WO2013067793A1 - 安全性操作执行***及执行方法 - Google Patents
安全性操作执行***及执行方法 Download PDFInfo
- Publication number
- WO2013067793A1 WO2013067793A1 PCT/CN2012/072328 CN2012072328W WO2013067793A1 WO 2013067793 A1 WO2013067793 A1 WO 2013067793A1 CN 2012072328 W CN2012072328 W CN 2012072328W WO 2013067793 A1 WO2013067793 A1 WO 2013067793A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- security
- application module
- smart card
- security operation
- instruction
- Prior art date
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/06—Authentication
- H04W12/069—Authentication using certificates or pre-shared keys
Definitions
- the present invention relates to the field of communications, and in particular to a security operation execution system and an execution method.
- BACKGROUND With the upgrading of networks, mobile terminal applications and mobile services are increasing, which makes the life of mobile users greatly facilitated. The popularity of these mobile services makes the security certification of users and the security protection of information more and more important, and users are more and more concerned about security issues.
- Mobile payment and enterprise information systems in particular, require reliable authentication of users and security of information to ensure the security of transactions and information.
- Public Key Infrastructure (PKI) is a mature business authentication technology.
- ⁇ refers to a versatile security infrastructure that implements and provides network information security services using public key concepts and technologies.
- ⁇ Technology is the core of information security technology and the key and basic technology of e-commerce.
- the core of the ⁇ is the Certificate Authority (CA), which guarantees the security of the private key is the basis of the PKI system.
- CA Certificate Authority
- the development of smart card technology has made it possible to implement mobile digital signature technology. Smart cards are highly resistant to security devices and are easy to carry, and can achieve a high level of security based on cryptography.
- the present invention provides a security operation execution system and an execution method to solve at least the problem that the mobile terminal in the related art lacks an interface for directly accessing the smart card, so that the security information on the smart card cannot be called by the mobile terminal.
- a security operation execution system is provided.
- the security operation execution system comprises: a mobile terminal and a smart card; the mobile terminal comprises: at least one mobile application module configured to send a security operation instruction; an intermediate security application module corresponding to the smart card, configured to receive from the mobile The security operation instruction of the application module is combined with the smart card to implement the security operation corresponding to the security operation instruction; the smart card is set to store the security information required by the mobile application module, and is jointly implemented and safely operated with the intermediate security application module.
- the security operation corresponding to the instruction the mobile terminal further includes: a self-test module, configured to detect whether the intermediate security application module and the smart card are from the same publisher system, and is configured to ensure that only one intermediate security application exists in the terminal.
- the intermediate security application module includes: a mobile application management unit configured to authenticate a mobile application module that needs to access an intermediate security application module; and a smart card access unit configured to obtain a security operation instruction from the smart card Corresponding first security operation information; the instruction execution unit is configured to perform a security operation on the security operation instruction according to the first security operation information.
- the instruction execution unit includes: a file management unit, configured to: when the mobile application module is authorized to access the intermediate security application module, send, to the smart card, the first security operation information corresponding to the security operation instruction, And creating and deleting a secure storage domain for storing the first security operation information; the security storage unit is set to ensure that the secure storage domain created by the file management unit can only be accessed by the intermediate security application module; the security operation unit is set to be secure according to The first security operation information in the storage domain performs a security operation on the security operation instruction.
- the first security operation information includes at least one of the following: a message related to the digital certificate, a random symmetric key generated by the application server, and a public key in the key pair generated by the smart card.
- the smart card includes: a security data storage module, configured to store the second security operation information, where the second security operation information includes: the first security operation information and the private key generated by the smart card
- the access control module is configured to control the smart card to receive only the security operation instruction from the intermediate security application module; the security operation module is configured to perform the security operation corresponding to the security operation instruction.
- the security operation instruction includes at least one of the following: an encryption instruction, a decryption instruction, an integrity protection instruction, an integrity verification instruction, a generation key pair instruction, and a secure delegation access request.
- the security operation includes at least one of the following: an encryption operation, a decryption operation, an integrity protection operation, an integrity verification operation, a key pair operation, and a secure delegation access verification.
- a security operation execution method based on the above-described security operation execution system is provided.
- the security operation execution method according to the present invention includes: the intermediate security application module of the mobile terminal receives a security operation instruction from the at least one mobile application module; the intermediate security application module and the smart card jointly implement a security operation corresponding to the security operation instruction .
- the method before the intermediate security application module and the smart card jointly implement the security operation corresponding to the security operation instruction, the method further includes: the mobile terminal detecting whether the intermediate security application module and the smart card are from the same publisher system. In the foregoing method, before the intermediate security application module receives the security operation instruction from the mobile application module, the method further includes: the intermediate security application module authenticating the mobile application module that needs to access the intermediate security application module. In the above method, the intermediate security application module and the smart card jointly implement the security operation corresponding to the security operation instruction, including: the intermediate security application module acquires the first security operation information corresponding to the security operation instruction from the smart card; The application module performs a security operation on the security operation instruction according to the first security operation information.
- performing security operations on the security operation instructions according to the first security operation information further includes: when the mobile application module is authorized to access the intermediate security application module, the intermediate security application module sends the acquisition and security to the smart card.
- the first security operation information corresponding to the operation instruction, and the security storage domain for saving the first security operation information is created and deleted, wherein the security storage domain can only be accessed by the intermediate security application module; the intermediate security application module is based on security
- the first security operation information in the storage domain performs a security operation on the security operation instruction.
- the first security operation information includes at least one of the following: a digital certificate related message, a random symmetric key generated by the application server, and a public key in the key pair generated by the smart card.
- the method further includes at least one of the following: the smart card stores the second security operation information, where The second security operation information includes: first security operation information and a private key in the key pair generated by the smart card; and the smart card controls the smart card to receive only the security operation instruction from the intermediate security application module.
- the security operation instruction comprises at least one of the following: an encryption instruction, a decryption instruction, an integrity protection instruction, an integrity verification instruction, opening a digital envelope instruction, generating a digital envelope instruction, and generating a key pair instruction.
- the security operation includes at least one of the following: an encryption operation, a decryption operation, an integrity protection operation, an integrity verification operation, opening a digital envelope operation, generating a digital envelope operation, and generating a key pair operation.
- the present invention solves the problem that the mobile terminal in the related art lacks an interface for directly accessing the smart card by adding the intermediate security application module to the mobile terminal, so that the data or function on the smart card cannot be called by the mobile terminal.
- the problem speeds up the promotion based on smart card service authentication, and improves the security and reliability of mobile terminal applications and services.
- FIG. 1 is a block diagram showing the structure of a security operation execution system according to an embodiment of the present invention
- FIG. 2 is a block diagram showing the structure of a security operation execution system according to a preferred embodiment of the present invention
- FIG. 4 is a flowchart of automatic detection by the self-test module when the intermediate security application module is installed to the mobile terminal according to an example of the present invention.
- 5 is a flow chart of a method for a mobile application module to perform a service request according to an example of the present invention; and
- FIG. 6 is a flow chart of data communication between a mobile application and an application server according to an example of the present invention.
