WO2018000843A1 - 移动支付方法、片上系统及终端 - Google Patents

移动支付方法、片上系统及终端 Download PDF

Info

Publication number
WO2018000843A1
WO2018000843A1 PCT/CN2017/075029 CN2017075029W WO2018000843A1 WO 2018000843 A1 WO2018000843 A1 WO 2018000843A1 CN 2017075029 W CN2017075029 W CN 2017075029W WO 2018000843 A1 WO2018000843 A1 WO 2018000843A1
Authority
WO
WIPO (PCT)
Prior art keywords
check value
external memory
security
check
soc
Prior art date
Application number
PCT/CN2017/075029
Other languages
English (en)
French (fr)
Inventor
檀珠峰
胡翠
孙少杰
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP17818842.1A priority Critical patent/EP3471042A4/en
Publication of WO2018000843A1 publication Critical patent/WO2018000843A1/zh
Priority to US16/235,270 priority patent/US20190139026A1/en

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00Payment architectures, schemes or protocols
    • G06Q20/38Payment protocols; Details thereof
    • G06Q20/40Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401Transaction verification
    • G06Q20/4014Identity check for transactions
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3234Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F12/00Accessing, addressing or allocating within memory systems or architectures
    • G06F12/14Protection against unauthorised use of memory or access to memory
    • G06F12/1408Protection against unauthorised use of memory or access to memory by using cryptography
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00Payment architectures, schemes or protocols
    • G06Q20/30Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/322Aspects of commerce using mobile devices [M-devices]
    • G06Q20/3227Aspects of commerce using mobile devices [M-devices] using secure elements embedded in M-devices
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00Payment architectures, schemes or protocols
    • G06Q20/30Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/327Short range or proximity payments by means of M-devices
    • G06Q20/3278RFID or NFC payments by means of M-devices
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00Payment architectures, schemes or protocols
    • G06Q20/30Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/36Payment architectures, schemes or protocols characterised by the use of specific devices or networks using electronic wallets or electronic money safes
    • G06Q20/367Payment architectures, schemes or protocols characterised by the use of specific devices or networks using electronic wallets or electronic money safes involving electronic purses or money safes
    • G06Q20/3674Payment architectures, schemes or protocols characterised by the use of specific devices or networks using electronic wallets or electronic money safes involving electronic purses or money safes involving authentication
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00Payment architectures, schemes or protocols
    • G06Q20/30Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/36Payment architectures, schemes or protocols characterised by the use of specific devices or networks using electronic wallets or electronic money safes
    • G06Q20/367Payment architectures, schemes or protocols characterised by the use of specific devices or networks using electronic wallets or electronic money safes involving electronic purses or money safes
    • G06Q20/3676Balancing accounts
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00Payment architectures, schemes or protocols
    • G06Q20/38Payment protocols; Details thereof
    • G06Q20/382Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3821Electronic credentials
    • G06Q20/38215Use of certificates or encrypted proofs of transaction rights
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00Payment architectures, schemes or protocols
    • G06Q20/38Payment protocols; Details thereof
    • G06Q20/40Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00Payment architectures, schemes or protocols
    • G06Q20/38Payment protocols; Details thereof
    • G06Q20/40Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/409Device specific authentication in transaction processing
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q2220/00Business processing using cryptography
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/56Financial cryptography, e.g. electronic payment or e-cash

