WO2018214649A1 - 一种生成ic卡安全数据的方法及装置 - Google Patents

一种生成ic卡安全数据的方法及装置 Download PDF

Info

Publication number
WO2018214649A1
WO2018214649A1 PCT/CN2018/081751 CN2018081751W WO2018214649A1 WO 2018214649 A1 WO2018214649 A1 WO 2018214649A1 CN 2018081751 W CN2018081751 W CN 2018081751W WO 2018214649 A1 WO2018214649 A1 WO 2018214649A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
security
security data
types
generated
Prior art date
Application number
PCT/CN2018/081751
Other languages
English (en)
French (fr)
Inventor
许先文
冀乃庚
傅宜生
田丰
Original Assignee
中国银联股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中国银联股份有限公司 filed Critical 中国银联股份有限公司
Publication of WO2018214649A1 publication Critical patent/WO2018214649A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3829—Payment protocols; Details thereof insuring higher security of transaction involving key management
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/322—Aspects of commerce using mobile devices [M-devices]
    • G06Q20/3226—Use of secure elements separate from M-devices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3821—Electronic credentials
    • G06Q20/38215—Use of certificates or encrypted proofs of transaction rights

Definitions

  • the present invention relates to the field of Internet technologies, and in particular, to a method and an apparatus for generating IC card security data.
  • the generation of the existing IC card security data is mainly applied in the scenario where the bank issues a physical bank IC card. After receiving the application for the IC card, the bank generates security data according to the user's personal information data according to the IC card design specification, and stores it in the IC card storage area in the process of card production and personalization. It can be seen that in the card issuing mode, the generation of the IC card security data has a process of preparing the card data, and the generation efficiency is low.
  • the application requirements of users are often intensive and high-concurrency, and it is hoped that the application and delivery of the card application can be realized in real time and quickly. Therefore, the method for generating the security data of the traditional IC card is generated. Because there is a process of generating the data of the preparation card, the generation efficiency of the security data is low, and the intensive card application requirement in the Internet environment cannot be met, and the real-time card issuance for the user, and thus the user experience is poor.
  • the present invention provides a method and apparatus for generating IC card security data, which are used to solve the technical problem of low efficiency of generating IC card security data in the prior art.
  • a method for generating IC card security data according to Embodiment 1 of the present invention includes: a first device receiving an IC card security data generation request; and the IC card security data generation request including a security data to be generated N data types; wherein N is an integer greater than or equal to 1; for any one of the N data types, the first device is required to generate security data according to any of the data types Consumption, generating the security data for any of the data types using a generation path that matches the performance consumption required to generate the security data for any of the data types.
  • the generating, by the first device, the security data of any one of the data types includes: if the first device determines that a performance consumption required to generate the security data of the any data type is greater than or equal to a performance consumption threshold, Then, the security data of any of the data types is obtained from the security data pre-generated and stored in the second device.
  • the generating, by the first device, the security data of any one of the data types further comprising: if the first device determines that a performance consumption required to generate the security data of the any data type is less than a performance consumption threshold,
  • the security data of any of the data types is generated by local computing or by calling an encryption machine.
  • the generating, by the local device, the security data of the any data type by using the local computing if the first device determines that the security level of the security data of the any data type is less than a security level threshold, Generating the security data of any of the data types by the low security level calculation module, and performing encryption by the high security level calculation module; if the first device determines that the security level of the first security data is greater than or equal to the security level threshold, The security data of any of the data types is generated and encrypted by the high security level calculation module.
  • the method further includes: if the first device determines that the security level of the security data of the any data type is greater than or equal to a security level threshold, The security data of the any data type is stored by the security protection encryption module; if it is determined that the security level of the security data of the any data type is less than the security level threshold, storing the data type by using the non-security protection encryption module Safety data.
  • the second embodiment of the present invention provides an apparatus for generating IC card security data, including: a receiving module, configured to receive an IC card security data generation request; and the IC card security data generation request includes a security to be generated N data types of data; wherein N is an integer greater than or equal to 1; a generating module, configured to be used according to any one of the N data types, according to the security data of generating any of the data types
  • the performance consumption, the generation of the security data of any of the data types is generated using a generation path that matches the performance consumption required to generate the security data for any of the data types.
  • the generating module is specifically configured to: if it is determined that a performance consumption required to generate the security data of the any data type is greater than or equal to a performance consumption threshold, obtain the security data pre-generated and stored in the second device. Security data for any of the data types described.
  • the generating module is further configured to: if it is determined that the performance consumption required to generate the security data of the any data type is less than a performance consumption threshold, generate the any data type by using a local computing or calling an encryption machine. Safety data.
  • the generating module is further configured to: if the security level of the security data of the any data type is determined to be less than a security level threshold, generate the security data of the any data type by using a low security level calculation module, Encryption is performed by the high security level calculation module. If the security level of the first security data is greater than or equal to the security level threshold, the security data of any of the data types is generated and encrypted by the high security level calculation module.
  • the generating module is further configured to: if it is determined that the security level of the security data of the any data type is greater than or equal to the security level threshold, storing the security data of the any data type by using a security protection encryption module; If it is determined that the security level of the security data of any of the data types is less than the security level threshold, the security data of the any data type is stored by the non-security protection encryption module.
  • a third embodiment of the present invention provides a computing device, including a transceiver, a memory, and a processor; wherein:
  • a transceiver configured to receive an IC card security data generation request; the IC card security data generation request includes N data types of security data to be generated; wherein N is an integer greater than or equal to 1;
  • a memory for storing program instructions
  • a processor configured to invoke a program instruction stored in the memory, and execute the following method according to the obtained program: for any one of the N data types, according to the security data for generating the any data type
  • the required performance consumption the generation of the security data of any of the data types is generated using a generation path that matches the performance consumption required to generate the security data for any of the data types.
  • the processor is specifically configured to: if it is determined that a performance consumption required to generate the security data of the any data type is greater than or equal to a performance consumption threshold, the security data pre-generated and stored in the second device is used. Get security data for any of the data types described.
  • the processor is specifically configured to: if it is determined that the performance consumption required to generate the security data of any one of the data types is less than a performance consumption threshold, generate any one of the data types by using local computing or calling an encryption machine. Safety data.
  • the processor is configured to: if it is determined that the security level of the security data of the any data type is less than a security level threshold, generate the security data of the any data type by using a low security level calculation module, Encryption is performed by the high security level calculation module. If the security level of the first security data is greater than or equal to the security level threshold, the security data of any of the data types is generated and encrypted by the high security level calculation module.
  • the processor is configured to: if it is determined that the security level of the security data of the any data type is greater than or equal to the security level threshold, storing the security data of the any data type by using a security protection encryption module; If it is determined that the security level of the security data of any of the data types is less than the security level threshold, the security data of any of the data types is stored by the non-secure protection encryption module.
  • the fourth embodiment of the present invention provides a computer readable storage medium, configured to store computer program instructions used by the computing device, and configured to execute the foregoing generated IC card security data. The method of the program.
  • an embodiment of the present application provides a computer program product, where the computer program product includes a calculation program stored on a non-transitory computer readable storage medium, the computer program includes program instructions, when the program instruction is The computer, when executed, causes the computer to perform the method of the first aspect or any possible implementation of the first aspect.
  • the first device receives an IC card security data generation request, where the IC card security data generation request is used to request the first device to generate N data type security data; and is applicable to any one of N data types.
