CN107240157B - Near field communication security control method, mobile terminal and computer readable storage medium - Google Patents

Near field communication security control method, mobile terminal and computer readable storage medium Download PDF

Info

Publication number
CN107240157B
CN107240157B CN201710340693.2A CN201710340693A CN107240157B CN 107240157 B CN107240157 B CN 107240157B CN 201710340693 A CN201710340693 A CN 201710340693A CN 107240157 B CN107240157 B CN 107240157B
Authority
CN
China
Prior art keywords
near field
field communication
application
preset
nfc
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201710340693.2A
Other languages
Chinese (zh)
Other versions
CN107240157A (en
Inventor
吕森
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Nanjing xinwindows Information Technology Co., Ltd
Original Assignee
Nanjing Xinwindows Information Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Nanjing Xinwindows Information Technology Co Ltd filed Critical Nanjing Xinwindows Information Technology Co Ltd
Priority to CN201710340693.2A priority Critical patent/CN107240157B/en
Publication of CN107240157A publication Critical patent/CN107240157A/en
Application granted granted Critical
Publication of CN107240157B publication Critical patent/CN107240157B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06K—GRAPHICAL DATA READING; PRESENTATION OF DATA; RECORD CARRIERS; HANDLING RECORD CARRIERS
    • G06K7/00—Methods or arrangements for sensing record carriers, e.g. for reading patterns
    • G06K7/10—Methods or arrangements for sensing record carriers, e.g. for reading patterns by electromagnetic radiation, e.g. optical sensing; by corpuscular radiation
    • G06K7/10009—Methods or arrangements for sensing record carriers, e.g. for reading patterns by electromagnetic radiation, e.g. optical sensing; by corpuscular radiation sensing by radiation using wavelengths larger than 0.1 mm, e.g. radio-waves or microwaves
    • G06K7/10297—Methods or arrangements for sensing record carriers, e.g. for reading patterns by electromagnetic radiation, e.g. optical sensing; by corpuscular radiation sensing by radiation using wavelengths larger than 0.1 mm, e.g. radio-waves or microwaves arrangements for handling protocols designed for non-contact record carriers such as RFIDs NFCs, e.g. ISO/IEC 14443 and 18092
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
    • G07B1/00—Machines for printing and issuing tickets
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04B—TRANSMISSION
    • H04B5/00—Near-field transmission systems, e.g. inductive or capacitive transmission systems
    • H04B5/70—Near-field transmission systems, e.g. inductive or capacitive transmission systems specially adapted for specific purposes
    • H04B5/77—Near-field transmission systems, e.g. inductive or capacitive transmission systems specially adapted for specific purposes for interrogation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Physics & Mathematics (AREA)
  • Signal Processing (AREA)
  • Health & Medical Sciences (AREA)
  • General Physics & Mathematics (AREA)
  • Toxicology (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Electromagnetism (AREA)
  • General Health & Medical Sciences (AREA)
  • Artificial Intelligence (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Power Engineering (AREA)
  • Theoretical Computer Science (AREA)
  • Telephone Function (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

The invention discloses a near field communication safety control method, which comprises the following steps: when a safe reading mode is started, redirecting a transmission path of data read by a near field communication controller to a preset cache region in a trusted execution environment; reading a first identity identifier of a near field communication card into the preset cache region based on the near field communication controller through a preset trusted application of the trusted execution environment, and performing security check on the near field communication card based on the first identity identifier; when the near field communication card passes the security verification, setting that the near field communication application corresponding to the near field communication card in a common execution environment can access the preset trusted application, so that the near field communication application can access the near field communication card through the preset trusted application. The invention also discloses a mobile terminal and a computer readable storage medium. The invention can improve the safety of the mobile terminal in near field communication interaction.

