WO2016192453A1

WO2016192453A1 - Safety control method and apparatus, and terminal

Info

Publication number: WO2016192453A1
Application number: PCT/CN2016/077958
Authority: WO
Inventors: 张子敬; 张晴
Original assignee: 宇龙计算机通信科技(深圳)有限公司
Priority date: 2015-05-30
Filing date: 2016-03-31
Publication date: 2016-12-08
Also published as: CN105550866A; CN105550866B

Abstract

A safety control method and apparatus (300, 400), and a terminal. The safety control method comprises: detecting a current state of a terminal (S101); if it is detected that the current state of the terminal is an unsafe state, closing a host card simulated transaction channel (S102); and encrypting and compressing a host card simulated safety module application and authentication information data related to the host card simulated safety module application (S103). Therefore, safety control of an NFC service is implemented by using a host card simulation-based technology.

Description

Safety control method, device and terminal

Technical field

The present invention relates to the field of communications, and in particular, to a security control method, apparatus, and terminal.

Background technique

At present, NFC (Near Field Communication) payment based on Android 4.4 introduces a new open architecture, namely HCE (Host-based Card Emulation) technology, which is equipped with NFC function. After the card module is implemented in the terminal, the terminal does not need to provide physical SE (Security Elements), which makes the application of NFC simpler and more flexible.

However, the HCE technology only simulates the protocol and implementation of NFC and SE communication, that is, the security guarantee of the NFC service is completed by the virtual SE, and the SE is not implemented. The existing SE solution based on HCE technology can be implemented by simulation of local application software or simulation of cloud server, but under these two schemes, data security is not enough due to the security problem of the Android system itself, for example, when After the system is rooted (with superuser privileges), all data in the system will be threatened by security, and SE or authentication information stored in the system can be easily obtained. So how to implement the security control of NFC service based on HCE technology is an urgent problem to be solved.

Summary of the invention

The embodiment of the invention provides a security control method, device and terminal, so as to implement security control of the NFC service based on the HCE technology.

A first aspect of the embodiments of the present invention provides a security control method, including:

Detecting the current state of the terminal;

If it is detected that the current state of the terminal is an unsafe state, the host card analog transaction channel is closed;

Encrypt and compress the host card to simulate the security module application and its associated authentication information data.

A second aspect of the embodiments of the present invention provides a security control apparatus, including:

a first detecting module, configured to detect a current state of the terminal;

The module is closed, and if the current state of the terminal is detected to be unsafe, the host card analog transaction channel is closed;

The encryption module is used to encrypt and compress the host card to simulate the security module application and the authentication information data associated therewith.

The present invention also provides a terminal comprising the security control device according to any of the above technical solutions.

It can be seen that, in the technical solution provided by the embodiment of the present invention, the current state of the terminal is detected; if the current state of the terminal is detected to be in an insecure state, the host card analog transaction channel is closed, so that the terminal state is unsafe. In the state, the host card is no longer used to simulate the transaction channel; the host card simulation security module application and its associated authentication information data are encrypted and compressed, and the data protection during the transaction process is realized. Therefore, the security control of the NFC service is realized under the technology based on the host card simulation.

DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any creative work.

1 is a schematic flowchart of a security control method according to an embodiment of the present invention;

2 is a schematic flowchart of another security control method according to an embodiment of the present invention;

3 is a schematic structural diagram of a security control apparatus according to an embodiment of the present invention;

4 is a schematic structural diagram of another security control apparatus according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of still another security control apparatus according to an embodiment of the present invention; FIG.

FIG. 6 is a schematic structural diagram of a terminal according to an embodiment of the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is an embodiment of the invention, but not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts shall fall within the scope of the present invention.

The terms "first", "second" and "first" in the specification and claims of the present invention and the above drawings The third term is used to distinguish different objects, and is not intended to describe a particular order. In addition, the term "comprises" and any variants thereof are intended to cover a non-exclusive inclusion, such as a process or method comprising a series of steps or units. A system, product, or device is not limited to the listed steps or units, but optionally includes steps or units not listed, or alternatively other steps inherent to those processes, methods, products, or devices Or unit.