  • the data type the first device may generate a security data of the data type by using a generation path that matches the performance consumption required to generate the data type. Since the first device can select a matching generation path for the generation of the data type according to the performance consumption required to generate the security data of any data type, the efficiency of generating the IC card security data can be effectively improved.
  • FIG. 1 is a schematic flowchart of a method for generating security data of an IC card according to Embodiment 1 of the present invention
  • FIG. 2 is a schematic structural diagram of a unified interface module according to Embodiment 1 of the present invention.
  • FIG. 3 is a schematic structural diagram of a second device according to Embodiment 1 of the present invention.
  • FIG. 4 is a schematic structural diagram of an apparatus for generating IC card security data according to Embodiment 2 of the present invention.
  • FIG. 5 is a schematic structural diagram of a computing device according to Embodiment 3 of the present invention.
  • FIG. 6 is a schematic structural diagram of a computing device according to Embodiment 4 of the present invention.
  • the first device is specifically configured to generate security data for a virtual IC card issued by each card issuer or card application provider in a real-time online card issuing system for issuing cards in the air.
  • It can be various types of computing devices, for example, high-performance computers, various types of encryption machines, and the like, which are not limited herein.
  • FIG. 1 is a schematic flowchart of a method for generating security data of an IC card according to Embodiment 1 of the present invention. As shown in FIG. 1 , the method includes the following steps S101 to S102:
  • Step S101 The first device receives the IC card security data generation request; the IC card security data generation request includes N types of data of the security data to be generated; wherein N is an integer greater than or equal to 1;
  • Step S102 For any data type of the N data types, the first device adopts and generates the data type according to the performance consumption required to generate the security data of any of the data types.
  • the performance required for the security data consumes a matching generation path, generating security data for any of the data types described.
  • the first device receives an IC card security data generation request, where the IC card security data generation request is used to request the first device to generate N data type security data; and is applicable to any one of N data types.
  • the data type the first device may generate a security data of the data type by using a generation path that matches the performance consumption required to generate the data type. Since the first device can select a matching generation path for the generation of the data type according to the performance consumption required to generate the security data of any data type, the efficiency of generating the IC card security data can be effectively improved.
  • the first device receives an IC card security data generation request, and the IC card security data generation request is used to generate security data that meets a certain service requirement to the first device.
  • the security data that meets certain service requirements may include security data of N data types, and N is an integer greater than or equal to 1.
  • the security data of the N data types may specifically include personal information, card information, financial transaction data, a signature certificate, a data protection security key, a communication encryption key, a consumption key, etc., or Other types of IC card security data are included, and no specific restrictions are made here.
  • the first device may receive an IC card security data generation request from multiple service demanders.
  • the application scenarios of the virtual IC cards issued by them are different, or because the pre-processing of the initial data is different, the request generated by the IC card generation request sent by different service demanders is generated.
  • the security data is also different, that is, the security data of the N data types requested by different service demanders is different.
  • the first device can receive the IC card security data generation request sent by each service demander through a unified interface module, and is used to provide a complete service for generating security data for each service demander.
  • the unified interface module 200 may specifically include a basic service interface 201 and multiple personalized service interfaces (2021 as shown in the figure). , 2022, 2023, 2024).
  • the basic service interface is used for uniformly receiving the IC card security data generation request sent by each service demand side, and the plurality of personalized service interfaces inherited from the basic service interface are respectively used to receive the security data generation request after passing through the basic service interface.
  • Security data generation requests from different service demanders that is, when a security data generation request from a service demander arrives at a personalized service interface, it can secure the N types of data requested according to its corresponding service requirements.
  • Data is personalized for initial processing, including data inspection and response.
  • the design of the unified interface module through the combination of the basic service interface and the plurality of personalized service interfaces not only ensures the simplicity of the externally released interface, but also simplifies the call implementation of each service demand side, so that different The isolation of business interfaces between business demanders can achieve efficient and timely data inspection and response to different security data generation requests.
  • the first device may further re-split the IC card security data generation request sent by each service requester according to the data type of the security data to be generated. As shown in FIG. 2, the first device performs splitting of the secure data generation request by the split module 203. After receiving the IC card security data generation request, the first device may further split the IC card security data generation request into two sub-requests according to the security level and the performance consumption, and each sub-request corresponds to one Data type security data.
  • the IC card security data generation request is divided into N sub-requests, so that the first device can specifically generate the security data requested in the sub-request for each security data. Choose the appropriate build path.
  • the first device may generate the sub-request by parsing the security data for any one of the N data types. Generating the security of any of the data types based on the performance cost required to generate the security data of any of the data types, using a generation path that matches the performance consumption required to generate the security data for any of the data types data.
  • the security data of the any data type is generated by local calculation, or the encryption machine is invoked to perform real-time Response calculation.
  • the first device may determine the security level of the security data of the any data type, and determine the security of the security data of any of the data types. If the level is lower than the security level threshold, the security data of any of the data types can be generated by the local low security level calculation module, and encrypted and protected by the high security level calculation module.
  • the security data of any of the data types may be generated by the local high security level calculation module.
  • the security data with higher security level may generally include the application data of the IC card and the protection key of the key, such as security certificates of various security certificates, communication keys or other application data, and transactions.
  • a one-time consumption key and its corresponding protection key may be generated by the local high security level calculation module.
  • the performance consumption threshold and the security level threshold may be set by a person skilled in the art according to actual conditions, and the present invention does not specifically limit this.
  • security data that often includes some data types requires a lot of calculations to generate, for example, personalized security certificates. Therefore, if the security data of these data types are calculated locally, a large amount of computing resources are consumed, so that the generation efficiency of the security data is lowered.
  • the second device may be invoked to generate the security data of any of the data types.
  • the second device is specifically a dedicated computing resource specially configured to generate security data with high performance consumption or high intensive computing type, which may be a high performance computer, an HSM encryption machine, or other types of computing devices.
  • high performance consumption or high intensive computing type which may be a high performance computer, an HSM encryption machine, or other types of computing devices.
  • the invention does not specifically limit this.
  • FIG. 3 is a schematic structural diagram of a second device according to Embodiment 1 of the present invention.
  • the second device includes a data service interface, a data generation module, and a data cache module.
  • the data service interface is configured to receive a generation sub-request of the security data of a certain data type sent by the first device, that is, a generation sub-request of the high-density computing-type security data.
  • the security data generated by the second device is usually a security data common to each user. Therefore, the data generation module in the second device can generate various data types according to the system status of the second device.
  • the preset time required for the security data, the HSM encryption device is continuously called to generate high-density computing security data such as personalized certificate data, and then the generated security data is encrypted and stored in the persistent device through the data protection and encryption module. in.
  • the data cache module may acquire the security data pre-generated by the data generation module from the persistent device by means of bulk loading, and provide data services. That is, when the first device invokes the second device to generate security data of a certain data type, the security data generation sub-request preferentially enters the data cache service through the data service interface, and acquires the pre-generated security data from the data cache service.
  • the data cache module also has the function of monitoring the cache data.
  • the data cache module can automatically load the security data from the persistent device.
  • the first The second device can calculate the generated security data in real time through the data generation module.
  • the second device continuously generates and stores the security data through the data generation module, and the data cache module.
  • the mechanism of dynamically acquiring secure data from a persistent device can effectively utilize the idle time of the encryption device, and convert high-concurrency data generation into a persistent and uniform generation process of secure data. Therefore, it can break through the traditional card-issuing mode.