Description

Near field communication security control method, mobile terminal and computer readable storage medium
Technical Field
The invention relates to the technical field of mobile terminals, in particular to a near field communication security control method, a mobile terminal and a computer readable storage medium.
Background
NFC (near field communication) is a short-range high-frequency Radio technology, which allows contactless point-to-point data transmission and exchange of data between electronic devices, and is evolved from RFID (Radio frequency identification). The NFC has the working frequency of 13.56Hz, the effective range of 20cm and the transmission speed of 106 Kbit/s, 212 Kbit/s or 424 Kbit/s. NFC has 3 modes of operation: card reader mode, point-to-point mode, card emulation mode.
When the mobile terminal is configured with the NFC controller and the NFC controller works in a card reader mode, the mobile terminal can generate a radio frequency field through the NFC controller, and read and write data from an NFC card with the same standard from the outside, for example, a user can read information of a 'Shenzhen Tong' card through a mobile phone and perform operations such as recharging. However, due to the low threshold of NFC, lawless persons can manufacture an NFC card by themselves and write a trojan program or other danger code into the NFC card, and if the NFC card is read by a user operating a mobile terminal, the trojan program or danger code written by the NFC card will be implanted into the mobile terminal of the user, resulting in the user data being stolen or damaged.
Disclosure of Invention
The invention provides a near field communication safety control method, a mobile terminal and a computer readable storage medium, aiming at improving the safety of the mobile terminal during near field communication interaction.
In order to achieve the above object, the present invention provides a near field communication security control method, including:
when a safe reading mode is started, redirecting a transmission path of data read by a near field communication controller to a preset cache region in a trusted execution environment;
reading a first identity identifier of a near field communication card into the preset cache region based on the near field communication controller through a preset trusted application of the trusted execution environment, and performing security check on the near field communication card based on the first identity identifier;
when the near field communication card passes the security verification, setting that the near field communication application corresponding to the near field communication card in a common execution environment can access the preset trusted application, so that the near field communication application can access the near field communication card through the preset trusted application.
Optionally, the near field communication application is a ticketing application, and after the step of setting that the near field communication application can access the preset trusted application, the method further includes:
reading user real-name information carried by the near field communication card into a preset cache region through a preset trusted application, and generating temporary application information based on the user real-name information and preset ticketing information of the ticketing application;
and transmitting the temporary application information to the ticketing application through an access channel between the preset trusted application and the ticketing application so that the ticketing application can complete real-name ticketing.
Optionally, the step of reading the first identity identifier through a preset trusted application includes:
and calling the preset trusted application for a preset number of times according to a preset frequency so as to indicate the preset trusted application to read the first identity of the near field communication card.
Optionally, after the step of performing security verification on the near field communication card through the preset trusted application based on the first identity identifier, the method further includes:
and when the near field communication card does not pass the safety verification, outputting first prompt information that the near field communication card is unsafe.
Optionally, before the step of redirecting the transmission path of the data read by the near field communication controller to a preset cache area in the trusted execution environment when the secure read mode is started, the method further includes:
and starting the safe reading mode when receiving the safe reading mode starting operation of the user.
Optionally, before the starting the secure read mode, the method further includes:
when receiving a safe reading mode starting operation of a user, displaying a preset authentication interface for the user to input authentication data;
receiving authentication data input by a user based on the displayed preset authentication interface, and performing user identity authentication based on the authentication data;
after the user identity authentication is passed, a secure reading mode is started.
Optionally, before the step of setting that the near field communication application can access the preset trusted application, the method further includes:
when the near field communication card passes the security verification, reading a second identity identifier of the near field communication application to the preset cache region through the preset trusted application;
based on the second identity, performing security verification on the near field communication application through the preset trusted application;
and when the near field communication application passes the security verification, setting the near field communication application to be accessible to the preset trusted application.
Optionally, after the step of performing security verification on the near field communication application by using the preset trusted application based on the second identity, the method further includes:
and when the near field communication application does not pass the safety verification, outputting second prompt information which is unsafe for the near field communication application.
Further, the present invention also provides a mobile terminal, comprising:
a memory storing a near field communication security control program;
a processor configured to execute the near field communication security control program to implement the steps of:
when a safe reading mode is started, redirecting a transmission path of data read by a near field communication controller to a preset cache region in a trusted execution environment;
reading a first identity identifier of a near field communication card into the preset cache region based on the near field communication controller through a preset trusted application of the trusted execution environment, and performing security check on the near field communication card based on the first identity identifier;
when the near field communication card passes the security verification, setting that the near field communication application corresponding to the near field communication card in a common execution environment can access the preset trusted application, so that the near field communication application can access the near field communication card through the preset trusted application.
Further, the present invention also provides a computer-readable storage medium having a near field communication security control program stored thereon, the near field communication security control program implementing the following steps when executed by a processor:
when a safe reading mode is started, redirecting a transmission path of data read by a near field communication controller to a preset cache region in a trusted execution environment;
reading a first identity identifier of a near field communication card into the preset cache region based on the near field communication controller through a preset trusted application of the trusted execution environment, and performing security check on the near field communication card based on the first identity identifier;
when the near field communication card passes the security verification, setting that the near field communication application corresponding to the near field communication card in a common execution environment can access the preset trusted application, so that the near field communication application can access the near field communication card through the preset trusted application.
The near field communication safety control method provided by the invention is combined with a reading function of near field communication and a trusted execution environment isolated from a common execution environment, a transmission path of data read by a near field communication controller is redirected to a preset cache region in the trusted execution environment, the near field communication card is subjected to safety inspection through a preset trusted application in the trusted execution environment, and when the near field communication card passes the safety inspection, the near field communication application corresponding to the near field communication card in the common execution environment is set to be accessible to the preset trusted application so that the near field communication application can access the near field communication card through the preset trusted application, thereby achieving the purpose of improving the safety of the mobile terminal in near field communication interaction.
Drawings
Fig. 1 is a schematic diagram of a hardware structure of an optional mobile terminal for implementing various embodiments of the present invention;
FIG. 2 is a communication network system architecture diagram of the mobile terminal shown in FIG. 1;
fig. 3 is a flowchart illustrating a first embodiment of a nfc security control method according to the present invention;
fig. 4 is a diagram illustrating an exemplary operation of reading a nfc card according to a first embodiment of the nfc security control method of the present invention;
fig. 5 is an exemplary diagram of a control triggering a secure read mode start operation in a third embodiment of the nfc security control method according to the present invention;
fig. 6 is an exemplary diagram of an authentication interface in a third embodiment of the nfc security control method according to the present invention;
fig. 7 is a diagram illustrating authentication data input by a user in a third embodiment of a nfc security control method according to the present invention.
Detailed Description
It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.
In the following description, suffixes such as "module", "component", or "unit" used to denote elements are used only for facilitating the explanation of the present invention, and have no specific meaning in itself. Thus, "module", "component" or "unit" may be used mixedly.
The terminal may be implemented in various forms. For example, the terminal described in the present invention may include a mobile terminal such as a mobile phone, a tablet computer, a notebook computer, a palmtop computer, a Personal Digital Assistant (PDA), a Portable Media Player (PMP), a navigation device, a wearable device, a smart band, a pedometer, and the like, and a fixed terminal such as a Digital TV, a desktop computer, and the like.
The following description will be given by way of example of a mobile terminal, and it will be understood by those skilled in the art that the construction according to the embodiment of the present invention can be applied to a fixed type terminal, in addition to elements particularly used for mobile purposes.
