WO2013174321A1

WO2013174321A1 - Command execution method and device, smart card and mobile terminal

Info

Publication number: WO2013174321A1
Application number: PCT/CN2013/079851
Authority: WO
Inventors: 缪海翔; 杨柯; 尚江峰
Original assignee: 中兴通讯股份有限公司
Priority date: 2012-11-13
Filing date: 2013-07-23
Publication date: 2013-11-28
Also published as: CN103020547A

Abstract

Disclosed are a command execution method and device, a smart card and a mobile terminal. The method comprises: a smart card of a mobile terminal receiving a command to be executed by means of a USB Key, wherein the USB Key is stored in the smart card; and the smart card executing an operation corresponding to the command. The present invention is applied to solve the problems in the related art that PC USB port resources are wasted because two USB ports are occupied, and a single USB Key and a data card may be lost, with loss of either one rendering the other unusable, thereby being able to conduct an interaction operation on a smart card and a data card in one and the same device, save PC USB port resources, and have a high practicality.

Description

TECHNICAL FIELD The present invention relates to the field of smart card and smart card security, and in particular to a method, device, smart card and mobile terminal for executing a command. BACKGROUND With the development and commercialization of the third generation mobile communication technology, wireless data cards have been widely used in various industries. In some regions, the banking system also commercializes wireless data cards. Because the banking system has high security requirements, the USB Key is also required on the personal computer (Personal Computer) device that uses the data card. This will take up two USB ports. In the related art, occupying two USB ports wastes the port resources of the PC, and a separate USB Key and a data card may cause a loss problem, and if any one of them is lost, the other cannot be used. SUMMARY OF THE INVENTION The present invention provides a method, an apparatus, a smart card, and a mobile terminal for executing a command, so as to at least solve the related art, occupying two USB ports to waste PC resources, and a separate USB Key and data card may cause loss Any one of them is lost, causing another problem that cannot be used. According to an aspect of the present invention, a method for executing a command is provided, including: a smart card of a mobile terminal receives a command that needs to be executed by means of a USB Key, wherein the smart card stores a USB Key; the smart card executes the command Corresponding operation. Preferably, the USB key is stored in the smart card, and the smart card is internally configured with an application having an EF file, wherein the EF file is used to store a certificate supporting the USB Key function. Preferably, before the smart card of the mobile terminal receives the command required to be executed by means of the USB Key, the method further comprises: determining whether the PIN2 code from the user matches the PIN2 code preset by the terminal; if yes, placing the smart card Execute the working status of the USB Key function. Preferably, the performing, by the smart card, the operation corresponding to the command comprises: performing an encryption or decryption operation according to the command; and feeding back a result of performing the encryption or decryption operation to the data card. Preferably, the receiving, by the smart card of the mobile terminal, the command required to be executed by means of the USB Key comprises: the smart card receiving a command after the format conversion process from the data card. Preferably, before the smart card receives the command from the data card for performing the format conversion process, the method further includes: the data card converting the operation command from the user; and transmitting the operation command of the converted user to the smart card The smart card is used to execute an operation command corresponding to the USB Key function. Preferably, the operation command of the user includes at least one of the following: encrypting, decrypting, generating a key pair. Preferably, the data card performs conversion processing on the operation command from the user, including: parsing the operation command of the user; and converting the operation command of the parsed user into a command recognizable by the smart card for sending. Preferably, the smart card is a Subscriber Identity Module (SIM) card and a Universal Subscriber Identity Module (USIM) card. According to another aspect of the present invention, an apparatus for executing a command is provided, including: a receiving module, configured to receive a command that needs to be executed by means of a USB Key, wherein the smart card stores a USB Key; and an execution module is set to Execute the operation corresponding to the command. Preferably, the device further includes: a determining module, configured to determine whether the PIN2 code from the user matches the PIN2 code preset by the terminal; and a setting module configured to preset the PIN2 code from the user and the terminal In the case where the PIN2 codes match, the smart card is placed in an operating state in which the USB Key function is executed. Preferably, the execution module comprises: an encryption and decryption unit configured to perform an encryption or decryption operation according to the command; and a feedback unit configured to feed back a result of performing the encryption or decryption operation to the data card. According to still another aspect of the present invention, a smart card is provided for use in a mobile terminal, wherein the smart card includes a storage device, and the storage device stores a USB Key. Preferably, the smart card includes at least one of the following: a SIM card and a USIM card. According to still another aspect of the present invention, a mobile terminal is provided, wherein the mobile terminal comprises: the smart card of any of the above. When the USB card is stored in the smart card of the present invention, when the smart card receives a command that needs to be executed by means of the USB Key, the corresponding operation can be directly performed according to the command. By using the invention, the USB Key is set in the smart card, which solves the related technology, which occupies two USB ports to waste PC resources, and the separate USB Key and data card may cause loss, and any one of them is lost, resulting in Another problem that cannot be used, and then In order to interact with the smart card and the data card in the same device, the utility of the PC is saved, and the utility model has high practicability. BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are set to illustrate,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, 1 is a flowchart of a method of executing a command according to an embodiment of the present invention; FIG. 2 is a block diagram showing a structure of an apparatus for executing a command according to an embodiment of the present invention; FIG. 3 is an execution according to an embodiment of the present invention. FIG. 4 is a block diagram showing the structure of an execution module of a device for executing a command according to an embodiment of the present invention; FIG. 5 is a schematic diagram of a system architecture according to a preferred embodiment of the present invention; FIG. A flowchart of implementing a USB Key function by using a SIM card in Embodiment 2; and FIG. 7 is a flowchart of implementing a USB Key function by using a SIM card according to a preferred embodiment 3 of the present invention. BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, the present invention will be described in detail with reference to the accompanying drawings. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict. In the related art, occupying two USB ports wastes the port resources of the PC, and the separate USB Key and the data card may cause loss, and any one of them is lost, which causes another problem that cannot be used. A method for executing a command, the flow of the method is as shown in FIG. 1 , including steps S102 to S104 : Step S102 , the smart card of the mobile terminal receives a command that needs to be executed by means of a USB Key, wherein the smart card stores a USB Key; S104. The smart card performs an operation corresponding to the command. In the smart card of this embodiment, a USB Key is stored, and when the smart card receives a command that needs to be executed by means of the USB Key, the corresponding operation can be directly performed according to the command. By using the embodiment, the USB Key is set in the smart card, which solves the related technology, which occupies the USB port of the USB port, and the separate USB Key and the data card may cause loss, and any one of them is lost. This leads to another problem that cannot be used, and thus the smart card and the data card can be interoperated in the same device, which saves the PC's superior resources and has high practicability. The USB Key is stored in the smart card. Initially, an application with an EF file is built in the smart card. The EF file is used to store a certificate supporting the USB Key function. The smart card may be a card having the same or similar functions, such as a SIM card or a USIM card. Before the smart card of the mobile terminal receives the command required to be executed by means of the USB Key, the verification step can be added, that is, the PIN code of the SIM card itself can be used to perform the related operation of the encryption. The smart card can receive the PIN2 code from the user, and determine whether the PIN2 code input by the user matches the PIN2 code preset by the terminal; if it matches, the USB Key function of the smart card is turned on, so that the function is in a working state. If the entered PIN2 code does not match the preset PIN2 code, the user may be an illegal user, prohibit any subsequent operations, or set the number of times the password is entered. After the number of incorrect passwords reaches the preset number of times, the user is prohibited. action. In implementation, the operation corresponding to the smart card execution command may be to perform different operations in different situations. For example, if the command is encrypted, the encryption operation is performed according to the command; and the result of performing the encryption operation is fed back to the data card. The command received by the smart card may be a command after the format conversion process of the data card. If the format of the command is identifiable by the smart card, the data card may be processed without direct processing and transparently transmitted. If the received command is after the data card performs format conversion processing, the data card converts the operation command from the user; and then sends the converted operation command of the user to the smart card, where the smart card is used to execute the USB Key The corresponding operation command of the function, for example, performs encryption, decryption, and generates a key pair operation. In implementation, the data card performs conversion processing from the user's operation command, including the following process: the data card parses the user's operation command; and converts the parsed user's operation command into a smart card identifiable command for transmission. The embodiment of the present invention further provides an apparatus for executing a command. The structural block diagram of the apparatus is as shown in FIG. 2, and includes: a receiving module 10 configured to receive a command that needs to be executed by means of a USB Key, where the smart card stores a USB The execution module 20 is coupled to the receiving module 10 and configured to perform an operation corresponding to the command. The device may further include: a determining module 30, configured to determine whether the PIN2 code from the user matches the PIN2 code preset by the terminal; the setting module 40 is coupled with the determining module 30 and the receiving module 10, and is configured to be In the case where the PIN2 code from the user matches the PIN2 code preset by the terminal, the smart card is placed in an operating state in which the USB Key function is executed. In one embodiment, the execution module 20, as shown in FIG. 4, includes: an encryption and decryption unit 202 configured to perform an encryption or decryption operation according to a command; a feedback unit 204 coupled with the encryption and decryption unit 202, configured to perform encryption or The result of the decryption operation is fed back to the data card. The embodiment further provides a smart card, which can be applied to a mobile terminal, that is, a mobile terminal including any one of the above smart cards. Preferably, the smart card may include a storage device, and when implemented, store the related files of the USB Key in the storage device to support the related functions of the USB Key. The embodiments of the present invention will be described below in conjunction with the preferred embodiments and the accompanying drawings. In the following embodiments, the naming of each module is slightly different from the naming of each module in the above embodiment, but all of them can achieve the same function. And can perform the above method. The preferred embodiment is based on the related art, in which the USB Key and the data card are usually separated, and the problem of occupying two USB sockets is required. In this embodiment, the encryption and decryption function of the existing USB Key is embedded in the SIM card, that is, the encryption and decryption process. Completed internally by the SIM card. The data card serves as a bridge between the USB Key function operation interface and the SIM card, and is responsible for parsing and transmitting the encryption and decryption data. The module involved in this embodiment includes: a SIM card, a data card driver module, a Data Protocol Application Protocol Data Unit (APDU) processing module, and a user operation interface. The method provided in this embodiment includes the following process. The user operates on the USB Key PC operation interface and issues related commands such as encryption, decryption, and key pair generation. After receiving the above command, the data card driver module parses and calls the relevant processing interface provided by the APDU processing module of the data card; the APDU processing module of the data card converts the received command into an APDU string that the SIM card can recognize, and the APDU is The string is sent to the SIM card.