  • the performance bottleneck of the security data generation enables the real-time online card issuance system to cope with the centralized and high-concurrency card issuance requirements in the Internet environment.
  • the first device may further include a security protection encryption module. After the first device calculates and generates the security data by using the local computing or calling the second device, the first device secures, encrypts, and stores the generated security data of different security levels through an independent security protection encryption module.
  • the security data of the any data type is stored by the security protection encryption module.
  • the security data of any of the data types is stored by the non-secure protection encryption module.
  • security data such as the security certificate authority root key, industry level certificate, and user private key certificate can be stored in the security protection encryption module, and the communication encryption key, the consumption key, and the security protection.
  • the key under the key protection in the module can be stored in the non-security protection encryption module.
  • the security protection encryption module can also provide security protection for storage and transmission of the generated security data.
  • the key storage mechanism stored in different security devices can isolate the problem of key security penetration and security boundary spread from the physical level, and effectively support the splitting of the first device request for security data of different data types. And the selection of the generation path ensures the security of each stage of generation, storage and transmission.
  • FIG. 4 is a schematic structural diagram of an apparatus for generating IC card security data according to Embodiment 2 of the present invention, as shown in FIG. 4 .
  • the device includes:
  • the receiving module 401 is configured to receive an IC card security data generation request, where the IC card security data generation request includes N types of data of the security data to be generated;
  • a generating module 402 configured to generate, according to any one of the N data types, security data required to generate the security data of any one of the data types, and generate security data of any one of the data types The required performance consumes a matching generation path, generating security data for any of the data types described.
  • the generating module 402 is specifically configured to:
  • the security data of any of the data types is obtained from the security data pre-generated and stored in the second device.
  • the generating module 402 is further configured to:
  • the security data of any of the data types is generated by local computing or by calling an encryption machine.
  • the generating module 402 is further configured to:
  • the security data of the any data type is generated by the low security level calculation module, and is encrypted by the high security level calculation module;
  • the security data of any of the data types is generated and encrypted by the high security level calculation module.
  • the generating module 402 is further configured to:
  • the security data of any of the data types is stored by the non-secure protection encryption module.
  • the third embodiment of the present invention provides a computing device 500, which may be a desktop computer, a portable computer, a smart phone, a tablet computer, a personal digital assistant (PDA), or the like.
  • the computing device may include a Central Processing Unit (CPU), a memory, an input/output device, etc.
  • the input device may include a keyboard, a mouse, a touch screen, etc.
  • the output device may include a display device such as a liquid crystal. Display (Liquid Crystal Display, LCD), cathode ray tube (CRT), etc.
  • the memory can include read only memory (ROM) and random access memory (RAM) and provides the processor with program instructions and data stored in the memory.
  • ROM read only memory
  • RAM random access memory
  • the memory may be used to store a program for a method based on generating IC card security data.
  • the processor is configured to execute the program instruction stored in the memory, and the processor is configured to: execute the IC card security data generation request according to the obtained program instruction; the IC card security data generation request includes N data types of the security data to be generated; N is an integer greater than or equal to 1; for any of the N data types, according to the performance consumption required to generate the security data of any of the data types, adopting and generating any of the data types
  • the performance required for the security data consumes a matching generation path, generating security data for any of the data types described.
  • FIG. 6 is a schematic structural diagram of a computing device provided by the present application.
  • the computing device includes a transceiver 601, a processor 602, a memory 603, and a communication interface 604; wherein the transceiver 601, the processor 602, the memory 603, and the communication interface 604 are interconnected by a bus 605.
  • the memory 603 is used to store programs.
  • the program can include program code, the program code including computer operating instructions.
  • the memory 603 may be a volatile memory, such as a random-access memory (RAM), or a non-volatile memory, such as a flash memory.
  • RAM random-access memory
  • non-volatile memory such as a flash memory.
  • HDD hard disk drive
  • SSD solid-state drive
  • the memory 603 stores the following elements, executable modules or data structures, or a subset thereof, or an extended set thereof:
  • Operation instructions include various operation instructions for implementing various operations.
  • Operating system Includes a variety of system programs for implementing various basic services and handling hardware-based tasks.
  • the bus 605 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus.
  • PCI peripheral component interconnect
  • EISA extended industry standard architecture
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 6, but it does not mean that there is only one bus or one type of bus.
  • the communication interface 604 can be a wired communication access port, a wireless communication interface, or a combination thereof, wherein the wired communication interface can be, for example, an Ethernet interface.
  • the Ethernet interface can be an optical interface, an electrical interface, or a combination thereof.
  • the wireless communication interface can be a WLAN interface.
  • the processor 602 can be a central processing unit (CPU), a network processor (NP) or a combination of a CPU and an NP. It can also be a hardware chip.
  • the hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof.
  • the PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a general array logic (GAL) or any combination.
  • the transceiver 601 is configured to receive an IC card security data generation request, where the IC card security data generation request includes N data types of the security data to be generated, where N is an integer greater than or equal to 1;
  • the processor 602 is configured to invoke a program instruction stored in the memory 603, and execute the following method according to the obtained program: according to any one of the N data types, according to the security of generating any of the data types
  • the performance consumption required for the data is generated using the generation path that matches the performance consumption required to generate the security data for any of the data types, and the security data for any of the data types is generated.
  • the processor 602 is specifically configured to: if the performance cost required to generate the security data of the any data type is greater than or equal to the performance consumption threshold, the security data pre-generated and stored from the second device Get the security data of any of the data types described.
  • the processor 602 is specifically configured to: if it is determined that the performance consumption required to generate the security data of any one of the data types is less than a performance consumption threshold, generate the any data by using a local computing or calling an encryption machine. Type of security data.
  • the processor 602 is specifically configured to: if the security level of the security data of the any data type is determined to be less than a security level threshold, generate the security data of the any data type by using a low security level calculation module. And encrypting by the high security level calculation module; if it is determined that the security level of the first security data is greater than or equal to the security level threshold, the security data of any of the data types is generated and encrypted by the high security level calculation module.
  • the processor 602 is configured to: if the security level of the security data of the any data type is greater than or equal to a security level threshold, store the security data of any of the data types by using a security protection encryption module. If it is determined that the security level of the security data of any of the data types is less than the security level threshold, the security data of any of the data types is stored by the non-security protection encryption module.
  • Embodiment 4 of the present invention provides a computer storage medium for storing computer program instructions for use in the above computing device, comprising a program for executing the method for generating IC card security data.
  • the computer storage medium can be any available media or data storage device accessible by a computer, including but not limited to magnetic storage (eg, floppy disk, hard disk, magnetic tape, magneto-optical disk (MO), etc.), optical storage (eg, CD, DVD) , BD, HVD, etc.), and semiconductor memories (such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid state drive (SSD)).
  • magnetic storage eg, floppy disk, hard disk, magnetic tape, magneto-optical disk (MO), etc.
  • optical storage eg, CD, DVD
  • BD magneto-optical disk
  • HVD etc.
  • semiconductor memories such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid state drive (SSD)).
  • the first device receives an IC card security data generation request, where the IC card security data generation request is used to request the first device to generate N data type security data; Any one of the data types, the first device may generate a security data of the data type by using a generation path that matches the performance consumption required to generate the data type. Since the first device can select a matching generation path for the generation of the data type according to the performance consumption required to generate the security data of any data type, the efficiency of generating the IC card security data can be effectively improved.
  • embodiments of the present application can be provided as a method, system, or computer program product. Therefore, the embodiments of the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Moreover, embodiments of the present application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • Embodiments of the present application are described with reference to flowchart illustrations and/or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present application. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG.
  • These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Abstract

