WO2016169229A1 - 移动支付装置和方法 - Google Patents
移动支付装置和方法 Download PDFInfo
- Publication number
- WO2016169229A1 WO2016169229A1 PCT/CN2015/092098 CN2015092098W WO2016169229A1 WO 2016169229 A1 WO2016169229 A1 WO 2016169229A1 CN 2015092098 W CN2015092098 W CN 2015092098W WO 2016169229 A1 WO2016169229 A1 WO 2016169229A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- mobile payment
- software
- memory
- data
- processor
- Prior art date
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
- G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
- G06Q20/322—Aspects of commerce using mobile devices [M-devices]
- G06Q20/3226—Use of secure elements separate from M-devices
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
- G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
- G06Q20/322—Aspects of commerce using mobile devices [M-devices]
- G06Q20/3223—Realising banking transactions through M-devices
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
- G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
- G06F21/74—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information operating in dual or compartmented mode, i.e. at least one secure mode
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
- G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
- G06Q20/322—Aspects of commerce using mobile devices [M-devices]
- G06Q20/3227—Aspects of commerce using mobile devices [M-devices] using secure elements embedded in M-devices
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
- G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
- G06Q20/322—Aspects of commerce using mobile devices [M-devices]
- G06Q20/3229—Use of the SIM of a M-device as secure element
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
- G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
- G06Q20/325—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices using wireless networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
- G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
- G06Q20/327—Short range or proximity payments by means of M-devices
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
- G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
- G06Q20/327—Short range or proximity payments by means of M-devices
- G06Q20/3278—RFID or NFC payments by means of M-devices
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
- G06Q20/3827—Use of message hashing
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
- G06Q20/3829—Payment protocols; Details thereof insuring higher security of transaction involving key management
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q20/401—Transaction verification
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
- H04W4/80—Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/56—Financial cryptography, e.g. electronic payment or e-cash
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/80—Wireless
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/08—Access security
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/40—Security arrangements using identity modules
- H04W12/45—Security arrangements using identity modules using multiple identity modules
Definitions
- the present invention relates to the field of mobile communications, and in particular, to a mobile payment device and method.
- Mobile Payment refers to a service that allows users to use their mobile terminals, such as mobile phones or tablets, to pay for goods or services they consume.
- mobile terminals such as mobile phones or tablets
- SD Secure Digital
- SIM Subscriber Identity Module
- NFC Near Field Communication
- SE Secure Element
- the mobile terminal 10 communicates with a point of sales (POS) machine 11 through its internal near field communication unit 101, a near field communication unit 101 and a POS machine 11
- the short-range wireless communication link 12 is a two-way path, and can be implemented by various suitable short-range wireless communication protocols to implement basic wireless communication functions in mobile payment.
- the communication link 12 can be used to transfer POS command data or the like from the POS machine 11 to the near field communication unit 101 inside the mobile terminal 10.
- the secure element 102 can be a component coupled to a separate Central Processing Unit (CPU) 103 for performing various functions related to the operation of the financial payment service and storing keys and certificates associated with the banking business. And other data.
- CPU Central Processing Unit
- the secure element 102 receives the POS command data from the near field communication unit 101, parses the command data, and responds accordingly according to the financial transaction protocol. The response is fed back to the POS machine 11 by the near field communication unit 101 to complete the data transmission in the mobile payment to implement the function of the mobile terminal 10 as a transaction verification card.
- Central processing order The element 103 is run with operating system software 1031, such as Android system software, for controlling the near field communication unit 101 and the secure element 102, such as controlling the opening and closing of the near field communication unit 101 and the secure element 102.
- the mobile terminal 10 may include an input unit 104, which may be a touch screen for interacting with a user through a user interface (UI), so that the user can input an operation instruction on the input unit 104 through the UI.
- UI user interface
- the POS machine 11 accesses the cloud server 14 on the network side through the Internet as a terminal device of the transaction to implement calculation and completion of the payment service by the server 14.
- the server 14 located on the network side is typically operated by a bank.
- All-terminal solutions can include online payments and offline payments.
- the mobile terminal 10 When paying offline, as shown in FIG. 1, the mobile terminal 10 performs a non-contact card swiping with the POS machine 11, that is, the mobile phone, and the near field communication unit 101 and the secure element 102 cooperate to complete the payment transaction.
- the central processing unit 103 and the secure element 102 can access the Internet through the mobile communication network to realize online payment, and the secure element 102 is equivalent to the bank U.
- the role of the shield is to store and verify the bank's certificate, so the near field communication unit 101 of Figure 1 above is optional. Specifically, referring to FIG.
- the mobile terminal 10 may further include a mobile communication unit 105 for replacing the role of the near field communication unit 101 when offline payment is applied to the radio access network (Radio Access).
- Network, RAN Radio Access
- RAN radio access network
- the secure element 102 parses the command data and responds accordingly in accordance with the financial transaction protocol to transmit data to the network side server 14 over the mobile internet via the mobile communication unit 105.
- the mobile communication unit 105 can now be a unit operating a wireless cellular communication protocol for accessing the mobile terminal 10 to the Internet via the cellular wireless communication link 13.
- the mobile communication unit 105 can specifically operate Global System for Mobile (GSM), Universal Mobile Communication System (Universal Mobile) A cellular wireless communication protocol such as the Telecommunications System (UMTS), Worldwide Interoperability for Microwave Access (WiMAX), or Long Term Evolution (LTE) to implement the mobile Internet function of the mobile terminal 10.
- GSM Global System for Mobile
- Universal Mobile Universal Mobile Communication System
- UMTS Telecommunications System
- WiMAX Worldwide Interoperability for Microwave Access
- LTE Long Term Evolution
- the current various types of mobile terminals adopt a scheme in which the security element 102 is externally disposed outside the main system.
- the central processing unit 103 and the mobile communication unit 105 can be located on an integrated circuit substrate, that is, a piece.
- the security element 102 is specifically a chip that is independent of the main chip 106.
- the secure element 102 is in particular in communication with a central processing unit 103 in the main chip 106 via a Serial Peripheral Interface (SPI).
- SPI Serial Peripheral Interface
- the external placement of the security element 102 outside of the main chip 106 causes the secure element 102 and the main chip 106 to occupy a large area on the main board of the mobile terminal 10 and consume more cost.
- Embodiments of the present invention provide a mobile payment apparatus and method to reduce hardware implementation cost and area of mobile payment.
- an embodiment of the present invention provides a mobile payment device, including: a communication unit, configured to exchange payment information with a communication peer through a wireless link; a memory for storing mobile payment software; and a security component, including the first a storage module and a processor; at least one central processing unit for running general operating system software and controlling at least one of the communication unit, the memory and the secure element under the action of the general operating system software; Loading the mobile payment software from the memory into the first storage module, running the mobile payment software, and interacting with the communication unit under the action of the mobile payment software; a storage module for providing the processor with a memory space required to run the mobile payment software; wherein the security element and the at least one central processing unit are located in a first semiconductor chip of the mobile payment device Inside.
- the communication unit may include a baseband unit.
- the communication unit may further include a radio frequency unit
- the memory is located in a second semiconductor chip in the mobile payment device. Since the first semiconductor chip is independent of the second semiconductor chip, the storage unit storing the mobile payment software does not have to be integrated with the secure element executing the mobile payment software, which reduces the difficulty and complexity of hardware implementation. In particular, current memories are difficult to integrate with a first chip including a CPU due to a process, an area, etc., which employs an off-chip memory by integrating only a secure element with a CPU, and is more suitable for a mobile payment scheme.
- the memory includes a secure storage area and a common storage area that are isolated from each other; the secure storage area is used for storage The mobile payment software; the normal storage area is configured to store the general operating system software; the processor is specifically configured to load the mobile payment software from the secure storage area in the memory to the first In a storage module, the at least one central processing unit is specifically configured to read and run the general operating system software from the normal storage area in the memory.
- This implementation is equivalent to multiplexing the memory such that the general operating system software and the mobile payment software coexist in one memory and achieve secure isolation from each other, saving memory resources while ensuring security.
- the memory is dedicated to storing the mobile payment software;
- the mobile payment device further includes a common storage unit,
- the common storage unit is located in a third semiconductor chip in the mobile payment device, the common storage unit is configured to store the general operating system software;
- the at least one central processing unit is specifically configured to be used from the common storage unit
- the general operating system software is read and run.
- the implementation may physically separate the dedicated memory dedicated to storing the mobile payment software from the normal storage unit, such that operational security is further enhanced.
- the mobile payment software includes mobile payment Operating system software.
- the use of a secure and reliable mobile payment operating system software in mobile payment software can ensure operational security, and is also beneficial to implement more mobile payment application software based on the mobile payment operating system software, such as supporting different banks' services.
- the mobile payment operating system software is a COS image.
- the mobile payment software further includes at least one mobile payment application software.
- the security element further includes: a second storage module, configured to store the processor Activating a required startup program; when the security element is powered on, the processor is configured to read the startup program from the second storage module, and the mobile payment operating system is operated by the startup program Software is loaded from the memory into the first storage module and runs the mobile payment operating system software. Since the startup program required for the activation of the security element is located in a separate second storage module inside the security element, the security of the activation of the security element can be ensured.
- the processor is configured to be triggered by the payment information when the payment information is exchanged with the communication unit And loading one or more mobile payment application software of the at least one mobile payment application software from the memory into the first storage module and running the one or more mobile payment application software. Since the loading and running of the mobile payment application software is triggered by the interaction of the payment information, when there is no payment service, the related mobile payment application software may not be turned on, and the memory space of the first storage module may be saved. Especially in the case of highly integrated safety components, the space of the first storage module is very limited, and the related scheme can achieve a very good saving effect.
- the payment information includes: Communication Mobile payment instructions transmitted by the peer end to the processor via the communication unit, and mobile payment data transmitted from the processor to the communication peer via the communication unit in response to the mobile payment instruction. Therefore, the payment information includes a two-way communication process in mobile payment.
- the mobile payment data includes data that is processed by security, and the security processing includes at least one of the following: data Encryption or data integrity protection. Since the mobile payment data is processed securely, the mobile payment data sent to the communication peer is more secure when the mobile payment device is used for mobile payment.
- the processor is further configured to generate the security-processed data.
- the processor has a secure processing process, so that the security processing process is more concentrated on the processor, and no additional security hardware is needed, which can save costs.
- the processor is further configured to generate original data
- the security component further includes: a security processing module, And performing the security processing on the original data to generate the securely processed data.
- the security processing is accelerated by using a processor-independent security processing module, and the processing is more optimized.
- the security processing module may be a hardware accelerator.
- the at least one central processing unit Controlling at least one of the communication unit, the memory, and the secure element includes controlling on, controlling off, or controlling entering or exiting a low power state or controlling an operating state.
- the at least one central processing unit may be an Advanced RISC Machine (ARM) processor. The operation of other units within the system can be conveniently controlled overall by the at least one central processing unit.
