WO2012055166A1 - 移动存储设备、基于该设备的数据处理系统和方法 - Google Patents

移动存储设备、基于该设备的数据处理系统和方法 Download PDF

Info

Publication number
WO2012055166A1
WO2012055166A1 PCT/CN2011/001788 CN2011001788W WO2012055166A1 WO 2012055166 A1 WO2012055166 A1 WO 2012055166A1 CN 2011001788 W CN2011001788 W CN 2011001788W WO 2012055166 A1 WO2012055166 A1 WO 2012055166A1
Authority
WO
WIPO (PCT)
Prior art keywords
processing
interface
storage device
network
data
Prior art date
Application number
PCT/CN2011/001788
Other languages
English (en)
French (fr)
Inventor
庄晓
鲁志军
何朔
孟宏文
欧鹏
Original Assignee
中国银联股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中国银联股份有限公司 filed Critical 中国银联股份有限公司
Priority to EP11835440.6A priority Critical patent/EP2634703B1/en
Priority to US13/881,721 priority patent/US20130290718A1/en
Publication of WO2012055166A1 publication Critical patent/WO2012055166A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/74—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information operating in dual or compartmented mode, i.e. at least one secure mode
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/08—Payment architectures
    • G06Q20/10—Payment architectures specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0431—Key distribution or pre-distribution; Key agreement