Definitions

  • the present application relates to the field of communications technologies, and in particular, to a mobile payment method, a system on chip, and a terminal.
  • NFC Near Field Communication
  • MT mobile terminal
  • SE Secure Element
  • the prior art provides an implementation manner of integrating an SE chip and a system on chip (SOC).
  • SOC system on chip
  • the external memory includes a common storage area and a Replay Protect Memory Block (RPMB), wherein the common storage area is used for storing data with low security requirements such as pictures and videos; and the RPMB adopts authentication and encryption technology. It is highly secure and is generally used to store important data that requires high security.
  • RPMB Replay Protect Memory Block
  • the prior art has a problem in that although the data in the RPMB itself is encrypted, even if it is stolen, it is difficult to be cracked, but since the external memory for storing sensitive data is separated from the main chip, the trespasser can The memory is replaced by another old version of the memory that can be authenticated, so that the data in the external memory is changed, and there is a big security risk. For example, after a transaction is completed, the intruder can completely copy or back up the entire external storage.
  • the copy or backup memory is replaced by the external memory as a whole, so that even if the data in the external memory changes after the next transaction is completed, for example, the account balance changes, but will be copied Or the backup of the old data of the memory replaces the actual current balance, which brings great security risks.
  • the present application provides a mobile payment method, a system on a chip, and a terminal, which solves a large security risk in the prior art after replacing the external memory as a whole with another old version of the memory that can be authenticated.
  • the present application provides a mobile payment method, applied to a system-on-a-chip, the SOC including a secure element SE integrated in the SOC, the method comprising: the SE receiving a transaction request; The external memory of the SOC acquires a first check value; and performs security check on the external memory according to the first check value and a second check value locally stored by the SOC In the case where the external memory passes the security check, the SE acquires the first transaction data from the external memory, and processes the transaction request based on the first transaction data.
  • the SE after receiving the transaction request, the SE obtains the locally stored check value and the check value stored in the external memory, and performs security check on the external memory according to the two check values.
  • the transaction request is processed only if the memory passes the security check. Therefore, compared with the prior art, the verification process of performing security check on the external memory is added in the present application, and the security of the data in the external memory caused by the overall replacement of the external memory can be avoided. Hidden dangers, improve the security of mobile payments.
  • the method further includes: the SE generating second transaction data after processing the transaction request; the SE synchronously updating the first a check value and the second check value; the SE transmitting the updated first check value and the second transaction data to the external memory, and locally storing the updated second in the SOC Check value.
  • the SE updates the local stored and stored checksum values in the external memory and saves each time after processing the transaction request. In this way, when the next transaction request is made, the external memory can be first checked for security according to the check value, and the transaction request can be processed again when the security check is performed, and the check values corresponding to different transaction requests are different. Improve the security of mobile payments.
  • the SE synchronously updates the first check value and the second check value, including: The SE adds n to the values of the first check value and the second check value to obtain the updated first check value and the updated second check value, where the n Is a natural number greater than or equal to 1.
  • This implementation provides a specific implementation in which the SE synchronously updates the first check value and the second check value.
  • the SE synchronously updates the first check value and the second check value, including: the SE Multiplying the values of the first check value and the second check value by k to obtain the updated first check value and the updated second check value, the k Is a natural number greater than or equal to 1.
  • This implementation provides another specific implementation in which the SE synchronously updates the first check value and the second check value.
  • the second verification that is locally stored according to the first verification value and the SOC Performing a security check on the external memory, including: comparing, by the SE, the first check value and the second check value; if the first check value is greater than or equal to the second school If the value is verified, the SE determines that the external memory passes the security check; otherwise, the SE determines that the external memory does not pass the security check.
  • the implementation manner provides a specific implementation of the SE performing security check on the external memory according to the first check value and the second check value. the way.
  • the method further includes: the SE, acquiring the second check from a payment platform server when the power is turned on.
  • the value is stored locally in the SOC; the SE sends the stored second verification value to the payment platform server upon power down.
  • the SE saves the locally stored check value to the payment platform server when the power is off, and correspondingly, obtains the check value from the payment platform server at the next power-on startup. Since the security of the payment platform server is high, the security of the check value can be ensured, and the accuracy of the security check result can be improved when the check value is used for security check with the external memory.
  • the method further includes: in a case where the external memory does not pass the security check, the SE refuses to process the transaction request to terminate the transaction. .
  • the SE refuses to process the transaction request to terminate the transaction.
  • the present application provides a system on chip, the system-on-chip SOC including a secure element SE integrated in the SOC; the SE includes a security processor and a built-in memory coupled to the security processor;
  • the security processor is configured to receive a transaction request, and obtain a first check value from an external memory of the SOC; the security processor is further configured to use the first check value and the SOC
  • the second check value stored in the memory performs a security check on the external memory; in the case where the external memory passes the security check, the first transaction data is acquired from the external memory, and based on the The first transaction data processes the transaction request.
  • the on-chip system integrates the SE, and after receiving the transaction request, the SE obtains the locally stored check value and the check value stored in the external memory, and externally stores the memory according to the two check values.
  • a security check is performed to process the transaction request if the external memory passes the security check. Therefore, compared with the prior art, the verification process of performing security check on the external memory is added in the present application, and the security of the data in the external memory caused by the overall replacement of the external memory can be avoided. Hidden dangers, improve the security of mobile payments.
  • the security processor is further configured to generate second transaction data after processing the transaction request; and synchronously update the first verification value And the second check value; and sending the updated first check value and the second transaction data to the external memory; the security processor is further configured to use the second check The value is stored locally to the memory in the SOC.
  • the security processor is specifically configured to respectively perform the first check value and the second check value And adding n to obtain the updated first check value and the updated second check value, wherein n is a natural number greater than or equal to 1.
  • the security processor is specifically configured to respectively perform the first check value and the second check value The value is multiplied by k to obtain the updated first check value and the updated second check value, where k is a natural number greater than or equal to 1.
  • the security processor is configured to compare the first verification value with the first And a second check value; when the first check value is greater than or equal to the second check value, determining that the external memory passes the security check; otherwise, determining that the external memory fails the security check.
  • the security processor is further configured to acquire the second school from a payment platform server when the SE is powered on Detecting and storing locally to a memory in the SOC; transmitting the updated second check value stored locally by the SOC to the payment platform server when the SE is powered off.
  • the memory in the SOC for storing the second check value is located in the SE Built-in memory.
  • the security processor is further configured to: when the external memory does not pass the security check Refused to process the transaction request to terminate the transaction.
  • the application provides a terminal, comprising the system-on-chip SOC of the second aspect and any one of the implementation manners of the second aspect, and an external memory coupled to the SOC.
  • the process of interaction between the SOC and the external memory can be referred to the first aspect and the method described in any implementation of the first aspect.
  • the terminal provided by the application after receiving the transaction request, acquires the locally stored check value and the check value stored in the external memory, and performs security check on the external memory according to the two check values, in the external memory.
  • the transaction request is processed only through the security check. Therefore, compared with the prior art, the verification process of performing security check on the external memory is added in the present application, and the security of the data in the external memory caused by the overall replacement of the external memory can be avoided. Hidden dangers, improve the security of mobile payments.
  • FIG. 1 is a schematic flowchart of a first mobile payment method according to an embodiment of the present application
  • FIG. 2 is a schematic flowchart of a second mobile payment method according to an embodiment of the present application.
  • FIG. 3 is a schematic flowchart of a third mobile payment method according to an embodiment of the present application.
  • FIG. 4 is a schematic flowchart of a fourth mobile payment method according to an embodiment of the present application.
  • FIG. 5 is a schematic flowchart diagram of a fifth mobile payment method according to an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of a system-on-chip SOC according to an embodiment of the present disclosure.
  • FIG. 7 is a schematic structural diagram of a terminal according to an embodiment of the present application.
  • the mobile payment method provided by the embodiment of the present application is applied to a system-on-chip SOC including a secure element SE integrated in the SOC.