Referring to fig. 1, which is a schematic diagram of a hardware structure of a mobile terminal for implementing various embodiments of the present invention, the mobile terminal 100 may include: RF (Radio Frequency) unit 101, WiFi module 102, audio output unit 103, a/V (audio/video) input unit 104, sensor 105, display unit 106, user input unit 107, interface unit 108, memory 109, processor 110, and power supply 111. Those skilled in the art will appreciate that the mobile terminal architecture shown in fig. 1 is not intended to be limiting of mobile terminals, which may include more or fewer components than those shown, or some components may be combined, or a different arrangement of components.
The following describes each component of the mobile terminal in detail with reference to fig. 1:
the radio frequency unit 101 may be configured to receive and transmit signals during information transmission and reception or during a call, and specifically, receive downlink information of a base station and then process the downlink information to the processor 110; in addition, the uplink data is transmitted to the base station. Typically, radio frequency unit 101 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier, a duplexer, and the like. In addition, the radio frequency unit 101 can also communicate with a network and other devices through wireless communication. The wireless communication may use any communication standard or protocol, including but not limited to GSM (Global System for Mobile communications), GPRS (General Packet Radio Service), CDMA2000(Code Division Multiple Access 2000), WCDMA (Wideband Code Division Multiple Access), TD-SCDMA (Time Division-Synchronous Code Division Multiple Access), FDD-LTE (Frequency Division duplex-Long Term Evolution), and TDD-LTE (Time Division duplex-Long Term Evolution).
WiFi belongs to short-distance wireless transmission technology, and the mobile terminal can help a user to receive and send e-mails, browse webpages, access streaming media and the like through the WiFi module 102, and provides wireless broadband internet access for the user. Although fig. 1 shows the WiFi module 102, it is understood that it does not belong to the essential constitution of the mobile terminal, and may be omitted entirely as needed within the scope not changing the essence of the invention.
The audio output unit 103 may convert audio data received by the radio frequency unit 101 or the WiFi module 102 or stored in the memory 109 into an audio signal and output as sound when the mobile terminal 100 is in a call signal reception mode, a call mode, a recording mode, a voice recognition mode, a broadcast reception mode, or the like. Also, the audio output unit 103 may also provide audio output related to a specific function performed by the mobile terminal 100 (e.g., a call signal reception sound, a message reception sound, etc.). The audio output unit 103 may include a speaker, a buzzer, and the like.
The a/V input unit 104 is used to receive audio or video signals. The a/V input Unit 104 may include a Graphics Processing Unit (GPU) 1041 and a microphone 1042, the Graphics processor 1041 Processing image data of still pictures or video obtained by an image capturing device (e.g., a camera) in a video capturing mode or an image capturing mode. The processed image frames may be displayed on the display unit 106. The image frames processed by the graphic processor 1041 may be stored in the memory 109 (or other storage medium) or transmitted via the radio frequency unit 101 or the WiFi module 102. The microphone 1042 may receive sounds (audio data) via the microphone 1042 in a phone call mode, a recording mode, a voice recognition mode, or the like, and may be capable of processing such sounds into audio data. The processed audio (voice) data may be converted into a format output transmittable to a mobile communication base station via the radio frequency unit 101 in case of a phone call mode. The microphone 1042 may implement various types of noise cancellation (or suppression) algorithms to cancel (or suppress) noise or interference generated in the course of receiving and transmitting audio signals.
The mobile terminal 100 also includes at least one sensor 105, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor includes an ambient light sensor that can adjust the brightness of the display panel 1061 according to the brightness of ambient light, and a proximity sensor that can turn off the display panel 1061 and/or a backlight when the mobile terminal 100 is moved to the ear. As one of the motion sensors, the accelerometer sensor can detect the magnitude of acceleration in each direction (generally, three axes), can detect the magnitude and direction of gravity when stationary, and can be used for applications of recognizing the posture of a mobile phone (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer and tapping), and the like; as for other sensors such as a fingerprint sensor, a pressure sensor, an iris sensor, a molecular sensor, a gyroscope, a barometer, a hygrometer, a thermometer, and an infrared sensor, which can be configured on the mobile phone, further description is omitted here.
The display unit 106 is used to display information input by a user or information provided to the user. The Display unit 106 may include a Display panel 1061, and the Display panel 1061 may be configured in the form of a Liquid Crystal Display (LCD), an Organic Light-Emitting Diode (OLED), or the like.
The user input unit 107 may be used to receive input numeric or character information and generate key signal inputs related to user settings and function control of the mobile terminal. Specifically, the user input unit 107 may include a touch panel 1071 and other input devices 1072. The touch panel 1071, also referred to as a touch screen, may collect a touch operation performed by a user on or near the touch panel 1071 (e.g., an operation performed by the user on or near the touch panel 1071 using a finger, a stylus, or any other suitable object or accessory), and drive a corresponding connection device according to a predetermined program. The touch panel 1071 may include two parts of a touch detection device and a touch controller. The touch detection device detects the touch direction of a user, detects a signal brought by touch operation and transmits the signal to the touch controller; the touch controller receives touch information from the touch sensing device, converts the touch information into touch point coordinates, sends the touch point coordinates to the processor 110, and can receive and execute commands sent by the processor 110. In addition, the touch panel 1071 may be implemented in various types, such as a resistive type, a capacitive type, an infrared ray, and a surface acoustic wave. In addition to the touch panel 1071, the user input unit 107 may include other input devices 1072. In particular, other input devices 1072 may include, but are not limited to, one or more of a physical keyboard, function keys (e.g., volume control keys, switch keys, etc.), a trackball, a mouse, a joystick, and the like, and are not limited to these specific examples.
Further, the touch panel 1071 may cover the display panel 1061, and when the touch panel 1071 detects a touch operation thereon or nearby, the touch panel 1071 transmits the touch operation to the processor 110 to determine the type of the touch event, and then the processor 110 provides a corresponding visual output on the display panel 1061 according to the type of the touch event. Although the touch panel 1071 and the display panel 1061 are shown in fig. 1 as two separate components to implement the input and output functions of the mobile terminal, in some embodiments, the touch panel 1071 and the display panel 1061 may be integrated to implement the input and output functions of the mobile terminal, and is not limited herein.
The interface unit 108 serves as an interface through which at least one external device is connected to the mobile terminal 100. For example, the external device may include a wired or wireless headset port, an external power supply (or battery charger) port, a wired or wireless data port, a memory card port, a port for connecting a device having an identification module, an audio input/output (I/O) port, a video I/O port, an earphone port, and the like. The interface unit 108 may be used to receive input (e.g., data information, power, etc.) from external devices and transmit the received input to one or more elements within the mobile terminal 100 or may be used to transmit data between the mobile terminal 100 and external devices.
The memory 109 may be used to store software programs as well as various data. The memory 109 may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application program required by at least one function (such as a sound playing function, an image playing function, etc.), and the like; the storage data area may store data (such as audio data, a phonebook, etc.) created according to the use of the cellular phone, and the like. Further, the memory 109 may include high speed random access memory, and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid state storage device.
The processor 110 is a control center of the mobile terminal, connects various parts of the entire mobile terminal using various interfaces and lines, and performs various functions of the mobile terminal and processes data by operating or executing software programs and/or modules stored in the memory 109 and calling data stored in the memory 109, thereby performing overall monitoring of the mobile terminal. Processor 110 may include one or more processing units; preferably, the processor 110 may integrate an application processor, which mainly handles operating systems, user interfaces, application programs, etc., and a modem processor, which mainly handles wireless communications. It will be appreciated that the modem processor described above may not be integrated into the processor 110.
Near Field Communication (NFC) is a short-range, high-frequency radio technology that allows contactless point-to-point data transmission and exchange of data between electronic devices, which evolved from contactless Radio Frequency Identification (RFID). The NFC has the working frequency of 13.56Hz, the effective range of 20cm and the transmission speed of 106 Kbit/s, 212 Kbit/s or 424 Kbit/s. NFC has 3 modes of operation: card reader mode, point-to-point mode, card emulation mode. And when the NFC equipment is in a card reader mode, the NFC equipment generates a radio frequency field to read and write data from an external NFC label with the same standard. In the peer-to-peer mode, the NFC may communicate with other NFC devices for peer-to-peer data transmission. In the card simulation mode, the card reader is an active device and generates a radio frequency field; the NFC equipment is passive equipment, and a non-contact card meeting the NFC standard is simulated to interact with the card reader. The mobile terminal 100 implements an NFC function, such as implementing NFC payment, etc., through the NFC controller 111.
The mobile terminal 100 may further include a power supply 112 (e.g., a battery) for supplying power to the various components, and preferably, the power supply 112 may be logically connected to the processor 110 via a power management system, so that functions of managing charging, discharging, and power consumption are performed via the power management system.
Although not shown in fig. 1, the mobile terminal 100 may further include a bluetooth module or the like, which is not described in detail herein.
In order to facilitate understanding of the embodiments of the present invention, a communication network system on which the mobile terminal of the present invention is based is described below.