- the security operation execution system mainly includes: a mobile terminal 10 and a smart card 20, and the mobile terminal 10 may include: at least one mobile application module 100 configured to send a security operation instruction; and an intermediate security application module 102,
- the intermediate security application module corresponds to the smart card 20, and is a unified smart card security application interface, configured to receive a security operation instruction from the mobile application module 100, and the smart card 20 jointly implements a security operation corresponding to the security operation instruction;
- the smart card 20 is arranged to cooperate with the intermediate security application module 102 to implement security operations corresponding to security operational instructions.
- the mobile terminal lacks an interface for directly accessing the smart card, so that data or functions on the smart card cannot be called by the mobile terminal. Using the system shown in FIG.
- an intermediate security application module 102 is added to the mobile terminal 10, the intermediate security application module and the smart card 20 are from the same publisher system, and receive security operation instructions from the mobile application module 100. Then, the security operation corresponding to the security operation instruction is implemented in conjunction with the smart card 20, thereby accelerating the promotion based on the smart card service authentication, and improving the security and reliability of the mobile terminal application and service.
- the mobile terminal may include multiple mobile application modules, which are provided by different application providers, and the intermediate security application module is released by the card issuer system corresponding to the smart card. Different card issuer systems issue their own intermediate security applications in accordance with the security delegation system architecture and security delegation method, and provide access to the smart cards to which the card issuer system belongs.
- the mobile application module may send a command to the intermediate security application module to request the intermediate security application module to read the security related information of the mobile application module stored on the smart card, but the security related information cannot leave the intermediate security application module and the smart card.
- the security-related information does not include the user's private key, and the user's private key cannot leave the smart card.
- the mobile application module can entrust the intermediate security application module and the smart card to perform security operations, such as encryption, decryption, integrity protection, and integrity verification, on the data and signaling of the mobile application module interacting with the external network.
- the security operation instructions may include, but are not limited to, at least one of the following: an encryption instruction, a decryption instruction, an integrity protection instruction, an integrity verification instruction, a generation key pair instruction, and a secure delegation access request.
- the above security operations may include, but are not limited to, at least one of the following: an encryption operation, a decryption operation, an integrity protection operation, an integrity verification operation, a key pair operation, and a secure delegation access verification.
- the mobile terminal further includes: a self-test module 104, configured to detect whether the intermediate security application module and the smart card are from the same publisher system, and ensure that only one intermediate security application exists in the terminal.
- whether the intermediate security application module corresponds to the smart card may be detected by setting a separate self-test module in the mobile terminal, and the foregoing detection function may be integrated into other modules of the mobile terminal, or may be connected in the smart card.
- the mobile terminal is triggered, the above automatic detection is triggered, and it is within the protection scope of the present invention to realize whether the intermediate security application module and the smart card are from the same publisher system and ensure that only one intermediate security application exists in the terminal.
- the intermediate security application module 102 may include: a mobile application management unit 1020 configured to authenticate the mobile application module 100 that needs to access the intermediate security application module 102, and control at least one mobile application module.
- the smart card access unit 1022 is configured to acquire first security operation information corresponding to the security operation instruction from the smart card;
- the instruction execution unit 1024 is configured to perform security operation according to the first security operation information
- the instruction performs security operations.
- the foregoing first security operation information may include, but is not limited to, at least one of the following: a message related to the digital certificate, a random symmetric key generated by the application server, and a public key in the key pair generated by the smart card.
- the mobile application management unit 1020 provides management of the mobile application module accessing the intermediate security application module within the mobile terminal.
- the mobile application management unit also needs to provide some signaling for the mobile application module to instruct the intermediate security application module to perform certain operations, such as encrypting the information, decrypting the information, protecting the integrity of the information, and Perform integrity verification, encapsulate information, generate key pairs, and more.
- the smart card access unit 1022 functions that the mobile terminal can only access the smart card through the smart card access unit of the intermediate security application module, including reading information of a specific area on the smart card, and deleting information of a specific area on the smart card, Information is written to a specific area in the smart card, etc.
- the smart card access unit also needs to provide commands for entrusting the smart card to perform some security operations, such as generating a key pair required by the mobile application user, requesting a digital signature, encrypting and decrypting data, opening a digital envelope, and the like.
- the instruction execution unit 1024 may further include: a file management unit (not shown) configured to send the acquisition to the smart card corresponding to the security operation instruction when the mobile application module is authorized to access the intermediate security application module.
- the first security operation information and create and delete a secure storage domain for storing the first security operation information; a secure storage unit (not shown), which is set to ensure that the secure storage domain created by the file management unit can only Aaccessed by the intermediate security application module; the security operation unit (not shown) is configured to perform security operations on the security operation instructions according to the first security operation information in the secure storage domain.
- the file management unit functions to manage the temporary secure storage area to which the intermediate security application module belongs.
- These secure storage domains store mobile application module security related information, including related information in the digital certificate, a random symmetric key generated by the application server, a public key in the key pair generated by the smart card, etc., but excluding the user private key, the user The private key cannot leave the smart card.
- the intermediate security application module When the mobile application is authorized to access the intermediate security application module, the intermediate security application module sends a command to the smart card to read the security related information of the mobile application module stored in the smart card, and creates a temporary secure storage domain in the terminal, and stores these Security information; When the mobile application module is closed, the mobile application module disconnects from the intermediate security application module, and the intermediate security application module subsequently deletes the temporary secure storage domain created for the mobile application. Therefore, the role of the file management unit is to create a temporary secure storage domain or delete a temporary secure storage domain for a mobile application with a secure delegate.
- the security storage unit functions to provide storage security of the mobile application module security related information within the mobile terminal.
- the temporary secure storage domains created by the intermediate security application module for storing the security information related to the mobile application modules read from the smart card can only be accessed by the intermediate security application module, and all information created and stored by the intermediate security application module is The other mobile application modules in the mobile terminal are closed and cannot be accessed and operated by other mobile application modules in the mobile terminal.
- the security computing unit functions to provide security operations for securely entrusted mobile application modules, including data encryption, decryption, integrity protection, and integrity verification. If the intermediate security application module authorizes the mobile application access module, the intermediate security application module creates a temporary secure storage domain for the mobile application module, and reads the security information associated with the mobile application module from the smart card and stores it in the created security. Storage domain.
- the security related information includes related information in the digital certificate, a random symmetric key generated by the application server, a public key in the key pair generated by the smart card, and the like.
- the secure computing function of the intermediate security application module identifies the public key, security algorithm identifier, or runnable code in the digital certificate.
- the secure computing unit can use these security related information to perform secure operations, secure encapsulation, and the like on data from the mobile application module.
- the smart card 20 includes: a secure data storage module 202 configured to store second security operation information, where the second security operation information includes: first security operation information and a secret generated by the smart card The private key in the key pair; the access control module 204 is configured to control the smart card to receive only the security operation instruction from the intermediate security application module; the security operation module 206 is configured to perform the security operation corresponding to the security operation instruction .