An embodiment of the security control method of the embodiment of the present invention, a security control method includes: detecting a current state of the terminal; and detecting that the current state of the terminal is an unsecured state, closing the host card analog transaction channel; Encrypt and compress the host card to simulate the security module application and its associated authentication information data.

Referring first to FIG. 1, FIG. 1 is a schematic flow chart of a security control method according to an embodiment of the present invention. As shown in FIG. 1 , a security control method provided by an embodiment of the present invention may include:

S101. Detect a current state of the terminal.

Among them, the terminal is a smart terminal capable of installing an Android system such as a mobile phone or a tablet computer, supports HCE, and has an NFC function. The current status of the terminal refers to the status of the current operating environment of the terminal, such as whether it is secure or not.

The HCE refers to the host-based card emulation. When the card emulation is implemented on the NFC-enabled terminal, the SE does not need to be provided. The SE function is implemented by an application running on the terminal or a cloud server. At this time, the NFC chip receives the function. The data obtained is completed by the operating system, or an application sent to the terminal, or a server sent to the cloud through the mobile network. For example, in an NFC mobile phone, the security module SE can be simulated by an application in the mobile phone.

The security module SE refers to a chip module for storing NFC application and user sensitive data and realizing security key operation, and is the core of the NFC card simulation. The security module also communicates with the external read/write device through the non-connected front end to realize data storage. And the security of the transaction process.

Optionally, in some possible implementation manners of the present invention, the NFC terminal may include a hardware security module SE, providing secure storage of sensitive information and providing a secure execution environment for transaction transactions, wherein the SE may be integrated into the SIM card , SD card or terminal chip.

Optionally, in some possible implementation manners of the present invention, the Android 4.4 system can be installed on the NFC-enabled terminal. Since the Android 4.4 system supports the HCE function, the HCE function can be implemented on the Android 4.4 system. Simulate SE applications with HCE.

Optionally, in some other possible implementation manners of the present invention, if the NFC-enabled terminal system is a version prior to Android 4.4, the terminal system may be upgraded to the Android 4.4 system. This enables support for HCE functions.

Optionally, in some possible implementation manners of the present invention, the terminal supporting the HCE function may use an APP (Application) application emulation card on the terminal to implement the function of the host card emulation, and the terminal also supports other functions. Traditional SE analog card technology, such as hardware SE module, that is, the terminal is compatible with both HCE and traditional SE.

For example, the mobile terminal of the Android 4.4 system with NFC function supports the HCE function, so that the card module of the SE can be realized by the HCE, and the hardware SE module is provided on the mobile terminal, so it can be understood that the mobile terminal It is also compatible with HCE card emulation and traditional hardware SE functions.

Optionally, in some possible implementation manners of the present invention, the current state of the terminal may be a security state or an unsecured state.

Optionally, in some possible implementation manners of the present invention, after detecting that the HCE analog transaction channel is enabled, the terminal detects the current security state of the terminal at a certain frequency.

S102. If it is detected that the current state of the terminal is an unsafe state, the host card analog transaction channel is closed.

The insecure state means that the operating environment of the terminal is not secure, and the current data running on the terminal may be stolen or destroyed, thereby causing the current transaction of the terminal to be unsafe.

The host card module transaction channel (ie, the HCE card analog transaction channel) refers to the channel that uses the HCE technology to simulate the SE security module to complete the NFC transaction. At this time, the NFC chip acts as a contactless communication front end and receives commands from the external reader. Forward to the application of the simulated SE and then reply by the application simulating the SE. The traditional hardware-based NFC transaction channel is the NFC chip as a contactless communication front-end, which will receive commands from the external reader, forward it to the SE, and then reply by the SE.

For example, in an HFC-enabled NFC mobile phone, the SE is simulated by the APP application, thereby implementing the HCE analog transaction channel, that is, the host card simulation transaction channel.

For example, in some possible implementation manners of the present invention, when the terminal is a mobile phone, the mobile phone NFC is used for payment. When the mobile phone system is rooted, the data stored in the mobile phone system is easily stolen or destroyed. If the current state of the terminal is unsafe, the HCE analog transaction channel is closed, thereby terminating the payment transaction performed by the channel.

