WO2016169229A1 - 移动支付装置和方法 - Google Patents

移动支付装置和方法 Download PDF

Info

Publication number
WO2016169229A1
WO2016169229A1 PCT/CN2015/092098 CN2015092098W WO2016169229A1 WO 2016169229 A1 WO2016169229 A1 WO 2016169229A1 CN 2015092098 W CN2015092098 W CN 2015092098W WO 2016169229 A1 WO2016169229 A1 WO 2016169229A1
Authority
WO
WIPO (PCT)
Prior art keywords
mobile payment
software
memory
data
processor
Prior art date
Application number
PCT/CN2015/092098
Other languages
English (en)
French (fr)
Inventor
潘时林
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to KR1020177006993A priority Critical patent/KR20170042344A/ko
Priority to BR112016024967A priority patent/BR112016024967A2/pt
Priority to EP18206102.8A priority patent/EP3534285A1/en
Priority to EP15888732.3A priority patent/EP3121752B1/en
Priority to CN201580078892.XA priority patent/CN107533621B/zh
Priority to JP2017516493A priority patent/JP6517926B2/ja
Priority to KR1020187023775A priority patent/KR20180095136A/ko
Priority to ES15888732T priority patent/ES2718540T3/es
Publication of WO2016169229A1 publication Critical patent/WO2016169229A1/zh
Priority to US15/388,813 priority patent/US11429950B2/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/322—Aspects of commerce using mobile devices [M-devices]
    • G06Q20/3226—Use of secure elements separate from M-devices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/322—Aspects of commerce using mobile devices [M-devices]
    • G06Q20/3223—Realising banking transactions through M-devices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/74—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information operating in dual or compartmented mode, i.e. at least one secure mode
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/322—Aspects of commerce using mobile devices [M-devices]
    • G06Q20/3227—Aspects of commerce using mobile devices [M-devices] using secure elements embedded in M-devices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/322—Aspects of commerce using mobile devices [M-devices]
    • G06Q20/3229—Use of the SIM of a M-device as secure element
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/325—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices using wireless networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/327—Short range or proximity payments by means of M-devices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/327—Short range or proximity payments by means of M-devices
    • G06Q20/3278—RFID or NFC payments by means of M-devices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3827—Use of message hashing
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3829—Payment protocols; Details thereof insuring higher security of transaction involving key management
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/80—Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/56—Financial cryptography, e.g. electronic payment or e-cash
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/40—Security arrangements using identity modules
    • H04W12/45—Security arrangements using identity modules using multiple identity modules