Definitions

  • the present invention relates to network security technologies, and more particularly to a mobile storage device for data security processing, a data processing system including the same, and a data processing method using the data processing system,
  • a removable storage device such as a key disk is one that provides some kind of physical interface (eg.
  • Hardware device with USB interface, SD interface and MMC interface), built-in microprocessor, memory and chip operating system (COS), user's key and/or digital certificate are saved in the secure data storage space of the key disk, right
  • the read and write operations of the storage space must be implemented by a program built into the disk, which cannot be directly read by the user and the key is not exportable, which effectively eliminates the possibility of copying the user's digital certificate or identity information.
  • the microprocessor can implement various algorithms for encryption, decryption and signature in the key disk, thereby providing security mechanisms for communication between the client and the server (for example, authentication of user identity and encryption of sensitive data).
  • the internal running program only provides an application program interface (API) to the external application, so that the latter can invoke the use process involving the key or the certificate, but the two are applied. There is no logical connection.
  • API application program interface
  • One of the objects of the present invention is to provide a mobile storage device for data security processing, which greatly improves the security of payment services.
  • the provided mobile storage device for data security processing includes: At least one memory for storing a key;
  • Processing means for communicating with the remote device via the interface circuit for performing security processing and application processing, the security processing comprising performing data encryption and decryption using the key.
  • the processing means includes hardware circuits that perform security processing and application processing, respectively.
  • the processing means includes a microprocessor, and the security processing and application processing are performed by running a corresponding program on the microprocessor.
  • the memory is a flash memory
  • the interface circuit is at least one of a USB interface, a SIM card interface, an SD interface, or an MMC interface.
  • the interface circuit is emulated as a network interface that follows a particular network protocol such that the processing device communicates with the remote device via a client terminal accessing the network.
  • a program corresponding to the application processing is used to implement a specific application function, such as a business function of an online banking, and a program corresponding to the security processing is invoked via an application program interface to complete security. Processing function.
  • the program corresponding to the application processing directly establishes a network connection with the remote device through an interface circuit emulated as a network interface complying with a specific network protocol.
  • the network protocol is a TCP/IP protocol stack.
  • the number of the memories is at least two, one of which is for holding a key and the other is for saving the program.
  • Another object of the present invention is to provide a data processing system that greatly enhances the security of payment services in a network environment.
  • a data processing system that includes:
  • Mobile storage devices including:
  • At least one memory for storing a key
  • a processing device for communicating with the server via the interface circuit, for executing Full processing and application processing, the security processing comprising performing data encryption and decryption using the key, the application processing comprising generating a message related to data processing, including the encrypted data,
  • the mobile storage device is connected to a client terminal accessing the network via the interface circuit, so that the mobile storage device accesses the network via the client terminal to implement the Communication between the processing device and the server.
  • the memory is a flash memory or other electrically erasable memory
  • the interface circuit is at least one of a USB interface, a SIM card interface, an SD interface, or an MMC interface.
  • the interface circuit is emulated as a network interface that follows a particular network protocol such that the processing device communicates with the server via a client terminal accessing the network.
  • the method provided includes the following steps:
  • the processing device interacts with the server to execute a business process, wherein the processing device generates a message related to the business process that includes encrypted data;
  • the processing device transmits the message to the server via an established network connection
  • the server decrypts the encrypted data in the message and performs data processing.
  • a manner of establishing a network connection between the processing device and the server is:
  • the interface circuit is coupled to a client terminal of the access network such that the processing device accesses the network via the client terminal.
  • an application for executing a business process flow is also solidified therein, which makes Applications can get a level of security like confidential information.
  • the mobile storage device has the ability to emulate a network interface, so the client (such as a personal computer) that originally executed the application is only used as a mobile storage.
  • the bridge between the storage device and the remote server, the generation and unpacking of service data are all completed inside the mobile storage device, which greatly improves the security of the business processing.
  • FIG. 1 is a block diagram of a mobile storage device in accordance with an embodiment of the present invention.
  • 2a and 2b are respectively a schematic diagram showing the physical structure and logical structure of a network connection between a mobile storage device and a remote device according to another embodiment of the present invention.
  • FIG. 3 is a schematic diagram showing the architecture of an internal running program of a mobile storage device according to an embodiment of the present invention.
  • FIG. 4 is a schematic diagram of a data processing system in accordance with another embodiment of the present invention
  • FIG. 5 is a flow diagram of a method of implementing data security processing in accordance with another embodiment of the present invention. detailed description
  • FIG. 1 is a block diagram of a mobile storage device in accordance with an embodiment of the present invention.
  • the key disk is used as a specific form of the mobile storage device, but it is obvious that the principles embodied in this embodiment are also applicable to other types of mobile storage devices, including but not limited to SIM cards and SD cards. And MMC card.
  • the key disk 10 mainly includes a memory 100, an interface circuit 110, and a processing device 120.
  • the memory 100 can be, for example, a read only memory, a flash memory, or other form of nonvolatile memory. It should be noted that although the memory 100 is represented by a square in FIG. 1, this does not mean that there can be only one memory in the key disk 10. In fact, multiple memories can be provided in the key disk 10. Physically separate memory, and preferably, confidential information (such as keys and digital certificates) and programs are stored in different memories. For external devices, the memory storing confidential information is inaccessible, and the program is saved. Memory allows for restricted access, for example, the program can only be called but cannot be overwritten, of course, It is also possible to divide a memory into different areas to store confidential information and programs, respectively, and different read and write control strategies can be used for different areas. The above various changes are not departing from the spirit and scope of the invention.
  • the interface circuit 110 provides a physical interface for communication between the internal unit of the key disk and an external device.
  • it may be, for example, a USB interface, an SD interface, an MMC interface, and an RJ45 interface for accessing a local area network.
  • Processing device 120 is the core unit of key disk 10, and functions implemented thereby include, for example, security processing and application processing, as further described below.
  • the digital certificate uses a public key mechanism based on an asymmetric encryption algorithm (such as the RSA encryption algorithm).
  • the certificate authority generates a pair of matching keys for the user, namely a public key and a private key, wherein the public key is published in the user's digital certificate.
  • the private key is not disclosed (for example, in the present embodiment, confidential information is stored in the memory 100 that is not accessible by the external device).
  • a typical business application such as online banking and online banking
  • the sender encrypts the plaintext using the recipient's public key
  • the receiver decrypts the ciphertext using its private key. . Since only the recipient can decrypt the information encrypted by its own public key, secure communication can be achieved.
  • SSL protocol In order to improve the security strength, a security mechanism called SSL protocol may be adopted, in which although the public and private keys of the sender and the receiver remain unchanged, a change session secret is introduced for each session between them. Key, the session key is used to encrypt the transmitted data, which makes the information deciphering more difficult, further ensuring the security of data transmission.
  • security processing can also be based on a symmetric encryption algorithm where the sender and receiver use the same key.
  • the encryption of the message transmitted to the external device and the decryption of the message from the external device are all implemented in the processing device 120 of the key disk 10, and these encryption and decryption processes are collectively referred to as security processing.
  • processing device 120 includes a general purpose microprocessor that implements secure processing functions by running a corresponding software program on the microprocessor.
  • a software program that implements a secure processing function can be stored in the memory 100.
  • the key disk 10 and the external device The communication between the two is based on an asymmetric encryption algorithm, but the implementation of the above security processing function is also suitable for a security mechanism based on a symmetric encryption algorithm.
  • the existing key disk provides security processing related to encryption and decryption, and application processing related to business processes other than security processing is mainly performed at the client terminal and the remote device. For example, when online banking or online payment process is initiated After that, for the application on the client terminal, it generally completes the following processing:
  • the application prompts the user to enter a username/password through the client terminal and thereby determine whether it is a legitimate user. Only by this verification, the application activates the key disk to make it work.
  • the application on the client terminal can establish a secure communication channel based on the SSL protocol with the remote server using the certificate in the key disk.