  • the SOC is generally applied to terminals such as mobile phones and tablet computers, and is a combination of a microprocessor, an analog Internet Protocol (IP) core, a digital IP core, and a memory (or an off-chip storage control interface).
  • IP Internet Protocol
  • a single chip, its functional modules include processors, communication modules, graphics and image processing modules, voice processing modules, and so on.
  • the SE in the embodiment of the present application is also integrated with the SE, and the SE can pass the mailbox mechanism or other communication.
  • the channel communicates with the SOC, which generally includes a dedicated security processor and a memory coupled to the security processor, capable of storing sensitive data in the mobile payment process, and performing security encryption and decryption algorithm operations to provide security for the mobile payment process. .
  • the mobile payment method provided by the embodiment of the present application further relates to an external memory coupled to the SOC, where the external memory includes a common storage area and an RPMB area, wherein the common storage area for storing pictures, videos, etc. has lower security requirements.
  • the RPMB area uses authentication and encryption technology, which is highly secure and is generally used to store important data that requires high security.
  • an embodiment of the present application provides a mobile payment method, including:
  • the SE receives the transaction request.
  • the originator of the transaction request may be an NFC module in the terminal or other module for performing mobile payment.
  • the SE may be in a dormant or power-off state before receiving the transaction request, and after the SE receives the transaction request, the SE wakes up from the sleep state or starts up and starts to perform the following steps.
  • the SE obtains a first check value from an external memory of the SOC, and performs a security check on the external memory according to the first check value and a second check value locally stored by the SOC.
  • the first check value and the second check value are used to identify the occurrence status of the mobile payment. After the mobile payment is performed, the first check value and the second check value may be updated synchronously, and the value of the check value corresponding to each mobile payment is different.
  • the SOC local storage for storing the second check value may be a memory or SE in the SOC
  • Different check values can be set for different mobile payment applications.
  • the application (Application, APP) 1 and the APP2 are different mobile payment applications.
  • the first check value and the second check value corresponding to the APP1 are respectively obtained and the security check is performed.
  • the first check value and the second check value corresponding to APP2 are respectively obtained and security check is performed.
  • the first check value and the second check value may be implemented by using a counter, and the bit width of the counter may be determined according to actual needs, which is not limited in this application.
  • the value of the counter can be modified to update the check value, and when the value of the counter reaches the maximum value, the counter can be reset.
  • the SE acquires the first transaction data from the external memory, and processes the transaction request based on the first transaction data.
  • the first transaction data includes sensitive data in a mobile payment process such as a payment application account, a password, and an account balance.
  • the external memory passes the security check, it indicates that the security of the external memory is high, and the data stored in the external memory is authentic, and the SE normally processes the transaction request.
  • the SE normally processes the transaction request.
  • the SE after receiving the transaction request, the SE obtains the locally stored check value and the check value stored in the external memory, and performs security check on the external memory according to the two check values.
  • the transaction request is processed only when the external memory passes the security check. Therefore, compared with the prior art, the verification of the security check of the external memory is added in the present application. The process can avoid the security risk caused by the change of the data in the external memory caused by the external replacement of the external memory, and improve the security of the mobile payment.
  • the embodiment of the present application further provides a mobile payment method, where the method includes:
  • the SE receives the transaction request.
  • the SE obtains a first check value from an external memory of the SOC, and performs security check on the external memory according to the first check value and a second check value locally stored by the SOC.
  • step 203 is performed, otherwise step 204 is performed.
  • the SE acquires first transaction data from the external memory, and processes the transaction request based on the first transaction data.
  • step 201 to step 203 For the specific implementation process of step 201 to step 203, refer to step 101 to step 103, and details are not described herein again.
  • the SE refuses to process the transaction request to terminate the transaction.
  • the SE rejects the transaction request to terminate the transaction.
  • the SE may also send an alarm message to a processor in the SOC.
  • the mobile payment method provided by the embodiment of the present application indicates that if the external memory does not pass the security check, it indicates that the security of the external memory is poor. If the transaction continues, there is a big security risk, and the external memory does not pass the security. In the case of verification, the SE refuses to process the transaction request to terminate the transaction. Therefore, compared with the prior art, the verification process of performing security check on the external memory is added in the present application, and the security of the data in the external memory caused by the overall replacement of the external memory can be avoided. Hidden dangers, improve the security of mobile payments.
  • the embodiment of the present application further provides a mobile payment method, where the method includes:
  • the SE receives the transaction request.
  • the SE obtains a first check value from an external memory of the SOC, and performs security check on the external memory according to the first check value and a second check value locally stored by the SOC.
  • step 303 is performed, otherwise step 307 is performed.
  • the SE acquires first transaction data from the external memory, and processes the transaction request based on the first transaction data.
  • step 301 to step 303 For the specific implementation process of step 301 to step 303, refer to step 101 to step 103, and details are not described herein again.
  • the SE generates second transaction data after processing the transaction request.
  • the second transaction data includes account information after the transaction is completed, such as the account balance after the transaction is completed.
  • the SE synchronously updates the first check value and the second check value.
  • the SE adds n to the values of the first check value and the second check value to obtain the updated first check value and the The updated second check value, where n is a natural number greater than or equal to 1.
  • the SE multiplies the values of the first check value and the second check value by k to obtain the updated first check value and The updated second check value, where k is a natural number greater than or equal to 1.
  • the specific implementation process of performing security check in step 102, 202 or 302 includes: comparing the SE The first check value and the second check value; if the first check value is greater than or equal to the second check value, the SE determines that the external memory passes the security check; Otherwise, the SE determines that the external memory has not passed the security check.
  • the data generated in the payment process and the first check value have been written into the external memory, but the second check value has not been written into the SE, and the SE is powered off.
  • the first check value will be greater than the second check value, but the external memory can be considered to be still legal, and its security is still high.
  • the SE reduces the value of the first check value and the second check value by m, to obtain the updated first check value and the The updated second check value, where m is a natural number greater than or equal to 1.
  • the specific implementation process of performing security check in step 102, 202 or 302 includes: comparing the first a check value and the second check value; if the first check value is less than or equal to the second check value, the SE determines that the external memory passes a security check; otherwise, the The SE determines that the external memory has not passed the security check.
  • the SE determines that the external memory passes the security check.
  • the data generated in the payment process and the first check value have been written into the external memory, but the second check value has not been written into the SE, and the SE is powered off.
  • the first check value will be smaller than the second check value, but the external memory can still be considered legal, and its security is still high.
  • the SE sends the updated first check value and the second transaction data to the external memory, and locally stores the updated second check value in the SOC.
  • the SE after processing the transaction request, the SE saves the first check value in the process of storing the second transaction data; the SE stores the updated second check value.
  • the SE compares the first check value with the second check value; if the first check value is smaller than Or equal to the second check value, the SE determines that the external memory passes the security check; otherwise, the SE determines that the external memory fails the security check.
  • the SE refuses to process the transaction request to terminate the transaction.
  • step 307 For the specific implementation process of step 307, refer to step 204, and details are not described herein again.
  • the SE synchronously updates and stores the check value stored locally and stored in the external memory after each processing of the transaction request. In this way, when the next transaction request is made, the external memory can be first checked for security according to the check value, and the security check is passed. In the case that the transaction request is processed again, and the check values corresponding to different transaction requests are different, the security of the mobile payment can be improved.
  • the SE acquires the second check value from a payment platform server at a power-on startup and stores it locally in the SOC.
  • the SE sends the stored second verification value to the payment platform server when the power is off.
  • servers such as banks and Alipay payment platforms have higher security because of the use of encryption and other technical means.
  • the SE saves the locally stored check value to the payment platform server when the power is off, and correspondingly, obtains the check value from the payment platform server when the power is turned on next time. Since the security of the payment platform server is high, the security of the check value can be ensured, and the accuracy of the security check result can be improved when the check value is used for security check with the external memory.
  • the embodiment of the present application provides a system-on-a-chip SOC, which is described in detail later.
  • the embodiment of the present application provides a terminal, including a system-on-chip SOC as shown in FIG. 6 and an external memory coupled to the SOC, which is described in detail later.