Definitions

  • the present invention relates to the field of mobile communications, and in particular, to a mobile payment device and method.
  • Mobile Payment refers to a service that allows users to use their mobile terminals, such as mobile phones or tablets, to pay for goods or services they consume.
  • mobile terminals such as mobile phones or tablets
  • SD Secure Digital
  • SIM Subscriber Identity Module
  • NFC Near Field Communication
  • SE Secure Element
  • the mobile terminal 10 communicates with a point of sales (POS) machine 11 through its internal near field communication unit 101, a near field communication unit 101 and a POS machine 11
  • the short-range wireless communication link 12 is a two-way path, and can be implemented by various suitable short-range wireless communication protocols to implement basic wireless communication functions in mobile payment.
  • the communication link 12 can be used to transfer POS command data or the like from the POS machine 11 to the near field communication unit 101 inside the mobile terminal 10.
  • the secure element 102 can be a component coupled to a separate Central Processing Unit (CPU) 103 for performing various functions related to the operation of the financial payment service and storing keys and certificates associated with the banking business. And other data.
  • CPU Central Processing Unit
  • the secure element 102 receives the POS command data from the near field communication unit 101, parses the command data, and responds accordingly according to the financial transaction protocol. The response is fed back to the POS machine 11 by the near field communication unit 101 to complete the data transmission in the mobile payment to implement the function of the mobile terminal 10 as a transaction verification card.
  • Central processing order The element 103 is run with operating system software 1031, such as Android system software, for controlling the near field communication unit 101 and the secure element 102, such as controlling the opening and closing of the near field communication unit 101 and the secure element 102.
  • the mobile terminal 10 may include an input unit 104, which may be a touch screen for interacting with a user through a user interface (UI), so that the user can input an operation instruction on the input unit 104 through the UI.
  • UI user interface
  • the POS machine 11 accesses the cloud server 14 on the network side through the Internet as a terminal device of the transaction to implement calculation and completion of the payment service by the server 14.
  • the server 14 located on the network side is typically operated by a bank.
  • All-terminal solutions can include online payments and offline payments.
  • the mobile terminal 10 When paying offline, as shown in FIG. 1, the mobile terminal 10 performs a non-contact card swiping with the POS machine 11, that is, the mobile phone, and the near field communication unit 101 and the secure element 102 cooperate to complete the payment transaction.
  • the central processing unit 103 and the secure element 102 can access the Internet through the mobile communication network to realize online payment, and the secure element 102 is equivalent to the bank U.
  • the role of the shield is to store and verify the bank's certificate, so the near field communication unit 101 of Figure 1 above is optional. Specifically, referring to FIG.
  • the mobile terminal 10 may further include a mobile communication unit 105 for replacing the role of the near field communication unit 101 when offline payment is applied to the radio access network (Radio Access).
  • Network, RAN Radio Access
  • RAN radio access network
  • the secure element 102 parses the command data and responds accordingly in accordance with the financial transaction protocol to transmit data to the network side server 14 over the mobile internet via the mobile communication unit 105.
  • the mobile communication unit 105 can now be a unit operating a wireless cellular communication protocol for accessing the mobile terminal 10 to the Internet via the cellular wireless communication link 13.
  • the mobile communication unit 105 can specifically operate Global System for Mobile (GSM), Universal Mobile Communication System (Universal Mobile) A cellular wireless communication protocol such as the Telecommunications System (UMTS), Worldwide Interoperability for Microwave Access (WiMAX), or Long Term Evolution (LTE) to implement the mobile Internet function of the mobile terminal 10.
  • GSM Global System for Mobile
  • Universal Mobile Universal Mobile Communication System
  • UMTS Telecommunications System
  • WiMAX Worldwide Interoperability for Microwave Access
  • LTE Long Term Evolution
  • the current various types of mobile terminals adopt a scheme in which the security element 102 is externally disposed outside the main system.
  • the central processing unit 103 and the mobile communication unit 105 can be located on an integrated circuit substrate, that is, a piece.
  • the security element 102 is specifically a chip that is independent of the main chip 106.
  • the secure element 102 is in particular in communication with a central processing unit 103 in the main chip 106 via a Serial Peripheral Interface (SPI).
  • SPI Serial Peripheral Interface
  • the external placement of the security element 102 outside of the main chip 106 causes the secure element 102 and the main chip 106 to occupy a large area on the main board of the mobile terminal 10 and consume more cost.
  • Embodiments of the present invention provide a mobile payment apparatus and method to reduce hardware implementation cost and area of mobile payment.
  • an embodiment of the present invention provides a mobile payment device, including: a communication unit, configured to exchange payment information with a communication peer through a wireless link; a memory for storing mobile payment software; and a security component, including the first a storage module and a processor; at least one central processing unit for running general operating system software and controlling at least one of the communication unit, the memory and the secure element under the action of the general operating system software; Loading the mobile payment software from the memory into the first storage module, running the mobile payment software, and interacting with the communication unit under the action of the mobile payment software; a storage module for providing the processor with a memory space required to run the mobile payment software; wherein the security element and the at least one central processing unit are located in a first semiconductor chip of the mobile payment device Inside.
  • the communication unit may include a baseband unit.
  • the communication unit may further include a radio frequency unit
  • the memory is located in a second semiconductor chip in the mobile payment device. Since the first semiconductor chip is independent of the second semiconductor chip, the storage unit storing the mobile payment software does not have to be integrated with the secure element executing the mobile payment software, which reduces the difficulty and complexity of hardware implementation. In particular, current memories are difficult to integrate with a first chip including a CPU due to a process, an area, etc., which employs an off-chip memory by integrating only a secure element with a CPU, and is more suitable for a mobile payment scheme.
  • the memory includes a secure storage area and a common storage area that are isolated from each other; the secure storage area is used for storage The mobile payment software; the normal storage area is configured to store the general operating system software; the processor is specifically configured to load the mobile payment software from the secure storage area in the memory to the first In a storage module, the at least one central processing unit is specifically configured to read and run the general operating system software from the normal storage area in the memory.
  • This implementation is equivalent to multiplexing the memory such that the general operating system software and the mobile payment software coexist in one memory and achieve secure isolation from each other, saving memory resources while ensuring security.
  • the memory is dedicated to storing the mobile payment software;
  • the mobile payment device further includes a common storage unit,
  • the common storage unit is located in a third semiconductor chip in the mobile payment device, the common storage unit is configured to store the general operating system software;
  • the at least one central processing unit is specifically configured to be used from the common storage unit
  • the general operating system software is read and run.
  • the implementation may physically separate the dedicated memory dedicated to storing the mobile payment software from the normal storage unit, such that operational security is further enhanced.
  • the mobile payment software includes mobile payment Operating system software.
  • the use of a secure and reliable mobile payment operating system software in mobile payment software can ensure operational security, and is also beneficial to implement more mobile payment application software based on the mobile payment operating system software, such as supporting different banks' services.
  • the mobile payment operating system software is a COS image.
  • the mobile payment software further includes at least one mobile payment application software.
  • the security element further includes: a second storage module, configured to store the processor Activating a required startup program; when the security element is powered on, the processor is configured to read the startup program from the second storage module, and the mobile payment operating system is operated by the startup program Software is loaded from the memory into the first storage module and runs the mobile payment operating system software. Since the startup program required for the activation of the security element is located in a separate second storage module inside the security element, the security of the activation of the security element can be ensured.
  • the processor is configured to be triggered by the payment information when the payment information is exchanged with the communication unit And loading one or more mobile payment application software of the at least one mobile payment application software from the memory into the first storage module and running the one or more mobile payment application software. Since the loading and running of the mobile payment application software is triggered by the interaction of the payment information, when there is no payment service, the related mobile payment application software may not be turned on, and the memory space of the first storage module may be saved. Especially in the case of highly integrated safety components, the space of the first storage module is very limited, and the related scheme can achieve a very good saving effect.
  • the payment information includes: Communication Mobile payment instructions transmitted by the peer end to the processor via the communication unit, and mobile payment data transmitted from the processor to the communication peer via the communication unit in response to the mobile payment instruction. Therefore, the payment information includes a two-way communication process in mobile payment.
  • the mobile payment data includes data that is processed by security, and the security processing includes at least one of the following: data Encryption or data integrity protection. Since the mobile payment data is processed securely, the mobile payment data sent to the communication peer is more secure when the mobile payment device is used for mobile payment.
  • the processor is further configured to generate the security-processed data.
  • the processor has a secure processing process, so that the security processing process is more concentrated on the processor, and no additional security hardware is needed, which can save costs.
  • the processor is further configured to generate original data
  • the security component further includes: a security processing module, And performing the security processing on the original data to generate the securely processed data.
  • the security processing is accelerated by using a processor-independent security processing module, and the processing is more optimized.
  • the security processing module may be a hardware accelerator.
  • the at least one central processing unit Controlling at least one of the communication unit, the memory, and the secure element includes controlling on, controlling off, or controlling entering or exiting a low power state or controlling an operating state.
  • the at least one central processing unit may be an Advanced RISC Machine (ARM) processor. The operation of other units within the system can be conveniently controlled overall by the at least one central processing unit.
  • ARM Advanced RISC Machine
  • the communication unit is a near field communication unit
  • the communication peer is a payment terminal
  • the near field communication unit is specifically configured to run short-range wireless
  • a communication protocol interacts with the payment terminal for the payment information.
  • the solution facilitates convenient mobile payment through a near field communication unit and a payment terminal, such as a POS machine.
  • the near field communication unit comprises a near field communication baseband unit for operating a short range wireless communication protocol.
  • the near field communication unit further includes a near field communication radio frequency unit for receiving or transmitting a radio frequency signal, and the radio frequency signal is converted by the near field communication radio frequency unit into a baseband signal that can be processed by the near field communication baseband unit,
  • the radio frequency signal includes the payment information.
  • the near field communication unit is located in the first semiconductor chip or in a mobile payment device Within the fourth semiconductor chip.
  • the near field communication unit is located within the first semiconductor chip, high integration of the near field communication unit with the secure element and the at least one central processing unit may be achieved, reducing implementation costs.
  • the near field communication unit is located in another fourth semiconductor chip, the design difficulty due to the need to integrate the near field communication unit can be reduced.
  • the communication unit is a mobile communication
  • the communication peer is a radio access network
  • the mobile communication unit is configured to exchange the payment information with the radio access network by running a cellular radio communication protocol.
  • the mobile communication unit comprises a mobile communication baseband unit for a cellular wireless communication protocol.
  • the mobile communication unit further includes a mobile communication radio frequency unit for receiving or transmitting a radio frequency signal, and the radio frequency signal is converted by the mobile communication radio frequency unit into a baseband signal that can be processed by the mobile communication baseband unit, the radio frequency signal
  • the payment information is included.
  • the mobile communication unit is located in the first semiconductor chip or the fifth in the mobile payment device Inside the semiconductor chip.
  • the mobile communication unit is located within the first semiconductor chip, Achieve high integration and reduce implementation costs.
  • design difficulty due to integration can be reduced.
  • the security element further includes: And an encryption and decryption engine, configured to perform security verification on the mobile payment software after the processor loads the mobile payment software from the memory into the first storage module, and after the security verification succeeds, indicate the The processor runs the mobile payment software, the security verification including at least one of a secure decryption or a hash check.
  • the encryption and decryption engine can be a hardware accelerator.
  • the mobile payment software can be run after the verification is successful, ensuring that the mobile payment software will not be tampered with before running, which is beneficial to improve the security verification. Processing performance.
  • the encryption and decryption engine is further configured to perform security encryption or first hash operation on the update data. At least one of the processes is processed to obtain processed update data; the processor is further configured to write the processed update data to the memory to update the mobile payment software.
  • the mobile payment software needs to be updated, through the processing of the encryption and decryption engine, it is convenient to verify the related software when the updated mobile payment software is read again, to ensure that the mobile payment software will not be tampered with, and it is better to ensure that the update is needed.
  • Software security is further configured to perform security encryption or first hash operation on the update data. At least one of the processes is processed to obtain processed update data; the processor is further configured to write the processed update data to the memory to update the mobile payment software.
  • the processor is further used Performing security verification on the mobile payment software after loading the mobile payment software from the memory into the first storage module, and running the mobile payment software after successful security verification, the security verification including security At least one of decryption or first hash check. Since the processor itself already has the above-mentioned security verification function, there is no need for other additional units to implement the function, which reduces the design difficulty.
  • the processor is further configured to perform, by performing at least one of security encryption or first hash operation processing on the update data, the processed update data, and write the processed update data to the
  • the memory is described to update the mobile payment software.
  • the processor may further perform security processing on the software that needs to be updated, so as to verify the related software when the updated mobile payment software is read out again, thereby realizing more in the processor. Multi-functional integration.
  • the processor writes the processed update data And when the memory is used to perform a second hash operation on the processed update data by using a key to obtain data to be stored; the memory is further configured to perform a second hash check on the to-be-stored data. After the second hash check succeeds, the processed update data is obtained, and the mobile payment software is updated by using the processed update data. Since the processor has the capabilities described above, the data written to the memory is subjected to verification by the memory to ensure the security of the memory write data.
  • the processor writes the processed update data And when the memory is used to send the processed update data to the at least one central processing unit; the at least one central processing unit is further configured to use the key pair in the trusted execution environment after the processing
  • the update data is subjected to a second hash operation process to obtain data to be stored, and the data to be stored is sent to the memory; there is security isolation between the trusted execution environment and the running general operating system software;
  • the memory is further configured to perform a second hash check on the to-be-stored data, obtain the processed update data after the second hash check succeeds, and update the move by using the processed update data.
  • Payment software is further configured to perform a second hash check on the to-be-stored data, obtain the processed update data after the second hash check succeeds, and update the move by using the processed update data.
  • the update data in the solution When the update data in the solution is written from the processor to the memory, it needs to be delivered by the trusted execution environment of the at least one central processing unit, and is hashed in the trusted execution environment, so that the memory performs the corresponding hash check. Since the trusted execution environment is more trusted than the general operating system software, the security of the memory write data can be improved.
  • the security element further includes a third storage module; the processor is further configured to write the processed update data into the third storage module, and send the data to the at least one central processing unit a first interrupt request; the at least one central processing unit is further configured to read the processed update data from the third storage module in response to the first interrupt request in a trusted execution environment.
  • the at least one central The processing unit is further configured to run a general application software other than the mobile payment software.
  • At least one central processing unit is a common central processing unit commonly used in mobile terminals, which facilitates the expansion of the solution on ordinary mobile terminals.
  • the at least one central The general operating system software run by the processing unit is securely isolated from the secure element. Due to the existence of the isolation, the general operating system software is not free to access the secure element, which can improve the security of mobile payment.
  • the processor is further configured to perform a second hash operation process by using a key pair update data or an erase instruction to obtain a processing result;
  • the memory is further configured to use the processing result Performing a second hash check, obtaining the update data or erase command after the second hash check succeeds, and updating the mobile payment software with the update data or erasing the memory in the memory according to the erase command Erase the data corresponding to the instruction.
  • the processor is further configured to send update data or an erase command to the at least one central processing unit;
  • the at least one central processing unit is further configured to perform in a trusted execution environment Key pair Updating data or erasing instructions to perform a second hash operation process to obtain a processing result, and transmitting the processing result to the memory; there is security isolation between the trusted execution environment and the executed general operating system software;
  • the memory is further configured to perform a second hash check on the processing result, obtain the update data or an erase command after the second hash check succeeds, and update the mobile payment software with the update data or according to the wipe In addition to the instruction to erase data corresponding to the erase command in the memory.
  • the solution improves the security of data erasure in mobile payment, and the central processing unit implements secure processing, which simplifies the design of the processor.
  • an embodiment of the present invention provides a method for implementing mobile payment by using a mobile payment device, including: running a general operating system software through at least one central processing unit, and controlling a communication unit and security under the function of a general operating system software. At least one of the components; loading mobile payment software from the memory into the secure element; operating mobile payment software within the secure element; the secure element and the communication unit under the action of the mobile payment software Interactive payment information, wherein the communication unit interacts with the communication peer to communicate information over a wireless link; wherein the secure element and the at least one central processing unit are located within a first semiconductor chip of the mobile payment device.
  • an embodiment of the present invention provides a semiconductor chip for a mobile payment device, the semiconductor chip including a security element and at least one central processing unit, the security element including a first storage module and a processor, a first storage module, configured to provide the processor with a memory space required to run mobile payment software; the at least one central processing unit for running general operating system software; the processor for using the mobile payment software Loading from the memory of the mobile payment device into the first storage module, running the mobile payment software, and interacting with the communication unit in the mobile payment device to pay for information under the action of the mobile payment software; At least one central processing unit is further configured to control at least one of the communication unit, the memory, and the security module under the action of general operating system software.
  • the mobile payment software comprises mobile payment operating system software.
  • the mobile payment software further includes at least one mobile payment application software.
  • the security element further includes: a second storage module, configured to store the processor Activating a required startup program; when the security element is powered on, the processor is configured to read the startup program from the second storage module, and the mobile payment operating system is operated by the startup program Software is loaded from the memory into the first storage module and runs the mobile payment operating system software.
  • the processor is configured to be triggered by the payment information when the payment information is exchanged with the communication unit And loading one or more mobile payment application software of the at least one mobile payment application software from the memory into the first storage module and running the one or more mobile payment application software.
  • the payment information includes: a mobile payment instruction transmitted by the communication peer to the processor via the communication unit, and mobile payment data transmitted from the processor to the communication peer via the communication unit in response to the mobile payment instruction.
  • the mobile payment data includes data that is processed by security, and the security process includes at least one of the following: data Encryption or data integrity protection.
  • the processor is further configured to generate the security-processed data.
  • the processor is further configured to generate original data
  • the security component further includes: a security processing module, Performing the security processing on the raw data to generate the securely processed data.
  • the at least one central processing unit Control of at least one of the communication unit, the memory, and the secure element includes controlling on, controlling off, or controlling entering or exiting a low power state or controlling an operating state.
  • the security element further includes: adding a decryption engine, configured to perform security verification on the mobile payment software after the processor loads the mobile payment software from the memory into the first storage module, and indicate the processing after the security verification succeeds The mobile payment software runs, the security verification including at least one of a secure decryption or a hash check.
  • the encryption and decryption engine is further configured to perform security encryption or first hash operation on the update data. At least one of the processes is processed to obtain processed update data; the processor is further configured to write the processed update data to the memory to update the mobile payment software.
  • the processor is further configured to Performing security verification on the mobile payment software after loading the mobile payment software from the memory into the first storage module, and running the mobile payment software after successful security verification, the security verification including secure decryption Or at least one of the first hash checks.
  • the processor is further configured to perform security encryption or first hash operation processing on the update data. At least one of the processes obtains the processed update data, and writes the processed update data to the The memory is described to update the mobile payment software.
  • the processor writes the processed update data And when the memory is used to perform a second hash operation on the processed update data by using a key to obtain data to be stored; the memory is further configured to perform a second hash check on the to-be-stored data. After the second hash check succeeds, the processed update data is obtained, and the mobile payment software is updated by using the processed update data.
  • the processor writes the processed update data to
  • the memory is further configured to send the processed update data to the at least one central processing unit;
  • the at least one central processing unit is further configured to utilize the key pair in the trusted execution environment to process the processed Updating data to perform a second hash operation process to obtain data to be stored, and transmitting the data to be stored to the memory; there is security isolation between the trusted execution environment and the running general operating system software;
  • the memory is further configured to perform a second hash check on the to-be-stored data, obtain the processed update data after the second hash check succeeds, and update the mobile payment by using the processed update data. software.
  • the security element further includes a third storage module; the processor is further configured to: after the processing The update data is written into the third storage module and sends a first interrupt request to the at least one central processing unit; the at least one central processing unit is further configured to respond to the first interrupt in a trusted execution environment Requesting to read the processed update data from the third storage module.
  • the at least one central processing unit It is also used to run general application software other than the mobile payment software.
  • the general operating system software run by the at least one central processing unit is securely isolated from the secure element.
  • the processor is further configured to perform a second hash operation process by using a key pair update data or an erase instruction to obtain a processing result;
  • the memory is further configured to perform a second process on the processing result.
  • Hash check, obtaining the update data or erase command after the second hash check succeeds, and updating the mobile payment software with the update data or erasing the erase command in the memory according to the erase command Corresponding data.
  • the processor is further configured to send update data or an erase command to the at least one central processing unit; the at least one central processing unit is further configured to utilize in a trusted execution environment The key performs a second hash operation on the update data or the erase instruction to obtain a processing result, and sends the processing result to the memory; the trusted execution environment and the executed general operating system software are secure Isolating; the memory is further configured to perform a second hash check on the processing result, obtain the update data or an erase command after the second hash check succeeds, and update the mobile payment software by using the update data Or erasing data corresponding to the erase command in the memory according to the erase command.
  • the technical solution provided by the embodiment of the invention can reduce the hardware implementation cost and area while ensuring the security of the mobile payment, better adapt to the requirement of miniaturization of the mobile terminal in the mobile payment, and facilitate the popularization and expansion of the mobile payment.
  • FIG. 1 is a simplified schematic diagram of a simplified mobile terminal structure for mobile payment provided by the prior art
  • FIG. 2 is a simplified schematic diagram of a structure of a mobile payment device according to an embodiment of the present invention.
  • FIG. 3 is a simplified schematic diagram of a mobile payment process according to an embodiment of the present invention.
  • FIG. 4 is a simplified schematic diagram of a mobile payment software performing a secure access operation on a secure storage area of a memory according to an embodiment of the present invention
  • FIG. 5 is a simplified schematic diagram of another mobile payment software performing a secure access operation on a secure storage area of a memory according to an embodiment of the present invention
  • FIG. 6 is a simplified schematic diagram of a system structure for mobile payment in a mobile payment device according to an embodiment of the present invention.
  • FIG. 7 is a schematic structural diagram of a memory for mobile payment according to an embodiment of the present invention.
  • FIG. 8 is a simplified schematic diagram of a software system architecture for mobile payment according to an embodiment of the present invention.
  • FIG. 2 is a schematic diagram of a mobile payment device 20 according to an embodiment of the present invention.
  • the mobile payment Device 20 can be located within a mobile terminal 21.
  • the mobile terminal 21 can be a user equipment (User Equipment, UE), such as a mobile phone, a tablet computer, and the like.
  • UE User Equipment
  • the mobile payment device 21 may specifically be a chip or a chipset or a circuit board on which a chip or a chipset is mounted. The chip or chipset or board with the chip or chipset can operate with the necessary software drivers.
  • the mobile payment device 20 may include: a near field communication unit 201 that interacts with a payment terminal, such as a POS, located outside the mobile terminal 21 for accessing the Internet to implement a mobile payment function by operating a short-range wireless communication protocol, to Implement offline payments.
  • the mobile communication unit 202 interacts with the radio access network by running a cellular radio communication protocol, such as a base station in the radio access network, to access the Internet through the radio access network including the base station, to finally implement the mobile communication unit. 202 exchanges information with a server having a payment function in the Internet, thereby implementing online payment. It can be understood that the mobile payment device 20 can include one of the near field communication unit 201 or the mobile communication unit 202, that is, any of offline payment or online payment.
  • the short-range wireless communication protocol operated by the near-field communication unit 201 can adopt Radio Frequency Identification (RFID) technology, and specifically supports various types of RFID protocols, such as the European Computer Manufactures Association (ECMA). Standard protocols, in addition to other types of short-range communication protocols such as Bluetooth communication, infrared communication, and Wireless Fidelity (WiFi) protocols.
  • RFID Radio Frequency Identification
  • ECMA European Computer Manufactures Association
  • Standard protocols in addition to other types of short-range communication protocols such as Bluetooth communication, infrared communication, and Wireless Fidelity (WiFi) protocols.
  • the cellular wireless communication protocol operated by the mobile communication unit 202 may be any one or more cellular wireless communication protocols such as GSM, UMTS, WiMAX or LTE to implement the wireless access network through the mobile communication unit 202 and the cellular mobile communication network. Communication.
  • the base station in the radio access network is a network element in the radio access network that implements the foregoing communication function, and the base station can be in various forms, such as a NodeB, an eNodeB, and the like.
  • the radio access network including the base station will eventually connect to a server in the network, i.e., a cloud side server, to enable the server to interact with the payment information of the mobile payment device 20.
  • the near field communication unit 201 or the mobile communication unit 202 may include a baseband unit that operates a communication protocol. Alternatively, the near field communication unit 201 or the mobile communication unit 202 may further include a radio frequency unit.
  • the radio unit can be used to receive radio frequency signals and convert the radio frequency signals into baseband signals for use.
  • the payment information is included in the radio frequency signal to be acquired by the near field communication unit 201 or the mobile communication unit 202.
  • the mobile payment device 20 of FIG. 2 also includes a memory 203, a secure element 204, and at least one central processing unit 205 that can be used to store mobile payment software.
  • At least one central processing unit 205 is configured to run general-purpose operating system software, such as an operating system such as an Android operating system, a Windows operating system, or an iOS operating system, which can be used to support general non-mobile payment application software.
  • general-purpose operating system software such as an operating system such as an Android operating system, a Windows operating system, or an iOS operating system, which can be used to support general non-mobile payment application software.
  • Universal operating system software is a common software platform that runs a variety of applications.
  • the central processing unit 205 can be implemented based on the ARM architecture or the Intel X86 architecture or the Million Instructions Per Second (MIPS) architecture, etc., which is not limited in this embodiment.
  • At least one central processing unit 205 controls the near field communication unit 201, the mobile communication unit 202, the memory 203, and the secure element 204 under the influence of the operating system software.
  • Specific control procedures may include: controlling on, controlling off, or controlling entering or exiting a low power state. Therefore, the central processing unit 205 running the general operating system can implement unified control of other parts of the mobile payment device 20, so that these parts are normally powered on and off, entering or exiting a low power consumption state, such as entering or exiting a sleep state. Any component of a communication unit, memory, or secure element consumes less power in a low power state than when the component is operating. Moreover, the control process for any of the components may also include other control operations, such as controlling the operating state.
  • the control working state may be an adjustment of the operating voltage, the clock frequency, or the processing rate when the component is in operation, which is not limited in this embodiment.
  • control operations of other components in the general central processing unit in the prior art may be made to be made to be made to be made to the control operations of other components in the general central processing unit in the prior art.
  • the secure element 204 can include a first memory module 2041 and a processor 2042.
  • the memory 203 may store the mobile payment software 2030.
  • the processor 2042 is configured to load the mobile payment software 2030 from the memory 203 into the first storage module 2041, run the mobile payment software 2030, and
  • the mobile payment software 2030 interacts with at least one of the near field communication unit 201 or the mobile communication unit 202 to pay for information.
  • the first storage module 2041 provides the processor 2042 with the memory space required to run the mobile payment software 2030.
  • the first storage module 2041 can be a random access memory (RAM).
  • the memory 203 can be a read-only memory (ROM).
  • the mobile payment software 2030 stored in the memory 203 may include a mobile payment operating system software 2031, which is different from ordinary operating system software, which is only one for running mobile.
  • the operating system platform of the payment application software 2032 makes the mobile payment more reliable.