本发明涉及互联网技术领域，公开了一种生成IC卡安全数据的方法及装置，包括：第一设备接收IC卡安全数据生成请求，该IC卡安全数据生成请求用于请求第一设备生成N种数据类型的安全数据；针对于N种数据类型中的任一种数据类型，第一设备可采用与生成该数据类型所需的性能消耗相匹配的生成路径，生成该数据类型的安全数据。由于第一设备可根据生成任一数据类型的安全数据所需的性能消耗，为该任一数据类型的生成选择匹配的生成路径，因而，可有效地提高IC卡安全数据的生成效率。

Description

一种生成IC卡安全数据的方法及装置
本申请要求在2017年5月24日提交中华人民共和国知识产权局、申请号为201710374072.6，发明名称为“一种生成IC卡安全数据的方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及互联网技术领域，尤其涉及一种生成IC卡安全数据的方法及装置。
背景技术
随着信息技术的不断发展，IC卡在人们生活中的应用也越来越广泛。使用IC卡代替现金可以快速便捷地进行各种交易，从而方便人们的生活。但在使用IC卡进行交易时，需要在IC卡中预先存储有如个人化安全信息等安全数据。
现有的IC卡安全数据的生成主要应用在银行发行实体银行IC卡的场景中。银行接收用户申请IC卡的申请后，根据用户的个人信息数据，按照IC卡设计规范生成安全数据，并在卡片制作和个人化的过程中，存储到IC卡存储区域中。可见，在这种卡片发行方式下，IC卡安全数据的生成存在着一个准备卡数据的过程，生成效率较低。
然而，由于互联网消费场景的不断普及，传统的IC卡发行方式已经不能满足人们的需要。在互联网时代，各种卡片发行方可接入TSM平台，通过互联网发行虚拟IC卡。用户网上提交卡片申请后，卡片发行方将安全数据传输到用户的手机等智能终端中，即可实现虚拟IC卡的下发，即空中发卡。
在空中发卡的业务场景下，用户的申请需求往往是密集型和高并发式的，并且希望能够实现实时、快速地实现卡片申请的申请和下发，因而，传统的IC卡安全数据的生成方法，由于存在着一个准备卡数据的生成过程，使得安 全数据的生成效率较低，无法应对互联网环境下密集型的申卡需求，为用户实现实时发卡，因而，用户体验较差。
综上，目前亟需一种生成IC卡安全数据的方法，用于解决现有技术中IC卡安全数据的生成效率较低的技术问题。
发明内容
本发明提供一种生成IC卡安全数据的方法及装置，用于解决现有技术中IC卡安全数据的生成效率较低的技术问题。
第一方面，本发明实施例一提供的一种生成IC卡安全数据的方法，其包括：第一设备接收IC卡安全数据生成请求；所述IC卡安全数据生成请求包括待生成的安全数据的N种数据类型；其中，N为大于等于1的整数；针对于所述N种数据类型中的任一数据类型，所述第一设备根据生成所述任一数据类型的安全数据所需的性能消耗，采用与生成所述任一数据类型的安全数据所需的性能消耗相匹配的生成路径，生成所述任一数据类型的安全数据。
可选地，所述第一设备生成所述任一数据类型的安全数据，包括：所述第一设备若确定生成所述任一数据类型的安全数据所需的性能消耗大于等于性能消耗阈值，则从第二设备中预先生成并存储的安全数据中获取所述任一数据类型的安全数据。
可选地，所述第一设备生成所述任一数据类型的安全数据，还包括：所述第一设备若确定生成所述任一数据类型的安全数据所需的性能消耗小于性能消耗阈值，则通过本地计算或者调用加密机生成所述任一数据类型的安全数据。
可选地，所述第一设备通过本地计算生成所述任一数据类型的安全数据，包括：所述第一设备若确定所述任一数据类型的安全数据的安全级别小于安全级别阈值，则通过低安全级别计算模块生成所述任一数据类型的安全数据，并通过高安全级别计算模块进行加密；所述第一设备若确定所述第一安全数据的安全级别大于等于安全级别阈值，则通过所述高安全级别计算模块生成 并加密所述任一数据类型的安全数据。
可选地，所述第一设备生成所述任一数据类型的安全数据后，还包括：所述第一设备若确定所述任一数据类型的安全数据的安全级别大于等于安全级别阈值，则通过安全保护加密模块存储所述任一数据类型的安全数据；若确定所述任一数据类型的安全数据的安全级别小于安全级别阈值，则通过非安全保护加密模块存储所述任一数据类型的安全数据。
第二方面，本发明实施例二提供了一种生成IC卡安全数据的装置，其包括：接收模块，用于接收IC卡安全数据生成请求；所述IC卡安全数据生成请求包括待生成的安全数据的N种数据类型；其中，N为大于等于1的整数；生成模块，用于针对于所述N种数据类型中的任一数据类型，根据生成所述任一数据类型的安全数据所需的性能消耗，采用与生成所述任一数据类型的安全数据所需的性能消耗相匹配的生成路径，生成所述任一数据类型的安全数据。
可选地，所述生成模块具体用于：若确定生成所述任一数据类型的安全数据所需的性能消耗大于等于性能消耗阈值，则从第二设备中预先生成并存储的安全数据中获取所述任一数据类型的安全数据。
可选地，所述生成模块还具体用于：若确定生成所述任一数据类型的安全数据所需的性能消耗小于性能消耗阈值，则通过本地计算或者调用加密机生成所述任一数据类型的安全数据。
可选地，所述生成模块还具体用于：若确定所述任一数据类型的安全数据的安全级别小于安全级别阈值，则通过低安全级别计算模块生成所述任一数据类型的安全数据，并通过高安全级别计算模块进行加密；若确定所述第一安全数据的安全级别大于等于安全级别阈值，则通过所述高安全级别计算模块生成并加密所述任一数据类型的安全数据。
可选地，所述生成模块还用于：若确定所述任一数据类型的安全数据的安全级别大于等于安全级别阈值，则通过安全保护加密模块存储所述任一数据类型的安全数据；若确定所述任一数据类型的安全数据的安全级别小于安 全级别阈值，则通过非安全保护加密模块存储所述任一数据类型的安全数据。
第三方面，本发明实施例三提供了一种计算设备，包括收发器、存储器和处理器；其中：
收发器，用于接收IC卡安全数据生成请求；所述IC卡安全数据生成请求包括待生成的安全数据的N种数据类型；其中，N为大于等于1的整数；
存储器，用于存储程序指令；
处理器，用于调用所述存储器中存储的程序指令，按照获得的程序执行以下方法：针对于所述N种数据类型中的任一数据类型，根据生成所述任一数据类型的安全数据所需的性能消耗，采用与生成所述任一数据类型的安全数据所需的性能消耗相匹配的生成路径，生成所述任一数据类型的安全数据。
可选地，所述处理器，具体用于：若确定生成所述任一数据类型的安全数据所需的性能消耗大于等于性能消耗阈值，则从第二设备中预先生成并存储的安全数据中获取所述任一数据类型的安全数据。
可选地，所述处理器，具体用于：若确定生成所述任一数据类型的安全数据所需的性能消耗小于性能消耗阈值，则通过本地计算或者调用加密机生成所述任一数据类型的安全数据。
可选地，所述处理器，具体用于：若确定所述任一数据类型的安全数据的安全级别小于安全级别阈值，则通过低安全级别计算模块生成所述任一数据类型的安全数据，并通过高安全级别计算模块进行加密；若确定所述第一安全数据的安全级别大于等于安全级别阈值，则通过所述高安全级别计算模块生成并加密所述任一数据类型的安全数据。
可选地，所述处理器，具体用于：若确定所述任一数据类型的安全数据的安全级别大于等于安全级别阈值，则通过安全保护加密模块存储所述任一数据类型的安全数据；若确定所述任一数据类型的安全数据的安全级别小于安全级别阈值，则通过非安全保护加密模块存储所述任一数据类型的安全数据。
第四方面，本发明实施例四提供了一种计算机可读存储介质，所述计算 机可读存储介质用于储存为上述计算设备所用的计算机程序指令，其包含用于执行上述生成IC卡安全数据的方法的程序。
第五方面，本申请实施例提供一种计算机程序产品，所述计算机程序产品包括存储在非暂态计算机可读存储介质上的计算程序，所述计算机程序包括程序指令，当所述程序指令被计算机执行时，使所述计算机执行第一方面或第一方面的任意可能的实现方式中的方法。
本发明实施例中，第一设备接收IC卡安全数据生成请求，该IC卡安全数据生成请求用于请求第一设备生成N种数据类型的安全数据；针对于N种数据类型中的任一种数据类型，第一设备可采用与生成该数据类型所需的性能消耗相匹配的生成路径，生成该数据类型的安全数据。由于第一设备可根据生成任一数据类型的安全数据所需的性能消耗，为该任一数据类型的生成选择匹配的生成路径，因而，可有效地提高IC卡安全数据的生成效率。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简要介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域的普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为本发明实施例一中的一种生成IC卡安全数据的方法所对应的流程示意图；
图2为本发明实施例一中统一接口模块的结构示意图；
图3为本发明实施例一中第二设备的结构示意图；
图4为本发明实施例二中的一种生成IC卡安全数据的装置的结构示意图；
图5为本发明实施例三中提供的一种计算设备的结构示意图；
图6为本发明实施例四中提供的一种计算设备的结构示意图。
具体实施方式