After receiving the APDU string, the SIM card internally performs an associated encryption and decryption operation, and returns the execution result to the APDU processing module of the data card. The data card APDU processing module sends the result returned by the SIM card to the driver module. The driver module converts the received data into a format recognizable by the USB Key operating software on the PC and sends it to the USB Key PC operating interface.

The PC USB Key operating software verifies the returned execution result. If the result is legal, the subsequent operation is allowed, otherwise it is rejected. Preferred Embodiment 2 This embodiment relates to a system having a USB Key function and a method for implementing an interaction process based on the system. In this embodiment, the data card side driver module parses the operation requirement of the user interface, and the software module inside the data card is converted into an APDU string that can be identified by the corresponding SIM card, and the APDU command is sent to the SIM card, and is performed inside the SIM card. The data is encrypted and decrypted, and the execution result is returned. This SIM card and data card are used together to make it have a USB Key function.

The SIM card is a smart card containing a large-scale integrated circuit for registering user identification data and information. The APDU is an instruction for the terminal to interact with the SIM card. In order to make the SIM card have the USB Key function, it is first necessary to create a new application inside the SIM card, and the operation of the EF file (mainly the EF file for storing the certificate file) involved in the application is protected by the PIN2 code. That is to say, when the user needs to use the SIM card as a USB Key, the data card first needs to issue a command to activate the application of the USB Key function of the SIM card; then the user needs to pass the PIN2 code verification. If the data card terminal does not issue a command to the SIM card to activate the USB Key application, the subsequent certificate file cannot be read and encrypted. If the user cannot provide the correct PIN2 code, the user is an illegal user. In this case, the user should be prohibited from continuing the subsequent operations. Secondly, it is necessary to design an APDU command for USB card operation for the SIM card. At least three functions should be implemented: generating a public-private key pair, encrypting data, and decrypting data. Since the 3rd Generation Partnership Project (3GPP) standard protocol does not have such a function in the SIM card protocol, the CLA and INS parameters in the APDU command can be made by ourselves. Definition, encryption, decryption function can use an INS parameter, and distinguish by Pl, P2 parameters. As shown in Figure 5, the basic architecture of the system is shown. Module 1 is a PC security application operation interface module. The user performs USB Key related operations on this interface. The module converts the operations that the user needs to perform into standard commands and sends them to the data card through the USB port. The module is also responsible for receiving the data. The execution result returned by the data card and judge whether the result is legal. Module 2 is a data card driver module. The module needs to map a USB port on the PC. It is responsible for parsing the commands sent by the module 1 through the USB port, and converting them into commands that the data card can recognize, and calling the relevant interfaces provided by the module 3. The command is issued, and the result reported by the module 3 is also converted into a packet format that can be recognized by the PC and reported to the module 1 through the USB port. The module 3 data card APDU processing module is responsible for the command and data packet received from the module 2 to be an APDU string that can be recognized by the SIM card, and sent to the SIM card, and the execution result of the SIM card is reported to the module 2. Module 4 is a SIM card, which is responsible for performing the encryption and decryption work performed by the original USB Key within it, and returns the data to module 3. Based on the system architecture described above, the flow of implementing the USB Key function by using the SIM card in this embodiment is as shown in FIG. 6, and includes steps S602 to S622. In step S602, the user operates on the USB Key PC operation interface, and issues related commands, such as: encryption, decryption, and generation of a key pair. Step S604, the data card driving module parses the above command, and invokes an relevant processing interface provided by the APDU processing module of the data card. Step S606, the APDU processing module of the data card converts the received command into a SIM card identifiable