  • the mobile payment operating system software 2031 may be a Chip Operating System (COS).
  • COS is also called a COS image, and can be equivalent to an operating system software that resides in a smart card or an integrated circuit (IC) card.
  • the secure element 204 is equivalent to having a resident smart card or a financial card.
  • Function which is used to provide data required for mobile payment services such as credit card services to external POS machines, card readers or financial servers on the cloud side, such as data related to banking financial services or personal account data of users, such as personal accounts and passwords. And various types of verification information required for the bank server to verify the personal account.
  • the COS image is also an operation platform for receiving and processing external payment information, such as a financial server or a card reader, and various payment information sent by the POS device to the secure element 204, and can be used to execute various instructions sent by the outside world, such as authentication operations.
  • the secure element 204 generally uses a COS based on the JAVA computer programming language as a security system.
  • the COS can be preset not only in the secure element 204, but also the mobile payment device 20 can dynamically download and install various mobile payment application software 2032 based on the COS. Such as various types of financial applications.
  • the specific design of the COS is part of the prior art and is outside the scope of this application.
  • the mobile payment software 2030 includes a plurality of mobile payment application software 2032 in addition to the mobile payment operating system software 2031.
  • a mobile payment application 2032 is used for a class of mobile payment functions.
  • each mobile payment application 2032 can be a bank related Software for implementing software functions related to the bank, such as account, password, authentication and authentication related information related to the bank, and functions related to the bank's featured services.
  • the application of mobile payment is not limited to the banking business, but also includes, but is not limited to, debit or credit card services, or other types of mobile payments, such as social security cards, transportation cards, or IC card payment services within an organization. This example does not limit this.
  • the secure element 204 and the at least one central processing unit 205 are located within a first semiconductor chip IC1 in the mobile payment device 20, which is also referred to as the main chip of the mobile payment device 20.
  • the secure element 204 with the at least one central processing unit 205 using the same semiconductor master chip IC1, the hardware implementation cost and area of mobile payment will be reduced without having to secure the payment related hardware as in the prior art.
  • the functional unit and the main chip are respectively formed into two independent chips, so that the arrangement of the more integrated main chip IC1 on the main board of the mobile payment device 20 is also simpler.
  • the near field communication unit 201 may be located in another fourth semiconductor chip IC4 in the mobile payment device 20.
  • the near field communication unit 201 can also be located in the first semiconductor chip IC1 (not shown), except that the fourth semiconductor chip IC4 shown in FIG. 2 or FIG. 6 is used to implement the near field communication unit 201. In order to further realize the integration of the main chip IC1 and reduce the implementation cost.
  • the mobile communication unit 202 can also be located within the first semiconductor chip IC1 as shown in FIG. 6, or otherwise located in another fifth semiconductor chip IC5 in the mobile payment device 20 as shown in FIG. Whether or not the near field communication unit 201 or the mobile communication unit 202 is integrated into the main chip IC1 depends on the specific design of those skilled in the art.
  • a semiconductor chip also referred to simply as a chip, may be a collection of integrated circuits fabricated on an integrated circuit substrate (typically a semiconductor material such as silicon) using an integrated circuit process, the outer layer of which Typically packaged by a semiconductor package material.
  • the integrated circuit may include a Metal-Oxide-Semiconductor (MOS) transistor, a bipolar transistor or a diode, or the like.
  • MOS Metal-Oxide-Semiconductor
  • the semiconductor chip can work independently or under the influence of necessary driving software to realize various functions such as communication, calculation, or storage.
  • the memory 203 may be Specifically, it is located in the second semiconductor chip IC2 in the mobile payment device 20. Alternatively, the memory 203 may also be integrated into the main chip IC1 (not shown) together with the near field communication unit 201 or the mobile communication unit 202, at which time the memory 203 and the secure element 204 may be regarded as being A system that implements secure payments. However, in general, similar to the scheme of FIG. 2 or FIG. 6, the memory 203 is implemented in the art by using the second semiconductor chip IC2 independent of the main chip IC1.
  • the memory 203 usually exists in the form of a flash memory when integrated in the main chip IC1, but the flash memory storage space is usually very limited, and if a large storage space is to be realized, the cost is greatly increased and realized. complex. If the flash memory 203 is implemented by using the independent second semiconductor chip IC2, the implementation cost is reduced and the design is simpler, and the storage capacity is more satisfied. In particular, the current memory is difficult to integrate with the main chip IC1 due to the production process, area, etc., and only the security element 204 is integrated with at least one central processing unit 205, and the main chip independent memory 203 is used, which is more suitable for existing mobile payment. Program.
  • the memory 203 can also be multiplexed by the mobile payment software 2030 and other software.
  • the memory 203 includes a secure storage area 203A and a normal storage area 203B that are isolated from each other.
  • the secure storage area 203A is used to store the mobile payment software 2030 for storing the aforementioned general operating system software.
  • the at least one central processing unit 205 is specifically configured to read and run the general operating system software from the normal storage area 203B in the memory 203, and the processor 2042 is specifically configured to use the mobile payment software. 2030 is loaded from the secure storage area 203A into the first storage module 2041.
  • the isolation indicates that the general operating system software and the mobile payment software 2030 are not mixed together, but exist in one memory 203 but are accessed independently by each other, and save memory under the premise of ensuring security. Resources.
  • the memory 203 at this time may be an embedded multimedia card (Embedded Multi Media Card, eMMC), the secure storage area 203A may be a Replay Protect Memory Block (RPMB) of the eMMC memory 203.
  • eMMC embedded Multi Media Card
  • RPMB Replay Protect Memory Block
  • the memory 203 can also be other types of storage devices, which is not limited in this embodiment.
  • the memory 203 may be dedicated to storing the mobile payment software 2030, that is, the memory 203 does not store other software related to mobile payment, including general operating system software.
  • the mobile payment device 20 also includes a normal storage unit 206 at this time. As shown in FIG. 2, the normal storage unit 206 is located in a third semiconductor chip IC3 in the mobile payment device 20, and the normal storage unit 206 is used to store the general operating system software.
  • the at least one central processing unit 205 is specifically configured to read and run the general operating system software from the normal storage unit 206.
  • the dedicated memory 203 is physically isolated from the normal storage unit 205, so that the operational security is further improved.
  • the normal storage unit 205 can be an eMMC as previously described.
  • the dedicated memory 203 may be a flash memory that is independent of the main chip IC1. However, the specific storage type of the normal storage unit 205 and the dedicated storage 203 is not limited in this embodiment.
  • the security element 204 further includes: a second storage module 2043, configured to store a startup program required for starting the processor 2042, such as a boot code at startup.
  • the processor is configured to read the startup program from the second storage module 2043, and the mobile payment operating system software 2031, such as The COS image is loaded from the memory 203 into the first storage module 2041 and runs the mobile payment operating system software 2031. Since the startup program required for the activation of the security element 204 is located in the second storage module 2043 inside the security element 204, the second storage module 2043 is dedicated to the activation of the security element 204 and is not external to any other security element 204. The software runs programs or hardware to access it at will, ensuring security.
  • the processor 2042 may be triggered by the payment information when interacting with the near field communication unit 201 or the mobile communication unit 202, and the One or more mobile payment application software 2032 of one less mobile payment application 2032 is loaded from the memory 203 into the first storage module 2041 and runs the one or more mobile payment application software 2032. Since the loading and running of the mobile payment application software 2032 is triggered by the interaction of the payment information, when the payment service is not available, the related mobile payment application software 2032 may not be turned on, and the memory space of the first storage module 2041 can be saved.
  • the mobile payment application software 2032 is loaded in a dynamic loading manner, that is, only the selected application software is loaded from the external memory 203 into the corresponding first storage module 2041, that is, the RAM. Other applications that are not needed are not loaded into the RAM, ensuring that the occupied space in the RAM is only used to hold the COS image and the program files of 1 to 2 applications without causing the RAM to be occupied. many.
  • the scheme in which the processor 2042 interacts with the communication peer (such as the payment terminal or the radio access network) through the communication unit (such as the near field communication unit 201 or the mobile communication unit 202) to the payment information belongs to the content of the mobile payment protocol, and the solution thereof is There are many kinds of prior art, and the process may be similar to the credit card process.
  • Each different service provider such as a bank, public transportation department, etc., may have its own mobile payment handshake communication protocol for implementing a payment handshake of the processor 2042 in the secure element 204 via the communication unit to the communication peer, such as personal privacy. Delivery of information, transmission of secure data, etc.
  • the present embodiment provides a mobile payment flow chart as shown in FIG.
  • various types of mobile payment related information transmitted between the mobile payment device 20 and the payment terminal through a wireless link can be regarded as payment information.
  • the brief steps of the payment process may include: S31, the central processing unit 205 runs the general operating system software, and controls the communication unit and the secure element 204 under the action of the general operating system software. The control can be to control on, off, enter, or exit a low power state. S32, the secure element 204 loads and runs the mobile payment software 2030 from the memory 203. S33.
  • the communication unit receives the mobile payment instruction from the communication peer end via the wireless communication link.
  • the command may be a request message for requesting the mobile payment device 20 to perform mobile payment.
  • the message may be included in an air interface signaling, and the specific implementation and signaling structure of the air interface signaling may refer to the content of the existing wireless communication protocol.
  • the mobile payment The instructions may include the necessary authentication and authentication requests in addition to the request to initiate the payment service.
  • the specific content may refer to the prior art in the field of mobile payment, and is not discussed in the present application.
  • S34. The communication unit obtains the mobile payment instruction by parsing the air interface signaling by running the wireless communication protocol software, and transmits the mobile payment instruction to the processor 2042 in the secure element 204.
  • S35 The processor 2042, after being driven by the mobile payment software 2030, sends mobile payment data to the communication unit in response to the mobile payment instruction.
  • the mobile payment data may include proof data of a user identity, such as a bank card number, an account number, personal confidential information, or a ciphertext required for various banking transactions, etc., which is similar to credit card information for credit card payment, and is used to be Read by the communication peer.
  • the communication unit runs a wireless communication protocol, and the mobile payment data is packaged into air interface signaling for transmission to the communication peer.
  • the communication peer transmits the mobile payment data to the server.
  • the server processes the mobile payment data to complete the payment service.
  • the communication peer end is a payment terminal such as a POS machine, and the payment terminal transmits the mobile payment data to the cloud side server through the Internet.
  • the mobile communication unit 202 acts as a communication unit that will communicate mobile payment data to the server over the wireless access network.
  • the existing payment solution such as the existing online payment service of the bank, which is not described in this application.
  • the transaction success information may be returned to the POS machine that uses the offline payment and displayed on the POS machine, or the server directly returns the transaction success information to the mobile communication unit of the mobile payment device 20 when the online payment is adopted.
  • the payment information includes a two-way communication process for implementing mobile payment handshake communication between the cloud server on the network side and the mobile payment device 20, and the handshake process of the two-way communication is different according to different service providers and processors 2042.
  • the mobile payment application 2032 differs and typically depends on different service providers.
  • the processor 2042 may be via a communication interface included in the secure element 204.
  • 2044 interacts with the near field communication unit 201 (located in IC 4) outside the main chip IC1 for the payment information.
  • the communication interface 2044 can follow a Single Wire Protocol (SWP).
  • SWP Single Wire Protocol
  • the communication interface 2044 can also use other interface protocols to implement the transmission of data or information.
  • the processor 2042 can implement information interaction with the near field communication unit 201 via an on-chip connection line, such as the on-chip bus 207 in FIG.
  • Communication interface 2044 is a standard SWP interface that can be implemented using the standard SWP protocol. How the near field communication unit 201 transmits data acquired from the POS to the secure element 204 based on the SWP protocol is already an existing mature solution and is outside the scope of this application.
  • the near field communication unit 201 and the at least one central processing unit 205 may be connected by an Inter-Integrated Circuit (I2C) interface to transmit other data.
  • I2C Inter-Integrated Circuit
  • Other interfaces may also perform similar functions and should not be excluded. Outside the implementation.
  • the near field communication unit 201 may internally store a routing table, and the near field communication unit 201 may identify the type of communication initiated by the communication peer. If the initiated service is a payment service, the relevant payment service related data is obtained by querying the routing table.
  • the near field communication unit 201 finds that the initiated service is a non-payment type service, the near field communication unit 201 forwards the data of the related non-payment type service to the at least one central processing unit 205 through the I2C interface by querying the routing table. For example, if the initiated service belongs to the credit card machine in the business enterprise and the credit card machine of the statistical work time, the near field communication unit 201 can send the data to the at least one central processing unit 205 through the I2C interface, and in the general operating system, such as In the Android environment, do a credit card simulation application.
  • the processor 2042 can also implement interactive payment information with the mobile communication unit 202 via an on-chip bus 207.
  • the on-chip bus 207 can also be coupled to the central processing unit 205 and the storage interface 208.
  • the storage interface 208 is used by the main chip IC1 to exchange data with the memory 203 in the second chip IC2.
  • the processor 2042 provides the mobile payment to the communication peer.
  • the data may be securely processed, and the security process may include at least one of the following: data encryption or data integrity protection.
  • the processor 2042 may further generate the security-processed data under the driving of the mobile payment software 2030, that is, the processor may perform security processing by using a software driver to ensure that the processed mobile payment data is transmitted to server.
  • the server can decrypt and de-protect the mobile payment data accordingly to verify whether the mobile payment data has been tampered with. If the mobile payment data has been tampered with, the server may return the previously mentioned payment failure information to ensure the security of the mobile payment process.
  • the processor 2042 may only generate raw data that is not securely processed for mobile payment data.
  • the secure processing is performed on the raw data by an independent security processing module 2045 of the secure element 204 to generate the securely processed data.
  • the security processing module 2045 can be hardware independent of the processor 2042, and can be a hardware accelerator including a circuit structure for implementing acceleration of security processing, so that the processing implementation is more optimized.
  • the processor 2042 In addition to the security processing of the data interacting with the communication peer, the processor 2042 also needs to read the mobile payment software 2030 from the memory 203, and the reading and writing of the mobile payment software 2030 can also be secured. Protection for better security.
  • the secure element 204 further includes an encryption and decryption engine 2046 for the movement after the processor 2042 loads the mobile payment software 2030 from the memory 203 into the first storage module 2041.
  • the payment software 2030 performs security verification and, after successful security verification, instructs the processor 2042 to run the mobile payment software 2030, the security verification including at least one of secure decryption or first hash check.
  • the encryption and decryption engine may be a hardware accelerator including a circuit structure.
  • the hardware form encryption/decryption engine 2046 stands on the processor 2042 and is dedicated to implementing the security verification function, it can be ensured that the mobile payment software 2030 is only run after the verification is successful, avoiding the mobile payment operating system software in the mobile payment software 2030.
  • the 2031 or mobile payment application software 2032 has been tampered with to improve the processing performance during security verification.
  • the secret engine 2046 can also be used to perform at least one of security encryption or first hash operation processing on the update data.
  • the processor 2042 is further configured to write the processed update data to the memory 203 to update the mobile payment software 2030.
  • the data update can be an update to the COS image or an update to any of the mobile payment application software 2032.
  • the content of the update data may include an upgrade file for the COS image or mobile payment application software 2032, and may also include an update of information for data encryption or data integrity protection of the mobile payment data, such as an upgrade of the key,
  • the recording file of the mobile payment may be included, such as personal information change, transaction log, etc., and the content of the update data is not limited in this embodiment.
  • the functionality of the encryption and decryption engine 2046 may also be replaced by the processor 2042, in which case a separate hardware encryption and decryption engine 2046 would not be required to read from or write to the memory 203.
  • the mobile payment software 2030 does the security processing, but the processor 2042 itself integrates the security function.
  • the processor 2042 may further perform a second hash operation process on the processed update data by using the key Krpmb when the processed update data is written to the memory to obtain a to be stored. data.
  • the second hash operation process may be similar to the previously mentioned first hash operation process, but the keys used to specifically perform the two hash processes are generally different.
  • the update data may be encrypted by using the key Krpmb in the second hash operation to obtain a digest value, and the digest value and the update data are combined to generate the to-be-stored data, and the digest value may also be an information authentication code (Messape). Authenticator Code, MAC) signature.
  • the memory 203 is further configured to perform a second hash check on the to-be-stored data, where the second hash check is a process corresponding to the second hash operation process, and is used to verify that the second hash operation is performed. Whether the processed data to be stored has been tampered with, specifically referring to the prior art of verifying the MAC signature.
  • the memory 203 obtains the processed update data after the second hash check succeeds, and updates the mobile payment software 2030 with the processed update data.
  • the secure storage area 203A is used to store the mobile payment software 2030.
  • the processor 2042 needs to verify the signature of the command in operations such as writing or erasing the secure storage area 203A, which is the key Krpmb.
  • eMMC The memory 203 verifies whether the write command data packet sent by the processor 2042 is correct according to the preset key Krpmb, and each write command data packet may include a partial data packet of all update data.
  • the specific hash check processing algorithm using the key Krpmb may be a Hash-based Message Authentication Code Secure Hash Algorithm (HMAC SHA) 256 algorithm.
  • HMAC SHA Hash-based Message Authentication Code Secure Hash Algorithm
  • each eMMC memory 203 unique key Krpmb can be programmed into the eMMC memory 203 when the eMMC memory 203 is produced, and the key Krpmb can also be programmed or recorded to the secure element.
  • 204 specifically can be programmed in the processor 2042 of the secure element 204 or other hardware circuits outside the programming processor 2042 by electronic fuse (eFuse) technology, and the key Krpmb is managed and used by the secure element 204. .
  • managing and using the key Krpmb in the security zone (Trustzone, TZ) of the central processing unit 205 is a more common The form of implementation.
  • the TZ is a Trust Execute Environment (TEE).
  • TEE Trust Execute Environment
  • an environment formed by a software operation is a software system that can exchange data with other software or hardware systems outside.
  • the trusted execution environment executed by the central processing unit 205 is securely isolated from the general operating system software (such as the Android system environment) also operated by the central processing unit 205, which are two independent software systems.
  • the security isolation between the trusted execution environment and the general operating system software is good, and the running programs of the general operating system software and the general application software based on the operating system cannot be accessed at will.
  • This trusted execution environment can then transfer data to and from the environment formed by the processor 2042 running the mobile payment software 2030, ie, with the secure element 204.
  • the general application software may include various types of non-secure payment related Software, such as instant messaging software, games, office software, e-book software or audio and video streaming media players.
  • management of the key Krpmb can be implemented in a trusted execution environment.
  • the key Krpmb can be programmed in the hardware circuit associated with the central processing unit 205, such that various types of non-secure software under the general operating system software (such as the Android system) of the central processing unit 205 do not know the Krpmb, so
  • the secure storage area 203A of the eMMC memory 203 performs a write operation.
  • the general operating system software of the central processing unit 205 and the running programs of various general application softwares based on the operating system are completely accessible. Since the general operating system software is securely isolated from the secure element 204, the general operating system software cannot access the secure element arbitrarily, and the mobile payment security can be improved.
  • the trusted execution environment may provide a user interface (UI) of the visualized bank payment or other financial service, such that the user inputs an instruction through the UI, such that the instruction is transmitted to the secure element 204 through the trusted execution environment.
  • the user is allowed to complete the information interaction with the secure element 204 through the UI.
  • the UI is a trusted UI that is distinct from the normal UI provided by the general operating system software and allows the user-entered mobile payment password to be sent to the secure element 204 via a relatively secure trusted execution environment, which then includes the mobile payment password.
  • the information is encrypted and transmitted to the server on the network side through the near field communication unit 201 or the mobile communication unit 202.
  • the memory 203 is an eMMC as an example.
  • a software architecture diagram for accessing the secure storage area 203A of the eMMC memory 203 according to an embodiment of the present invention is shown. .
  • the access may include reading data from the secure storage area 203A or writing data to the secure storage area 203A (secure data update or upgrade), and the unit of reading or writing may be a fixed unit of length.
  • the software architecture includes mobile payment software 2030, which is executed by secure element 204.
  • Mobile payment software 2030 provides card-swapping related functions similar to resident smart cards or IC cards, and may include the aforementioned mobile payment operating system software 2031 and mobile payment. Use software 2032.
  • the data 410 is data to be updated or upgraded, and the data 410 is processed by hash calculation.
  • the processed data 411 includes data 410 as plaintext data and a hash value (also referred to as a digest of data 410) 410A of the plaintext data 410.
  • the data 411 is then securely encrypted within the secure environment, and the data 411 can be specifically encrypted by the Kse key to obtain the ciphertext data 412.
  • the Kse key may be one or more sets of keys, and the secure encryption encryption algorithm may be any symmetric encryption algorithm or asymmetric encryption algorithm.
  • an available encryption algorithm may be an Advanced Encryption Standard (AES), which is not limited in this embodiment.
  • AES Advanced Encryption Standard
  • the secure element 204 can then transmit the ciphertext data 412 and the write address to the central processing unit 205 via the system bus 207 as shown in FIG. 6, ie the ciphertext data 412 and its write address are transferred from the mobile payment software 2030 environment to The central processing unit 205 is generated in the trusted execution environment 2051.
  • the central processing unit 205 performs a second hash operation on the ciphertext data 412 and its write address in the generated trusted execution environment 2051.
  • the ciphertext data 412 or a portion of the ciphertext data 412 may be encrypted using the key Krpmb.
  • the hashed digest value that is, the MAC signature
  • the encryption algorithm may be a hash algorithm as described in the previous embodiment, such as the HMAC SHA 256 algorithm.
  • the second hash operation process may also be other processing algorithms that satisfy the data security requirements of the secure storage area 203A of the eMMC memory 203.
  • the ciphertext data 412 and its write address as data can be divided into a plurality of sections, each section being processed in parallel. As shown in FIG. 4, the trusted execution environment 2051 includes a plurality of queues L1, . . .
  • each queue such as queue L1
  • each queue includes a portion of a packet L11 and a verification portion L12, wherein the verification portion L12 is a key Krpmb.
  • Each queue is then transferred from the trusted execution environment 2051 to the general operating system software 2052, typically to the kernel (Kernel) of the general operating system software 2052, which is typically transparent, ie, the general operating system software 2052 The data content will not be modified.
  • each The queues L1, ..., LN are converted into RPMB data D that can be read by the eMMC memory 203, D can also be divided into multiple segments or queues, such as D1, ...
  • the illustrated storage interface 208 is transmitted to the eMMC memory 203.
  • the queue L1 is processed by the eMMC protocol command to obtain the data D1, . . . DN conforming to the specification of the storage interface 208, but the original data content is not subjected to any processing or modification.
  • the eMMC memory 203 holds the key Krpmb, gets the queue L1 based on the data D1, and performs a MAC signature check on the check portion L12 in the queue L1 using the key Krpmb.
  • the key Krpmb is used to encrypt the packet L11 in the queue L1 to obtain a digest value, which is compared with the verification portion L12 to obtain a verification result. If the check passes, the ciphertext data 412 or its portion is obtained based on the plurality of sub-packets L11, and the corresponding write address, and the ciphertext data 412 or a portion thereof is written to the secure storage area 203A of the eMMC memory 203 in accordance with the write address. , for example, in RPMB.
  • the data queue sent by the eMMC memory 203 to the general operating system software 2052 and transmitted to the trusted execution environment 2051 via the universal operating system software 2052 is encrypted by the key Krpmb, including the packet L11 carrying the data content and the verification generated by the encryption. Part L12.
  • the central processing unit 205 encrypts the packet L11 in the cached queue L1 by using the key Krpmb to obtain a digest value, and the digest value is compared with the verification part L12 to check whether the data is verified. Was tampered with.
  • the security element 204 specifically the encryption/decryption engine 2046 or the processor 2042 as described above, obtains the ciphertext data 412 through the system bus 207 or other interface in the environment provided by the mobile payment software 2030, and utilizes the Kse key.
  • the resulting data 410 and the hash value 410A of the data 410 are securely decrypted.
  • the secure element 204 further hashes the hash value 410A and confirms that the relevant data has not been tampered with after the verification is successful, thereby achieving a successful read. If any of the hash check and the secure decryption are unsuccessful, the associated data can be considered tampering and the data read this time is not trusted, then the processor 2042 in the secure element 204 can decide to discard the data.
  • the processor 2042 may be when the data is not trusted.
  • the central processing unit 205 reports an error or an alarm, which is not limited in this embodiment.
  • either the mobile payment operating system software 2031, such as a COS image, or the read and write flow of the mobile payment application 2032 may be similar to that of FIG.
  • the data is written to the memory 203 as an example.
  • the processor 2042 may also generate an erase command.
  • the instruction carries an address of data that needs to be erased.
  • the instructions are transmitted by the processor 2042 to the central processing unit 205, i.e., by the mobile payment software environment 2030, to the trusted execution environment 2051.
  • the instructions may be encrypted (hash processing) by the central processing unit 205 using the key Krpmb in the trusted execution environment 2051 to obtain a digest value that is passed along with the instructions to the memory 203 via the general operating system software 2052.
  • the memory 203 adopts a similar verification method as described above, that is, the instruction is encrypted (hash processed) with the same key Krpmb, and the obtained result is compared with the digest value to determine whether the instruction passes the verification.
  • the memory 203 can erase the corresponding data according to the address in the instruction.
  • the key Krpmb encryption may also be processed by the processor 2042 in the secure element 204 instead of being executed by the central processing unit 205 in the trusted execution environment 2051.
  • the erased data may be part of the data of the mobile payment software 2030 stored in the memory 203.
  • the memory 203 can erase part of the data of the mobile payment operating system software 2031, or move all or part of the data of the payment application software 2032, in response to the instructions and in accordance with the address in the instructions.
  • the above solution may be applicable to the case where the eMMC memory 203 is multiplexed by the mobile payment software 2030 and the general operating system software 2052. It can be seen that unless the keys Krpmb and Kse are cracked, it is difficult for non-secure software to access the eMMC.
  • the secure storage area 203A of the memory 203 allows for better privacy and integrity of the data.
  • the key Kse is the most important means for generating ciphertext in the secure element 204 and preventing intrusion.
  • the embodiment of the present invention can integrate the secure element 204 in the main core IC1 slice with respect to the scheme of interacting data between the CPU of the main chip and the secure element located outside the main chip by the SPI, and the secure element 204 via the bus 207
  • the data transfer is implemented between the trusted execution environment 2051 of the central processing unit 205, and the security is better.
  • a third storage module 2047 can be included.
  • the processor 2042 may first write the data to the third storage module 2047 and send it to the central processing unit 205 on the bus 207.
  • An interrupt request is requested to request the central processing unit 205 to read the data in the third storage module 2047.
  • the interrupt request may include an address of the read data in the third storage module 2047.
  • central processing unit 205 can read the corresponding data from third storage module 2047 in response to the interrupt request.
  • the third storage module 2047 can be a RAM, such as Inter-Process Communication (IPC) RAM. Alternatively, the third storage module 2047 may also be another type of memory such as a cache.
  • IPC Inter-Process Communication
  • the third storage module 2047 may also be another type of memory such as a cache.
  • the memory storing the mobile payment software 2030 and the general operating system software 2052 can be physically isolated, and the basic flow of writing or reading of the data can be simplified.
  • the memory 203 is located in the second semiconductor chip IC2, and specifically may be an exclusive OR (Nor) flash memory.
  • the data is 410 is the data to be updated or upgraded, and the data 410 is subjected to hash calculation processing to obtain the processed data 411, and the data 411 includes the data 410 as the plaintext data and the hash value 410A of the data 410.
  • the data 411 is then securely encrypted within the secure environment, and the data 411 can be specifically encrypted by the Kse key to obtain the ciphertext data 412.
  • the ciphertext data 412 is then written directly to the memory 203.
  • the data reading process is opposite to the data writing process, and will not be described in detail in this embodiment.
  • the memory 203 is a storage device dedicated to mobile payment.
  • the forwarding of the trusted execution environment 2051 is not required, and the security element 204 can directly write or read various types of data, including COS, to the memory 203.
  • the processor 2042 in the secure element 204 can send an erase command to the memory 203, where the address carries the address of the data to be erased, and the memory 203 can directly directly address the relevant address after receiving the instruction. Data is erased to improve security.
  • mobile payment is a broad definition, which includes not only mobile payment services in commercial and financial fields, but also other types of payment services such as public transportation, ID cards, and social security cards. That is to say, through mobile payment, the mobile terminal can connect with the communication peer to finally realize the interaction payment information with the server, and realize data transaction, data exchange or data settlement associated with one or more accounts in the mobile terminal.
  • the unit of the data transaction, the exchange, or the data settlement may include not only the currency, but also other units that can be used for realizing payment, redemption, or transaction settlement, such as a virtual currency, various types of credits, or a credit line. This embodiment does not limit this.
  • the account includes, but is not limited to, a personal account, a group account, or an organizational account.
  • the mobile payment implementation is more flexible, and the execution subject is a mobile terminal, which can better meet the requirement of performing payment anytime and anywhere.
  • the number of central processing units 205 may be multiple.
  • a plurality of central processing units 205 are handed over to other components of mobile payment device 20, such as secure element 204.
  • Mutual data may refer to any one or more of the plurality of central processing units 205 that interact with data of the other components.
  • the plurality of central processing units 205 can be simultaneously turned on or partially turned on, and mutually cooperatively cooperate to implement the trusted execution environment 2051, the general operating system software 2052, and other application software.
  • the mobile payment device 20 may further include an image processing unit (GPU), an audio processing unit, a power consumption management unit (PMU), or a global positioning system (GPS), and the like.
  • GPU image processing unit
  • PMU power consumption management unit
  • GPS global positioning system
  • the mobile terminal 21 in addition to the mobile payment device 20 mainly including various types of circuits, a touch screen for input, a display, and other necessary sensors such as a gravity accelerometer, a gyroscope, or a photo sensor may be included.

