WO2022165771A1 - 虚拟电子卡管理方法、系统及安全芯片、终端和存储介质 - Google Patents

虚拟电子卡管理方法、系统及安全芯片、终端和存储介质 Download PDF

Info

Publication number
WO2022165771A1
WO2022165771A1 PCT/CN2021/075648 CN2021075648W WO2022165771A1 WO 2022165771 A1 WO2022165771 A1 WO 2022165771A1 CN 2021075648 W CN2021075648 W CN 2021075648W WO 2022165771 A1 WO2022165771 A1 WO 2022165771A1
Authority
WO
WIPO (PCT)
Prior art keywords
card
virtual electronic
security chip
management
target
Prior art date
Application number
PCT/CN2021/075648
Other languages
English (en)
French (fr)
Inventor
张雁玲
Original Assignee
深圳市汇顶科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市汇顶科技股份有限公司 filed Critical 深圳市汇顶科技股份有限公司
Priority to PCT/CN2021/075648 priority Critical patent/WO2022165771A1/zh
Priority to CN202180002380.0A priority patent/CN113508411A/zh
Priority to EP21765817.8A priority patent/EP4060588A1/en
Priority to US17/473,278 priority patent/US11907931B2/en
Publication of WO2022165771A1 publication Critical patent/WO2022165771A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/22—Payment schemes or models
    • G06Q20/227—Payment schemes or models characterised in that multiple accounts are available, e.g. to the payer
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/34—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using cards, e.g. integrated circuit [IC] cards or magnetic cards
    • G06Q20/341—Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/445—Program loading or initiating
    • G06F9/44505—Configuring for program initiating, e.g. using registry, configuration files
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/322—Aspects of commerce using mobile devices [M-devices]
    • G06Q20/3223—Realising banking transactions through M-devices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/322—Aspects of commerce using mobile devices [M-devices]
    • G06Q20/3227—Aspects of commerce using mobile devices [M-devices] using secure elements embedded in M-devices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/326—Payment applications installed on the mobile devices
    • G06Q20/3263—Payment applications installed on the mobile devices characterised by activation or deactivation of payment capabilities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/327—Short range or proximity payments by means of M-devices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/327—Short range or proximity payments by means of M-devices
    • G06Q20/3278—RFID or NFC payments by means of M-devices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/34—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using cards, e.g. integrated circuit [IC] cards or magnetic cards
    • G06Q20/349—Rechargeable cards
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/34—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using cards, e.g. integrated circuit [IC] cards or magnetic cards
    • G06Q20/351—Virtual cards
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/34—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using cards, e.g. integrated circuit [IC] cards or magnetic cards
    • G06Q20/354—Card activation or deactivation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/34—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using cards, e.g. integrated circuit [IC] cards or magnetic cards
    • G06Q20/355—Personalisation of cards for use
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/34—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using cards, e.g. integrated circuit [IC] cards or magnetic cards
    • G06Q20/356—Aspects of software for card payments
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/34—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using cards, e.g. integrated circuit [IC] cards or magnetic cards
    • G06Q20/356—Aspects of software for card payments
    • G06Q20/3563—Software being resident on card
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/36—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using electronic wallets or electronic money safes
    • G06Q20/367—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using electronic wallets or electronic money safes involving electronic purses or money safes

