is created, an identifier is assigned to each data channel.

The SE operation module 7315 transparently transmits the APDU instruction sent by the valid application software to the SE 732; and rejects the APDU instruction of the invalid application software.

In practical application, the security requirements of the system for establishing the data channel mainly include the following points:

(1) The data channel management unit 731 of the smart card 73 provides the authentication and registration capability for the application software, which can be authenticated by a signature method or a Token method.

(2) The software registration information in the off-card entity application software registry of the smart card 73 is only valid "temporarily", that is, it is valid within the valid life cycle of the data channel, and the application software is only valid within the valid life cycle of the data channel Access to the smart card 73 may be allowed.

(3) For the data channel key or certificate, the smart card 73 and the smart card management platform 71 store the key or certificate for establishing the data channel; specifically, the smart card management platform 71 stores the private key or the root key. The smart card 73 stores a public key or a sub-key distributed according to an integrated circuit card identification code (ICCID, Integrate Circuit Card Identity), thereby ensuring that the certificates or keys of each SE are different.

(4) Security between the smart card 73 and the smart card management platform 71; the instruction interaction between each smart card and the smart card management platform is protected by a key, the smart card management platform stores the private key or the root key, and the public key is stored in the smart card management platform. The key or the sub-key distributed according to the ICCID is written into the smart card, and the key of each smart card is guaranteed to be different.

The process of establishing a data channel in this embodiment, as shown in Figure 7, includes the following steps:

Step 701: Before establishing a data channel with the smart card, the application software 722 sends a data channel registration application to the smart card management software 721;

Step 702: After receiving the data channel registration application, the smart card management software 722 sends the data channel registration application sent by the application software 522 to the smart card management platform 51;

Step 703: After the smart card management platform 71 receives the data channel registration application, the data channel security module 712 reads the data channel key or certificate from the data channel key or certificate storage module 711;

Step 704: The data channel security module 712 uses the read key or certificate to calculate the signature or Token of the application software application for the data channel according to the information of the application software;

Step 705: The smart card management platform 71 sends the application software authentication and registration message to the smart card management software 722;

Here, the sent message carries the signature or Token of the application software to apply for the data channel.

Step 706: After receiving the message, the smart card management software 722 sends a message of application software authentication and registration to the smart card data channel management unit 731; after receiving the message, the smart card data channel management unit 731 performs data channel authentication and registration on the application software, and the authentication and registration are successful Then execute step 707;

Here, the sent message carries the signature or Token of the application software to apply for the data channel.

Specifically, the off-card entity application software authentication module 7312 reads the key or certificate stored in the key or certificate storage module 7311, calculates the signature or Token according to the information of the application software, and matches the signature or Token sent by the smart card management software 721. Carry out matching, and after matching, trigger the off-card entity application software registry management module 7313 to add application software information in the off-card entity application software registry, at this time, it means that the authentication and registration are successful, and continue the operation of step 707; If it matches, the smart card data channel management unit 731 returns an error message to the smart card management software 521, and the process ends.

Step 707: The smart card management software 721 returns the result of the successful data channel authentication and registration to the application software 722;

Step 708: After receiving the result, the application software 722 establishes a data channel with the data channel management unit 731 of the smart card 73, and the data channel life cycle management module 7314 maintains the data channel life cycle;

Here, the data channel life cycle management module 7314 dynamically determines whether the data channel is valid, and notifies the software registry management module 7313 of the status of the data channel, so that the software registry management module 7313 updates the relevant information of the corresponding data channel status.

Wherein, the data channel life cycle management module 7314 can dynamically determine whether the data channel is valid according to the duration of the establishment of the data channel, the type of the APDU command, and the like.

Step 709: After the data channel is established, the application software 722 can send the APDU instruction of the application processing logic to the smart card 73. After the smart card data channel management unit verifies that the status of the application software is valid, it forwards the APDU instruction sent by the application software 722 to the SE for processing. Apply transactions.

Here, after the transaction is completed, the data channel between the application software and the smart card is closed, and the off-card entity application software registry management module 7313 deletes the relevant information in the off-card entity application software registry.