Referring to fig. 2, fig. 2 is an architecture diagram of a communication Network system according to an embodiment of the present invention, where the communication Network system is an LTE system of a universal mobile telecommunications technology, and the LTE system includes a UE (User Equipment) 201, an E-UTRAN (Evolved UMTS Terrestrial Radio Access Network) 202, an EPC (Evolved Packet Core) 203, and an IP service 204 of an operator, which are in communication connection in sequence.
Specifically, the UE201 may be the mobile terminal 100 described above, and is not described herein again.
The E-UTRAN202 includes eNodeB2021 and other eNodeBs 2022, among others. Among them, the eNodeB2021 may be connected with other eNodeB2022 through backhaul (e.g., X2 interface), the eNodeB2021 is connected to the EPC203, and the eNodeB2021 may provide the UE201 access to the EPC 203.
The EPC203 may include an MME (Mobility Management Entity) 2031, an HSS (Home Subscriber Server) 2032, other MMEs 2033, an SGW (Serving gateway) 2034, a PGW (PDN gateway) 2035, and a PCRF (Policy and charging functions Entity) 2036, and the like. The MME2031 is a control node that handles signaling between the UE201 and the EPC203, and provides bearer and connection management. HSS2032 is used to provide registers to manage functions such as home location register (not shown) and holds subscriber specific information about service characteristics, data rates, etc. All user data may be sent through SGW2034, PGW2035 may provide IP address assignment for UE201 and other functions, and PCRF2036 is a policy and charging control policy decision point for traffic data flow and IP bearer resources, which selects and provides available policy and charging control decisions for a policy and charging enforcement function (not shown).
The IP services 204 may include the internet, intranets, IMS (IP Multimedia Subsystem), or other IP services, among others.
Although the LTE system is described as an example, it should be understood by those skilled in the art that the present invention is not limited to the LTE system, but may also be applied to other wireless communication systems, such as GSM, CDMA2000, WCDMA, TD-SCDMA, and future new network systems.
Based on the above mobile terminal hardware structure and communication network system, various embodiments of the mobile terminal of the present invention are provided.
Referring to fig. 1, in a first embodiment of the mobile terminal of the present invention, the mobile terminal includes:
a memory 109 in which an NFC security control program is stored;
a processor 110 configured to execute the NFC security control program stored in the memory 109 to implement the following operations:
when the secure read mode is started, redirecting a transmission path of data read by the NFC controller 111 to a preset cache area in a trusted execution environment;
reading a first identity of the NFC card into a preset cache region based on the NFC controller 111 through a preset trusted application of a trusted execution environment, and performing security check on the NFC card based on the first identity;
when the NFC card passes through the safety verification, the NFC application corresponding to the NFC card in the common execution environment can be accessed to the preset trusted application, so that the NFC application can access the NFC card through the preset trusted application.
Further, the NFC application is a ticketing application, and when the processor 110 executes the NFC security control program stored in the memory 109, the following operations are also performed:
reading user real-name information carried by the NFC card into a preset cache region through a preset trusted application, and generating temporary application information based on the user real-name information and preset ticket business information of a ticket business application;
and transmitting the temporary application information to the ticketing application through an access channel between the preset trusted application and the ticketing application so that the ticketing application can finish real-name ticket purchasing.
Further, when the processor 110 executes the NFC security control program stored in the memory 109, the following operations are also performed:
and calling the preset trusted application for a preset number of times according to a preset frequency so as to indicate the preset trusted application to read the first identity of the NFC card.
Further, when the processor 110 executes the NFC security control program stored in the memory 109, the following operations are also performed:
and when the NFC card does not pass the safety verification, outputting first prompt information that the NFC card is unsafe.
Further, when the processor 110 executes the NFC security control program stored in the memory 109, the following operations are also performed:
and starting the safe reading mode when receiving the safe reading mode starting operation of the user.
Further, when the processor 110 executes the NFC security control program stored in the memory 109, the following operations are also performed:
when receiving a safe reading mode starting operation of a user, displaying a preset authentication interface for the user to input authentication data;
receiving authentication data input by a user based on a displayed preset authentication interface, and performing user identity authentication based on the authentication data;
after the user identity authentication is passed, a secure reading mode is started.
Further, when the processor 110 executes the NFC security control program stored in the memory 109, the following operations are also performed:
reading a second identity of the NFC application into a preset cache region through a preset trusted application;
based on the second identity, performing security verification on the NFC application through a preset trusted application;
and when the NFC application passes the security verification, setting the NFC application to be accessible to the preset trusted application.
Further, when the processor 110 executes the NFC security control program stored in the memory 109, the following operations are also performed:
and when the NFC application does not pass the safety verification, outputting second prompt information which is unsafe for the NFC application.
Further, the present invention also provides an NFC security control method applied to a mobile terminal, and referring to fig. 3, in a first embodiment of the near field communication security control method of the present invention, the near field communication security control method includes:
step S10, when the secure read mode is started, redirecting the transmission path of the data read by the NFC controller 111 to a preset cache area in the trusted execution environment;
step S20, reading, by a preset trusted application of the trusted execution environment, the first identity identifier of the NFC card into a preset cache area based on the NFC controller 111, and performing security check on the NFC card based on the first identity identifier;
step S30, when the NFC card passes the security verification, setting that the NFC application corresponding to the NFC card in the common execution environment can access the preset trusted application, so that the NFC application can access the NFC card through the preset trusted application.
To facilitate understanding of the present invention, the following description will first describe a trusted execution environment to which the present invention relates.
Trusted Execution Environment (TEE) is a concept proposed by globalplatform (gp).
Security issues are also of increasing concern for the open environment of mobile devices, not just end users, but also service providers, mobile operators, and chip vendors. The TEE is an operating Environment coexisting with a normal execution Environment (Rich system execution Environment, generally Android, etc., hereinafter, referred to as REE) on the device, and provides a security service to the REE. It has its own execution space, higher than the security level of REE, but less than the security of the security element (SE, usually a smart card). The TEE can meet the security requirements of most applications. From a cost perspective, TEE provides a balance of safety and cost.
Wherein the software and hardware resources accessible by the TEE are separate from the REE. The TEE provides a secure execution environment for authorized security software (or trusted application, hereinafter referred to as TA) while also protecting the confidentiality, integrity and access rights of the TA's resources and data. To guarantee the trusted root of the TEE itself, the TEE is authenticated and isolated from the REE during secure boot. In TEE, each TA is independent of each other and cannot access each other without authorization.
GP is a measure for standardization of TEE, and the basic specifications include an Application Programming Interface (API) inside TEE, an API of TEE client, and a series of supplementary functional API specifications, as well as specifications of Application management, debugging function, security protection profile, and the like. The internal API of the TEE mainly comprises the APIs such as key management, cryptographic algorithm, safe storage, safe clock resource and service, and expanded trusted UI. Trusted UI means that when key information is displayed and user key data (e.g. password) is entered, hardware resources such as screen display and keyboard are completely controlled and accessed by TEE, but not by software applications in REE. The internal API is the programming interface provided by the TEE to the TA; the TEE client API is the underlying communication interface for Client Applications (CAs) running in the REE to access TA services and data.
The following description of the inventive solution starts on the basis of the following brief description of the TEE.
In the embodiment of the invention, a safe reading mode is provided, and a preset cache region is arranged in the TEE. Wherein any application on the REE side will not be able to directly access the pre-defined cache region due to the soft and hard isolation of the TEE and REE. In addition, the physical location and size of the preset buffer are not specifically limited, and may be set by those skilled in the art according to actual needs, for example, a storage area with a size of 1Mb may be divided into storage areas belonging to the TEE in the memory 109 as the preset buffer.
When the secure read mode is started, the processor 110 implements a function based on the near field communication secure control program provided by the present invention, first initializes the NFC controller 111 to operate in the card reader mode, and then redirects a transmission path of data read by the NFC controller 111 to a preset buffer area in the TEE. It is easily understood that after the transmission path of the data read by the NFC controller 111 is redirected to the preset buffer in the TEE, any data read by the NFC controller 111 will be stored in the preset buffer, and await processing.
After the redirection to the NFC controller 111 is completed, the identity of the NFC card is read into the preset cache area through the preset TA in the TEE, and the identity of the NFC card (in this embodiment, the identity uniquely identifies the NFC card, and the identities of different NFC cards are different) is recorded as the first identity, that is, the first identity is the identity of the NFC card. Specifically, through the preset trusted application of the trusted execution environment, reading the first identity of the NFC card into the preset cache area based on the NFC controller 111 includes:
and calling the preset TA for preset times according to the preset frequency so as to indicate the preset TA to read the first identity mark of the NFC card.