Abstract

一种移动支付装置和方法，涉及移动通信领域。该移动支付装置包括：通信单元，用于通过无线链路与通信对端交互支付信息；存储器，用于存储移动支付软件；安全元件，包括第一存储模块和处理器；至少一个中央处理单元，用于运行通用操作系统软件，并在通用操作系统软件的作用下控制所述通信单元、存储器和所述安全元件中的至少一个；所述处理器用于将所述移动支付软件从所述存储器加载到所述第一存储模块中，在所述移动支付软件的作用下与所述通信单元交互所述支付信息；第一存储模块，用于为所述处理器提供运行所述移动支付软件所需的内存空间；其中，所述安全元件与所述至少一个中央处理单元位于移动支付装置中的第一半导体芯片内。

Description

移动支付装置和方法
本申请要求于2015年4月24日提交中国专利局、申请号为201510201343.9、发明名称为“移动支付装置和方法”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及移动通信领域，尤其涉及一种移动支付装置和方法。
背景技术
移动支付(Mobile Payment)是指允许用户使用其移动终端，例如手机或平板电脑，对所消费的商品或服务进行账务支付的一种服务方式。通过移动终端实现移动支付目前有三种方式，分别是安全数据(Secure Digital，SD)卡方案、用户识别模块(Subscriber Identity Module，SIM)方案、或近场通信(Near Field Communication，NFC)结合安全元件(Secure Element，SE)的全终端解决方案。目前近场通信结合安全元件的全终端解决方案越来越成为实现移动支付方案的主流。
一种现有的全终端解决方案如图1所示，移动终端10通过其内部的近场通信单元101与销售点(Point of sales，POS)机11通信，近场通信单元101和POS机11间的近距离无线通信连路12为双向通路，可采用各类合适的短距离无线通信协议实现，以实现移动支付中的基本无线通信功能。例如，通信连路12可用于从POS机11向移动终端10内部的近场通信单元101传输POS指令数据等。安全元件102则可以是与一个独立的中央处理单元(Central Processing Unit，CPU)103相耦合的部件，用于对运行金融支付业务相关的各类功能，并存储与银行业务相关的密钥、证书等数据。在交易时，安全元件102从近场通信单元101收到POS指令数据，解析指令数据并根据金融交易协议进行相应回应。所述回应被近场通信单元101反馈给POS机11以完成移动支付中的数据传输，以实现移动终端10作为交易验证卡的功能。中央处理单 元103则运行有操作系统软件1031，例如安卓(Android)系统软件，其用于对近场通信单元101和安全元件102进行控制，例如控制打开或关闭近场通信单元101和安全元件102。此外，移动终端10可包括输入单元104，输入单元104可以是触摸屏，用于通过一个用户界面(User Interface，UI)来与用户交互消息，使得用户可以通过UI在输入单元104上输入操作指令，以便指示操作系统软件1031和相关应用软件执行相关操作，如交易的确认、或个人交易密码的输入等。POS机11作为一个交易的终端设备通过互联网接入网络侧的云服务器14，以实现通过服务器14计算并完成支付业务。位于网络侧的服务器14通常由银行运营。
全终端的解决方案可包括线上支付和线下支付。在线下支付时，如图1所示，移动终端10与POS机11进行非接触式刷卡，即刷手机，近场通信单元101和安全元件102共同作用完成支付交易。在采用线上支付时，则可以不通过近场通信单元10实现，中央处理单元103和安全元件102此时可通过移动通信网络接入互联网实现线上支付，此时安全元件102相当于银行U盾的作用，用于存储并验证银行的证书，因此上述图1中近场通信单元101是可选的。具体地，请参见图1，在线上支付时，移动终端10可进一步包括一个移动通信单元105，用于代替线下支付时近场通信单元101的作用，其接入无线接入网(Radio Access Network，RAN)15，具体可以是无线接入网15中的基站，并通过该无线接入网15接入互联网，所述互联网与位于互联网中的服务器14连接，以实现服务器14接收指令数据或传输信息给安全元件102。安全元件102解析指令数据并根据金融交易协议进行相应回应，以便通过移动通信单元105将数据通过移动互联网传输给网络侧服务器14。此时移动通信单元105可以是一个运行无线蜂窝通信协议的单元，用于将移动终端10通过蜂窝无线通信链路13接入互联网。移动通信单元105具体可运行全球移动通信(Global System for Mobile，GSM)、通用移动通信系统(Universal Mobile  Telecommunications System，UMTS)、全球微波互联接入(Worldwide Interoperability for Microwave Access，WiMAX)或长期演进(Long Term Evolution，LTE)等蜂窝无线通信协议以实现移动终端10的移动互联网功能。
目前的各类移动终端采用的方案都是将安全元件102外置于主系统之外，如图1所示，中央处理单元103和移动通信单元105可以位于一个集成电路衬底上，即成为一块主芯片106上。安全元件102则具体是一个独立于主芯片106外的芯片。安全元件102具体通过串行外设接口(Serial Peripheral Interface，SPI)与主芯片106中的中央处理单元103通信。然而，安全元件102外置于主芯片106之外会导致安全元件102和主芯片106在移动终端10的主板上占用大的面积，并且会消耗更多成本。
发明内容
本发明实施例提供了一种移动支付装置和方法，以降低移动支付的硬件实现成本和面积。
第一方面，本发明实施例提供了一种移动支付装置，包括：通信单元，用于通过无线链路与通信对端交互支付信息；存储器，用于存储移动支付软件；安全元件，包括第一存储模块和处理器；至少一个中央处理单元，用于运行通用操作系统软件，并在通用操作系统软件的作用下控制所述通信单元、存储器和所述安全元件中的至少一个；所述处理器用于将所述移动支付软件从所述存储器加载到所述第一存储模块中，运行所述移动支付软件，并在所述移动支付软件的作用下与所述通信单元交互所述支付信息；第一存储模块，用于为所述处理器提供运行所述移动支付软件所需的内存空间；其中，所述安全元件与所述至少一个中央处理单元位于所述移动支付装置中的第一半导体芯片内。通过使用同一个第一半导体芯片集成所述安全元件与所述至少一个中央处理单元，移动支付的硬件实现成本和面积将被降低。可选地，所述通信单元可包括基带 单元。所述通信单元还可进一步包括射频单元。
根据第一方面，在第一方面的第一种可能的实现方式中，所述存储器位于所述移动支付装置中的第二半导体芯片内。由于第一半导体芯片独立于第二半导体芯片，存储移动支付软件的所述存储单元不必与执行所述移动支付软件的所述安全元件集成在一起，降低了硬件实现的难度和复杂度。特别是目前的存储器由于工艺、面积等原因难以与包括CPU的第一芯片集成，所述方案通过仅将安全元件与CPU集成，而采用片外存储器，更适合于移动支付方案。
根据第一方面的第一种可能的实现方式，在第一方面的第二种可能的实现方式中，所述存储器包括互相隔离的安全存储区域和普通存储区域；所述安全存储区域用于存储所述移动支付软件；所述普通存储区域用于存储所述通用操作系统软件；所述处理器具体用于将所述移动支付软件从所述存储器中的所述安全存储区加载到所述第一存储模块中；所述至少一个中央处理单元具体用于从所述存储器中的所述普通存储区读取并运行所述通用操作系统软件。该实现方式等价于复用了所述存储器，使得所述通用操作系统软件和所述移动支付软件共存在一个存储器中且实现彼此安全隔离，在保证安全性的前提下节省存储器资源。
根据第一方面的第一种可能的实现方式，在第一方面的第三种可能的实现方式中，所述存储器专用于存储所述移动支付软件；所述移动支付装置还包括普通存储单元，所述普通存储单元位于所述移动支付装置中的第三半导体芯片内，该普通存储单元用于存储所述通用操作系统软件；所述至少一个中央处理单元具体用于从所述普通存储单元中读取并运行所述通用操作系统软件。所述实现方式可让专用于存储所述移动支付软件的专用存储器与普通存储单元在物理上隔离，使得操作安全性进一步提高。
根据第一方面、或第一方面的第一种至第三种可能的实现方式中的任一方式，在第一方面的第四种可能的实现方式中，所述移动支付软件包括移动支付 操作系统软件。在移动支付软件中采用一个安全可靠的移动支付操作系统软件，可保证操作安全性，且也有利于以该移动支付操作系统软件为平台实现更多的移动支付应用软件，如支持不同银行的业务。可选地，所述移动支付操作系统软件为COS镜像。
根据第一方面的第四种可能的实现方式，在第一方面的第五种可能的实现方式中，所述移动支付软件还包括至少一个移动支付应用软件。移动支付应用软件的数量越多将有利于移动支付业务扩展到更多不同的服务提供商，如不同的银行或商业机构。
根据第一方面的第四种或第五种可能的实现方式，在第一方面的第六种可能的实现方式中，所述安全元件还包括：第二存储模块，用于存储所述处理器启动所需的启动程序；当所述安全元件上电时，所述处理器用于从所述第二存储模块读取所述启动程序，在所述启动程序的作用下将所述移动支付操作系统软件从所述存储器加载到所述第一存储模块中，并运行所述移动支付操作系统软件。由于所述安全元件启动所需的启动程序位于安全元件内部的一个独立的第二存储模块中，可以保证所述安全元件启动的安全性。
根据第一方面的第五种可能的实现方式，在第一方面的第七种可能的实现方式中，所述处理器用于在与所述通信单元交互所述支付信息时受所述支付信息触发，将所述至少一个移动支付应用软件中的一个或多个移动支付应用软件从所述存储器加载到所述第一存储模块中，并运行所述一个或多个移动支付应用软件。由于移动支付应用软件的加载和运行是受到交互所述支付信息的触发，当没有支付服务时，相关移动支付应用软件可不被开启，能够节省第一存储模块的内存空间。特别是在安全元件高度集成的情况下，第一存储模块的空间很有限，相关方案能达到很好节约效果。
根据第一方面、或第一方面的第一种至第七种可能的实现方式中的任一方式，在第一方面的第八种可能的实现方式中，所述支付信息包括：从所述通信 对端经由所述通信单元传输至所述处理器的移动支付指令、以及响应所述移动支付指令从所述处理器经由所述通信单元传输至所述通信对端的移动支付数据。因此，所述支付信息包括了移动支付中双向通信过程。
根据第一方面的第八种可能的实现方式，在第一方面的第九种可能的实现方式中，所述移动支付数据包括经过安全处理的数据，所述安全处理包括如下至少一项：数据加密或数据完整性保护。由于移动支付数据经过了安全处理，使得在采用移动支付装置进行移动支付的时候，送给通信对端的所述移动支付数据安全性更有保障。
根据第一方面的第九种可能的实现方式，在第一方面的第十种可能的实现方式中，所述处理器还用于生成所述经过安全处理的数据。所述处理器由于具有安全处理过程，使得安全处理过程更集中于所述处理器上，无需额外的安全硬件，可节约成本。
根据第一方面的第九种可能的实现方式，在第一方面的第十一种可能的实现方式中，所述处理器还用于生成原始数据；所述安全元件还包括：安全处理模块，用于对所述原始数据进行所述安全处理以生成所述经过安全处理的数据。由于采用独立于处理器的安全处理模块进行安全处理，实现了安全处理的加速，处理实现更加优化。可选地，所述安全处理模块可以是一个硬件加速器。
根据第一方面、或第一方面的第一种至第十一种可能的实现方式中的任一方式，在第一方面的第十二种可能的实现方式中，所述至少一个中央处理单元对所述通信单元、存储器和所述安全元件中的至少一个的控制包括：控制开启、控制关闭或控制进入或退出低功耗状态或控制工作状态。可选地，所述至少一个中央处理单元可以是进阶精简指令集机器(Advanced RISC Machine，ARM)处理器。通过该至少一个中央处理单元可以在总体上方便地控制系统内其他单元的运行。
根据第一方面、或第一方面的第一种至第十二种可能的实现方式中的任一 方式，在第一方面的第十三种可能的实现方式中，所述通信单元为近场通信单元，所述通信对端为支付终端，所述近场通信单元具体用于通过运行短距离无线通信协议与所述支付终端交互所述支付信息。本方案便于通过近场通信单元与支付终端，例如POS机，进行方便的移动支付。可选地，所述近场通信单元包括用于运行短距离无线通信协议的近场通信基带单元。进一步地，所述近场通信单元还包括用于接收或发送射频信号的近场通信射频单元，所述射频信号被所述近场通信射频单元转化为近场通信基带单元能够处理的基带信号，所述射频信号包括所述支付信息。
根据第一方面的第十三种可能的实现方式，在第一方面的第十四种可能的实现方式中，所述近场通信单元位于所述第一半导体芯片内或者位于移动支付装置中的第四半导体芯片内。当所述近场通信单元位于所述第一半导体芯片内时，可以实现所述近场通信单元与安全元件和所述至少一个中央处理单元的高度集成，降低实现成本。当所述近场通信单元位于另一第四半导体芯片内时，可降低由于需要集成近场通信单元带来的设计难度。
根据第一方面、或第一方面的第一种至第十二种可能的实现方式中的任一方式，在第一方面的第十五种可能的实现方式中，所述通信单元为移动通信单元，所述通信对端为无线接入网，所述移动通信单元用于通过运行蜂窝无线通信协议与所述无线接入网交互所述支付信息。该方案有利于通过移动通信实现安全支付功能。可选地，所述移动通信单元包括用于蜂窝无线通信协议的移动通信基带单元。进一步地，所述移动通信单元还包括用于接收或发送射频信号的移动通信射频单元，所述射频信号被所述移动通信射频单元转化为移动通信基带单元能够处理的基带信号，所述射频信号包括所述支付信息。
根据第一方面的第十五种可能的实现方式，在第一方面的第十六种可能的实现方式中，所述移动通信单元位于所述第一半导体芯片内或者移动支付装置中的第五半导体芯片内。当所述移动通信单元位于所述第一半导体芯片内时， 可以实现高度集成，降低实现成本。当所述移动通信单元位于另一第五半导体芯片内时，可降低由于集成带来的设计难度。
根据第一方面、或第一方面的第一种至第十六种可能的实现方式中的任一方式，在第一方面的第十七种可能的实现方式中，所述安全元件还包括：加解密引擎，用于在所述处理器将所述移动支付软件从所述存储器加载到所述第一存储模块中后对所述移动支付软件进行安全验证，并在安全验证成功后指示所述处理器运行所述移动支付软件，所述安全验证包括安全解密或哈希(Hash)校验中的至少一项。可选地，该加解密引擎可以是一个硬件加速器。由于加解密引擎独立于所述安全元件中的处理器，专用于实现安全验证功能，可在验证成功后运行移动支付软件，确保移动支付软件在运行前不会被篡改，有利于提高安全验证时的处理性能。
根据第一方面的第十七种可能的实现方式，在第一方面的第十八种可能的实现方式中，所述加解密引擎，还用于对更新数据做安全加密或第一哈希运算处理中的至少一种处理得到处理后的更新数据；所述处理器还用于将所述处理后的更新数据写入到所述存储器以更新所述移动支付软件。当移动支付软件需要更新时，通过加解密引擎的处理，便于后续再一次读出该更新后的移动支付软件时对相关软件进行验证，确保移动支付软件不会被篡改，更好保证需要更新的软件的安全性。
根据第一方面、或第一方面的第一种至第十六种可能的实现方式中的任一方式，在第一方面的第十九种可能的实现方式中，所述处理器还用于在将所述移动支付软件从所述存储器加载到所述第一存储模块中后对所述移动支付软件进行安全验证，并在安全验证成功后运行所述移动支付软件，所述安全验证包括安全解密或第一哈希校验中的至少一项。由于所述处理器自身已经具有上述安全验证功能，因此无需其他额外单元实现该功能，降低设计难度。
根据第一方面的第十九种可能的实现方式，在第一方面的第二十种可能的 实现方式中，所述处理器还用于对更新数据做安全加密或第一哈希运算处理中的至少一种处理得到处理后的更新数据，并将所述处理后的更新数据写入到所述存储器以更新所述移动支付软件。当移动支付软件需要更新时，处理器可进一步对需要更新的软件做安全处理，以便于后续再一次读出该更新后的移动支付软件时对相关软件进行验证，实现了在处理器中的更多功能集成。
根据第一方面的第十八种或第二十种可能的实现方式，在第一方面的第二十一种可能的实现方式中，所述处理器在将所述处理后的更新数据写入到所述存储器时还用于利用密钥对所述处理后的更新数据做第二哈希运算处理得到待存储数据；所述存储器还用于对所述待存储数据做第二哈希校验，在第二哈希校验成功后得到所述处理后的更新数据，并利用所述处理后的更新数据更新所述移动支付软件。由于处理器具有如上所述的能力，使得被写入所述存储器的数据都需经过存储器的校验，保证存储器写入数据的安全性。
根据第一方面的第十八种或第二十种可能的实现方式，在第一方面的第二十二种可能的实现方式中，所述处理器在将所述处理后的更新数据写入到所述存储器时还用于将所述处理后的更新数据发送给所述至少一个中央处理单元；所述至少一个中央处理单元还用于在可信执行环境中利用密钥对所述处理后的更新数据做第二哈希运算处理得到待存储数据，并将所述待存储数据发送给所述存储器；所述可信执行环境与所述被运行的通用操作系统软件间存在安全隔离；所述存储器还用于对所述待存储数据做第二哈希校验，在第二哈希校验成功后得到所述处理后的更新数据，并利用所述处理后的更新数据更新所述移动支付软件。本方案中的更新数据从处理器写入存储器时，需要通过至少一个中央处理单元的可信执行环境来传递，且在可信执行环境中经过哈希处理，以使得存储器执行相应哈希校验，由于所述可信执行环境比通用操作系统软件更加可信，可提高存储器写入数据的安全性。
根据第一方面的第二十二种可能的实现方式，在第一方面的第二十三种可 能的实现方式中，所述安全元件还包括第三存储模块；处理器还用于将所述处理后的更新数据写入所述第三存储模块中，并向所述至少一个中央处理单元发送第一中断请求；所述至少一个中央处理单元还用于在可信执行环境中响应所述第一中断请求从第三存储模块中读取所述处理后的更新数据。
根据第一方面、或第一方面的第一种至第二十三种可能的实现方式中的任一方式，在第一方面的第二十四种可能的实现方式中，所述至少一个中央处理单元，还用于运行除所述移动支付软件外的普通应用软件。至少一个中央处理单元是移动终端内常用的通用中央处理单元，有利于该方案在普通移动终端上的扩展。
根据第一方面、或第一方面的第一种至第二十四种可能的实现方式中的任一方式，在第一方面的第二十五种可能的实现方式中，所述至少一个中央处理单元所运行的通用操作系统软件与所述安全元件存在安全隔离。由于所述隔离的存在，通用操作系统软件并不能随意对所述安全元件进行访问，可提高移动支付安全性。
根据第一方面、或第一方面的第一种至第十七种、第十九种、第二十四种和第二十五种可能的实现方式中的任一方式，在第一方面的第二十六种可能的实现方式中，所述处理器还用于利用密钥对更新数据或擦除指令做第二哈希运算处理得到处理结果；所述存储器还用于对所述处理结果做第二哈希校验，在第二哈希校验成功后得到所述更新数据或擦除指令，并利用更新数据更新所述移动支付软件或根据擦除指令擦除所述存储器中的与擦除指令对应的数据。该方案提高了移动支付中数据擦除的安全性。
根据第一方面、或第一方面的第一种至第十七种、第十九种、第二十四种和第二十五种可能的实现方式中的任一方式，在第一方面的第二十七种可能的实现方式中，所述处理器还用于将更新数据或擦除指令发送给所述至少一个中央处理单元；所述至少一个中央处理单元还用于在可信执行环境中利用密钥对 更新数据或擦除指令做第二哈希运算处理得到处理结果，并将该处理结果发送给所述存储器；所述可信执行环境与所述被运行的通用操作系统软件间存在安全隔离；所述存储器还用于对所述处理结果做第二哈希校验，在第二哈希校验成功后得到所述更新数据或擦除指令，并利用更新数据更新所述移动支付软件或根据擦除指令擦除所述存储器中的与擦除指令对应的数据。该方案提高了移动支付中数据擦除的安全性，且由中央处理单元实现安全处理，简化了处理器的设计。
第二方面，本发明实施例提供了一种通过移动支付装置实现移动支付的方法，包括：通过至少一个中央处理单元运行通用操作系统软件，并在通用操作系统软件的作用下控制通信单元和安全元件中的至少一个；将移动支付软件从存储器加载到所述安全元件中；在所述安全元件内运行移动支付软件；在所述移动支付软件的作用下，所述安全元件与所述通信单元交互支付信息，其中所述通信单元通过无线链路与通信对端交互支付信息；其中，所述安全元件与所述至少一个中央处理单元位于所述移动支付装置中的第一半导体芯片内。通过使用同一个半导体芯片集成了所述安全元件与所述至少一个中央处理单元，移动支付的硬件实现成本和面积将被降低。
第三方面，本发明实施例提供了一种半导体芯片，用于移动支付装置，所述半导体芯片包括安全元件与至少一个中央处理单元，所述安全元件包括第一存储模块和处理器，所述第一存储模块，用于为所述处理器提供运行移动支付软件所需的内存空间；所述至少一个中央处理单元，用于运行通用操作系统软件；所述处理器用于将所述移动支付软件从所述移动支付装置的存储器中加载到所述第一存储模块中，运行所述移动支付软件，并在所述移动支付软件的作用下与移动支付装置中的通信单元交互支付信息；所述至少一个中央处理单元，还用于在通用操作系统软件的作用下控制所述通信单元、存储器和所述安全模块中的至少一个。
根据第三方面，在第三方面的第一种可能的实现方式中，所述移动支付软件包括移动支付操作系统软件。
根据第三方面的第一种可能的实现方式，在第三方面的第二种可能的实现方式中，所述移动支付软件还包括至少一个移动支付应用软件。
根据第三方面的第一种或第二种可能的实现方式，在第三方面的第三种可能的实现方式中，所述安全元件还包括：第二存储模块，用于存储所述处理器启动所需的启动程序；当所述安全元件上电时，所述处理器用于从所述第二存储模块读取所述启动程序，在所述启动程序的作用下将所述移动支付操作系统软件从所述存储器加载到所述第一存储模块中，并运行所述移动支付操作系统软件。
根据第三方面的第二种可能的实现方式，在第三方面的第四种可能的实现方式中，所述处理器用于在与所述通信单元交互所述支付信息时受所述支付信息触发，将所述至少一个移动支付应用软件中的一个或多个移动支付应用软件从所述存储器加载到所述第一存储模块中，并运行所述一个或多个移动支付应用软件。