  • the application on the client terminal can display a business logic interface to the user, and generate a message containing the encrypted data in the client terminal according to the function selected by the user on the business logic interface and send it to the remote device.
  • the client terminal can call the key disk for security processing, such as sensitive data (including but not limited to merchant code, sub-mer/terminal code, order number, transaction amount, transaction currency, debit amount, deduction The currency, debit exchange rate, account information, track information, PIN and card expiration date, etc. are entered into the key disk for encryption.
  • the client terminal's application can receive a message from a remote server and generate a corresponding business logic interface based on the message.
  • the client terminal can invoke the key disk for secure processing, such as decrypting the received message and extracting data needed to generate the business logic interface.
  • the application processing is performed by the processing device 120 located inside the key disk 10. Compared with the manner in which the application processing is completed at the client terminal, since the sensitive data is provided in an encrypted form outside the key disk 10 and the business process flow originally completed by the client terminal is also closed in the key disk 10, Improve the security of business processes In addition, the manner of this embodiment also eliminates the need to install an application on a client terminal.
  • processing device 120 includes a general purpose microprocessor that implements application processing functions by running a corresponding software program on the microprocessor.
  • a software program that implements application processing functions can also be stored in the memory 100.
  • an application processing function may be implemented by providing an application program interface (API).
  • API application program interface
  • Different physical media are used for access.
  • the interface circuit 110 of the key disk 10 can be designed as a corresponding physical interface.
  • the interface circuit 110 can also be equipped as a USB interface, a SIM card interface, an SD interface or an MMC interface, and through a client terminal (for example, an individual).
  • the computer, personal digital processing or mobile phone runs a suitable driver that emulates the interface as a network interface that follows a particular communication protocol, thereby enabling communication of the key disk 10 with the remote device.
  • FIGS. 2a and 2b are respectively a schematic diagram showing the physical structure and logical structure of a network connection between a mobile storage device and a remote device according to another embodiment of the present invention.
  • the illustrated case is exemplified by a key disk equipped with a USB interface.
  • the key disk 10 is connected to a client terminal 20 (e.g., a personal computer) via a USB interface, and the client terminal 20 is connected to a remote device 30 (e.g., a remote server) via a network, and the key disk 10 includes an interface circuit 110. And processing device 120.
  • a client terminal 20 e.g., a personal computer
  • a remote device 30 e.g., a remote server
  • the key disk 10 includes an interface circuit 110.
  • processing device 120 e.g., a remote server
  • the key disk 10 includes an interface circuit 110.
  • processing device 120 e.g., a remote processing device.
  • the memory 100A holds confidential information such as a key
  • the memory 100B holds programs for performing security processing and application processing (for example, WEB).
  • WEB security processing and application processing
  • the browser and the network driver that emulates the key disk 10 as a virtual network device, wherein the saved program is read-only and is prohibited from being overwritten or modified.
  • the USB interface is emulated as a network interface
  • the key disk 10 connected to the client terminal 20 via the emulated network interface is regarded as a remote host at the client terminal 20.
  • the client terminal 20 functions as a bridge to establish a network underlying channel between the key disk 10 and the remote device 30.
  • the processing device 120 can communicate directly with the remote device 30 via the client terminal 20 in accordance with a particular communication protocol (e.g., TCP/IP network protocol).
  • the key disk 10 configures the memory 100B to be externally The accessed USB storage disk, such that the network driver can be directly installed on the client terminal 20 and the program for completing the application processing can be started.
  • FIG. 4 is a schematic diagram of a data processing system in accordance with another embodiment of the present invention, which takes a client/server distributed architecture and a payment service application as an example.
  • the data processing system 40 includes mobile storage devices 400A and 400B and a remote server 410.
  • the mobile storage devices 400A and 400B serve as clients, and are responsible for security processing and application processing at the user, which may be, for example, as shown in FIG.
  • the key disk of the structure may be, for example, as shown in FIG.
  • the remote server 410 is used to complete the payment processing of the online banking.
  • the mobile storage device 400A may be, for example, a SIM card installed in the client terminal 20 (here, a mobile phone), and the client terminal 20 wirelessly accesses the Internet 50. Similarly, by installing at the client terminal 20.
  • the network driver described above causes the client terminal 20 to function as a bridge to establish a network underlying channel between the mobile storage device 400A and the remote server 410.
  • mobile storage device 400A can communicate with remote server 410 in accordance with a particular communication protocol, such as a TCP/IP network protocol.
  • the mobile storage device 400A may itself be provided with no input and/or output devices, but instead utilize existing input and output devices (e.g., a keyboard, a touch screen, a mouse, a display, etc.) of the client terminal 20,
  • existing input and output devices e.g., a keyboard, a touch screen, a mouse, a display, etc.
  • the mobile memory device 400B When the mobile memory device 400B has sufficient hardware resources, it is equipped with a dedicated input and/or output device and a network interface, so that it can directly access the network 50, thereby implementing the remote server 410 without using the client terminal 20. Interaction. Data security processing method
  • FIG. 5 is a flowchart of a method for implementing data security processing according to another embodiment of the present invention. The method of this embodiment is implemented by using the data processing system shown in FIG.
  • step 510 the mobile storage device 400 is connected to the client terminal 20, and for the USB key disk, that is, it is inserted into the USB interface of the client terminal,
  • the mobile phone On the SIM card, the mobile phone is connected to the client terminal.
  • the guest terminal 20 identifies the mobile storage device 400 as a network device and one (or more) storage disks, as described above in connection with Figures 2a and 2b.
  • the processing device in the mobile storage device 400 initiates a network connection with the remote server 410 of the access network 50.
  • the manner of establishing the network connection may be, for example, an input device (such as a keyboard, a mouse, or the like by the user through the client terminal 20). Touch screen), launching an application (eg, a WEB browser) stored in the memory of the mobile storage device 400 or the client terminal 20, the interface of the application being presented on an output device (eg, a display) of the client terminal 20, the user in the WEB browser
  • the address of the remote server 410 is entered in the address bar.
  • the processing device can thus establish a network connection with the remote server 410 and send its public key (eg, in the form of a digital certificate) to the remote Server 410.
  • the address of the remote server 410 can also be built into the application stored in the mobile storage device 400 so that the user does not need to manually enter the address of the remote server.
  • the remote server 410 transmits to the mobile storage device 400 a message requesting the input of a username and password containing a session key encrypted with the user's public key.
  • the processing device of the mobile storage device 400 obtains the session key from the message requesting the user name and password by using the private key of the user, and encrypts the user input through the keyboard, mouse and touch screen of the client terminal 20 with the session key. user name and password.
  • step 516 the processing device sends the identity information encrypted with the session key to the remote server 410 via the established network connection, which determines whether the user identity is legitimate.
  • the remote server 410 decrypts the session name with the username and password and determines whether the identity of the user is legitimate. If it is not legal, proceed to step 518 to return the information of the denial of service to the user. Otherwise, proceed to step 519 to present a data processing interface on the display of the client terminal 20.
  • the user selects to exit the data processing flow or select a particular data processing function (e.g., transfer) on the data processing interface using a keyboard, mouse, or touch screen.
  • a particular data processing function e.g., transfer
  • step 521 the request associated with the particular data processing function is sent to the mobile storage device 400 for processing.
  • the device generates relevant data (such as transaction amount, transaction currency, debit amount, debit currency, debit exchange rate, etc.) inside the mobile storage device 400, wherein the encrypted data item is first used by the mobile storage device 400
  • the user's private key key stored in the memory is encrypted and then encrypted with the public key assigned to the remote server 410, and the encrypted data thus obtained is encapsulated in the transaction message.
  • the processing device encrypts the transaction message with the session key and sends it to the remote server 410 via the established network connection.
  • the remote server 410 first decrypts the transaction message with the session key, then decrypts the encrypted data in the transaction message with the user's public key, and finally decrypts it further with the private key assigned to the remote server 410, thereby obtaining the user.
  • the original data item The original data item.
  • the remote server 410 performs corresponding data processing to complete the service requested by the user (e.g., transfer), and then returns to step 520.
  • the present invention is described by way of example only and not by way of limitation. The scope of the present invention is defined by the appended claims, and various changes and modifications may be made in the scope of the appended claims.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Business, Economics & Management (AREA)
  • Computing Systems (AREA)
  • General Physics & Mathematics (AREA)
  • Accounting & Taxation (AREA)
  • Finance (AREA)
  • Software Systems (AREA)
  • Strategic Management (AREA)
  • Economics (AREA)
  • General Business, Economics & Management (AREA)
  • Development Economics (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Mathematical Physics (AREA)
  • Storage Device Security (AREA)