The APDU string is sent to the SIM card. Step S608, receiving a PIN2 code from the user. This step is to improve security, so the SIM card is designed to require the user to perform PIN2 code verification when receiving such an operation. Step S610, determining whether the PIN2 code check is passed. If yes, step S612 is performed, and if no, step S622 is performed. Step S612, the SIM card performs an encryption and decryption APDU instruction and returns an execution result of the APDU format. Step S614, the data card APDU processing module parses the valid data in the APDU string returned by the SIM card, and reports it to the driver module. Step S616, the driver module converts the received data into a format recognizable by the USB Key operating software on the PC and sends the format to the USB Key PC operation interface. Step S618, the PC USB Key operation software checks the returned execution result to determine whether the verification is passed. If yes, go to step S620, otherwise, go to step S622. In step S620, the user is allowed to perform subsequent operations. Step S622, the user is prohibited from performing the next operation. In the third embodiment, the data card and the USB Key are combined into one, which gradually becomes the customization requirement of the user. The mobile terminal after the integration provided by the embodiment can save the USB interface of the PC, and the encryption and decryption function of the USB Key can be completed internally by the SIM card, and only needs to modify the internal software of the SIM card when designing the SIM card. Realization, this can save the hardware cost of the original USB Key; SIM card itself has PIN1, PIN2 code protection mechanism, further enhances the security of USB Key related operations; this SIM card is used with data card, not only for banks The system provides security support, and can also be applied to other scenarios that require the use of a USB Key, thereby providing users with more convenient, safe and efficient services. The system architecture of this embodiment may be as shown in FIG. 5, and the process performed may be as shown in FIG. 7. The process indicates a specific implementation process of the data card APDU processing module, and the process includes steps S702 to S716. In step S702, the APDU is sent in accordance with the format agreed by the SIM card card vendor, and the USB Key application of the SIM card is activated. Step S704, the SIM card module internally maintains a state machine, and accepts and processes the commands sent by the driver module at any time. In step S706, the state machine determines whether a command sent by the driver module is received. If yes, step S708 is performed, otherwise, the step is continued. Step S708, parsing the command sent by the driver module, performing the APDU group packet according to the command according to the command, and filling in relevant parameters. Step S710, opening a logical channel (OPEN CHANNEL) for the USB Key application related command, for performing APDU transmission related to the USB Key application. Step S712, the grouped APDUs are sent to the SIM card through the opened channel. Step S714, accepting the execution result of the SIM card, and returning the result to the driver module. Step S716, a command execution is completed, and the logical channel (CLOSE CHANNEL) is closed. After this step, the process may continue to return to step S704 for repeated execution, that is, the state machine waits for the command issued by the next driver module. From the above description, it can be seen that the present invention achieves the following technical effects: By using the embodiment, the security of the USB Key related operation is further enhanced; the SIM card is used together with the data card to provide not only the banking system but also the banking system. Security support can also be applied to other scenarios where a USB Key is required, thus providing users with more convenient, safe and efficient services. Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general-purpose computing device, which can be concentrated on a single computing device or distributed over a network composed of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device, such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein. The steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps are fabricated as a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software. The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