根据第三方面、或第三方面的第一种至第四种可能的实现方式中的任一方式，在第三方面的第五种可能的实现方式中，所述支付信息包括：从所述通信对端经由所述通信单元传输至所述处理器的移动支付指令、以及响应所述移动支付指令从所述处理器经由所述通信单元传输至所述通信对端的移动支付数据。
根据第三方面的第五种可能的实现方式，在第三方面的第六种可能的实现方式中，所述移动支付数据包括经过安全处理的数据，所述安全处理包括如下至少一项：数据加密或数据完整性保护。
根据第三方面的第六种可能的实现方式，在第三方面的第七种可能的实现方式中，所述处理器还用于生成所述经过安全处理的数据。
根据第三方面的第六种可能的实现方式，在第三方面的第八种可能的实现方式中，所述处理器还用于生成原始数据；所述安全元件还包括：安全处理模块，用于对所述原始数据进行所述安全处理以生成所述经过安全处理的数据。
根据第三方面、或第三方面的第一种至第八种可能的实现方式中的任一方式，在第三方面的第九种可能的实现方式中，所述至少一个中央处理单元对所述通信单元、存储器和所述安全元件中的至少一个的控制包括：控制开启、控制关闭或控制进入或退出低功耗状态或控制工作状态。
根据第三方面、或第三方面的第一种至第十种可能的实现方式中的任一方式，在第三方面的第十一种可能的实现方式中，所述安全元件还包括：加解密引擎，用于在所述处理器将所述移动支付软件从所述存储器加载到所述第一存储模块中后对所述移动支付软件进行安全验证，并在安全验证成功后指示所述处理器运行所述移动支付软件，所述安全验证包括安全解密或哈希(Hash)校验中的至少一项。
根据第三方面的第十一种可能的实现方式，在第三方面的第十二种可能的实现方式中，所述加解密引擎，还用于对更新数据做安全加密或第一哈希运算处理中的至少一种处理得到处理后的更新数据；所述处理器还用于将所述处理后的更新数据写入到所述存储器以更新所述移动支付软件。
根据第三方面、或第三方面的第一种至第十种可能的实现方式中的任一方式，在第三方面的第十三种可能的实现方式中，所述处理器还用于在将所述移动支付软件从所述存储器加载到所述第一存储模块中后对所述移动支付软件进行安全验证，并在安全验证成功后运行所述移动支付软件，所述安全验证包括安全解密或第一哈希校验中的至少一项。
根据第三方面的第十三种可能的实现方式，在第三方面的第十四种可能的实现方式中，所述处理器还用于对更新数据做安全加密或第一哈希运算处理中的至少一种处理得到处理后的更新数据，并将所述处理后的更新数据写入到所 述存储器以更新所述移动支付软件。
根据第三方面的第十二种或第十四种可能的实现方式，在第一方面的第二十五种可能的实现方式中，所述处理器在将所述处理后的更新数据写入到所述存储器时还用于利用密钥对所述处理后的更新数据做第二哈希运算处理得到待存储数据；所述存储器还用于对所述待存储数据做第二哈希校验，在第二哈希校验成功后得到所述处理后的更新数据，并利用所述处理后的更新数据更新所述移动支付软件。
根据第三方面的第十二种或第十四种可能的实现方式，在第三方面的第十六种可能的实现方式中，所述处理器在将所述处理后的更新数据写入到所述存储器时还用于将所述处理后的更新数据发送给所述至少一个中央处理单元；所述至少一个中央处理单元还用于在可信执行环境中利用密钥对所述处理后的更新数据做第二哈希运算处理得到待存储数据，并将所述待存储数据发送给所述存储器；所述可信执行环境与所述被运行的通用操作系统软件间存在安全隔离；所述存储器还用于对所述待存储数据做第二哈希校验，在第二哈希校验成功后得到所述处理后的更新数据，并利用所述处理后的更新数据更新所述移动支付软件。
根据第三方面的第十六种可能的实现方式，在第三方面的第十七种可能的实现方式中，所述安全元件还包括第三存储模块；处理器还用于将所述处理后的更新数据写入所述第三存储模块中，并向所述至少一个中央处理单元发送第一中断请求；所述至少一个中央处理单元还用于在可信执行环境中响应所述第一中断请求从第三存储模块中读取所述处理后的更新数据。
根据第三方面、或第三方面的第一种至第十七种可能的实现方式中的任一方式，在第三方面的第十八种可能的实现方式中，所述至少一个中央处理单元，还用于运行除所述移动支付软件外的普通应用软件。
根据第三方面、或第三方面的第一种至第十八种可能的实现方式中的任一 方式，在第三方面的第十九种可能的实现方式中，所述至少一个中央处理单元所运行的通用操作系统软件与所述安全元件存在安全隔离。
根据第三方面、或第三方面的第一种至第十一种、第十三种、第十八种和第十九种可能的实现方式中的任一方式，在第三方面的第二十种可能的实现方式中，所述处理器还用于利用密钥对更新数据或擦除指令做第二哈希运算处理得到处理结果；所述存储器还用于对所述处理结果做第二哈希校验，在第二哈希校验成功后得到所述更新数据或擦除指令，并利用更新数据更新所述移动支付软件或根据擦除指令擦除所述存储器中的与擦除指令对应的数据。
根据第三方面、或第三方面的第一种至第十一种、第十三种、第十八种和第十九种可能的实现方式中的任一方式，在第三方面的第二十一种可能的实现方式中，所述处理器还用于将更新数据或擦除指令发送给所述至少一个中央处理单元；所述至少一个中央处理单元还用于在可信执行环境中利用密钥对更新数据或擦除指令做第二哈希运算处理得到处理结果，并将该处理结果发送给所述存储器；所述可信执行环境与所述被运行的通用操作系统软件间存在安全隔离；所述存储器还用于对所述处理结果做第二哈希校验，在第二哈希校验成功后得到所述更新数据或擦除指令，并利用更新数据更新所述移动支付软件或根据擦除指令擦除所述存储器中的与擦除指令对应的数据。
本发明实施例提供的技术方案可在确保移动支付安全性的情况下降低硬件实现成本和面积，更好地适应移动支付中移动终端小型化的需求，方便了移动支付的普及和扩展。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例或现有技术的简化示意图，对于本领域普 通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为现有技术提供的一种简化的用于移动支付的移动终端结构的简化示意图；
图2为本发明实施例提供的一种移动支付装置结构的简化示意图；
图3为本发明实施例提供的一种移动支付流程的简化示意图；
图4为本发明实施例提供的一种移动支付软件对存储器的安全存储区域进行安全访问操作的简化示意图；
图5为本发明实施例提供的另一种移动支付软件对存储器的安全存储区域进行安全访问操作的简化示意图；
图6为本发明实施例提供的一种移动支付装置内用于移动支付的系统结构的简化示意图；
图7为本发明实施例提供的一种用于移动支付的存储器的简化结构示意图；
图8为本发明实施例提供的一种用于移动支付的软件系统架构的简化示意图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
图2为本发明实施例提供的一种移动支付装置20的示意图。该移动支付 装置20可以位于一个移动终端21内。该移动终端21可以是一个用户设备(User Equipment，UE)，如手机、平板电脑等各种类型的便携式终端设备。该移动支付装置21具体可以是芯片或芯片组或搭载有芯片或芯片组的电路板。该芯片或芯片组或搭载有芯片或芯片组的电路板可在必要的软件驱动下工作。移动支付装置20可包括：近场通信单元201，通过运行短距离无线通信协议与位于移动终端21外的用于接入互联网以实现移动支付功能的支付终端，例如POS机，交互支付信息，以实现线下支付。移动通信单元202，通过运行蜂窝无线通信协议与无线接入网，具体如无线接入网中的基站交互支付信息，以便通过包括该基站的无线接入网接入互联网，以最终实现移动通信单元202与互联网中具有支付功能的服务器交互支付信息，从而实现线上支付。可以理解，该移动支付装置20可以包括近场通信单元201或移动通信单元202之一，即可实现线下支付或线上支付的任一种。其中，近场通信单元201运行的短距离无线通信协议可以采用射频识别(Radio Frequency Identification，RFID)技术，具体可支持各种类型的RFID协议，例如欧洲计算机制造联合会(European Computer Manufactures Association，ECMA)标准协议，此外也不排除蓝牙通信、红外通信、无线保真(WiFi)协议等其他类型的短距离通信协议。移动通信单元202运行的蜂窝无线通信协议可以是GSM、UMTS、WiMAX或LTE等任一种或多种蜂窝无线通信协议，以实现通过该移动通信单元202与蜂窝移动通信网络中无线接入网的通信。可以理解，无线接入网中的基站是一种实现上述通信功能的无线接入网中的网元，基站的形态可以有多种，如NodeB、eNodeB等。包括所述基站的无线接入网最终将连接到网络中的服务器，即云侧服务器，实现服务器与移动支付装置20的支付信息交互。近场通信单元201或移动通信单元202可以包括运行通信协议的基带单元。可选地，近场通信单元201或移动通信单元202可以进一步包括射频单元。与现有技术类似，射频单元可用于进行射频信号接收并将射频信号转化为基带信号以供上 述基带单元处理。支付信息被包括在射频信号内，从而被近场通信单元201或移动通信单元202获取。
图2中的移动支付装置20中还包括可用于存储移动支付软件的存储器203、安全元件204和至少一个中央处理单元205。至少一个中央处理单元205，用于运行通用操作系统软件，如安卓操作系统、Windows操作系统或iOS操作系统等通用的操作系统，这些操作系统可以用来支持一般的非移动支付类应用软件。中央处理单元205的数量越多，能够处理数据的能力越强。通用操作系统软件则是运行各种应用软件的通用软件平台。中央处理单元205可以基于ARM架构或英特尔X86架构或单字长定点指令平均执行速度(Million Instructions Per Second，MIPS)架构等来实现，本实施例对此不作限制。至少一个中央处理单元205在该用操作系统软件的作用下控制近场通信单元201、移动通信单元202、存储器203和所述安全元件204。具体的控制过程可以包括：控制开启、控制关闭或控制进入或退出低功耗状态。因此，运行通用操作系统的中央处理单元205可以实现对移动支付装置20中其他各个部分的统一控制，使得这些部分正常上下电，进入或退出低功耗状态，如进入或退出睡眠状态等。通信单元、存储器或安全元件中的任一部件在低功耗状态时的功耗低于该部件工作时的功耗。此外，对任意部件的所述控制过程还可以包括其他控制操作，如控制工作状态。控制工作状态可以是调整该部件工作时的工作电压、时钟频率或处理速率等，本实施例对此不作限定。具体的控制过程可参见现有技术中通用中央处理单元对其他部件的控制操作。
可参考图6的系统结构，其是在图2基础上对部分部件的进一步细化，其中安全元件204可包括第一存储模块2041和处理器2042。关于图6中存储器203所包括的具体内容，可参考图7，存储器203可存有移动支付软件2030。结合图6和图7，所述处理器2042用于将所述移动支付软件2030从所述存储器203加载到所述第一存储模块2041中，运行所述移动支付软件2030，并在 所述移动支付软件2030的作用下与近场通信单元201或移动通信单元202中的至少一个交互支付信息。第一存储模块2041为所述处理器2042提供运行所述移动支付软件2030所需的内存空间。该第一存储模块2041可以是一个随机存取存储器(Random Access Memory，RAM)。存储器203则可以是一个只读存储器(Read-Only Memory，ROM)。具体如图7所示，存储器203内存有的所述移动支付软件2030可以包括移动支付操作系统软件2031，该移动支付操作系统软件2031不同于普通的操作系统软件，其仅仅是一个用于运行移动支付应用软件2032的操作系统平台，使得该移动支付可靠性更高。
在一种可选的实现方式中，移动支付操作系统软件2031可以是片内操作系统(Chip Operating System，COS)。该COS也叫COS镜像，可以等效为是驻留智能卡或金融集成电路(Integrated Circuit，IC)卡内的操作系统软件，此时的安全元件204等效为是具有驻留智能卡或金融卡的功能，其用于向外界的POS机、读卡器或云侧的金融服务器提供刷卡等移动支付服务所需的数据，如银行金融业务相关的数据或用户个人的账户数据，例如个人账号、密码、银行服务器对个人账户进行验证所需的各类验证信息等。此外，COS镜像也是接收和处理外界支付信息，如金融服务器或者读卡器、POS机发给安全元件204的各种支付信息的操作平台，可用于执行外界发送的各种指令，比如鉴权运算等操作，并管理安全元件204内的第一存储模块2041的空间，以及向外界回送应答信息等。安全元件204一般采用基于JAVA计算机程序语言的COS作为安全系统，COS不仅能够在安全元件204中被预置，而且移动支付装置20还能基于该COS动态下载和安装各类移动支付应用软件2032，如各类金融应用软件。COS的具体设计属于现有技术的内容，不在本申请讨论范围内。
在图7中，所述移动支付软件2030除了所述移动支付操作系统软件2031外还包括多个移动支付应用软件2032。一个移动支付应用软件2032用于一类移动支付功能。例如，每个移动支付应用软件2032可以是一个银行的相关应 用软件，用于实现与该银行相关的软件功能，如包括与该银行相关的账号、密码、鉴权和认证相关信息，以及与该银行特色服务相关的功能。当然，移动支付的应用不仅限于银行的业务，也包括但不限于借记卡或信用卡服务、或其他类型的移动支付，比如社保卡、交通卡或某个单位内部的IC卡支付业务，本实施例对此不作限制。
在图2或图6中，所述安全元件204与所述至少一个中央处理单元205位于所述移动支付装置20中的第一半导体芯片IC1内，该IC1也叫做移动支付装置20的主芯片。通过使用同一个半导体主芯片IC1集成了所述安全元件204与所述至少一个中央处理单元205，移动支付的硬件实现成本和面积将被降低，而不必像现有技术一样将安全支付相关的硬件功能单元与主芯片分别做成2个独立的芯片，使得集成度更高的主芯片IC1在移动支付装置20的主板上的排布也更加简单。可选地，如图2或图6所示，所述近场通信单元201可位于移动支付装置20中的另一第四半导体芯片IC4内。可以理解，除了采用图2或图6所示的第四半导体芯片IC4来实现近场通信单元201外，近场通信单元201也可位于所述第一半导体芯片IC1内(图中未示出)，以便进一步实现对主芯片IC1的集成度，降低实现成本。类似地，所述移动通信单元202也可如图6所示位于所述第一半导体芯片IC1内，或者如图2所示独自位于移动支付装置20中的另一第五半导体芯片IC5内。是否将近场通信单元201或移动通信单元202集成进入主芯片IC1取决于本领域技术人员的具体设计。
在本发明的各个实施例中，半导体芯片也简称为芯片，其可以是利用集成电路工艺制作在集成电路衬底(通常是例如硅一类的半导体材料)上的集成电路的集合，其外层通常被半导体封装材料封装。所述集成电路可以包括金属氧化物半导体(Metal-Oxide-Semiconductor，MOS)晶体管、双极晶体管或二极管等。半导体芯片可以独立工作或者在必要的驱动软件的作用下工作，实现通信、计算、或存储等各类功能。
关于移动支付装置20内各部分如何在不同芯片上分部，请继续参见图2，除了将近场通信单元201和移动通信单元202置于主芯片IC1之外的其他芯片上，所述存储器203可具体位于所述移动支付装置20中的第二半导体芯片IC2内。可替换地，所述存储器203也可以与近场通信单元201或移动通信单元202一起被集成进主芯片IC1内(图中未示出)，此时该存储器203和安全元件204可以视为是一个实现安全支付的系统。但是通常的，类似图2或图6的方案，本领域中更多采用独立于主芯片IC1的第二半导体芯片IC2来实现存储器203。这是由于存储器203如果集成于主芯片IC1内时通常以闪速(flash)存储器的形式存在，但flash存储器存储空间通常非常有限，如果要实现大的存储空间会导致成本有较大上升且实现复杂。如果采用独立的第二半导体芯片IC2实现flash存储器203，将使得实现成本有一定下降且设计更简单、且更能满足存储大容量的要求。特别是目前的存储器由于生产工艺、面积等原因难以与主芯片IC1集成，仅将安全元件204与至少一个中央处理单元205集成，而采用主芯片外独立的存储器203，更适合于现有移动支付方案。
当采用类似图2或图6中的片外存储器203时，所述存储器203还可被移动支付软件2030和其他软件复用。在此种实现方式下，存储器203包括互相隔离的安全存储区域203A和普通存储区域203B，具体请参考图7。所述安全存储区域203A用于存储所述移动支付软件2030，所述普通存储区域203B用于存储之前提到的通用操作系统软件。所述至少一个中央处理单元205具体用于从所述存储器203中的所述普通存储区域203B读取并运行所述通用操作系统软件，而所述处理器2042具体用于将所述移动支付软件2030从所述安全存储区域203A加载到所述第一存储模块2041中。所述隔离表明所述通用操作系统软件和所述移动支付软件2030不会混合在一起，而是共存在一个存储器203中但彼此被各自执行主体所独立访问，在保证安全性的前提下节省存储器资源。此时的存储器203可以是嵌入式多媒体卡(Embedded Multi Media Card， eMMC)，安全存储区域203A可以是所述eMMC存储器203的回环保护存储分区(Replay Protect Memory Block，RPMB)。当然，存储器203也可以是其他类型的存储设备，本实施例对此不作限制。
在另一种可选的实现方式中，所述存储器203可以专用于存储所述移动支付软件2030，即存储器203此时不会存储包括通用操作系统软件在内的其他与移动支付不相关的软件。所述移动支付装置20此时还包括一个普通存储单元206。如图2所示，所述普通存储单元206位于所述移动支付装置20中的第三半导体芯片IC3内，该普通存储单元206用于存储所述通用操作系统软件。所述至少一个中央处理单元205具体用于从所述普通存储单元206中读取并运行所述通用操作系统软件。此时专用存储器203与普通存储单元205在物理上隔离，使得操作安全性进一步提高。普通存储单元205可以是如前所述的eMMC。所述专用存储器203可以是一个独立于主芯片IC1的Flash存储器。不过对于普通存储单元205和专用存储器203的具体存储类型，本实施例不作限定。
具体参见图6，在一种可选的实现方式内，所述安全元件204还包括：第二存储模块2043，用于存储所述处理器2042启动所需的启动程序，如启动时的引导代码；当所述安全元件204上电时，所述处理器用于从所述第二存储模块2043读取所述启动程序，在所述启动程序的作用下将所述移动支付操作系统软件2031，如COS镜像，从所述存储器203加载到所述第一存储模块2041中，并运行所述移动支付操作系统软件2031。由于所述安全元件204启动所需的启动程序位于安全元件204内部的第二存储模块2043中，该第二存储模块2043是所述安全元件204启动专用的，不会被其他任何安全元件204外的软件运行程序或硬件所随意访问，保证了安全性。
在一种可选的实现方式中，所述处理器2042可以在与所述近场通信单元201或移动通信单元202交互所述支付信息时受所述支付信息触发，将所述至 少一个移动支付应用软件2032中的一个或多个移动支付应用软件2032从所述存储器203加载到所述第一存储模块2041中，并运行所述一个或多个移动支付应用软件2032。由于移动支付应用软件2032的加载和运行是受到交互所述支付信息的触发，当没有支付服务时相关移动支付应用软件2032可不被开启，能够节省第一存储模块2041的内存空间。也就是说，移动支付应用软件2032是以动态加载的方式被载入的，即只有被选择的应用软件会被从外部存储器203加载到对应的第一存储模块2041，即RAM中。其他不需要使用的应用软件则不被加载到该RAM中，保证让RAM中被占用的空间只用来容纳COS镜像和1至2个应用软件的程序文件，而不会导致该RAM被占用过多。
处理器2042通过通信单元(如近场通信单元201或移动通信单元202)与通信对端(如支付终端或无线接入网)交互所述支付信息的方案属于移动支付协议的内容，其方案在现有技术中已有很多种，流程上可能类似于信用卡的刷卡过程。每个不同的服务提供商，如银行、公共交通部门等，都可以拥有自身的移动支付握手通信协议，用于实现安全元件204中处理器2042经由通信单元至通信对端的支付握手，如个人保密信息的传递、安全数据的发送等。
为便于说明，本实施例给出了一个如图3所示的一个移动支付流程图。在相关流程中，通过无线链路(包括蜂窝无线通信链路或短距离无线通信链路)在移动支付装置20和支付终端之间传递的各类与移动支付有关的信息都可以认为是支付信息。所述支付流程的简要步骤可包括：S31，中央处理单元205运行通用操作系统软件，并在通用操作系统软件的作用下控制通信单元和安全元件204。所述控制可以是控制开启、关闭、进入或退出低功耗状态。S32，安全元件204从存储器203中载入并运行移动支付软件2030。S33，通信单元从通信对端经由无线通信链路接收移动支付指令。该指令可以是请求移动支付装置20进行移动支付的请求消息，该消息可以包括在一个空口信令中，该空口信令的具体实现和信令结构可参照现有无线通信协议的内容。所述移动支付 指令除了用于请求发起支付业务外，还可包括必要的认证、鉴权请求，其具体内容可参考移动支付领域的现有技术，不在本申请讨论之内。S34，通信单元通过运行无线通信协议软件解析空口信令得到移动支付指令，并将移动支付指令传输至所述安全元件204中处理器2042。S35，处理器2042在所述移动支付软件2030的驱动下，响应所述移动支付指令向通信单元发送移动支付数据。具体地，所述移动支付数据可以包括用户身份的证明数据，如银行卡号、账号、个人保密信息、或各类银行交易所需的密文等，其类似于信用卡支付的信用卡信息，用于被通信对端所读取。S36，通信单元运行无线通信协议将移动支付数据打包为空口信令传输给通信对端。S37，通信对端将移动支付数据传输至服务器。所述服务器对移动支付数据进行处理以完成支付业务。