Abstract

本发明涉及网络安全技术，特别涉及用于数据安全处理的移动存储设备、包含该移动存储设备的数据处理系统和利用该数据处理系统的数据处理方法。按照本发明，用于数据安全处理的移动存储设备包括：至少一个存储器，用于保存密钥；接口电路；以及经所述接口电路与远程设备通信的处理装置，用于执行安全处理和应用处理逻辑，所述安全处理包括利用所述密钥执行数据加密和解密。与现有技术相比，按照本发明的实施例，密钥和数字证书之类的机密信息连同用于执行业务处理流程的应用程序都内置于移动存储设备，这提高了安全保护级别。另外，移动存储设备具有网络接口的能力，因此业务数据的生成和解包都在移动存储设备内部完成，这大大提高了业务处理的安全性。

Description

移动存储设备、 基于该设备的数据处理系统和方法 技术领域
本发明涉及网络安全技术，特别涉及用于数据安全处理的移动存 储设备、包含该移动存储设备的数据处理系统和利用该数据处理系统 的数据处理方法， 背景技术
网上支付和网上银行正在成为支付服务中的重要方式，但是其安 全性不足一直是其未来发展的最大阻碍。业界目前有各种解决方案来 提供安全性保证， 常见的有动态密码、 令牌和密钥盘或 U盾等。
诸如密钥盘之类的移动存储设备是一种提供某种物理接口（例如
USB接口、 SD接口和 MMC接口） 的硬件设备， 其内置微处理器、 存储器和芯片操作系统 （COS ) ， 用户的密钥和 /或数字证书被保存 在密钥盘的安全数据存储空间，对该存储空间的读写操作必须通过内 置于盘内的程序实现， 用户无法直接读取并且密钥是不可导出的， 这 有效杜绝了复制用户数字证书或身份信息的可能性。 此外， 通过微处 理器可以在密钥盘内实现加解密和签名的各种算法，从而为客户端与 服务器之间的通信提供安全机制（例如对用户身份的认证和敏感数据 的加密） . 值得指出的是， 在按照现有架构的移动存储设备中， 内部 运行程序仅向外部应用程序提供应用程序接口 （API ) ， 使后者能调 用涉及密钥或证书的使用过程， 但是二者在应用逻辑上没有关联。
但是目前的技术无法从根本上防止黑客对涉及支付交易的敏感 数据和交易流程的窥视和攻击。 可见， 需要提供一种更为严密的机制 来保证支付服务等的安全性。 发明内容
本发明的目的之一是提供一种用于数据安全处理的移动存储设 备， 其大大提高了支付服务的安全性.
为实现上述目的，所提供的用于数据安全处理的移动存储设备包 括： 至少一个存储器， 用于保存密钥；
接口电路； 以及
经所述接口电路与远程设备通信的处理装置，用于执行安全处理 和应用处理， 所述安全处理包括利用所述密钥执行数据加密和解密。
优选地， 在上述移动存储设备中， 所述处理装置包括分别执行安 全处理和应用处理的硬件电路。
优选地， 在上述移动存储设备中， 所述处理装置包括微处理器， 通过在所述微处理器上运行相应的程序的方式来执行所述安全处理 和应用处理。
优选地， 在上述移动存储设备中， 所述存储器为快闪存储器， 所 述接口电路为 USB接口、 SIM卡接口、 SD接口或 MMC接口中的至 少一种. 优选地， 在上述移动存储设备中， 所述接口电路被仿真为遵 循特定网络协议的网络接口，使得所述处理装置经接入网络的客户终 端与所述远程设备通信。
优选地， 在上述移动存储设备中， 与所述应用处理对应的程序用 于实现特定的应用功能， 如网上银行的业务功能， 并且经应用程序接 口调用与所述安全处理对应的程序来完成安全处理功能。
优选地， 在上述移动存储设备中， 与所述应用处理对应的程序通 过被仿真为遵循特定网络协议的网络接口的接口电路与所述远程设 备直接建立网络连接。
优选地， 在上述移动存储设备中， 所述网络协议为 TCP/IP协议 栈《
优选地，在上述移动存储设备中，所述存储器的数量至少为两个， 其中一个用于保存密钥， 另一个用于保存所述程序。
本发明的另外一个目的是提供一种数据处理系统，其大大提高了 网络环境下支付服务的安全性。
为实现上述目的， 所提供的数据处理系统包括：
接入网络的服务器；
移动存储设备， 包括：
至少一个存储器， 用于保存密钥；
接口电路； 以及
经所述接口电路与所述服务器通信的处理装置， 用于执行安 全处理和应用处理，所述安全处理包括利用所述密钥执行数据加 密和解密， 所述应用处理包括生成与数据处理有关的、 包含被加 密数据的消息，
在上述数据处理系统中，所述移动存储设备经所述接口电路与接 入所述网絡的客户终端相连，从而使所述移动存储设备经所述客户终 端接入所述网络， 以实现所述处理装置与所述服务器之间的通信。
在上述数据处理系统中，所述存储器为快闪存储器或其它电可擦 除存储器，所述接口电路为 USB接口、 SIM卡接口、 SD接口或 MMC 接口中的至少一种。
在上述数据处理系统中，所述接口电路被仿真为遵循特定网络协 议的网络接口，使得所述处理装置经接入网络的客户终端与所述服务 器通信。
本发明的还有一个目的是提供一种利用如上所述的数据处理系 统实现数据安全处理的方法，其大大提高了网络环境下支付服务的安 全性。
为实现上述目的， 所提供的方法包括下列步骤：
经所述接口电路在所述处理装置与所述服务器之间建立网络连 接；
所述处理装置与所述服务器交互以执行业务流程， 其中， 所述处 理装置生成与所述业务流程有关的、 包含被加密数据的消息；
所述处理装置经建立的网络连接向所述服务器发送所述消息； 以 及
所述服务器解密所述消息中的被加密的数据并执行数据处理. 优选地， 在上述方法中， 在所述处理装置与所述服务器之间建立 网络连接的方式为，所述处理装置经所述接口电路与接入网络的客户 终端相连， 从而使所述处理装置经所述客户终端接入所述网络。 与现有技术相比， 按照本发明的实施例， 由于移动存储设备内不 仅保存密钥和数字证书之类的机密信息，而且可以将用于执行业务处 理流程的应用程序也固化其中，这使得应用程序可以得到如机密信息 那样的安全保护级别。另外，移动存储设备具有仿真网络接口的能力， 因此原先执行应用程序的客户端（例如个人计算机）仅仅用作移动存 储设备与远端服务器之间的桥接器，业务数据的生成和解包都在移动 存储设备内部完成， 这大大提高了业务处理的安全性， 附图说明
从结合附图的以下详细说明中，将会使本发明的上述和其它目的 及优点更加完全清楚.
图 1为按照本发明一个实施例的移动存储设备的架构示意图。 图 2a和 2b分别为按照本发明另一实施例的移动存储设备与远程 设备之间网络连接的物理结构示意图和逻辑结构示意图。