为了使本发明的目的、技术方案和优点更加清楚，下面将结合附图对本发明作进一步地详细描述，显然，所描述的实施例，仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其它实施例，都属于本发明保护的范围。
本发明实施例中，所述第一设备具体用于在空中发卡的实时联机发卡系统中，为各卡片发行方或卡片应用提供方发行的虚拟IC卡生成安全数据。其可为各种类型的计算设备，比如说，可以是高性能计算机，也可以是各种类型的加密机等等，此处不做限制。
下面结合说明书附图对本发明实施例做进一步详细描述。
图1为本发明实施例一提供的一种生成IC卡安全数据的方法所对应的流程示意图，如图1所示，包括以下步骤S101至步骤S102：
步骤S101：第一设备接收IC卡安全数据生成请求；所述IC卡安全数据生成请求包括待生成的安全数据的N种数据类型；其中，N为大于等于1的整数；
步骤S102：针对于所述N种数据类型中的任一数据类型，所述第一设备根据生成所述任一数据类型的安全数据所需的性能消耗，采用与生成所述任一数据类型的安全数据所需的性能消耗相匹配的生成路径，生成所述任一数据类型的安全数据。
本发明实施例中，第一设备接收IC卡安全数据生成请求，该IC卡安全数据生成请求用于请求第一设备生成N种数据类型的安全数据；针对于N种数据类型中的任一种数据类型，第一设备可采用与生成该数据类型所需的性能消耗相匹配的生成路径，生成该数据类型的安全数据。由于第一设备可根 据生成任一数据类型的安全数据所需的性能消耗，为该任一数据类型的生成选择匹配的生成路径，因而，可有效地提高IC卡安全数据的生成效率。
具体来说，在步骤S101中，第一设备接收IC卡安全数据生成请求；所述IC卡安全数据生成请求用于向第一设备生成满足一定业务需求的安全数据。其中，所述满足一定业务需求的安全数据可以包括N种数据类型的安全数据，N为大于等于1的整数。
举例来说，所述N种数据类型的安全数据具体可以包括个人信息、卡片信息、金融交易数据、签名证书、数据保护安全密钥、通信加密密钥、消耗密钥等等，或者，也可以包括其他类型的IC卡安全数据，此处不做具体限制。
本发明实施例中，第一设备可从多个业务需求方处接收IC卡安全数据生成请求。对于不同的业务需求方来说，由于其发行的虚拟IC卡的应用场景不同，或者，由于其对初始数据做的预处理不同，不同的业务需求方发送来的IC卡生成请求中所请求生成的安全数据也不同，即不同的业务需求方请求生成的N种数据类型的安全数据是不同的。
因此，第一设备可通过一个统一接口模块来接收各个业务需求方发送来的IC卡安全数据生成请求，用于为各个业务需求方提供生成安全数据的完整服务。
图2为本发明实施例中统一接口模块的结构示意图，由图2可知，所述统一接口模块200又可具体包括一个基础服务接口201和多个个性化服务接口(如图中所示的2021、2022、2023、2024)。
其中，基础服务接口用于统一接收各个业务需求方发送来的IC卡安全数据生成请求，继承自基础服务接口的多个个性化服务接口分别用于在安全数据生成请求通过基础服务接口后，接收来自不同业务需求方的安全数据生成请求，即当来自某一业务需求方的安全数据生成请求到达个性化服务接口时，可以根据其对应的业务需求，对其所请求的N种数据类型的安全数据进行个性化的初步处理，包括数据检查和响应等等。
基于此，可以看出统一接口模块的通过基础服务接口和多个个性化服务接口相结合的设计，既保证了对外发布接口的简单性，同时又简化各个业务需求方的调用实现，使得不同的业务需求方彼此之间业务接口的隔离，可以实现对不同安全数据生成请求的高效及时的数据检查、响应。
进而，在步骤S102中，所述第一设备可将各个业务需求方发送来的IC卡安全数据生成请求，根据所需生成的安全数据的数据类型，重新做进一步地拆分。如图2中所示，所述第一设备通过拆分模块203来执行安全数据生成请求的拆分。第一设备可在接收到IC卡安全数据生成请求后，可将该IC卡安全数据生成请求根据安全级别和性能消耗两个维度，进一步拆分为N个子请求，每一个子请求分别对应一种数据类型的安全数据。
由于不同类型的安全数据的计算、加密方式不同，因此，将IC卡安全数据生成请求划分为N个子请求，可使第一设备有针对性地对每一个安全数据生成子请求中所请求安全数据选择合适的生成路径。
若某一IC卡安全数据生成请求中请求了N种数据类型的安全数据，则针对于所述N种数据类型中的任一数据类型，所述第一设备可通过解析该安全数据生成子请求，根据生成所述任一数据类型的安全数据所需的性能消耗，采用与生成所述任一数据类型的安全数据所需的性能消耗相匹配的生成路径，生成所述任一数据类型的安全数据。
具体的，第一设备若确定生成所述任一数据类型的安全数据所需的性能消耗小于性能消耗阈值，则通过本地计算生成所述任一数据类型的安全数据，或者调用加密机进行实时地响应计算。
若确定通过本地计算生成所述任一数据类型的安全数据，则第一设备可对所述任一数据类型的安全数据的安全级别进行判断，若确定所述任一数据类型的安全数据的安全级别小于安全级别阈值，则可通过本地的低安全级别计算模块生成所述任一数据类型的安全数据，并通过高安全级别计算模块进行加密和保护。
反之，若确定所述任一数据类型的安全数据的安全级别大于等于安全级别阈值，则可通过本地的高安全级别计算模块生成所述任一数据类型的安全数据。本发明实施例中，安全级别较高的安全数据通常可包括IC卡的应用数据和密钥的保护密钥，如各类安全证书、通信密钥或其他应用数据的保护密钥，以及交易的一次性消耗密钥和其对应的保护密钥。
需要说明的是，本发明实施例中，所述性能消耗阈值和所述安全级别阈值可由本领域技术人员可根据实际情况进行设置，本发明对此不做具体限制。
在IC卡安全数据中，常包括一些数据类型的安全数据需要大量的计算才能生成，比如说，个人化安全证书。因此，若通过本地计算这些数据类型的安全数据，则会消耗大量的计算资源，使得安全数据的生成效率降低。
在这种情况下，第一设备若确定生成所述任一数据类型的安全数据所需的性能消耗大于等于性能消耗阈值，则可通过调用第二设备以生成所述任一数据类型的安全数据。
其中，所述第二设备具体是专门为生成性能消耗较高或高密集计算型的安全数据而部署的专用计算资源，其可以为高性能计算机、HSM加密机，或者其他类型的计算设备，本发明对此不做具体限制。
图3为本发明实施例一中所述第二设备的结构示意图。如图3所示，所述第二设备中包括数据服务接口、数据生成模块和数据缓存模块。其中，数据服务接口用于接收第一设备发送来的某种数据类型的安全数据的生成子请求，即高密集计算型的安全数据的生成子请求。
由于需要通过调用第二设备生成的安全数据，通常是对各用户都通用的安全数据，因此，第二设备中的数据生成模块可根据所述第二设备的系统状况和生成各种数据类型的安全数据所需的预设时间，持续地调用HSM加密设 备来生成如个人化证书数据等高密集计算型的安全数据，然后通过数据保护和加密模块将生成的安全数据加密后存储到持久化设备中。
所述数据缓存模块可通过批量加载的方式，从持久化设备中获取所述数据生成模块预先生成的安全数据，并为提供数据服务。也就是说，当第一设备调用第二设备生成某一数据类型的安全数据时，安全数据生成子请求通过数据服务接口优先进入数据缓存服务，从数据缓存服务中获取已预先生成的安全数据。
同时，数据缓存模块还具有监控缓存数据的功能，当数据缓存模块中缓存的安全数据的数据量小于某一安全值时，数据缓存模块可自动地从持久化设备中加载安全数据。
在某些特殊情况下，如果数据缓存模块和持久化设备中的已预先生成的安全数据的数量都不能满足高并发的安全数据生成请求的需要，或在，其他异常情况下，则所述第二设备可通过数据生成模块实时地计算生成安全数据。
可见，为应对高密集计算型安全数据生成过程中存在的性能消耗要求较高、耗费时间可能较长的问题，第二设备通过数据生成模块不间断地预生成安全数据并存储，与数据缓存模块从持久化设备中动态获取安全数据相结合的机制，可以有效利用加密设备的空闲时间，将高并发性的数据生成转化为持久的、均匀的安全数据的生成过程，因此，可突破传统发卡模式中安全数据生成的性能瓶颈，使得实时联机发卡系统可以应对互联网环境下集中式、高并发性的发卡需求。
需要说明的是，本发明实施例中，所述第一设备中还可包括一个安全保护加密模块。所述第一设备在通过本地计算或调用第二设备计算生成安全数据之后，通过一个独立的安全保护加密模块来实现对生成的不同安全级别的安全数据的加密、保护和存储。
具体来说，包括所述第一设备若确定所述任一数据类型的安全数据的安全级别大于等于安全级别阈值，则通过安全保护加密模块存储所述任一数据类型的安全数据。
若确定所述任一数据类型的安全数据的安全级别小于安全级别阈值，则通过非安全保护加密模块存储所述任一数据类型的安全数据。
举例来说，安全认证中心根密钥、行业二级证书和用户私钥证书等安全级别较高的安全数据可以存储于安全保护加密模块中，而通讯加密密钥、消耗密钥和处于安全保护模块内的密钥保护下的密钥可以存储于非安全保护加密模块中。
此外，由于生成的安全数据要通过互联网环境传输到到用户的手机等智能终端中，所述安全保护加密模块还可为生成的安全数据的存储和传输提供安全保护。
可见，存储于不同安全设备的密钥存储机制，可以从物理层面上隔绝密钥安全渗透和安全边界蔓延的问题，并有效支持所述第一设备对不同数据类型的安全数据的请求的拆分和生成路径的选取，保证了生成、存储和传输等各阶段的安全性。