In this embodiment, the preset TA is called repeatedly, and the NFC controller 111 is notified that the preset TA is ready to be completed through the repeated call, so that the first identity of the NFC card can be read. It should be noted that, the value of the preset frequency and the preset number of times is not specifically limited, and may be set by a person skilled in the art according to actual needs, for example, the present invention calls the preset TA 5 times according to the frequency of 5 times/second to indicate the preset TA to read the first identity identifier of the NFC card.
In specific implementation, as shown in fig. 4, when the user holds the mobile terminal close to the NFC card and the distance between the mobile terminal and the NFC card is within the NFC communication distance, the predetermined TA reads the data carried by the NFC card through the radio frequency field generated by the NFC controller 111, where the predetermined TA reads the first identity identifier of the NFC card and stores the read first identity identifier in the predetermined cache area of the TEE. It should be noted that, in this embodiment, the NFC card may be an NFC card whose physical form is a card as shown in fig. 3, or may be an NFC device operating in a card simulation mode, or an NFC card of another form.
After the first identity identification of the NFC card is read into the preset cache region by the preset TA, based on the first identity identification in the preset cache region, the NFC card is subjected to security verification by the preset TA, optionally, in an embodiment, the preset TA includes a first identity authentication rule, and the security verification of the NFC card by the preset TA includes:
and judging whether the first identity identification is in a first identity authentication rule of a preset TA, wherein when the first identity identification is in the first identity authentication rule of the preset TA, the NFC card is determined to pass the safety verification, otherwise, the NFC card is determined not to pass the safety verification.
In a specific implementation, the first identity authentication rule may be preset in the preset TA when the mobile terminal leaves a factory or installs the preset TA. The aforementioned first authentication rule includes an identification of the authentic NFC card.
Optionally, in an embodiment, the preset TA includes an agreed first asymmetric encryption algorithm (for which asymmetric encryption algorithm is adopted, the present invention is not particularly limited, and may be selected by a person skilled in the art according to actual needs), when the first identity identifier of the NFC card is read, a first ciphertext carried by the NFC card is also read (a ciphertext obtained by calculating the first identity identifier by using the agreed first asymmetric encryption algorithm by an NFC card manufacturer), and performing security check on the NFC card by using the preset TA includes:
calculating the read first identity identifier through a first asymmetric encryption algorithm of a preset TA to obtain a second ciphertext;
and judging whether the calculated second ciphertext is matched with the first ciphertext, wherein the NFC card is determined to pass the safety verification when the calculated second ciphertext is matched with the first ciphertext, and otherwise, the NFC card is determined not to pass the safety verification.
And when the verification result returned by the preset TA is that the NFC card passes the safety verification, setting that the NFC application corresponding to the NFC card in the REE can access the preset TA so that the NFC application can access the NFC card through the preset TA.
For example, taking the NFC card as "shenzhen tong" as an example, when the NFC card is subjected to security verification by the preset TA, and the "shenzhen tong" passes the security verification, it is set that the "pan app" in the REE can access the preset TA, so that the "pan app" can access the "shenzhen tong" by the preset TA, and the functions of "balance inquiry" and "recharge" are realized by corresponding read-write operations.
Further, after step S20, the method further includes:
and when the NFC card does not pass the safety verification, outputting first prompt information that the NFC card is unsafe.
It is easy to understand that when the NFC card fails the security verification, it indicates that the NFC card may be forged and there is a certain security risk, and at this time, a first prompt message indicating that the NFC card is not secure is output, for example, the first prompt message "the NFC card is not secure and there is a security risk" is displayed on the screen.
Optionally, in an embodiment, while outputting the first prompt message that the NFC card is not secure, the following steps are further performed:
and clearing the first identity mark in the preset cache region.
The near field communication safety control method provided by the invention is combined with a reading function of near field communication and a trusted execution environment isolated from a common execution environment, a transmission path of data read by a near field communication controller is redirected to a preset cache region in the trusted execution environment, the near field communication card is subjected to safety inspection through a preset trusted application in the trusted execution environment, and when the near field communication card passes the safety inspection, the near field communication application corresponding to the near field communication card in the common execution environment is set to be accessible to the preset trusted application so that the near field communication application can access the near field communication card through the preset trusted application, thereby achieving the purpose of improving the safety of the mobile terminal in near field communication interaction.
Further, based on the first embodiment, a second embodiment of the NFC security control method according to the present invention is proposed, where in this embodiment, after step S30, the method further includes the following steps:
reading user real-name information carried by an NFC card into a preset cache region through a preset TA, and generating temporary application information based on the user real-name information and preset ticket business information of ticket business application;
and transmitting the temporary application information to the ticket application through an access channel between the preset TA and the ticket application so that the ticket application can finish real-name ticket purchasing.
It is easy to understand that in real life, places such as scenic spots, zoos, amusement parks and the like all need to purchase real-name tickets, and when a user purchases tickets through a ticketing application, the user needs to manually input real-name information to purchase tickets, so that the operation is complex. Therefore, in this embodiment, based on the first embodiment, the processing operation of the provisional application information is further added, which is only described below, and other embodiments can be referred to, and are not described herein again.
In the embodiment of the invention, the NFC application is a ticketing application, and after the NFC card passes the security verification and the ticketing application is set to have access to the preset TA, the user real-name information carried by the NFC card is further read through the preset TA, and the user real-name information is read into the preset cache area.
And then, acquiring the preset ticketing information of the ticketing application based on the preset TA and the access channel of the ticketing application, and generating temporary application information based on the real-name information of the user and the preset ticketing information. The method includes the steps that ticket information is preset, namely other ticket information except real name information required for ticket purchasing of a user operation ticket application, wherein the ticket information includes but is not limited to ticket purchasing quantity, positions and the like; the temporary application information is generated by a preset TA according to ticket buying rules of the ticket application, and can be understood as a ticket buying request.
After the temporary application information is generated, the generated temporary application information is transmitted to the ticketing application through the access channel, and then the ticketing application can transmit the temporary application information to a preset ticketing server to finish real-name ticket purchasing.
For example, the NFC card is an identity card, the ticketing application is a "take-away application", the user operates the "take-away application" to purchase a flight ticket and complete selection of ticket information (such as a location, a cabin space, and the like), and when the real-name information needs to be input, the user brings the mobile terminal close to the identity card. The mobile terminal carries out safety verification on the identity card through a preset TA, reads user real name information 'identity card number, name and the like' carried by the identity card after the identity card passes the safety verification, generates a 'travel application' available ticket purchasing request 'temporary application information' according to a ticket purchasing rule of 'travel application' by combining preset ticket information input by a user, transmits the 'temporary application information' to 'travel application', and completes the purchase of the air ticket by the 'travel application'.
It should be noted that the aforementioned access channel is a client API.
Further, in this embodiment, after the real-name ticket purchasing is completed by the ticketing application, the ticket-purchasing credentials (such as a two-dimensional code and a barcode carrying entrance ticket information) obtained by the real-name ticket purchasing by the ticketing application are transparently transferred to the preset TA, and are stored in the security unit (such as an embedded security unit, ESE) according to the GP specification through the preset TA. When the ticket buying voucher needs to be used, after the NFC controller 111 is configured in the card simulation mode, the mobile terminal is close to the ticket checking terminal to complete the checking, which is convenient and fast.
Further, based on the first embodiment, a third embodiment of the NFC security control method according to the present invention is proposed, where in this embodiment, before step S10, the method further includes:
and starting the safe reading mode when receiving the safe reading mode starting operation of the user.
It should be noted that, in this embodiment, on the basis of the first embodiment, a start operation of the secure read mode is added, which is only described below, and other embodiments can refer to the foregoing embodiment, and are not described herein again.
In the embodiment of the present invention, a control for starting the secure reading mode may be added to a "setup" interface of the mobile terminal, or a control for starting the secure reading mode may be added to a UI of the near field communication secure control program provided by the present invention, so that the user may operate the control and start the secure reading mode. For example, as shown in FIG. 5, a user may trigger a secure read mode initiation operation by sliding the circular control shown in FIG. 5.
Further, in this embodiment, before starting the secure read mode, the method further includes:
when receiving a safe reading mode starting operation of a user, displaying a preset authentication interface for the user to input authentication data;
receiving authentication data input by a user based on the displayed preset authentication interface, and performing user identity authentication based on the authentication data;
after the user identity authentication is passed, a secure reading mode is started.
In the embodiment of the invention, the authentication operation of the user is further added, specifically, when the starting operation of the safe reading mode of the user is received, the preset authentication interface is displayed for the user to input the authentication data, and when the preset authentication interface is specifically implemented, the preset authentication interface is displayed through the trusted UI of the TEE, so that the hardware resources such as screen display, keyboard and the like are completely controlled and accessed by the TEE, and the user input authentication data is prevented from being stolen. The form of the preset authentication interface is not specifically limited in the present invention, and may be set by a person skilled in the art according to actual needs, for example, the nine-grid authentication interface shown in fig. 6 is adopted in the embodiment of the present invention.
And then, receiving authentication data input by a user through a displayed preset authentication interface, and comparing the authentication data input by the user with the preset authentication data after receiving the authentication data input by the user to realize user identity authentication, wherein when the authentication data of the user and the authentication data of the preset authentication data are consistent, the user identity authentication is determined to be passed, otherwise, the user identity authentication is determined to be failed. For example, based on the squared fig. 6 authentication interface, the user draws the pattern shown in fig. 7 (i.e. the input authentication data), and if the pattern is the same as the preset pattern (i.e. the preset authentication data, such as the authentication pattern drawn by the pre-authorized user), it is determined that the user identity authentication is passed.
After the user identity authentication is confirmed to pass, the safe reading mode can be started.
Further, based on any one of the foregoing embodiments, a fourth embodiment of the NFC security control method according to the present invention is provided, where in this embodiment, before step S30, the method further includes:
when the NFC card passes the safety verification, reading a second identity identifier of the NFC application to a preset cache region through a preset TA;
based on the second identity, performing security verification on the NFC application through a preset TA;
and when the NFC application passes the security verification, setting the NFC application to have access to a preset TA.
It should be noted that, in this embodiment, on the basis of the foregoing embodiment, a security check operation for the NFC application is further added, which is only described below, and other embodiments may refer to the foregoing embodiment, and are not described here again.
In the embodiment of the invention, after the NFC card passes the security verification and the second identity of the NFC application is read into the preset cache region, the security verification is performed on the NFC application through the preset TA based on the second identity in the preset cache region. The second identity can be obtained by analyzing the application installation package of the NFC application, and specifically can be an application certificate hash value of the NFC application.
Optionally, in an embodiment, the preset TA includes a second identity authentication rule, and performing security verification on the NFC card through the preset TA includes:
and judging whether the second identity mark is in a second identity authentication rule of a preset TA, wherein when the second identity mark is in the second identity authentication rule of the preset TA, the NFC application is determined to pass the safety verification, otherwise, the NFC application is determined not to pass the safety verification.
In a specific implementation, the second identity authentication rule may be preset in the preset TA when the mobile terminal leaves a factory or installs the preset TA. The aforementioned second authentication rule includes an identity of the trusted NFC application.
Optionally, in an embodiment, the preset TA includes an agreed second asymmetric encryption algorithm (which asymmetric encryption algorithm is adopted, the present invention is not particularly limited, and may be selected by a person skilled in the art according to actual needs), when the second identity of the NFC application is read, a third ciphertext (a ciphertext obtained by calculating the second identity by using the agreed second asymmetric encryption algorithm by an NFC application manufacturer) carried by the NFC application is also read, and performing security check on the NFC application by using the preset TA includes:
calculating the read second identity through a second asymmetric encryption algorithm of a preset TA to obtain a fourth ciphertext;
and judging whether the calculated fourth ciphertext is matched with the third ciphertext, wherein when the calculated fourth ciphertext is matched with the calculated third ciphertext, the NFC application is determined to pass the safety verification, otherwise, the NFC application is determined not to pass the safety verification.
And when the verification result returned by the preset TA is that the NFC application passes the safety verification, setting the NFC application to access the preset TA so that the NFC application can access the NFC card through the preset TA.
Further, after the step of performing security check on the NFC application by using a preset TA based on the second identity. Further comprising:
and when the NFC application does not pass the safety verification, outputting second prompt information which is unsafe for the NFC application.
It is easy to understand that when the NFC application fails the security check, it is indicated that the NFC application may be an illegally distributed emulational application, and there is a certain security risk, and at this time, a second prompt message indicating that the NFC application is not secure is output, for example, the second prompt message "the NFC application is not secure and there is a security risk" is displayed on the screen.
Optionally, in an embodiment, while outputting the second prompt information that the NFC application is not secure, the following steps are further performed:
and clearing the second identity in the preset cache region.
Furthermore, the present invention also provides a computer-readable storage medium, having an NFC security control program stored thereon, which when executed by the processor 110, implements the following operations:
when the secure read mode is started, redirecting a transmission path of data read by the NFC controller 111 to a preset cache area in the TEE;
reading a first identity identifier of the NFC card into a preset cache area based on the NFC controller 111 through a preset TA of the TEE, and performing security verification on the NFC card based on the first identity identifier;
when the NFC card passes the security verification, the NFC application corresponding to the NFC card in the REE is set to have access to the preset TA so that the NFC application can access the NFC card through the preset TA.
Further, the NFC application is a ticketing application, and the aforementioned NFC security control program, when executed by the processor 110, further implements the following operations:
reading user real-name information carried by an NFC card into a preset cache region through a preset TA, and generating temporary application information based on the user real-name information and preset ticket business information of ticket business application;
and transmitting the temporary application information to the ticket application through an access channel between the preset TA and the ticket application so that the ticket application can finish real-name ticket purchasing.
Further, the aforementioned NFC security control program, when executed by the processor 110, further implements the following operations:
and calling the preset TA for preset times according to the preset frequency so as to indicate the preset TA to read the first identity mark of the NFC card.
Further, the aforementioned NFC security control program, when executed by the processor 110, further implements the following operations:
and when the NFC card does not pass the safety verification, outputting first prompt information that the NFC card is unsafe.
Further, the aforementioned NFC security control program, when executed by the processor 110, further implements the following operations:
and starting the safe reading mode when receiving the safe reading mode starting operation of the user.
Further, the aforementioned NFC security control program, when executed by the processor 110, further implements the following operations:
when receiving a safe reading mode starting operation of a user, displaying a preset authentication interface for the user to input authentication data;
receiving authentication data input by a user based on a displayed preset authentication interface, and performing user identity authentication based on the authentication data;
after the user identity authentication is passed, a secure reading mode is started.
Further, the aforementioned near field communication security control program, when executed by the processor 110, further implements the following operations:
reading a second identity identifier of the NFC application to a preset cache region through a preset TA;
based on the second identity, performing security verification on the NFC application through a preset TA;
and when the NFC application passes the security verification, the NFC application is set to be accessible to the preset TA.
Further, the aforementioned near field communication security control program, when executed by the processor 110, further implements the following operations:
and when the NFC application does not pass the safety verification, outputting second prompt information which is unsafe for the NFC application.
It should be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element.
The above-mentioned serial numbers of the embodiments of the present invention are merely for description and do not represent the merits of the embodiments.
Through the above description of the embodiments, those skilled in the art will clearly understand that the method of the above embodiments can be implemented by software plus a necessary general hardware platform, and certainly can also be implemented by hardware, but in many cases, the former is a better implementation manner. Based on such understanding, the technical solution of the present invention may be embodied in the form of a software product, which is stored in a storage medium (e.g., ROM/RAM, magnetic disk, optical disk) as described above and includes instructions for enabling a terminal (e.g., a mobile phone, a computer, a server, an air conditioner, or a network device) to execute the method according to the embodiments of the present invention.
While the present invention has been described with reference to the embodiments shown in the drawings, the present invention is not limited to the embodiments, which are illustrative and not restrictive, and it will be apparent to those skilled in the art that various changes and modifications can be made therein without departing from the spirit and scope of the invention as defined in the appended claims.