- the function of the secure data storage module is that the mobile application module that performs the security delegation stores its own private key and digital certificate in the smart card, and the smart card establishes a secure storage domain for the mobile application module, and saves the mobile application module.
- Security related information including private keys and digital certificates.
- Secure storage domain is Refers to the secure storage domain located in the smart card, and the smart card can receive commands from the intermediate security application module to create or delete the above secure storage domain.
- the function of the access control module is that the smart card only accepts read and write operations and other control signaling from the intermediate security application module, and prohibits other application modules in the terminal from accessing the smart card.
- the function of the security computing module is that after receiving the instruction from the intermediate security application module to generate the key pair, the smart card can use the security computing module to help the mobile application module generate the key pair; the smart card can generate the digital signature.
- FIG. 3 is a flowchart of a security operation execution method based on the security operation execution system illustrated in FIG. 1 according to an embodiment of the present invention. As shown in FIG. 3, the method may include the following steps: Step S302: The intermediate security application module of the mobile terminal receives a security operation instruction from the at least one mobile application module; Step S304: The intermediate security application module and the smart card jointly implement and secure The security operation corresponding to the sexual operation instruction.
- the mobile terminal lacks an interface capable of directly accessing the smart card, so that data or functions on the smart card cannot be called by the mobile terminal.
- the method shown in FIG. 3 is adopted to add an intermediate security application module to the mobile terminal, so that the mobile terminal can indirectly call the security information stored on the smart card through the intermediate security application module, thereby solving the problem that the mobile terminal lacks direct access to the smart card.
- the interface so that the security information on the smart card cannot be called by the mobile terminal, thereby accelerating the promotion based on the smart card service authentication, and improving the security and reliability of the mobile terminal application and service.
- the security operation instructions may include, but are not limited to, at least one of the following: an encryption instruction, a decryption instruction, an integrity protection instruction, an integrity verification instruction, a generation key pair instruction, and a secure delegation access request.
- the above security operations may include, but are not limited to, at least one of the following: an encryption operation, a decryption operation, an integrity protection operation, an integrity verification operation, a key pair operation, and a secure delegation access verification.
- the method before performing step S304, the method further includes: the mobile terminal detecting whether the intermediate security application module and the smart card are from the same publisher system, and ensuring that only one intermediate security application exists in the terminal.
- the following describes an example of the automatic detection process of the self-test module described above with an example. 4 is a flow chart showing automatic detection of a self-test module when an intermediate security application module is installed to a mobile terminal according to an example of the present invention. As shown in FIG.
- the self-test module in the mobile terminal runs a self-test program to detect whether a new smart card is inserted in the mobile terminal, and detects whether the intermediate security application module on the mobile terminal is a card issuer system corresponding to the inserted smart card.
- the intermediate security application module is released, the purpose of which is to ensure that as long as a smart card is inserted into the mobile terminal, there must be an intermediate security application module in the mobile terminal, and only one intermediate security application module exists.
- the automatic detection process may include the following processing steps: Step S402: The self-test module in the mobile terminal starts the self-test program.
- the self-test program should have the function of auto-starting, and it will start automatically every time the mobile terminal is turned on, and when the mobile terminal is running, if the smart card is plugged in, it will start itself;
- Step S404 The self-test module first determines whether the mobile terminal is inside There is a smart card insertion, if there is a smart card insertion, proceed to step S406 to detect whether the inserted smart card is from the same card issuer system as the smart card last inserted into the mobile terminal recorded by the self-test module; if there is no smart card insertion, go to the step S416.
- the intermediate security application module is notified that the security delegation operation cannot be performed.
- Step S406 The self-test module detects whether a new smart card is inserted into the mobile terminal.
- the new smart card refers to the smart card inserted into the mobile terminal and the smart card inserted into the mobile terminal recorded by the last self-test module belong to two different card issuer systems. If the self-test module detects that there is no smart card insertion, the self-test module notifies the intermediate security application module that no smart card is inserted, and the mobile application module cannot perform the security delegation operation; if the self-test module detects the smart card inserted into the mobile terminal and If the smart card inserted into the mobile terminal recorded by the last self-test module belongs to the same card issuer system, then the process goes to step S418, and the self-test module notifies the intermediate security application module to perform security delegation; if the self-test module finds the insertion The smart card and the self-test module record the smart card inserted into the mobile terminal last time belong to two different card issuer systems, and then proceed to step S408; Step S408: The self-test module further checks whether there is intermediate security in the mobile terminal Application module.
- step S414 the self-test module notifying the mobile terminal to download and install the intermediate security application module issued by the card issuer system to which the smart card inserted into the mobile terminal belongs;
- the detecting module detects that there is a new smart card insertion in the mobile terminal and the intermediate security application module exists in the mobile terminal, and then performs step S410;
- Step S412 If the mobile terminal receives the uninstallation from the self-test module The instruction of the intermediate security application module, the mobile terminal uninstalls the intermediate security application module; Step S414: If the mobile terminal receives an instruction to download and install a new intermediate security application module from the self-test module, the mobile terminal downloads the installation by inserting into the The intermediate security application module issued by the card issuer system to which the smart card belongs in the mobile terminal; it should be noted that the mobile terminal needs to download from the application server of the card issuer system through the network and the smart card inserted into the mobile terminal belongs to Intermediate security application module released by the card issuer system.
- Step S416 If the intermediate security application module receives the report from the self-test module that cannot perform the security delegation, the intermediate security application module closes the security delegation service; step S418: if the intermediate security application module receives the self-test module The security entrustment service is implemented, and the intermediate security application module and the smart card can normally perform security entrustment services for the mobile application module.
- the method before performing step S304, the method further includes: the intermediate security application module authenticating the mobile application module that needs to access the intermediate security application module.
- step S304 may include the following processing:
- the intermediate security application module acquires the first security operation information corresponding to the security operation instruction from the smart card;
- the intermediate security application module performs a security operation on the security operation instruction according to the first security operation information.
- the first security operation information during the preferred implementation includes at least one of the following: a digital certificate related message, a random symmetric key generated by the application server, and a public key in the key pair generated by the smart card.
- the performing the security operation on the security operation instruction according to the first security operation information may further include the following processing: (1) when the mobile application module is authorized to access the intermediate security application module, the intermediate security application module sends the smart security application module to the smart card.
- step S304 Obtaining first security operation information corresponding to the security operation instruction, and creating and deleting a security storage domain for saving the first security operation information, wherein the security storage domain can only be accessed by the intermediate security application module; (2) The intermediate security application module performs a security operation on the security operation instruction according to the first security operation information in the secure storage domain.
- the smart card stores the second security operation information, where the second security operation information includes: the first security operation information and the smart card The private key in the generated key pair; the smart card controls the smart card to receive only security operational commands from the intermediate security application module.
- Step S502 The intermediate security application module performs authentication and authentication on the mobile application module, and determines whether to allow the mobile application module to access the intermediate security application module; the intermediate security application module sends a query instruction to the smart card, and queries the smart card.