It can be understood that closing the host card simulation transaction channel can no longer use the transaction channel to conduct transactions when the current state of the terminal is unsafe, thereby preventing the occurrence of unsafe transactions.

S103. Encrypt and compress the host card to simulate the security module application and the authentication information data related thereto.

In the NFC terminal, the host card analog security module application (ie, the HCE analog SE application) refers to an APP application that simulates the SE security module on the terminal having the HCE card simulation function, and the related authentication information data is stored in the HCE simulation. Data for authentication and user sensitive data in NFC transactions in SE applications. For example, in the NFC payment, the authentication information data may be user information, a password, and other data related to the payment, etc. of the payment parties.

Optionally, in some possible implementation manners of the present invention, the HCE card analog security module application and the authentication information data associated therewith may also be compressed and encrypted to ensure the security of the transaction data.

For example, when the mobile phone NFC mobile payment, if the payment environment has a security risk, the HCE analog payment channel is closed at this time, and the user information, password and other related data related to the payment are encrypted and compressed to ensure data security. .

It can be understood that encrypting and compressing the host card analog security module application and its associated authentication information data in a certain way will enhance the security of the data.

It can be seen that, in the solution of this embodiment, the current state of the terminal is detected; if the current state of the terminal is detected to be in an insecure state, the host card analog transaction channel is closed, so that the terminal state is no longer in an unsafe state. Continue to use the host card to simulate the transaction channel; encrypt and compress the host card to simulate the security module application and its associated authentication information data, to achieve data protection during the transaction process. Therefore, the security control of the NFC service is realized under the technology based on the host card simulation.

Optionally, in some possible implementation manners of the present invention, the HCE card analog transaction channel may be closed by a host or an NFC controller.

Optionally, in some possible implementation manners of the present invention, the detecting the current state of the terminal includes at least one of the following manners:

Detecting whether the terminal system is acquired by the super user authority, detecting whether the application installed by the terminal is officially released, and detecting whether the application installed by the terminal is infected by a virus.

The current security status of the terminal includes whether the operating environment of the terminal is secure and whether the software running on the terminal is qualified. When it is detected that the terminal system is acquired by the super user or the application installed by the terminal is infected by a virus, it is determined that the operating environment of the terminal itself is not Security, that is, the status of the terminal is unsafe. At this time, the HCE card analog transaction channel is closed.

It can be understood that in the above several cases, the security of the application and the data running by the terminal will be threatened. For example, when the terminal is making a payment, if the terminal is acquired with the super user right, the information related to the payment will be acquired. Payment transactions are not secure.

Optionally, in some other possible implementation manners of the present invention, the detecting the current state of the terminal may further include detecting whether the application installed by the terminal is an illegal application or a non-privileged application, and detecting other abnormal conditions of the terminal.

Optionally, in some possible implementation manners of the present invention, the method further includes:

If it is detected that the application installed by the terminal is an unofficial publishing application, an illegal application, or an unauthorized application, the application is denied access to the host card analog transaction channel.

It can be understood that, if it is detected that the application installed in the terminal is an unofficial publishing application, a legitimate application, or a non-privileged application, only the application of the terminal is unqualified, and the terminal itself does not have a root or other security risk, Limiting the application's access to the HCE card emulation transaction channel without closing the HCE card emulation transaction channel, making the operation simple, without affecting other official applications, legitimate applications, and access to the HCE card emulation transaction channel.

Optionally, in some possible implementation manners of the present invention, after the encrypting and compressing the host card to simulate the security module application and the authentication information data associated therewith, the method further includes:

The host card analog transaction channel is routed to the security module entity.

It can be understood that when the current state of the terminal is in an insecure state, the HCE card analog transaction channel is closed, and the HCE simulated SE application and the authentication information data related thereto are simultaneously encrypted and compressed, so that the NFC transaction cannot be performed, then the HCE card simulation transaction channel routing to the traditional SE module ensures the smooth progress of the transaction, while ensuring the security of the data.

Optionally, in some possible implementation manners of the present disclosure, the security module entity is a hardware entity SE module.