图 3 为按照本发明一个实施例的移动存储设备内部运行程序的 架构的示意图.
图 4为按照本发明另一个实施例的数据处理系统的示意图， 图 5 为按照本发明另一个实施例的实现数据安全处理的方法的 流程图。 具体实施方式
下面根据表示本发明实施方式的附图具体描述本发明的实施例， 移动存储设备
图 1为按照本发明一个实施例的移动存储设备的架构示意图。在 本实施例中， 以密钥盘作为移动存储设备的具体形式， 但是显而易见 的是， 本实施例体现的原理同样也适合于其它类型的移动存储设备， 例如包括但不限于 SIM卡、 SD卡和 MMC卡。
如图 1所示， 密钥盘 10主要包括存储器 100、接口电路 110和处 理装置 120.
存储器 100例如可以是只读存储器、 闪存或其它形式的非易失存 储器。 需要指出的是， 在图 1中存储器 100虽然是以一个方框表示， 但是这并不意味着在密钥盘 10 内仅能有一个存储器， 实际上， 可以 在密钥盘 10内设置多个物理上分立的存储器， 并且比较好的是， 将 机密信息（例如密钥和数字证书）与程序分别保存在不同的存储器内， 对于外部设备， 保存机密信息的存储器是不可访问的， 而保存程序的 存储器允许有限制的访问，例如对于程序只能调用但不能改写，当然， 也可以将一个存储器划分为不同的区域来分别保存机密信息和程序， 此时对于不同的区域可采用不同的读写控制策略。上面的各种变化都 未脱离本发明的精神和保护范围。
接口电路 110 为密钥盘内部单元与外部设备的通信提供了物理 接口， 在本实施例中其例如可以是 USB接口、 SD接口、 MMC接口 和用于接入局域网的 RJ45接口。
处理装置 120是密钥盘 10的核心单元， 其实现的功能例如包括 安全处理和应用处理， 以下作进一步的描述。
Δ安全处理
数字证书采用基于非对称加密算法 （例如 RSA加密算法） 的公 钥机制， 证书颁发机构为用户产生一对相互匹配的密钥， 即公钥和私 钥， 其中公钥在用户的数字证书中公布， 而私钥是不公开的（例如在 本实施例中作为机密信息保存在不可被外部设备访问的存储器 100 内）。在典型的业务应用（例如网上支付和转账之类的网上银行业务） 中， 为了进行保密通信， 发送方使用接收方的公钥对明文进行加密， 接收方使用自己的私钥对密文进行解密。由于只有接收方才能对由自 己的公钥加密的信息解密， 因此可以实现保密通信。 为了提高安全强 度， 可以采用称之为的 SSL 协议的安全机制， 其中， 虽然发送方和 接收方的公钥和私钥保持不变，但是为它们之间的每次会话都引入变 化的会话密钥， 该会话密钥用于对传输的数据进行加密， 这使的信息 破译的难度加大， 进一步确保了数据传输的安全。 此外， 安全处理也 可以基于对称加密算法， 此时发送方和接收方采用相同的密钥。 在本实施例中，对向外部设备发送的消息的加密和对来自外部设 备的消息的解密都是在密钥盘 10的处理装置 120内实现的， 这些加 密和解密处理统称为安全处理。
这些安全处理的功能可以用作为处理装置 120 的組成部分的专 门的硬件电路来实现。另一种方式是处理装置 120包含通用的微处理 器， 通过在该微处理器上运行相应的软件程序来实现安全处理功能。 另外， 实现安全处理功能的软件程序可以保存在存储器 100内。
值得指出的是， 虽然在上面的描述中， 密钥盘 10与外部设备之 间的通信基于非对称加密算法，但是上述安全处理功能的实现对于基 于对称加密算法的安全机制也是适合的。
Δ应用处理
现有的密钥盘提供的是与加密和解密相关的安全处理，安全处理 以外的、与业务流程有关的应用处理主要是在客户终端和远程设备处 进行. 例如当网上银行或网上支付流程发起之后， 对于客户终端上的 应用程序， 其一般完成下列处理：
( 1 ) 用户身份验证
例如， 应用程序提示用户通过客户终端输入用户名 /密码并且据 此判断是否为合法用户， 只有通过该验证， 应用程序才激活密钥盘， 使其进入可工作状态。
( 2 ) 网络连接的建立
客户终端上的应用程序可利用密钥盘内的证书与远程服务器建 立基于 SSL协议的安全的通信通道。
( 3 ) 消息的生成和发送
客户终端上的应用程序可向用户显示业务逻辑界面，根据用户在 业务逻辑界面上选定的功能，在客户终端生成包含加密数据的消息并 向远程设备发送。 在生成过程中， 客户终端可调用密钥盘进行安全处 理， 例如将敏感数据 （例如包括但不限于商户代码、 子商户 /终端代 码、 订单号、 交易金额、 交易币种、 扣帐金额、 扣帐币种、 扣帐汇率、 账户信息、 磁道信息、 PIN和卡有效期等）输入密钥盘内进行加密。
( 4 ) 消息的接收和处理
客户终端的应用程序可从远程服务器接收消息，根据该消息生成 相应的业务逻辑界面。在生成业务逻辑界面的过程中， 客户终端可调 用密钥盘进行安全处理，例如对接收的消息进行解密并从中提取生成 业务逻辑界面所需的数据。 在本实施例中， 应用处理由位于密钥盘 10 内部的处理装置 120 完成。 与在客户终端完成应用处理的方式相比， 由于敏感数据在密钥 盘 10外部都是以加密形式提供的而且原先由客户终端完成的业务处 理流程也在密钥盘 10 内封闭运行， 因此大大提高了业务流程的安全 性， 此外， 本实施例的方式也免去了在客户终端上安装应用程序的需 要。
同样，可以在处理装置 120内包含专门的硬件电路来实现应用处 理功能。 另一种方式是在处理装置 120包含通用的微处理器， 通过在 该微处理器上运行相应的软件程序来实现应用处理功能。 此外， 实现 应用处理功能的软件程序也可以保存在存储器 100内。
优选地， 如图 3所示， 可以通过提供应用程序接口 （API ) 的方 式， 使得实现应用处理功能的应用程序（例如网上银行软件和证券交 内的应用业务逻辑。 为了接入采用不同物理介质的网络， 可以将密钥盘 10的接口电 路 110设计为相应的物理接口。 但是也可以将接口电路 110 配备为 USB接口、 SIM卡接口、 SD接口或 MMC接口， 并且通过在客户终 端 （例如个人计算机、 个人数字处理或手机）运行合适的驱动程序， 将该接口仿真为遵循特定通信协议的网络接口， 从而实现密钥盘 10 与远程设备的通信。
图 2a和 2b分别为按照本发明另一实施例的移动存储设备与远程 设备之间网络连接的物理结构示意图和逻辑结构示意图，所示的情形 以配备 USB接口的密钥盘为例。