Definitions

  • the present application relates to the technical field of near field communication, and in particular, to a virtual electronic card management method, system, security chip, terminal and storage medium.
  • NFC Near Field Communication
  • a terminal with NFC function can generate a virtual electronic card, and then interact with the card reader through the terminal to realize operations such as swiping a bank card, a bus card or an access card. Since the card operation can be realized without carrying a physical card, so It can bring greater convenience to users.
  • each NFC-capable terminal can generate multiple virtual electronic cards, in the process of generating, using and deleting virtual electronic cards, it is necessary to manage each virtual electronic card through a card management program.
  • a card management program for each virtual electronic card, at least two card management programs are required for management, wherein at least one card management program is used to manage the authority of the virtual electronic card, and at least one card management program is used to manage the programs in the virtual electronic card.
  • the card management program used to manage each virtual electronic card will occupy a larger chip. Therefore, it is necessary to equip the terminal with a chip with a larger storage space to meet the user's demand for using and managing multiple virtual electronic cards on the terminal, which will lead to an increase in the cost of the terminal.
  • the embodiments of the present application provide a virtual electronic card management method, system, security chip, terminal and storage medium, which can reduce the occupation of the chip storage space by the card management program of the virtual electronic card.
  • an embodiment of the present application provides a virtual electronic card management method, which is applied to a security chip, where the security chip is installed in a first terminal, and the method includes:
  • a management request from a trusted mobile application on the first terminal, wherein the management request is used to manage a target virtual electronic card in at least one virtual electronic card on the security chip, and the virtual electronic card
  • the authority of the card is configured by the on-chip operating system of the security chip
  • a target card management program corresponding to the target virtual electronic card is determined from at least one card management program on the security chip, wherein each virtual electronic card corresponds to one card management program, and different The virtual electronic cards correspond to different card management programs;
  • the target virtual electronic card is managed by invoking the card management command corresponding to the management request in the security-chip card management system through the target card management program.
  • the method further includes creating the target virtual electronic card, and the creating the target virtual electronic card includes:
  • a card creation command in the card management system is invoked, and the target virtual electronic card is created on the security chip.
  • the acquiring the installation package of the card management program includes:
  • the acquiring the installation package of the card management program includes:
  • the installation package is downloaded from a preset device.
  • the method further includes:
  • the matching relationship between the target program identifier and the target card identifier is registered in the registry of the on-chip operating system.
  • the target card management program corresponding to the target virtual electronic card is determined from at least one card management program on the security chip procedures, including:
  • the card management program corresponding to the target program identifier is determined as the target card management program corresponding to the target virtual electronic card.
  • the card management command includes a personalization command, a deletion command, an activation command or a read-write command;
  • the personalized command is used to instruct the target card management program to store the personalized data carried in the management request into the target virtual electronic card;
  • the deletion command is used to instruct the target card management program to delete the target virtual electronic card
  • the activation command is used to instruct the target card management program to set the target virtual electronic card to a non-contact activation state
  • the read-write command is used to instruct the target card management program to read and write the content of the target virtual electronic card.
  • the personalization data is read from an entity card by a near field communication controller, and the personalization data is sent by the card management system to the trusted mobile application, the personalization data is sent by the trusted mobile application to a trusted service management platform, and the trusted service management platform generates the management request including the personalization data, and The management request is sent to the trusted mobile application by the trusted service management platform.
  • the personalization data is sent by the second terminal to the trusted service management platform, and is generated by the trusted service management platform including all The management request of the personalization data is sent, and the trusted service management platform sends the management request to the trusted mobile application, wherein the first terminal and the second terminal are different terminals.
  • the virtual electronic card management method further includes:
  • the method further includes:
  • the sending the feedback information to the near field communication controller includes:
  • the feedback information in the memory of the security chip is transmitted to the register of the serial peripheral interface SPI2;
  • the encrypted feedback information is sent to the near field communication controller.
  • the card management system is implemented by C language, and the card management program is implemented by Java.
  • an embodiment of the present application further provides a security chip, the security chip is located in a terminal and is connected to a memory in the terminal, the memory stores an instruction that can be executed by the security chip, the security chip is The instruction is executed by the security chip, so that the security chip can execute the virtual electronic card management method provided by the first aspect and any possible implementation manner of the first aspect.
  • an embodiment of the present application further provides a terminal, including: the security chip provided in the second aspect, and a memory connected to the security chip.
  • an embodiment of the present application further provides a computer-readable storage medium, where a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the above-mentioned first aspect and the first aspect are implemented A virtual electronic card management method provided by any possible implementation manner of .
  • an embodiment of the present application further provides a virtual electronic card management system, including: the security chip and the trusted mobile application provided in the second aspect;
  • the trusted mobile application is installed on the first terminal where the security chip is located;
  • the trusted mobile application is configured to send a management request to the security chip, wherein the management request is used to instruct the card management program on the security chip to manage the virtual electronic card on the security chip, Different said card management programs are used to manage different said virtual electronic cards.
  • the virtual electronic card management system further includes: a trusted service management platform;
  • the trusted mobile application is further configured to send an acquisition instruction to the trusted service management platform, wherein the acquisition instruction is used to request acquisition of an installation package of the card management program;
  • the trusted service management platform configured to send the installation package to the trusted mobile application according to the obtaining instruction
  • the trusted mobile application is further configured to send the received installation package to the security chip.
  • the virtual electronic card management system further includes: a preset device;
  • the preset device is configured to send a download instruction to the security chip during the production stage of the security chip, wherein the download instruction is used to instruct the security chip to download the card management from the preset device Program installation package.
  • the virtual electronic card management system further includes: a near field communication controller;
  • the near field communication controller is arranged on the first terminal
  • the near field communication controller is configured to generate a contactless operation command according to the near field communication between the near field communication controller and the contactless card reader, and send the contactless operation command to the security chip ;
  • the near field communication manager is further configured to receive feedback information after the security chip executes the contactless operation command, and send the feedback information to the contactless card reader through near field communication.
  • the near field communication controller is further configured to read personalization data from the entity card, and send the read personalization data to the trusted mobile application;
  • the trusted mobile application is further configured to send the received personalization data to the trusted service management platform;
  • the trusted service management platform is further configured to generate the management request including the received personalization data.
  • the trusted service management platform is further configured to receive personalized data from the second terminal, and generate a data including the received personal data the management request for the data.
  • each virtual electronic card corresponds to a card management program on the security chip
  • different virtual electronic cards correspond to different card management programs .
  • the management request from the trusted mobile application on the terminal where the security chip is located is received, and the management request is sent to the corresponding card management program, and the card management program calls the card management on the security chip.
  • the card management command in the system manages the virtual electronic card that needs to be managed. Since the permissions of multiple virtual electronic cards are configured by the on-chip operating system of the security chip, and other management of each virtual electronic card can be implemented through the corresponding card management program, each virtual electronic card only needs to pass through one card.
  • the management program is used for management, thereby reducing the occupation of the chip storage space by the card management program of the virtual electronic card.
  • FIG. 1 is a flowchart of a virtual electronic card management method provided by an embodiment of the present application.
  • FIG. 2 is a flowchart of another virtual electronic card management method provided by an embodiment of the present application.
  • FIG. 3 is a flowchart of another virtual electronic card management method provided by an embodiment of the present application.
  • FIG. 4 is a schematic diagram of a terminal provided by an embodiment of the present application.
  • FIG. 5 is a schematic diagram of a virtual electronic card management system provided by an embodiment of the present application.
  • FIG. 6 is a schematic diagram of another virtual electronic card management system provided by an embodiment of the present application.
  • the embodiment of the present application provides a virtual electronic card management method, which is applied to a security chip, and the security chip may be a secure element (Secure Element, SE), more specifically, an embedded secure element (embedded Secure Element, eSE).
  • the security chip may be set in a terminal, and the terminal may be an electronic device such as a smart phone, a smart bracelet, and a smart watch.
  • the application scenario of the embodiment of the present application may be: the user manages the virtual electronic card simulated by the terminal through the security chip, and the virtual electronic card simulated by the terminal includes but is not limited to: bank card, bus card, and access control card.
  • the implementation details of the virtual electronic card management method provided by the embodiments of the present application will be specifically described below. The following content is only provided for the convenience of understanding, and is not necessary for implementing this solution.
  • Various traditional smart cards such as bus cards, bank cards, medical insurance cards, etc.
  • chips There are two types of chips commonly used in smart cards.
  • One is contact card swiping, such as a common card POS machine, and the other is contactless card swiping, which contains a non-contact data transmission control chip like NFC (including supporting antenna), such as a common near card reader.
  • Swipe bus card These common physical card functions are simulated through the mobile phone terminal, which is called virtual electronic card. At this time, there is no real card, but the relevant information or program of the card is added to the mobile terminal to "simulate" a card.
  • Smart card so that the same mobile phone terminal can realize the simulation of multiple cards and multiple cards through the cooperation of NFC chip and secure element, which is equivalent to installing multiple smart cards on the mobile phone. Simulate the information of multiple cards, and exchange information with the external card reader through the NFC chip connected to it to realize the card swipe function. Through these "simulated cards" (virtual electronic cards), the same mobile phone terminal can be used on different occasions to realize card-swiping authentication, card-swiping consumption and other behaviors of different cards.
  • FIG. 1 is a flowchart of a virtual electronic card management method provided by an embodiment of the present application. The method is applied to a security chip, and the security chip is installed in a first terminal. Referring to FIG. 1 , the method includes the following steps:
  • Step 101 Receive a management request from a trusted mobile application on the first terminal, wherein the management request is used to manage the target virtual electronic card in at least one virtual electronic card on the security chip, and the authority of the virtual electronic card is controlled by the security chip.
  • the chip's on-chip OS configuration is used to manage the target virtual electronic card in at least one virtual electronic card on the security chip, and the authority of the virtual electronic card is controlled by the security chip.
  • a trusted mobile application is installed on the first terminal including the security chip, and one or more virtual electronic cards are created on the security chip.
  • the authority of the virtual electronic card on the security chip is configured by the on-chip operating system of the security chip.
  • the on-chip operating system can perform operating system functions other than OPEN (functions of the Global Platform International Organization for Standardization), and realize memory supervision and authority management. Realize permission configuration for virtual electronic card.
  • the trusted mobile application can provide a human-computer interaction interface, so that the user can manage the virtual electronic card on the first terminal.
  • the trusted mobile application is a wallet-type application.
  • the user "selects" any virtual electronic card on the interface through the human-computer interaction interface provided by the trusted mobile application, and triggers the card management option, which means that the trusted mobile application initiates a management request, and the "selected" virtual card is selected.
  • the electronic card is the target virtual electronic card.
  • the human-computer interaction interface provided by the trusted mobile application displays three virtual electronic cards, namely, transportation card A, transportation card B and access control card. After the user selects transportation card B on the human-computer interaction interface, the user triggers the human-computer interaction. Click the "Recharge” button on the interface. At this time, the trusted mobile application will initiate a management request for the transportation card B.
  • the trusted mobile application can communicate with the Near Field Communication Controller (NFCC), the security chip and the Trusted Service Manager (TSM) through the software interface provided by the Android system architecture.
  • the Android system architecture provides an Open Mobile API (OMAPI) framework, an interface for the trusted service management platform to report the read virtual electronic card information, an interface for receiving the message flow of the trusted service management platform, and an interface for the trusted service management platform.
  • OMAPI Open Mobile API
  • the application protocol data unit (Application Protocol Data Unit, APDU) command is transmitted to the interface of the card management program in the security chip.
  • the trusted mobile application generates a management request for the target virtual electronic card in response to the user card selection operation and the card management operation, and sends the generated management request to the security chip.
  • the trusted mobile application uploads data to the trusted service management platform in response to the user's operation or the feedback from the security chip, and the trusted service management platform generates a management request based on the data uploaded by the trusted mobile application , and deliver the generated management request to the trusted mobile application, and then the trusted mobile application sends the received management request to the security chip.
  • Step 102 From at least one card management program on the security chip, determine a target card management program corresponding to the target virtual electronic card, wherein each virtual electronic card corresponds to a card management program, and different virtual electronic cards correspond to different Card management program.
  • At least one virtual electronic card is created on the security chip, and a corresponding card management program is installed on the security chip for each virtual electronic card. Different virtual electronic cards correspond to different card management programs, and the card management program is used for corresponding virtual electronic card for management. After receiving the management request for the target virtual electronic card, first determine the target card management program corresponding to the target virtual electronic card, so that the target card management program manages the target virtual electronic card in response to the management request.
  • Step 103 Send the management request to the target card management program.
  • the management request for the target virtual electronic card is sent to the target card management program.
  • the on-chip operating system of the security chip receives the management request from the trusted mobile application, and forwards the received management request to the target card management program.
  • Step 104 Through the target card management program, call the card management command corresponding to the management request in the card management system on the security chip to manage the target virtual electronic card.
  • a card management system is deployed in the security chip, and the card management system provides various card management commands for managing the virtual electronic card.
  • the card management system receives the invocation of the card management command by the card management program, executes the called card management command, and manages the virtual electronic card.
  • the target card management program After receiving the management request, the target card management program invokes the corresponding card management command in the card management system according to the management request, so that the card management system executes the card management command to manage the target virtual electronic card.
  • the management of the target virtual electronic card includes personalizing the target virtual electronic card, deleting the target virtual electronic card, activating the target virtual electronic card, reading and writing the target virtual electronic card, and the like. Among them, personalization refers to writing personalized data into the virtual electronic card, so that the virtual electronic card can realize the functions of cards such as bank cards, bus cards, and access control cards, and can distinguish different virtual electronic cards based on the written personalized data.
  • the virtual electronic card can realize the function of the traffic card, and then the virtual electronic card can be used to swipe the card.
  • the virtual electronic card By car, by subway, etc.
  • At least one virtual electronic card is created on the security chip, each virtual electronic card corresponds to a card management program on the security chip, and different virtual electronic cards correspond to different card management programs.
  • the management request from the trusted mobile application on the terminal where the security chip is located is received, and the management request is sent to the corresponding card management program, and the card management program calls the card management on the security chip.
  • the card management command in the system manages the virtual electronic card that needs to be managed. Since the permissions of multiple virtual electronic cards are configured by the on-chip operating system of the security chip, and other management of each virtual electronic card can be implemented through the corresponding card management program, each virtual electronic card only needs to pass through one card.
  • the management program is used for management, thereby reducing the occupation of the chip storage space by the card management program of the virtual electronic card.
  • the card management program on the security chip can not only be used to manage the virtual electronic card, but also can be used to create a virtual electronic card.
  • the card management program needs to be installed on the security chip first, and the installation package for the user to install the card management program can be from different sources.
  • the following describes in detail the virtual electronic card management method provided by the embodiment of the present application by taking the acquisition of the installation package of the card management program from the trusted service management platform and the preset device as an example.
  • FIG. 2 is a flowchart of a virtual electronic card management method provided by an embodiment of the present application. The method is applied to a security chip. Referring to FIG. 2 , the method installs a card management program through a trusted service management platform and manages it through a trusted mobile application.
  • the virtual electronic card includes the following steps:
  • Step 201 The security chip receives the installation package from the trusted mobile application.
  • the trusted mobile application installed on the terminal sends an acquisition instruction to the trusted service management platform in response to the user's operation, so as to obtain the information of the card management program from the trusted service management platform.
  • installation package and then the trusted mobile application can send the obtained installation package to the security chip on the terminal.
  • the trusted mobile application can download the installation package through the LOAD instruction of the Global Platform International Standards Organization (Global Platform, GP), and the installation package can be a CAP package.
  • the trusted mobile application accesses the background of the trusted service management platform through the service interface of the trusted service management platform, obtains the list of available virtual electronic cards, and displays the obtained list of available virtual electronic cards on the human-computer interaction interface , the user selects the target virtual electronic card to be created from the list of available virtual electronic cards, and then the trusted mobile application obtains the installation package of the card management program from the trusted service management platform, and sends the obtained installation package to the security chip.
  • different virtual electronic cards correspond to different card management programs, and each virtual electronic card is created and managed through the corresponding card management program.
  • Different card management programs can be installed through the same or different installation packages.
  • different card management programs are installed through a common installation package, and different card management programs are configured differently, such as recording the difference between the virtual electronic card and the card management program in the registry of the security chip. Matching relationship, so that different card management programs can create and manage different virtual electronic cards.
  • the installation package stored on the trusted service management platform can be uploaded by the manufacturer of the security chip.
  • each virtual electronic card needs to be created and managed through a corresponding card management program, and different card management programs can be created and managed through the same installation package to install. Therefore, when the virtual electronic card is created on the terminal for the first time, the installation package of the card management program is obtained from the trusted service management platform, and the obtained installation package is stored in the security chip.
  • the card management program can be installed directly using the installation package stored in the security chip. For example, the transportation card A of city A is the first virtual electronic card created on the terminal. When the transportation card A is created, the installation package of the card management program is obtained from the trusted service management platform, and the installation package will be stored in the terminal.
  • a traffic card B virtual electronic card
  • a card management program B for creating and managing the traffic card B is created based on the installation package stored on the security chip, and then The transportation card B is created and managed on the security chip by the card management program B.