可选地，在采用线下支付时，通信对端是POS机一类的支付终端，支付终端将通过互联网将移动支付数据传输给云侧服务器。或者可替换地，在采用线上支付时，移动通信单元202作为通信单元，将通过无线接入网将移动支付数据传递给服务器。服务器的具体操作可以参见现有的支付方案，如现有的银行网上支付业务，本申请对此不作说明。当服务器完成交易后，可以返回交易成功的信息给采用线下支付的POS机并在POS机上显示，或者在采用线上支付时服务器直接将交易成功的信息返回给移动支付装置20的移动通信单元202，以便移动支付装置20内能够显示该信息。可选地，在交易不成功时，服务器可通过返回支付失败信息来代替所述交易成功的信息，本实施例对此不做限制。所述支付信息包括了双向的通信过程，用于实现网络侧的云服务器和移动支付装置20的移动支付握手通信，其双向通信的握手过程根据不同的服务提供商和处理器2042所运行的不同移动支付应用软件2032而有所不同，通常取决于不同服务提供商。
参考图6所示，对于线下支付，当处理器2042与近场通信单元201交互所述支付信息时，处理器2042可经由安全元件204内包括的一个通信接口 2044与主芯片IC1外的近场通信单元201(位于IC4中)交互所述支付信息。具体地，该通信接口2044可遵循单线协议(Single Wire Protocol，SWP)。当然，通信接口2044也可以使用其他的接口协议来实现数据或信息的传输。如果近场通信单元201同样集成于主芯片IC1中，则处理器2042可以通过一个片内连接线，如图6中的片内总线207，与近场通信单元201实现信息交互。通信接口2044由于是标准SWP接口，其可采用标准的SWP协议实现。近场通信单元201如何基于SWP协议将从POS机获取的数据传输到安全元件204已是现有的成熟方案，不在本申请讨论范围内。此外近场通信单元201与所述至少一个中央处理单元205可采用内部集成电路(Inter-Integrated Circuit，I2C)接口连接，以传递其他数据，当然其他接口也可实现类似作用且不应被排除在实现方案外。近场通信单元201内部可以存储有路由表，近场通信单元201可识别通信对端发起的通信属于何种类型，如果发起的业务是的支付业务，则通过查询路由表将相关支付业务相关数据通过SWP接口转发至安全元件204，以便安全元件204中的处理器2042进行处理。如果近场通信单元201发现发起的业务是非支付类业务，近场通信单元201通过查询路由表将相关非支付类业务的数据通过I2C接口转发至述至少一个中央处理单元205。例如，如果被发起的业务属于业务企业内的工卡与统计工时的刷卡机接触时，近场通信单元201可以将数据通过I2C接口送往至少一个中央处理单元205，并在通用操作系统，如安卓环境下，做刷卡模拟应用。
对于线上支付，假设采用移动通信单元202集成在主芯片IC1内的实现方式，则参见图6，处理器2042也可通过一个片上总线207与移动通信单元202实现交互支付信息。片上总线207还可连接至中央处理单元205和存储接口208。存储接口208被主芯片IC1用于和第二芯片IC2中的存储器203交互数据。
在一种可选的实现方式中，处理器2042提供给通信对端的所述移动支付 数据可以是经过安全处理的，所述安全处理可以包括如下至少一项：数据加密或数据完整性保护。具体地，所述处理器2042还可以在所述移动支付软件2030的驱动下生成所述经过安全处理的数据，即处理器通过软件驱动可以执行安全处理，保证经过处理的移动支付数据被传输给服务器。服务器可以相应地对移动支付数据做解密和解完整性保护，以验证移动支付数据是否被篡改。如果所述移动支付数据被篡改过，服务器可以返回之前提到的支付失败信息，从而保证移动支付过程的安全性。可替换地，所述处理器2042可以仅生成原始数据，该原始数据时未经过安全处理的移动支付数据。由所述安全元件204中的一个独立的安全处理模块2045对所述原始数据进行所述安全处理以生成所述经过安全处理的数据。安全处理模块2045在硬件上可独立于所述处理器2042，具体可以是一个包括电路结构的硬件加速器，用于实现安全处理的加速，使得处理实现更加优化。
除了与通信对端所交互的数据需要经过安全处理外，处理器2042还需要从所述存储器203读取所述移动支付软件2030，所述移动支付软件2030的读取和写入也可以经过安全保护，以实现更好的安全性。例如，所述安全元件204还包括：加解密引擎2046，用于在所述处理器2042将所述移动支付软件2030从所述存储器203加载到所述第一存储模块2041中后对所述移动支付软件2030进行安全验证，并在安全验证成功后指示所述处理器2042运行所述移动支付软件2030，所述安全验证包括安全解密或第一哈希校验中的至少一项。可选地，该加解密引擎可以是一个包括电路结构的硬件加速器。由于硬件形式的加解密引擎独2046立于所述处理器2042，专用于实现安全验证功能，可确保移动支付软件2030仅在验证成功后被运行，避免移动支付软件2030中的移动支付操作系统软件2031或移动支付应用软件2032被篡改，有利于提高安全验证时的处理性能。
除了将移动支付软件2030读出后对移动支付软件2030做验证，所述加解 密引擎2046还可用于对更新数据做安全加密或第一哈希运算处理中的至少一种处理。所述处理器2042还用于将处理后的更新数据写入到所述存储器203以更新所述移动支付软件2030。例如，数据更新可以是COS镜像的更新或任一种移动支付应用软件2032的更新。更新数据的内容可以包括对COS镜像或移动支付应用软件2032的升级文件，也可以包括用于对所述移动支付数据做数据加密或数据完整性保护的信息的更新，如密钥的升级，还可以包括移动支付的记录文件，如个人信息更改、交易日志等，本实施例对更新数据的内容不作限定。
可替换地，所述加解密引擎2046的功能也可以被所述处理器2042所代替，此时将不需要独立的硬件加解密引擎2046来对从存储器203读出的或向存储器203写入的移动支付软件2030做安全处理，而是由处理器2042自身集成该安全功能。更近一步地，所述处理器2042在将所述处理后的更新数据写入到所述存储器时还可利用密钥Krpmb对所述处理后的更新数据做第二哈希运算处理得到待存储数据。该第二哈希运算处理可以和之前提到的第一哈希运算处理过程类似，但具体做这两种哈希处理时所采用的密钥通常不同。例如，可在第二哈希运算处理中利用密钥Krpmb对更新数据加密得到一个摘要值，并将摘要值与更新数据合并生成所述待存储数据，该摘要值也可以是信息鉴别码(Messape Authenticator Code，MAC)签名。所述存储器203还用于对所述待存储数据做第二哈希校验，第二哈希校验是与第二哈希运算处理相对应的过程，用于校验经过第二哈希运算处理的待存储数据是否被篡改过，具体可以参照校验MAC签名的现有技术。存储器203在第二哈希校验成功后得到所述处理后的更新数据，并利用所述处理后的更新数据更新所述移动支付软件2030。
以存储器203是一个eMMC为例，参见图7，其安全存储区域203A用于存储移动支付软件2030。所述处理器2042在对安全存储区域203A做写入或擦除等操作都需要验证命令的签名，该验证命令也就是密钥Krpmb。eMMC 存储器203会根据预置的密钥Krpmb校验处理器2042送过来的写入命令数据包是否正确，每个写入命令数据包可包括全部更新数据的部分数据包。具体的利用密钥Krpmb所做的哈希校验处理算法可以是哈希运算消息认证码安全散列算法(Hash-based Message Authentication Code Secure Hash Algorithm，HMAC SHA)256算法。在一种可选的实现方式下，可以在eMMC存储器203生产时将每个eMMC存储器203唯一的密钥Krpmb烧写到eMMC存储器203中，该密钥Krpmb也被可以烧写或记录到安全元件204中，具体可以通过电子熔丝(eFuse)技术烧写在安全元件204的处理器2042中或烧写处理器2042外的其他硬件电路中，并由安全元件204来管理和使用该密钥Krpmb。
除了由安全元件204来管理和使用密钥Krpmb，在另一种可选的实现方式中，在中央处理单元205的安全域(Trustzone，TZ)中管理和使用密钥Krpmb是一种更为常见的实现形式。该TZ为一个可信执行环境(Trust Execute Environment，TEE)。具体地，由一种软件运行所形成一个环境也就是一个软件系统，其可与外界其他的软件或硬件系统交互数据。如图8所示，该被中央处理单元205执行的可信执行环境与同样被中央处理单元205运行的通用操作系统软件(如安卓系统环境)间存在安全隔离，分别是两个独立的软件系统，虽然由同一个中央处理单元205运行，但可信执行环境与通用操作系统软件之间的安全隔离性很好，通用操作系统软件和基于该操作系统的的普通应用软件的运行程序不能随意访问该可信执行环境。可信执行环境则可以与由处理器2042运行移动支付软件2030所形成的环境，即与安全元件204之间传输数据。因此，通用操作系统软件与可信执行环境和安全元件204之间均存在安全隔离，使得通用操作系统软件或基于该软件的普通应用软件的运行程序对可信执行环境和安全元件204的访问不是随意的，即便所述访问被执行需要经过特定的软件或硬件的安全接口，但可信执行环境和安全元件204之间的安全隔离度相对更低，操作相对方便。所述普通应用软件可以包括各类非安全支付相关的 软件，如即时通信软件、游戏、办公软件、电子书软件或音视频流媒体播放器等。
在一种可选的实现方式，可在可信执行环境中来实现对密钥Krpmb的管理。具体地，密钥Krpmb可以烧写在中央处理单元205相关的硬件电路中，这样中央处理单元205的通用操作系统软件(如安卓系统)下的各类非安全软件不知道该Krpmb，故不能对该eMMC存储器203的安全存储区域203A进行写操作。而对eMMC存储器203内其他普通存储区域203B，中央处理单元205的通用操作系统软件和基于该操作系统的各类普通应用软件的运行程序是完全都能够访问的。由于通用操作系统软件与所述安全元件204存在安全隔离，通用操作系统软件并不能随意对所述安全元件进行访问，可提高移动支付安全性。
可选地，可信执行环境可以提供可视化的银行支付或其他金融业务的用户界面(User interface，UI)，以便用户通过该UI输入指令，使得所述指令通过可信执行环境传输至安全元件204，实现用户通过该UI完成与安全元件204的信息交互。该UI是一个可信UI，其区别于通用操作系统软件提供的普通UI，可以使得用户输入的移动支付密码通过相对安全的可信执行环境送到安全元件204中，之后这些包括了移动支付密码的信息被做数据加密后通过近场通信单元201或移动通信单元202传输至网络侧的服务器。
在一种具体实施方式下，以存储器203的类型是eMMC为例，如图4所示，给出了本发明实施例的一种对eMMC存储器203的安全存储区域203A进行访问操作的软件架构示意图。所述访问可以包括从安全存储区域203A读取数据或者向安全存储区域203A写入数据(安全数据更新或升级)，读取或写入的单位可以是固定的长度单位。所述软件架构包括移动支付软件2030，由安全元件204执行，移动支付软件2030提供类似驻留智能卡或IC卡的刷卡操作相关功能，可包括之前提到的移动支付操作系统软件2031和移动支付应 用软件2032。
在图4中，对于eMMC存储器203的写入过程而言，在处理器2042运行移动支付软件2030所提供的安全环境内部，数据410就是待更新或升级的数据，数据410经过哈希计算处理得到处理后的数据411，数据411包括作为明文数据的数据410和该明文数据410的哈希值(也可以叫数据410的摘要)410A。数据411随后在该安全环境内部被做安全加密，可以具体由Kse密钥来加密该数据411，得到密文数据412。Kse密钥可以是一组或多组密钥，安全加密的加密算法可以是任意的对称加密算法或非对称加密算法。例如，一种可用的加密算法可以是高级加密算法(Advanced Encryption Standard，AES)，本实施例对此不作限定。随后安全元件204可通过如图6所示的系统总线207将密文数据412和写入地址传输给中央处理单元205，即密文数据412和其写入地址被从移动支付软件2030环境转移到中央处理单元205生成的可信执行环境2051中。由中央处理单元205在生成的可信执行环境2051对密文数据412和其写入地址做第二哈希运算处理，具体可以是使用密钥Krpmb加密密文数据412或密文数据412的一部分得到哈希处理的摘要值，即MAC签名，加密算法可以是如前实施例所述的哈希算法，如HMAC SHA 256算法。该第二哈希运算处理也可以是满足eMMC存储器203的安全存储区域203A对数据安全的需求的其他处理算法。具体地，在可信执行环境2051中，密文数据412和其写入地址作为数据可以被分为多个部分，每个部分被并行处理。如图4所示，可信执行环境2051中包括多个队列L1，……，LN，其中每个队列，如队列L1包括一部分分包L11和检验部分L12，其中检验部分L12是采用密钥Krpmb对分包L11做第二哈希运算处理得到的摘要值。随后每个队列被从可信执行环境2051转移到通用操作系统软件2052，通常是具体转移到通用操作系统软件2052的内核(Kernel)，该转移的过程通常是透传，即通用操作系统软件2052不会对数据内容进行修改。在通用操作系统软件2052环境下，每 个队列L1，……，LN被转化为能够被eMMC存储器203读取的RPMB数据D，D也可分为多个分段或队列，如D1，……DN，并通过如图2或图6所示的存储接口208传输给eMMC存储器203。具体地，在通用操作系统软件2052环境下，队列L1被经过eMMC协议命令处理得到符合存储接口208规范的数据D1，……DN，但原数据内容不会经过任何加工或改造。如前所述，eMMC存储器203持有密钥Krpmb，会基于数据D1得到队列L1，并采用密钥Krpmb对队列L1中的检验部分L12做MAC签名的校验。具体地，密钥Krpmb被用于加密队列L1中的分包L11得到摘要值，该摘要值被与检验部分L12比对以得到校验结果。如果检验通过，则基于多个分包L11得到密文数据412或其部分，以及相应写入地址，并将按照写入地址将密文数据412或其部分写入eMMC存储器203的安全存储区域203A，例如RPMB中。
参见图4，对于eMMC存储器203的读出过程，其和之前的写入过程是相反的流程，本实施例对此不作详细描述。其中eMMC存储器203发送给通用操作系统软件2052且经由该通用操作系统软件2052传递至可信执行环境2051的数据队列经过密钥Krpmb的加密，包括携带有数据内容的分包L11和加密生成的检验部分L12。在可信执行环境2051中，中央处理单元205采用密钥Krpmb对缓存的队列L1中的分包L11做加密处理得到摘要值，所述摘要值被与检验部分L12做比对以校验数据是否被篡改过。安全元件204，具体可以是如前所述的加解密引擎2046或所述处理器2042，在移动支付软件2030提供的环境下通过系统总线207或其他接口得到密文数据412，并利用Kse密钥安全解密得到的数据410和数据410的哈希值410A。安全元件204进一步对哈希值410A进行哈希校验并在校验成功后确认相关数据没有被篡改，从而实现成功读取。如果哈希校验和安全解密中的任一个没有成功，则可以认为相关数据被篡改，本次读出的数据不可信，那么安全元件204中的所述处理器2042可以决定丢弃这些数据。可选地，在数据不可信时所述处理器2042可以 向中央处理单元205报错或报警，本实施例对此不作限制。对eMMC存储器203的操作来说，无论是移动支付操作系统软件2031，如COS镜像，还是移动支付应用软件2032的读出和写入流程可以是与图4类似的。
在图4对应的实施例中，以对存储器203写入数据为例做说明，实际上，在所述处理器2042需要擦除存储器203的数据时，处理器2042也可以生成一个擦除指令，所述指令中携带有需要擦除的数据的地址。该指令被处理器2042传输给中央处理单元205，即由移动支付软件环境2030传输给可信执行环境2051。该指令可在可信执行环境2051中被中央处理单元205利用密钥Krpmb加密(哈希处理)得到摘要值，该摘要值和指令一起经由通用操作系统软件2052传递给存储器203。此时存储器203采用如前所述类似的校验方法，即采用同样的密钥Krpmb加密(哈希处理)所述指令，并将得到的结果与摘要值做比较以确定该指令是否通过验证。当所述验证通过时，存储器203可根据该指令中的地址对相应数据做擦除。可替换地，在擦除操作中，所述密钥Krpmb加密(哈希处理)也可由安全元件204中的处理器2042处理，而不是由中央处理单元205在可信执行环境2051中执行。由于擦除操作的过程需经过哈希处理，基于通用操作系统软件2052的其他非安全类软件不能掌握密钥Krpmb，因此不能随意擦除存储器203中的数据，提高了安全性。被擦除的数据可以是存储器203中存有的移动支付软件2030的部分数据。例如，存储器203可响应指令并依照指令中的地址擦除移动支付操作系统软件2031的部分数据，或者移动支付应用软件2032的全部或部分数据。
需要说明的是，以上方案可针对eMMC存储器203被移动支付软件2030和通用操作系统软件2052复用的情形，可以看到，除非密钥Krpmb和Kse均被破解，否则非安全软件很难访问eMMC存储器203的安全存储区域203A，使得数据的私密性和完整性可以得到更好保证。其中密钥Kse则是安全元件204中生成密文并防止侵入最重要的手段。通过片内总线207在安全元件204、 中央处理单元205和存储接口208之间交互数据的安全性则高于现有技术的其他接口传输技术，如SPI传输，以提高安全元件204与eMMC存储器203交互数据的安全性。因此，相对于通过SPI在主芯片的CPU和位于主芯片外的安全元件之间交互数据的方案，本发明实施例可以将安全元件204集成在主芯IC1片中，通过总线207在安全元件204和中央处理单元205的可信执行环境2051之间实现数据转移，安全性更好。
进一步地，如图6所示，在安全元件204中，可以包括第三存储模块2047。当采用图4的处理流程将数据从移动支付软件环境2030发送至可信执行环境2051时，处理器2042可先将数据写入第三存储模块2047，并在总线207上向中央处理单元205发送一个中断请求，以请求中央处理单元205读取该第三存储模块2047中的数据。具体地，该中断请求中可以包括被读取的数据在第三存储模块2047中的地址。这样中央处理单元205可以响应该中断请求来从第三存储模块2047中读取相应数据。当中央处理单元205向安全元件204发送数据时，也可以将数据写入第三存储模块2047，并通过发送中断请求来请求安全元件204中的处理器2042或其他部件读取该数据。本实施例中的中断请求是一个用于请求读取数据的指示消息。第三存储模块2047可以是一个RAM，例如进程间通信(Inter-Process Communication，IPC)RAM。可替换地，第三存储模块2047也可以是缓存等其他类型的存储器。通过该第三存储模块2047，相对于通过片外SPI进行通信的方式，安全元件204与中央处理单元205的通信和数据交互都是通过主芯片IC1内部的存储器2047和总线207执行的，安全性得到提高。
在另一种可选的实现方式中，存储移动支付软件2030和通用操作系统软件2052的存储器可以在物理上隔离，此时数据的写入或读出基本流程会得到简化。如图5所示，此时存储器203位于第二半导体芯片IC2，具体可以是异或(Nor)Flash存储器，在移动支付软件2030提供的安全环境内部中，数据 410就是待更新或升级的数据，数据410经过哈希计算处理得到处理后的数据411，数据411包括作为明文数据的数据410和数据410的哈希值410A。数据411随后在该安全环境内部被做安全加密，可以具体由Kse密钥来加密该数据411，得到密文数据412。随后密文数据412被直接写入存储器203。数据读出过程则与数据写入过程相反，本实施例不再赘述。在本实现方案中，存储器203是一个专用于移动支付的存储装置，此时无需经过可信执行环境2051的转发，可以直接由安全元件204对存储器203写入或读出各类数据，包括COS镜像或应用软件数据等。当执行擦除操作时，安全元件204中处理器2042可向存储器203发送擦除指令，所述指令中携带有需要擦除的数据的地址，存储器203可在收到指令后直接对相关地址的数据做擦除，以提高安全性。
通过以上技术方案，本发明实施例可以实现安全的移动支付，同时降低移动支付的成本和设计难度。需要说明的是，移动支付是一个广义上的定义，其不仅包括商业、金融上的移动支付业务，也包括公共交通、身份证、社保卡等其他类型的支付业务。也就是说，通过移动支付，移动终端可以与通信对端连接最终实现与服务器的交互支付信息，并实现与该移动终端内一个或多个账户相关联的数据交易、数据兑换或数据结算。数据交易、兑换或数据结算的单位可以不仅包括货币，也可以是虚拟货币、各类积分或信用额度等其他能够用于实现支付、兑换或交易结算的单位，本实施例对此不做限定。所述账户包括但不限于个人账户、团体账户或组织账户。相对于仅在固定终端上实施的支付行为，移动支付实现更加灵活，其执行主体为移动终端，可以更好满足随时随地执行支付的需求。
需要说明的是，在本发明实施例中，中央处理单元205的数量可以是多个。多个中央处理单元205与移动支付装置20中其他部件，如安全元件204，交 互数据可以是指多个中央处理单元205中的任何一个或多个与该其他部件的数据交互。当移动支付装置20处于工作状态时，多个中央处理单元205可以同时开启或部分开启，并且互相分工协作实现所述可信执行环境2051、通用操作系统软件2052和其他应用软件。
此外，所述移动支付装置20还可包括图像处理单元(GPU)、音频处理单元、功耗管理单元(PMU)或全球定位系统(GPS)等。此外在移动终端21内，除了主要包括各类电路的移动支付装置20外，还可以包括用于输入的触摸屏、显示器以及其他必要的传感器，例如重力加速计、陀螺仪、或光传感器等。
以上所述仅为本发明的几个实施例，本领域的技术人员依据申请文件公开的可以对本发明进行各种改动或变型而不脱离本发明的精神和范围。例如本发明实施例的附图中的各个部件具体形状或结构是可以根据实际应用场景进行调整的。