  • the embodiment of the present application in conjunction with the terminal shown in FIG. 7 and the actual application scenario, the embodiment of the present application further provides a mobile payment.
  • Methods including:
  • the SE receives the transaction request, starts up at power-on, and executes a program stored in the ROM to load data located in the RPMB area of the external memory.
  • the data of the RPMB area referred to in this step includes an operating system for mobile payment, an application software for mobile payment, a first check value, and the like.
  • the SE obtains a second check value from the payment platform server.
  • the SE stores the second check value obtained from the payment platform server in the SOC local storage, such as in a volatile memory in the SOC, such as RAM. This is equivalent to a temporary storage process.
  • the SE performs verification authentication and decryption on the acquired data of the RPMB area.
  • the RPMB area uses authentication and encryption technologies. Therefore, the SE needs to decrypt the data of the acquired RPMB area.
  • the SE needs to decrypt the data of the acquired RPMB area.
  • the SE performs security verification on the external storage according to the first check value obtained from the RPMB area and the second check value obtained from the payment platform server.
  • the SE stores the data of the RPMB area into the internal memory, and the SE startup is completed, and normal operations and transactions can be performed.
  • the SE acquires first transaction data from the RPMB area, and processes the transaction request based on the first transaction data.
  • the SE generates second transaction data after processing the transaction request.
  • the SE synchronously updates the first check value and the second check value.
  • the SE sends the updated first check value and the second transaction data to the external memory, and locally stores the updated second check value.
  • the external storage stores the updated first check value and the second transaction data to the RPMB area.
  • the specific implementation process of performing step 406 to step 409 shown in FIG. 4 specifically includes: the SE loads the mobile payment application software, and when the data in the transaction process needs to be stored in the external memory, the mobile payment is performed.
  • the application software encrypts the data in the transaction to obtain the ciphertext data, wherein, as shown in the bold part of FIG. 5, in addition to encrypting the data in the transaction process to obtain the ciphertext data, the first check value is also needed. Encryption is performed to obtain ciphertext data, and then the data is subcontracted in a trusted execution environment provided by the terminal, and then the general operating system software, that is, the operating system used by the terminal, such as the Android operating system software, will be subcontracted.
  • the data is encapsulated into RPMB format data according to the requirements of the RPMB protocol and then written into the RPMB area of the external memory.
  • the second check value is also stored in the SOC local storage and stored in the payment platform server before the SE is powered off.
  • the SE includes a process of establishing a channel between the SE and the payment platform server, and packaging the data into a specific format and storing the data in the mobile platform server.
  • the process reference may be made to the prior art, and details are not described herein again.
  • the storage of the second check value in the SE internal memory is a temporary storage process, so the internal memory of the SE may be a volatile memory such as a RAM or a static random access memory. (Static Random Access Memory, SRAM).
  • SRAM Static Random Access Memory
  • the embodiment of the present application provides a system on chip SOC500 for performing the method described in any one of FIG. 1 to FIG. 5, where the system-on-chip SOC includes a security element SE51 integrated in the SOC.
  • the memory 54 is located in the SOC but not in the SE, and may be a non-volatile read-only memory (ROM), a random access random access memory (RAM), or an electrically erasable memory. Electrically Erasable Programmable Read-Only Memory (EEPROM).
  • ROM read-only memory
  • RAM random access random access memory
  • EEPROM Electrically Erasable Programmable Read-Only Memory
  • the SE includes a secure processor 501, a second bus 502, and a built-in memory 503 coupled to the secure processor 501 via a second bus 502.
  • the built-in memory 503 specifically includes a ROM, a RAM, a static random access memory (SRAM), a one-time programmable memory (OTP), and the like.
  • a communication channel is also provided within the SOC for the SE to communicate with other modules within the SOC via the communication channel.
  • the SOC is coupled to the external memory via the first bus 52.
  • the SE communicates with the external memory through the communication channel and the first bus.
  • system on chip 500 further includes a communication module and a diagram. Shape and image processing modules, voice processing modules, and the like.
  • the SE further includes a module such as a True Random Number Generator (TRNG), an encryption and decryption module, and the like.
  • TRNG True Random Number Generator
  • an encryption and decryption module and the like.
  • the security processor 501 is configured to receive a transaction request, and obtain a first check value from an external memory of the SOC.
  • the security processor 501 is further configured to: perform security verification on the external memory according to the first check value and a second check value stored in a memory in the SOC; pass the external memory in the external memory In the case of a security check, the first transaction data is obtained from the external memory and the transaction request is processed based on the first transaction data.
  • the security processor 501 is further configured to generate second transaction data after processing the transaction request; synchronously update the first check value and the second check value; The first check value and the second transaction data are sent to the external memory; the security processor is further configured to locally store the second check value to a memory in the SOC.
  • the security processor 501 is specifically configured to add n values of the first check value and the second check value to obtain the updated first check value and the The updated second check value, where n is a natural number greater than or equal to 1.
  • the security processor 501 is specifically configured to multiply the values of the first check value and the second check value by k to obtain the updated first check value and The updated second check value, where k is a natural number greater than or equal to 1.
  • the security processor 501 is specifically configured to compare the first check value with the second check value; when the first check value is greater than or equal to the second check value Determining that the external memory passes the security check; otherwise, determining that the external memory fails the security check.
  • the security processor 501 is further configured to: when the SE is powered on, acquire the second check value from a payment platform server and locally store the memory in the SOC; And transmitting the updated second check value locally stored by the SOC to the payment platform server.
  • the memory in the SOC for storing the second check value is a built-in memory located in the SE, such as RAM or OTP in the SE, or other memory located in the SOC.
  • each bit unit of the OTP represents 1 value
  • each bit unit is a write-once device
  • the second check value can be modified by programming the bit unit, for example, by writing one more.
  • the bit unit represents the value of the second check value plus one.
  • the security processor is further configured to refuse to process the transaction request to terminate the transaction if the external memory does not pass the security check.
  • the on-chip system integrates the SE, and after receiving the transaction request, the SE obtains the locally stored check value and the check value stored in the external memory, and according to the two check values,
  • the memory is checked for security, and the transaction request is processed only when the external memory passes the security check. Therefore, compared with the prior art, the verification process of performing security check on the external memory is added in the present application, which can avoid the external replacement caused by the external memory.
  • the security risks caused by the data in the memory being changed are improved, and the security of mobile payment is improved.
  • processors including the processor 53 and the security processor 501 referred to in the embodiments of the present application may be one processor or a collective name of multiple processing elements.
  • the processor may be a central processing unit (CPU), or may be an application specific integrated circuit (ASIC), or one or more configured to implement the embodiments of the present application.
  • An integrated circuit such as one or more digital signal processors (DSPs), or one or more Field Programmable Gate Arrays (FPGAs).
  • the memory (memory 54) referred to in the embodiment of the present application may be a storage device, or may be a collective name of a plurality of storage elements, and is used to store executable program code and the like.
  • the memory may include random access memory (RAM), and may also include non-volatile memory such as a magnetic disk memory, a flash memory, or the like.
  • the bus (including the first bus 52 and the second bus 502) may be an Industry Standard Architecture (ISA) bus, a Peripheral Component (PCI) bus, or an Extended Industry Standard Architecture (Extended Industry Standard Architecture). , EISA) bus, etc.
  • ISA Industry Standard Architecture
  • PCI Peripheral Component
  • EISA Extended Industry Standard Architecture
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one line is shown in the figure, but it does not mean that there is only one bus or one type of bus.
  • an embodiment of the present application provides a terminal, including: a system on chip SOC500 as described in FIG. 6, and an external memory 600 coupled to the SOC.
  • the external storage 600 includes a common storage area and an RPMB area, wherein the common storage area is used for storing data with low security requirements such as pictures and videos; the RPMB area adopts authentication and encryption technology, and the security is high. Used to store important data that requires a high level of security.
  • the terminal provided by the embodiment of the present application further includes an NFC module.
  • the terminal after receiving the transaction request, acquires the locally stored check value and the check value stored in the external memory, and performs security check on the external memory according to the two check values.
  • the transaction request is processed only if the memory passes the security check. Therefore, compared with the prior art, the verification process of performing security check on the external memory is added in the present application, and the security of the data in the external memory caused by the overall replacement of the external memory can be avoided. Hidden dangers, improve the security of mobile payments.
  • the present application can be implemented by means of software plus necessary general hardware, and of course, by hardware, but in many cases, the former is a better implementation. .
  • the technical solution of the present application which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a readable storage medium, such as a floppy disk of a computer.
  • a hard disk or optical disk, etc. includes instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform the methods described in various embodiments of the present application.