For example, in some possible implementation manners of the present invention, when the mobile phone is used for NFC mobile payment, if the mobile phone is detected to be Root, in order to ensure the security of payment, the HCE analog transaction channel is closed, and the host card is simulated and encrypted. The module application and its associated authentication information data, and at the same time routing the HCE simulated trading channel to the entity SE, thereby eliminating the payment risk and ensuring the smooth progress of the transaction.

Optionally, in some possible implementation manners of the present invention, the encrypting and compressing the host card to simulate the security module application and the authentication information data related thereto include:

The host card analog security module application and its associated authentication information data are encrypted by the host card emulating the personal identification password corresponding to the mobile wallet or the user-set password.

Optionally, in some possible implementation manners of the present invention, the encrypting and compressing the host card emulation security module application and the authentication information data related thereto may also use the password formed by a certain encoding rule to the host card. The analog security module application and its associated authentication information data are encrypted.

It can be understood that using the host card to simulate the personal identification password (host HCE wallet PIN code) of the mobile phone wallet, the host card analog security module application and the authentication information data related thereto are encrypted according to the password setting manner in the NFC transaction, and the password is guaranteed. safety.

Detecting a current state of the terminal;

If it is detected that the current state of the terminal is a security state, the host card is simulated to open a transaction channel;

Decompress and decrypt the host card to simulate the security module application and its associated authentication information data.

Optionally, in some possible implementation manners of the present invention, when the current state of the terminal is an unsecured state, the HCE card analog transaction channel is closed, and the HCE simulated SE application and the authentication information data related thereto are simultaneously encrypted and compressed. Continue to detect the current state of the terminal at a certain frequency.

It can be understood that when the current state of the terminal is in an insecure state, the HCE card analog transaction channel is closed, and the HCE simulated SE application and the authentication information data related thereto are simultaneously encrypted and compressed, and then the terminal is continuously detected at a certain frequency. After the current state of the terminal is in a safe state, the HCE simulated transaction channel is opened, and the HCE simulated SE application and related authentication information data are restored, so that the HCE simulated transaction channel can be restored in time after the security state of the terminal is restored.

Optionally, in some possible implementation manners of the present invention, the HCE card analog transaction channel is enabled by the host or the NFC controller.

Optionally, in some possible implementation manners of the present invention, when the HCE simulated transaction channel is restored, the host card analog security module application and the authentication information data associated therewith may be decrypted and decompressed.

Optionally, in some possible implementation manners of the present invention, if it is detected that the current state of the terminal is a security state, the HCE card analog transaction channel is again routed from the SE entity to the HCE card analog transaction channel.

For example, when the mobile phone NCF pays, when the system is rooted, the analog payment channel is closed. Close and protect the HCE simulated SE application and related authentication information data, and then route the HCE simulated transaction channel to the entity SE simulation, continue to detect the security status of the terminal, and when it detects that the terminal's insecure factor has been eliminated, then it is turned on. The original HCE analog payment channel releases relevant applications and data, and routes the transaction channel from the entity SE to the HCE analog payment channel again to restore the HCE card simulation transaction function.

In order to facilitate the better understanding and implementation of the foregoing solutions of the embodiments of the present invention, the following is exemplified in conjunction with some specific application scenarios.

Referring to FIG. 2, FIG. 2 is a schematic flowchart diagram of another security control method according to another embodiment of the present invention, where another security control method provided by another embodiment of the present invention is shown in FIG. Can include:

S201. Detect a current state of the terminal.

Optionally, in some possible implementation manners of the present invention, the terminal supporting the HCE function may use an APP (Application) application emulation card on the terminal to implement the function of the host card emulation, and the terminal also supports other functions. Traditional SE solutions, such as hardware SE modules, that is, terminals are compatible with both HCE and traditional SE.

For example, in some possible implementation manners of the present invention, for a mobile phone terminal with an NFC-enabled Android 4.4 system, the HCE function is supported, so that the card module for the SE can be implemented by the HCE, and the mobile phone terminal has Hardware SE module, so it can be understood that the mobile terminal is compatible with both HCE card emulation and traditional hardware SE functions.