- the intermediate security application module reads the security related information of the mobile application user from the smart card related security domain, including related information in the digital certificate, but does not include the private key, and the private key cannot leave the smart card
- Step S504 The mobile application module generates a service authentication request and sends it to the intermediate security application module, where the intermediate security application module is instructed to process the service request message by encryption, integrity protection, and additional digital signature
- S506 After receiving the service authentication request from the mobile application module, the intermediate security application module sends a digital signature request to the smart card according to the operation instruction of the mobile application module, requesting the smart card to generate a digital signature
- Step S510 The intermediate security application module receives the After the digital signature of the smart card is responded, the digital signature
- Step S512 The intermediate security application module forwards the service authentication request to the application server, and sends the security-processed service authentication request to the application server.
- the application server refers to the user performing mobile payment, online shopping, and the like. , an application server of an application provider corresponding to the mobile application module.
- Step S514 After receiving the forwarding service authentication request from the intermediate security application module, the application server decrypts the message and performs integrity verification. If the decryption and integrity verification succeeds, the application server extracts the digital signature and authenticates the user.
- Step S516 After the application server authenticates the user, generates a random key, and uses the random key to respond to the service authentication request.
- Step S518 The application server then uses the user's public key to generate a digital envelope, protects the encryption and integrity protected random key, and attaches it after the service authentication request response;
- Step S520 The application server The intermediate security application module sends a service authentication request response indicating whether the authentication succeeds or the authentication fails, and a digital envelope protecting the random key is attached. If the authentication succeeds, the user is allowed to access. If the authentication fails, the reason for the failure is indicated, and the connection is abandoned.
- Step S522 After receiving the service authentication request response from the application server, the intermediate security application module extracts the digital envelope therein.
- the intermediate security application module sends an open digital envelope request to the smart card, instructing the smart card to open the digital envelope, and extracting the random key therein;
- Step S524 After receiving the request for opening the digital envelope from the intermediate security application module, the smart card uses the user private key Open the digital envelope and remove the random key from it.
- Step S526 After the intermediate security application module receives the open digital envelope response from the smart card, the slave digital The decryption and integrity verification algorithm is read in the certificate, and the service authentication request response is decrypted and integrity verified using the random key sent by the smart card; Step S528: The intermediate security application module sends a service authentication response to the mobile application module, A service authentication request response signal including decryption and integrity verification.
- 6 is a flow diagram of data communication between a mobile application and an application server in accordance with an example of the present invention. As shown in FIG.