基于同样的发明构思，本发明实施例二提供了一种生成IC卡安全数据的装置，图4为本发明实施例二中提供的一种生成IC卡安全数据的装置的结构示意图，如图4所示，所述装置包括：
接收模块401，用于接收IC卡安全数据生成请求；所述IC卡安全数据生成请求包括待生成的安全数据的N种数据类型；
生成模块402，用于针对于所述N种数据类型中的任一数据类型，根据生成所述任一数据类型的安全数据所需的性能消耗，采用与生成所述任一数 据类型的安全数据所需的性能消耗相匹配的生成路径，生成所述任一数据类型的安全数据。
可选地，所述生成模块402具体用于：
若确定生成所述任一数据类型的安全数据所需的性能消耗大于等于性能消耗阈值，则从第二设备中预先生成并存储的安全数据中获取所述任一数据类型的安全数据。
可选地，所述生成模块402还具体用于：
若确定生成所述任一数据类型的安全数据所需的性能消耗小于性能消耗阈值，则通过本地计算或者调用加密机生成所述任一数据类型的安全数据。
可选地，所述生成模块402还具体用于：
若确定所述任一数据类型的安全数据的安全级别小于安全级别阈值，则通过低安全级别计算模块生成所述任一数据类型的安全数据，并通过高安全级别计算模块进行加密；
若确定所述第一安全数据的安全级别大于等于安全级别阈值，则通过所述高安全级别计算模块生成并加密所述任一数据类型的安全数据。
可选地，所述生成模块402还用于：
若确定所述任一数据类型的安全数据的安全级别大于等于安全级别阈值，则通过安全保护加密模块存储所述任一数据类型的安全数据；
若确定所述任一数据类型的安全数据的安全级别小于安全级别阈值，则通过非安全保护加密模块存储所述任一数据类型的安全数据。
基于同样的发明构思，本发明实施例三提供了一种计算设备500，该计算设备500具体可以为桌面计算机、便携式计算机、智能手机、平板电脑、个人数字助理(Personal Digital Assistant，PDA)等。如图5所示，该计算设备可以包括中央处理器(Center Prosessing Unit，CPU)、存储器、输入/输出设 备等，输入设备可以包括键盘、鼠标、触摸屏等，输出设备可以包括显示设备，如液晶显示器(Liquid Crystal Display，LCD)、阴极射线管(Cathode Ray Tube，CRT)等。
存储器可以包括只读存储器(ROM)和随机存取存储器(RAM)，并向处理器提供存储器中存储的程序指令和数据。在本发明实施例中，存储器可以用于存储用于基于生成IC卡安全数据的方法的程序。
处理器通过调用存储器存储的程序指令，处理器用于按照获得的程序指令执行：接收IC卡安全数据生成请求；所述IC卡安全数据生成请求包括待生成的安全数据的N种数据类型；其中，N为大于等于1的整数；针对于所述N种数据类型中的任一数据类型，根据生成所述任一数据类型的安全数据所需的性能消耗，采用与生成所述任一数据类型的安全数据所需的性能消耗相匹配的生成路径，生成所述任一数据类型的安全数据。
基于相同构思，本发明实施例四提供了一种计算设备，可用于执行上述生成IC卡安全数据的方法流程。图6为本申请提供的一种计算设备的结构示意图。该计算设备包括收发器601、处理器602、存储器603和通信接口604；其中，收发器601、处理器602、存储器603和通信接口604通过总线605相互连接。
其中，存储器603用于存储程序。具体地，程序可以包括程序代码，程序代码包括计算机操作指令。存储器603可以为易失性存储器(volatile memory)，例如随机存取存储器(random-access memory，简称RAM)；也可以为非易失性存储器(non-volatile memory)，例如快闪存储器(flash memory)，硬盘(hard disk drive，简称HDD)或固态硬盘(solid-state drive，简称SSD)；还可以为上述任一种或任多种易失性存储器和非易失性存储器的组合。
存储器603存储了如下的元素，可执行模块或者数据结构，或者它们的子集，或者它们的扩展集：
操作指令：包括各种操作指令，用于实现各种操作。
操作系统：包括各种系统程序，用于实现各种基础业务以及处理基于硬件的任务。
总线605可以是外设部件互连标准(peripheral component interconnect，简称PCI)总线或扩展工业标准结构(extended industry standard architecture，简称EISA)总线等。总线可以分为地址总线、数据总线、控制总线等。为便于表示，图6中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
通信接口604可以为有线通信接入口，无线通信接口或其组合，其中，有线通信接口例如可以为以太网接口。以太网接口可以是光接口，电接口或其组合。无线通信接口可以为WLAN接口。
处理器602可以是中央处理器(central processing unit，简称CPU)，网络处理器(network processor，简称NP)或者CPU和NP的组合。还可以是硬件芯片。上述硬件芯片可以是专用集成电路(application-specific integrated circuit，简称ASIC)，可编程逻辑器件(programmable logic device，简称PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(complex programmable logic device，简称CPLD)，现场可编程逻辑门阵列(field-programmable gate array，简称FPGA)，通用阵列逻辑(generic array logic，简称GAL)或其任意组合。
收发器601，用于接收IC卡安全数据生成请求；所述IC卡安全数据生成请求包括待生成的安全数据的N种数据类型；其中，N为大于等于1的整数；
存储器603，用于存储程序指令；
处理器602，用于调用所述存储器603中存储的程序指令，按照获得的程序执行以下方法：针对于所述N种数据类型中的任一数据类型，根据生成所 述任一数据类型的安全数据所需的性能消耗，采用与生成所述任一数据类型的安全数据所需的性能消耗相匹配的生成路径，生成所述任一数据类型的安全数据。
可选地，所述处理器602，具体用于：若确定生成所述任一数据类型的安全数据所需的性能消耗大于等于性能消耗阈值，则从第二设备中预先生成并存储的安全数据中获取所述任一数据类型的安全数据。
可选地，所述处理器602，具体用于：若确定生成所述任一数据类型的安全数据所需的性能消耗小于性能消耗阈值，则通过本地计算或者调用加密机生成所述任一数据类型的安全数据。
可选地，所述处理器602，具体用于：若确定所述任一数据类型的安全数据的安全级别小于安全级别阈值，则通过低安全级别计算模块生成所述任一数据类型的安全数据，并通过高安全级别计算模块进行加密；若确定所述第一安全数据的安全级别大于等于安全级别阈值，则通过所述高安全级别计算模块生成并加密所述任一数据类型的安全数据。
可选地，所述处理器602，具体用于：若确定所述任一数据类型的安全数据的安全级别大于等于安全级别阈值，则通过安全保护加密模块存储所述任一数据类型的安全数据；若确定所述任一数据类型的安全数据的安全级别小于安全级别阈值，则通过非安全保护加密模块存储所述任一数据类型的安全数据。
本发明实施例四提供了一种计算机存储介质，用于储存为上述计算设备所用的计算机程序指令，其包含用于执行上述生成IC卡安全数据的方法的程序。
所述计算机存储介质可以是计算机能够存取的任何可用介质或数据存储 设备，包括但不限于磁性存储器(例如，软盘、硬盘、磁带、磁光盘(MO)等)、光学存储器(例如CD、DVD、BD、HVD等)、以及半导体存储器(例如ROM、EPROM、EEPROM、非易失性存储器(NAND FLASH)、固态硬盘(SSD))等。
由上述内容可以看出：本发明实施例中，第一设备接收IC卡安全数据生成请求，该IC卡安全数据生成请求用于请求第一设备生成N种数据类型的安全数据；针对于N种数据类型中的任一种数据类型，第一设备可采用与生成该数据类型所需的性能消耗相匹配的生成路径，生成该数据类型的安全数据。由于第一设备可根据生成任一数据类型的安全数据所需的性能消耗，为该任一数据类型的生成选择匹配的生成路径，因而，可有效地提高IC卡安全数据的生成效率。
本领域内的技术人员应明白，本申请实施例可提供为方法、系统、或计算机程序产品。因此，本申请实施例可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请实施例可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请实施例是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设 备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然，本领域的技术人员可以对本申请实施例进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请实施例的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (17)