It can be seen from the above description that the solution provided by this embodiment can ensure the security of the smart card being accessed by application software outside the card.

In addition, the security policies between the smart card management software 722 and the smart card management platform 51 and between the smart card management software 722 and the smart card data channel management unit 731 can be flexibly adjusted and upgraded.

As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the invention may take the form of a hardware embodiment, a software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media having computer-usable program code embodied therein, including but not limited to disk storage, optical storage, and the like.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block in the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to the processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing device to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing device produce Means for implementing the functions specified in a flow or flow of a flowchart and/or a block or blocks of a block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions The apparatus implements the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.

These computer program instructions can also be loaded on a computer or other programmable data processing device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process such that The instructions provide steps for implementing the functions specified in the flow or blocks of the flowcharts and/or the block or blocks of the block diagrams.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention.

Claims (21)

1. a method for establishing a data channel, characterized in that the method comprises: The application of the off-card entity obtains the security authentication information of the data channel corresponding to the application from the smart card management platform; the security authentication information is the key or certificate stored by the smart card management platform by itself, and the relevant information of the application. information generated; The off-card entity sends an authentication registration message carrying the security authentication information to the smart card device; After the smart card device successfully verifies the security authentication information, it establishes a data channel with the application of the off-card entity; The method also includes: The smart card device stores the authentication-passed application software identifier and assigns the application software authority. 2. The method according to claim 1, wherein the off-card entity obtains the security authentication information of the application data channel from the smart card management platform, comprising: The off-card entity sends a data channel registration application carrying the corresponding application-related information to the smart card management platform; After receiving the data channel registration application, the smart card management platform generates the security authentication information of the corresponding application by using the key or certificate stored by itself and according to the application-related information; The smart card management platform sends the generated security authentication information to the off-card entity. 3. The method according to claim 2, wherein the verification of the security authentication information by the smart card device comprises: The smart card device generates the security authentication information of the corresponding application by using the key or certificate stored by itself and according to the relevant information of the corresponding application; The generated security authentication information of the corresponding application is matched with the security authentication information carried in the authentication registration message. 4. The method according to claim 1, wherein after the data channel is established, the method further comprises: The smart card device adds the information of the corresponding application in its own application software registry. 5. The method according to claim 4, wherein after the data channel is established, the method further comprises: After the smart card device receives the application protocol data unit APDU instruction of the off-card entity, and determines that the data channel corresponding to the APDU is valid, it performs a corresponding transaction operation. 6. The method according to claim 5, wherein the determining that the data channel corresponding to the APDU is valid is: The smart card device determines that the data channel corresponding to the APDU is valid according to the information of the data channel corresponding to the APDU in the application software registry. 7. The method according to claim 5, wherein the method further comprises: After the transaction operation is completed, the smart card device closes the data channel corresponding to the APDU; and deletes the corresponding information in the application software registry. 8. An off-card entity, characterized in that the off-card entity comprises: an acquisition unit, a first sending unit and a data channel establishment unit; wherein, The obtaining unit is used to obtain, from the smart card management platform, the security authentication information for applying for the data channel corresponding to the application; the security authentication information is the key or certificate stored by the smart card management platform by itself, and the relevant information of the application. information generated; the first sending unit, configured to send an authentication registration message carrying the security authentication information to the smart card device; the data channel establishment unit, configured to establish a data channel with the smart card after the smart card device successfully verifies the security authentication information; Wherein, after the smart card device successfully verifies the security authentication information, the smart card device stores the application software identifier that has passed the authentication and assigns application software permissions. 9. The off-card entity according to claim 8, wherein the obtaining unit further comprises: a first sending module and a first receiving module; wherein, The first sending module is configured to send a data channel registration application carrying relevant application-related information to the smart card management platform; The first receiving module is configured to receive the security authentication information of the corresponding application sent by the smart card management platform; the security authentication information is stored by the smart card management platform using the key or certificate stored by itself, and Application related information is generated. 