- ARM Advanced RISC Machine
- the communication unit is a near field communication unit
- the communication peer is a payment terminal
- the near field communication unit is specifically configured to run short-range wireless
- a communication protocol interacts with the payment terminal for the payment information.
- the solution facilitates convenient mobile payment through a near field communication unit and a payment terminal, such as a POS machine.
- the near field communication unit comprises a near field communication baseband unit for operating a short range wireless communication protocol.
- the near field communication unit further includes a near field communication radio frequency unit for receiving or transmitting a radio frequency signal, and the radio frequency signal is converted by the near field communication radio frequency unit into a baseband signal that can be processed by the near field communication baseband unit,
- the radio frequency signal includes the payment information.
- the near field communication unit is located in the first semiconductor chip or in a mobile payment device Within the fourth semiconductor chip.
- the near field communication unit is located within the first semiconductor chip, high integration of the near field communication unit with the secure element and the at least one central processing unit may be achieved, reducing implementation costs.
- the near field communication unit is located in another fourth semiconductor chip, the design difficulty due to the need to integrate the near field communication unit can be reduced.
- the communication unit is a mobile communication
- the communication peer is a radio access network
- the mobile communication unit is configured to exchange the payment information with the radio access network by running a cellular radio communication protocol.
- the mobile communication unit comprises a mobile communication baseband unit for a cellular wireless communication protocol.
- the mobile communication unit further includes a mobile communication radio frequency unit for receiving or transmitting a radio frequency signal, and the radio frequency signal is converted by the mobile communication radio frequency unit into a baseband signal that can be processed by the mobile communication baseband unit, the radio frequency signal
- the payment information is included.
- the mobile communication unit is located in the first semiconductor chip or the fifth in the mobile payment device Inside the semiconductor chip.
- the mobile communication unit is located within the first semiconductor chip, Achieve high integration and reduce implementation costs.
- design difficulty due to integration can be reduced.
- the security element further includes: And an encryption and decryption engine, configured to perform security verification on the mobile payment software after the processor loads the mobile payment software from the memory into the first storage module, and after the security verification succeeds, indicate the The processor runs the mobile payment software, the security verification including at least one of a secure decryption or a hash check.
- the encryption and decryption engine can be a hardware accelerator.
- the mobile payment software can be run after the verification is successful, ensuring that the mobile payment software will not be tampered with before running, which is beneficial to improve the security verification. Processing performance.
- the encryption and decryption engine is further configured to perform security encryption or first hash operation on the update data. At least one of the processes is processed to obtain processed update data; the processor is further configured to write the processed update data to the memory to update the mobile payment software.
- the mobile payment software needs to be updated, through the processing of the encryption and decryption engine, it is convenient to verify the related software when the updated mobile payment software is read again, to ensure that the mobile payment software will not be tampered with, and it is better to ensure that the update is needed.
- Software security is further configured to perform security encryption or first hash operation on the update data. At least one of the processes is processed to obtain processed update data; the processor is further configured to write the processed update data to the memory to update the mobile payment software.
- the processor is further used Performing security verification on the mobile payment software after loading the mobile payment software from the memory into the first storage module, and running the mobile payment software after successful security verification, the security verification including security At least one of decryption or first hash check. Since the processor itself already has the above-mentioned security verification function, there is no need for other additional units to implement the function, which reduces the design difficulty.
- the processor is further configured to perform, by performing at least one of security encryption or first hash operation processing on the update data, the processed update data, and write the processed update data to the
- the memory is described to update the mobile payment software.
- the processor may further perform security processing on the software that needs to be updated, so as to verify the related software when the updated mobile payment software is read out again, thereby realizing more in the processor. Multi-functional integration.
- the processor writes the processed update data And when the memory is used to perform a second hash operation on the processed update data by using a key to obtain data to be stored; the memory is further configured to perform a second hash check on the to-be-stored data. After the second hash check succeeds, the processed update data is obtained, and the mobile payment software is updated by using the processed update data. Since the processor has the capabilities described above, the data written to the memory is subjected to verification by the memory to ensure the security of the memory write data.
- the processor writes the processed update data And when the memory is used to send the processed update data to the at least one central processing unit; the at least one central processing unit is further configured to use the key pair in the trusted execution environment after the processing
- the update data is subjected to a second hash operation process to obtain data to be stored, and the data to be stored is sent to the memory; there is security isolation between the trusted execution environment and the running general operating system software;
- the memory is further configured to perform a second hash check on the to-be-stored data, obtain the processed update data after the second hash check succeeds, and update the move by using the processed update data.
- Payment software is further configured to perform a second hash check on the to-be-stored data, obtain the processed update data after the second hash check succeeds, and update the move by using the processed update data.
- the update data in the solution When the update data in the solution is written from the processor to the memory, it needs to be delivered by the trusted execution environment of the at least one central processing unit, and is hashed in the trusted execution environment, so that the memory performs the corresponding hash check. Since the trusted execution environment is more trusted than the general operating system software, the security of the memory write data can be improved.
- the security element further includes a third storage module; the processor is further configured to write the processed update data into the third storage module, and send the data to the at least one central processing unit a first interrupt request; the at least one central processing unit is further configured to read the processed update data from the third storage module in response to the first interrupt request in a trusted execution environment.
- the at least one central The processing unit is further configured to run a general application software other than the mobile payment software.
- At least one central processing unit is a common central processing unit commonly used in mobile terminals, which facilitates the expansion of the solution on ordinary mobile terminals.
- the at least one central The general operating system software run by the processing unit is securely isolated from the secure element. Due to the existence of the isolation, the general operating system software is not free to access the secure element, which can improve the security of mobile payment.
- the processor is further configured to perform a second hash operation process by using a key pair update data or an erase instruction to obtain a processing result;
- the memory is further configured to use the processing result Performing a second hash check, obtaining the update data or erase command after the second hash check succeeds, and updating the mobile payment software with the update data or erasing the memory in the memory according to the erase command Erase the data corresponding to the instruction.
- the processor is further configured to send update data or an erase command to the at least one central processing unit;
- the at least one central processing unit is further configured to perform in a trusted execution environment Key pair Updating data or erasing instructions to perform a second hash operation process to obtain a processing result, and transmitting the processing result to the memory; there is security isolation between the trusted execution environment and the executed general operating system software;
- the memory is further configured to perform a second hash check on the processing result, obtain the update data or an erase command after the second hash check succeeds, and update the mobile payment software with the update data or according to the wipe In addition to the instruction to erase data corresponding to the erase command in the memory.
- the solution improves the security of data erasure in mobile payment, and the central processing unit implements secure processing, which simplifies the design of the processor.
- an embodiment of the present invention provides a method for implementing mobile payment by using a mobile payment device, including: running a general operating system software through at least one central processing unit, and controlling a communication unit and security under the function of a general operating system software. At least one of the components; loading mobile payment software from the memory into the secure element; operating mobile payment software within the secure element; the secure element and the communication unit under the action of the mobile payment software Interactive payment information, wherein the communication unit interacts with the communication peer to communicate information over a wireless link; wherein the secure element and the at least one central processing unit are located within a first semiconductor chip of the mobile payment device.
- an embodiment of the present invention provides a semiconductor chip for a mobile payment device, the semiconductor chip including a security element and at least one central processing unit, the security element including a first storage module and a processor, a first storage module, configured to provide the processor with a memory space required to run mobile payment software; the at least one central processing unit for running general operating system software; the processor for using the mobile payment software Loading from the memory of the mobile payment device into the first storage module, running the mobile payment software, and interacting with the communication unit in the mobile payment device to pay for information under the action of the mobile payment software; At least one central processing unit is further configured to control at least one of the communication unit, the memory, and the security module under the action of general operating system software.
- the mobile payment software comprises mobile payment operating system software.
- the mobile payment software further includes at least one mobile payment application software.
- the security element further includes: a second storage module, configured to store the processor Activating a required startup program; when the security element is powered on, the processor is configured to read the startup program from the second storage module, and the mobile payment operating system is operated by the startup program Software is loaded from the memory into the first storage module and runs the mobile payment operating system software.
- the processor is configured to be triggered by the payment information when the payment information is exchanged with the communication unit And loading one or more mobile payment application software of the at least one mobile payment application software from the memory into the first storage module and running the one or more mobile payment application software.
- the payment information includes: a mobile payment instruction transmitted by the communication peer to the processor via the communication unit, and mobile payment data transmitted from the processor to the communication peer via the communication unit in response to the mobile payment instruction.
- the mobile payment data includes data that is processed by security, and the security process includes at least one of the following: data Encryption or data integrity protection.
- the processor is further configured to generate the security-processed data.
- the processor is further configured to generate original data
- the security component further includes: a security processing module, Performing the security processing on the raw data to generate the securely processed data.
- the at least one central processing unit Control of at least one of the communication unit, the memory, and the secure element includes controlling on, controlling off, or controlling entering or exiting a low power state or controlling an operating state.
- the security element further includes: adding a decryption engine, configured to perform security verification on the mobile payment software after the processor loads the mobile payment software from the memory into the first storage module, and indicate the processing after the security verification succeeds The mobile payment software runs, the security verification including at least one of a secure decryption or a hash check.
- the encryption and decryption engine is further configured to perform security encryption or first hash operation on the update data. At least one of the processes is processed to obtain processed update data; the processor is further configured to write the processed update data to the memory to update the mobile payment software.
- the processor is further configured to Performing security verification on the mobile payment software after loading the mobile payment software from the memory into the first storage module, and running the mobile payment software after successful security verification, the security verification including secure decryption Or at least one of the first hash checks.
- the processor is further configured to perform security encryption or first hash operation processing on the update data. At least one of the processes obtains the processed update data, and writes the processed update data to the The memory is described to update the mobile payment software.
- the processor writes the processed update data And when the memory is used to perform a second hash operation on the processed update data by using a key to obtain data to be stored; the memory is further configured to perform a second hash check on the to-be-stored data. After the second hash check succeeds, the processed update data is obtained, and the mobile payment software is updated by using the processed update data.
- the processor writes the processed update data to
- the memory is further configured to send the processed update data to the at least one central processing unit;
- the at least one central processing unit is further configured to utilize the key pair in the trusted execution environment to process the processed Updating data to perform a second hash operation process to obtain data to be stored, and transmitting the data to be stored to the memory; there is security isolation between the trusted execution environment and the running general operating system software;
- the memory is further configured to perform a second hash check on the to-be-stored data, obtain the processed update data after the second hash check succeeds, and update the mobile payment by using the processed update data. software.
- the security element further includes a third storage module; the processor is further configured to: after the processing The update data is written into the third storage module and sends a first interrupt request to the at least one central processing unit; the at least one central processing unit is further configured to respond to the first interrupt in a trusted execution environment Requesting to read the processed update data from the third storage module.
- the at least one central processing unit It is also used to run general application software other than the mobile payment software.
- the general operating system software run by the at least one central processing unit is securely isolated from the secure element.
- the processor is further configured to perform a second hash operation process by using a key pair update data or an erase instruction to obtain a processing result;
- the memory is further configured to perform a second process on the processing result.