Optionally, in some other possible implementation manners of the present invention, the current state of the detecting terminal may further include other conditions that affect the security of the operating environment of the terminal.

S202. If it is detected that the current state of the terminal is an unsafe state, the host card analog transaction channel is closed.

The insecure state means that the operating environment of the terminal is not secure, and the current data running on the terminal may be stolen or destroyed, thereby causing the current transaction of the terminal to be unsafe, such as the terminal system. Applications that are installed by the root or terminal are not infected by viruses.

If it is detected that the application installed by the terminal is an unofficial publishing application, an illegal application, or an unprivileged application, the application is denied access to the host card analog transaction channel.

S203: Encrypt and compress the host card to simulate the security module application and the authentication information data related thereto.

S204. Route the host card analog transaction channel to the security module entity.

S205. Detect the current state of the terminal again.

It can be understood that when the current state of the terminal is in an insecure state, the HCE card analog transaction channel is closed, and the HCE simulated SE application and the authentication information data related thereto are simultaneously encrypted and compressed, and then the terminal is continuously detected at a certain frequency. The state of the terminal can be observed in real time, and the response is timely when the state of the terminal changes.

S206. If it is detected that the current state of the terminal is a safe state, start the host card to simulate the transaction channel.

Optionally, if it is detected again that the current state of the terminal is an unsafe state, no action is taken.

S207. Decompress and decrypt the host card to simulate the security module application and the authentication information data related thereto.

Optionally, in some possible implementation manners of the present invention, if the action of protecting the host card emulation security module application and the authentication information data associated therewith is compressed and encrypted, the host card emulation security module application may be decrypted and decompressed and Relevant authentication information data.

Optionally, in some possible implementation manners of the present invention, the password of the decryption host card emulation security module application and the authentication information data associated therewith is a password when the encryption host card emulates the security module application and the authentication information data associated therewith, Generally it is the host HCE wallet PIN code.

For example, when the mobile phone NCF pays, when the system is rooted, the analog payment channel is closed and the HCE simulated SE application and related authentication information data are protected, and the HCE simulated transaction channel is routed to the entity SE simulation, and then continues. Detecting the security status of the terminal. When it is detected that the insecure factor of the terminal has been eliminated, the original HCE analog payment channel is opened, the related application and data are released, and the transaction channel is again routed from the entity SE to the HCE analog payment channel. In the recovery of the HCE card simulation transaction function.

Let's take a more specific application scenario below.

For example, when the terminal is a mobile phone with an Android 4.4 system installed, it has an NFC function and supports HCE technology, so that the NFC software simulation can be implemented on the mobile phone through the HCE analog SE application. When using NFC for mobile payment, first check the status of the mobile phone, such as whether the mobile phone is rooted, whether the payment software is officially released, whether the software installed on the mobile phone is infected by a virus, etc. If the mobile phone is detected to be root, the user can obtain the highest system. Permission, so that the stored SE or authentication information can be obtained. The malicious user may access the terminal's storage system by other means, and obtain sensitive data stored in the application to complete some pseudo-card transactions, which will bring the payer Great security risk, so after detecting the security risk, the mobile phone closes the HCE card simulation transaction channel through the NFC controller, and encrypts and compresses the HCE simulated SE application and related authentication data information through the PIN code corresponding to the HCE mobile wallet. To ensure the security of the data.

Further, when it is detected that the payment software is an unofficial release software, the payment software is denied access to the HCE card analog transaction channel, thereby eliminating the insecurities caused by the payment software.

Further, after the HCE card analog transaction channel is closed, the HCE card analog transaction channel can be routed to the SE entity.

Further, when the mobile phone root authority is turned off, and the state of the mobile phone is detected again, the state of the mobile phone is detected as a safe state, the HCE card simulation transaction channel is restored, and the HCE simulated SE application and related authentication are decompressed and decrypted. Data information, at this time no NFC transactions are performed by the entity SE.

Referring to FIG. 3, FIG. 3 is a schematic structural diagram of a security control apparatus according to an embodiment of the present invention. As shown in FIG. 3, a security control apparatus 300 according to an embodiment of the present invention may include:

The first detection module 310, the shutdown module 320, and the encryption module 330.