- Step S602 The intermediate security application module has permitted the mobile application module to access the intermediate security application module, and the security related information of the mobile application module already exists in the intermediate security application module, including related information in the digital certificate, but does not include private The key, the private key cannot leave the smart card;
- Step S604 The mobile application module sends a data processing request to the intermediate security application module, where the method includes indicating that the intermediate security application module processes the data as encryption and integrity protection;
- Step S606 Intermediate security The application module reads the encryption and integrity protection algorithm from the digital certificate according to the indication, and reads the public key from the digital certificate to encrypt and protect the data.
- Step S608 The intermediate security application module forwards the data to the application server. Sending the security-processed data to the application server; Step S610: After receiving the forwarding data from the intermediate security application module, the application server decrypts the message and performs integrity verification; Step S612: The application server subsequently generates a random key.
- Step S614 The application server then uses the public key of the user to generate a digital envelope, protects the encryption and integrity protected random key, and attaches it to the response data;
- S616 The application server sends the response data to the intermediate security application module, and the digital envelope protecting the random key is attached;
- Step S618 After receiving the response data from the application server, the intermediate security application module extracts the digital envelope therein.
- the intermediate security application module sends an open digital envelope request to the smart card, instructing the smart card to open the digital envelope, and extracting the random key therein;
- Step S620 The smart card uses the user private key after receiving the request for opening the digital envelope from the intermediate security application module Open the digital envelope and remove the random key from it.
- the smart card then sends an open digital envelope response to the intermediate security application module, and sends the random key in the digital envelope to the intermediate security application module;
- Step S622 After the intermediate security application module receives the open digital envelope response from the smart card, the slave digital The decryption and integrity verification algorithm is read in the certificate, and the response data is decrypted and integrity verified using the random key sent by the smart card;
- Step S624 The intermediate security application module sends a forwarding response data to the mobile application module, including decryption And response data after integrity verification.
- the present invention achieves the following technical effects:
- the mobile terminal can access the smart card
- the mobile terminal in the related art lacks an interface for directly accessing the smart card. Therefore, the data or function on the smart card cannot be called by the mobile terminal, thereby accelerating the promotion based on the smart card service authentication, and improving the security and reliability of the mobile terminal application and service.
- the above modules or steps of the present invention can be implemented by a general-purpose computing device, which can be concentrated on a single computing device or distributed over a network composed of multiple computing devices.
- the computing device may be implemented by program code executable by the computing device, such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein.
- the steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps are fabricated as a single integrated circuit module.
- the invention is not limited to any specific combination of hardware and software.