- Hash check, obtaining the update data or erase command after the second hash check succeeds, and updating the mobile payment software with the update data or erasing the erase command in the memory according to the erase command Corresponding data.
- the processor is further configured to send update data or an erase command to the at least one central processing unit; the at least one central processing unit is further configured to utilize in a trusted execution environment The key performs a second hash operation on the update data or the erase instruction to obtain a processing result, and sends the processing result to the memory; the trusted execution environment and the executed general operating system software are secure Isolating; the memory is further configured to perform a second hash check on the processing result, obtain the update data or an erase command after the second hash check succeeds, and update the mobile payment software by using the update data Or erasing data corresponding to the erase command in the memory according to the erase command.
- the technical solution provided by the embodiment of the invention can reduce the hardware implementation cost and area while ensuring the security of the mobile payment, better adapt to the requirement of miniaturization of the mobile terminal in the mobile payment, and facilitate the popularization and expansion of the mobile payment.
- FIG. 1 is a simplified schematic diagram of a simplified mobile terminal structure for mobile payment provided by the prior art
- FIG. 2 is a simplified schematic diagram of a structure of a mobile payment device according to an embodiment of the present invention.
- FIG. 3 is a simplified schematic diagram of a mobile payment process according to an embodiment of the present invention.
- FIG. 4 is a simplified schematic diagram of a mobile payment software performing a secure access operation on a secure storage area of a memory according to an embodiment of the present invention
- FIG. 5 is a simplified schematic diagram of another mobile payment software performing a secure access operation on a secure storage area of a memory according to an embodiment of the present invention
- FIG. 6 is a simplified schematic diagram of a system structure for mobile payment in a mobile payment device according to an embodiment of the present invention.
- FIG. 7 is a schematic structural diagram of a memory for mobile payment according to an embodiment of the present invention.
- FIG. 8 is a simplified schematic diagram of a software system architecture for mobile payment according to an embodiment of the present invention.
- FIG. 2 is a schematic diagram of a mobile payment device 20 according to an embodiment of the present invention.
- the mobile payment Device 20 can be located within a mobile terminal 21.
- the mobile terminal 21 can be a user equipment (User Equipment, UE), such as a mobile phone, a tablet computer, and the like.
- UE User Equipment
- the mobile payment device 21 may specifically be a chip or a chipset or a circuit board on which a chip or a chipset is mounted. The chip or chipset or board with the chip or chipset can operate with the necessary software drivers.
- the mobile payment device 20 may include: a near field communication unit 201 that interacts with a payment terminal, such as a POS, located outside the mobile terminal 21 for accessing the Internet to implement a mobile payment function by operating a short-range wireless communication protocol, to Implement offline payments.
- the mobile communication unit 202 interacts with the radio access network by running a cellular radio communication protocol, such as a base station in the radio access network, to access the Internet through the radio access network including the base station, to finally implement the mobile communication unit. 202 exchanges information with a server having a payment function in the Internet, thereby implementing online payment. It can be understood that the mobile payment device 20 can include one of the near field communication unit 201 or the mobile communication unit 202, that is, any of offline payment or online payment.
- the short-range wireless communication protocol operated by the near-field communication unit 201 can adopt Radio Frequency Identification (RFID) technology, and specifically supports various types of RFID protocols, such as the European Computer Manufactures Association (ECMA). Standard protocols, in addition to other types of short-range communication protocols such as Bluetooth communication, infrared communication, and Wireless Fidelity (WiFi) protocols.
- RFID Radio Frequency Identification
- ECMA European Computer Manufactures Association
- Standard protocols in addition to other types of short-range communication protocols such as Bluetooth communication, infrared communication, and Wireless Fidelity (WiFi) protocols.
- the cellular wireless communication protocol operated by the mobile communication unit 202 may be any one or more cellular wireless communication protocols such as GSM, UMTS, WiMAX or LTE to implement the wireless access network through the mobile communication unit 202 and the cellular mobile communication network. Communication.
- the base station in the radio access network is a network element in the radio access network that implements the foregoing communication function, and the base station can be in various forms, such as a NodeB, an eNodeB, and the like.
- the radio access network including the base station will eventually connect to a server in the network, i.e., a cloud side server, to enable the server to interact with the payment information of the mobile payment device 20.
- the near field communication unit 201 or the mobile communication unit 202 may include a baseband unit that operates a communication protocol. Alternatively, the near field communication unit 201 or the mobile communication unit 202 may further include a radio frequency unit.
- the radio unit can be used to receive radio frequency signals and convert the radio frequency signals into baseband signals for use.
- the payment information is included in the radio frequency signal to be acquired by the near field communication unit 201 or the mobile communication unit 202.
- the mobile payment device 20 of FIG. 2 also includes a memory 203, a secure element 204, and at least one central processing unit 205 that can be used to store mobile payment software.
- At least one central processing unit 205 is configured to run general-purpose operating system software, such as an operating system such as an Android operating system, a Windows operating system, or an iOS operating system, which can be used to support general non-mobile payment application software.
- general-purpose operating system software such as an operating system such as an Android operating system, a Windows operating system, or an iOS operating system, which can be used to support general non-mobile payment application software.
- Universal operating system software is a common software platform that runs a variety of applications.
- the central processing unit 205 can be implemented based on the ARM architecture or the Intel X86 architecture or the Million Instructions Per Second (MIPS) architecture, etc., which is not limited in this embodiment.
- At least one central processing unit 205 controls the near field communication unit 201, the mobile communication unit 202, the memory 203, and the secure element 204 under the influence of the operating system software.
- Specific control procedures may include: controlling on, controlling off, or controlling entering or exiting a low power state. Therefore, the central processing unit 205 running the general operating system can implement unified control of other parts of the mobile payment device 20, so that these parts are normally powered on and off, entering or exiting a low power consumption state, such as entering or exiting a sleep state. Any component of a communication unit, memory, or secure element consumes less power in a low power state than when the component is operating. Moreover, the control process for any of the components may also include other control operations, such as controlling the operating state.
- the control working state may be an adjustment of the operating voltage, the clock frequency, or the processing rate when the component is in operation, which is not limited in this embodiment.
- control operations of other components in the general central processing unit in the prior art may be made to be made to be made to be made to the control operations of other components in the general central processing unit in the prior art.
- the secure element 204 can include a first memory module 2041 and a processor 2042.
- the memory 203 may store the mobile payment software 2030.
- the processor 2042 is configured to load the mobile payment software 2030 from the memory 203 into the first storage module 2041, run the mobile payment software 2030, and
- the mobile payment software 2030 interacts with at least one of the near field communication unit 201 or the mobile communication unit 202 to pay for information.
- the first storage module 2041 provides the processor 2042 with the memory space required to run the mobile payment software 2030.
- the first storage module 2041 can be a random access memory (RAM).
- the memory 203 can be a read-only memory (ROM).
- the mobile payment software 2030 stored in the memory 203 may include a mobile payment operating system software 2031, which is different from ordinary operating system software, which is only one for running mobile.
- the operating system platform of the payment application software 2032 makes the mobile payment more reliable.
- the mobile payment operating system software 2031 may be a Chip Operating System (COS).
- COS is also called a COS image, and can be equivalent to an operating system software that resides in a smart card or an integrated circuit (IC) card.
- the secure element 204 is equivalent to having a resident smart card or a financial card.
- Function which is used to provide data required for mobile payment services such as credit card services to external POS machines, card readers or financial servers on the cloud side, such as data related to banking financial services or personal account data of users, such as personal accounts and passwords. And various types of verification information required for the bank server to verify the personal account.
- the COS image is also an operation platform for receiving and processing external payment information, such as a financial server or a card reader, and various payment information sent by the POS device to the secure element 204, and can be used to execute various instructions sent by the outside world, such as authentication operations.
- the secure element 204 generally uses a COS based on the JAVA computer programming language as a security system.
- the COS can be preset not only in the secure element 204, but also the mobile payment device 20 can dynamically download and install various mobile payment application software 2032 based on the COS. Such as various types of financial applications.
- the specific design of the COS is part of the prior art and is outside the scope of this application.
- the mobile payment software 2030 includes a plurality of mobile payment application software 2032 in addition to the mobile payment operating system software 2031.
- a mobile payment application 2032 is used for a class of mobile payment functions.
- each mobile payment application 2032 can be a bank related Software for implementing software functions related to the bank, such as account, password, authentication and authentication related information related to the bank, and functions related to the bank's featured services.
- the application of mobile payment is not limited to the banking business, but also includes, but is not limited to, debit or credit card services, or other types of mobile payments, such as social security cards, transportation cards, or IC card payment services within an organization. This example does not limit this.
- the secure element 204 and the at least one central processing unit 205 are located within a first semiconductor chip IC1 in the mobile payment device 20, which is also referred to as the main chip of the mobile payment device 20.
- the secure element 204 with the at least one central processing unit 205 using the same semiconductor master chip IC1, the hardware implementation cost and area of mobile payment will be reduced without having to secure the payment related hardware as in the prior art.
- the functional unit and the main chip are respectively formed into two independent chips, so that the arrangement of the more integrated main chip IC1 on the main board of the mobile payment device 20 is also simpler.
- the near field communication unit 201 may be located in another fourth semiconductor chip IC4 in the mobile payment device 20.
- the near field communication unit 201 can also be located in the first semiconductor chip IC1 (not shown), except that the fourth semiconductor chip IC4 shown in FIG. 2 or FIG. 6 is used to implement the near field communication unit 201. In order to further realize the integration of the main chip IC1 and reduce the implementation cost.
- the mobile communication unit 202 can also be located within the first semiconductor chip IC1 as shown in FIG. 6, or otherwise located in another fifth semiconductor chip IC5 in the mobile payment device 20 as shown in FIG. Whether or not the near field communication unit 201 or the mobile communication unit 202 is integrated into the main chip IC1 depends on the specific design of those skilled in the art.
- a semiconductor chip also referred to simply as a chip, may be a collection of integrated circuits fabricated on an integrated circuit substrate (typically a semiconductor material such as silicon) using an integrated circuit process, the outer layer of which Typically packaged by a semiconductor package material.
- the integrated circuit may include a Metal-Oxide-Semiconductor (MOS) transistor, a bipolar transistor or a diode, or the like.
- MOS Metal-Oxide-Semiconductor
- the semiconductor chip can work independently or under the influence of necessary driving software to realize various functions such as communication, calculation, or storage.
- the memory 203 may be Specifically, it is located in the second semiconductor chip IC2 in the mobile payment device 20. Alternatively, the memory 203 may also be integrated into the main chip IC1 (not shown) together with the near field communication unit 201 or the mobile communication unit 202, at which time the memory 203 and the secure element 204 may be regarded as being A system that implements secure payments. However, in general, similar to the scheme of FIG. 2 or FIG. 6, the memory 203 is implemented in the art by using the second semiconductor chip IC2 independent of the main chip IC1.