The first detecting module 310 is configured to detect a current state of the terminal.

Among them, the terminal is a smart terminal capable of installing an Android system such as a mobile phone or a tablet computer, and supports HCE. With NFC capabilities. The current status of the terminal refers to the status of the current operating environment of the terminal, such as whether it is secure or not.

Optionally, in some possible implementation manners of the present invention, the terminal is opened in the HCE analog transaction channel. After the start, the current security status of the terminal is detected at a certain frequency.

The closing module 320 is configured to close the host card analog transaction channel if it is detected that the current state of the terminal is an unsafe state.

The encryption module 330 is configured to encrypt and compress the host card to simulate the security module application and the authentication information data associated therewith.

It is to be understood that the functions of the functional modules of the security control device 300 of the present embodiment may be specifically implemented according to the method in the foregoing method embodiments. For the specific implementation process, reference may be made to the related description of the foregoing method embodiments, and details are not described herein again. .

It can be seen that, in the solution of the embodiment, the security control device 300 detects the current state of the terminal; if the security control device 300 detects that the current state of the terminal is unsafe, the host controller simulates the transaction channel, thereby When the status is unsafe, the host card is no longer used to simulate the transaction channel; the security control device 300 encrypts and compresses the host card analog security module application and the authentication information data associated therewith, thereby realizing the protection of data during the transaction process. Therefore, the security control of the NFC service is realized under the technology based on the host card simulation.

Referring to FIG. 4, FIG. 4 is a schematic structural diagram of another security control apparatus according to another embodiment of the present invention, wherein another security control apparatus according to another embodiment of the present invention is shown in FIG. 400 can include:

The first detection module 410, the shutdown module 420, and the encryption module 430.

The first detecting module 410 is configured to detect a current state of the terminal.

The closing module 420 is configured to close the host card analog transaction channel if it detects that the current state of the terminal is an unsafe state.

For example, in some possible implementation manners of the present invention, when the terminal is a mobile phone, the hand is utilized. The NFC performs payment. When the mobile phone's system is rooted, the data stored in the mobile phone system is easily stolen or destroyed. At this time, the current state of the terminal is unsafe, then the HCE analog transaction channel is closed, thereby terminating the channel. A payment transaction made.

The encryption module 430 is configured to encrypt and compress the host card to simulate the security module application and the authentication information data associated therewith.

Optionally, in some possible implementation manners of the present invention, the detecting module 410 detects that a current state of the terminal includes at least one of the following manners:

It can be understood that in the above several cases, the security of applications and data running on the terminal will be affected. Threats, such as when the terminal is making a payment, if the terminal is acquired the super user right, the information related to the payment will be obtained, and the payment transaction is not secure.

Optionally, in some possible implementation manners of the present invention, the detecting module 410 is further configured to:

Optionally, in some possible implementation manners of the present invention, the security control apparatus 400 further includes:

The routing module 440 is configured to route the host card analog transaction channel to the security module entity.

Optionally, in some possible implementation manners of the present disclosure, the encryption module 430 is specifically configured to:

Optionally, in some possible implementation manners of the present invention, after the encryption module 430, the security control apparatus 400 further includes:

a second detecting module 450, configured to detect a current state of the terminal;

The module 460 is configured to: if it is detected that the current state of the terminal is a security state, enable the host card to simulate a transaction channel;

The decryption module 470 is configured to decompress and decrypt the host card analog security module application and the authentication information data associated therewith.

The second detection module 450 may be different from the first detection module 410 for detecting the current security state of the terminal after the HCE card analog transaction channel is closed, or may be integrated with the first detection module 410 in the same module. It is used to detect the current state of the terminal.

Optionally, in some possible implementation manners of the present invention, when the current state of the terminal is an unsecured state, the HCE card analog transaction channel is closed, and the HCE simulated SE application and the authentication information data related thereto are simultaneously encrypted and compressed. The second detecting module 450 continues to detect the current state of the terminal at a certain frequency.

Optionally, in some possible implementation manners of the present invention, the opening module 460 can be implemented by the host or the NFC controller to enable the HCE card to simulate the transaction channel.