如图 2a所示， 密钥盘 10通过 USB接口与客户终端 20 (例如个 人计算机）相连， 而客户终端 20经网络与远程设备 30 (例如远程服 务器）相连， 并且密钥盘 10 包括接口电路 110和处理装置 120。 但 是与图 1所示的密钥盘不同， 这里包括两个存储器 100A和 100B, 其 中存储器 100A保存密钥之类的机密信息， 而存储器 100B保存用于 完成安全处理和应用处理的程序 （例如 WEB浏览器） 以及将密钥盘 10 仿真为虚拟的网络设备的网络驱动程序， 其中所保存的程序是只 读的， 禁止被覆盖或修改。
如图 2b所示，当在客户终端 20安装上述网络驱动程序之后， USB 接口仿真为网络接口， 经仿真网络接口与客户终端 20相连的密钥盘 10在客户终端 20被视为远端主机， 由此， 客户终端 20充当了桥接 器的功能， 在密钥盘 10与远程设备 30之间建立起网络底层通道， 使 得处理装置 120可以 "直接"透过客户终端 20与远程设备 30按照特 定的通信协议（例如 TCP/IP网络协议）进行通信， 另一方面， 密钥 盘 10将存储器 100B配置为可以由外部设备访问的 USB存储盘， 这 样， 可以在客户终端 20上直接安装网络驱动程序和启动用于完成应 用处理的程序。 数据处理系统
图 4为按照本发明另一个实施例的数据处理系统的示意图，该实 施例以客户机 /服务器的分布式架构和支付服务应用为例.
如图 4所示， 数据处理系统 40包含移动存储设备 400A和 400B 以及远程服务器 410.移动存储设备 400A和 400B作为客户机， 负责 用户处的安全处理和应用处理，其例如可以采用图 1所示结构的密钥 盘。 远程服务器 410用于完成网上银行的支付处理。
在图 4中， 移动存储设备 400A例如可以是 SIM卡， 其被安装在 客户终端 20 (这里为手机） 内， 而客户终端 20则以无线方式接入互 联网 50. 同样， 通过在客户终端 20安装上述网络驱动程序， 使得客 户终端 20充当起桥接器的作用， 从而在移动存储设备 400A与远程 服务器 410之间建立起网络底层通道。 由此， 移动存储设备 400A可 以与远程服务器 410按照特定的通信协议（例如 TCP/IP网络协议） 进行通信。
在一种优选方式中，移动存储设备 400A自身可以不配备输入和 / 或输出设备， 而是利用客户终端 20 已有的输入和输出设备（例如键 盘、 触摸屏、 鼠标和显示器等） ，
移动存储器设备 400B具有充足的硬件资源时， 因此为其配备了 专门的输入和 /输出设备以及网络接口， 这样它就可以直接接入网络 50， 从而无需借助客户终端 20即可实现与远程服务器 410的交互。 数据安全处理方法
图 5 为按照本发明另一个实施例的实现数据安全处理的方法的 流程图， 本实施例的方法是利用图 4所示的数据处理系统实现的。
如图 5所示，在步骤 510中，将移动存储设备 400与客户终端 20 相连， 对于 USB密钥盘， 也就是将其插入客户终端的 USB接口， 对
8 于 SIM卡， 则装入手机后即与客户终端相连。
接着进入步骤 511，客卢终端 20将移动存储设备 400识别为一个 网络设备和一个（或多个）存储磁盘， 就象上面结合图 2a和 2b所述 的那样。
随后进入步骤 513， 移动存储设备 400内的处理装置发起与接入 网络 50的远程服务器 410的网络连接， 建立网络连接的方式例如可 以是由用户通过客户终端 20的输入设备（例如键盘、鼠标或触摸屏）， 启动保存在移动存储设备 400的存储器或客户终端 20内的应用程序 (例如 WEB浏览器） ， 应用程序的界面在客户终端 20的输出设备 (例如显示器）上呈现， 用户在 WEB浏览器的地址栏中输入远程服 务器 410 的地址. 由于用户终端已经接入网络 50， 因此处理装置由 此可以与远程服务器 410建立网络连接， 并将其公钥（例如以数字证 书的形式）发送给远程服务器 410。可选地，也可以将远程服务器 410 的地址内置于保存在移动存储设备 400的应用程序内，这样用户就无 需手工输入远程服务器的地址.
接着进入步骤 514， 远程服务器端 410向移动存储设备 400发送 要求输入用户名和密码的消息，该消息内包含以用户的公钥加密的会 话密钥。
随后进入步骤 515， 移动存储设备 400的处理装置利用用户的私 钥从要求输入用户名和密码的消息中得到会话密钥，并用该会话密钥 加密用户通过客户终端 20的键盘、 鼠标和触摸屏输入的用户名和密 码.
接着， 在步骤 516， 处理装置经已经建立的网络连接将以会话密 钥加密的身份信息送至远程服务器 410，由其判断用户身份是否合法。
在步骤 517， 远程服务器 410用会话密钥解密得到用户名和密码 并据此判断用户的身份是否合法。 如果不合法， 则进入步骤 518 , 向 用户返回拒绝服务的信息， 否则， 则进入步骤 519, 在客户终端 20 的显示器上呈现数据处理的界面.
在步骤 520， 用户利用键盘、 鼠标或触摸屏在数据处理的界面上 选择退出数据处理流程或者选择特定的数据处理功能 （例如转帐） 。
如果选择退出，则结束处理流程，否则进入步骤 521.在步骤 521 , 与特定数据处理功能相关联的请求被送至移动存储设备 400 的处理 装置，由其在移动存储设备 400内部生成相关的数据（例如交易金额、 交易币种、 扣帐金额、 扣帐币种和扣帐汇率等）， 其中需要加密的数 据项先以移动存储设备 400 内的存储器保存的用户私钥密钥进行加 密， 然后以分配给远程服务器 410的公钥进行加密， 由此获得的加密 数据被封装在交易消息内。
在步骤 522, 处理装置以会话密钥加密该交易消息并经已经建立 的网络连接送至远程服务器 410。
在步骤 523， 远程服务器 410首先以会话密钥解密交易消息， 然 后利用用户的公钥解密交易消息中的加密数据，最后再以分配给远程 服务器 410的私钥作进一步的解密， 由此得到用户原始的数据项。
在步骤 524， 远程服务器 410进行的相应的数据处理以完成用户 请求的业务（例如转账） ， 随后返回步猓 520。 由于可以在不背离本发明基本精神的情况下， 以各种形式实施本 发明， 因此上面描述的具体实施方式仅是说明性的而不是限制性的。 本发明的范围由所附权利要求定义，对上面描述方式所作的各种变化 或变动都属于所附权利要求的保护范围，