  1. 一种生成IC卡安全数据的方法，其特征在于，所述方法包括：
    第一设备接收IC卡安全数据生成请求；所述IC卡安全数据生成请求包括待生成的安全数据的N种数据类型；其中，N为大于等于1的整数；
    针对于所述N种数据类型中的任一数据类型，所述第一设备根据生成所述任一数据类型的安全数据所需的性能消耗，采用与生成所述任一数据类型的安全数据所需的性能消耗相匹配的生成路径，生成所述任一数据类型的安全数据。
  2. 根据权利要求1所述的方法，其特征在于，所述第一设备生成所述任一数据类型的安全数据，包括：
    所述第一设备若确定生成所述任一数据类型的安全数据所需的性能消耗大于等于性能消耗阈值，则从第二设备中预先生成并存储的安全数据中获取所述任一数据类型的安全数据。
  3. 根据权利要求1所述的方法，其特征在于，所述第一设备生成所述任一数据类型的安全数据，还包括：
    所述第一设备若确定生成所述任一数据类型的安全数据所需的性能消耗小于性能消耗阈值，则通过本地计算或者调用加密机生成所述任一数据类型的安全数据。
  4. 根据权利要求3所述的方法，其特征在于，所述第一设备通过本地计算生成所述任一数据类型的安全数据，包括：
    所述第一设备若确定所述任一数据类型的安全数据的安全级别小于安全级别阈值，则通过低安全级别计算模块生成所述任一数据类型的安全数据，并通过高安全级别计算模块进行加密；
    所述第一设备若确定所述第一安全数据的安全级别大于等于安全级别阈值，则通过所述高安全级别计算模块生成并加密所述任一数据类型的安全数据。
  5. 根据权利要求1至4中任一项所述的方法，其特征在于，所述第一设备生成所述任一数据类型的安全数据后，还包括：
    所述第一设备若确定所述任一数据类型的安全数据的安全级别大于等于安全级别阈值，则通过安全保护加密模块存储所述任一数据类型的安全数据；
    若确定所述任一数据类型的安全数据的安全级别小于安全级别阈值，则通过非安全保护加密模块存储所述任一数据类型的安全数据。
  6. 一种生成IC卡安全数据的装置，其特征在于，包括：
    接收模块，用于接收IC卡安全数据生成请求；所述IC卡安全数据生成请求包括待生成的安全数据的N种数据类型；其中，N为大于等于1的整数；
    生成模块，用于针对于所述N种数据类型中的任一数据类型，根据生成所述任一数据类型的安全数据所需的性能消耗，采用与生成所述任一数据类型的安全数据所需的性能消耗相匹配的生成路径，生成所述任一数据类型的安全数据。
  7. 根据权利要求6所述的装置，其特征在于，所述生成模块具体用于：
    若确定生成所述任一数据类型的安全数据所需的性能消耗大于等于性能消耗阈值，则从第二设备中预先生成并存储的安全数据中获取所述任一数据类型的安全数据。
  8. 根据权利要求6所述的装置，其特征在于，所述生成模块还具体用于：
    若确定生成所述任一数据类型的安全数据所需的性能消耗小于性能消耗阈值，则通过本地计算或者调用加密机生成所述任一数据类型的安全数据。
  9. 根据权利要求8所述的装置，其特征在于，所述生成模块还具体用于：
    若确定所述任一数据类型的安全数据的安全级别小于安全级别阈值，则通过低安全级别计算模块生成所述任一数据类型的安全数据，并通过高安全级别计算模块进行加密；
    若确定所述第一安全数据的安全级别大于等于安全级别阈值，则通过所述高安全级别计算模块生成并加密所述任一数据类型的安全数据。
  10. 根据权利要求6至9中任一项所述的装置，其特征在于，所述生成模块还用于：
    若确定所述任一数据类型的安全数据的安全级别大于等于安全级别阈值，则通过安全保护加密模块存储所述任一数据类型的安全数据；
    若确定所述任一数据类型的安全数据的安全级别小于安全级别阈值，则通过非安全保护加密模块存储所述任一数据类型的安全数据。
  11. 一种计算设备，其特征在于，所述计算设备包括：
    收发器，用于接收IC卡安全数据生成请求；所述IC卡安全数据生成请求包括待生成的安全数据的N种数据类型；其中，N为大于等于1的整数；
    存储器，用于存储程序指令；
    处理器，用于调用所述存储器中存储的程序指令，按照获得的程序执行以下方法：针对于所述N种数据类型中的任一数据类型，根据生成所述任一数据类型的安全数据所需的性能消耗，采用与生成所述任一数据类型的安全数据所需的性能消耗相匹配的生成路径，生成所述任一数据类型的安全数据。
  12. 根据权利要求11所述的计算设备，其特征在于，所述处理器，具体用于：
    若确定生成所述任一数据类型的安全数据所需的性能消耗大于等于性能消耗阈值，则从第二设备中预先生成并存储的安全数据中获取所述任一数据类型的安全数据。
  13. 根据权利要求11所述的计算设备，其特征在于，所述处理器，具体用于：
    若确定生成所述任一数据类型的安全数据所需的性能消耗小于性能消耗阈值，则通过本地计算或者调用加密机生成所述任一数据类型的安全数据。
  14. 根据权利要求13所述的计算设备，其特征在于，所述处理器，具体用于：
    若确定所述任一数据类型的安全数据的安全级别小于安全级别阈值，则通过低安全级别计算模块生成所述任一数据类型的安全数据，并通过高安全级别计算模块进行加密；
    若确定所述第一安全数据的安全级别大于等于安全级别阈值，则通过所述高安全级别计算模块生成并加密所述任一数据类型的安全数据。
  15. 根据权利要求11至14中任一项所述的计算设备，其特征在于，所述处理器，具体用于：
    若确定所述任一数据类型的安全数据的安全级别大于等于安全级别阈值，则通过安全保护加密模块存储所述任一数据类型的安全数据；
    若确定所述任一数据类型的安全数据的安全级别小于安全级别阈值，则通过非安全保护加密模块存储所述任一数据类型的安全数据。
  16. 一种计算机存储介质，其特征在于，所述计算机可读存储介质存储有计算机可执行指令，所述计算机可执行指令用于使所述计算机执行权利要求1至5中任一项所述的方法。
  17. 一种计算机程序产品，其特征在于，所述计算机程序产品包括存储在非暂态计算机可读存储介质上的计算程序，所述计算机程序包括程序指令，当所述程序指令被计算机执行时，使所述计算机执行权利要求1～5任一项所述方法。
PCT/CN2018/081751 2017-05-24 2018-04-03 一种生成ic卡安全数据的方法及装置 WO2018214649A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710374072.6 2017-05-24
CN201710374072.6A CN107169761B (zh) 2017-05-24 2017-05-24 一种生成ic卡安全数据的方法及装置