Optionally, in some possible implementation manners of the present invention, when the HCE simulated transaction channel is restored, the decryption module 470 can decrypt and decompress the host card analog security module application and the authentication information associated therewith. data.

It is to be understood that the functions of the functional modules of the security control device 400 of the present embodiment may be specifically implemented according to the method in the foregoing method embodiments, and the specific implementation process may refer to the related description of the foregoing method embodiments, and details are not described herein again. .

It can be seen that, in the solution of the embodiment, the security control device 400 detects the current state of the terminal; if the security control device 400 detects that the current state of the terminal is in an insecure state, the host controller simulates the transaction channel, thereby When the state is unsafe, the host card is no longer used to simulate the transaction channel; the security control device 400 encrypts and compresses the host card simulation security module application and the authentication information data related thereto, thereby realizing the protection of the data during the transaction process. Therefore, the security control of the NFC service is realized under the technology based on the host card simulation.

Referring to FIG. 5, FIG. 5 is a schematic structural diagram of still another safety control device according to still another embodiment of the present invention. As shown in FIG. 5, still another security control apparatus 500 provided by still another embodiment of the present invention may include at least one bus 501, at least one processor 502 connected to the bus, and at least one memory 503 connected to the bus.

The processor 502 calls the code stored in the memory 503 to detect the current state of the terminal through the bus 501. If the current state of the terminal is detected to be in an insecure state, the host card is simulated to close the transaction channel; the encryption and compression are performed. The host card emulates the security module application and its associated authentication information data.

The host card module transaction channel (ie, the HCE card analog transaction channel) refers to the channel that uses the HCE technology to simulate the SE security module to complete the NFC transaction. At this time, the NFC chip acts as a contactless communication front end and receives commands from the external reader. Forward to the application of the simulated SE, then enter the application of the simulated SE Line reply. The traditional hardware-based NFC transaction channel is the NFC chip as a contactless communication front-end, which will receive commands from the external reader, forward it to the SE, and then reply by the SE.

Optionally, in some possible implementation manners of the present invention, the detecting, by the processor 502, the current state of the terminal includes at least one of the following manners:

Optionally, in some possible implementation manners of the present invention, the processor 502 may further:

Optionally, in some possible implementation manners of the present invention, after the processor 502 encrypts and compresses the host card emulation security module application and the authentication information data associated therewith, the processor 502 may further:

Optionally, in some possible implementation manners of the present invention, the processor 502 encrypts and compresses the host card emulation security module application and authentication information data related thereto, and the processor 502 may:

Optionally, in some possible implementation manners of the present invention, after the processor 502 encrypts and compresses the host card to simulate the security module application and the authentication information data associated therewith, the processor 502 further includes:

Detecting a current state of the terminal;

Optionally, in some possible implementation manners of the present invention, when the HCE simulated transaction channel is restored, the processor 502 can decrypt and decompress the host card emulation security module application and the authentication information data associated therewith.

Optionally, in some possible implementation manners of the present invention, if it is detected that the current state of the terminal is a security state, the processor 502 again routes the HCE card analog transaction channel from the SE entity to the HCE card analog transaction channel. in.

It is to be understood that the functions of the functional modules of the security control device 500 of the present embodiment may be specifically implemented according to the method in the foregoing method embodiments. For the specific implementation process, reference may be made to the related description of the foregoing method embodiments, and details are not described herein again. .

It can be seen that, in the solution of this embodiment, the security control device 500 detects the current state of the terminal; If the security control device 500 detects that the current state of the terminal is in an insecure state, the host card is simulated to close the transaction channel, so that the host card is not used to simulate the transaction channel when the terminal state is in an unsafe state; the security control device 500 encrypts And compress the host card analog security module application and its associated authentication information data to achieve data protection during the transaction process. Therefore, the security control of the NFC service is realized under the technology based on the host card simulation.

Referring to Figure 6, Figure 6 is a terminal provided by an embodiment of the present invention. The present invention also provides a terminal 500 comprising the security control device 400 as described in any of the above aspects.