Claims

权 利 要 求
1、 一种用于数据安全处理的移动存储设备， 其特征在于， 包括: 至少一个存储器， 用于保存密钥；
接口电路； 以及
经所述接口电路与远程设备通信的处理装置，用于执行安全处理 和应用处理， 所述安全处理包括利用所述密钥执行数据加密和解密。
2、 如权利要求 1所述的移动存储设备， 其中， 所述处理装置包 括分别执行安全处理和应用处理的硬件电路。
3、 如权利要求 1所述的移动存储设备， 其中， 所述处理装置包 括微处理器，通过在所述微处理器上运行相应的程序的方式来执行所 述安全处理和应用处理。
4、 如权利要求 1或 2所述的移动存储设备， 其中， 所述存储器 为快闪存储器或其它电可擦除存储器， 所述接口电路为 USB接口、 SIM卡接口、 SD接口或 MMC接口中的至少一种，
5、 如权利要求 1或 2所述的移动存储设备， 其中， 所述接口电 路被仿真为遵循特定网络协议的网络接口，使得所述处理装置经接入 网络的客户终端与所述远程设备通信。
6、 如权利要求 3所述的移动存储设备， 其中， 与所迷应用处理 对应的程序用于实现网上银行的业务功能，并且经应用程序接口调用 与所述安全处理对应的程序来完成安全处理功能。
7、 如权利要求 5所述的移动存储设备， 其中， 与所述应用处理 对应的程序通过被仿真为遵循特定网络协议的网络接口的接口电路 与所述远程设备直接建立网络连接。
8、 如权利要求 5所述的移动存储设备， 其中， 所述网络协议为 TCP/IP协议栈。
9、 如权利要求 3所述的移动存储设备， 所述存储器的数量至少 为两个， 其中一个用于保存密钥， 另一个用于保存所述程序。
10、 一种数据处理系统， 包括：
接入网络的服务器；
移动存储设备， 包括：
至少一个存储器， 用于保存密钥； 接口电路； 以及
经所述接口电路与所述服务器通信的处理装置， 用于执行安 全处理和应用处理，所述安全处理包括利用所述密钥执行数据加 密和解密， 所述应用处理包括生成与数据处理有关的、 包含被加 密数据的消息。
11、 如权利要求 10所述的数据处理系统， 其中， 所述接口电路 被仿真为遵循特定网络协议的网络接口，使得所述处理装置经接入网 络的客户终端与所述服务器通信。
12、 如权利要求 10所述的数据处理系统， 其中， 所述存储器为 快闪存储器或其它电可擦除存储器，所述接口电路为 USB接口、 SIM 卡接口、 SD接口或 MMC接口中的至少一种，
13、 如权利要求 11所述的数据处理系统， 其中， 所述处理装置 包括微处理器，通过在所述微处理器上运行相应的程序的方式来执行 所述安全处理和应用处理，
14、 如权利要求 13所述的数据处理系统， 其中， 与所述应用处 理对应的程序用于实现网上银行的业务功能，并且经应用程序接口调 用与所述安全处理对应的程序来完成安全处理功能。
15、 如权利要求 13所迷的数据处理系统， 其中， 与所述应用处 理对应的程序通过被仿真为遵循特定网络协议的网络接口的接口电 路与所述远程设备直接建立网络连接，
16、 如权利要求 15所迷的数据处理系统， 其中， 所述网络协议 为 TCP/IP协议栈。
17、 如权利要求 10所述的数据处理系统， 其中， 所述存储器的 数量至少为两个，其中一个用于保存密钥，另一个用于保存所述程序。
18、 一种利用如上述权利要求 10-17所述的数据处理系统实现数 据安全处理的方法， 其特征在于， 包括下列步骤：
经所述接口电路在所述处理装置与所述服务器之间建立网络连 接；
所述处理装置与所述服务器交互以执行业务流程， 其中， 所述处 理装置生成与所述业务流程有关的、 包含被加密数据的消息；
所述处理装置经建立的网络连接向所述服务器发送所述消息； 以 及 所述服务器解密所述消息中的被加密的数据并执行数据处理。
19、 如权利要求 18所述的方法， 其中， 在所述移动存储设备与 所述服务器之间建立网络连接的方式为，所述移动存储设备经所述接 口电路与接入网络的客卢终端相连，从而使所述移动存储设备经所述 客户终端接入所述网络。
PCT/CN2011/001788 2010-10-28 2011-10-26 移动存储设备、基于该设备的数据处理系统和方法 WO2012055166A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP11835440.6A EP2634703B1 (en) 2010-10-28 2011-10-26 Removable storage device, and data processing system and method based on the device
US13/881,721 US20130290718A1 (en) 2010-10-28 2011-10-26 Mobile storage device and the data processing system and method based thereon

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN2010105239824A CN102456193A (zh) 2010-10-28 2010-10-28 移动存储设备、基于该设备的数据处理系统和方法
CN201010523982.4 2010-10-28

Publications (1)

Publication Number Publication Date
WO2012055166A1 true WO2012055166A1 (zh) 2012-05-03

Family

ID=45993095

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2011/001788 WO2012055166A1 (zh) 2010-10-28 2011-10-26 移动存储设备、基于该设备的数据处理系统和方法

Country Status (4)

Country Link
US (1) US20130290718A1 (zh)
EP (1) EP2634703B1 (zh)
CN (1) CN102456193A (zh)
WO (1) WO2012055166A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113806763A (zh) * 2021-07-16 2021-12-17 广州鲁邦通物联网科技有限公司 一种安全获取现场设备的数据的方法、安全服务器和系统