  • Step 202 The security chip installs the target card management program based on the received installation package.
  • the on-chip operating system Chip Operating System, COS
  • COS Chip Operating System
  • the on-chip operating system calls the program installation command of the card management system on the security chip to install the software in the security chip based on the obtained installation package.
  • the target card management program is installed on the chip.
  • the terminal first establishes a secure channel through a security algorithm (such as SCP02, SCP03), and then the terminal executes the INSTALL command of Global Platform.
  • a security algorithm such as SCP02, SCP03
  • Step 203 The target card management program creates a target virtual electronic card on the security chip.
  • the target card management program can call the card creation command of the card management system on the security chip, the card management system executes the card creation command, and creates the target virtual electronic card in the virtual electronic card storage area on the security chip.
  • the card management system provides commands for creating and managing virtual electronic cards.
  • Each card management program invokes the commands provided by the card management system to manage each virtual electronic card. .
  • Step 204 Register the matching relationship between the target card management program and the target virtual electronic card in the registry of the on-chip operating system.
  • a target program identifier is allocated to the target card management program, wherein different card management programs correspond to different program identifiers.
  • the target virtual electronic card is created on the security chip, the target virtual electronic card is assigned a target card identifier, wherein different virtual electronic cards correspond to different card identifiers.
  • register the matching relationship between the target program identifier and the target card identifier in the registry of the on-chip operating system of the security chip.
  • the parameters of the virtual electronic card configured by the INSTALL command include the program identifier, the Unique Identifier (UID), SAK (English: Select Acknowledge, Chinese: Select Confirmation), ATQA ( English: Answer To request, Type A; Chinese: Type A reply request) and so on.
  • Step 205 The security chip receives the management request from the trusted mobile application.
  • the trusted mobile application installed on the terminal sends a management request for the target virtual electronic card to the security chip, and the on-chip operating system of the security chip receives the management request for the target virtual electronic card. Card management request.
  • the trusted mobile application can generate a management request for the target virtual electronic card in response to the user's trigger, and then transmit the generated management request to the security chip located on the same terminal.
  • the trusted mobile application may receive a management request for the target virtual electronic card from the trusted service management platform, and then forward the received management request to the security chip located on the same terminal.
  • Step 206 Determine the target card management program according to the management request.
  • the on-chip operating system of the security chip After receiving the management request, the on-chip operating system of the security chip firstly determines the virtual electronic card for which the received management request is directed, that is, determines which virtual electronic card the received management request is to manage. Since different card management programs are used to manage different virtual electronic cards, after receiving the management request for the target virtual electronic card, it is first necessary to determine the target card management program for managing the target virtual electronic card, and then the management request It is sent to the target card management program, and the target virtual electronic card is managed by the target card management program.
  • the target card management program for managing the target virtual electronic card may be determined in the following manner:
  • the card identifier of the target virtual electronic card to be managed will be appended to the management request. Therefore, the management request not only carries specific management instructions and corresponding management information, but also Carrying the card identification of the target virtual electronic card.
  • the on-chip operating system of the security chip obtains the target card identifier carried in the management request by parsing the management request.
  • S2 Determine the target program identifier matching the target card identifier according to the matching relationship between the program identifier registered in the registry and the card identifier.
  • a card identifier is allocated to the virtual electronic card, and a program identifier is also allocated to the card management program used to manage the virtual electronic card, Moreover, different virtual electronic cards correspond to different card identifiers, and different card management programs correspond to different program identifiers.
  • the matching relationship between the card identification and the program identification is recorded. If the card management program X is used to manage the virtual electronic card X, the program identification of the card management program X and the virtual electronic card X's program identification are recorded. Card ID, which is registered as a matching relationship in the registry of the on-chip operating system.
  • the on-chip operating system of the security chip After the on-chip operating system of the security chip obtains the target card identifier carried in the management request, it determines the matching relationship with the target card identifier according to the matching relationship between the program identifier and the card identifier registered in the registry of the on-chip operating system. program identifier, and then determine the determined program identifier as the target program identifier.
  • the on-chip operating system of the security chip determines the target program identifier, it determines a card management program corresponding to the target program identifier as the target management program, that is, the determined target card management program is used for the management request.
  • the target virtual electronic card is managed.
  • the target card management program can determine the type of the target virtual electronic card to manage according to the management request, and then call the corresponding card management command in the card management system to perform the corresponding type of the target virtual electronic card. management.
  • Step 207 The security chip invokes the card management command of the card management system through the target card management program to manage the target virtual electronic card.
  • the on-chip operating system After the on-chip operating system determines the target card management program for managing the target virtual electronic card, the on-chip operating system sends a management request to the target card management program. After the target card management program receives the management request, the target card management program invokes the card management command of the card management system in the security chip to manage the target virtual electronic card.
  • the on-chip operating system of the security chip may determine a card management program for managing the virtual electronic card targeted by the management request in the following manner:
  • the card management command of the card management system may be a personalization command, a deletion command, an activation command or a read-write command.
  • the personalization command is used to instruct the corresponding card management program to store the personalization data in the corresponding virtual electronic card.
  • the delete command is used to instruct the corresponding card management program to delete the corresponding virtual electronic card from the security chip.
  • the activation command is used to instruct the corresponding card management program to set the corresponding virtual electronic card to a contactless activation state.
  • the read-write command is used to instruct the corresponding card management program to read and write the content of the corresponding virtual electronic card.
  • the terminal can update the user's data to the virtual electronic card through the Global Platform's PERSONALIZATION and STORE DATA standard commands.
  • the on-chip operating system of the security chip receives the STORE DATA command (management request)
  • the on-chip operating system will transmit the STORE DATA command to the card management program with the corresponding program identifier.
  • the card management program After receiving the STORE DATA instruction, the card management program calls the personalized command in the card management system on the security chip through the Process data method, and stores the personalized data in the corresponding virtual electronic card.
  • the on-chip operating system of the security chip when the on-chip operating system of the security chip receives the DELETE instruction (management request), the on-chip operating system will transmit the DELETE instruction to the card management program with the corresponding program identifier.
  • the card management program invokes the delete command in the card management system on the security chip through the uninstall method to delete the virtual electronic card corresponding to the corresponding card ID, so as to release the storage space corresponding to the deleted virtual electronic card. Since the storage space allocated to each virtual electronic card by the on-chip operating system has an upper limit, the virtual electronic card storage space on the security chip can be reused by requesting to delete the virtual electronic card created on the security chip. In addition to deleting the virtual electronic card on the security chip, the installation package of the card management program stored on the security chip can also be deleted.
  • the terminal sets the contactless activation state of the virtual electronic card through the SET STATUS instruction of the CRS (English: Contactless Registry Service, Chinese: Contactless Registry Service) application of Global Platform.
  • the SET STATUS instruction is executed for a virtual electronic card, the virtual electronic card is normally activated, and the virtual electronic card can perform non-contact communication normally at this time.
  • the on-chip operating system of the security chip receives the SET STATUS instruction (management request)
  • the on-chip operating system will transmit the SET STATUS instruction to the card management program with the corresponding program identifier.
  • the card management program calls the activation command in the card management system on the security chip, and selects the virtual electronic card with the corresponding card identification for subsequent contactless communication.
  • the on-chip operating system of the security chip records the registration information of each card management program, and the contactless activation state of the virtual electronic card is stored in the registry of the on-chip operating system.
  • the on-chip operating system of the security chip allows multiple virtual electronic cards to be activated at the same time, just ensure that the installation parameters of each virtual electronic card do not conflict, but at the same time only with the trusted mobile application or the card management program selected by the contactless card reader A corresponding virtual electronic card communicates.
  • the installation parameters of the virtual electronic card include the UID.
  • the installation parameters of the virtual electronic card can set whether to perform conflict judgment. If the conflict judgment is required, when the on-chip operating system of the security chip calculates the conflict, the virtual electronic cards with the same UID cannot be activated at the same time.
  • the card management system on the security chip provides an interface
  • the terminal reads and writes the content of the virtual electronic card through the card management program
  • the instructions for reading and writing the content of the virtual electronic card are implemented in the Process method of the card management program.
  • the terminal selects the card management program through the standard SELECT command of Global Platform.
  • the selected card management program responds to the read and write APDU commands (management requests), and then the card management program calls the read and write commands in the card management system in the Process method.
  • the near field communication controller on the terminal can read the personalization data from the physical card, and the card management system can send the personalization data read by the near field communication controller to the computer on the terminal.
  • the trusted mobile application on the terminal can send the received personalized data to the trusted service management platform, and then the trusted service management platform can generate a management request including the personalized data.
  • the trusted mobile application on the terminal reads the personal data in the physical card through the near field communication controller, and then the trusted mobile application uploads the read personal data to the trusted service management platform through the terminal to manage the trusted service
  • the management platform sends the personalized data to the security chip through the trusted mobile application, and then the card management program newly installed in the security chip will store the personalized data in the newly created virtual electronic card to complete the personalized processing of the virtual electronic card .
  • the function of copying the physical card can be realized, and the physical access control card, points The card or the like is converted into a virtual electronic card on the terminal, which can improve the user experience.
  • the trusted service management platform may receive the personalization data uploaded by the second terminal, and then the trusted service management platform may generate a management request including the personalization data, and store the generated management request. The request is sent to the first terminal, where the first terminal and the second terminal are different terminals.
  • the management page of each virtual electronic card has a sub-interface that can be imported, and the sub-interface displays the personal data that can be imported on the trusted service management platform through a list.
  • the personalized data on the trusted service management platform can be downloaded to the terminal through the trusted mobile application.
  • the personalization data of the virtual electronic card in the security chip is uploaded to the trusted service management platform through the trusted mobile application for subsequent use in moving in.
  • the personal data of the virtual electronic card installed on the terminal can be uploaded to the trusted service management platform, and the personal data stored on the trusted service management platform can also be downloaded to the trusted mobile application.
  • the function of moving in and out of multiple virtual electronic cards between different mobile phones is realized, so that the user can migrate the virtual electronic card on the original mobile phone to the new mobile phone after changing the mobile phone, thereby further improving the user's use experience.
  • the card management program can not only manage the virtual electronic card based on the management request, but also participate in the contactless operation of the virtual electronic card.
  • the near field communication controller performs near field communication with the contactless card reader to generate a contactless operation command, the near field communication controller sends the contactless operation command to the security chip, and the security chip receives the contactless operation from the near field communication controller
  • the non-contact operation command is executed by the card management system on the security chip to read and write the target virtual electronic card, and the feedback information of the read and write operation of the target virtual electronic card is sent to the near field communication controller.
  • the contactless card reader can perform authentication operations, read operations and write operations on the virtual electronic card through NFC.
  • the card management system in the security chip can receive the non-contact operation command from the near field communication controller, and then the card management system can execute the received non-contact operation command, and will read and write the corresponding virtual electronic card.
  • the information is sent to the near field communication controller to ensure that each virtual electronic card on the terminal can normally perform non-contact operations, thereby ensuring the convenience and experience of the user's card swiping operation through the terminal.
  • the security chip after the security chip receives the contactless operation command from the near field communication controller, it can decrypt the contactless operation command through the serial peripheral interface SPI2, and then use the direct memory access (Direct Memory Access).
  • Memory Access, DMA) controller transmits the decrypted non-contact operation command to the memory of the security chip, and then the card management system on the security chip can execute the non-contact operation command in the memory.
  • the card management system performs read and write operations on the virtual electronic card
  • the feedback information of the read and write operations on the virtual electronic card is stored in the memory of the security chip, and then the feedback information in the memory of the security chip is transmitted through the DMA controller. into the register of the serial peripheral interface SPI2, then encrypt the feedback information through the serial peripheral interface SPI2, and then send the encrypted feedback information to the near field communication controller.
  • serial peripheral interface SPI2 Serial Peripheral Interface 2
  • the serial peripheral interface SPI2 not only has the function of data transmission It also has the function of encrypting and decrypting the data stream.
  • the security chip communicates with the near field communication controller through the serial peripheral interface SPI2, and the security chip can also communicate with other components in the first terminal through the serial peripheral interface SPI2, such as with the central processing unit of the first terminal ( Central Processing Unit, CPU) to communicate.
  • the DMA controller transmits the non-contact operation command decrypted by the serial peripheral interface SPI2 to the memory of the security chip, and also transmits the feedback information in the security chip to the register of the serial peripheral interface SPI2.
  • the memory of the security chip generally refers to The memory space of the security chip, the virtual electronic card, the card management program, the card management system and the on-chip operating system in the embodiments of the present application are all implemented in the memory of the security chip.
  • the non-contact communication of the virtual electronic card is carried out between the on-chip operating system and the operating system of the near field communication controller based on the SPI2 protocol.
  • the authentication, read and write commands of the virtual electronic card are encapsulated into the SPI2 command frame.
  • the on-chip operating system receives the non-contact operation command of the operating system of the near field communication controller, it is first encrypted and decrypted by SPI2 and then transferred to the DMA.
  • the DMA directly transfers the data to the memory of the security chip without going through the CPU, and then starts In the interrupt service routine, the card management system executes the non-contact operation command for processing the virtual electronic card, and performs a read operation or a write operation on the virtual electronic card.
  • the returned feedback information is directly transferred from the memory of the security chip to the register of SPI2 via DMA, and then sent to the operating system of the near field communication controller through the SPI2 encryption and decryption operation.
  • the data transmission between the near field communication controller and the security chip is carried out through DMA, and the DMA directly transfers the data to the memory of the security chip without going through the CPU, which can improve the processing speed of the non-contact operation command by the security chip and shorten the user's brushing of virtual electronic devices. Card waiting time, so it can improve the user experience.
  • the transmitted data is encrypted and decrypted through SPI2 to ensure that the data is in an encrypted state during the data transmission process and to ensure the security of the user when swiping the virtual electronic card.
  • the security chip obtains the installation package of the card management program from the trusted mobile application, and the trusted mobile application obtains the installation package of the card management program from the trusted service management platform, which corresponds to the purchase by the user.
  • the security chip is preset with one or more virtual electronic cards when it leaves the factory, and a card management program for managing the virtual electronic cards is preset. application scenarios.
  • FIG. 3 is a flowchart of a virtual electronic card management method provided by an embodiment of the present application. The method is applied to a security chip. Referring to FIG. 3 , the method includes the following steps:
  • Step 301 The security chip receives a download instruction from a preset device.
  • the security chip may receive a download instruction sent by the preset device, wherein the download instruction is used to instruct the security chip to download the installation package of the card management program from the preset device.
  • the preset device is used to issue download instructions to the security chip during the production stage of the security chip.
  • the preset device can be a notebook computer, an industrial computer, a portable device, or other devices with instruction issuance and data communication. After issuing download instructions, it can also be used as a debugging/testing tool in the chip production stage to debug and perform performance testing on the security chip.
  • the boot program of the security chip will program the on-chip operating system (Chip Operating System, COS), and the preset device can directly send the download to the on-chip operating system without going through the trusted service management platform. instruction.
  • COS Chip Operating System
  • Step 302 The security chip downloads the installation package of the card management program from the preset device according to the download instruction.
  • the security chip After the security chip receives the download instruction from the preset device, the security chip downloads the installation package of the card management program from the preset device.
  • Step 303 The security chip installs at least one card management program based on the obtained installation package.
  • the on-chip operating system of the security chip After the security chip downloads the installation package of the card management program from the preset device, the on-chip operating system of the security chip installs one or more card management programs on the security chip based on the downloaded installation package.
  • the number of card management programs installed on the security chip is determined by the number of virtual electronic cards that need to be preset on the security chip, because each virtual electronic card corresponds to a card management program, and different virtual electronic cards correspond to different card management programs .
  • Step 304 The card management program creates a virtual electronic card on the security chip.
  • the card management program can call the card creation command of the card management system on the security chip, the card management system executes the card creation command, and creates a virtual electronic card storage area on the security chip. Virtual electronic card.
  • Step 305 Register the matching relationship between the card management program and the virtual electronic card in the registry of the on-chip operating system.
  • steps 303-305 refer to the steps 202-204 in the foregoing embodiments, but the above-mentioned steps 303-305 are usually completed in the production stage of the security chip.
  • Step 306 The security chip sends the information of the virtual electronic card to the trusted mobile application on the terminal.
  • the trusted mobile application on the terminal acquires the information of each virtual electronic card preset on the security chip in response to the trigger of the user to obtain the preset virtual electronic card information, so as to facilitate the verification of the information on the security chip.
  • Each virtual electronic card and card management program are managed.
  • the security chip not only provides a program interface that can be called by a trusted mobile application, but also a preset interface that can be called by a preset device.
  • the trusted mobile application can send data to the security chip through the program interface, such as sending the installation package and management request of the card management program.
  • the preset device can send a download instruction to the security chip through the preset interface, and in response to the request of the security chip, send the installation package of the card management program to the security chip.
  • Step 307 The security chip receives the management request from the trusted mobile application.
  • Step 308 Determine the target card management program according to the management request.
  • Step 309 The security chip invokes the card management command of the card management system through the target card management program to manage the target virtual electronic card.
  • steps 307-309 refer to steps 205-207 in the foregoing embodiment.
  • the virtual electronic card can be managed multiple times through the card management program in the future. Management needs to perform the steps of installation package acquisition and card management program installation.
  • the card management system on the security chip can be implemented by C language
  • the card management program installed on the security chip can be implemented by Java.
  • FIG. 4 is a schematic diagram of a security chip provided by an embodiment of the present application.