Landscapes

  • Business, Economics & Management (AREA)
  • Engineering & Computer Science (AREA)
  • Accounting & Taxation (AREA)
  • Theoretical Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Strategic Management (AREA)
  • General Business, Economics & Management (AREA)
  • Finance (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Development Economics (AREA)
  • Economics (AREA)
  • Signal Processing (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
  • Storage Device Security (AREA)

Abstract

本申请公开了一种移动支付方法、片上系统及终端,涉及通信技术领域。为了解决现有技术中存在的将外置存储器整体替换为其他可通过鉴权的旧版本的存储器后,存在较大的安全隐患的问题而发明。该方法应用于片上系统SOC,所述SOC包括集成在SOC中的安全元件SE,该方法包括:SE接收交易请求;SE从外置存储器获取第一校验值;并根据第一校验值以及SOC本地存储的第二校验值对外置存储器进行安全校验;在外置存储器通过安全校验的情况下,SE从外置存储器获取第一交易数据,并基于第一交易数据对交易请求进行处理。本申请应用在移动支付的过程中。

Description

移动支付方法、片上系统及终端
本申请要求了2016年6月30日提交的,申请号为201610513966.4,发明名称为“移动支付方法、片上系统及终端”的中国申请的优先权,其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域,尤其涉及一种移动支付方法、片上系统及终端。
背景技术
目前,近距离无线通信(Near Field Communication,NFC)技术已经广泛应用于移动支付领域。在利用NFC实现移动支付的过程中,为了保证移动支付的安全性,移动终端(Mobile Terminal,MT)上通常需要增加独立的安全元件(Secure Element,SE)芯片。SE芯片能够存储移动支付过程中的敏感数据,并进行安全加解密算法运算等工作。但增加独立的SE芯片会增加移动终端电路板设计复杂度以及整机成本。
为了解决上述问题,现有技术中提供了一种将SE芯片和片上系统(System on Chip,SOC)集成设置的实现方式。但受存储工艺所限,SE芯片中存储操作系统和安全性能应用的非易失性存储器无法集成到SOC主芯片内,因此需要增加外置存储器。外置存储器中包括普通存储区和回环加密保护分区(Replay Protect Memory Block,RPMB),其中,普通存储区用于存储图片、视频等对安全性要求较低的数据;RPMB采用了鉴权加密技术,安全性较高,一般用于存储对安全性要求较高的重要数据。
然而,现有技术存在的问题为,尽管RPMB中的数据本身被加密,即使被窃取,也难以被破解,但由于用于存储敏感数据的外置存储器与主芯片分离,非法侵入者可以将外置存储器整体替换为另一可通过鉴权的旧版本的存储器,使得外置存储器中的数据被更改,进而存在较大的安全隐患。例如:在某次交易完成后,侵入者可以将整个外置存储器完全复制或备份。在下一次交易完成后,再将所述复制或备份存储器整体替换外置存储器,这样,即使在下一次交易完成后外置存储器中的数据发生了变化,例如:账户余额发生了变化,但由于将复制或备份的存储器旧数据替换了此次实际上的当前余额,带来极大的安全隐患。
发明内容
本申请提供一种移动支付方法、片上系统及终端,以解决现有技术中存在的将外置存储器整体替换为其他可通过鉴权的旧版本的存储器后,存在较大的安全隐患。
为达到上述目的,本申请采用如下技术方案:
第一方面,本申请提供一种移动支付方法,应用于片上系统SOC,所述SOC包括集成在所述SOC中的安全元件SE,所述方法包括:所述SE接收交易请求;所述SE从所述SOC的外置存储器获取第一校验值;并根据所述第一校验值以及所述SOC本地存储的第二校验值对所述外置存储器进行安全校 验;在所述外置存储器通过安全校验的情况下,所述SE从所述外置存储器获取第一交易数据,并基于所述第一交易数据对所述交易请求进行处理。
本申请提供的移动支付方法,SE接收交易请求后,分别获取本地存储的校验值和外置存储器中存储的校验值,并根据这两个校验值对外置存储器进行安全校验,在外置存储器通过安全校验的情况下才处理该交易请求。因此,与现有技术相比,本申请中增加了对外置存储器进行安全校验的校验过程,能够避免由于外置存储器被整体替换带来的外置存储器中的数据被更改带来的安全隐患,提高移动支付的安全性。
结合第一方面,在第一方面的第一种实现方式中,所述方法还包括:所述SE在处理完所述交易请求后生成第二交易数据;所述SE同步地更新所述第一校验值和所述第二校验值;所述SE将更新后的第一校验值和所述第二交易数据发送至所述外置存储器,以及在SOC中本地存储更新后的第二校验值。
该实现方式中,SE在每次处理完交易请求后,同步更新本地存储和存储在外置存储器中的校验值并保存。这样,在进行下次交易请求时,能够首先根据校验值对外置存储器进行安全校验,在通过安全校验的情况下再处理交易请求,且不同次交易请求对应的校验值不同,能够提高移动支付的安全性。
结合第一方面的第一种实现方式中,在第一方面的第二种实现方式中,所述SE同步地更新所述第一校验值和所述第二校验值,包括:所述SE分别将所述第一校验值和所述第二校验值的取值加n,得到所述更新后的第一校验值以及所述更新后的第二校验值,所述n为大于等于1的自然数。
该实现方式给出了SE同步地更新所述第一校验值和所述第二校验值的一种具体实现方式。
结合第一方面的第一种实现方式,在第一方面的第三种实现方式中,所述SE同步地更新所述第一校验值和所述第二校验值,包括:所述SE分别将所述第一校验值和所述第二校验值的取值乘以k,得到所述更新后的第一校验值以及所述更新后的第二校验值,所述k为大于等于1的自然数。
该实现方式给出了SE同步地更新所述第一校验值和所述第二校验值的另一种具体实现方式。
结合第一方面的第二种实现方式或第三种实现方式,在第一方面的第四种实现方式中,所述根据所述第一校验值以及所述SOC本地存储的第二校验值对所述外置存储器进行安全校验,包括:所述SE比较所述第一校验值与所述第二校验值;如果所述第一校验值大于或等于所述第二校验值,则所述SE确定所述外置存储器通过安全校验;否则,所述SE确定所述外置存储器未通过安全校验。
结合上述两种更新第一校验值和第二校验值的具体实现方式,该实现方式给出了SE根据第一校验值和第二校验值对外置存储器进行安全校验的具体实现方式。
结合第一方面的第一种实现方式,在第一方面的第五种实现方式中,所述方法还包括:所述SE,在上电启动时从支付平台服务器获取所述第二校验 值并在SOC中本地存储;所述SE,在下电时将存储的所述更新后的第二校验值发送至所述支付平台服务器。
在该实现方式中,SE在下电时将本地存储的校验值保存到支付平台服务器,相应的,在下次上电启动时再从支付平台服务器获取校验值。由于支付平台服务器的安全性较高,因此能够保证校验值的安全性,则在利用该校验值与外置存储器进行安全校验时,能够提高安全校验结果的准确性。
结合第一方面,在第一方面的第六种实现方式中,所述方法还包括:在所述外置存储器没有通过安全校验的情况下,所述SE拒绝处理所述交易请求以终止交易。
在该实现方式中,如果外置存储器没有通过安全校验,则表明外置存储器的安全性较差,如果继续进行交易,则存在较大的安全隐患,因此,在该实现方式中,在所述外置存储器没有通过安全校验的情况下,所述SE拒绝处理所述交易请求以终止交易。
第二方面,本申请提供一种片上系统,所述片上系统SOC包括集成在所述SOC中的安全元件SE;所述SE包括安全处理器以及耦合到所述安全处理器的内置存储器;其中,所述安全处理器,用于接收交易请求;并从所述SOC的外置存储器获取第一校验值;所述安全处理器,还用于根据所述第一校验值以及所述SOC中的存储器存储的第二校验值对所述外置存储器进行安全校验;在所述外置存储器通过安全校验的情况下,从所述外置存储器获取第一交易数据,并基于所述第一交易数据对所述交易请求进行处理。
本申请提供的片上系统,该片上系统集成设置SE,SE接收交易请求后,分别获取本地存储的校验值和外置存储器中存储的校验值,并根据这两个校验值对外置存储器进行安全校验,在外置存储器通过安全校验的情况下才处理该交易请求。因此,与现有技术相比,本申请中增加了对外置存储器进行安全校验的校验过程,能够避免由于外置存储器被整体替换带来的外置存储器中的数据被更改带来的安全隐患,提高移动支付的安全性。
结合第二方面,在第二方面的第一种实现方式中,所述安全处理器,还用于在处理完所述交易请求后生成第二交易数据;同步地更新所述第一校验值和所述第二校验值;并将更新后的第一校验值和所述第二交易数据发送至所述外置存储器;所述安全处理器,还用于将所述第二校验值本地存储至所述SOC中的存储器。
结合第二方面的第一种实现方式,在第二方面的第二种实现方式中,所述安全处理器,具体用于分别将所述第一校验值和所述第二校验值的取值加n,得到所述更新后的第一校验值以及所述更新后的第二校验值,所述n为大于等于1的自然数。
结合第二方面的第一种实现方式,在第二方面的第三种实现方式中,所述安全处理器,具体用于分别将所述第一校验值和所述第二校验值的取值乘以k,得到所述更新后的第一校验值以及所述更新后的第二校验值,所述k为大于等于1的自然数。
结合第二方面的第二种实现方式或第三种实现方式,在第二方面的第四种实现方式中,所述安全处理器,具体用于比较所述第一校验值与所述第二校验值;当所述第一校验值大于或等于所述第二校验值时,确定所述外置存储器通过安全校验;否则,确定所述外置存储器未通过安全校验。
结合第二方面的第一种实现方式,在第二方面的第五种实现方式中,所述安全处理器,还用于在所述SE上电启动时从支付平台服务器获取所述第二校验值并本地存储至所述SOC中的存储器;在所述SE下电时将所述SOC本地存储的所述更新后的第二校验值发送至所述支付平台服务器。