Families Citing this family (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2014161573A1 (en) * 2013-04-03 2014-10-09 Telefonaktiebolaget L M Ericsson (Publ) A method of and a device handling charging data in an ip-based network
KR101612751B1 (ko) * 2013-04-26 2016-04-15 비자 인터네셔널 서비스 어소시에이션 디지털 인증서의 제공
KR102119895B1 (ko) 2013-07-15 2020-06-17 비자 인터네셔널 서비스 어소시에이션 보안 원격 지불 거래 처리
JPWO2015019821A1 (ja) * 2013-08-05 2017-03-02 ソニー株式会社 情報処理装置、情報処理方法及びコンピュータプログラム
EP3033725A4 (en) 2013-08-15 2017-05-03 Visa International Service Association Secure remote payment transaction processing using a secure element
WO2015042548A1 (en) 2013-09-20 2015-03-26 Visa International Service Association Secure remote payment transaction processing including consumer authentication
EP2851833B1 (en) 2013-09-20 2017-07-12 Open Text S.A. Application Gateway Architecture with Multi-Level Security Policy and Rule Promulgations
US10116697B2 (en) 2013-09-20 2018-10-30 Open Text Sa Ulc System and method for geofencing
US10824756B2 (en) 2013-09-20 2020-11-03 Open Text Sa Ulc Hosted application gateway architecture with multi-level security policy and rule promulgations
US10210561B2 (en) * 2014-09-30 2019-02-19 Apple Inc. Beacon triggered device to device content transfer
US10296950B2 (en) 2014-09-30 2019-05-21 Apple Inc. Beacon triggered processes
CN104915832B (zh) * 2015-06-25 2019-05-14 中国工商银行股份有限公司 移动支付、验证方法及其装置与系统
CN105354500B (zh) * 2015-10-13 2018-05-04 成都汇研科技有限公司 文件加密方法及装置
US11593075B2 (en) 2015-11-03 2023-02-28 Open Text Sa Ulc Streamlined fast and efficient application building and customization systems and methods
US11388037B2 (en) 2016-02-25 2022-07-12 Open Text Sa Ulc Systems and methods for providing managed services
EP3731453B1 (en) * 2018-02-06 2023-08-02 Sony Group Corporation Information processing device, information processing method, program, and information processing system
CN108668260B (zh) * 2018-04-17 2021-12-24 北京华大智宝电子系统有限公司 一种sim卡数据自毁方法、sim卡、装置及服务器
CN112039852B (zh) * 2020-08-07 2022-08-05 武汉斗鱼鱼乐网络科技有限公司 一种核心接口保护的方法、存储介质、电子设备及系统
WO2023287585A1 (en) * 2021-07-14 2023-01-19 Secturion Systems, Inc. Secure data transfer over wireless networks using data storage encryptors

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN201408416Y (zh) * 2009-04-02 2010-02-17 同方股份有限公司 具有密钥分拆存储机制的移动存储设备
CN201549223U (zh) * 2009-05-04 2010-08-11 同方股份有限公司 可信安全移动存储装置
CN101873583A (zh) * 2010-06-01 2010-10-27 中国科学院深圳先进技术研究院 移动证书装置及其控制方法

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6381589B1 (en) * 1999-02-16 2002-04-30 Neopost Inc. Method and apparatus for performing secure processing of postal data
US20070033136A1 (en) * 2005-08-05 2007-02-08 Yih-Chun Hu Secured financial transaction device
US20080189554A1 (en) * 2007-02-05 2008-08-07 Asad Ali Method and system for securing communication between a host computer and a secure portable device
BRPI0919158B1 (pt) * 2008-09-17 2020-06-02 International Busines Machines Corporation Dispositivo de autorização, aparelho para controle de operações de um servidor, servidor para realização de operações e sistema de comunicação de dados

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN201408416Y (zh) * 2009-04-02 2010-02-17 同方股份有限公司 具有密钥分拆存储机制的移动存储设备
CN201549223U (zh) * 2009-05-04 2010-08-11 同方股份有限公司 可信安全移动存储装置
CN101873583A (zh) * 2010-06-01 2010-10-27 中国科学院深圳先进技术研究院 移动证书装置及其控制方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP2634703A4 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113806763A (zh) * 2021-07-16 2021-12-17 广州鲁邦通物联网科技有限公司 一种安全获取现场设备的数据的方法、安全服务器和系统
CN113806763B (zh) * 2021-07-16 2024-05-24 广州鲁邦通物联网科技股份有限公司 一种安全获取现场设备的数据的方法、安全服务器和系统

Also Published As

Publication number Publication date
EP2634703A1 (en) 2013-09-04
CN102456193A (zh) 2012-05-16
EP2634703B1 (en) 2018-02-21
EP2634703A4 (en) 2015-06-03
US20130290718A1 (en) 2013-10-31

Similar Documents

Publication Publication Date Title
EP2634703B1 (en) Removable storage device, and data processing system and method based on the device
US9875368B1 (en) Remote authorization of usage of protected data in trusted execution environments
JP6105721B2 (ja) 企業トリガ式２ｃｈｋ関連付けの起動
JP6012125B2 (ja) 問い合わせ型トランザクションによる強化された２ｃｈｋ認証セキュリティ
JP6117317B2 (ja) 否認防止方法、このための決済管理サーバおよび使用者端末
US8209753B2 (en) Universal secure messaging for remote security tokens
CA2838763C (en) Credential authentication methods and systems
JP6704919B2 (ja) 支払いトークンのセキュリティを確保する方法
US11824998B2 (en) System and method for software module binding
US11651343B2 (en) Systems and method for payment transaction processing with payment application driver
CN106878245B (zh) 图形码信息提供、获取方法、装置及终端
US7861015B2 (en) USB apparatus and control method therein
JP2018522353A (ja) サーバベースド支払のための認証システム及び方法
CA3080954C (en) Secure zone for secure purchases
WO2009039771A1 (fr) Terminal de paiement mobile et procédé de paiement basé sur la technologie pki
CN110278180B (zh) 金融信息的交互方法、装置、设备及存储介质
KR100939725B1 (ko) 모바일 단말기 인증 방법
US20230379336A1 (en) Systems and methods for multi-factor authentication by a commerce platform using a cloud services provider
CN107563743B (zh) 提升pos交易安全的方法及系统
PT2306668T (pt) Sistema e método de transação em linha segura
Arnosti et al. Secure physical access with NFC-enabled smartphones
Zhang Network Security Middleware Based on USB Key
Van Damme et al. A PKI-based mobile banking demonstrator
Khelifi et al. Open Source Cryptographic Algorithm to Better Secure E-Banking Services and Enhance its Protection Techniques

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 11835440

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2011835440

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 13881721

Country of ref document: US