Claim

1. A method of executing a command, which includes:

The smart card of the mobile terminal receives a command that needs to be executed by means of a USB Key, wherein the smart card stores a USB Key;

The smart card performs an operation corresponding to the command.

The method of claim 1 , wherein the storing the USB key in the smart card comprises: the smart card internally having an application having an EF file, wherein the EF file is set to store a certificate supporting the USB Key function .

3. The method according to claim 1, wherein before the smart card of the mobile terminal receives the command that needs to be executed by means of the USB Key, the method further includes:

Determining whether the PIN2 code from the user matches the PIN2 code preset by the terminal; if so, placing the smart card in an operating state in which the USB Key function is performed.

4. The method according to claim 1, wherein the operation of the smart card to execute the command comprises: performing an encryption or decryption operation according to the command;

The result of performing the encryption or decryption operation is fed back to the data card.

The method according to any one of claims 1 to 4, wherein the receiving, by the smart card of the mobile terminal, the command required to be executed by means of the USB Key comprises:

The smart card receives a command from the data card for performing a format conversion process.

The method according to claim 5, wherein, before the smart card receives the command after the format conversion process from the data card, the method further includes:

The data card performs conversion processing from an operation command of the user;

The operation command of the converted user is sent to the smart card, wherein the smart card is set to execute an operation command corresponding to the USB Key function.

The method according to claim 6, wherein the operation command of the user includes at least one of the following: encrypting, decrypting, generating a key pair.

The method according to claim 6, wherein the converting, by the data card, the operation command from the user comprises: parsing an operation command of the user;

Translating the parsed user's operation command into a command that the smart card can recognize and transmitting.

9. The method according to claim 1, wherein the smart card is a customer identification module SIM card, a global subscriber identity module USIM card.

10. An apparatus for executing a command, comprising:

a receiving module, configured to receive a command that needs to be executed by means of a USB Key, wherein the smart card stores a USB Key;

The execution module is set to execute the operation corresponding to the command.

11. The device according to claim 10, further comprising:

a determining module, configured to determine whether the PIN2 code from the user matches the PIN2 code preset by the terminal;

The setting module is configured to place the smart card in an operating state in which the USB Key function is performed in a case where the PIN2 code from the user matches the PIN2 code preset by the terminal.

The device according to claim 10 or 11, wherein the execution module comprises:

An encryption and decryption unit configured to perform an encryption or decryption operation according to the command;

A feedback unit is arranged to feed back the result of performing the encryption or decryption operation to the data card.

A smart card, which is applied to a mobile terminal, wherein the smart card includes a storage device, and the storage device stores a USB Key.

The smart card according to claim 13, wherein the smart card comprises at least one of the following: a customer identification module SIM card, a global subscriber identity module USIM card.

A mobile terminal, comprising: the smart card of claim 13 or 14.