  • the security chip 401 is located in the terminal and is connected to the memory 402 in the terminal.
  • the memory 402 stores instructions that can be executed by the security chip 401.
  • the instructions are executed by the security chip 401, so that the security chip 401 can execute the virtual electronic card management method provided by any of the above embodiments.
  • this embodiment is a device embodiment corresponding to the foregoing virtual electronic card management method embodiment, and this embodiment can be implemented in cooperation with the foregoing virtual electronic card management method embodiment.
  • the relevant technical details mentioned in the foregoing virtual electronic card management method embodiments are still valid in this embodiment, and are not repeated here in order to reduce repetition.
  • the relevant technical details mentioned in this embodiment can also be applied to the foregoing embodiments of the virtual electronic card management method.
  • FIG. 4 Another embodiment of the present application provides a terminal, see FIG. 4 , including: a security chip 401 , and a memory 402 connected to the security chip 401 .
  • the memory and the security chip are connected by a bus, and the bus may include any number of interconnected buses and bridges, and the bus connects one or more security chips and various circuits of the memory.
  • the bus may also connect together various other circuits, such as peripherals, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein.
  • the bus interface provides the interface between the bus and the transceiver.
  • a transceiver may be a single element or multiple elements, such as multiple receivers and transmitters, providing a means for communicating with various other devices over a transmission medium.
  • the data processed by the security chip is transmitted on the wireless medium through the antenna, and further, the antenna also receives the data and transmits the data to the security chip.
  • the security chip manages the bus and general processing, and can also provide various functions, including timing, peripheral interface, voltage regulation, power management, and other control functions. And memory can be used to store data that the security chip uses when performing operations.
  • Embodiments of the present application further provide a computer-readable medium, where a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the virtual electronic card management methods provided by the above embodiments are executed.
  • the aforementioned storage medium includes: U disk, mobile hard disk, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes .
  • FIG. 5 is a schematic diagram of a virtual electronic card management system provided by an embodiment of the present application.
  • the system includes: a security chip 501 and a trusted mobile application 502 provided by any of the above embodiments;
  • the trusted mobile application 502 is installed on the first terminal where the security chip 501 is located;
  • the trusted mobile application 502 is used to send a management request to the security chip 501, wherein the management request is used to instruct the card management program on the security chip 501 to manage the virtual electronic card on the security chip 501. for managing different virtual electronic cards.
  • At least one virtual electronic card is created on the security chip 501 , each virtual electronic card corresponds to a card management program on the security chip, and different virtual electronic cards correspond to different card management programs.
  • the trusted mobile application 502 on the terminal will send a management request to the security chip 501.
  • the card management program will call the security The card management command in the card management system on the chip 501 manages the virtual electronic card that needs to be managed.
  • each virtual electronic card Since the authority of each virtual electronic card is configured by the on-chip operating system of the security chip 501, and other management of each virtual electronic card can be implemented through the corresponding card management program, each virtual electronic card only needs to pass through one card The management program performs management, thereby reducing the occupation of the chip storage space by the card management program of the virtual electronic card.
  • the trusted mobile application 502 may generate a management request for the virtual electronic card on the security chip 501 in response to the user's operation, and send the generated management request to the security chip 501 .
  • the trusted mobile application 502 may also receive the management request, and send the received management request to the security chip 501 , for example, the trusted mobile application 502 may forward the management request from the cloud service to the security chip 501 .
  • the trusted mobile application 502 is a wallet-type application.
  • the trusted mobile application 502 can provide a human-computer interaction interface, so that the user can manage the virtual electronic card on the first terminal, and the user can “select” any one on the interface through the human-computer interaction interface provided by the trusted mobile application 502.
  • a virtual electronic card is opened, and the card management option is triggered, it means that the trusted mobile application initiates a management request, and the virtual electronic card that is "selected" is the target virtual electronic card.
  • the virtual electronic card management system may include a trusted service management platform 503 in addition to the security chip 501 and the trusted mobile application 502 .
  • the trusted mobile application 502 can send an acquisition instruction to the trusted service management platform 503. After receiving the acquisition instruction, the trusted service management platform 503 sends the installation package of the card management program to the trusted mobile application 502. The trusted mobile application 502 can send the received installation package to the security chip 501 .
  • the trusted mobile application 502 downloads the installation package of the card management program from the trusted service management platform 503 through the LOAD instruction of the Global Platform, and the installation package may be a CAP package.
  • different virtual electronic cards are created and managed through different card management programs, and different card management programs can be installed based on the same installation package.
  • the card management program creates and manages different virtual electronic cards. For example, different virtual electronic cards correspond to different card IDs. By associating different card IDs for different card management programs, different card management programs can create and manage different cards. virtual electronic card.
  • the installation package for installing the card management program is stored on the trusted service management platform 503, and the trusted service management platform 503 sends the installation package of the card management program to the trusted mobile application in response to the obtaining instruction of the trusted mobile application 502 502.
  • the installation package of the card management program is stored on the trusted service management platform 503, and the installation package of the card management program can be centrally managed and controlled.
  • the trusted service management platform 503 needs to be updated.
  • the installation package is convenient to manage the card management program.
  • the user can download the installation package of the card management program from the trusted service management platform 503 at any time, so as to create a virtual electronic card on the terminal, thereby improving the user's use experience.
  • the trusted service management platform 503 provides a system with functions such as application issuance management and security chip management, and is used to solve the storage of secure data and the issuance of applications. It contains SP-TSM (Service Provider) and SEI-TSM (Security Module Provider) two parts.
  • SEI-TSM is the TSM for security chip issuers, responsible for managing security chips, creating security domains, and managing domain keys.
  • SP-TSM is the service provider TSM responsible for managing services and managing data within assigned security domains.
  • the software implementation on TSM is mainly divided into the following two parts: download the installation package through SEI-TSM and instantiate one or more card management programs; personalize the content of a corresponding virtual electronic card through SP-TSM.
  • SEI-TSM is based on eSE for management, including security domain creation, key update, creation of auxiliary security domains, and information management and application management of SE chips.
  • the installation package of the card management program obtained from the service provider, download/installation/deletion/instantiation, etc. belong to the application management of SEI-TSM.
  • the SEI-TSM communicates with the terminal according to the HTTP protocol. After receiving the command, the terminal parses and encapsulates it into a frame format defined by the NFCC or eSE and forwards it to the NFCC or eSE for processing.
  • SP-TSM provides application issuance management, which is used to solve the data personalization management of virtual electronic cards.
  • the application personalization operation includes data such as the content information of the virtual electronic card.
  • the virtual electronic card inside the eSE can be personalized by sending a personalization instruction to the application through TSM.
  • the steps of personalization are: first, establish a secure channel and perform security authentication; then the personalization module organizes personalization data: including application information and keys; finally, the personalization module sends the personalization instruction to eSE.
  • the trusted mobile application 502 sends an acquisition instruction to the trusted service management platform 503 in response to the user's operation or the feedback from the security chip 501, and the trusted service management platform 503 generates an acquisition instruction in response to the received instruction.
  • management request, and issue the generated management request to the trusted mobile application 502 and the trusted mobile application 502 can send the received management request to the security chip 501, and the corresponding card management program on the security chip 501 can manage the request, and manage the corresponding virtual electronic card.
  • the virtual electronic card management system may include a preset device 504 in addition to the security chip 501 and the trusted mobile application 502 .
  • the preset device 504 may send a download instruction to the security chip 501 during the production stage of the security chip 501 , and the security chip 501 downloads the installation package of the card management program from the preset device 504 in response to the download instruction.
  • the preset device can also be used as a debugging/testing tool in the chip production stage to debug and perform performance testing of the security chip.
  • the preset device 504 may send a download instruction to the security chip 501 , so that the security chip 501 downloads the installation package of the card management program from the preset device 504 .
  • the security chip 501 downloads the installation package of the card management program, it can install the card management program based on the downloaded installation package, and create a virtual electronic card through the card management program, so that the virtual electronic card can be preset in the security chip 501 .
  • the user can use the virtual electronic card after configuring the security chip, which can improve the user experience and meet the individual needs of different terminal manufacturers. .
  • the security chip 501 is in the production stage of the factory, the boot program of the security chip 501 will program the on-chip operating system (Chip Operating System, COS), and the preset device 504 may not be managed by the trusted service
  • COS Chip Operating System
  • the platform 503 directly sends a download instruction to the on-chip operating system to download the installation package of the card management program to the security chip 501 .
  • the system may further include a near field communication controller 505 .
  • the near field communication controller 505, the security chip 501 and the trusted mobile application 502 are all located on the first terminal.
  • the near field communication controller 505 performs near field communication with the contactless card reader 506 to generate contactless operation commands, and the near field communication controls
  • the controller 505 sends the generated contactless operation command to the security chip 501 .
  • the security chip 501 performs read and write operations on the virtual electronic card based on the received contactless operation command, obtains feedback information of the read and write operations on the virtual electronic card, and sends the obtained feedback information to the contactless card reader 505.
  • the contact card reader 505 completes the corresponding subsequent processing of swiping the card according to the received feedback information.
  • the security chip 501 through the data interaction between the security chip 501 and the near field communication controller 505, the authentication, reading and writing operations of the virtual electronic card through NFC are realized, so that the user can swipe the virtual card in a non-contact way. Operation of electronic cards.
  • the contactless communication of the virtual electronic card in the security chip 501 is performed between the on-chip operating system of the security chip 501 and the operating system of the near field communication controller 505 based on the SPI2 protocol, and the authentication of the virtual electronic card , read and write commands are encapsulated into the command frame of SPI2.
  • the on-chip operating system receives the non-contact operation command of the operating system of the near field communication controller 505, it is first encrypted and decrypted by SPI2 and then transferred to the DMA.
  • the DMA directly transfers the data to the memory of the security chip without going through the CPU, and then Starting the interrupt service routine, the card management system executes the non-contact operation command for processing the virtual electronic card, and performs read or write operations on the virtual electronic card.
  • the returned feedback information is directly transferred from the memory of the security chip to the register of SPI2 via DMA, and then sent to the operating system of the near field communication controller 505 through the SPI2 encryption and decryption operation.
  • the near field communication controller 505 can read the personalization data from the physical card, and send the read personalization data to the card in the security chip 501 .
  • the management system the card management system may forward personalization data from the near field communication controller 505 to the trusted mobile application 502 .
  • the trusted mobile application 502 can send the personalization data from the security chip 501 to the trusted service management platform 503, and the trusted service management platform 503 generates a management request including the received personalization data, and sends the generated management request.
  • Sent to trusted mobile application 502 After the trusted mobile application 502 sends the management request from the trusted service management platform 503 to the security chip 501, the security chip 501 personalizes the virtual electronic card through the personalization data in the management request.
  • the near field communication controller 505 reads the personalization data in the physical card, and the personalization data is uploaded to the trusted service management platform 503 via the security chip 501 and the trusted mobile application 502,
  • the trusted service management platform 503 sends the management request including the personalized data to the security chip 501 through the trusted mobile application 502, and the security chip 501 stores the personalized data in the management request into the virtual electronic card, realizing the duplication of the physical card. It converts the physical access control card, loyalty card, etc. into a virtual electronic card on the terminal, which can improve the user experience.
  • the trusted service management platform 503 may receive personalized data from the second terminal, generate a management request including the received personalized data, and store all the personalized data.
  • the generated management request is sent to the trusted mobile application 502 .
  • the security chip 501 personalizes the virtual electronic card through the personalization data in the management request.
  • a trusted mobile application on one terminal can upload the personalized data of the virtual electronic card to the trusted service management platform, and the trusted service management platform can deliver the personalized data to another terminal,
  • the virtual electronic card can be moved in and out between different terminals, so that the user can migrate the virtual electronic card on the original mobile phone to the new mobile phone after changing the mobile phone, thereby further improving the user's use experience.
  • the trusted mobile application 502 provides a human-computer interaction interface for managing virtual electronic cards, and the trusted mobile application 502 can communicate with the near field communication controller 505, security Communication between the chip 501 and the trusted service management platform 503 .
  • the Android system architecture provides an open mobile application program interface (Open Mobile API, OMAPI) framework, an interface for reporting the virtual electronic card information read to the trusted service management platform 503, and an interface for receiving the message flow of the trusted service management platform 503 , to transmit the application protocol data unit (Application Protocol Data Unit, APDU) instruction to the interface of the card management program in the security chip 501.
  • OMAPI open mobile application program interface
  • APDU Application Protocol Data Unit
  • the trusted mobile application 502 accesses the background of the trusted service management platform 503 through the service interface of the trusted service management platform 503, obtains a list of available virtual electronic cards, and uses the obtained virtual electronic cards A list of electronic cards is displayed on the interface of the trusted mobile application 502 .
  • the trusted mobile application 502 interacts according to the defined instruction format through the service interface of the trusted service management platform 503 , so as to realize the installation of the virtual electronic card into the security chip 501 through the trusted service management platform 503 .
  • the trusted mobile application 502 will set the card management application of the virtual electronic card in the security chip 501 by sending a frame encapsulating the APDU command of the Global Platform be chosen.
  • the trusted mobile application 502 will also set the card management program to be activated by contactless activation through the GET STATUS instruction of the CRS application.
  • a virtual electronic card in the security chip 501 is selected by the card management program for contactless communication.
  • the function of moving in and out of multiple virtual electronic cards between different mobile phones The management page of each virtual electronic card in the trusted mobile application 502 has a sub-interface that can be imported, and the card data that can be imported on the trusted service management platform 503 is displayed in a list.
  • the data of a certain card on the trusted service management platform 503 is copied to the new mobile phone.
  • the virtual electronic card in the security chip 501 is copied to the trusted service management platform 503 through the trusted mobile application 502, and contains personalized data for subsequent moving in.
  • the trusted mobile application 502 reads the personalized data of the card through the near field communication controller 505 . Then, upload the background of the trusted service management platform 503 through the mobile phone, and then issue the security chip 501 to generate a new card management program and a virtual electronic card.
  • the operations in the on-chip operating system of the security chip are all controlled within the storage range limited by the system, and the on-chip operating system provides basic card application functions for each virtual electronic card interface and communication interface.
  • the on-chip operating system complies with the Global Platform and Java card specifications, and is compatible with contact and contactless smart card applications of different protocol types.
  • the on-chip operating system on the security chip 501 is used to implement the following processes: power management (power up/down, low power consumption management, etc.), message task processing mechanism, synchronization of system activity and communication, memory management (allocation, tearing prevention, etc.) , atomic write, resource recovery, etc.) and so on.
  • the security chip 501 can also implement the basic functions of the latest Java card 2.3.1 and Global Platform 2.3.1 OPEN.
  • a card manager is one or more Applets on OPEN.
  • the on-chip operating system will assign a YulaAppID (program identifier) to the card management program, and the YulaAppID will correspond to the card identifier of a virtual electronic card in the card management system.
  • the card management system in the security chip 501 supports the ISO/IEC 14443-3 A function, and the card management system realizes the contact and contactless data interaction functions of the virtual electronic card, including the memory of multiple virtual electronic cards. Management, UID allocation, RF authentication, read-write communication, etc.
  • the card management system is implemented by C language, and the card management program is implemented by Java, and they support mutual calls.
  • the communication module of the on-chip operating system communicates with the NFCC or the mobile communication device through the SPI bus, and realizes the reception and processing of the APDU command transmitted by the mobile communication device.
  • SPI2 and the stream encryption interface with CRYPTO1 the virtual electronic card and the card reader can perform RF communication, and the data exchange of CLT (Chinese: Contactless Tunnel, English: Contactless Tunnel) frame plaintext and ciphertext.
  • the entire process of starting and initializing the on-chip operating system until reaching the idle state is described below.
  • initialize the on-chip operating system including initialization of memory, clock, interrupt, peripherals, and operating system task message response mechanism, and check whether the card management system is enabled in the boot program of the on-chip operating system.
  • the operating system task message response mechanism is a multi-task operating system architecture with tasks as the smallest unit.
  • the on-chip operating system includes 1 system task, 2 application tasks, 2 I/O peripheral tasks, and 1 idle task.
  • the tasks can be set with different priorities, and high-priority tasks can be preempted and executed first.
  • the task will hang.
  • the card management program indirectly manages the virtual electronic card through the application general commands INTSALL, PERSONLIZATION, DELETE, etc. defined by the Global Platform specification.
  • the card management program supports private APDU commands, allowing the mobile communication device to perform read and write operations on the virtual electronic card.
  • the on-chip operating system can also perform functions of operating systems other than OPEN, such as memory supervision, rights management, and the like.
  • the on-chip operating system exchanges data with other chips through SPI and SPI2.
  • SPI2 includes the CRYPTO1 stream encryption function.
  • the contactless communication authentication of the virtual electronic card and the encryption and decryption of read and write instructions are directly processed in the interrupt of SPI2.
  • the trusted mobile application selects the CRS application in the eSE, and obtains the parameters of all virtual electronic cards installed in the security chip through the GET STATUS command of the CRS application, including contactless parameters such as ATQA, SAK, and UID. Then, the trusted mobile application calculates and merges the parameters of the virtual electronic card through the rules of intelligent routing. Finally, the trusted mobile application delivers the calculated parameters of the card to the NFCC.
  • intelligent routing when the number of virtual electronic cards is more than one, if the contactless parameters between the virtual electronic cards are in conflict (such as the same UID), the trusted mobile application will issue multiple sets of parameters to the operating system of the NFCC.
  • the trusted mobile application selects a virtual electronic card as the default card, and sends the parameters of the default card to the NFCC operating system.
  • the card parameters in the operating system of the NFCC are read to perform a non-contact card search operation.
  • the card with the UID is identified by the contactless card reader, if it is not an intelligent routing, it will directly interact with the virtual electronic card selected by default in the on-chip operating system; if it is an intelligent routing, the UID of the currently identified card will be used
  • AID program identifier
  • the operation of the virtual electronic card on the NFCC operating system must select the virtual electronic card through the existing system to ensure that the final contactless card reader can find the correct and unique in the on-chip operating system.
  • a virtual electronic card for data exchange must select the virtual electronic card through the existing system to ensure that the final contactless card reader can find the correct and unique in the on-chip operating system.
  • the virtual electronic card management methods and systems provided by the above embodiments can be used to manage Yula cards, and the Yula card application (Yula virtual card and card management program) supports the ISO14443-3 protocol and is in the frequency range of 13.56MHz. A working smart card application protocol with read/write capability.
  • the on-chip operating system of the security chip can be the Great Wall eSE chip operating system
  • the operating system of the NFCC can be Pyramid
  • the operating system task message response mechanism can be Event Driven Architecture (EDA).
  • EDA Event Driven Architecture