结合第二方面或者第二方面的第一种实现方式,在第二方面的第六种实现方式中,用于存储所述第二校验值的所述SOC中的存储器为位于所述SE中的内置存储器。
结合第二方面或者第二方面的第一种实现方式,在第二方面的第七种实现方式中,所述安全处理器,还用于在所述外置存储器没有通过安全校验的情况下,拒绝处理所述交易请求以终止交易。
第三方面,本申请提供一种终端,包括第二方面以及第二方面任意一种实现方式所述的片上系统SOC,以及耦合至所述SOC的外置存储器。
SOC与外置存储器的交互过程可参考第一方面以及第一方面任意实现方式所述的方法。
本申请提供的终端,SE接收交易请求后,分别获取本地存储的校验值和外置存储器中存储的校验值,并根据这两个校验值对外置存储器进行安全校验,在外置存储器通过安全校验的情况下才处理该交易请求。因此,与现有技术相比,本申请中增加了对外置存储器进行安全校验的校验过程,能够避免由于外置存储器被整体替换带来的外置存储器中的数据被更改带来的安全隐患,提高移动支付的安全性。
附图说明
图1为本申请实施例提供的第一种移动支付方法的流程示意图;
图2为本申请实施例提供的第二种移动支付方法的流程示意图;
图3为本申请实施例提供的第三种移动支付方法的流程示意图;
图4为本申请实施例提供的第四种移动支付方法的流程示意图;
图5为本申请实施例提供的第五种移动支付方法的流程示意图;
图6为本申请实施例提供的片上系统SOC的结构示意图;
图7为本申请实施例提供的终端的结构示意图。
具体实施方式
本申请实施例提供的移动支付方法应用于片上系统SOC,所述SOC包括集成在所述SOC中的安全元件SE。其中,SOC一般应用于手机、平板电脑等终端中,为一种将微处理器、模拟网络互联协议(Internet Protocol,IP)核、数字IP核和存储器(或片外存储控制接口)集成设置的单一芯片,其功能模块包括处理器、通信模块、图形和图像处理模块、语音处理模块等。本申请实施例所指的SOC中还集成设置了SE,SE能够通过邮箱机制或其他通讯 通道与SOC通信,其一般包括专用的安全处理器和与该安全处理器耦合的存储器,能够存储移动支付过程中的敏感数据,并进行安全加解密算法运算等工作,为移动支付过程提供安全保障。
本申请实施例提供的移动支付方法还涉及耦合至所述SOC的外置存储器,外置存储器包括普通存储区和RPMB区,其中,普通存储区用于存储图片、视频等对安全性要求较低的数据;RPMB区采用了鉴权加密技术,安全性较高,一般用于存储对安全性要求较高的重要数据。
如图1所示,本申请实施例提供了一种移动支付方法,包括:
101:SE接收交易请求。
其中,交易请求的发起者可以为终端中的NFC模块或者其他用于进行移动支付的模块。
可选的,SE在未接收交易请求前可能处于休眠或下电状态,则当SE接收交易请求后,SE由休眠状态唤醒或上电启动并开始执行下述步骤。
102:SE从所述SOC的外置存储器获取第一校验值;并根据所述第一校验值以及所述SOC本地存储的第二校验值对所述外置存储器进行安全校验。
其中,第一校验值和第二校验值用于标识移动支付的发生状态。每次进行移动支付后,可同步更新第一校验值和第二校验值,则每次移动支付对应的校验值的取值不同。
SOC本地用于存储第二校验值的存储器可以为SOC中的存储器或者SE
针对不同的移动支付应用,可以设定不同的校验值。例如:应用程序(Application,APP)1和APP2为不同的移动支付应用,当用户通过APP1进行移动支付时,分别获取与APP1对应的第一校验值和第二校验值并进行安全校验。当用户通过APP2进行移动支付时,分别获取与APP2对应的第一校验值和第二校验值并进行安全校验。
可选的,第一校验值和第二校验值可以通过计数器实现,计数器的位宽可根据实际需要确定,本申请不作限定。每次进行移动支付后,可以修改计数器的取值以更新校验值,当计数器的取值达到最大值时,可复位所述计数器。
103:在所述外置存储器通过安全校验的情况下,所述SE从所述外置存储器获取第一交易数据,并基于所述第一交易数据对所述交易请求进行处理。
其中,第一交易数据包括支付应用账号、密码、账户余额等移动支付过程中的敏感数据。
如果外置存储器通过安全校验,则表明外置存储器的安全性较高,外置存储器中存储的数据真实可信,则SE正常处理该交易请求。对交易请求进行正常处理的具体处理过程可参考现有技术,此处不再赘述。
本申请实施例提供的移动支付方法,SE接收交易请求后,分别获取本地存储的校验值和外置存储器中存储的校验值,并根据这两个校验值对外置存储器进行安全校验,在外置存储器通过安全校验的情况下才处理该交易请求。因此,与现有技术相比,本申请中增加了对外置存储器进行安全校验的校验 过程,能够避免由于外置存储器被整体替换带来的外置存储器中的数据被更改带来的安全隐患,提高移动支付的安全性。
如图2所示,本申请实施例还提供了一种移动支付方法,该方法包括:
201:SE接收交易请求。
202:SE从所述SOC的外置存储器获取第一校验值;并根据所述第一校验值以及所述SOC本地存储的第二校验值对所述外置存储器进行安全校验。
在所述外置存储器通过安全校验的情况下,执行步骤203,否则执行步骤204。
203:所述SE从所述外置存储器获取第一交易数据,并基于所述第一交易数据对所述交易请求进行处理。
其中,步骤201至步骤203的具体实现过程可参考步骤101至步骤103,此处不再赘述。
204:SE拒绝处理所述交易请求以终止交易。
如果外置存储器未通过安全校验,则SE拒绝该交易请求以终止交易。
可选的,SE还可以向SOC中的处理器发送告警信息。
本申请实施例提供的移动支付方法,如果外置存储器没有通过安全校验,表明外置存储器的安全性较差,如果继续进行交易,则存在较大的安全隐患,则在外置存储器没有通过安全校验的情况下,SE拒绝处理所述交易请求以终止交易。因此,与现有技术相比,本申请中增加了对外置存储器进行安全校验的校验过程,能够避免由于外置存储器被整体替换带来的外置存储器中的数据被更改带来的安全隐患,提高移动支付的安全性。
如图3所示,在图2所示的方法的基础上,本申请实施例还提供了一种移动支付方法,该方法包括:
301:SE接收交易请求。
302:SE从所述SOC的外置存储器获取第一校验值;并根据所述第一校验值以及所述SOC本地存储的第二校验值对所述外置存储器进行安全校验。
在所述外置存储器通过安全校验的情况下,执行步骤303,否则执行步骤307。
303:所述SE从所述外置存储器获取第一交易数据,并基于所述第一交易数据对所述交易请求进行处理。
步骤301至步骤303的具体实现过程可参考步骤101至步骤103,此处不再赘述。
304:SE在处理完所述交易请求后生成第二交易数据。
其中,第二交易数据包括交易完成后的账户信息,如交易完成后的账户余额等。
305:SE同步地更新所述第一校验值和所述第二校验值。
在该步骤的第一种实现方式中,所述SE分别将所述第一校验值和所述第二校验值的取值加n,得到所述更新后的第一校验值以及所述更新后的第二校验值,所述n为大于等于1的自然数。
在该步骤的第二种实现方式中,所述SE分别将所述第一校验值和所述第二校验值的取值乘以k,得到所述更新后的第一校验值以及所述更新后的第二校验值,所述k为大于等于1的自然数。
相应的,与上述更新第一校验值和第二校验值的第一种和第二种实现方式对应,步骤102、202或302的进行安全校验的具体实现过程包括:所述SE比较所述第一校验值与所述第二校验值;如果所述第一校验值大于或等于所述第二校验值,则所述SE确定所述外置存储器通过安全校验;否则,所述SE确定所述外置存储器未通过安全校验。
其中,如果第一校验值与第二校验值相等,则很明显的,所述SE确定所述外置存储器通过安全校验。
考虑到实际应用过程中,可能存在已经将支付过程中产生的数据和第一校验值均写入外置存储器,但还未将第二校验值写入SE,SE就下电的情况,则这种情况下,第一校验值会大于第二校验值,但可认为外置存储器仍然合法,其安全性仍然较高。
在该步骤的第三种实现方式中,所述SE分别将所述第一校验值和所述第二校验值的取值减m,得到所述更新后的第一校验值以及所述更新后的第二校验值,所述m为大于等于1的自然数。
相应的,与上述更新第一校验值和第二校验值的第三种实现方式对应,步骤102、202或302的进行安全校验的具体实现过程包括:所述SE比较所述第一校验值与所述第二校验值;如果所述第一校验值小于或等于所述第二校验值,则所述SE确定所述外置存储器通过安全校验;否则,所述SE确定所述外置存储器未通过安全校验。其中,如果第一校验值与第二校验值相等,则很明显的,所述SE确定所述外置存储器通过安全校验。考虑到实际应用过程中,可能存在已经将支付过程中产生的数据和第一校验值均写入外置存储器,但还未将第二校验值写入SE,SE就下电的情况,则这种情况下,第一校验值会小于第二校验值,但可仍然认为外置存储器合法,其安全性仍然较高。
306:SE将更新后的第一校验值和所述第二交易数据发送至所述外置存储器,以及在SOC中本地存储更新后的第二校验值。
在本步骤的具体实现过程中,处理完交易请求后,SE在存储第二交易数据的过程中,同时保存第一校验值;SE存储更新后的第二校验值。
与步骤305的第三种实现方式对应,在该步骤的一种实现方式中,所述SE比较所述第一校验值与所述第二校验值;如果所述第一校验值小于或等于所述第二校验值,则所述SE确定所述外置存储器通过安全校验;否则,所述SE确定所述外置存储器未通过安全校验。
307:SE拒绝处理所述交易请求以终止交易。
步骤307的具体实现过程可参考步骤204,此处不再赘述。
本申请提供的移动支付方法,SE在每次处理完交易请求后,同步更新本地存储和存储在外置存储器中的校验值并保存。这样,在进行下次交易请求时,能够首先根据校验值对外置存储器进行安全校验,在通过安全校验的情 况下再处理交易请求,且不同次交易请求对应的校验值不同,能够提高移动支付的安全性。
可选的,所述SE,在上电启动时从支付平台服务器获取所述第二校验值并在SOC中本地存储。
所述SE,在下电时将存储的所述更新后的第二校验值发送至所述支付平台服务器。
一般而言,如银行、支付宝等支付平台的服务器,由于采用了加密等技术手段,其安全性较高。
本申请提供的移动支付方法,SE在下电时将本地存储的校验值保存到支付平台服务器,相应的,在下次上电启动时再从支付平台服务器获取校验值。由于支付平台服务器的安全性较高,因此能够保证校验值的安全性,则在利用该校验值与外置存储器进行安全校验时,能够提高安全校验结果的准确性。