Claims (8)

1. A near field communication security control method is applied to a mobile terminal, and is characterized by comprising the following steps:
when a safe reading mode is started, redirecting a transmission path of data read by a near field communication controller to a preset cache region in a trusted execution environment;
reading a first identity identifier of a near field communication card into the preset cache region based on the near field communication controller through a preset trusted application of the trusted execution environment, and performing security check on the near field communication card based on the first identity identifier;
when the near field communication card passes the security verification, setting that a near field communication application corresponding to the near field communication card in a common execution environment can access the preset trusted application, so that the near field communication application can access the near field communication card through the preset trusted application;
before the step of redirecting the transmission path of the data read by the near field communication controller to the preset cache region in the trusted execution environment when the secure read mode is started, the method further includes:
starting a safe reading mode when receiving a safe reading mode starting operation of a user;
before the secure read mode is started, the method further comprises:
when receiving a safe reading mode starting operation of a user, displaying a preset authentication interface for the user to input authentication data;
receiving authentication data input by a user based on the displayed preset authentication interface, and performing user identity authentication based on the authentication data;
after the user identity authentication is passed, a secure reading mode is started.
2. The near field communication security control method according to claim 1, wherein the near field communication application is a ticketing application, and after the step of setting the preset trusted application accessible to the near field communication application, the method further comprises:
reading user real-name information carried by the near field communication card into a preset cache region through a preset trusted application, and generating temporary application information based on the user real-name information and preset ticketing information of the ticketing application;
and transmitting the temporary application information to the ticketing application through an access channel between the preset trusted application and the ticketing application so that the ticketing application can complete real-name ticketing.
3. The near field communication security control method of claim 1, wherein the step of reading the first identity by the preset trusted application comprises:
and calling the preset trusted application for a preset number of times according to a preset frequency so as to indicate the preset trusted application to read the first identity of the near field communication card.
4. The near field communication security control method according to claim 1, wherein after the step of performing security verification on the near field communication card by the preset trusted application based on the first identity, the method further comprises:
and when the near field communication card does not pass the safety verification, outputting first prompt information that the near field communication card is unsafe.
5. A near field communication security control method according to any of claims 1 to 4, wherein before the step of setting the preset trusted application accessible to the near field communication application, further comprising:
when the near field communication card passes the security verification, reading a second identity identifier of the near field communication application to the preset cache region through the preset trusted application;
based on the second identity, performing security verification on the near field communication application through the preset trusted application;
and when the near field communication application passes the security verification, setting the near field communication application to be accessible to the preset trusted application.
6. The near field communication security control method according to claim 5, wherein after the step of performing security verification on the near field communication application by the preset trusted application based on the second identity, the method further comprises:
and when the near field communication application does not pass the safety verification, outputting second prompt information which is unsafe for the near field communication application.
7. A mobile terminal, characterized in that the mobile terminal comprises:
a memory storing a near field communication security control program;
a processor configured to execute the near field communication security control program to implement the steps of the near field communication security control method of any one of claims 1 to 6.
8. A computer-readable storage medium, characterized in that a near field communication security control program is stored on the computer-readable storage medium, which when executed by a processor implements the steps of the near field communication security control method of any one of claims 1 to 6.
CN201710340693.2A 2017-05-12 2017-05-12 Near field communication security control method, mobile terminal and computer readable storage medium Active CN107240157B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201710340693.2A CN107240157B (en) 2017-05-12 2017-05-12 Near field communication security control method, mobile terminal and computer readable storage medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201710340693.2A CN107240157B (en) 2017-05-12 2017-05-12 Near field communication security control method, mobile terminal and computer readable storage medium