Landscapes

  • Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Theoretical Computer Science (AREA)
  • Accounting & Taxation (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Strategic Management (AREA)
  • General Business, Economics & Management (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Microelectronics & Electronic Packaging (AREA)
  • Software Systems (AREA)
  • Finance (AREA)
  • General Engineering & Computer Science (AREA)
  • Stored Programmes (AREA)
  • Storage Device Security (AREA)

Abstract

本申请提供了一种虚拟电子卡管理方法、系统及安全芯片、终端和存储介质，涉及近场通信技术领域。该虚拟电子卡管理方法应用于安全芯片，安全芯片安装在第一终端内，该方法包括：接收来自第一终端上的可信移动应用的管理请求，其中管理请求用于对安全芯片上的目标虚拟电子卡进行管理，虚拟电子卡的权限由安全芯片的片内操作系统配置；从安全芯片上确定与目标虚拟电子卡相对应的目标卡管理程序，其中不同的虚拟电子卡对应不同的卡管理程序；将管理请求发送给目标卡管理程序；通过目标卡管理程序，调用安全芯片上卡管理系统中与管理请求相对应的卡管理命令，对目标虚拟电子卡进行管理。本方案能够减少虚拟电子卡的卡管理程序对芯片存储空间的占用。

Description

虚拟电子卡管理方法、系统及安全芯片、终端和存储介质 技术领域
本申请涉及近场通信技术领域，特别涉及一种虚拟电子卡管理方法、系统及安全芯片、终端和存储介质。
背景技术
近场通信(Near Field Communication，NFC)技术，允许设备之间进行非接触式点对点数据传输。由于NFC具有较高的安全性，因此具备NFC功能的终端得到迅速发展。具备NFC功能的终端可以生成虚拟电子卡，进而通过终端与读卡器进行交互，便可以实现刷银行卡、刷公交卡或刷门禁卡等操作，由于无需携带实体卡片便能够实现刷卡操作，因此能够给用户带来较大的方便。
由于每个具备NFC功能的终端可以生成多个虚拟电子卡，在虚拟电子卡的生成、使用和删除过程中，需要通过卡管理程序对各虚拟电子卡进行管理。目前，对于每张虚拟电子卡，需要至少两个卡管理程序进行管理，其中至少一个卡管理程序用于管理虚拟电子卡的权限，至少一个卡管理程序用于管理虚拟电子卡内的程序。
对于相关技术中对虚拟电子卡进行管理的方法，由于每张虚拟电子卡均需要通过至少两个卡管理程序进行管理，因此用于对各虚拟电子卡进行管理的卡管理程序将占用芯片较大的存储空间，进而需要为终端配备具有较大存储空间的芯片，才能够满足用户在终端上使用和管理多个虚拟电子卡的需求，这将导致终端的成本上升。
发明内容
本申请实施例提供了一种虚拟电子卡管理方法、系统及安全芯片、终端和存储介质，能够减少虚拟电子卡的卡管理程序对芯片存储空间的占用。
第一方面，本申请实施例提供了一种虚拟电子卡管理方法，应用于安全芯片，所述安全芯片安装在第一终端内，所述方法包括：
接收来自所述第一终端上的可信移动应用的管理请求，其中，所述管理请求用于对所述安全芯片上的至少一个虚拟电子卡中的目标虚拟电子卡进行管理，所述虚拟电子卡的权限由所述安全芯片的片内操作系统配置；
从所述安全芯片上的至少一个卡管理程序中，确定与所述目标虚拟电子卡相对应的目标卡管理程序，其中，每个所述虚拟电子卡对应一个所述卡管理程序，不同的所述虚拟电子卡对应不同的所述卡管理程序；
将所述管理请求发送给所述目标卡管理程序；
通过所述目标卡管理程序，调用所述安全芯片上卡管理系统中与所述管理请求相对应的卡管理命令，对所述目标虚拟电子卡进行管理。
在第一种可能的实现方式中，结合上述第一方面，所述方法进一步包括创建所述目标虚拟电子卡，所述创建所述目标虚拟电子卡包括：
获取所述卡管理程序的安装包；
基于所述安装包，在所述安全芯片上安装所述目标卡管理程序；
通过所述目标卡管理程序，调用所述卡管理系统中的卡创建命令，在所述安全芯片上 创建所述目标虚拟电子卡。
在第二种可能的实现方式中，结合上述第一种可能的实现方式，所述获取所述卡管理程序的安装包，包括：
通过所述可信移动应用从可信服务管理平台获取所述安装包。
在第三种可能的实现方式中，结合上述第一种可能的实现方式，所述获取所述卡管理程序的安装包，包括：
在所述安全芯片的生产阶段，从预置设备下载所述安装包。
在第四种可能的实现方式中，结合上述第一方面，在所述安全芯片上创建所述目标虚拟电子卡之后，所述方法还包括：
为所述目标卡管理程序分配目标程序标识，其中，不同的所述卡管理程序对应不同的程序标识；
为所述目标虚拟电子卡分配目标卡标识，其中，不同的所述虚拟电子卡对应不同的卡标识；
在所述片内操作系统的注册表中注册所述目标程序标识与所述目标卡标识之间的匹配关系。
在第五种可能的实现方式中，结合上述第四种可能的实现方式，所述从所述安全芯片上的至少一个卡管理程序中，确定与所述目标虚拟电子卡相对应的目标卡管理程序，包括：
获取所述管理请求所携带的所述目标卡标识；
根据所述注册表中注册的所述程序标识与所述卡标识之间的匹配关系，确定与所述目标卡标识相匹配的所述目标程序标识；
将与所述目标程序标识相对应的所述卡管理程序，确定为与所述目标虚拟电子卡相对应的所述目标卡管理程序。
在第六种可能的实现方式中，结合上述第五种可能的实现方式，所述卡管理命令包括个人化命令、删除命令、激活命令或读写命令；
所述个人化命令用于指示所述目标卡管理程序，将所述管理请求携带的个人化数据存储到所述目标虚拟电子卡中；
所述删除命令用于指示所述目标卡管理程序，将所述目标虚拟电子卡删除；
所述激活命令用于指示所述目标卡管理程序，将所述目标虚拟电子卡设置为非接触激活状态；
所述读写命令用于指示所述目标卡管理程序，对所述目标虚拟电子卡的内容进行读写。
在第七种可能的实现方式中，结合上述第六种可能的实现方式，所述个人化数据由近场通信控制器从实体卡中读取，所述个人化数据由所述卡管理系统发送给所述可信移动应用，所述个人化数据由所述可信移动应用发送给可信服务管理平台，由所述可信服务管理平台生成包括所述个人化数据的所述管理请求，并由所述可信服务管理平台将所述管理请求发送给所述可信移动应用。
在第八种可能的实现方式中，结合上述第六种可能的实现方式，所述个人化数据由第二终端发送给所述可信服务管理平台，由所述可信服务管理平台生成包括所述个人化数据的所述管理请求，并由所述可信服务管理平台将所述管理请求发送给所述可信移动应用，其中所述第一终端与所述第二终端为不同的终端。
在第九种可能的实现方式中，结合上述第一方面，所述虚拟电子卡管理方法还包括：
接收来自近场通信控制器的非接触操作命令，其中，所述非接触操作命令根据所述近场通信控制器与非接触读卡器之间的近场通信生成；
通过所述卡管理系统执行所述非接触操作命令，对所述目标虚拟电子卡进行读写操作；
获取所述卡管理系统对所述目标虚拟电子卡进行读写操作后的反馈信息；
将所述反馈信息发送给所述近场通信控制器。
在第十种可能的实现方式中，结合上述第九种可能的实现方式，在所述接收来自近场 通信控制器的非接触操作命令之后，且在通过所述卡管理系统执行所述非接触操作命令之前，所述方法还包括：
通过串行外设接口SPI2对所述非接触操作命令进行解密处理；
通过直接存储器访问DMA控制器将经过解密处理的所述非接触操作命令传输到所述安全芯片的内存；
相应地，所述将所述反馈信息发送给所述近场通信控制器，包括：
通过所述直接存储器访问DMA控制器，将所述安全芯片的内存中的所述反馈信息传输到所述串行外设接口SPI2的寄存器中；
通过所述串行外设接口SPI2对所述反馈信息进行加密操作；
将经过加密操作的所述反馈信息发送给所述近场通信控制器。
在第十一种可能的实现方式中，结合上述第一方面或第一方面的任一可能的实现方式，所述卡管理系统通过C语言实现，所述卡管理程序通过Java实现。
第二方面，本申请实施例还提供了一种安全芯片，所述安全芯片位于终端内且与所述终端内的存储器连接，所述存储器存储有可被所述安全芯片执行的指令，所述指令被所述安全芯片执行，以使所述安全芯片能够执行上述第一方面及第一方面的任一可能的实现方式所提供的虚拟电子卡管理方法。
第三方面，本申请实施例还提供了一种终端，包括：上述第二方面所提供的安全芯片，以及与所述安全芯片连接的存储器。
第四方面，本申请实施例还提供了一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机程序，所述计算机程序被处理器执行时实现上述第一方面及第一方面的任一可能的实现方式所提供的虚拟电子卡管理方法。
第五方面，本申请实施例还提供了一种虚拟电子卡管理系统，包括：上述第二方面所提供的安全芯片和可信移动应用；
所述可信移动应用安装在所述安全芯片所在的第一终端；
所述可信移动应用，用于向所述安全芯片发送管理请求，其中，所述管理请求用于指示所述安全芯片上的卡管理程序，对所述安全芯片上的虚拟电子卡进行管理，不同的所述卡管理程序用于管理不同的所述虚拟电子卡。
在第一种可能的实现方式中，结合上述第五方面，所述虚拟电子卡管理系统还包括：可信服务管理平台；
所述可信移动应用，还用于向所述可信服务管理平台发送获取指令，其中，所述获取指令用于请求获取所述卡管理程序的安装包；
所述可信服务管理平台，用于根据所述获取指令，将所述安装包发送给所述可信移动应用；
所述可信移动应用，还用于将接收到的所述安装包发送给所述安全芯片。
在第二种可能的实现方式中，结合上述第五方面，所述虚拟电子卡管理系统还包括：预置设备；
所述预置设备，用于在所述安全芯片的生产阶段，向所述安全芯片发送下载指令，其中，所述下载指令用于指示所述安全芯片从所述预置设备下载所述卡管理程序的安装包。
在第三种可能的实现方式中，结合上述第一种可能的实现方式，所述虚拟电子卡管理系统还包括：近场通信控制器；
所述近场通信控制器设置在所述第一终端；
所述近场通信控制器，用于根据所述近场通信控制器与非接触读卡器之间的近场通信生成非接触操作命令，并将所述非接触操作命令发送给所述安全芯片；
所述近场通信管理器，还用于接收所述安全芯片执行所述非接触操作命令后的反馈信息，并通过近场通信将所述反馈信息发送给所述非接触读卡器。
在第四种可能的实现方式中，结合上述第三种可能的实现方式，
所述近场通信控制器，还用于从实体卡中读取个人化数据，并将读取到的个人化数据发送给所述可信移动应用；
所述可信移动应用，还用于将所接收到的所述个人化数据发送给所述可信服务管理平台；
所述可信服务管理平台，还用于生成包括所接收到的所述个人化数据的所述管理请求。
在第五种可能的实现方式中，结合上述第三种可能的实现方式，所述可信服务管理平台还用于接收来自第二终端的个人化数据，并生成包括所接收到的所述个人化数据的所述管理请求。
通过本申请实施例提供的虚拟电子卡管理方案，安全芯片上创建有至少一个虚拟电子卡，每个虚拟电子卡对应安全芯片上的一个卡管理程序，不同的虚拟电子卡对应不同的卡管理程序。当需要对一个虚拟电子卡进行管理时，接收来自安全芯片所在终端上的可信移动应用的管理请求，将管理请求发送给相对应的卡管理程序后，由卡管理程序调用安全芯片上卡管理系统中的卡管理命令，对需要进行管理的虚拟电子卡进行管理。由于多个虚拟电子卡的权限由安全芯片的片内操作系统配置，而对各个虚拟电子卡进行的其他管理均可通过相对应的卡管理程序实现，因此每个虚拟电子卡仅需通过一个卡管理程序进行管理，从而能够减少虚拟电子卡的卡管理程序对芯片存储空间的占用。
附图说明
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本申请实施例提供的一种虚拟电子卡管理方法的流程图；
图2是本申请实施例提供的另一种虚拟电子卡管理方法的流程图；
图3是本申请实施例提供的又一种虚拟电子卡管理方法的流程图；
图4是本申请实施例提供的一种终端的示意图；
图5是本申请实施例提供的一种虚拟电子卡管理系统的示意图；
图6是本申请实施例提供的另一种虚拟电子卡管理系统的示意图。
具体实施方式
为使本申请实施例的目的、技术方案和优点更加清楚，下面将结合附图对本申请的各实施方式进行详细的阐述。然而，本领域的普通技术人员可以理解，在本申请各实施方式中，为了使读者更好地理解本申请而提出了许多技术细节。但是，即使没有这些技术细节和基于以下各实施方式的种种变化和修改，也可以实现本申请所要求保护的技术方案。以下各个实施例的划分是为了描述方便，不应对本申请的具体实现方式构成任何限定，各个实施例在不矛盾的前提下可以相互结合相互引用。
本申请实施例提供一种虚拟电子卡管理方法，应用于安全芯片，该安全芯片可以是安全单元(Secure Element，SE)，更具体的可以是嵌入式安全单元(embedded Secure Element，eSE)。在具体实现中，安全芯片可以设置在终端内，终端可以为智能手机、智能手环、智能手表等电子设备。本申请实施例的应用场景可以为：用户对终端通过安全芯片所模拟出的虚拟电子卡进行管理，终端所模拟出的虚拟电子卡包括但不限于：银行卡、公交卡、门禁卡。下面对本申请实施例提供的虚拟电子卡管理方法的实现细节进行具体的说明，以下内容仅为方便理解提供的实现细节，并非实施本方案的必须。
在介绍本申请实施例之前，首先对手机终端模拟的虚拟电子卡进行简单介绍：
传统的各种智能卡，比如公交卡、银行卡、医保卡等，因为卡内含有芯片而能被各种 读卡器读取数据进行刷卡，而常见的用于智能卡的芯片有两大类，一类是接触式刷卡，比如常见的插卡POS机，另一类是非接触式刷卡，其内含有类似NFC一类的非接触式数据传输控制芯片(含配套天线)，比如常见的靠近读卡机刷卡的公交卡。将这些常见的实体卡片功能，通过手机终端来模拟，就称为虚拟电子卡，这时并没有实实在在的卡片存在，只是通过手机终端内添加卡片的相关信息或程序以“模拟”一张智能卡，这样同一个手机终端可以通过NFC芯片和安全元件的配合实现多种卡、多张卡的模拟，相当于在手机上安装了多张智能卡，其中可以简单理解为安全元件内存储了用于模拟多张卡片的信息，通过与其连接的NFC芯片与外部的读卡器进行信息交互，实现刷卡功能。通过这些“模拟卡”(虚拟电子卡)可以在不同场合使用同一个手机终端实现不同卡的刷卡认证、刷卡消费等行为。
图1是本申请实施例提供的一种虚拟电子卡管理方法的流程图，该方法应用于安全芯片，安全芯片安装在第一终端内，参见图1，该方法包括如下步骤：
步骤101：接收来自第一终端上的可信移动应用的管理请求，其中，管理请求用于对安全芯片上的至少一个虚拟电子卡中的目标虚拟电子卡进行管理，虚拟电子卡的权限由安全芯片的片内操作系统配置。
包括安全芯片的第一终端上安装有可信移动应用，安全芯片上创建有一个或多个虚拟电子卡，可信移动应用响应于用户对所选中虚拟电子卡的卡管理操作，向安全芯片发送管理请求，以对用户选中的虚拟电子卡进行管理。安全芯片上虚拟电子卡的权限由安全芯片的片内操作系统配置，片内操作系统可以执行OPEN(全球平台国际标准组织的功能)之外的操作系统功能，实现内存监管、权限管理等，从而实现对虚拟电子卡的权限配置。
可信移动应用可以提供人机交互界面，以便于用户对第一终端上的虚拟电子卡进行管理。在一个实例中，可信移动应用是钱包类应用程序。用户通过可信移动应用提供的人机交互界面，在其界面上“选中”任意一张虚拟电子卡，并触发卡管理选项，则表示可信移动应用发起了管理请求，被“选中”的虚拟电子卡即为目标虚拟电子卡。比如，可信移动应用提供的人机交互界面上展示有交通卡A、交通卡B和门禁卡共计三张虚拟电子卡，用户在人机交互界面上选中交通卡B后，用户触发人机交互界面上的“充值”按钮，此时可信移动应用会发起针对交通卡B的管理请求。
可信移动应用通过安卓系统架构提供的软件接口，可实现与近场通信控制器(Near Field Communication Controller，NFCC)、安全芯片和可信服务管理平台(Trusted Service Manager，TSM)之间的通信。安卓系统架构提供了开放移动应用程序接口(Open Mobile API，OMAPI)框架，提供可信服务管理平台上报所读取到虚拟电子卡信息的接口、接收可信服务管理平台的消息流的接口以及将应用协议数据单元(Application Protocol Data Unit，APDU)指令传输到安全芯片中卡管理程序的接口。
在一种可能的实现方式中，可信移动应用响应于用户卡选择操作和卡管理操作，生成针对目标虚拟电子卡的管理请求，并将所生成的管理请求发送给安全芯片。在另一种可能的实现方式中，可信移动应用响应于用户的操作或安全芯片的反馈，向可信服务管理平台上传数据，可信服务管理平台基于可信移动应用上传的数据生成管理请求，并将所生成的管理请求下发给可信移动应用，进而可信移动应用将所接收到的管理请求发送给安全芯片。
步骤102：从安全芯片上的至少一个卡管理程序中，确定与目标虚拟电子卡相对应的目标卡管理程序，其中，每个虚拟电子卡对应一个卡管理程序，不同的虚拟电子卡对应不同的卡管理程序。
安全芯片上创建有至少一个虚拟电子卡，针对每个虚拟电子卡在安全芯片上安装有相对应的卡管理程序，不同的虚拟电子卡对应不同的卡管理程序，卡管理程序用于对相对应的虚拟电子卡进行管理。在接收到针对目标虚拟电子卡的管理请求后，首先确定与目标虚拟电子卡相对应的目标卡管理程序，以使目标卡管理程序响应于管理请求，对目标虚拟电子卡进行管理。
步骤103：将管理请求发送给目标卡管理程序。
在确定出用于对目标虚拟电子卡进行管理的目标卡管理请求后，将针对目标虚拟电子卡的管理请求发送给目标卡管理程序。在一种可能的实现方式中，安全芯片的片内操作系统接收来自可信移动应用的管理请求，并将接收到的管理请求转发给目标卡管理程序。
步骤104：通过目标卡管理程序，调用安全芯片上卡管理系统中与管理请求相对应的卡管理命令，对目标虚拟电子卡进行管理。
安全芯片中部署有卡管理系统，卡管理系统提供多种用于对虚拟电子卡进行管理的卡管理命令。卡管理系统接收卡管理程序对卡管理命令的调用，执行被调用卡管理命令，实现对虚拟电子卡进行管理。
目标卡管理程序接收到管理请求后，根据管理请求调用卡管理系统中相对应的卡管理命令，使卡管理系统执行卡管理命令，以对目标虚拟电子卡进行管理。对目标虚拟电子卡的管理包括对目标虚拟电子卡进行个人化、删除目标虚拟电子卡、将目标虚拟电子卡激活、对目标虚拟电子卡进行读写等。其中，个人化是指向虚拟电子卡中写入个人化数据，使得虚拟电子卡实现银行卡、公交卡、门禁卡等卡片的功能，并可以基于所写入的个人化数据区分不同的虚拟电子卡，比如，对于某地的交通卡而言，向新创建的虚拟电子卡中写入卡号、充值金额、有效期等信息，使得该虚拟电子卡实现交通卡的功能，进而可以通过该虚拟电子卡刷卡乘车、乘地铁等。
本申请实施例提供的方案，安全芯片上创建有至少一个虚拟电子卡，每个虚拟电子卡对应安全芯片上的一个卡管理程序，不同的虚拟电子卡对应不同的卡管理程序。当需要对一个虚拟电子卡进行管理时，接收来自安全芯片所在终端上的可信移动应用的管理请求，将管理请求发送给相对应的卡管理程序后，由卡管理程序调用安全芯片上卡管理系统中的卡管理命令，对需要进行管理的虚拟电子卡进行管理。由于多个虚拟电子卡的权限由安全芯片的片内操作系统配置，而对各个虚拟电子卡进行的其他管理均可通过相对应的卡管理程序实现，因此每个虚拟电子卡仅需通过一个卡管理程序进行管理，从而能够减少虚拟电子卡的卡管理程序对芯片存储空间的占用。
可选地，在图1所示虚拟电子卡管理方法的基础上，安全芯片上的卡管理程序不仅可以用于对虚拟电子卡进行管理，还可以用于创建虚拟电子卡，为此在安全芯片上创建虚拟电子卡之前，首先需要在安全芯片上安装卡管理程序，而用户安装卡管理程序的安装包可以由不同的来源。下面以从可信服务管理平台和预置设备获取卡管理程序的安装包为例，对本申请实施例提供的虚拟电子卡管理方法进行详细说明。
图2是本申请实施例提供的一种虚拟电子卡管理方法的流程图，该方法应用于安全芯片，参见图2，该方法通过可信服务管理平台安装卡管理程序并通过可信移动应用管理虚拟电子卡，具体包括如下步骤：
步骤201：安全芯片接收来自可信移动应用的安装包。