- the above are only the preferred embodiments of the present invention, and are not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Storage Device Security (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
本发明公开了一种安全性操作执行***及执行方法,在上述***中,在移动终端上增加中间安全应用模块,使得移动终端通过该中间安全应用模块可以间接的调用保存在智能卡上的安全信息,并且可以向智能卡发送指令,进而在移动终端的中间安全应用模块接收来自于至少一个移动应用模块的安全性操作指令之后,中间安全应用模块和智能卡可以联合实现与安全性操作指令对应的安全性操作。根据本发明提供的技术方案,加快了基于智能卡业务认证的推广,提高了移动终端应用与业务的安全性和可靠性。
Description
安全性操作执行***及执行方法 技术领域 本发明涉及通信领域, 具体而言, 涉及一种安全性操作执行***及执行方法。 背景技术 随着网络的升级, 移动终端应用和移动业务不断增多, 使得移动用户的生活得到 了极大的便利。 这些移动业务的普及使得对用户的安全认证和对信息的安全保护越来 越重要, 用户也越来越关心安全问题。 移动支付和企业信息化***等尤其需要用户身 份的可靠验证和信息的安全保护以确保交易和信息的安全。 公钥基础设施 (Public Key Infrastructure, 简称为 PKI) 是目前一种成熟的业务认 证技术。 ΡΚΙ是指用公钥概念和技术来实现并提供网络信息安全服务的具有通用性的 安全基础设施。 ΡΚΙ技术是信息安全技术的核心, 也是电子商务的关键和基础技术。
ΡΚΙ的核心是数字证书认证中心(Certificate Authority, 简称为 CA), 保证私钥的 安全是 PKI体系的基础。 现在有很多人都把私钥和数字证书存储在终端 (包括: 固定 终端和移动终端) 当中, 但这种方式很不安全。 黑客可能非法盗取合法用户的私钥, 伪装成为合法用户的身份在网络上进行诈骗和非法交易; 终端病毒也可能删除硬盘上 的数据, 造成无法使用 PKI***; 而且, 这种方式是将用户与某台特定的终端绑定了, 用户无法方便地在其它终端上使用自己的私钥。 智能卡技术的发展使得移动数字签名技术在其上的实现成为可能。 智能卡是抗破 坏性高的安全设备, 并且便于携带, 并可基于密码学达到很高的安全水平, 因此, 将 私钥和数字证书存储在智能卡上, 并且利用智能卡完成鉴权认证是比较安全、 可靠和 方便的, 同时, 也可以在智能卡上实现生成密钥对、 完成数字签名等功能。 现今智能卡的处理能力已经有了大大的增强, 智能卡上承载的业务也越来越多, 但是, 由于现有的移动终端没有开放应用直接访问智能卡的接口, 因此, 导致了智能 卡上的数据或功能不能被移动终端调用。 同时, 由于终端内存在操作***的差异, 导 致具有认证服务的智能卡需要对终端进行适配, 这些给基于智能卡的业务认证技术的 产品化造成了很大的困难。
发明内容 本发明提供了一种安全性操作执行***及执行方法, 以至少解决相关技术中的移 动终端缺少直接访问智能卡的接口, 以致智能卡上的安全信息不能被移动终端调用的 问题。 根据本发明的一个方面, 提供了一种安全性操作执行***。 根据本发明的安全性操作执行***包括: 移动终端和智能卡; 移动终端包括: 至 少一个移动应用模块, 设置为发送安全性操作指令; 中间安全应用模块, 与智能卡相 对应, 设置为接收来自于移动应用模块的安全性操作指令, 和智能卡联合实现与安全 性操作指令对应的安全性操作; 智能卡, 设置为储存移动应用模块所需的安全性信息, 并与中间安全应用模块联合实现与安全性操作指令对应的安全性操作。 在上述***中, 上述移动终端还包括: 自检模块, 设置为检测中间安全应用模块 与智能卡是否来自于同一发行商***,并设置为保证终端内只存在一个中间安全应用。 在上述***中, 上述中间安全应用模块包括: 移动应用管理单元, 设置为对需要 接入中间安全应用模块的移动应用模块进行鉴权; 智能卡访问单元, 设置为从智能卡 获取与安全性操作指令相对应的第一安全性操作信息; 指令执行单元, 设置为根据第 一安全性操作信息对安全性操作指令执行安全性操作。 在上述***中, 上述指令执行单元包括: 文件管理单元, 设置为在移动应用模块 被授权接入中间安全应用模块时, 向智能卡发送获取与安全性操作指令相对应的第一 安全性操作信息, 并创建和删除用于保存第一安全性操作信息的安全存储域; 安全存 储单元, 设置为保证文件管理单元创建的安全存储域仅能被中间安全应用模块访问; 安全运算单元, 设置为根据安全存储域中的第一安全性操作信息对安全性操作指令执 行安全性操作。 在上述***中, 上述第一安全性操作信息包括以下至少之一: 与数字证书相关的 消息、 应用服务器产生的随机对称密钥、 智能卡产生的密钥对中的公钥。 在上述***中, 上述智能卡包括: 安全数据存储模块, 设置为存储第二安全性操 作信息, 其中, 第二安全性操作信息包括: 第一安全性操作信息以及智能卡产生的密 钥对中的私钥; 接入控制模块, 设置为控制智能卡仅接收来自于中间安全应用模块的 安全性操作指令; 安全运算模块, 设置为执行与安全性操作指令相对应的安全性操作。
在上述***中, 上述安全性操作指令包括以下至少之一: 加密指令、 解密指令、 完整性保护指令、 完整性验证指令、 产生密钥对指令、 安全委托接入请求。 在上述***中, 上述安全性操作包括以下至少之一: 加密操作、 解密操作、 完整 性保护操作、 完整性验证操作、 产生密钥对操作、 安全委托接入验证。 根据本发明的另一方面, 提供了一种基于上述安全性操作执行***的安全性操作 执行方法。 根据本发明的安全性操作执行方法包括: 移动终端的中间安全应用模块接收来自 于至少一个移动应用模块的安全性操作指令; 中间安全应用模块和智能卡联合实现与 安全性操作指令对应的安全性操作。 在上述方法中, 在中间安全应用模块和智能卡联合实现与安全性操作指令对应的 安全性操作之前, 还包括: 移动终端检测中间安全应用模块与智能卡是否来自于同一 发行商***。 在上述方法中, 在中间安全应用模块接收来自于移动应用模块的安全性操作指令 之前, 还包括: 中间安全应用模块对需要接入中间安全应用模块的移动应用模块进行 鉴权。 在上述方法中, 中间安全应用模块和智能卡联合实现与安全性操作指令对应的安 全性操作, 包括: 中间安全应用模块从智能卡获取与安全性操作指令相对应的第一安 全性操作信息; 中间安全应用模块根据第一安全性操作信息对安全性操作指令执行安 全性操作。 在上述方法中, 根据第一安全性操作信息对安全性操作指令执行安全性操作, 还 包括: 在移动应用模块被授权接入中间安全应用模块时, 中间安全应用模块向智能卡 发送获取与安全性操作指令相对应的第一安全性操作信息, 并创建和删除用于保存第 一安全性操作信息的安全存储域, 其中, 安全存储域仅能被中间安全应用模块访问; 中间安全应用模块根据安全存储域中的第一安全性操作信息对安全性操作指令执行安 全性操作。 在上述方法中, 第一安全性操作信息包括以下至少之一: 数字证书相关消息、 应 用服务器产生的随机对称密钥、 智能卡产生的密钥对中的公钥。 在上述方法中, 在智能卡与中间安全应用模块联合实现与安全性操作指令对应的 安全性操作之前, 还包括以下至少之一: 智能卡将第二安全性操作信息进行存储, 其
中, 第二安全性操作信息包括: 第一安全性操作信息以及智能卡产生的密钥对中的私 钥; 智能卡控制该智能卡仅接收来自于中间安全应用模块的安全性操作指令。 在上述方法中, 安全性操作指令包括以下至少之一: 加密指令、 解密指令、 完整 性保护指令、 完整性验证指令、 打开数字信封指令、 产生数字信封指令、 产生密钥对 指令。 在上述方法中, 安全性操作包括以下至少之一: 加密操作、 解密操作、 完整性保 护操作、 完整性验证操作、 打开数字信封操作、 产生数字信封操作、 产生密钥对操作。 通过本发明, 通过在移动终端上增加中间安全应用模块, 使得移动终端能够访问 智能卡, 解决了相关技术中的移动终端缺少直接访问智能卡的接口, 以致智能卡上的 数据或功能不能被移动终端调用的问题, 进而加快了基于智能卡业务认证的推广, 提 高了移动终端应用与业务的安全性和可靠性。 附图说明 此处所说明的附图用来提供对本发明的进一步理解, 构成本申请的一部分, 本发 明的示意性实施例及其说明用于解释本发明, 并不构成对本发明的不当限定。 在附图 中: 图 1是根据本发明实施例的安全性操作执行***的结构框图; 图 2是根据本发明优选实施例的安全性操作执行***的结构框图; 图 3是根据本发明实施例的基于图 1所示的安全性操作执行***的安全性操作执 行方法的流程图; 图 4是根据本发明实例的在中间安全应用模块安装到移动终端时, 自检模块实现 自动检测的流程图; 图 5是根据本发明实例的移动应用模块进行业务请求的方法流程图; 以及 图 6是根据本发明实例的移动应用和应用服务器之间进行数据通信的流程图。 具体实施方式 下文中将参考附图并结合实施例来详细说明本发明。 需要说明的是, 在不冲突的 情况下, 本申请中的实施例及实施例中的特征可以相互组合。