Claims (30)

  1. 一种移动支付装置，其特征在于，包括：
    通信单元，用于通过无线链路与通信对端交互支付信息；
    存储器，用于存储移动支付软件；
    安全元件，包括第一存储模块和处理器；
    至少一个中央处理单元，用于运行通用操作系统软件，并在通用操作系统软件的作用下控制所述通信单元、存储器和所述安全元件中的至少一个；
    所述处理器用于将所述移动支付软件从所述存储器加载到所述第一存储模块中，运行所述移动支付软件，并在所述移动支付软件的作用下与所述通信单元交互所述支付信息；
    第一存储模块，用于为所述处理器提供运行所述移动支付软件所需的内存空间；
    其中，所述安全元件与所述至少一个中央处理单元位于所述移动支付装置中的第一半导体芯片内。
  2. 根据权利要求1所述移动支付装置，其特征在于，所述存储器位于所述移动支付装置中的第二半导体芯片内。
  3. 根据权利要求2所述移动支付装置，其特征在于，所述存储器包括互相隔离的安全存储区域和普通存储区域；
    所述安全存储区域用于存储所述移动支付软件；
    所述普通存储区域用于存储所述通用操作系统软件；
    所述处理器具体用于将所述移动支付软件从所述存储器中的所述安全存储区加载到所述第一存储模块中；
    所述至少一个中央处理单元具体用于从所述存储器中的所述普通存储区读取并运行所述通用操作系统软件。
  4. 根据权利要求2所述移动支付装置，其特征在于，所述存储器专用于存储所述移动支付软件；
    所述移动支付装置还包括普通存储单元，所述普通存储单元位于所述移动支付装置中的第三半导体芯片内，该普通存储单元用于存储所述通用操作系统软件；
    所述至少一个中央处理单元具体用于从所述普通存储单元中读取并运行所述通用操作系统软件。
  5. 根据权利要求1至4中任一项所述移动支付装置，其特征在于，所述移动支付软件包括移动支付操作系统软件。
  6. 根据权利要求5所述移动支付装置，其特征在于，所述移动支付软件还包括至少一个移动支付应用软件。
  7. 根据权利要求5或6所述移动支付装置，其特征在于，所述安全元件还包括：第二存储模块，用于存储所述处理器启动所需的启动程序；
    当所述安全元件上电时，所述处理器用于从所述第二存储模块读取所述启动程序，在所述启动程序的作用下将所述移动支付操作系统软件从所述存储器加载到所述第一存储模块中，并运行所述移动支付操作系统软件。
  8. 根据权利要求6所述移动支付装置，其特征在于，所述处理器用于在与所述通信单元交互所述支付信息时受所述支付信息触发，将所述至少一个移动支付应用软件中的一个或多个移动支付应用软件从所述存储器加载到所述第一存储模块中，并运行所述一个或多个移动支付应用软件。
  9. 根据权利要求1至8中任一项所述移动支付装置，其特征在于，所述支付信息包括：从所述通信对端经由所述通信单元传输至所述处理器的移动支付指令、以及响应所述移动支付指令从所述处理器经由所述通信单元传输至所述通信对端的移动支付数据。
  10. 根据权利要求9所述移动支付装置，其特征在于，所述移动支付数据包括经过安全处理的数据，所述安全处理包括如下至少一项：数据加密或数据完整性保护。
  11. 根据权利要求10所述移动支付装置，其特征在于，所述处理器还用于生成所述经过安全处理的数据。
  12. 根据权利要求10所述移动支付装置，其特征在于，所述处理器还用于生成原始数据；
    所述安全元件还包括：安全处理模块，用于对所述原始数据进行所述安全处理以生成所述经过安全处理的数据。
  13. 根据权利要求1至12中任一项所述移动支付装置，其特征在于，所述至少一个中央处理单元对所述通信单元、存储器和所述安全元件中的至少一个的控制包括：控制开启、控制关闭、控制进入或退出低功耗状态或控制工作状态。
  14. 根据权利要求1至13中任一项所述移动支付装置，其特征在于，所述通信单元为近场通信单元，所述通信对端为支付终端，所述近场通信单元具体用于通过运行短距离无线通信协议与所述支付终端交互所述支付信息。
  15. 根据权利要求14所述移动支付装置，其特征在于，所述近场通信单元位于所述第一半导体芯片内或者位于移动支付装置中的第四半导体芯片内。
  16. 根据权利要求1至13中任一项所述移动支付装置，其特征在于，所述通信单元为移动通信单元，所述通信对端为无线接入网，所述移动通信单元用于通过运行蜂窝无线通信协议与所述无线接入网交互所述支付信息。
  17. 根据权利要求16所述移动支付装置，其特征在于，所述移动通信单元位于所述第一半导体芯片内或者移动支付装置中的第五半导体芯片内。
  18. 根据权利要求1至17中的任一项所述移动支付装置，其特征在于，所述安全元件还包括：加解密引擎，用于在所述处理器将所述移动支付软件从所述存储器加载到所述第一存储模块中后对所述移动支付软件进行安全验证，并在安全验证成功后指示所述处理器运行所述移动支付软件，所述安全验证包括安全解密或第一哈希校验中的至少一项。
  19. 根据权利要求18所述移动支付装置，其特征在于，所述加解密引擎，还用于对更新数据做安全加密或第一哈希运算处理中的至少一种处理得到处理后的更新数据；
    所述处理器还用于将所述处理后的更新数据写入到所述存储器以更新所述移动支付软件。
  20. 根据权利要求1至17中的任一项所述移动支付装置，其特征在于，所述处理器还用于在将所述移动支付软件从所述存储器加载到所述第一存储模块中后对所述移动支付软件进行安全验证，并在安全验证成功后运行所述移动支付软件，所述安全验证包括安全解密或第一哈希校验中的至少一项。
  21. 根据权利要求20所述移动支付装置，其特征在于，所述处理器还用于对更新数据做安全加密或第一哈希运算处理中的至少一种处理得到处理后的更新数据，并将所述处理后的更新数据写入到所述存储器以更新所述移动支付软件。
  22. 根据权利要求19或21所述移动支付装置，其特征在于，所述处理器在将所述处理后的更新数据写入到所述存储器时还用于利用密钥对所述处理后的更新数据做第二哈希运算处理得到待存储数据；
    所述存储器还用于对所述待存储数据做第二哈希校验，在第二哈希校验成功后得到所述处理后的更新数据，并利用所述处理后的更新数据更新所述移动支付软件。
  23. 根据权利要求19或21所述移动支付装置，其特征在于，所述处理器在将所述处理后的更新数据写入到所述存储器时还用于将所述处理后的更新数据发送给所述至少一个中央处理单元；
    所述至少一个中央处理单元还用于在可信执行环境中利用密钥对所述处理后的更新数据做第二哈希运算处理得到待存储数据，并将所述待存储数据发送给所述存储器；所述可信执行环境与所述被运行的通用操作系统软件间存在 安全隔离；
    所述存储器还用于对所述待存储数据做第二哈希校验，在第二哈希校验成功后得到所述处理后的更新数据，并利用所述处理后的更新数据更新所述移动支付软件。
  24. 根据权利要求23所述移动支付装置，其特征在于，所述安全元件还包括第三存储模块；
    处理器还用于将所述处理后的更新数据写入所述第三存储模块中，并向所述至少一个中央处理单元发送第一中断请求；
    所述至少一个中央处理单元还用于在可信执行环境中响应所述第一中断请求从第三存储模块中读取所述处理后的更新数据。
  25. 根据权利要求1至24中的任一项所述移动支付装置，其特征在于，所述至少一个中央处理单元，还用于运行除所述移动支付软件外的普通应用软件。
  26. 根据权利要求1至25中的任一项所述移动支付装置，其特征在于，所述至少一个中央处理单元所运行的通用操作系统软件与所述安全元件存在安全隔离。
  27. 根据权利要求1至18、20、25和26中的任一项所述移动支付装置，其特征在于，所述处理器还用于利用密钥对更新数据或擦除指令做第二哈希运算处理得到处理结果；
    所述存储器还用于对所述处理结果做第二哈希校验，在第二哈希校验成功后得到所述更新数据或擦除指令，并利用更新数据更新所述移动支付软件或根据擦除指令擦除所述存储器中的与擦除指令对应的数据。
  28. 根据权利要求1至18、20、25和26中的任一项所述移动支付装置，其特征在于，所述处理器还用于将更新数据或擦除指令发送给所述至少一个中央处理单元；
    所述至少一个中央处理单元还用于在可信执行环境中利用密钥对更新数据或擦除指令做第二哈希运算处理得到处理结果，并将该处理结果发送给所述存储器；所述可信执行环境与所述被运行的通用操作系统软件间存在安全隔离；
    所述存储器还用于对所述处理结果做第二哈希校验，在第二哈希校验成功后得到所述更新数据或擦除指令，并利用更新数据更新所述移动支付软件或根据擦除指令擦除所述存储器中的与擦除指令对应的数据。
  29. 一种通过移动支付装置实现移动支付的方法，其特征在于，包括：
    通过至少一个中央处理单元运行通用操作系统软件，并在通用操作系统软件的作用下控制通信单元、存储器和安全元件中的至少一个；
    将移动支付软件从存储器加载到所述安全元件中；
    在所述安全元件内运行移动支付软件；
    在所述移动支付软件的作用下，所述安全元件与所述通信单元交互支付信息，其中所述通信单元通过无线链路与通信对端交互所述支付信息；
    其中，所述安全元件与所述至少一个中央处理单元位于所述移动支付装置中的第一半导体芯片内。
  30. 一种半导体芯片，用于移动支付装置，其特征在于，所述半导体芯片包括安全元件与至少一个中央处理单元，所述安全元件包括第一存储模块和处理器，所述第一存储模块，用于为所述处理器提供运行移动支付软件所需的内存空间；所述至少一个中央处理单元，用于运行通用操作系统软件；
    所述处理器用于将所述移动支付软件从所述移动支付装置的存储器中加载到所述第一存储模块中，运行所述移动支付软件，并在所述移动支付软件的作用下与移动支付装置中的通信单元交互支付信息；
    所述至少一个中央处理单元，还用于在通用操作系统软件的作用下控制所述通信单元、存储器和所述安全模块中的至少一个。
PCT/CN2015/092098 2015-04-24 2015-10-16 移动支付装置和方法 WO2016169229A1 (zh)