当用户需要在终端上创建目标虚拟电子卡时，终端上所安装的可信移动应用响应于用户的操作，向可信服务管理平台发送获取指令，以从可信服务管理平台获取卡管理程序的安装包，进而可信移动应用可将获取到的安装包发送给终端上的安全芯片。比如，可信移动应用可以通过全球平台国际标准组织(Global Platform，GP)的LOAD指令实现安装包的下载，安装包可以为CAP包。
可信移动应用通过可信服务管理平台的服务接口，访问可信服务管理平台的后台，获取可用的虚拟电子卡列表，并将所获取到的可用的虚拟电子卡列表展示在人机交互界面上，用户从可用的虚拟电子卡列表中选取所需创建的目标虚拟电子卡，之后可信移动应用从可信服务管理平台获取卡管理程序的安装包，并将所获取到的安装包发送给安全芯片。
需要说明的是，不同的虚拟电子卡对应不同的卡管理程序，每张虚拟电子卡通过相对应的卡管理程序进行创建和管理，由于卡管理程序对虚拟电子卡进行管理的方式基本相同，因此不同的卡管理程序可以通过相同或不同的安装包进行安装。在一种可能的实现方式中，不同的卡管理程序通过通用的安装包安装，通过对不同的卡管理程序进行差异性配置，比如 在安全芯片的注册表中记录虚拟电子卡与卡管理程序的匹配关系，以实现不同的卡管理程序对不同的虚拟电子卡进行创建和管理。可信服务管理平台上存储的安装包可以由安全芯片的生产商上传。
另外需要说明的是，由于在同一个终端上可以创建多个虚拟电子卡，每个虚拟电子卡均需要通过相应的卡管理程序进行创建和管理，而不同的卡管理程序可以通过同一个安装包进行安装。因此，首次在终端上创建虚拟电子卡时，从可信服务管理平台获取卡管理程序的安装包，所获取到的安装包被存储在安全芯片中，后续再次在终端上创建虚拟电子卡时，可直接利用存储在安全芯片中的安装包安装卡管理程序。比如，A城市的交通卡A是在终端上创建的首张虚拟电子卡，在创建交通卡A时从可信服务管理平台获取卡管理程序的安装包，该安装包将被存储在终端内的安全芯片上，后续需要在该终端上创建B城市的交通卡B(虚拟电子卡)时，基于安全芯片上存储的安装包创建用于对交通卡B进行创建和管理的卡管理程序B，进而通过卡管理程序B在安全芯片上创建和管理交通卡B。
步骤202：安全芯片基于接收到的安装包，安装目标卡管理程序。
安全芯片的片内操作系统(Chip Operating System，COS)接收到卡管理程序的安装包后，片内操作系统调用安全芯片上卡管理系统的程序安装命令，以基于所获取到的安装包在安全芯片上安装目标卡管理程序。比如，片内操作系统在获取到卡管理程序的安装包后，终端首先通过安全算法(比如SCP02、SCP03)建立安全通道，之后终端执行Global Platform的INSTALL指令，片内操作系统收到INSTALL指令后，基于安装包在安全芯片中创建卡管理程序，将所创建的卡管理程序作为目标卡管理程序。
步骤203：目标卡管理程序在安全芯片上创建目标虚拟电子卡。
在安全芯片上安装目标卡管理程序之后，目标卡管理程序可调用安全芯片上卡管理系统的卡创建命令，卡管理系统执行卡创建命令，在安全芯片上的虚拟电子卡存储区创建目标虚拟电子卡。卡管理系统作为虚拟电子卡与卡管理程序之间的通信媒介，提供用于对虚拟电子卡进行创建和管理的命令，各个卡管理程序调用卡管理系统提供的命令，对各个虚拟电子卡进行管理。
步骤204：在片内操作系统的注册表中注册目标卡管理程序与目标虚拟电子卡之间的匹配关系。
在安全芯片上安装目标卡管理程序后，为目标卡管理程序分配目标程序标识，其中不同的卡管理程序对应不同程序标识。在安全芯片上创建目标虚拟电子卡后，为目标虚拟电子卡分配目标卡标识，其中不同的虚拟电子卡对应不同的卡标识。在获得目标程序标识和目标卡标识后，在安全芯片的片内操作系统的注册表中注册目标程序标识与目标卡标识职期间的匹配关系。
由于可以在安全芯片上创建多个虚拟电子卡，而不同的虚拟电子卡需要通过不同的卡管理程序进行管理，通过为每个虚拟电子卡分配卡标识，为每个卡管理程序分配程序标识，并在片内操作系统的注册表中注册卡标识与程序标识的匹配关系，当用户需要对其中一个虚拟电子卡进行管理时，片内操作系统可以根据注册表中卡标识与程序标识的匹配关系，确定出与待管理虚拟电子卡的卡标识相匹配的程序标识，进而根据所确定出的程序标识可以确定用于对待管理虚拟电子卡进行管理的卡管理程序，因此能够准确的对多个虚拟电子卡进行管理。
需要说明的是，片内操作系统通过INSTALL指令创建卡管理程序时，需要保证INSTALL指令配置的虚拟电子卡的参数不冲突，避免卡管理程序和虚拟电子卡安装失败，同时也避免后续进行非接触通信时出现失败的情况。INSTALL指令配置的虚拟电子卡的参数包括程序标识，以及非接触通信需要使用到的虚拟电子卡的统一标识号码(Unique Identifier，UID)、SAK(英文：Select Acknowledge，中文：选择确认)、ATQA(英文：Answer To request,Type A；中文：A类型答复请求)等。
步骤205：安全芯片接收来自可信移动应用的管理请求。
在需要对终端上所创建的目标虚拟电子卡进行管理时，终端上所安装的可信移动应用向安全芯片发送针对目标虚拟电子卡的管理请求，安全芯片的片内操作系统接收针对目标虚拟电子卡的管理请求。
可信移动应用可以响应于用户的触发，生成针对目标虚拟电子卡的管理请求，进而将所生成的管理请求传输给位于相同终端上的安全芯片。或者，可信移动应用可以接收来自可信服务管理平台针对目标虚拟电子卡的管理请求，进而将所接收到的管理请求转发给位于相同终端上的安全芯片。
步骤206：根据管理请求确定目标卡管理程序。
安全芯片的片内操作系统接收到管理请求后，首先确定所接收到管理请求针对的虚拟电子卡，即确定所接收到的管理请求要对哪一个虚拟电子卡进行管理。由于不同的卡管理程序用于管理不同的虚拟电子卡，在接收到针对目标虚拟电子卡的管理请求后，首先需要确定用于对目标虚拟电子卡进行管理的目标卡管理程序，进而将管理请求发送给目标卡管理程序，由目标卡管理程序对目标虚拟电子卡进行管理。在一种可能的实现方式中，可以通过如下方式确定用于对目标虚拟电子卡进行管理的目标卡管理程序：
S1：获取管理请求所携带的目标卡标识。
可信移动应用或可信服务管理平台生成管理请求时，会在管理请求中附加所要管理的目标虚拟电子卡的卡标识，因此管理请求不仅携带有具体的管理指令和相应的管理信息外，还携带有目标虚拟电子卡的卡标识。安全芯片的片内操作系统在接收到管理请求后，通过对管理请求进行解析，获得管理请求所携带的目标卡标识。
S2：根据注册表中注册的程序标识与卡标识之间的匹配关系，确定与目标卡标识相匹配的目标程序标识。
如上述步骤204所述，对于终端上所创建的每一个虚拟电子卡，为该虚拟电子卡分配有卡标识，同时还为用于对该虚拟电子卡进行管理的卡管理程序分配有程序标识，而且不同的虚拟电子卡对应有不同的卡标识，而且不同的卡管理程序对应有不同的程序标识。在片内操作系统的注册表中，记录有卡标识与程序标识的匹配关系，如果卡管理程序X用于对虚拟电子卡X进行管理，则卡管理程序X的程序标识与虚拟电子卡X的卡标识，在片内操作系统的注册表中被注册为匹配关系。
安全芯片的片内操作系统在获得管理请求所携带的目标卡标识后，根据在片内操作系统的注册表中注册的程序标识与卡标识之间的匹配关系，确定与目标卡标识相匹配的程序标识，进而将所确定出的程序标识确定为目标程序标识。
S3：根据目标程序标识，确定目标卡管理程序。
安全芯片的片内操作系统在确定出目标程序标识后，确定出与目标程序标识相对应的一个卡管理程序，作为目标管理程序，即所确定出的目标卡管理程序用于对管理请求所针对的目标虚拟电子卡进行管理。在确定出目标卡管理程序之后，目标卡管理程序便可以根据管理请求确定对目标虚拟电子卡进行管理的类型，进而调用卡管理系统中相应的卡管理命令，以对目标虚拟电子卡进行相应类型的管理。
步骤207：安全芯片通过目标卡管理程序，调用卡管理系统的卡管理命令，对目标虚拟电子卡进行管理。
在片内操作系统确定出用于对目标虚拟电子卡进行管理的目标卡管理程序后，片内操作系统将管理请求发送给目标卡管理程序。目标卡管理程序在接收到管理请求后，目标卡管理程序调用安全芯片中卡管理系统的卡管理命令，实现对目标虚拟电子卡进行管理。
在一种可能的实现方式中，对于接收到的管理请求，安全芯片的片内操作系统可以通过如下方式，确定用于对该管理请求所针对虚拟电子卡进行管理的卡管理程序：
在一种可能的实现方式中，卡管理系统的卡管理命令可以是个人化命令、删除命令、激活命令或读写命令。个人化命令用于指示相应的卡管理程序，将个人化数据存储到相应虚拟电子卡中。删除命令用于指示相应的卡管理程序，将相应的虚拟电子卡从安全芯片上删除。 激活命令用于指示相应的卡管理程序，将相应的虚拟电子卡设置为非接触激活状态。读写命令用于指示相应的卡管理程序，对相应虚拟电子卡的内容进行读写。
对于个人化命令：终端通过Global Platform的PERSONALIZATION和STORE DATA标准指令可以更新用户的数据到虚拟电子卡中。当安全芯片的片内操作系统接收到STORE DATA指令(管理请求)时，片内操作系统会将STORE DATA指令传输给具有相对应程序标识的卡管理程序。卡管理程序接收到STORE DATA指令后，通过Process data方法调用安全芯片上卡管理系统里的个人化命令，将个人化数据存储到相应虚拟电子卡中。
对于删除命令：当安全芯片的片内操作系统接收到DELETE指令(管理请求)时，片内操作系统会将DELETE指令传输给具有相对应程序标识的卡管理程序。卡管理程序接收到DELETE指令后，通过uninstall方法调用安全芯片上卡管理系统里的删除命令，将对应相应卡标识的虚拟电子卡删除，以释放对应被删除虚拟电子卡的存储空间。由于片内操作系统分配给各虚拟电子卡的存储空间存在上限，通过管理请求删除安全芯片上已创建的虚拟电子卡，可以实现安全芯片上虚拟电子卡存储空间的重复利用。除了可以删除安全芯片上的虚拟电子卡，还可以删除安全芯片上存储的卡管理程序的安装包。
对于激活命令：终端通过Global Platform的CRS(英文：Contactless Registry Service，中文：非接触注册表服务)应用的SET STATUS指令来设置虚拟电子卡的非接触激活状态。在针对一个虚拟电子卡执行SET STATUS指令后，该虚拟电子卡被正常激活，此时该虚拟电子卡可以正常进行非接触通信。当安全芯片的片内操作系统接收到SET STATUS指令(管理请求)时，片内操作系统会将SET STATUS指令传输给具有相对应程序标识的卡管理程序。卡管理程序接收到SET STATUS指令后，调用安全芯片上卡管理系统里的激活命令，选择具有相应卡标识的虚拟电子卡进行后续的非接触通信。
安全芯片的片内操作系统会记录每个卡管理程序的注册信息，虚拟电子卡的非接触激活状态存储在片内操作系统的注册表中。安全芯片的片内操作系统允许同时激活多张虚拟电子卡，只需确保各虚拟电子卡的安装参数不冲突，但同一时刻只会跟可信移动应用或非接触读卡器选择的卡管理程序相对应的一个虚拟电子卡进行通信。虚拟电子卡的安装参数包括UID。虚拟电子卡的安装参数可以设置是否进行冲突判断，如果设置了需要进行冲突判断，当安全芯片的片内操作系统计算出冲突后，使具有相同UID的虚拟电子卡不能被同时激活。
对于读写命令：安全芯片上的卡管理系统提供接口，终端通过卡管理程序读写虚拟电子卡的内容，对虚拟电子卡的内容进行读写的指令均在卡管理程序的Process方法中实现。终端通过Global Platform的标准SELECT指令，选择卡管理程序，被选择的卡管理程序响应于读写的APDU指令(管理请求)，之后卡管理程序在Process方法中调用卡管理系统中的读写命令，读写具有相应卡标识的虚拟电子卡。
在本申请实施例中，目标卡管理程序调用卡管理系统的个人化命令，对目标虚拟电子卡进行个人化处理时，由可信服务管理平台生成的管理请求中包括有个人化数据，个人化数据可以包括卡号、余额、刷卡记录等信息。管理请求中的个人化数据可以由第一终端上传至可信服务管理平台，也可以由与第一终端不同的第二终端上传至可信服务管理平台。
在一种可能的实现方式中，终端上的近场通信控制器可以从实体卡中读取个人化数据，卡管理系统可以将近场通信控制器读取到的个人化数据发送给终端上的可信移动应用，终端上的可信移动应用可以将接收到的个人化数据发送给可信服务管理平台，进而可信服务管理平台可以生成包括有个人化数据的管理请求。
终端上的可信移动应用通过近场通信控制器读取实体卡中的个人化数据，然后可信移动应用通过终端将读取到的个人化数据上传至可信服务管理平台，管理可信服务管理平台通过可信移动应用将个人化数据下发至安全芯片，进而安全芯片中新安装的卡管理程序会将个人化数据存储到新创建的虚拟电子卡中，完成虚拟电子卡的个人化处理。通过从实体卡读取个人化数据，将个人化数据上传至可信服务管理平台，再由可信服务管理平台下发至安全芯片，可以实现复制实体卡的功能，将实体的门禁卡、积分卡等转换为终端上的虚拟电子卡， 能够提高用户的使用体验。
在另一种可能的实现方式中，可信服务管理平台可以接收由第二终端上传的个人化数据，进而可信服务管理平台可以生成包括有个人化数据的管理请求，并将所生成的管理请求发送给第一终端，其中第一终端和第二终端为不同的终端。
在终端上的可信移动应用中，每个虚拟电子卡的管理页面都有一个可迁入的子界面，子界面中通过列表显示可信服务管理平台上可迁入的个人化数据。在迁入虚拟电子卡时，通过可信移动应用可以将可信服务管理平台上的个人化数据下载到终端。在迁出虚拟电子卡时，通过可信移动应用将安全芯片中的虚拟电子卡的个人化数据上传到可信服务管理平台，以供后续迁入时使用。
通过终端上的可信移动应用，可以将终端上所安装虚拟电子卡的个人化数据上传到可信服务管理平台，还可以将可信服务管理平台上存储的个人化数据下载可信移动应用，从而实现多张虚拟电子卡在不同手机之间的迁入迁出功能，使用户更换手机后可以将原手机上的虚拟电子卡迁移到新换的手机上，从而能够进一步提高用户的使用体验。
在本申请实施例中，卡管理程序除了可以基于管理请求对虚拟电子卡进行管理外，还可以参与虚拟电子卡的非接触操作。近场通信控制器与非接触读卡器进行近场通信生成非接触操作命令，近场通信控制器将非接触操作命令发送给安全芯片，安全芯片接收到来自近场通信控制器的非接触操作命令后，通过安全芯片上的卡管理系统执行非接触操作命令，以对目标虚拟电子卡进行读写操作，并将对目标虚拟电子卡进行读写操作的反馈信息发送给近场通信控制器。
当虚拟电子卡成功创建并激活后，非接触读卡器可以通过NFC方式对虚拟电子卡进行认证操作、读操作以及写操作。安全芯片中的卡管理系统可以接收来自近场通信控制器的非接触操作命令，之后卡管理系统可以执行所接收到的非接触操作命令，并将对相应虚拟电子卡进行读写操作后的反馈信息发送给近场通信控制器，保证终端上的各虚拟电子卡能够正常进行非接触操作，进而保证用户通过终端进行刷卡操作的方便性和体验。
在一种可能的实现方式中，安全芯片接收到来自近场通信控制器的非接触操作命令后，可以通过串行外设接口SPI2对非接触操作命令进行解密处理，之后通过直接存储器访问(Direct Memory Access，DMA)控制器，将经过解密处理的非接触操作命令传输到安全芯片的内存中，之后安全芯片上的卡管理系统可以对内存中的非接触操作命令进行执行。相应的，卡管理系统对虚拟电子卡进行读写操作后，将对虚拟电子卡进行读写操作的反馈信息存储到安全芯片的内存中，然后通过DMA控制器将安全芯片内存中的反馈信息传输到串行外设接口SPI2的寄存器中，然后通过串行外设接口SPI2对反馈信息进行加密操作，然后将经过加密操作的反馈信息发送给近场通信控制器。
需要说明的是，串行外设接口SPI2(Serial Peripheral Interface 2)是安全芯片中的硬件接口，相对于串行外设接口SPI(Serial Peripheral Interface)，串行外设接口SPI2不仅具有数据传输的功能，还具有对数据流进行加解密处理的功能。安全芯片通过串行外设接口SPI2与近场通信控制器进行通信，安全芯片通过串行外设接口SPI2还可以与第一终端中的其他部件进行通信，比如与第一终端的中央处理器(Central Processing Unit，CPU)进行通信。
DMA控制器将经串行外设接口SPI2解密处理的非接触操作命令输送到安全芯片的内存，还将安全芯片中的反馈信息输送到串行外设接口SPI2的寄存器，安全芯片的内存泛指安全芯片的内存空间，本申请实施例中的虚拟电子卡、卡管理程序、卡管理系统及片内操作系统均在安全芯片的内存中实现。
虚拟电子卡的非接触通信，在片内操作系统与近场通信控制器的操作系统之间基于SPI2协议进行，虚拟电子卡的认证、读、写指令被封装到SPI2的指令帧中。片内操作系统接收到近场通信控制器的操作系统的非接触操作命令后，首先由SPI2进行加解密操作后搬运到DMA中，DMA不经过CPU直接将数据搬运到安全芯片的内存，然后出发中断服务程序，卡管理系统执行处理虚拟电子卡的非接触操作命令，对虚拟电子卡进行读操作或写操作。对非 接触操作命令处理完成后，返回的反馈信息从安全芯片的内存直接经由DMA传送到SPI2的寄存器中，通过SPI2加解密操作后发送给近场通信控制器的操作系统。
近场通信控制器与安全芯片之间通过DMA进行数据传输，DMA不经过CPU直接将数据搬运到安全芯片的内存中，从而可以提高安全芯片对非接触操作命令的处理速度，缩短用户刷虚拟电子卡时的等待时间，因此可以提高用户的使用体验。近场通信控制器与安全芯片之间进行数据传输时，通过SPI2对所传输的数据进行加解密处理，保证数据传输过程中处于加密状态，保证用户刷虚拟电子卡时的安全性。
在图2所示的实施例中，安全芯片从可信移动应用获取卡管理程序的安装包，而可信移动应用从可信服务管理平台获取卡管理程序的安装包，此时对应于用户购买终端后在终端创建虚拟电子卡的应用场景。在另一些实施例中，安全芯片出厂时预置有一个或多个虚拟电子卡，并预置用于对虚拟电子卡进行管理的卡管理程序，此时对应于用户购买后直接配置虚拟电子卡的应用场景。图3是本申请实施例提供的一种虚拟电子卡管理方法的流程图，该方法应用于安全芯片，参见图3，该方法包括如下步骤：
步骤301：安全芯片接收来自预置设备的下载指令。
在安全芯片的生产阶段，安全芯片可以接收预置设备发送的下载指令，其中下载指令用于指示安全芯片从预置设备下载卡管理程序的安装包。预置设备用于在安全芯片的生产阶段向安全芯片下发下载指令，预置设备可以为笔记本电脑、工业电脑、便携式设备或其他具有指令下发及数据通信的设备，预置设备除了用于下发下载指令，还可以在芯片生产阶段用作调试/测试类工具对安全芯片进行调试和性能检测。
安全芯片在工厂生产阶段，安全芯片的引导(Boot)程序会烧写片内操作系统(Chip Operating System，COS)，预置设备可以不经过可信服务管理平台，直接向片内操作系统发送下载指令。
步骤302：安全芯片根据下载指令，从预置设备下载卡管理程序的安装包。
安全芯片接收到来自预置设备的下载指令后，安全芯片从预置设备下载卡管理程序的安装包。
步骤303：安全芯片基于获取到的安装包，安装至少一个卡管理程序。
安全芯片从预置设备下载卡管理程序的安装包后，安全芯片的片内操作系统基于所下载的安装包，在安全芯片上安装一个或多个卡管理程序。在安全芯片上安装卡管理程序的数量，由需要在安全芯片上预置虚拟电子卡的数量决定，因为每个虚拟电子卡对应一个卡管理程序，且不同的虚拟电子卡对应不同的卡管理程序。
步骤304：卡管理程序在安全芯片上创建虚拟电子卡。
对于在安全芯片上所安装的每一个卡管理程序，该卡管理程序可调用安全芯片上卡管理系统的卡创建命令，卡管理系统执行卡创建命令，在安全芯片上虚拟电子卡存储区创建一个虚拟电子卡。
步骤305：在片内操作系统的注册表中注册卡管理程序与虚拟电子卡之间的匹配关系。
需要说明的是，上述步骤303-305参考前述实施例中的步骤202-204，只是上述步骤303-305通常是在安全芯片的生产阶段完成的。
步骤306：安全芯片将虚拟电子卡的信息发送给终端上的可信移动应用。
安全芯片被安装到终端上之后，终端上的可信移动应用响应于用户获取预置虚拟电子卡信息的触发，获取安全芯片上预置的每个虚拟电子卡的信息，以便于对安全芯片上的各虚拟电子卡和卡管理程序进行管理。
需要说明的是，安全芯片不仅提供可被可信移动应用调用的程序接口，还提供可被预置设备调用的预置接口。可信移动应用通过程序接口，可以向安全芯片发送数据，比如发送卡管理程序的安装包和管理请求。预置设备通过预置接口，可以向安全芯片发送下载指令，并响应于安全芯片的请求，将卡管理程序的安装包发送给安全芯片。
步骤307：安全芯片接收来自可信移动应用的管理请求。
步骤308：根据管理请求确定目标卡管理程序。
步骤309：安全芯片通过目标卡管理程序，调用卡管理系统的卡管理命令，对目标虚拟电子卡进行管理。
需要说明的是，上述步骤307-309参考前述实施例中的步骤205-207。