- the memory 203 usually exists in the form of a flash memory when integrated in the main chip IC1, but the flash memory storage space is usually very limited, and if a large storage space is to be realized, the cost is greatly increased and realized. complex. If the flash memory 203 is implemented by using the independent second semiconductor chip IC2, the implementation cost is reduced and the design is simpler, and the storage capacity is more satisfied. In particular, the current memory is difficult to integrate with the main chip IC1 due to the production process, area, etc., and only the security element 204 is integrated with at least one central processing unit 205, and the main chip independent memory 203 is used, which is more suitable for existing mobile payment. Program.
- the memory 203 can also be multiplexed by the mobile payment software 2030 and other software.
- the memory 203 includes a secure storage area 203A and a normal storage area 203B that are isolated from each other.
- the secure storage area 203A is used to store the mobile payment software 2030 for storing the aforementioned general operating system software.
- the at least one central processing unit 205 is specifically configured to read and run the general operating system software from the normal storage area 203B in the memory 203, and the processor 2042 is specifically configured to use the mobile payment software. 2030 is loaded from the secure storage area 203A into the first storage module 2041.
- the isolation indicates that the general operating system software and the mobile payment software 2030 are not mixed together, but exist in one memory 203 but are accessed independently by each other, and save memory under the premise of ensuring security. Resources.
- the memory 203 at this time may be an embedded multimedia card (Embedded Multi Media Card, eMMC), the secure storage area 203A may be a Replay Protect Memory Block (RPMB) of the eMMC memory 203.
- eMMC embedded Multi Media Card
- RPMB Replay Protect Memory Block
- the memory 203 can also be other types of storage devices, which is not limited in this embodiment.
- the memory 203 may be dedicated to storing the mobile payment software 2030, that is, the memory 203 does not store other software related to mobile payment, including general operating system software.
- the mobile payment device 20 also includes a normal storage unit 206 at this time. As shown in FIG. 2, the normal storage unit 206 is located in a third semiconductor chip IC3 in the mobile payment device 20, and the normal storage unit 206 is used to store the general operating system software.
- the at least one central processing unit 205 is specifically configured to read and run the general operating system software from the normal storage unit 206.
- the dedicated memory 203 is physically isolated from the normal storage unit 205, so that the operational security is further improved.
- the normal storage unit 205 can be an eMMC as previously described.
- the dedicated memory 203 may be a flash memory that is independent of the main chip IC1. However, the specific storage type of the normal storage unit 205 and the dedicated storage 203 is not limited in this embodiment.
- the security element 204 further includes: a second storage module 2043, configured to store a startup program required for starting the processor 2042, such as a boot code at startup.
- the processor is configured to read the startup program from the second storage module 2043, and the mobile payment operating system software 2031, such as The COS image is loaded from the memory 203 into the first storage module 2041 and runs the mobile payment operating system software 2031. Since the startup program required for the activation of the security element 204 is located in the second storage module 2043 inside the security element 204, the second storage module 2043 is dedicated to the activation of the security element 204 and is not external to any other security element 204. The software runs programs or hardware to access it at will, ensuring security.
- the processor 2042 may be triggered by the payment information when interacting with the near field communication unit 201 or the mobile communication unit 202, and the One or more mobile payment application software 2032 of one less mobile payment application 2032 is loaded from the memory 203 into the first storage module 2041 and runs the one or more mobile payment application software 2032. Since the loading and running of the mobile payment application software 2032 is triggered by the interaction of the payment information, when the payment service is not available, the related mobile payment application software 2032 may not be turned on, and the memory space of the first storage module 2041 can be saved.
- the mobile payment application software 2032 is loaded in a dynamic loading manner, that is, only the selected application software is loaded from the external memory 203 into the corresponding first storage module 2041, that is, the RAM. Other applications that are not needed are not loaded into the RAM, ensuring that the occupied space in the RAM is only used to hold the COS image and the program files of 1 to 2 applications without causing the RAM to be occupied. many.
- the scheme in which the processor 2042 interacts with the communication peer (such as the payment terminal or the radio access network) through the communication unit (such as the near field communication unit 201 or the mobile communication unit 202) to the payment information belongs to the content of the mobile payment protocol, and the solution thereof is There are many kinds of prior art, and the process may be similar to the credit card process.
- Each different service provider such as a bank, public transportation department, etc., may have its own mobile payment handshake communication protocol for implementing a payment handshake of the processor 2042 in the secure element 204 via the communication unit to the communication peer, such as personal privacy. Delivery of information, transmission of secure data, etc.
- the present embodiment provides a mobile payment flow chart as shown in FIG.
- various types of mobile payment related information transmitted between the mobile payment device 20 and the payment terminal through a wireless link can be regarded as payment information.
- the brief steps of the payment process may include: S31, the central processing unit 205 runs the general operating system software, and controls the communication unit and the secure element 204 under the action of the general operating system software. The control can be to control on, off, enter, or exit a low power state. S32, the secure element 204 loads and runs the mobile payment software 2030 from the memory 203. S33.
- the communication unit receives the mobile payment instruction from the communication peer end via the wireless communication link.
- the command may be a request message for requesting the mobile payment device 20 to perform mobile payment.
- the message may be included in an air interface signaling, and the specific implementation and signaling structure of the air interface signaling may refer to the content of the existing wireless communication protocol.
- the mobile payment The instructions may include the necessary authentication and authentication requests in addition to the request to initiate the payment service.
- the specific content may refer to the prior art in the field of mobile payment, and is not discussed in the present application.
- S34. The communication unit obtains the mobile payment instruction by parsing the air interface signaling by running the wireless communication protocol software, and transmits the mobile payment instruction to the processor 2042 in the secure element 204.
- S35 The processor 2042, after being driven by the mobile payment software 2030, sends mobile payment data to the communication unit in response to the mobile payment instruction.
- the mobile payment data may include proof data of a user identity, such as a bank card number, an account number, personal confidential information, or a ciphertext required for various banking transactions, etc., which is similar to credit card information for credit card payment, and is used to be Read by the communication peer.
- the communication unit runs a wireless communication protocol, and the mobile payment data is packaged into air interface signaling for transmission to the communication peer.
- the communication peer transmits the mobile payment data to the server.
- the server processes the mobile payment data to complete the payment service.
- the communication peer end is a payment terminal such as a POS machine, and the payment terminal transmits the mobile payment data to the cloud side server through the Internet.
- the mobile communication unit 202 acts as a communication unit that will communicate mobile payment data to the server over the wireless access network.
- the existing payment solution such as the existing online payment service of the bank, which is not described in this application.
- the transaction success information may be returned to the POS machine that uses the offline payment and displayed on the POS machine, or the server directly returns the transaction success information to the mobile communication unit of the mobile payment device 20 when the online payment is adopted.
- the payment information includes a two-way communication process for implementing mobile payment handshake communication between the cloud server on the network side and the mobile payment device 20, and the handshake process of the two-way communication is different according to different service providers and processors 2042.
- the mobile payment application 2032 differs and typically depends on different service providers.
- the processor 2042 may be via a communication interface included in the secure element 204.
- 2044 interacts with the near field communication unit 201 (located in IC 4) outside the main chip IC1 for the payment information.
- the communication interface 2044 can follow a Single Wire Protocol (SWP).
- SWP Single Wire Protocol
- the communication interface 2044 can also use other interface protocols to implement the transmission of data or information.
- the processor 2042 can implement information interaction with the near field communication unit 201 via an on-chip connection line, such as the on-chip bus 207 in FIG.
- Communication interface 2044 is a standard SWP interface that can be implemented using the standard SWP protocol. How the near field communication unit 201 transmits data acquired from the POS to the secure element 204 based on the SWP protocol is already an existing mature solution and is outside the scope of this application.
- the near field communication unit 201 and the at least one central processing unit 205 may be connected by an Inter-Integrated Circuit (I2C) interface to transmit other data.
- I2C Inter-Integrated Circuit
- Other interfaces may also perform similar functions and should not be excluded. Outside the implementation.
- the near field communication unit 201 may internally store a routing table, and the near field communication unit 201 may identify the type of communication initiated by the communication peer. If the initiated service is a payment service, the relevant payment service related data is obtained by querying the routing table.
- the near field communication unit 201 finds that the initiated service is a non-payment type service, the near field communication unit 201 forwards the data of the related non-payment type service to the at least one central processing unit 205 through the I2C interface by querying the routing table. For example, if the initiated service belongs to the credit card machine in the business enterprise and the credit card machine of the statistical work time, the near field communication unit 201 can send the data to the at least one central processing unit 205 through the I2C interface, and in the general operating system, such as In the Android environment, do a credit card simulation application.
- the processor 2042 can also implement interactive payment information with the mobile communication unit 202 via an on-chip bus 207.
- the on-chip bus 207 can also be coupled to the central processing unit 205 and the storage interface 208.
- the storage interface 208 is used by the main chip IC1 to exchange data with the memory 203 in the second chip IC2.
- the processor 2042 provides the mobile payment to the communication peer.
- the data may be securely processed, and the security process may include at least one of the following: data encryption or data integrity protection.
- the processor 2042 may further generate the security-processed data under the driving of the mobile payment software 2030, that is, the processor may perform security processing by using a software driver to ensure that the processed mobile payment data is transmitted to server.
- the server can decrypt and de-protect the mobile payment data accordingly to verify whether the mobile payment data has been tampered with. If the mobile payment data has been tampered with, the server may return the previously mentioned payment failure information to ensure the security of the mobile payment process.
- the processor 2042 may only generate raw data that is not securely processed for mobile payment data.
- the secure processing is performed on the raw data by an independent security processing module 2045 of the secure element 204 to generate the securely processed data.
- the security processing module 2045 can be hardware independent of the processor 2042, and can be a hardware accelerator including a circuit structure for implementing acceleration of security processing, so that the processing implementation is more optimized.
- the processor 2042 In addition to the security processing of the data interacting with the communication peer, the processor 2042 also needs to read the mobile payment software 2030 from the memory 203, and the reading and writing of the mobile payment software 2030 can also be secured. Protection for better security.
- the secure element 204 further includes an encryption and decryption engine 2046 for the movement after the processor 2042 loads the mobile payment software 2030 from the memory 203 into the first storage module 2041.
- the payment software 2030 performs security verification and, after successful security verification, instructs the processor 2042 to run the mobile payment software 2030, the security verification including at least one of secure decryption or first hash check.
- the encryption and decryption engine may be a hardware accelerator including a circuit structure.
- the hardware form encryption/decryption engine 2046 stands on the processor 2042 and is dedicated to implementing the security verification function, it can be ensured that the mobile payment software 2030 is only run after the verification is successful, avoiding the mobile payment operating system software in the mobile payment software 2030.
- the 2031 or mobile payment application software 2032 has been tampered with to improve the processing performance during security verification.
- the secret engine 2046 can also be used to perform at least one of security encryption or first hash operation processing on the update data.
- the processor 2042 is further configured to write the processed update data to the memory 203 to update the mobile payment software 2030.
- the data update can be an update to the COS image or an update to any of the mobile payment application software 2032.