10. A smart card management platform, wherein the platform comprises: a second receiving unit, an information generating unit and a second sending unit; wherein, The second receiving unit is used for the data channel registration application carrying the corresponding application-related information sent by the off-card entity; The information generating unit is configured to generate the security authentication information of the corresponding application according to the application-related information by using the key or certificate stored by itself; The second sending unit is configured to send the generated security authentication information to the off-card entity; the security authentication information is used for the off-card entity to send to the smart card device, so that the smart card device can verify the information. After the security authentication information is successful, a data channel is established with the application of the off-card entity, and the application software identifier that has passed the authentication is stored and the application software authority is allocated. 11. The platform according to claim 10, wherein the information generating unit can further comprise: a storage module and a data channel security module; wherein, the storage module for storing keys or certificates; The data channel security module is configured to generate security authentication information of the corresponding application according to the key or certificate stored by the storage module and according to the application-related information. 12. A smart card device, characterized in that the device comprises: a third receiving unit and a data channel establishing unit; wherein, The third receiving unit is used to receive an authentication registration message carrying security authentication information sent by an entity outside the card; the security authentication information is the key or certificate stored by the smart card management platform by itself, and the application of the entity outside the card. generated from the relevant information; The data channel establishment unit is used for establishing a data channel with the entity outside the card after the security authentication information is successfully verified; and is also used for storing the application software identifier that has passed the authentication and assigning the application software authority. 13. The device according to claim 12, wherein the data channel establishment unit further comprises: an information generation module, a matching module and a data channel establishment module; wherein, The information generation module is used to generate the security authentication information of the corresponding application according to the relevant information of the corresponding application by using the key or certificate stored by itself; The matching module is configured to match the generated security authentication information of the corresponding application with the security authentication information carried in the authentication registration message, and trigger the data channel establishment module after matching; The data channel establishment module is configured to establish a data channel with the off-card entity after receiving a trigger from the matching module. 14 . The device according to claim 12 , wherein the device further comprises: an application software registry management unit, which is used for adding the information of the corresponding application in its own application software registry after the data channel is established. 15 . 15 . The device according to claim 14 , wherein the device further comprises: an SE operation unit, used for establishing a data channel, and after receiving an APDU instruction from the off-card entity, determining whether to communicate with the APDU. 16 . When the corresponding data channel is valid, the corresponding transaction operation is performed. 16. The device according to claim 15, wherein the data channel establishment unit is further configured to close the data channel corresponding to the APDU after the transaction operation is completed; Correspondingly, the application software registry management unit is further configured to delete the corresponding information in the application software registry. 17. A system for establishing a data channel, wherein the system comprises: a smart card management platform, an off-card entity and a smart card device; wherein, The off-card entity is used to obtain, from the smart card management platform, the security authentication information for applying for a data channel corresponding to the application; and to send an authentication registration message carrying the security authentication information to the smart card device; the security authentication information is generated by the smart card management platform using the key or certificate stored by itself and the relevant information of the application; The smart card device is used to establish a data channel with the application of the entity outside the card after successfully verifying the security authentication information; it is also used to store the identification of the application software that has passed the authentication and assign the application software authority. 18. The system according to claim 17, wherein the off-card entity is used to send a data channel registration application carrying the corresponding application-related information to the smart card management platform; and receive the data sent by the smart card management platform. full authentication information; The smart card management platform is used to generate the security authentication information of the corresponding application according to the application-related information by using the key or certificate stored by itself after receiving the data channel registration application; The authentication information is sent to the off-card entity. 19 . The system according to claim 17 , wherein the smart card device is further configured to add the information of the corresponding application in its own application software registry after the data channel is established. 20 . 20. The system according to claim 19, wherein the smart card device is further configured to determine the data channel corresponding to the APDU after the data channel is established and after receiving the APDU instruction of the off-card entity When valid, carry out the corresponding transaction operation. 21. The system according to claim 20, wherein the smart card device is further configured to close the data channel corresponding to the APDU after the transaction operation is completed; and delete the corresponding information in the application software registry.

Images