如图6所示,本申请实施例提供了一种片上系统SOC,其具体介绍见后文详述。
如图7所示,本申请实施例提供了一种终端,包括如图6所示的片上系统SOC和与该SOC耦合的外置存储器,其具体介绍见后文详述。
如图4所示,为了更清楚的说明本申请实施例图1至图3任意实施例提供的方法,结合图7所示的终端以及实际应用场景,本申请实施例还提供了一种移动支付方法,包括:
401:SE接收交易请求,上电启动,执行ROM内存储的程序以加载位于外置存储器的RPMB区的数据。
其中,本步骤所指的RPMB区的数据包括移动支付的操作系统、移动支付的应用软件、第一校验值等。本步骤的具体实现过程可参考现有技术,本申请实施例不再赘述。
402:SE从支付平台服务器获取第二校验值。
可选的,SE将从支付平台服务器获取的第二校验值存储在SOC本地存储器中,如SOC中的易失性存储器中,如RAM中。这相当于是一个临时存储的过程。
403:SE对获取的RPMB区的数据进行校验鉴权和解密。
RPMB区采用了鉴权和加密技术,因此,SE需要对获取的RPMB区的数据进行解密等操作。本步骤的具体实现过程可参考现有技术,本申请实施例不再赘述。
404:SE根据从RPMB区获取的第一校验值和从支付平台服务器获取的第二校验值对外置存储器进行安全性验证。
该步骤的具体实现过程,可参考前文所述,本申请实施例不再赘述。
405:在外置存储器通过安全性验证的情况下,SE将RPMB区的数据存储到内部存储器中,SE启动完成,可进行正常操作和交易。
406:SE从所述RPMB区获取第一交易数据,并基于所述第一交易数据对所述交易请求进行处理。
407:SE在处理完交易请求后生成第二交易数据。
408:SE同步地更新第一校验值和第二校验值。
409:SE将更新后的第一校验值和第二交易数据发送至所述外置存储器,并本地存储更新后的第二校验值。
410:外置存储器将更新后的第一校验值和第二交易数据存储至RPMB区。
如图5所示,在执行图4所示的步骤406至步骤409的具体实现过程具体包括:SE加载了移动支付应用软件,当需要将交易过程中的数据存入外置存储器时,移动支付应用软件对交易中的数据进行加密后得到密文数据,其中,正如图5中加粗部分所示,除了将交易过程中的数据进行加密得到密文数据外,还需要将第一校验值进行加密,得到密文数据,然后在终端提供的可信执行环境中对数据分包,再由通用操作系统软件,也就是终端所采用的操作系统,如安卓操作系统软件,将分包后的数据按照RPMB协议的要求封装成RPMB格式的数据后写入外置存储器的RPMB区。同时,还要将第二校验值存入SOC本地存储器中并在SE下电前存入支付平台服务器中。
需要说明的是,SE在将数据存入支付平台服务器的具体实现中,包含了SE与支付平台服务器之间建立通道,并将数据封装成特定格式的数据存入移动平台服务器等过程。该过程可参考现有技术,本申请实施例不再赘述。
还需要说明的是,这里所指的将第二校验值存入SE内部存储器中为一个临时存储的过程,因此该SE内部的存储器可以为易失性存储器,如RAM或静态随机存取存储器(Static Random Access Memory,SRAM)。当交易完成,SE需下电以降低功耗时,SE需要连接网络,将其内保存的更新后的第二校验值上传到支付平台服务器;之后,SE进入下电状态,SE内存储器保存的信息自动被清除。
如图6所示,本申请实施例提供一种片上系统SOC500,用于执行图1至图5任一实施例所述的方法,所述片上系统SOC包括集成在所述SOC中的安全元件SE51、第一总线52、处理器53、存储器54。
其中,存储器54位于SOC内但不位于SE中,可以为非易失性只读内存(Read-Only Memory,ROM)、易失性随机存取存储器(Random Access Memory,RAM)或电可擦可编程只读存储器(Electrically Erasable Programmable Read-Only Memory,EEPROM)。
所述SE包括安全处理器501、第二总线502以及通过第二总线502与安全处理器501耦合连接的内置存储器503。内置存储器503具体包括ROM、RAM、静态随机存取存储器(Static Random Access Memory,SRAM)、一次性可编程存储器(One Time Programmable,OTP)等。
SOC内还设置有通信通道,用于SE与SOC内的其他模块通过所述通信信道互相通信。SOC通过第一总线52与外置存储器耦合连接。SE通过所述通信通道和第一总线与外置存储器互相通信。
需要说明的是,虽然图6未示出,但片上系统500还包括通信模块、图 形和图像处理模块、语音处理模块等。
还需要说明的是,虽然图6未示出,但SE还包括真随机数发生器(True Random Number Generator,TRNG)、加解密模块等模块。
其中,所述安全处理器501,用于接收交易请求;并从所述SOC的外置存储器获取第一校验值。
所述安全处理器501,还用于根据所述第一校验值以及所述SOC中的存储器存储的第二校验值对所述外置存储器进行安全校验;在所述外置存储器通过安全校验的情况下,从所述外置存储器获取第一交易数据,并基于所述第一交易数据对所述交易请求进行处理。
进一步的,所述安全处理器501,还用于在处理完所述交易请求后生成第二交易数据;同步地更新所述第一校验值和所述第二校验值;并将更新后的第一校验值和所述第二交易数据发送至所述外置存储器;所述安全处理器,还用于将所述第二校验值本地存储至所述SOC中的存储器。
可选的,所述安全处理器501,具体用于分别将所述第一校验值和所述第二校验值的取值加n,得到所述更新后的第一校验值以及所述更新后的第二校验值,所述n为大于等于1的自然数。
可选的,所述安全处理器501,具体用于分别将所述第一校验值和所述第二校验值的取值乘以k,得到所述更新后的第一校验值以及所述更新后的第二校验值,所述k为大于等于1的自然数。
可选的,所述安全处理器501,具体用于比较所述第一校验值与所述第二校验值;当所述第一校验值大于或等于所述第二校验值时,确定所述外置存储器通过安全校验;否则,确定所述外置存储器未通过安全校验。
进一步的,所述安全处理器501,还用于在所述SE上电启动时从支付平台服务器获取所述第二校验值并本地存储至所述SOC中的存储器;在所述SE下电时将所述SOC本地存储的所述更新后的第二校验值发送至所述支付平台服务器。
可选的,用于存储所述第二校验值的所述SOC中的存储器为位于所述SE中的内置存储器,如SE中的RAM或OTP中,或者位于所述SOC中的其他存储器。
具体的,由于OTP的每个比特单元代表1个值,且每个比特单元是一次可烧写器件,因此,可通过烧写比特单元来修改第二校验值,例如:多烧写1个比特单元代表第二校验值的取值加1。
进一步的,所述安全处理器,还用于在所述外置存储器没有通过安全校验的情况下,拒绝处理所述交易请求以终止交易。
本申请实施例提供的片上系统,该片上系统集成设置SE,SE接收交易请求后,分别获取本地存储的校验值和外置存储器中存储的校验值,并根据这两个校验值对外置存储器进行安全校验,在外置存储器通过安全校验的情况下才处理该交易请求。因此,与现有技术相比,本申请中增加了对外置存储器进行安全校验的校验过程,能够避免由于外置存储器被整体替换带来的外 置存储器中的数据被更改带来的安全隐患,提高移动支付的安全性。
需要说明的是,本申请实施例所指的所有处理器(包括处理器53和安全处理器501)均可以是一个处理器,也可以是多个处理元件的统称。例如,该处理器可以是中央处理器(Central Processing Unit,简称CPU),也可以是特定集成电路(Application Specific Integrated Circuit,简称ASIC),或者是被配置成实施本申请实施例的一个或多个集成电路,例如:一个或多个微处理器(digital signal processor,简称DSP),或,一个或者多个现场可编程门阵列(Field Programmable Gate Array,简称FPGA)。
本申请实施例所指的存储器(存储器54)可以是一个存储装置,也可以是多个存储元件的统称,且用于存储可执行程序代码等。且存储器可以包括随机存储器(RAM),也可以包括非易失性存储器(non-volatile memory),例如磁盘存储器,闪存(Flash)等。
总线(包括第一总线52和第二总线502)可以是工业标准体系结构(Industry Standard Architecture,ISA)总线、外部设备互连(Peripheral Component,PCI)总线或扩展工业标准体系结构(Extended Industry Standard Architecture,EISA)总线等。总线可以分为地址总线、数据总线、控制总线等。为便于表示,图中仅用一条线表示,但并不表示仅有一根总线或一种类型的总线。
如图7所示,本申请实施例提供一种终端,包括:如图6所述的片上系统SOC500,以及耦合至所述SOC的外置存储器600。
其中,外置存储器600包括普通存储区和RPMB区,其中,普通存储区用于存储图片、视频等对安全性要求较低的数据;RPMB区采用了鉴权加密技术,安全性较高,一般用于存储对安全性要求较高的重要数据。
可选的,本申请实施例提供的终端还包括NFC模块。
SOC500和外置存储器600的具体交互流程可参考图1至图5任意实施例所述的方法。
本申请实施例提供的终端,SE接收交易请求后,分别获取本地存储的校验值和外置存储器中存储的校验值,并根据这两个校验值对外置存储器进行安全校验,在外置存储器通过安全校验的情况下才处理该交易请求。因此,与现有技术相比,本申请中增加了对外置存储器进行安全校验的校验过程,能够避免由于外置存储器被整体替换带来的外置存储器中的数据被更改带来的安全隐患,提高移动支付的安全性。
通过以上的实施方式的描述,所属领域的技术人员可以清楚地了解到本申请可借助软件加必需的通用硬件的方式来实现,当然也可以通过硬件,但很多情况下前者是更佳的实施方式。基于这样的理解,本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来,该计算机软件产品存储在可读取的存储介质中,如计算机的软盘,硬盘或光盘等,包括若干指令用以使得一台计算机设备(可以是个人计算机,服务器,或者网络设备等)执行本申请各个实施例所述的方法。
以上所述,仅为本申请的具体实施方式,但本申请的保护范围并不局限于此,任何熟悉本技术领域的技术人员在本申请揭露的技术范围内,可轻易想到变化或替换,都应涵盖在本申请的保护范围之内。