- the content of the update data may include an upgrade file for the COS image or mobile payment application software 2032, and may also include an update of information for data encryption or data integrity protection of the mobile payment data, such as an upgrade of the key,
- the recording file of the mobile payment may be included, such as personal information change, transaction log, etc., and the content of the update data is not limited in this embodiment.
- the functionality of the encryption and decryption engine 2046 may also be replaced by the processor 2042, in which case a separate hardware encryption and decryption engine 2046 would not be required to read from or write to the memory 203.
- the mobile payment software 2030 does the security processing, but the processor 2042 itself integrates the security function.
- the processor 2042 may further perform a second hash operation process on the processed update data by using the key Krpmb when the processed update data is written to the memory to obtain a to be stored. data.
- the second hash operation process may be similar to the previously mentioned first hash operation process, but the keys used to specifically perform the two hash processes are generally different.
- the update data may be encrypted by using the key Krpmb in the second hash operation to obtain a digest value, and the digest value and the update data are combined to generate the to-be-stored data, and the digest value may also be an information authentication code (Messape). Authenticator Code, MAC) signature.
- the memory 203 is further configured to perform a second hash check on the to-be-stored data, where the second hash check is a process corresponding to the second hash operation process, and is used to verify that the second hash operation is performed. Whether the processed data to be stored has been tampered with, specifically referring to the prior art of verifying the MAC signature.
- the memory 203 obtains the processed update data after the second hash check succeeds, and updates the mobile payment software 2030 with the processed update data.
- the secure storage area 203A is used to store the mobile payment software 2030.
- the processor 2042 needs to verify the signature of the command in operations such as writing or erasing the secure storage area 203A, which is the key Krpmb.
- eMMC The memory 203 verifies whether the write command data packet sent by the processor 2042 is correct according to the preset key Krpmb, and each write command data packet may include a partial data packet of all update data.
- the specific hash check processing algorithm using the key Krpmb may be a Hash-based Message Authentication Code Secure Hash Algorithm (HMAC SHA) 256 algorithm.
- HMAC SHA Hash-based Message Authentication Code Secure Hash Algorithm
- each eMMC memory 203 unique key Krpmb can be programmed into the eMMC memory 203 when the eMMC memory 203 is produced, and the key Krpmb can also be programmed or recorded to the secure element.
- 204 specifically can be programmed in the processor 2042 of the secure element 204 or other hardware circuits outside the programming processor 2042 by electronic fuse (eFuse) technology, and the key Krpmb is managed and used by the secure element 204. .
- managing and using the key Krpmb in the security zone (Trustzone, TZ) of the central processing unit 205 is a more common The form of implementation.
- the TZ is a Trust Execute Environment (TEE).
- TEE Trust Execute Environment
- an environment formed by a software operation is a software system that can exchange data with other software or hardware systems outside.
- the trusted execution environment executed by the central processing unit 205 is securely isolated from the general operating system software (such as the Android system environment) also operated by the central processing unit 205, which are two independent software systems.
- the security isolation between the trusted execution environment and the general operating system software is good, and the running programs of the general operating system software and the general application software based on the operating system cannot be accessed at will.
- This trusted execution environment can then transfer data to and from the environment formed by the processor 2042 running the mobile payment software 2030, ie, with the secure element 204.
- the general application software may include various types of non-secure payment related Software, such as instant messaging software, games, office software, e-book software or audio and video streaming media players.
- management of the key Krpmb can be implemented in a trusted execution environment.
- the key Krpmb can be programmed in the hardware circuit associated with the central processing unit 205, such that various types of non-secure software under the general operating system software (such as the Android system) of the central processing unit 205 do not know the Krpmb, so
- the secure storage area 203A of the eMMC memory 203 performs a write operation.
- the general operating system software of the central processing unit 205 and the running programs of various general application softwares based on the operating system are completely accessible. Since the general operating system software is securely isolated from the secure element 204, the general operating system software cannot access the secure element arbitrarily, and the mobile payment security can be improved.
- the trusted execution environment may provide a user interface (UI) of the visualized bank payment or other financial service, such that the user inputs an instruction through the UI, such that the instruction is transmitted to the secure element 204 through the trusted execution environment.
- the user is allowed to complete the information interaction with the secure element 204 through the UI.
- the UI is a trusted UI that is distinct from the normal UI provided by the general operating system software and allows the user-entered mobile payment password to be sent to the secure element 204 via a relatively secure trusted execution environment, which then includes the mobile payment password.
- the information is encrypted and transmitted to the server on the network side through the near field communication unit 201 or the mobile communication unit 202.
- the memory 203 is an eMMC as an example.
- a software architecture diagram for accessing the secure storage area 203A of the eMMC memory 203 according to an embodiment of the present invention is shown. .
- the access may include reading data from the secure storage area 203A or writing data to the secure storage area 203A (secure data update or upgrade), and the unit of reading or writing may be a fixed unit of length.
- the software architecture includes mobile payment software 2030, which is executed by secure element 204.
- Mobile payment software 2030 provides card-swapping related functions similar to resident smart cards or IC cards, and may include the aforementioned mobile payment operating system software 2031 and mobile payment. Use software 2032.
- the data 410 is data to be updated or upgraded, and the data 410 is processed by hash calculation.
- the processed data 411 includes data 410 as plaintext data and a hash value (also referred to as a digest of data 410) 410A of the plaintext data 410.
- the data 411 is then securely encrypted within the secure environment, and the data 411 can be specifically encrypted by the Kse key to obtain the ciphertext data 412.
- the Kse key may be one or more sets of keys, and the secure encryption encryption algorithm may be any symmetric encryption algorithm or asymmetric encryption algorithm.
- an available encryption algorithm may be an Advanced Encryption Standard (AES), which is not limited in this embodiment.
- AES Advanced Encryption Standard
- the secure element 204 can then transmit the ciphertext data 412 and the write address to the central processing unit 205 via the system bus 207 as shown in FIG. 6, ie the ciphertext data 412 and its write address are transferred from the mobile payment software 2030 environment to The central processing unit 205 is generated in the trusted execution environment 2051.
- the central processing unit 205 performs a second hash operation on the ciphertext data 412 and its write address in the generated trusted execution environment 2051.
- the ciphertext data 412 or a portion of the ciphertext data 412 may be encrypted using the key Krpmb.
- the hashed digest value that is, the MAC signature
- the encryption algorithm may be a hash algorithm as described in the previous embodiment, such as the HMAC SHA 256 algorithm.
- the second hash operation process may also be other processing algorithms that satisfy the data security requirements of the secure storage area 203A of the eMMC memory 203.
- the ciphertext data 412 and its write address as data can be divided into a plurality of sections, each section being processed in parallel. As shown in FIG. 4, the trusted execution environment 2051 includes a plurality of queues L1, . . .
- each queue such as queue L1
- each queue includes a portion of a packet L11 and a verification portion L12, wherein the verification portion L12 is a key Krpmb.
- Each queue is then transferred from the trusted execution environment 2051 to the general operating system software 2052, typically to the kernel (Kernel) of the general operating system software 2052, which is typically transparent, ie, the general operating system software 2052 The data content will not be modified.
- each The queues L1, ..., LN are converted into RPMB data D that can be read by the eMMC memory 203, D can also be divided into multiple segments or queues, such as D1, ...
- the illustrated storage interface 208 is transmitted to the eMMC memory 203.
- the queue L1 is processed by the eMMC protocol command to obtain the data D1, . . . DN conforming to the specification of the storage interface 208, but the original data content is not subjected to any processing or modification.
- the eMMC memory 203 holds the key Krpmb, gets the queue L1 based on the data D1, and performs a MAC signature check on the check portion L12 in the queue L1 using the key Krpmb.
- the key Krpmb is used to encrypt the packet L11 in the queue L1 to obtain a digest value, which is compared with the verification portion L12 to obtain a verification result. If the check passes, the ciphertext data 412 or its portion is obtained based on the plurality of sub-packets L11, and the corresponding write address, and the ciphertext data 412 or a portion thereof is written to the secure storage area 203A of the eMMC memory 203 in accordance with the write address. , for example, in RPMB.
- the data queue sent by the eMMC memory 203 to the general operating system software 2052 and transmitted to the trusted execution environment 2051 via the universal operating system software 2052 is encrypted by the key Krpmb, including the packet L11 carrying the data content and the verification generated by the encryption. Part L12.
- the central processing unit 205 encrypts the packet L11 in the cached queue L1 by using the key Krpmb to obtain a digest value, and the digest value is compared with the verification part L12 to check whether the data is verified. Was tampered with.
- the security element 204 specifically the encryption/decryption engine 2046 or the processor 2042 as described above, obtains the ciphertext data 412 through the system bus 207 or other interface in the environment provided by the mobile payment software 2030, and utilizes the Kse key.
- the resulting data 410 and the hash value 410A of the data 410 are securely decrypted.
- the secure element 204 further hashes the hash value 410A and confirms that the relevant data has not been tampered with after the verification is successful, thereby achieving a successful read. If any of the hash check and the secure decryption are unsuccessful, the associated data can be considered tampering and the data read this time is not trusted, then the processor 2042 in the secure element 204 can decide to discard the data.
- the processor 2042 may be when the data is not trusted.
- the central processing unit 205 reports an error or an alarm, which is not limited in this embodiment.
- either the mobile payment operating system software 2031, such as a COS image, or the read and write flow of the mobile payment application 2032 may be similar to that of FIG.
- the data is written to the memory 203 as an example.
- the processor 2042 may also generate an erase command.
- the instruction carries an address of data that needs to be erased.
- the instructions are transmitted by the processor 2042 to the central processing unit 205, i.e., by the mobile payment software environment 2030, to the trusted execution environment 2051.
- the instructions may be encrypted (hash processing) by the central processing unit 205 using the key Krpmb in the trusted execution environment 2051 to obtain a digest value that is passed along with the instructions to the memory 203 via the general operating system software 2052.
- the memory 203 adopts a similar verification method as described above, that is, the instruction is encrypted (hash processed) with the same key Krpmb, and the obtained result is compared with the digest value to determine whether the instruction passes the verification.
- the memory 203 can erase the corresponding data according to the address in the instruction.
- the key Krpmb encryption may also be processed by the processor 2042 in the secure element 204 instead of being executed by the central processing unit 205 in the trusted execution environment 2051.
- the erased data may be part of the data of the mobile payment software 2030 stored in the memory 203.
- the memory 203 can erase part of the data of the mobile payment operating system software 2031, or move all or part of the data of the payment application software 2032, in response to the instructions and in accordance with the address in the instructions.
- the above solution may be applicable to the case where the eMMC memory 203 is multiplexed by the mobile payment software 2030 and the general operating system software 2052. It can be seen that unless the keys Krpmb and Kse are cracked, it is difficult for non-secure software to access the eMMC.
- the secure storage area 203A of the memory 203 allows for better privacy and integrity of the data.
- the key Kse is the most important means for generating ciphertext in the secure element 204 and preventing intrusion.