Publications (1)

Publication Number Publication Date
WO2018214649A1 true WO2018214649A1 (zh) 2018-11-29

Family

ID=59820755

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/081751 WO2018214649A1 (zh) 2017-05-24 2018-04-03 一种生成ic卡安全数据的方法及装置

Country Status (2)

Country Link
CN (1) CN107169761B (zh)
WO (1) WO2018214649A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107169761B (zh) * 2017-05-24 2020-07-07 中国银联股份有限公司 一种生成ic卡安全数据的方法及装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102612028A (zh) * 2012-03-28 2012-07-25 电信科学技术研究院 一种配置传输和数据传输的方法、系统及设备
CN102958050A (zh) * 2011-08-12 2013-03-06 英特尔移动通信有限责任公司 数据传送设备及其控制方法、数据接收设备及其控制方法
CN105376051A (zh) * 2014-08-29 2016-03-02 宇龙计算机通信科技(深圳)有限公司 一种加密方法、装置及终端
CN107169761A (zh) * 2017-05-24 2017-09-15 中国银联股份有限公司 一种生成ic卡安全数据的方法及装置

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8825677B2 (en) * 2006-09-20 2014-09-02 Ebay Inc. Listing generation utilizing catalog information
EP2026552B1 (en) * 2007-08-17 2014-02-26 Accenture Global Services Limited Multiple channel automated refill system
CN106209615B (zh) * 2016-07-05 2019-11-05 云南大学 一种基于spfa算法计算转发路径的动态路由控制方法和系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102958050A (zh) * 2011-08-12 2013-03-06 英特尔移动通信有限责任公司 数据传送设备及其控制方法、数据接收设备及其控制方法
CN102612028A (zh) * 2012-03-28 2012-07-25 电信科学技术研究院 一种配置传输和数据传输的方法、系统及设备
CN105376051A (zh) * 2014-08-29 2016-03-02 宇龙计算机通信科技(深圳)有限公司 一种加密方法、装置及终端
CN107169761A (zh) * 2017-05-24 2017-09-15 中国银联股份有限公司 一种生成ic卡安全数据的方法及装置

Also Published As

Publication number Publication date
CN107169761A (zh) 2017-09-15
CN107169761B (zh) 2020-07-07

Similar Documents

Publication Publication Date Title
US20210264042A1 (en) Techniques to provide client-side security for storage of data in a network environment
US10552827B2 (en) Dynamic digital certificate updating
CN104982005B (zh) 实施虚拟化环境中的特权加密服务的计算装置及方法
US8244609B2 (en) Payment management on mobile devices
US20180183578A1 (en) Provisioning keys for virtual machine scaling
CN109104281A (zh) 令牌化硬件安全模块
US20160164880A1 (en) Systems And Methods Of Transaction Authorization Using Server-Triggered Switching To An Integrity-Attested Virtual Machine
US11025420B2 (en) Stateless service-mediated security module
US20220309512A1 (en) Fraud detection and control in multi-tiered centralized processing
JP2017528844A (ja) 企業システム内の装置の変更イベントの管理
US11263632B2 (en) Information sharing methods, apparatuses, and devices
US10395028B2 (en) Virtualization based intra-block workload isolation
WO2022161182A1 (zh) 基于数据流的可信计算的方法及装置
US11310244B2 (en) Information sharing methods, apparatuses, and devices
US11637868B2 (en) Attestation support for elastic cloud computing environments
US10692074B2 (en) Secure resource sharing between computing devices for electronic transactions
TW202101266A (zh) 用於安全介面控制之安全執行客體所有者控制
US20220083347A1 (en) Adding cycle noise to enclaved execution environment
US10084784B1 (en) Restricting access to computing resources
WO2018214649A1 (zh) 一种生成ic卡安全数据的方法及装置
WO2023134259A1 (zh) 基于点对点的数据处理方法、系统、计算设备及存储介质
US20200126047A1 (en) Digital Check Generation and Processing Platform
WO2020052383A1 (zh) 一种指纹处理系统、方法及指纹设备
US20220109581A1 (en) Distributed attestation in heterogenous computing clusters
US10762228B2 (en) Transaction scheduling method and apparatus

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18805722

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18805722

Country of ref document: EP

Kind code of ref document: A1