图 1是根据本发明实施例的安全性操作执行***的结构框图。 如图 1所示, 该安 全性操作执行***主要包括: 移动终端 10和智能卡 20, 移动终端 10可以包括: 至少 一个移动应用模块 100, 设置为发送安全性操作指令; 中间安全应用模块 102, 该中间 安全应用模块与智能卡 20相对应, 是一个统一的智能卡安全应用接口, 设置为接收来 自于移动应用模块 100的安全性操作指令,和智能卡 20联合实现与安全性操作指令对 应的安全性操作; 智能卡 20, 设置为与中间安全应用模块 102联合实现与安全性操作 指令对应的安全性操作。 在相关技术中, 移动终端缺少直接访问智能卡的接口, 从而导致智能卡上的数据 或功能不能被移动终端所调用。采用了如图 1所示的***,在移动终端 10上增加中间 安全应用模块 102, 该中间安全应用模块与智能卡 20来自于同一发行商***, 在接收 来自于移动应用模块 100的安全性操作指令之后,和智能卡 20联合实现与安全性操作 指令对应的安全性操作, 进而加快了基于智能卡业务认证的推广, 提高了移动终端应 用与业务的安全性和可靠性。 需要说明的是, 移动终端中可以包括多种移动应用模块, 这些移动应用模块由不 同的应用提供商提供, 而中间安全应用模块由智能卡所对应的卡发行商***发布。 不 同的卡发行商***依照安全委托***架构和安全委托方法发行自己的中间安全应用, 并且提供对卡发行商***所属的智能卡的访问功能。 为了保证智能卡上存储的信息的 安全, 安装在移动终端中的各种应用模块, 除了中间安全应用模块外, 其余移动应用 模块均无法直接访问智能卡。 移动应用模块可以向中间安全应用模块发送命令委托中 间安全应用模块读取智能卡上存储的移动应用模块安全相关信息, 但这些安全相关信 息不能离开中间安全应用模块和智能卡。 安全相关信息不包括用户私钥, 用户私钥不 能够离开智能卡。 移动应用模块可以委托中间安全应用模块和智能卡将移动应用模块 与外部网络交互的数据和信令进行安全性操作, 如加密、 解密、 完整性保护与完整性 验证等操作。 在优选实施过程中, 上述安全性操作指令可以包括但不限于以下至少之一: 加密 指令、 解密指令、 完整性保护指令、 完整性验证指令、 产生密钥对指令、 安全委托接 入请求。 上述安全性操作可以包括但不限于以下至少之一: 加密操作、 解密操作、 完 整性保护操作、 完整性验证操作、 产生密钥对操作、 安全委托接入验证。 优选地, 如图 2 所示, 上述移动终端还包括: 自检模块 104, 设置为检测中间安 全应用模块与智能卡是否来自于同一发行商***, 并保证终端内只存在一个中间安全 应用。
在优选实施过程中, 可以通过在移动终端中设置单独的自检模块来检测中间安全 应用模块与智能卡是否相对应,还可以将上述检测功能集成到移动终端的其他模块中, 也可以在智能卡接入移动终端时触发上述自动检测, 只要能实现中间安全应用模块与 智能卡是否来自于同一发行商***并保证终端内只存在一个中间安全应用的自动检测 功能均在本发明的保护范围之内。 优选地, 如图 2所示, 上述中间安全应用模块 102可以包括: 移动应用管理单元 1020, 设置为对需要接入中间安全应用模块 102的移动应用模块 100进行鉴权, 控制 至少一个移动应用模块 100接入中间安全应用; 智能卡访问单元 1022, 设置为从智能 卡获取与安全性操作指令相对应的第一安全性操作信息; 指令执行单元 1024, 设置为 根据第一安全性操作信息对安全性操作指令执行安全性操作。 在优选实施过程中, 上述第一安全性操作信息可以包括但不限于以下至少之一: 与数字证书相关的消息、 应用服务器产生的随机对称密钥、 智能卡产生的密钥对中的 公钥。 在优选的实施过程中,移动应用管理单元 1020提供移动终端内移动应用模块接入 到中间安全应用模块的管理。 移动终端内其他移动应用模块想要接入到中间安全应用 模块并进行安全委托, 应该经过中间安全应用模块的鉴权认证后才会被允许接入。 该 移动应用管理单元还需提供一些信令, 用于移动应用模块指示中间安全应用模块进行 某些操作, 这些操作可以是将信息进行加密、 将信息进行解密、 将信息进行完整性保 护、 将信息进行完整性验证、 将信息进行认证封装、 产生密钥对等。 在优选的实施过程中, 智能卡访问单元 1022的作用在于,移动终端只能通过中间 安全应用模块的智能卡访问单元访问智能卡, 包括读取智能卡上特定区域的信息, 删 除智能卡上特定区域的信息, 将信息写入到智能卡中特定区域内等操作。 智能卡访问 单元还需提供一些命令, 用来委托智能卡进行一些安全性操作, 如产生移动应用用户 所需的密钥对、 请求数字签名、 数据加解密、 打开数字信封等。 优选地, 上述指令执行单元 1024可以进一步包括: 文件管理单元(图中未示出), 设置为在移动应用模块被授权接入中间安全应用模块时, 向智能卡发送获取与安全性 操作指令相对应的第一安全性操作信息, 并创建和删除用于保存第一安全性操作信息 的安全存储域; 安全存储单元(图中未示出), 设置为保证文件管理单元创建的安全存 储域仅能被中间安全应用模块访问; 安全运算单元(图中未示出), 设置为根据安全存 储域中的第一安全性操作信息对安全性操作指令执行安全性操作。
在优选的实施过程中, 文件管理单元的作用在于, 管理中间安全应用模块所属的 临时安全存储区域。 这些安全存储域存储的是移动应用模块安全相关信息, 包括数字 证书中相关信息、应用服务器产生的随机对称密钥、智能卡产生的密钥对中的公钥等, 但不包括用户私钥, 用户私钥不能够离开智能卡。 当移动应用被授权接入中间安全应 用模块时, 中间安全应用模块会向智能卡发送命令读取存储在智能卡中的移动应用模 块安全相关的信息, 并且在终端内创建一个临时安全存储域, 储存这些安全信息; 当 移动应用模块关闭, 移动应用模块会断开与中间安全应用模块的连接, 中间安全应用 模块会随后删除为该移动应用所创建的临时安全存储域。 因此, 文件管理单元的作用 就是为设置了安全委托的移动应用创建一个临时安全存储域或删除一个临时安全存储 域等操作。 在优选的实施过程中, 安全存储单元的作用在于, 提供移动应用模块安全相关信 息在移动终端内的存储的安全性。 这些由中间安全应用模块创建的用来存储从智能卡 中读取的移动应用模块相关安全信息的临时安全存储域只能被中间安全应用模块访 问, 中间安全应用模块创建和存储的一切信息都是对移动终端内其他移动应用模块封 闭的, 是不能被移动终端内其他移动应用模块访问和操作的。 在优选的实施过程中, 安全运算单元的作用在于, 为进行了安全委托的移动应用 模块提供安全性操作, 包括数据的加密、 解密、 完整性保护和完整性验证等操作。 如 果中间安全应用模块授权移动应用接入模块, 那么中间安全应用模块会为移动应用模 块创建临时安全存储域, 并从智能卡中读取出与该移动应用模块相关的安全信息存储 在其创建的安全存储域中。 这些安全相关信息包括数字证书中相关信息、 应用服务器 产生的随机对称密钥、 智能卡产生的密钥对中的公钥等。 中间安全应用模块的安全运 算功能能够识别数字证书中的公钥、 安全性算法标识或可运行代码。 安全运算单元能 够利用这些安全相关信息对来自于移动应用模块的数据进行安全运算、 安全封装等操 作。 优选地, 如图 2所示, 智能卡 20包括: 安全数据存储模块 202, 设置为存储第二 安全性操作信息, 其中, 第二安全性操作信息包括: 第一安全性操作信息以及智能卡 产生的密钥对中的私钥; 接入控制模块 204, 设置为控制智能卡仅接收来自于中间安 全应用模块的安全性操作指令; 安全运算模块 206, 设置为执行与安全性操作指令相 对应的安全性操作。 在优选实施过程中, 安全数据存储模块的作用在于, 进行了安全委托的移动应用 模块将自己的私钥和数字证书存储在智能卡当中, 智能卡为移动应用模块建立一个安 全存储域, 保存移动应用模块的安全相关信息, 包括私钥和数字证书。 安全存储域是
指位于智能卡内的安全存储域, 并且智能卡能够接收来自于中间安全应用模块的命令 创建或删除上述安全存储域。 在优选实施过程中, 接入控制模块的作用在于, 智能卡只接受来自于中间安全应 用模块的读写操作和其他控制信令, 禁止终端内其他应用模块访问智能卡。 在优选实施过程中, 安全运算模块的作用在于, 智能卡在收到来自于中间安全应 用模块产生密钥对的指令后, 能够使用安全运算模块帮助移动应用模块产生密钥对; 智能卡能够产生数字签名并将其发送给中间安全应用模块; 智能卡能够打开中间安全 应用模块发送过来的数字信封; 智能卡还能进行一些数据加解密的处理。 图 3是根据本发明实施例的基于图 1所示的安全性操作执行***的安全性操作执 行方法的流程图。 如图 3所示, 该方法可以包括以下处理: 步骤 S302:移动终端的中间安全应用模块接收来自于至少一个移动应用模块的安 全性操作指令; 步骤 S304: 中间安全应用模块和智能卡联合实现与安全性操作指令对应的安全性 操作。 在相关技术中, 移动终端缺少能够直接访问智能卡的接口, 以致智能卡上的数据 或功能不能被移动终端调用。 采用了图 3所示的方法, 在移动终端上增加中间安全应 用模块, 使得移动终端通过该中间安全应用模块可以间接的调用保存在智能卡上的安 全信息, 从而解决了移动终端缺少直接访问智能卡的接口, 以致智能卡上的安全信息 不能被移动终端调用的问题, 进而加快了基于智能卡业务认证的推广, 提高了移动终 端应用与业务的安全性和可靠性。 在优选实施过程中, 上述安全性操作指令可以包括但不限于以下至少之一: 加密 指令、 解密指令、 完整性保护指令、 完整性验证指令、 产生密钥对指令、 安全委托接 入请求。 上述安全性操作可以包括但不限于以下至少之一: 加密操作、 解密操作、 完 整性保护操作、 完整性验证操作、 产生密钥对操作、 安全委托接入验证。 优选地, 在执行步骤 S304之前, 还可以包括: 移动终端检测中间安全应用模块与 智能卡是否来自于同一发行商***, 并保证终端内只存在一个中间安全应用。 下面结合一个实例对上述自检模块实现自动检测的过程做进一步的描述。