Priority Applications (9)

Application Number Priority Date Filing Date Title
KR1020177006993A KR20170042344A (ko) 2015-04-24 2015-10-16 모바일 결제 장치 및 방법
BR112016024967A BR112016024967A2 (pt) 2015-04-24 2015-10-16 aparelho e método para pagamento móvel
EP18206102.8A EP3534285A1 (en) 2015-04-24 2015-10-16 Mobile payment apparatus and method
EP15888732.3A EP3121752B1 (en) 2015-04-24 2015-10-16 Mobile payment device and method
CN201580078892.XA CN107533621B (zh) 2015-04-24 2015-10-16 移动支付装置和方法
JP2017516493A JP6517926B2 (ja) 2015-04-24 2015-10-16 モバイル支払い装置および方法
KR1020187023775A KR20180095136A (ko) 2015-04-24 2015-10-16 모바일 결제 장치 및 방법
ES15888732T ES2718540T3 (es) 2015-04-24 2015-10-16 Dispositivo y método de pago móvil
US15/388,813 US11429950B2 (en) 2015-04-24 2016-12-22 Mobile payment apparatus and method

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510201343.9 2015-04-24
CN201510201343.9A CN104778794B (zh) 2015-04-24 2015-04-24 移动支付装置和方法

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/388,813 Continuation US11429950B2 (en) 2015-04-24 2016-12-22 Mobile payment apparatus and method

Publications (1)

Publication Number Publication Date
WO2016169229A1 true WO2016169229A1 (zh) 2016-10-27

Family

ID=53620234

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/092098 WO2016169229A1 (zh) 2015-04-24 2015-10-16 移动支付装置和方法

Country Status (8)

Country Link
US (1) US11429950B2 (zh)
EP (2) EP3534285A1 (zh)
JP (2) JP6517926B2 (zh)
KR (2) KR20180095136A (zh)
CN (2) CN104778794B (zh)
BR (1) BR112016024967A2 (zh)
ES (1) ES2718540T3 (zh)
WO (1) WO2016169229A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3547195A4 (en) * 2016-12-29 2019-12-25 Huawei Technologies Co., Ltd. SYSTEM-ON-CHIP AND METHOD FOR SWITCHING SAFE OPERATING SYSTEMS

Families Citing this family (40)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104778794B (zh) * 2015-04-24 2017-06-20 华为技术有限公司 移动支付装置和方法
CN106919856B (zh) * 2015-12-25 2020-01-07 展讯通信（上海）有限公司 安全移动终端
CN106936580A (zh) * 2015-12-31 2017-07-07 北京握奇智能科技有限公司 一种电子密码器、及基于电子密码器的业务处理方法
CN105761067B (zh) * 2016-02-05 2021-08-31 北京微智全景信息技术有限公司 智能pos机安全模块及其启动方法
US10475034B2 (en) 2016-02-12 2019-11-12 Square, Inc. Physical and logical detections for fraud and tampering
CN109871717A (zh) 2016-02-29 2019-06-11 华为技术有限公司 一种数据安全传输装置及方法
CN105897425B (zh) * 2016-03-31 2019-04-12 北京小米移动软件有限公司 分配、请求社交网络账号的方法及装置
CN105912272B (zh) * 2016-04-14 2019-03-01 华为技术有限公司 一种控制多个安全应用软件的运行的装置和方法
CN106127483A (zh) * 2016-06-30 2016-11-16 华为技术有限公司 移动支付方法、片上系统及终端
CN106157008A (zh) * 2016-06-30 2016-11-23 成都生辉电子科技有限公司 一种智能终端安全支付方法
CN106096934A (zh) * 2016-06-30 2016-11-09 成都生辉电子科技有限公司 一种通信控制方法
CN106204047A (zh) * 2016-06-30 2016-12-07 成都生辉电子科技有限公司 一种移动终端支付装置
CN106228072A (zh) * 2016-07-21 2016-12-14 恒宝股份有限公司 一种通用ta支付平台和支付方法
KR20180135940A (ko) * 2016-08-09 2018-12-21 후아웨이 테크놀러지 컴퍼니 리미티드 시스템 온 칩 및 처리 장치
CN106385314A (zh) * 2016-08-29 2017-02-08 福建联迪商用设备有限公司 数据隔离系统、方法及利用数据隔离系统的方法
CN106961417B (zh) * 2016-12-23 2020-05-22 中国银联股份有限公司 基于密文的身份验证方法
CN106960144B (zh) * 2017-04-11 2018-10-02 北京深思数盾科技股份有限公司 信息安全电子装置及其进行数据处理的方法
US10681185B1 (en) 2017-08-15 2020-06-09 Worldpay, Llc Systems and methods for cloud based messaging between electronic database infrastructure
CN111201553B (zh) * 2017-10-16 2022-04-22 华为技术有限公司 一种安全元件及相关设备
CN109815749B (zh) * 2017-11-21 2021-01-15 华为技术有限公司 控制se的系统、方法及芯片
CN109862553B (zh) * 2017-11-30 2022-07-12 华为技术有限公司 终端和通信方法
CN108229951A (zh) * 2018-01-08 2018-06-29 陈崇 一种移动终端及其快速支付方法和装置
US11257072B1 (en) 2018-03-29 2022-02-22 Square, Inc. Detecting unauthorized devices
US11182794B1 (en) 2018-03-29 2021-11-23 Square, Inc. Detecting unauthorized devices using proximity sensor(s)
CN111386513B (zh) * 2018-05-03 2021-09-07 华为技术有限公司 数据处理的方法、装置和系统芯片
US10733291B1 (en) * 2018-06-11 2020-08-04 Square, Inc. Bi-directional communication protocol based device security
CN109151777B (zh) 2018-06-11 2020-11-24 中国银联股份有限公司 一种非接通信方法以及通信装置
CN111566989B (zh) 2018-06-14 2022-06-07 华为技术有限公司 一种密钥处理方法及装置
US11223485B2 (en) * 2018-07-17 2022-01-11 Huawei Technologies Co., Ltd. Verifiable encryption based on trusted execution environment
CN109104712B (zh) * 2018-07-17 2021-04-30 北京神州安付科技股份有限公司 一种基于nfc功能的无线充值加密系统及其加密方法
CN111699467B (zh) * 2018-12-26 2021-12-03 华为技术有限公司 安全元件、数据处理装置及数据处理方法
CN111383015B (zh) * 2018-12-29 2023-11-03 华为技术有限公司 交易安全处理方法、装置及终端设备
CN111475430B (zh) * 2019-01-24 2023-04-11 深圳市文鼎创数据科技有限公司 Java卡芯片通信设备及通信方法
US11336684B2 (en) * 2019-06-07 2022-05-17 Lookout, Inc. Mobile device security using a secure execution context
CN114616569A (zh) * 2020-02-27 2022-06-10 谷歌有限责任公司 利用外部资源的安全元件
US20230180007A1 (en) * 2020-05-21 2023-06-08 Samsung Electronics Co., Ltd. Electronic device and method for electronic device to provide ranging-based service
CN111445231A (zh) * 2020-06-12 2020-07-24 支付宝(杭州)信息技术有限公司 实现MOTOpay的方法、装置及电子设备
CN112328265A (zh) * 2020-09-29 2021-02-05 福建联迪商用设备有限公司 一种eMMC验证方法及智能POS
FR3115622A1 (fr) * 2020-10-27 2022-04-29 Stmicroelectronics (Rousset) Sas Elément sécurisé
CN116738507B (zh) * 2023-08-14 2023-11-10 中科亿海微电子科技（苏州）有限公司 一种芯片鉴权方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102325210A (zh) * 2011-05-19 2012-01-18 武汉天喻信息产业股份有限公司 兼容多个运营商的通用移动支付终端及其实现方法
CN103544599A (zh) * 2012-07-09 2014-01-29 马克西姆综合产品公司 用于在移动终端内认证、存储和交易的嵌入式安全元件
US20140286492A1 (en) * 2010-11-23 2014-09-25 Microsoft Corporation Access Techniques Using a Mobile Communication Device
CN104145285A (zh) * 2012-02-29 2014-11-12 莫比威孚公司 用于在设备上进行安全金融交易的方法、设备和安全元件
CN104778794A (zh) * 2015-04-24 2015-07-15 华为技术有限公司 移动支付装置和方法

Family Cites Families (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2005227995A (ja) 2004-02-12 2005-08-25 Sony Corp 情報処理装置、および情報処理方法、並びにコンピュータ・プログラム
CA2648523C (en) 2005-04-21 2018-09-04 Securedpay Solutions, Inc. Portable handheld device for wireless order entry and real time payment authorization and related methods
JP5216486B2 (ja) * 2008-08-28 2013-06-19 株式会社日立製作所 半導体素子、携帯端末、および情報端末
US20100217709A1 (en) * 2008-09-22 2010-08-26 Christian Aabye Apparatus and method for preventing unauthorized access to payment application installed in contactless payment device
US10454693B2 (en) * 2009-09-30 2019-10-22 Visa International Service Association Mobile payment application architecture
DE102010028231A1 (de) * 2010-04-27 2011-10-27 Robert Bosch Gmbh Speichermodul zur gleichzeitigen Bereitstellung wenigstens eines sicheren und wenigstens eines unsicheren Speicherbereichs
DE102011117236A1 (de) * 2011-10-28 2013-05-02 Giesecke & Devrient Gmbh Effiziente Primzahlprüfung
KR101322402B1 (ko) 2011-11-25 2013-11-21 농업협동조합중앙회 어플리케이션 보안 시스템 및 방법, 이를 위한 통신 단말기
US20140012762A1 (en) * 2012-07-06 2014-01-09 Terry L. Glatt Embedded Electronic Payment System and Integrated Circuit
KR20140009744A (ko) 2012-07-12 2014-01-23 주식회사 엘지씨엔에스 교통 요금 처리를 위한 태그형 결제 단말, 태그형 결제 단말의 교통 요금 처리 방법 및 기록 매체
US20140020114A1 (en) * 2012-07-13 2014-01-16 Qualcomm Incorporated Methods and apparatuses for integrating a portion of secure element components on a system on chip
US9781598B2 (en) 2013-03-15 2017-10-03 Tyfone, Inc. Personal digital identity device with fingerprint sensor responsive to user interaction
JP6067449B2 (ja) * 2013-03-26 2017-01-25 株式会社東芝 情報処理装置、情報処理プログラム
KR102052959B1 (ko) 2013-04-16 2019-12-06 삼성전자주식회사 단말장치, 보안서버 및 그 결제방법
US10607212B2 (en) * 2013-07-15 2020-03-31 Visa International Services Association Secure remote payment transaction processing
DE102013013179A1 (de) * 2013-08-07 2015-02-12 Giesecke & Devrient Gmbh Verfahren zum Betreiben eines Sicherheitselements
EP3033725A4 (en) 2013-08-15 2017-05-03 Visa International Service Association Secure remote payment transaction processing using a secure element
EP2884692B1 (en) * 2013-12-13 2020-05-20 Nxp B.V. Updating software on a secure element
CN103793815B (zh) * 2014-01-23 2017-01-11 武汉天喻信息产业股份有限公司 适用于银行卡和行业卡的移动智能终端收单系统及方法
CN203966188U (zh) * 2014-06-06 2014-11-26 北京民芯科技有限公司 安全设备及终端
US20180012037A1 (en) * 2016-07-05 2018-01-11 Nxp B.V. Secure operation apparatuses and methods therefor

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140286492A1 (en) * 2010-11-23 2014-09-25 Microsoft Corporation Access Techniques Using a Mobile Communication Device
CN102325210A (zh) * 2011-05-19 2012-01-18 武汉天喻信息产业股份有限公司 兼容多个运营商的通用移动支付终端及其实现方法
CN104145285A (zh) * 2012-02-29 2014-11-12 莫比威孚公司 用于在设备上进行安全金融交易的方法、设备和安全元件
CN103544599A (zh) * 2012-07-09 2014-01-29 马克西姆综合产品公司 用于在移动终端内认证、存储和交易的嵌入式安全元件
CN104778794A (zh) * 2015-04-24 2015-07-15 华为技术有限公司 移动支付装置和方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3121752A4 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3547195A4 (en) * 2016-12-29 2019-12-25 Huawei Technologies Co., Ltd. SYSTEM-ON-CHIP AND METHOD FOR SWITCHING SAFE OPERATING SYSTEMS
US10853519B2 (en) 2016-12-29 2020-12-01 Huawei Technologies Co., Ltd. System on chip and method for implementing secure operating system switching

Also Published As

Publication number Publication date
JP6517926B2 (ja) 2019-05-22
JP2017536603A (ja) 2017-12-07
KR20170042344A (ko) 2017-04-18
US20170103378A1 (en) 2017-04-13
BR112016024967A2 (pt) 2017-08-15
US11429950B2 (en) 2022-08-30
ES2718540T3 (es) 2019-07-02
EP3534285A1 (en) 2019-09-04
EP3121752A1 (en) 2017-01-25
CN107533621B (zh) 2020-10-27
EP3121752A4 (en) 2017-05-31
JP2019079561A (ja) 2019-05-23
KR20180095136A (ko) 2018-08-24
CN104778794B (zh) 2017-06-20
CN107533621A (zh) 2018-01-02
CN104778794A (zh) 2015-07-15
EP3121752B1 (en) 2019-01-09

Similar Documents

Publication Publication Date Title
WO2016169229A1 (zh) 移动支付装置和方法
US10853519B2 (en) System on chip and method for implementing secure operating system switching
US20190172047A1 (en) System on chip and processing device
US10601795B2 (en) Service processing method and electronic device
WO2017177814A1 (zh) 一种控制多个安全应用软件的运行的装置和方法
CN106605233B (zh) 使用处理器提供可信执行环境
US11410156B2 (en) NFC payment method and terminal
TWI537765B (zh) 板上小型應用程式移轉
US20190089810A1 (en) Resource access method, apparatus, and system
US11126753B2 (en) Secure processor chip and terminal device
US20140161258A1 (en) Authentication server, mobile terminal and method for issuing radio frequency card key using authentication server and mobile terminal
US20150089586A1 (en) Systems and methods for nfc access control in a secure element centric nfc architecture
KR20190131712A (ko) 복수의 프로세서들과 연결된 보안 모듈의 제어 방법 및 이를 구현한 전자 장치
US11734416B2 (en) Construct general trusted application for a plurality of applications
CN109643340B (zh) 具有多个用户的安全元件
KR100648709B1 (ko) 스마트 카드 ｉｃ 칩이 장착된 휴대 단말기 및 그에 따른어플리케이션 발급 방법

Legal Events

Date Code Title Description
REEP Request for entry into the european phase

Ref document number: 2015888732

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2015888732

Country of ref document: EP

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15888732

Country of ref document: EP

Kind code of ref document: A1

REG Reference to national code

Ref country code: BR

Ref legal event code: B01A

Ref document number: 112016024967

Country of ref document: BR

ENP Entry into the national phase

Ref document number: 20177006993

Country of ref document: KR

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2017516493

Country of ref document: JP

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 112016024967

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20161025

NENP Non-entry into the national phase

Ref country code: DE