Claims (16)

  1. 一种移动支付方法,应用于片上系统SOC,其特征在于,所述SOC包括集成在所述SOC中的安全元件SE,所述方法包括:
    所述SE接收交易请求;
    所述SE从所述SOC的外置存储器获取第一校验值;并根据所述第一校验值以及所述SOC本地存储的第二校验值对所述外置存储器进行安全校验;
    在所述外置存储器通过安全校验的情况下,所述SE从所述外置存储器获取第一交易数据,并基于所述第一交易数据对所述交易请求进行处理。
  2. 根据权利要求1所述的方法,其特征在于,所述方法还包括:
    所述SE在处理完所述交易请求后生成第二交易数据;
    所述SE同步地更新所述第一校验值和所述第二校验值;
    所述SE将更新后的第一校验值和所述第二交易数据发送至所述外置存储器,以及在SOC中本地存储更新后的第二校验值。
  3. 根据权利要求2所述的方法,其特征在于,所述SE同步地更新所述第一校验值和所述第二校验值,包括:
    所述SE分别将所述第一校验值和所述第二校验值的取值加n,得到所述更新后的第一校验值以及所述更新后的第二校验值,所述n为大于等于1的自然数。
  4. 根据权利要求2所述的方法,其特征在于,所述SE同步地更新所述第一校验值和所述第二校验值,包括:
    所述SE分别将所述第一校验值和所述第二校验值的取值乘以k,得到所述更新后的第一校验值以及所述更新后的第二校验值,所述k为大于等于1的自然数。
  5. 根据权利要求3或4所述的方法,其特征在于,所述根据所述第一校验值以及所述SOC本地存储的第二校验值对所述外置存储器进行安全校验,包括:
    所述SE比较所述第一校验值与所述第二校验值;
    如果所述第一校验值大于或等于所述第二校验值,则所述SE确定所述外置存储器通过安全校验;否则,所述SE确定所述外置存储器未通过安全校验。
  6. 根据权利要求2所述的方法,其特征在于,所述方法还包括:
    所述SE,在上电启动时从支付平台服务器获取所述第二校验值并在SOC中本地存储;
    所述SE,在下电时将存储的所述更新后的第二校验值发送至所述支付平台服务器。
  7. 根据权利要求1所述的方法,其特征在于,所述方法还包括:
    在所述外置存储器没有通过安全校验的情况下,所述SE拒绝处理所述交易请求以终止交易。
  8. 一种片上系统,其特征在于,所述片上系统SOC包括集成在所述SOC中的安全元件SE;所述SE包括安全处理器以及耦合到所述安全处理器的内置 存储器;
    其中,所述安全处理器,用于接收交易请求;并从所述SOC的外置存储器获取第一校验值;
    所述安全处理器,还用于根据所述第一校验值以及所述SOC中的存储器存储的第二校验值对所述外置存储器进行安全校验;在所述外置存储器通过安全校验的情况下,从所述外置存储器获取第一交易数据,并基于所述第一交易数据对所述交易请求进行处理。
  9. 根据权利要求8所述的片上系统,其特征在于,
    所述安全处理器,还用于在处理完所述交易请求后生成第二交易数据;同步地更新所述第一校验值和所述第二校验值;并将更新后的第一校验值和所述第二交易数据发送至所述外置存储器;
    所述安全处理器,还用于将所述第二校验值本地存储至所述SOC中的存储器。
  10. 根据权利要求9所述的片上系统,其特征在于,
    所述安全处理器,具体用于分别将所述第一校验值和所述第二校验值的取值加n,得到所述更新后的第一校验值以及所述更新后的第二校验值,所述n为大于等于1的自然数。
  11. 根据权利要求9所述的片上系统,其特征在于,
    所述安全处理器,具体用于分别将所述第一校验值和所述第二校验值的取值乘以k,得到所述更新后的第一校验值以及所述更新后的第二校验值,所述k为大于等于1的自然数。
  12. 根据权利要求10或11所述的片上系统,其特征在于,
    所述安全处理器,具体用于比较所述第一校验值与所述第二校验值;当所述第一校验值大于或等于所述第二校验值时,确定所述外置存储器通过安全校验;否则,确定所述外置存储器未通过安全校验。
  13. 根据权利要求9所述的片上系统,其特征在于,
    所述安全处理器,还用于在所述SE上电启动时从支付平台服务器获取所述第二校验值并本地存储至所述SOC中的存储器;在所述SE下电时将所述SOC本地存储的所述更新后的第二校验值发送至所述支付平台服务器。
  14. 根据权利要求8或9所述的片上系统,其特征在于,用于存储所述第二校验值的所述SOC中的存储器为位于所述SE中的内置存储器。
  15. 根据权利要求8或9所述的片上系统,其特征在于,
    所述安全处理器,还用于在所述外置存储器没有通过安全校验的情况下,拒绝处理所述交易请求以终止交易。
  16. 一种终端,其特征在于,包括:如权利要求8至15任一项所述的片上系统SOC,以及耦合至所述SOC的外置存储器。
PCT/CN2017/075029 2016-06-30 2017-02-27 移动支付方法、片上系统及终端 WO2018000843A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP17818842.1A EP3471042A4 (en) 2016-06-30 2017-02-27 MOBILE PAYMENT METHOD, SYSTEM ON CHIP AND TERMINAL
US16/235,270 US20190139026A1 (en) 2016-06-30 2018-12-28 Mobile payment method, system on chip, and terminal

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610513966.4 2016-06-30
CN201610513966.4A CN106127483A (zh) 2016-06-30 2016-06-30 移动支付方法、片上系统及终端

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/235,270 Continuation US20190139026A1 (en) 2016-06-30 2018-12-28 Mobile payment method, system on chip, and terminal

Publications (1)

Publication Number Publication Date
WO2018000843A1 true WO2018000843A1 (zh) 2018-01-04

Family

ID=57468857

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/075029 WO2018000843A1 (zh) 2016-06-30 2017-02-27 移动支付方法、片上系统及终端

Country Status (4)

Country Link
US (1) US20190139026A1 (zh)
EP (1) EP3471042A4 (zh)
CN (1) CN106127483A (zh)
WO (1) WO2018000843A1 (zh)

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106127483A (zh) * 2016-06-30 2016-11-16 华为技术有限公司 移动支付方法、片上系统及终端
CN109150534B (zh) * 2017-06-19 2021-10-01 华为技术有限公司 终端设备及数据处理方法
CN107360165B (zh) * 2017-07-13 2021-02-12 北京元心科技有限公司 终端设备、云服务器以及管控操作系统的方法及装置
EP3690836A4 (en) * 2017-10-16 2020-10-14 Huawei Technologies Co., Ltd. SAFETY ELEMENT AND ASSOCIATED DEVICE
WO2019210490A1 (zh) * 2018-05-03 2019-11-07 华为技术有限公司 数据处理的方法、装置和系统芯片
WO2021087956A1 (zh) * 2019-11-08 2021-05-14 华为技术有限公司 数据处理的方法、装置和系统芯片

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104778794A (zh) * 2015-04-24 2015-07-15 华为技术有限公司 移动支付装置和方法
CN105190661A (zh) * 2013-03-15 2015-12-23 三星电子株式会社 使用媒体绑定的安全移动支付
US20160028725A1 (en) * 2014-07-25 2016-01-28 Qualcomm Incorporated Integrated circuit for determining whether data stored in external nonvolative memory is valid
CN106127483A (zh) * 2016-06-30 2016-11-16 华为技术有限公司 移动支付方法、片上系统及终端

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140020114A1 (en) * 2012-07-13 2014-01-16 Qualcomm Incorporated Methods and apparatuses for integrating a portion of secure element components on a system on chip
US9418254B2 (en) * 2013-02-01 2016-08-16 Mxtran Inc. Integrated circuit film and method for manipulating the same
US20160253651A1 (en) * 2015-02-27 2016-09-01 Samsung Electronics Co., Ltd. Electronic device including electronic payment system and operating method thereof

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105190661A (zh) * 2013-03-15 2015-12-23 三星电子株式会社 使用媒体绑定的安全移动支付
US20160028725A1 (en) * 2014-07-25 2016-01-28 Qualcomm Incorporated Integrated circuit for determining whether data stored in external nonvolative memory is valid
CN104778794A (zh) * 2015-04-24 2015-07-15 华为技术有限公司 移动支付装置和方法
CN106127483A (zh) * 2016-06-30 2016-11-16 华为技术有限公司 移动支付方法、片上系统及终端

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3471042A4 *

Also Published As

Publication number Publication date
EP3471042A1 (en) 2019-04-17
US20190139026A1 (en) 2019-05-09
CN106127483A (zh) 2016-11-16
EP3471042A4 (en) 2019-04-17

Similar Documents

Publication Publication Date Title
WO2018000843A1 (zh) 移动支付方法、片上系统及终端
EP3602388B1 (en) Blockchain node communication method and apparatus
US20190172047A1 (en) System on chip and processing device
US10055578B1 (en) Secure software containers
US9311506B1 (en) Storing and transmitting sensitive data
US9742568B2 (en) Trusted support processor authentication of host BIOS/UEFI
US8769295B2 (en) Computing system feature activation mechanism
US9867043B2 (en) Secure device service enrollment
US9755831B2 (en) Key extraction during secure boot
CN108476404A (zh) 安全设备配对
KR101654778B1 (ko) 하드웨어 강제 액세스 보호
US20200342091A1 (en) Authentication and control of encryption keys
US11893118B2 (en) Transfer of ownership of a computing device via a security processor
US10936722B2 (en) Binding of TPM and root device
CN112149144A (zh) 聚合密码引擎
US20190306155A1 (en) Generating cryptographic keys using supplemental authentication data
US10019577B2 (en) Hardware hardened advanced threat protection
CN115943610A (zh) 安全签署配置设置
US20240211601A1 (en) Firmware policy enforcement via a security processor
US8549312B2 (en) Mobile terminal and method for protecting its system data
US20210243030A1 (en) Systems And Methods To Cryptographically Verify An Identity Of An Information Handling System
US11671422B1 (en) Systems and methods for securing authentication procedures
US11526339B1 (en) Systems and methods for improving application installation
TWI709873B (zh) 以電子鑰匙安全管理電子裝置的方法及系統
WO2018017019A1 (en) Personal security device and method

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17818842

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2017818842

Country of ref document: EP

Effective date: 20190108