The embodiment of the present invention further provides a computer storage medium, wherein the computer storage medium can store a program, and the program includes some or all of the steps of any one of the message interaction methods described in the foregoing method embodiments.

It should be noted that, for the foregoing method embodiments, for the sake of simple description, they are all expressed as a series of action combinations, but those skilled in the art should understand that the present invention is not limited by the described action sequence. Because certain steps may be performed in other sequences or concurrently in accordance with the present invention. In addition, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

In the above embodiments, the descriptions of the various embodiments are different, and the details that are not detailed in a certain embodiment can be referred to the related descriptions of other embodiments.

In the several embodiments provided herein, it should be understood that the disclosed apparatus may be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be combined or may be Integrate into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be electrical or otherwise.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. in. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention, which is essential or contributes to the prior art, or all or part of the technical solution, may be embodied in the form of a software product stored in a storage medium. A number of instructions are included to cause a computer device (which may be a personal computer, server or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The foregoing storage medium includes: a U disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a removable hard disk, a magnetic disk, or an optical disk, and the like. .

The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art will understand that The technical solutions described in the embodiments are modified, or some of the technical features are replaced by equivalents; and the modifications or substitutions do not deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

A security control method, the method comprising:

Detecting the current state of the terminal;

If it is detected that the current state of the terminal is an unsafe state, the host card analog transaction channel is closed;

Encrypt and compress the host card to simulate the security module application and its associated authentication information data.
The method of claim 1, wherein after the encrypting and compressing the host card emulation security module application and the authentication information data associated therewith, the method further comprises:

The host card analog transaction channel is routed to the security module entity.
The method of claim 1, wherein after the encrypting and compressing the host card emulation security module application and the authentication information data associated therewith, the method further comprises:

Detecting a current state of the terminal;

If it is detected that the current state of the terminal is a security state, the host card is simulated to open a transaction channel;

Decompress and decrypt the host card to simulate the security module application and its associated authentication information data.
The method according to claim 1 or 3, wherein the detecting the current state of the terminal comprises at least one of the following:

Detecting whether the terminal system is acquired by the super user authority, detecting whether the application installed by the terminal is officially released, and detecting whether the application installed by the terminal is infected by a virus.
The method of claim 1, wherein the encrypting and compressing the host card emulation security module application and the authentication information data associated therewith comprises:

The host card analog security module application and its associated authentication information data are encrypted by the host card emulating the personal identification password corresponding to the mobile wallet or the user-set password.
The method of claim 1 wherein the method further comprises:

If it is detected that the application installed by the terminal is an unofficial publishing application, an illegal application, or an unprivileged application, the application is denied access to the host card analog transaction channel.
A safety control device, characterized in that the device comprises:

a first detecting module, configured to detect a current state of the terminal;

The module is closed, and if the current state of the terminal is detected to be unsafe, the host card analog transaction channel is closed;

Encryption module for encrypting and compressing the host card analog security module application and its associated authentication letter Information data.
The device of claim 7 wherein said device further comprises:

a routing module, configured to route the host card analog transaction channel to the security module entity.
The device of claim 7, wherein after the encrypting module, the device further comprises:

a second detecting module, configured to detect a current state of the terminal;

Opening a module, if it is detected that the current state of the terminal is a safe state, opening the host card to simulate a transaction channel;

The decryption module is configured to decompress and decrypt the host card analog security module application and the authentication information data related thereto.
The device according to claim 6 or 9, wherein the detecting module detects the current state of the terminal and comprises at least one of the following manners:

Detecting whether the terminal system is acquired by the super user authority, detecting whether the application installed by the terminal is officially released, and detecting whether the application installed by the terminal is infected by a virus.
The device according to claim 7, wherein the encryption module is specifically configured to:

The host card analog security module application and its associated authentication information data are encrypted by the host card emulating the personal identification password corresponding to the mobile wallet or the user-set password.
The apparatus of claim 7, wherein the detecting module is further configured to:

If it is detected that the application installed by the terminal is an unofficial publishing application, an illegal application, or an unprivileged application, the application is denied access to the host card analog transaction channel.
A terminal characterized by comprising the security control device according to any one of claims 7 to 12.