- the embodiment of the present invention can integrate the secure element 204 in the main core IC1 slice with respect to the scheme of interacting data between the CPU of the main chip and the secure element located outside the main chip by the SPI, and the secure element 204 via the bus 207
- the data transfer is implemented between the trusted execution environment 2051 of the central processing unit 205, and the security is better.
- a third storage module 2047 can be included.
- the processor 2042 may first write the data to the third storage module 2047 and send it to the central processing unit 205 on the bus 207.
- An interrupt request is requested to request the central processing unit 205 to read the data in the third storage module 2047.
- the interrupt request may include an address of the read data in the third storage module 2047.
- central processing unit 205 can read the corresponding data from third storage module 2047 in response to the interrupt request.
- the third storage module 2047 can be a RAM, such as Inter-Process Communication (IPC) RAM. Alternatively, the third storage module 2047 may also be another type of memory such as a cache.
- IPC Inter-Process Communication
- the third storage module 2047 may also be another type of memory such as a cache.
- the memory storing the mobile payment software 2030 and the general operating system software 2052 can be physically isolated, and the basic flow of writing or reading of the data can be simplified.
- the memory 203 is located in the second semiconductor chip IC2, and specifically may be an exclusive OR (Nor) flash memory.
- the data is 410 is the data to be updated or upgraded, and the data 410 is subjected to hash calculation processing to obtain the processed data 411, and the data 411 includes the data 410 as the plaintext data and the hash value 410A of the data 410.
- the data 411 is then securely encrypted within the secure environment, and the data 411 can be specifically encrypted by the Kse key to obtain the ciphertext data 412.
- the ciphertext data 412 is then written directly to the memory 203.
- the data reading process is opposite to the data writing process, and will not be described in detail in this embodiment.
- the memory 203 is a storage device dedicated to mobile payment.
- the forwarding of the trusted execution environment 2051 is not required, and the security element 204 can directly write or read various types of data, including COS, to the memory 203.
- the processor 2042 in the secure element 204 can send an erase command to the memory 203, where the address carries the address of the data to be erased, and the memory 203 can directly directly address the relevant address after receiving the instruction. Data is erased to improve security.
- mobile payment is a broad definition, which includes not only mobile payment services in commercial and financial fields, but also other types of payment services such as public transportation, ID cards, and social security cards. That is to say, through mobile payment, the mobile terminal can connect with the communication peer to finally realize the interaction payment information with the server, and realize data transaction, data exchange or data settlement associated with one or more accounts in the mobile terminal.
- the unit of the data transaction, the exchange, or the data settlement may include not only the currency, but also other units that can be used for realizing payment, redemption, or transaction settlement, such as a virtual currency, various types of credits, or a credit line. This embodiment does not limit this.
- the account includes, but is not limited to, a personal account, a group account, or an organizational account.
- the mobile payment implementation is more flexible, and the execution subject is a mobile terminal, which can better meet the requirement of performing payment anytime and anywhere.
- the number of central processing units 205 may be multiple.
- a plurality of central processing units 205 are handed over to other components of mobile payment device 20, such as secure element 204.
- Mutual data may refer to any one or more of the plurality of central processing units 205 that interact with data of the other components.
- the plurality of central processing units 205 can be simultaneously turned on or partially turned on, and mutually cooperatively cooperate to implement the trusted execution environment 2051, the general operating system software 2052, and other application software.
- the mobile payment device 20 may further include an image processing unit (GPU), an audio processing unit, a power consumption management unit (PMU), or a global positioning system (GPS), and the like.
- GPU image processing unit
- PMU power consumption management unit
- GPS global positioning system
- the mobile terminal 21 in addition to the mobile payment device 20 mainly including various types of circuits, a touch screen for input, a display, and other necessary sensors such as a gravity accelerometer, a gyroscope, or a photo sensor may be included.
Landscapes
- Engineering & Computer Science (AREA)
- Business, Economics & Management (AREA)
- Theoretical Computer Science (AREA)
- Accounting & Taxation (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Strategic Management (AREA)
- General Business, Economics & Management (AREA)
- Computer Networks & Wireless Communication (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Finance (AREA)
- General Engineering & Computer Science (AREA)
- Software Systems (AREA)
- Signal Processing (AREA)
- Mathematical Physics (AREA)
- Telephone Function (AREA)
- Stored Programmes (AREA)
- Storage Device Security (AREA)
- Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
- Cash Registers Or Receiving Machines (AREA)
Abstract
Description
Claims (30)
- 一种移动支付装置,其特征在于,包括:通信单元,用于通过无线链路与通信对端交互支付信息;存储器,用于存储移动支付软件;安全元件,包括第一存储模块和处理器;至少一个中央处理单元,用于运行通用操作系统软件,并在通用操作系统软件的作用下控制所述通信单元、存储器和所述安全元件中的至少一个;所述处理器用于将所述移动支付软件从所述存储器加载到所述第一存储模块中,运行所述移动支付软件,并在所述移动支付软件的作用下与所述通信单元交互所述支付信息;第一存储模块,用于为所述处理器提供运行所述移动支付软件所需的内存空间;其中,所述安全元件与所述至少一个中央处理单元位于所述移动支付装置中的第一半导体芯片内。
- 根据权利要求1所述移动支付装置,其特征在于,所述存储器位于所述移动支付装置中的第二半导体芯片内。
- 根据权利要求2所述移动支付装置,其特征在于,所述存储器包括互相隔离的安全存储区域和普通存储区域;所述安全存储区域用于存储所述移动支付软件;所述普通存储区域用于存储所述通用操作系统软件;所述处理器具体用于将所述移动支付软件从所述存储器中的所述安全存储区加载到所述第一存储模块中;所述至少一个中央处理单元具体用于从所述存储器中的所述普通存储区读取并运行所述通用操作系统软件。
- 根据权利要求2所述移动支付装置,其特征在于,所述存储器专用于存储所述移动支付软件;所述移动支付装置还包括普通存储单元,所述普通存储单元位于所述移动支付装置中的第三半导体芯片内,该普通存储单元用于存储所述通用操作系统软件;所述至少一个中央处理单元具体用于从所述普通存储单元中读取并运行所述通用操作系统软件。
- 根据权利要求1至4中任一项所述移动支付装置,其特征在于,所述移动支付软件包括移动支付操作系统软件。
- 根据权利要求5所述移动支付装置,其特征在于,所述移动支付软件还包括至少一个移动支付应用软件。
- 根据权利要求5或6所述移动支付装置,其特征在于,所述安全元件还包括:第二存储模块,用于存储所述处理器启动所需的启动程序;当所述安全元件上电时,所述处理器用于从所述第二存储模块读取所述启动程序,在所述启动程序的作用下将所述移动支付操作系统软件从所述存储器加载到所述第一存储模块中,并运行所述移动支付操作系统软件。
- 根据权利要求6所述移动支付装置,其特征在于,所述处理器用于在与所述通信单元交互所述支付信息时受所述支付信息触发,将所述至少一个移动支付应用软件中的一个或多个移动支付应用软件从所述存储器加载到所述第一存储模块中,并运行所述一个或多个移动支付应用软件。
- 根据权利要求1至8中任一项所述移动支付装置,其特征在于,所述支付信息包括:从所述通信对端经由所述通信单元传输至所述处理器的移动支付指令、以及响应所述移动支付指令从所述处理器经由所述通信单元传输至所述通信对端的移动支付数据。
- 根据权利要求9所述移动支付装置,其特征在于,所述移动支付数据包括经过安全处理的数据,所述安全处理包括如下至少一项:数据加密或数据完整性保护。
- 根据权利要求10所述移动支付装置,其特征在于,所述处理器还用于生成所述经过安全处理的数据。
- 根据权利要求10所述移动支付装置,其特征在于,所述处理器还用于生成原始数据;所述安全元件还包括:安全处理模块,用于对所述原始数据进行所述安全处理以生成所述经过安全处理的数据。
- 根据权利要求1至12中任一项所述移动支付装置,其特征在于,所述至少一个中央处理单元对所述通信单元、存储器和所述安全元件中的至少一个的控制包括:控制开启、控制关闭、控制进入或退出低功耗状态或控制工作状态。
- 根据权利要求1至13中任一项所述移动支付装置,其特征在于,所述通信单元为近场通信单元,所述通信对端为支付终端,所述近场通信单元具体用于通过运行短距离无线通信协议与所述支付终端交互所述支付信息。
- 根据权利要求14所述移动支付装置,其特征在于,所述近场通信单元位于所述第一半导体芯片内或者位于移动支付装置中的第四半导体芯片内。
- 根据权利要求1至13中任一项所述移动支付装置,其特征在于,所述通信单元为移动通信单元,所述通信对端为无线接入网,所述移动通信单元用于通过运行蜂窝无线通信协议与所述无线接入网交互所述支付信息。
- 根据权利要求16所述移动支付装置,其特征在于,所述移动通信单元位于所述第一半导体芯片内或者移动支付装置中的第五半导体芯片内。