另外需要说明的是，在安全芯片上安装卡管理程序，并通过卡管理程序创建虚拟电子卡后，后续便可以通过卡管理程序对虚拟电子卡进行多次管理，并非每次对虚拟电子卡进行管理都需要执行安装包获取和卡管理程序安装的步骤。
在上述各实施例的基础上，安全芯片上的卡管理系统可以通过C语言实现，而安装在安全芯片上的卡管理程序可以通过Java实现。
由于C语言和Java之间支持相互调用，而C语言相对于Java具有更快的运行速度，因此通过C语音实现安全芯片上的卡管理系统，可以提高对虚拟电子卡进行管理的效率，并可以继续沿用此前通过Java开发的卡管理程序，提高该虚拟电子卡管理方法的适用性。
图4是本申请实施例提供的一种安全芯片的示意图，参见图4，安全芯片401位于终端内，且与终端内的存储器402连接，存储器402中存储有可被安全芯片401执行的指令，所述指令被安全芯片401执行，以使安全芯片401能够执行上述任一实施例所提供的虚拟电子卡管理方法。
不难发现，本实施方式为与前述虚拟电子卡管理方法实施例相对应的装置实施例，本实施方式可与前述虚拟电子卡管理方法实施例互相配合实施。前述虚拟电子卡管理方法实施例提到的相关技术细节在本实施方式中依然有效，为了减少重复，这里不再赘述。相应地，本实施方式中提到的相关技术细节也可应用在前述虚拟电子卡管理方法实施例中。
本申请的另一个实施例提供了一种终端，参见图4，包括：安全芯片401，以及与安全芯片401连接的存储器402。
其中，存储器和安全芯片采用总线方式连接，总线可以包括任意数量的互联的总线和桥，总线将一个或多个安全芯片和存储器的各种电路连接在一起。总线还可以将诸如外围设备、稳压器和功率管理电路等之类的各种其他电路连接在一起，这些都是本领域所公知的，因此，本文不再对其进行进一步描述。总线接口在总线和收发机之间提供接口。收发机可以是一个元件，也可以是多个元件，比如多个接收器和发送器，提供用于在传输介质上与各种其他装置通信的单元。经安全芯片处理的数据通过天线在无线介质上进行传输，进一步，天线还接收数据并将数据传送给安全芯片。
安全芯片负责管理总线和通常的处理，还可以提供各种功能，包括定时，外围接口，电压调节、电源管理以及其他控制功能。而存储器可以被用于存储安全芯片在执行操作时所使用的数据。
本申请实施例还提供了一种计算机可读介质，所述计算机可读存储介质中存储有计算机程序，所述计算机程序被处理器执行时，执行上述各实施例提供的虚拟电子卡管理方法。
即，本领域技术人员可以理解，实现上述实施例方法中的全部或部分步骤是可以通过程序来指令相关的硬件来完成，该程序存储在一个存储介质中，包括若干指令用以使得一个设备(可以是单片机，芯片等)或处理器(processor)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
图5是本申请实施例提供的一种虚拟电子卡管理系统的示意图，参见图5，该系统包括：上述任一实施例所提供的安全芯片501和可信移动应用502；
可信移动应用502安装在安全芯片501所在的第一终端；
可信移动应用502，用于向安全芯片501发送管理请求，其中，管理请求用于指示安全芯片501上的卡管理程序，对安全芯片501上的虚拟电子卡进行管理，不同的卡管理程序用于管理不同的虚拟电子卡。
在本申请实施例中，安全芯片501上创建有至少一个虚拟电子卡，每个虚拟电子卡对应安全芯片上的一个卡管理程序，不同的虚拟电子卡对应不同的卡管理程序。当需要对一个虚拟电子卡进行管理时，终端上的可信移动应用502会向安全芯片501发送管理请求，安全芯片501将管理请求发送给相对应的卡管理程序后，由卡管理程序调用安全芯片501上卡管理系统中的卡管理命令，对需要进行管理的虚拟电子卡进行管理。由于各虚拟电子卡的权限由安全芯片501的片内操作系统配置，而对各个虚拟电子卡进行的其他管理均可通过相对应的卡管理程序实现，因此每个虚拟电子卡仅需通过一个卡管理程序进行管理，从而能够减少虚拟电子卡的卡管理程序对芯片存储空间的占用。
可信移动应用502可以响应于用户的操作，生成针对安全芯片501上虚拟电子卡的管理请求，并将所生成的管理请求发送给安全芯片501。可信移动应用502还可以接收管理请求，并将接收到的管理请求发送给安全芯片501，比如可信移动应用502可以将来自云端服务的管理请求转发给安全芯片501。
在一种可能的实现方式中，可信移动应用502是钱包类应用程序。可信移动应用502可提供人机交互界面，以便于用户对第一终端上的虚拟电子卡进行管理，用户通过可信移动应用502提供的人机交互界面，在其界面上“选中”任意一张虚拟电子卡，并触发卡管理选项，则表示可信移动应用发起了管理请求，被“选中”的虚拟电子卡即为目标虚拟电子卡。
可选地，参见图5所示的虚拟电子卡管理系统，该虚拟电子卡管理系统除了包括安全芯片501和可信移动应用502之外，还可以包括可信服务管理平台503。可信移动应用502可以向可信服务管理平台503发送获取指令，可信服务管理平台503在接收到该获取指令后，将卡管理程序的安装包发送给可信移动应用502，可信移动应用502则可以将接收到的安装包发送给安全芯片501。
在一种可能的实现方式中，可信移动应用502通过Global Platform的LOAD指令从可信服务管理平台503下载卡管理程序的安装包，该安装包可以为CAP包。
在本申请实施例中，不同的虚拟电子卡通过不同的卡管理程序进行创建和管理，不同的卡管理程序可以基于同一个安装包进行安装，通过对卡管理程序进行差异化配置，使得不同的卡管理程序对不同的虚拟电子卡进行创建和管理，比如不同的虚拟电子卡对应有不同的卡标识，通过为不同的卡管理程序关联不同的卡标识，使得不同的卡管理程序创建和管理不同的虚拟电子卡。用于安装卡管理程序的安装包存储在可信服务管理平台503上，可信服务管理平台503响应于可信移动应用502的获取指令，将卡管理程序的安装包下发给可信移动应用502。将卡管理程序的安装包存储在可信服务管理平台503上，可以对卡管理程序的安装包进行集中管控，当需要对卡管理程序进行更新时，仅需更新可信服务管理平台503上的安装包，方便对卡管理程序进行管理。另外，用户在使用终端过程中，可以随时从可信服务管理平台503上下载卡管理程序的安装包，以实现在终端上创建虚拟电子卡，从而可以提高用户的使用体验。
需要说明的是，可信服务管理平台503提供应用发行管理和安全芯片管理等功能的系统，用于解决对安全数据的存储及应用的发行。它包含SP-TSM(服务提供商)与SEI-TSM(安全模块提供商)两个部分。SEI-TSM是安全芯片发行商的TSM，负责管理安全芯片，创建安全域和管理域密钥。SP-TSM是服务提供商TSM，负责管理服务和在分配的安全域内管理数据。TSM上的软件实现，主要分为下面二个部分：通过SEI-TSM下载安装包，并实例化一个或者多个卡管理程序；通过SP-TSM个人化对应的一张虚拟电子卡内容。
SEI-TSM是基于eSE进行管理，包括安全域创建，密钥更新，辅助安全域的创建，以及SE芯片的信息管理和应用管理。其中，从服务提供商处获得的卡管理程序的安装包，下载/安装/删除/实例化等就属于SEI-TSM的应用管理。SEI-TSM按照HTTP协议和终端进行通信。终端收到指令过后解析封装成NFCC或者eSE定义的帧格式转发到NFCC或者eSE进行处理。
SP-TSM提供应用发行管理，用于解决对虚拟电子卡的数据个人化管理。应用个人化 操作，包括信息为虚拟电子卡的内容信息等数据。卡管理程序通过SEI-TSM安装成功过后，即可以通过TSM发送给应用个人化指令对eSE内部的虚拟电子卡进行个人化。个人化的步骤是，首先，建立安全通道，进行安全认证；然后个人化模块组织个人化数据：包括应用信息，密钥；最后，个人化模块将，个人化指令发送给eSE。
在本申请实施例中，可信移动应用502响应于用户的操作或安全芯片501的反馈，向可信服务管理平台503发送获取指令，可信服务管理平台503响应于所接收到的获取指令生成管理请求，并将所生成的管理请求下发给可信移动应用502，可信移动应用502则可以将所接收到的管理请求发送给安全芯片501，安全芯片501上相应的卡管理程序根据管理请求，对相对应的虚拟电子卡进行管理。
可选地，参见图6所示的虚拟电子卡管理系统，该虚拟电子卡管理系统除了包括安全芯片501和可信移动应用502之外，还可以包括预置设备504。预置设备504可以在安全芯片501的生产阶段，向安全芯片501发送下载指令，安全芯片501响应于该下载指令，从预置设备504下载卡管理程序的安装包。预置设备除了用于下发下载指令，还可以在芯片生产阶段用作调试/测试类工具对安全芯片进行调试和性能检测。
在本申请实施例中，安全芯片501在工厂生产阶段，预置设备504可以向安全芯片501发送下载指令，使得安全芯片501从预置设备504上下载卡管理程序的安装包。安全芯片501下载卡管理程序的安装包后，可以基于所下载的安装包安装卡管理程序，并通过卡管理程序创建虚拟电子卡，从而实现在安全芯片501中预置虚拟电子卡。当终端中的安全芯片中预置有虚拟电子卡时，用户对安全芯片中的虚拟电子卡进行配置后便可以使用，可以提升用户的使用体验，而且也可以满足不同终端生产厂商的个性化需求。
在本申请实施例中，安全芯片501在工厂生产阶段，安全芯片501的引导(Boot)程序会烧写片内操作系统(Chip Operating System，COS)，预置设备504可以不经过可信服务管理平台503，直接向片内操作系统发送下载指令，实现将卡管理程序的安装包下载到安全芯片501中。
可选地，参见图5所示的虚拟电子卡管理系统，该系统还可以包括近场通信控制器505。近场通信控制器505与安全芯片501和可信移动应用502均位于第一终端上，近场通信控制器505与非接触读卡器506进行近场通信生成非接触操作命令，近场通信控制器505将所生成的非接触操作命令发送给安全芯片501。安全芯片501基于接收到的非接触操作命令对虚拟电子卡进行读写操作，获得对虚拟电子卡进行读写操作的反馈信息，并将所获得的反馈信息发送给非接触读卡器505，非接触读卡器505根据接收到的反馈信息完成相应的刷卡后续处理。
在本申请实施例中，通过安全芯片501与近场通信控制器505之间的数据交互，实现了通过NFC方式对虚拟电子卡进行认证、读、写操作，从而实现用户通过非接触方式刷虚拟电子卡的操作。
在本申请实施例中，安全芯片501中虚拟电子卡的非接触通信，在安全芯片501的片内操作系统与近场通信控制器505的操作系统之间基于SPI2协议进行，虚拟电子卡的认证、读、写指令被封装到SPI2的指令帧中。片内操作系统接收到近场通信控制器505的操作系统的非接触操作命令后，首先由SPI2进行加解密操作后搬运到DMA中，DMA不经过CPU直接将数据搬运到安全芯片的内存，然后出发中断服务程序，卡管理系统执行处理虚拟电子卡的非接触操作命令，对虚拟电子卡进行读操作或写操作。对非接触操作命令处理完成后，返回的反馈信息从安全芯片的内存直接经由DMA传送到SPI2的寄存器中，通过SPI2加解密操作后发送给近场通信控制器505的操作系统。
可选地，参见图5所示的虚拟电子卡管理系统，近场通信控制器505可以从实体卡中读取个人化数据，并将读取到的个人化数据发送给安全芯片501中的卡管理系统，卡管理系统可以将来自近场通信控制器505的个人化数据转发给可信移动应用502。可信移动应用502可以将来自安全芯片501的个人化数据发送给可信服务管理平台503，可信服务管理平台503 生成包括有所接收到个人化数据的管理请求，并将所生成的管理请求发送给可信移动应用502。可信移动应用502将来自可信服务管理平台503的管理请求发送给安全芯片501后，安全芯片501通过管理请求中的个人化数据对虚拟电子卡进行个人化处理。
在本申请实施例中，近场通信控制器505读取实体卡中的个人化数据，个人化数据经由安全芯片501和可信移动应用502上传到可信服务管理平台503，
可信服务管理平台503通过可信移动应用502将包括有个人化数据的管理请求发给安全芯片501，安全芯片501将管理请求中的个人化数据存储到虚拟电子卡中，实现了复制实体卡的功能，将实体的门禁卡、积分卡等转换为终端上的虚拟电子卡，能够提高用户的使用体验。
可选地，在图5所述虚拟电子卡管理系统的基础上，可信服务管理平台503可以接收来自第二终端的个人化数据，生成包括所接收到个人化数据的管理请求，并将所生成的管理请求发送给可信移动应用502。可信移动应用502将来自可信服务管理平台503的管理请求发送给安全芯片501后，安全芯片501通过管理请求中的个人化数据对虚拟电子卡进行个人化处理。
在本申请实施例中，一个终端上的可信移动应用可将虚拟电子卡的个人化数据上传到可信服务管理平台，可信服务管理平台可将该个人化数据下发给另一个终端，从而实现虚拟电子卡在不同终端之间的迁入和迁出，使用户更换手机后可以将原手机上的虚拟电子卡迁移到新换的手机上，从而能够进一步提高用户的使用体验。
在本申请实施例中，可信移动应用502提供对虚拟电子卡进行管理的人机交互界面，可信移动应用502通过安卓系统架构提供的软件接口，可实现与近场通信控制器505、安全芯片501和可信服务管理平台503之间的通信。安卓系统架构提供了开放移动应用程序接口(Open Mobile API，OMAPI)框架，对可信服务管理平台503上报所读取到虚拟电子卡信息的接口，接收可信服务管理平台503的消息流的接口，将应用协议数据单元(Application Protocol Data Unit，APDU)指令传输到安全芯片501中卡管理程序的接口。可信移动应用502可实现的功能包括：
(1)获取已发布应用列表：可信移动应用502通过可信服务管理平台503的服务接口，访问可信服务管理平台503的后台，获取可用虚拟电子卡的列表，并将所获取到的虚拟电子卡的列表显示在可信移动应用502的界面上。
(2)下载安装卡管理程序到安全芯片501(即空中开卡OTA)，或者删除安全芯片501中的已安装的卡管理应用等。可信移动应用502通过可信服务管理平台503的服务接口，根据定义的指令格式进行交互，实现虚拟电子卡通过可信服务管理平台503安装到安全芯片501中。
(3)设置默认卡管理程序，实现离线刷卡等用户刷卡功能。用户通过可信移动应用502的界面，选择一张虚拟电子卡后，可信移动应用502会通过发送封装了Global Platform的APDU指令的帧，设置安全芯片501中该张虚拟电子卡的卡管理应用被选择。同时，如果该张虚拟电子卡没有非接激活，可信移动应用502还会通过CRS应用的GET STATUS指令设置卡管理程序为非接激活。最后，通过卡管理程序选择安全芯片501中的一个虚拟电子卡进行非接触通信。
(4)多虚拟电子卡在不同手机之间迁入迁出功能。可信移动应用502中每张虚拟电子卡的管理页面都有一个可迁入的子界面，里面列表显示可信服务管理平台503上可迁入的卡片数据。迁入虚拟电子卡时,首先通过可信移动应用502，将可信服务管理平台503上的某张卡的数据复制到新手机。迁出时，安全芯片501中的虚拟电子卡通过可信移动应用502复制到可信服务管理平台503，包含个人化数据，供后续迁入使用。
(5)复制实体卡的功能，复制现有的实体门禁卡，积分卡等，转换成虚拟电子卡。复制一张实体门禁卡到安全芯片501中，首先可信移动应用502通过近场通信控制器505读取卡片的个人化数据。然后，通过手机上传可信服务管理平台503的后台，再下发安全芯片 501生成新卡管理程序和虚拟电子卡。
在本申请实施例中，参见图5和图6，安全芯片的片内操作系统中的操作都被控制在系统限定的存储范围内，片内操作系统为每个虚拟电子卡提供基本卡应用功能接口和通信接口。片内操作系统满足Global Platform和Java card规范，并且兼容不同协议类型的接触和非接触智能卡应用。
安全芯片501上的片内操作系统用于实现如下处理：电源管理(上/掉电，低功耗管理等)、消息任务处理机制、系统活动与通信的同步、内存管理(分配，防撕裂，原子写，资源回收等)等。安全芯片501还可以实现最新Java card 2.3.1和Global Platform 2.3.1 OPEN的基本功能。卡管理程序是OPEN上面的一个或者多个Applets。片内操作系统会给卡管理程序分配YulaAppID(程序标识)，YulaAppID会对应到卡管理系统里面的一个虚拟电子卡的卡标识。
在本申请实施例中，安全芯片501中的卡管理系统，支持ISO/IEC 14443-3 A功能，卡管理系统实现了虚拟电子卡接触和非接触的数据交互功能，包括多虚拟电子卡的内存管理、UID分配、RF认证、读写通信等。卡管理系统通过C语言实现，而卡管理程序通过Java实现，两者之间支持互相调用。
片内操作系统的通信模块，通过SPI总线与NFCC或者移动通信设备进行通信，实现了移动通信设备传输APDU指令的接收和处理。通过SPI2和带有CRYPTO1流加密接口，实现虚拟电子卡与读卡器进行RF通信，进行CLT(中文：非接触通道，英文：Contactless Tunnel)帧明文和密文的数据交换。
下面对片内操作系统的启动和初始化，直至达到空闲状态为止的整个过程进行说明。首先，安全芯片上电后先初始化片内操作系统，包括内存、时钟、中断、外设以及操作系统任务消息响应机制的初始化，并检测片内操作系统的boot程序中配置是否使能卡管理系统，及使能过后占用的RAM、ROM、NVM的初始化，对比虚拟电子卡的状态进行初始化。操作系统任务消息响应机制是以任务为最小单位的多任务操作系统架构。片内操作系统里面包括1个系统任务、2个应用任务、2个输入输出外设任务和1个空闲任务，任务可以设置不同的优先级，支持高优先级的任务抢占优先执行，被抢占的任务会挂起。然后，卡管理程序通过Global Platform规范定义的应用通用命令INTSALL、PERSONLIZATION、DELETE等来间接管理虚拟电子卡。同时，卡管理程序支持私有的APDU指令，允许移动通信设备对虚拟电子卡进行读、写操作。除了上述功能外，片内操作系统还可以执行OPEN以外的操作系统的功能，如内存监管、权限管理等。最后，片内操作系统通过SPI和SPI2跟其它芯片进行数据交换，其中SPI和SPI2的主要区别在于，SPI2由于包含了CRYPTO1流加密功能。在SPI2的中断里面直接处理虚拟电子卡的非接触通信认证、读写指令的加解密。
在本申请实施例中，可信移动应用选择到eSE里的CRS应用，通过CRS应用的GET STATUS命令获取安全芯片中安装的所有虚拟电子卡的参数，包括ATQA、SAK、UID等非接参数。然后，可信移动应用经过智能路由的规则计算合并虚拟电子卡的参数。最后，可信移动应用下发计算后的卡的参数到NFCC。在智能路由的情况下，当虚拟电子卡的个数多于1张时，如果虚拟电子卡之间的非接参数是有冲突的(如UID相同)，可信移动应用会下发多套参数到NFCC的操作系统。在非智能路由的情况下，可信移动应用选择一张虚拟电子卡为默认卡，下发这张默认卡的参数到NFCC的操作系统。
当非接触读卡器进行读卡时，首先，读取NFCC的操作系统中的卡参数进行非接触的寻卡操作。当确定UID的卡被非接触读卡器识别后，如果不是智能路由，直接跟片内操作系统中默认选择的虚拟电子卡进行数据交互；如果是智能路由，则根据当前的识别的卡的UID和对应的卡管理程序的AID(程序标识)之间的映射关系，选择片内操作系统中对应的虚拟电子卡进行通信。
在NFCC的操作系统上对虚拟电子卡的操作，无论是否为智能路由，都要通过现有系统选择到虚拟电子卡，确保最终非接触读卡器在片内操作系统里能找到正确且唯一的一张虚 拟电子卡进行数据交换。
需要说明的是，上述各实施例提供的虚拟电子卡管理方法和系统，可用于管理Yula卡，Yula卡应用(Yula虚拟卡和卡管理程序)是支持ISO14443-3协议，在13.56MHz频率范围中工作的具有读/写能力的智能卡应用协议。相对应的，通过上述实施例提供的方法或相同对Yula卡进行管理时，安全芯片的片内操作系统可以是Great Wall eSE芯片操作系统，NFCC的操作系统可以为Pyramid，操作系统任务消息响应机制可以是Event Driven Architecture(EDA)。
需要说明的是，上述虚拟电子卡管理系统实施例与前述虚拟电子卡管理方法实施例基于相同构思，系统实施例中各部分之间的交互可参见前述方法实施例中的描述，在此不再进行赘述。
最后需要说明的是，以上实施例仅用于说明本申请实施例的技术方案，而非对其限制。尽管参照前述实施例对本申请实施例进行了详细的说明，本领域的普通技术人员应当理解，其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换，而这些修改或者替换，并不是相应技术方案的本质脱离本申请各实施例技术方案的精神和范围。