Publications (2)

Publication Number Publication Date
CN107240157A CN107240157A (en) 2017-10-10
CN107240157B true CN107240157B (en) 2020-08-21

Family

ID=59985844

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201710340693.2A Active CN107240157B (en) 2017-05-12 2017-05-12 Near field communication security control method, mobile terminal and computer readable storage medium

Country Status (1)

Country Link
CN (1) CN107240157B (en)

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107659921B (en) * 2017-11-08 2023-12-26 上海坤锐电子科技有限公司 NFC universal realization circuit and chip
US10789391B1 (en) 2019-07-22 2020-09-29 Alibaba Group Holding Limited RFID information processing
CN110427790B (en) * 2019-07-22 2021-02-05 创新先进技术有限公司 RFID device and information processing method based on same
CN110609799A (en) * 2019-09-11 2019-12-24 天津飞腾信息技术有限公司 Safety protection method for off-chip nonvolatile storage
CN111860016A (en) * 2020-07-15 2020-10-30 维沃移动通信有限公司 Information display method and device for Near Field Communication (NFC) and electronic equipment
CN114302404A (en) * 2021-12-23 2022-04-08 汇顶科技(成都)有限责任公司 Near field communication method, configuration method, NFC host and electronic equipment

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP2746981A1 (en) * 2012-12-19 2014-06-25 ST-Ericsson SA Trusted execution environment access control rules derivation
CN104765612A (en) * 2015-04-10 2015-07-08 武汉天喻信息产业股份有限公司 System and method for having access to credible execution environment and credible application
CN105591672A (en) * 2015-04-30 2016-05-18 中国银联股份有限公司 NFC-based communication method and device
CN105812332A (en) * 2014-12-31 2016-07-27 北京握奇智能科技有限公司 Data protection method

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105446713B (en) * 2014-08-13 2019-04-26 阿里巴巴集团控股有限公司 Method for secure storing and equipment
KR20160056749A (en) * 2014-11-12 2016-05-20 삼성전자주식회사 Appratus and method for payment
CN105592403B (en) * 2014-12-29 2020-03-31 中国银联股份有限公司 NFC-based communication device and method
CN105590201B (en) * 2015-04-23 2019-05-10 中国银联股份有限公司 Mobile payment device and mobile-payment system
CN105447406B (en) * 2015-11-10 2018-10-19 华为技术有限公司 A kind of method and apparatus for accessing memory space
CN108809659B (en) * 2015-12-01 2022-01-18 神州融安科技（北京）有限公司 Dynamic password generation method, dynamic password verification method, dynamic password system and dynamic password verification system
CN105429760B (en) * 2015-12-01 2018-12-14 神州融安科技（北京）有限公司 A kind of auth method and system of the digital certificate based on TEE
CN106056380A (en) * 2016-05-27 2016-10-26 深圳市雪球科技有限公司 Mobile payment risk control system and mobile payment risk control method

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP2746981A1 (en) * 2012-12-19 2014-06-25 ST-Ericsson SA Trusted execution environment access control rules derivation
CN105812332A (en) * 2014-12-31 2016-07-27 北京握奇智能科技有限公司 Data protection method
CN104765612A (en) * 2015-04-10 2015-07-08 武汉天喻信息产业股份有限公司 System and method for having access to credible execution environment and credible application
CN105591672A (en) * 2015-04-30 2016-05-18 中国银联股份有限公司 NFC-based communication method and device

Also Published As

Publication number Publication date
CN107240157A (en) 2017-10-10

Similar Documents

Publication Publication Date Title
CN107240157B (en) Near field communication security control method, mobile terminal and computer readable storage medium
KR102216877B1 (en) Authentication method and apparatus based on biometric information in a electronic device
KR102226411B1 (en) Electronic device and method for managing reenrollment
CN109618316B (en) Network sharing method, mobile terminal and storage medium
CN108075899B (en) Identity authentication method, mobile terminal and computer readable storage medium
CN108475304B (en) Method and device for associating application program and biological characteristics and mobile terminal
US10038834B2 (en) Video call method and device
CN109687974B (en) APK verification method and device, mobile terminal and readable storage medium
CN107730260B (en) Method, equipment and terminal for realizing two-dimensional code payment
CN110457888B (en) Verification code input method and device, electronic equipment and storage medium
CN108833690B (en) Authority control method, terminal and computer readable storage medium
CN107635234B (en) Wi-Fi control method, mobile terminal and computer-readable storage medium
CN107563158B (en) Method, device and computer readable storage medium for displaying hidden application icon
CN107317680B (en) Method and system for marking safety account and computer readable storage medium
CN107358432A (en) Mobile terminal is swiped the card method, apparatus and computer-readable recording medium
CN108229149B (en) Data protection method and device
CN108012270B (en) Information processing method, equipment and computer readable storage medium
CN107194217B (en) User data access control method, apparatus and computer-readable storage medium
CN107622213A (en) A kind of data access method, terminal and computer-readable recording medium
CN108540458A (en) A kind of method of client checks, equipment, server and storage medium
CN110557747A (en) network registration method, terminal and readable storage medium
CN107395363B (en) Fingerprint sharing method and mobile terminal
CN107168747B (en) Method and device for distinguishing mobile terminal configuration and computer readable storage medium
CN111967871A (en) Secure payment method, device and storage medium
CN107172076B (en) Security verification method, mobile terminal and server side

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
TA01 Transfer of patent application right

Effective date of registration: 20200703

Address after: 210013, Gu Ping Gang 4, Gulou District, Jiangsu, Nanjing

Applicant after: Nanjing xinwindows Information Technology Co., Ltd

Address before: 518057 Guangdong Province, Shenzhen high tech Zone of Nanshan District City, No. 9018 North Central Avenue's innovation building A, 6-8 layer, 10-11 layer, B layer, C District 6-10 District 6 floor

Applicant before: NUBIA TECHNOLOGY Co.,Ltd.

TA01 Transfer of patent application right
GR01 Patent grant
GR01 Patent grant