- 根据权利要求1至17中的任一项所述移动支付装置,其特征在于,所述安全元件还包括:加解密引擎,用于在所述处理器将所述移动支付软件从所述存储器加载到所述第一存储模块中后对所述移动支付软件进行安全验证,并在安全验证成功后指示所述处理器运行所述移动支付软件,所述安全验证包括安全解密或第一哈希校验中的至少一项。
- 根据权利要求18所述移动支付装置,其特征在于,所述加解密引擎,还用于对更新数据做安全加密或第一哈希运算处理中的至少一种处理得到处理后的更新数据;所述处理器还用于将所述处理后的更新数据写入到所述存储器以更新所述移动支付软件。
- 根据权利要求1至17中的任一项所述移动支付装置,其特征在于,所述处理器还用于在将所述移动支付软件从所述存储器加载到所述第一存储模块中后对所述移动支付软件进行安全验证,并在安全验证成功后运行所述移动支付软件,所述安全验证包括安全解密或第一哈希校验中的至少一项。
- 根据权利要求20所述移动支付装置,其特征在于,所述处理器还用于对更新数据做安全加密或第一哈希运算处理中的至少一种处理得到处理后的更新数据,并将所述处理后的更新数据写入到所述存储器以更新所述移动支付软件。
- 根据权利要求19或21所述移动支付装置,其特征在于,所述处理器在将所述处理后的更新数据写入到所述存储器时还用于利用密钥对所述处理后的更新数据做第二哈希运算处理得到待存储数据;所述存储器还用于对所述待存储数据做第二哈希校验,在第二哈希校验成功后得到所述处理后的更新数据,并利用所述处理后的更新数据更新所述移动支付软件。
- 根据权利要求19或21所述移动支付装置,其特征在于,所述处理器在将所述处理后的更新数据写入到所述存储器时还用于将所述处理后的更新数据发送给所述至少一个中央处理单元;所述至少一个中央处理单元还用于在可信执行环境中利用密钥对所述处理后的更新数据做第二哈希运算处理得到待存储数据,并将所述待存储数据发送给所述存储器;所述可信执行环境与所述被运行的通用操作系统软件间存在 安全隔离;所述存储器还用于对所述待存储数据做第二哈希校验,在第二哈希校验成功后得到所述处理后的更新数据,并利用所述处理后的更新数据更新所述移动支付软件。
- 根据权利要求23所述移动支付装置,其特征在于,所述安全元件还包括第三存储模块;处理器还用于将所述处理后的更新数据写入所述第三存储模块中,并向所述至少一个中央处理单元发送第一中断请求;所述至少一个中央处理单元还用于在可信执行环境中响应所述第一中断请求从第三存储模块中读取所述处理后的更新数据。
- 根据权利要求1至24中的任一项所述移动支付装置,其特征在于,所述至少一个中央处理单元,还用于运行除所述移动支付软件外的普通应用软件。
- 根据权利要求1至25中的任一项所述移动支付装置,其特征在于,所述至少一个中央处理单元所运行的通用操作系统软件与所述安全元件存在安全隔离。
- 根据权利要求1至18、20、25和26中的任一项所述移动支付装置,其特征在于,所述处理器还用于利用密钥对更新数据或擦除指令做第二哈希运算处理得到处理结果;所述存储器还用于对所述处理结果做第二哈希校验,在第二哈希校验成功后得到所述更新数据或擦除指令,并利用更新数据更新所述移动支付软件或根据擦除指令擦除所述存储器中的与擦除指令对应的数据。
- 根据权利要求1至18、20、25和26中的任一项所述移动支付装置,其特征在于,所述处理器还用于将更新数据或擦除指令发送给所述至少一个中央处理单元;所述至少一个中央处理单元还用于在可信执行环境中利用密钥对更新数据或擦除指令做第二哈希运算处理得到处理结果,并将该处理结果发送给所述存储器;所述可信执行环境与所述被运行的通用操作系统软件间存在安全隔离;所述存储器还用于对所述处理结果做第二哈希校验,在第二哈希校验成功后得到所述更新数据或擦除指令,并利用更新数据更新所述移动支付软件或根据擦除指令擦除所述存储器中的与擦除指令对应的数据。
- 一种通过移动支付装置实现移动支付的方法,其特征在于,包括:通过至少一个中央处理单元运行通用操作系统软件,并在通用操作系统软件的作用下控制通信单元、存储器和安全元件中的至少一个;将移动支付软件从存储器加载到所述安全元件中;在所述安全元件内运行移动支付软件;在所述移动支付软件的作用下,所述安全元件与所述通信单元交互支付信息,其中所述通信单元通过无线链路与通信对端交互所述支付信息;其中,所述安全元件与所述至少一个中央处理单元位于所述移动支付装置中的第一半导体芯片内。
- 一种半导体芯片,用于移动支付装置,其特征在于,所述半导体芯片包括安全元件与至少一个中央处理单元,所述安全元件包括第一存储模块和处理器,所述第一存储模块,用于为所述处理器提供运行移动支付软件所需的内存空间;所述至少一个中央处理单元,用于运行通用操作系统软件;所述处理器用于将所述移动支付软件从所述移动支付装置的存储器中加载到所述第一存储模块中,运行所述移动支付软件,并在所述移动支付软件的作用下与移动支付装置中的通信单元交互支付信息;所述至少一个中央处理单元,还用于在通用操作系统软件的作用下控制所述通信单元、存储器和所述安全模块中的至少一个。
Priority Applications (9)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201580078892.XA CN107533621B (zh) | 2015-04-24 | 2015-10-16 | 移动支付装置和方法 |
KR1020187023775A KR20180095136A (ko) | 2015-04-24 | 2015-10-16 | 모바일 결제 장치 및 방법 |
ES15888732T ES2718540T3 (es) | 2015-04-24 | 2015-10-16 | Dispositivo y método de pago móvil |
BR112016024967A BR112016024967A2 (pt) | 2015-04-24 | 2015-10-16 | aparelho e método para pagamento móvel |
EP18206102.8A EP3534285A1 (en) | 2015-04-24 | 2015-10-16 | Mobile payment apparatus and method |
KR1020177006993A KR20170042344A (ko) | 2015-04-24 | 2015-10-16 | 모바일 결제 장치 및 방법 |
EP15888732.3A EP3121752B1 (en) | 2015-04-24 | 2015-10-16 | Mobile payment device and method |
JP2017516493A JP6517926B2 (ja) | 2015-04-24 | 2015-10-16 | モバイル支払い装置および方法 |
US15/388,813 US11429950B2 (en) | 2015-04-24 | 2016-12-22 | Mobile payment apparatus and method |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201510201343.9 | 2015-04-24 | ||
CN201510201343.9A CN104778794B (zh) | 2015-04-24 | 2015-04-24 | 移动支付装置和方法 |
Related Child Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US15/388,813 Continuation US11429950B2 (en) | 2015-04-24 | 2016-12-22 | Mobile payment apparatus and method |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2016169229A1 true WO2016169229A1 (zh) | 2016-10-27 |
Family
ID=53620234
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2015/092098 WO2016169229A1 (zh) | 2015-04-24 | 2015-10-16 | 移动支付装置和方法 |
Country Status (8)
Country | Link |
---|---|
US (1) | US11429950B2 (zh) |
EP (2) | EP3121752B1 (zh) |
JP (2) | JP6517926B2 (zh) |
KR (2) | KR20170042344A (zh) |
CN (2) | CN104778794B (zh) |
BR (1) | BR112016024967A2 (zh) |
ES (1) | ES2718540T3 (zh) |
WO (1) | WO2016169229A1 (zh) |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP3547195A4 (en) * | 2016-12-29 | 2019-12-25 | Huawei Technologies Co., Ltd. | SYSTEM-ON-CHIP AND METHOD FOR SWITCHING SAFE OPERATING SYSTEMS |
Families Citing this family (41)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN104778794B (zh) | 2015-04-24 | 2017-06-20 | 华为技术有限公司 | 移动支付装置和方法 |
CN106919856B (zh) * | 2015-12-25 | 2020-01-07 | 展讯通信(上海)有限公司 | 安全移动终端 |
CN106936580A (zh) * | 2015-12-31 | 2017-07-07 | 北京握奇智能科技有限公司 | 一种电子密码器、及基于电子密码器的业务处理方法 |
CN105761067B (zh) * | 2016-02-05 | 2021-08-31 | 北京微智全景信息技术有限公司 | 智能pos机安全模块及其启动方法 |
US10475034B2 (en) | 2016-02-12 | 2019-11-12 | Square, Inc. | Physical and logical detections for fraud and tampering |
CN109871717A (zh) | 2016-02-29 | 2019-06-11 | 华为技术有限公司 | 一种数据安全传输装置及方法 |
CN105897425B (zh) * | 2016-03-31 | 2019-04-12 | 北京小米移动软件有限公司 | 分配、请求社交网络账号的方法及装置 |
CN105912272B (zh) | 2016-04-14 | 2019-03-01 | 华为技术有限公司 | 一种控制多个安全应用软件的运行的装置和方法 |
CN106157008A (zh) * | 2016-06-30 | 2016-11-23 | 成都生辉电子科技有限公司 | 一种智能终端安全支付方法 |
CN106127483A (zh) * | 2016-06-30 | 2016-11-16 | 华为技术有限公司 | 移动支付方法、片上系统及终端 |
CN106096934A (zh) * | 2016-06-30 | 2016-11-09 | 成都生辉电子科技有限公司 | 一种通信控制方法 |
CN106204047A (zh) * | 2016-06-30 | 2016-12-07 | 成都生辉电子科技有限公司 | 一种移动终端支付装置 |
CN106228072A (zh) * | 2016-07-21 | 2016-12-14 | 恒宝股份有限公司 | 一种通用ta支付平台和支付方法 |
KR20180135940A (ko) * | 2016-08-09 | 2018-12-21 | 후아웨이 테크놀러지 컴퍼니 리미티드 | 시스템 온 칩 및 처리 장치 |
CN106385314A (zh) * | 2016-08-29 | 2017-02-08 | 福建联迪商用设备有限公司 | 数据隔离系统、方法及利用数据隔离系统的方法 |
CN106961417B (zh) * | 2016-12-23 | 2020-05-22 | 中国银联股份有限公司 | 基于密文的身份验证方法 |
CN106960144B (zh) * | 2017-04-11 | 2018-10-02 | 北京深思数盾科技股份有限公司 | 信息安全电子装置及其进行数据处理的方法 |
US10681185B1 (en) | 2017-08-15 | 2020-06-09 | Worldpay, Llc | Systems and methods for cloud based messaging between electronic database infrastructure |
EP3690836A4 (en) * | 2017-10-16 | 2020-10-14 | Huawei Technologies Co., Ltd. | SAFETY ELEMENT AND ASSOCIATED DEVICE |
CN109815749B (zh) * | 2017-11-21 | 2021-01-15 | 华为技术有限公司 | 控制se的系统、方法及芯片 |
CN109862553B (zh) * | 2017-11-30 | 2022-07-12 | 华为技术有限公司 | 终端和通信方法 |
CN108229951A (zh) * | 2018-01-08 | 2018-06-29 | 陈崇 | 一种移动终端及其快速支付方法和装置 |
US11182794B1 (en) | 2018-03-29 | 2021-11-23 | Square, Inc. | Detecting unauthorized devices using proximity sensor(s) |
US11257072B1 (en) | 2018-03-29 | 2022-02-22 | Square, Inc. | Detecting unauthorized devices |
CN111386513B (zh) * | 2018-05-03 | 2021-09-07 | 华为技术有限公司 | 数据处理的方法、装置和系统芯片 |
US10733291B1 (en) * | 2018-06-11 | 2020-08-04 | Square, Inc. | Bi-directional communication protocol based device security |
CN109151777B (zh) | 2018-06-11 | 2020-11-24 | 中国银联股份有限公司 | 一种非接通信方法以及通信装置 |
CN111566989B (zh) | 2018-06-14 | 2022-06-07 | 华为技术有限公司 | 一种密钥处理方法及装置 |
CN109104712B (zh) * | 2018-07-17 | 2021-04-30 | 北京神州安付科技股份有限公司 | 一种基于nfc功能的无线充值加密系统及其加密方法 |
US11223485B2 (en) * | 2018-07-17 | 2022-01-11 | Huawei Technologies Co., Ltd. | Verifiable encryption based on trusted execution environment |
CN111699467B (zh) * | 2018-12-26 | 2021-12-03 | 华为技术有限公司 | 安全元件、数据处理装置及数据处理方法 |
CN111383015B (zh) * | 2018-12-29 | 2023-11-03 | 华为技术有限公司 | 交易安全处理方法、装置及终端设备 |
CN111475430B (zh) * | 2019-01-24 | 2023-04-11 | 深圳市文鼎创数据科技有限公司 | Java卡芯片通信设备及通信方法 |
US11336684B2 (en) * | 2019-06-07 | 2022-05-17 | Lookout, Inc. | Mobile device security using a secure execution context |
CN114616569A (zh) * | 2020-02-27 | 2022-06-10 | 谷歌有限责任公司 | 利用外部资源的安全元件 |
CN115669022A (zh) * | 2020-05-21 | 2023-01-31 | 三星电子株式会社 | 电子设备提供基于测距的服务的方法和电子设备 |
CN111445231A (zh) * | 2020-06-12 | 2020-07-24 | 支付宝(杭州)信息技术有限公司 | 实现MOTOpay的方法、装置及电子设备 |
CN112328265A (zh) * | 2020-09-29 | 2021-02-05 | 福建联迪商用设备有限公司 | 一种eMMC验证方法及智能POS |
FR3115622A1 (fr) * | 2020-10-27 | 2022-04-29 | Stmicroelectronics (Rousset) Sas | Elément sécurisé |
CN114038132A (zh) * | 2021-11-11 | 2022-02-11 | 武汉天喻信息产业股份有限公司 | 一种基于网口的离线收款终端、系统以及收款和提现方法 |
CN116738507B (zh) * | 2023-08-14 | 2023-11-10 | 中科亿海微电子科技(苏州)有限公司 | 一种芯片鉴权方法 |
Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN102325210A (zh) * | 2011-05-19 | 2012-01-18 | 武汉天喻信息产业股份有限公司 | 兼容多个运营商的通用移动支付终端及其实现方法 |
CN103544599A (zh) * | 2012-07-09 | 2014-01-29 | 马克西姆综合产品公司 | 用于在移动终端内认证、存储和交易的嵌入式安全元件 |
US20140286492A1 (en) * | 2010-11-23 | 2014-09-25 | Microsoft Corporation | Access Techniques Using a Mobile Communication Device |
CN104145285A (zh) * | 2012-02-29 | 2014-11-12 | 莫比威孚公司 | 用于在设备上进行安全金融交易的方法、设备和安全元件 |
CN104778794A (zh) * | 2015-04-24 | 2015-07-15 | 华为技术有限公司 | 移动支付装置和方法 |
Family Cites Families (21)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP2005227995A (ja) | 2004-02-12 | 2005-08-25 | Sony Corp | 情報処理装置、および情報処理方法、並びにコンピュータ・プログラム |
US7721969B2 (en) | 2005-04-21 | 2010-05-25 | Securedpay Solutions, Inc. | Portable handheld device for wireless order entry and real time payment authorization and related methods |
JP5216486B2 (ja) * | 2008-08-28 | 2013-06-19 | 株式会社日立製作所 | 半導体素子、携帯端末、および情報端末 |
US20100217709A1 (en) * | 2008-09-22 | 2010-08-26 | Christian Aabye | Apparatus and method for preventing unauthorized access to payment application installed in contactless payment device |
US10454693B2 (en) * | 2009-09-30 | 2019-10-22 | Visa International Service Association | Mobile payment application architecture |
DE102010028231A1 (de) * | 2010-04-27 | 2011-10-27 | Robert Bosch Gmbh | Speichermodul zur gleichzeitigen Bereitstellung wenigstens eines sicheren und wenigstens eines unsicheren Speicherbereichs |
DE102011117236A1 (de) * | 2011-10-28 | 2013-05-02 | Giesecke & Devrient Gmbh | Effiziente Primzahlprüfung |
KR101322402B1 (ko) | 2011-11-25 | 2013-11-21 | 농업협동조합중앙회 | 어플리케이션 보안 시스템 및 방법, 이를 위한 통신 단말기 |
US20140012762A1 (en) * | 2012-07-06 | 2014-01-09 | Terry L. Glatt | Embedded Electronic Payment System and Integrated Circuit |
KR20140009744A (ko) | 2012-07-12 | 2014-01-23 | 주식회사 엘지씨엔에스 | 교통 요금 처리를 위한 태그형 결제 단말, 태그형 결제 단말의 교통 요금 처리 방법 및 기록 매체 |
US20140020114A1 (en) * | 2012-07-13 | 2014-01-16 | Qualcomm Incorporated | Methods and apparatuses for integrating a portion of secure element components on a system on chip |
US9781598B2 (en) | 2013-03-15 | 2017-10-03 | Tyfone, Inc. | Personal digital identity device with fingerprint sensor responsive to user interaction |
JP6067449B2 (ja) * | 2013-03-26 | 2017-01-25 | 株式会社東芝 | 情報処理装置、情報処理プログラム |
KR102052959B1 (ko) | 2013-04-16 | 2019-12-06 | 삼성전자주식회사 | 단말장치, 보안서버 및 그 결제방법 |
KR102255458B1 (ko) * | 2013-07-15 | 2021-05-25 | 비자 인터네셔널 서비스 어소시에이션 | 보안 원격 지불 거래 처리 |
DE102013013179A1 (de) * | 2013-08-07 | 2015-02-12 | Giesecke & Devrient Gmbh | Verfahren zum Betreiben eines Sicherheitselements |
US9646303B2 (en) | 2013-08-15 | 2017-05-09 | Visa International Service Association | Secure remote payment transaction processing using a secure element |
EP2884692B1 (en) * | 2013-12-13 | 2020-05-20 | Nxp B.V. | Updating software on a secure element |
CN103793815B (zh) * | 2014-01-23 | 2017-01-11 | 武汉天喻信息产业股份有限公司 | 适用于银行卡和行业卡的移动智能终端收单系统及方法 |
CN203966188U (zh) * | 2014-06-06 | 2014-11-26 | 北京民芯科技有限公司 | 安全设备及终端 |
US20180012037A1 (en) * | 2016-07-05 | 2018-01-11 | Nxp B.V. | Secure operation apparatuses and methods therefor |
-
2015
- 2015-04-24 CN CN201510201343.9A patent/CN104778794B/zh active Active
- 2015-10-16 JP JP2017516493A patent/JP6517926B2/ja active Active
- 2015-10-16 ES ES15888732T patent/ES2718540T3/es active Active
- 2015-10-16 KR KR1020177006993A patent/KR20170042344A/ko not_active IP Right Cessation
- 2015-10-16 WO PCT/CN2015/092098 patent/WO2016169229A1/zh active Application Filing
- 2015-10-16 KR KR1020187023775A patent/KR20180095136A/ko not_active IP Right Cessation
- 2015-10-16 BR BR112016024967A patent/BR112016024967A2/pt not_active Application Discontinuation
- 2015-10-16 EP EP15888732.3A patent/EP3121752B1/en active Active
- 2015-10-16 EP EP18206102.8A patent/EP3534285A1/en not_active Withdrawn
- 2015-10-16 CN CN201580078892.XA patent/CN107533621B/zh active Active
-
2016
- 2016-12-22 US US15/388,813 patent/US11429950B2/en active Active
-
2019
- 2019-01-16 JP JP2019005353A patent/JP2019079561A/ja not_active Withdrawn
Patent Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20140286492A1 (en) * | 2010-11-23 | 2014-09-25 | Microsoft Corporation | Access Techniques Using a Mobile Communication Device |
CN102325210A (zh) * | 2011-05-19 | 2012-01-18 | 武汉天喻信息产业股份有限公司 | 兼容多个运营商的通用移动支付终端及其实现方法 |
CN104145285A (zh) * | 2012-02-29 | 2014-11-12 | 莫比威孚公司 | 用于在设备上进行安全金融交易的方法、设备和安全元件 |
CN103544599A (zh) * | 2012-07-09 | 2014-01-29 | 马克西姆综合产品公司 | 用于在移动终端内认证、存储和交易的嵌入式安全元件 |
CN104778794A (zh) * | 2015-04-24 | 2015-07-15 | 华为技术有限公司 | 移动支付装置和方法 |
Non-Patent Citations (1)
Title |
---|
See also references of EP3121752A4 * |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP3547195A4 (en) * | 2016-12-29 | 2019-12-25 | Huawei Technologies Co., Ltd. | SYSTEM-ON-CHIP AND METHOD FOR SWITCHING SAFE OPERATING SYSTEMS |
US10853519B2 (en) | 2016-12-29 | 2020-12-01 | Huawei Technologies Co., Ltd. | System on chip and method for implementing secure operating system switching |
Also Published As
Publication number | Publication date |
---|---|
CN104778794B (zh) | 2017-06-20 |
US20170103378A1 (en) | 2017-04-13 |
EP3121752A1 (en) | 2017-01-25 |
CN107533621B (zh) | 2020-10-27 |
CN104778794A (zh) | 2015-07-15 |
JP2017536603A (ja) | 2017-12-07 |
EP3534285A1 (en) | 2019-09-04 |
US11429950B2 (en) | 2022-08-30 |
BR112016024967A2 (pt) | 2017-08-15 |
JP6517926B2 (ja) | 2019-05-22 |
KR20180095136A (ko) | 2018-08-24 |
EP3121752B1 (en) | 2019-01-09 |
JP2019079561A (ja) | 2019-05-23 |
CN107533621A (zh) | 2018-01-02 |
EP3121752A4 (en) | 2017-05-31 |
KR20170042344A (ko) | 2017-04-18 |
ES2718540T3 (es) | 2019-07-02 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
WO2016169229A1 (zh) | 移动支付装置和方法 | |
US20190172047A1 (en) | System on chip and processing device | |
US10601795B2 (en) | Service processing method and electronic device | |
WO2017177814A1 (zh) | 一种控制多个安全应用软件的运行的装置和方法 | |
US20190318127A1 (en) | System on Chip And Method For Implementing Secure Operating System Switching | |
CN106605233B (zh) | 使用处理器提供可信执行环境 | |
US11410156B2 (en) | NFC payment method and terminal | |
TWI537765B (zh) | 板上小型應用程式移轉 | |
US11126753B2 (en) | Secure processor chip and terminal device | |
US20140161258A1 (en) | Authentication server, mobile terminal and method for issuing radio frequency card key using authentication server and mobile terminal | |
US20150089586A1 (en) | Systems and methods for nfc access control in a secure element centric nfc architecture | |
KR20190131712A (ko) | 복수의 프로세서들과 연결된 보안 모듈의 제어 방법 및 이를 구현한 전자 장치 | |
CN109643340B (zh) | 具有多个用户的安全元件 | |
US11734416B2 (en) | Construct general trusted application for a plurality of applications |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
REEP | Request for entry into the european phase |
Ref document number: 2015888732 Country of ref document: EP |
|
WWE | Wipo information: entry into national phase |
Ref document number: 2015888732 Country of ref document: EP |
|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 15888732 Country of ref document: EP Kind code of ref document: A1 |
|
REG | Reference to national code |
Ref country code: BR Ref legal event code: B01A Ref document number: 112016024967 Country of ref document: BR |
|
ENP | Entry into the national phase |
Ref document number: 20177006993 Country of ref document: KR Kind code of ref document: A |
|
ENP | Entry into the national phase |
Ref document number: 2017516493 Country of ref document: JP Kind code of ref document: A |
|
ENP | Entry into the national phase |
Ref document number: 112016024967 Country of ref document: BR Kind code of ref document: A2 Effective date: 20161025 |
|
NENP | Non-entry into the national phase |
Ref country code: DE |