Claims (20)

  1. 一种虚拟电子卡管理方法，应用于安全芯片，所述安全芯片安装在第一终端内，所述方法包括：
    接收来自所述第一终端上的可信移动应用的管理请求，其中，所述管理请求用于对所述安全芯片上的至少一个虚拟电子卡中的目标虚拟电子卡进行管理，所述虚拟电子卡的权限由所述安全芯片的片内操作系统配置；
    从所述安全芯片上的至少一个卡管理程序中，确定与所述目标虚拟电子卡相对应的目标卡管理程序，其中，每个所述虚拟电子卡对应一个所述卡管理程序，不同的所述虚拟电子卡对应不同的所述卡管理程序；
    将所述管理请求发送给所述目标卡管理程序；
    通过所述目标卡管理程序，调用所述安全芯片上卡管理系统中与所述管理请求相对应的卡管理命令，对所述目标虚拟电子卡进行管理。
  2. 根据权利要求1所述的方法，其中，进一步包括创建所述目标虚拟电子卡，所述创建所述目标虚拟电子卡包括：
    获取所述卡管理程序的安装包；
    基于所述安装包，在所述安全芯片上安装所述目标卡管理程序；
    通过所述目标卡管理程序，调用所述卡管理系统中的卡创建命令，在所述安全芯片上创建所述目标虚拟电子卡。
  3. 根据权利要求2所述的方法，其中，所述获取所述卡管理程序的安装包，包括：
    通过所述可信移动应用从可信服务管理平台获取所述安装包。
  4. 根据权利要求2所述的方法，其中，所述获取所述卡管理程序的安装包，包括：
    在所述安全芯片的生产阶段，从预置设备下载所述安装包。
  5. 根据权利要求1所述的方法，其中，所述方法还包括：
    为所述目标卡管理程序分配目标程序标识，其中，不同的所述卡管理程序对应不同的程序标识；
    为所述目标虚拟电子卡分配目标卡标识，其中，不同的所述虚拟电子卡对应不同的卡标识；
    在所述片内操作系统的注册表中注册所述目标程序标识与所述目标卡标识之间的匹配关系。
  6. 根据权利要求5所述的方法，其中，所述从所述安全芯片上的至少一个卡管理程序中，确定与所述目标虚拟电子卡相对应的目标卡管理程序，包括：
    获取所述管理请求携带的所述目标卡标识；
    根据所述注册表中注册的所述程序标识与所述卡标识之间的匹配关系，确定与所述目标卡标识相匹配的所述目标程序标识；
    将与所述目标程序标识相对应的所述卡管理程序，确定为与所述目标虚拟电子卡相对应的所述目标卡管理程序。
  7. 根据权利要求6所述的方法，其中，所述卡管理命令包括个人化命令、删除命令、激活命令或读写命令；
    所述个人化命令用于指示所述目标卡管理程序，将所述管理请求携带的个人化数据存储到所述目标虚拟电子卡中；
    所述删除命令用于指示所述目标卡管理程序，将所述目标虚拟电子卡删除；
    所述激活命令用于指示所述目标卡管理程序，将所述目标虚拟电子卡设置为非接触激活状态；
    所述读写命令用于指示所述目标卡管理程序，对所述目标虚拟电子卡的内容进行读写。
  8. 根据权利要求7所述的方法，其中，
    所述个人化数据由近场通信控制器从实体卡中读取，所述个人化数据由所述卡管理系统发送给所述可信移动应用，所述个人化数据由所述可信移动应用发送给可信服务管理平台，由所述可信服务管理平台生成包括所述个人化数据的所述管理请求，并由所述可信服务管理平台将所述管理请求发送给所述可信移动应用；
    或者，
    所述个人化数据由第二终端发送给所述可信服务管理平台，由所述可信服务管理平台生成包括所述个人化数据的所述管理请求，并由所述可信服务管理平台将所述管理请求发送给所述可信移动应用，其中所述第一终端与所述第二终端为不同的终端。
  9. 根据权利要求1所述的方法，其中，所述方法还包括：
    接收来自近场通信控制器的非接触操作命令，其中，所述非接触操作命令根据所述近场通信控制器与非接触读卡器之间的近场通信生成；
    通过所述卡管理系统执行所述非接触操作命令，对所述目标虚拟电子卡进行读写操作；
    获取所述卡管理系统对所述目标虚拟电子卡进行读写操作后的反馈信息；
    将所述反馈信息发送给所述近场通信控制器。
  10. 根据权利要求9所述的方法，其中，所述方法还包括：
    通过串行外设接口SPI2对所述非接触操作命令进行解密处理；
    通过直接存储器访问DMA控制器将经过解密处理的所述非接触操作命令传输到所述安全芯片的内存；
    所述将所述反馈信息发送给所述近场通信控制器，包括：
    通过所述直接存储器访问DMA控制器，将所述安全芯片的内存中的所述反馈信息传输到所述串行外设接口SPI2的寄存器中；
    通过所述串行外设接口SPI2对所述反馈信息进行加密操作；
    将经过加密操作的所述反馈信息发送给所述近场通信控制器。
  11. 根据权利要求1至10中任一所述的方法，其中，所述卡管理系统通过C语言实现，所述卡管理程序通过Java实现。
  12. 一种安全芯片，所述安全芯片位于终端内且与所述终端内的存储器连接，所述存储器存储有可被所述安全芯片执行的指令，所述指令被所述安全芯片执行，以使所述安全芯片能够执行如权利要求1至11中任一所述的虚拟电子卡管理方法。
  13. 一种终端，包括：如权利要求12所述的安全芯片，以及与所述安全芯片连接的存储器。
  14. 一种计算机可读存储介质，存储有计算机程序，所述计算机程序被处理器执行时实现权利要求1至11中任一所述的虚拟电子卡管理方法。
  15. 一种虚拟电子卡管理系统，包括：如权利要求12所述的安全芯片和可信移动应用；
    所述可信移动应用安装在所述安全芯片所在的第一终端；
    所述可信移动应用，用于向所述安全芯片发送管理请求，其中，所述管理请求用于指示所述安全芯片上的卡管理程序，对所述安全芯片上的虚拟电子卡进行管理，不同的所述卡管理程序用于管理不同的所述虚拟电子卡。
  16. 根据权利要求15所述的系统，其中，所述系统还包括：可信服务管理平台；
    所述可信移动应用，还用于向所述可信服务管理平台发送获取指令，其中，所述获取指令用于请求获取所述卡管理程序的安装包；
    所述可信服务管理平台，用于根据所述获取指令，将所述安装包发送给所述可信移动应用；
    所述可信移动应用，还用于将接收到的所述安装包发送给所述安全芯片。
  17. 根据权利要求15所述的系统，其中，所述系统还包括：预置设备；
    所述预置设备，用于在所述安全芯片的生产阶段，向所述安全芯片发送下载指令，其中，所述下载指令用于指示所述安全芯片从所述预置设备下载所述卡管理程序的安装包。
  18. 根据权利要求16所述的系统，其中，所述系统还包括：近场通信控制器；
    所述近场通信控制器设置在所述第一终端；
    所述近场通信控制器，用于根据所述近场通信控制器与非接触读卡器之间的近场通信生成非接触操作命令，并将所述非接触操作命令发送给所述安全芯片；
    所述近场通信管理器，还用于接收所述安全芯片执行所述非接触操作命令后的反馈信息，并通过近场通信将所述反馈信息发送给所述非接触读卡器。
  19. 根据权利要求18所述的系统，其中，
    所述近场通信控制器，还用于从实体卡中读取个人化数据，并将读取到的个人化数据发送给所述可信移动应用；
    所述可信移动应用，还用于将接收到的所述个人化数据发送给所述可信服务管理平台；
    所述可信服务管理平台，还用于生成包括所接收到的所述个人化数据的所述管理请求。
  20. 根据权利要求18所述的系统，其中，
    所述可信服务管理平台，还用于接收来自第二终端的个人化数据，并生成包括所接收到的所述个人化数据的所述管理请求。
PCT/CN2021/075648 2021-02-05 2021-02-05 虚拟电子卡管理方法、系统及安全芯片、终端和存储介质 WO2022165771A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
PCT/CN2021/075648 WO2022165771A1 (zh) 2021-02-05 2021-02-05 虚拟电子卡管理方法、系统及安全芯片、终端和存储介质
CN202180002380.0A CN113508411A (zh) 2021-02-05 2021-02-05 虚拟电子卡管理方法、系统及安全芯片、终端和存储介质
EP21765817.8A EP4060588A1 (en) 2021-02-05 2021-02-05 Virtual electronic card management method and system, security chip, terminal, and storage medium
US17/473,278 US11907931B2 (en) 2021-02-05 2021-09-13 Method and system for managing virtual electronic card, secure chip, terminal and storage medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2021/075648 WO2022165771A1 (zh) 2021-02-05 2021-02-05 虚拟电子卡管理方法、系统及安全芯片、终端和存储介质

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/473,278 Continuation US11907931B2 (en) 2021-02-05 2021-09-13 Method and system for managing virtual electronic card, secure chip, terminal and storage medium

Publications (1)

Publication Number Publication Date
WO2022165771A1 true WO2022165771A1 (zh) 2022-08-11

Family

ID=78008214

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/075648 WO2022165771A1 (zh) 2021-02-05 2021-02-05 虚拟电子卡管理方法、系统及安全芯片、终端和存储介质

Country Status (4)

Country Link
US (1) US11907931B2 (zh)
EP (1) EP4060588A1 (zh)
CN (1) CN113508411A (zh)
WO (1) WO2022165771A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114301506B (zh) * 2022-01-17 2022-05-06 北京紫光青藤微系统有限公司 用于模拟nfc功能的方法及装置、nfc终端、存储介质
CN115941833A (zh) * 2022-11-21 2023-04-07 深圳市雪球科技有限公司 一种开通交通卡优化的方法、系统、设备及存储介质
CN117852565B (zh) * 2024-02-28 2024-05-28 花瓣支付(深圳)有限公司 Nfc卡片生成方法、系统、装置、电子设备及服务器

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105550863A (zh) * 2015-07-31 2016-05-04 宇龙计算机通信科技(深圳)有限公司 一种移动支付方法及可穿戴设备
CN106845971A (zh) * 2015-12-03 2017-06-13 中国电信股份有限公司 用于提升电子钱包安全性的方法、装置和系统
CN109547554A (zh) * 2018-11-30 2019-03-29 北京红枣科技有限公司 无卡交互系统及模拟卡设备
CN111124503A (zh) * 2018-11-01 2020-05-08 华为终端有限公司 一种nfc应用的自动激活方法及终端
US10664824B2 (en) * 2013-12-19 2020-05-26 Visa International Service Association Cloud-based transactions methods and systems

Family Cites Families (26)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9710804B2 (en) * 2012-10-07 2017-07-18 Andrew H B Zhou Virtual payment cards issued by banks for mobile and wearable devices
US11018724B2 (en) * 2006-09-24 2021-05-25 Rfcyber Corp. Method and apparatus for emulating multiple cards in mobile devices
EP2043016A1 (en) * 2007-09-27 2009-04-01 Nxp B.V. Method, system, trusted service manager, service provider and memory element for managing access rights for trusted applications
JP5651473B2 (ja) * 2007-11-06 2015-01-14 ジエマルト・エス・アー 移動体通信装置間でのｎｆｃのアプリケーションの共有または再販
MX2010014374A (es) * 2008-06-24 2011-03-01 Nxp Bv Metodo para accesar aplicaciones en un ambiente movil seguro.
US20100063906A1 (en) * 2008-09-05 2010-03-11 Giftango Corporation Systems and methods for authentication of a virtual stored value card
US8807440B1 (en) * 2010-12-17 2014-08-19 Google Inc. Routing secure element payment requests to an alternate application
CN102087716B (zh) * 2011-03-02 2013-02-13 武汉天喻信息产业股份有限公司 一种多应用Java智能卡
EP2839602B1 (en) * 2012-04-17 2017-10-11 Secure NFC Pty. Ltd. Multi-issuer secure element partition architecture for nfc enabled devices
US9223965B2 (en) * 2013-12-10 2015-12-29 International Business Machines Corporation Secure generation and management of a virtual card on a mobile device
CN104902463B (zh) * 2015-05-22 2020-01-07 努比亚技术有限公司 移动终端及其虚拟卡终端的多卡管理方法和服务器
TWI599971B (zh) * 2016-07-29 2017-09-21 Digital wallet in the virtual card management
WO2018218662A1 (zh) * 2017-06-02 2018-12-06 华为技术有限公司 一种nfc业务处理方法、终端及nfc芯片
CN109146012A (zh) * 2017-06-16 2019-01-04 北京橙鑫数据科技有限公司 卡片的管理方法、装置以及系统
EP3665633A4 (en) * 2017-08-09 2020-06-17 Xard Group Pty Ltd APPARATUS, SYSTEM AND METHOD FOR OPERATING A DIGITAL TRANSACTION CARD
CN109801065A (zh) * 2017-11-17 2019-05-24 北京小米移动软件有限公司 虚拟卡片的开卡方法、装置及系统、存储介质
CN110766388B (zh) * 2018-07-27 2022-05-31 北京三快在线科技有限公司 虚拟卡生成方法及系统、电子设备
WO2020118516A1 (en) * 2018-12-11 2020-06-18 Orange Method for operating a device for selecting a virtual card in a digital wallet
US11429952B2 (en) * 2019-03-05 2022-08-30 Convenient Payments, LLC System and method for processing chip-card transactions from a host computer
CN114781415A (zh) * 2019-03-11 2022-07-22 华为技术有限公司 自动选择nfc模拟卡的方法、电子设备及通信系统
US11113685B2 (en) * 2019-12-23 2021-09-07 Capital One Services, Llc Card issuing with restricted virtual numbers
CN111443994B (zh) * 2020-04-01 2023-06-23 江苏恒宝智能系统技术有限公司 一种包含模拟智能卡驱动程序的装置、系统及方法
CN112200564A (zh) * 2020-09-23 2021-01-08 建信金融科技有限责任公司 一种虚拟卡生成和管理方法、装置、电子设备及可读存储介质
CN112200584A (zh) 2020-11-05 2021-01-08 加减信息科技(深圳)有限公司 一种支付受理终端的输入电路
CN112069848B (zh) * 2020-11-12 2021-04-30 深圳市汇顶科技股份有限公司 用于nfc卡模拟模式的选卡方法、芯片、终端和存储介质
WO2022099563A1 (zh) * 2020-11-12 2022-05-19 深圳市汇顶科技股份有限公司 用于nfc卡模拟模式的选卡方法、芯片、终端和存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10664824B2 (en) * 2013-12-19 2020-05-26 Visa International Service Association Cloud-based transactions methods and systems
CN105550863A (zh) * 2015-07-31 2016-05-04 宇龙计算机通信科技(深圳)有限公司 一种移动支付方法及可穿戴设备
CN106845971A (zh) * 2015-12-03 2017-06-13 中国电信股份有限公司 用于提升电子钱包安全性的方法、装置和系统
CN111124503A (zh) * 2018-11-01 2020-05-08 华为终端有限公司 一种nfc应用的自动激活方法及终端
CN109547554A (zh) * 2018-11-30 2019-03-29 北京红枣科技有限公司 无卡交互系统及模拟卡设备

Also Published As

Publication number Publication date
US11907931B2 (en) 2024-02-20
EP4060588A4 (en) 2022-09-21
US20220253830A1 (en) 2022-08-11
CN113508411A (zh) 2021-10-15
EP4060588A1 (en) 2022-09-21

Similar Documents

Publication Publication Date Title
WO2022165771A1 (zh) 虚拟电子卡管理方法、系统及安全芯片、终端和存储介质
CN110023941B (zh) 一种实现安全操作系统切换的片上系统和方法
AU2011343546B2 (en) Writing application data to a secure element
EP2988470B1 (en) Automatic purposed-application creation
AU2011343474B2 (en) Local trusted services manager for a contactless smart card
JP6923582B2 (ja) 情報処理装置、情報処理方法、およびプログラム
US8844827B2 (en) Chip card, and method for the software-based modification of a chip card
JP4236830B2 (ja) アップロード機能付き記憶装置
TWI494856B (zh) Program call method and mobile device
AU2013222020B2 (en) Local trusted services manager for a contactless smart card
CN118246040A (zh) 电子设备的保护
CN118246039A (zh) 电子设备的保护

Legal Events

Date Code Title Description
ENP Entry into the national phase

Ref document number: 2021765817

Country of ref document: EP

Effective date: 20210914

NENP Non-entry into the national phase

Ref country code: DE