图 4是根据本发明实例的在中间安全应用模块安装到移动终端时, 自检模块实现 自动检测的流程图。 如图 4所示, 移动终端内的自检模块运行自检程序, 检测移动终 端内是否有新的智能卡***, 并且检测移动终端上的中间安全应用模块是否为***的 智能卡所对应卡发行商***发布的中间安全应用模块, 其目的在于保证只要有智能卡 ***移动终端, 那么移动终端内必定存在一个中间安全应用模块, 并且只存在一个中 间安全应用模块。 该自动检测流程可以包括以下处理步骤: 步骤 S402: 移动终端内的自检模块启动自检程序。 自检程序应具备自动启动的功 能, 每次移动终端开机时自行启动, 并且在移动终端运行时, 若出现智能卡拔插情况 后也会自行启动; 步骤 S404: 自检模块首先判断移动终端内是否存在智能卡***, 如果有智能卡插 入,则继续执行步骤 S406检测***的智能卡是否是与自检模块记录的上一次***移动 终端的智能卡来自于同一卡发行商***; 如果没有智能卡***, 则转到步骤 S416, 通 知中间安全应用模块无法进行安全委托操作; 步骤 S406: 自检模块检测是否有新的智能卡***了移动终端。 新的智能卡指的是 此次***到移动终端内的智能卡和上一次自检模块记录的***到移动终端内的智能卡 是属于两个不同的卡发行商***的。 如果自检模块检测到无智能卡***, 则自检模块 会通知中间安全应用模块无智能卡***, 移动应用模块将不能进行安全委托操作; 如 果自检模块检测到此次***到移动终端内的智能卡和上一次自检模块记录的***到移 动终端内的智能卡是属于同一卡发行商***, 则转到步骤 S418, 自检模块通知中间安 全应用模块可进行安全委托; 如果自检模块发现此次***的智能卡和自检模块所记录 的上次***到移动终端内的智能卡是属于两个不同的卡发行商***的, 则继续执行步 骤 S408; 步骤 S408: 自检模块进一步检查移动终端内是否存在中间安全应用模块。 如果移 动终端内不存在中间安全应用模块, 则转到步骤 S414, 自检模块会通知移动终端下载 安装由***到移动终端内的智能卡所属的卡发行商***所发布的中间安全应用模块; 如果自检模块检测到移动终端内有新的智能卡***并且移动终端内存在中间安全应用 模块, 则进行执行步骤 S410; 步骤 S410: 自检模块会进一步检查该中间安全应用模块是否由***到移动终端内 的智能卡所属的卡发行商***所发布的中间安全应用模块。如果是,则转到步骤 S418, 通知中间安全应用模块可进行安全委托; 如果不是, 则继续执行步骤 S412, 自检模块
会通知移动终端卸载中间安全应用模块, 并且下载安装由***到移动终端内的智能卡 所属的卡发行商***所发布的中间安全应用模块; 步骤 S412: 如果移动终端收到来自于自检模块的卸载中间安全应用模块的指令, 则移动终端卸载中间安全应用模块; 步骤 S414: 如果移动终端收到来自于自检模块的下载安装新的中间安全应用模块 的指令, 则移动终端下载安装由***到该移动终端内的智能卡所属的卡发行商***所 发布的中间安全应用模块; 需要说明的是, 移动终端需要通过网络从卡发行商***的应用服务器上下载与插 入到该移动终端内的智能卡所属的卡发行商***所发布的中间安全应用模块。 步骤 S416: 若中间安全应用模块收到来自于自检模块的无法进行安全委托的报 告, 则中间安全应用模块关闭安全委托服务; 步骤 S418: 若中间安全应用模块收到来自于自检模块的可进行安全委托的通知, 中间安全应用模块和智能卡可正常进行面向于移动应用模块的安全委托服务。 优选地, 在执行步骤 S304之前, 还可以包括: 中间安全应用模块对需要接入中间 安全应用模块的移动应用模块进行鉴权。 优选地, 步骤 S304可以包括以下处理:
( 1 )中间安全应用模块从智能卡获取与安全性操作指令相对应的第一安全性操作 信息;
(2)中间安全应用模块根据第一安全性操作信息对安全性操作指令执行安全性操 作。 在优选实施过程中第一安全性操作信息包括以下至少之一: 数字证书相关消息、 应用服务器产生的随机对称密钥、 智能卡产生的密钥对中的公钥。 优选地, 上述根据第一安全性操作信息对安全性操作指令执行安全性操作可以进 一步包括以下处理: ( 1 )在移动应用模块被授权接入中间安全应用模块时, 中间安全应用模块向智能 卡发送获取与安全性操作指令相对应的第一安全性操作信息, 并创建和删除用于保存 第一安全性操作信息的安全存储域,其中, 安全存储域仅能被中间安全应用模块访问;
(2)中间安全应用模块根据安全存储域中的第一安全性操作信息对安全性操作指 令执行安全性操作。 优选地, 在执行步骤 S304之前, 还可以包括但不限于以下处理至少之一: 智能卡将第二安全性操作信息进行存储, 其中, 第二安全性操作信息包括: 第一 安全性操作信息以及智能卡产生的密钥对中的私钥; 智能卡控制该智能卡仅接收来自于中间安全应用模块的安全性操作指令。 下面结合两个实例对上述安全性操作执行方法做进一步的描述。 图 5是根据本发明实例的移动应用模块进行业务请求的方法流程图。如图 5所示, 移动应用模块发送安全性操作指令, 交予智能卡和中间安全应用模块处理, 从而进行 安全委托。 该方法可以包括以下处理步骤: 步骤 S502: 中间安全应用模块对移动应用模块进行认证鉴权, 决定是否允许移动 应用模块接入到中间安全应用模块; 中间安全应用模块向智能卡发送查询指令, 查询 智能卡内是否存在移动应用模块相关的安全域; 中间安全应用模块从智能卡相关安全 域中读取出移动应用用户的安全相关信息,包括数字证书中相关信息,但不包括私钥, 私钥不能离开智能卡; 步骤 S504: 移动应用模块产生一个业务认证请求, 并将其发送给中间安全应用模 块, 其中, 指示中间安全应用模块对该业务请求消息的处理方式为加密、 完整性保护 和附加数字签名; 步骤 S506: 中间安全应用模块接收到来自于移动应用模块的业务认证请求后, 按 照移动应用模块的操作指示向智能卡发送数字签名请求, 请求智能卡产生数字签名; 步骤 S508: 智能卡在收到来自于中间安全应用的数字签名请求后, 使用用户私钥 产生数字签名, 并向中间安全应用发送一个数字签名响应, 将数字签名发送给中间安 全应用; 步骤 S510: 中间安全应用模块接收到来自于智能卡的数字签名响应后, 按照步骤 S506中收到的移动应用模块的操作指示将数字签名附加在业务认证请求后,从数字证 书中读取出加密和完整性保护算法, 并且从数字证书中读取出公钥对消息进行加密和 完整性保护;
步骤 S512: 中间安全应用模块给应用服务器转发业务认证请求, 将安全处理后的 业务认证请求发送给应用服务器; 需要说明的是, 上述应用服务器指的是在用户进行移动支付、 网上购物等操作时, 与移动应用模块相对应的应用提供商的应用服务器。 步骤 S514: 应用服务器接收到来自于中间安全应用模块的转发业务认证请求后, 将消息进行解密并完整性验证。 如果解密和完整性验证成功, 应用服务器会提取出数 字签名, 并对用户进行认证; 步骤 S516: 应用服务器对用户进行认证后, 产生一个随机密钥, 使用该随机密钥 对业务认证请求应答进行加密和完整性保护; 步骤 S518: 应用服务器随后使用用户的公钥产生一个数字信封, 将加密和完整性 保护的随机密钥保护起来, 并附加在业务认证请求应答后; 步骤 S520: 应用服务器向中间安全应用模块发送一个业务认证请求应答, 指示认 证成功还是认证失败, 并附加了保护随机密钥的数字信封。 如果认证成功则允许用户 接入, 如果认证失败则指示失败原因, 并放弃连接; 步骤 S522: 中间安全应用模块接收到来自于应用服务器的业务认证请求应答后, 将其中的数字信封提取出来。中间安全应用模块向智能卡发送一个打开数字信封请求, 指示智能卡打开数字信封, 取出其中的随机密钥; 步骤 S524: 智能卡在收到来自于中间安全应用模块的打开数字信封请求后, 使用 用户私钥打开数字信封, 并取出其中的随机密钥。 智能卡随后给中间安全应用模块发 送一个打开数字信封应答, 将数字信封内的随机密钥发送给中间安全应用模块; 步骤 S526: 中间安全应用模块接收到来自于智能卡的打开数字信封应答后, 从数 字证书中读取出解密和完整性验证算法, 并且使用智能卡发送过来的随机密钥对业务 认证请求应答进行解密和完整性验证; 步骤 S528: 中间安全应用模块给移动应用模块发送一个业务认证响应, 包括解密 和完整性验证后的业务认证请求应答信号。 图 6是根据本发明实例的移动应用和应用服务器之间进行数据通信的流程图。 如 图 6所示,移动应用模块发送安全性操作指令, 交予智能卡和中间安全应用模块处理, 从而进行安全委托。 该方法可以包括以下处理步骤:
步骤 S602: 中间安全应用模块已经准许了移动应用模块接入到该中间安全应用模 块, 并且中间安全应用模块中已存在移动应用模块的安全相关信息, 包括数字证书内 的相关信息, 但不包括私钥, 私钥不能离开智能卡; 步骤 S604: 移动应用模块向中间安全应用模块发送一个数据处理请求, 其中, 包 括指示中间安全应用模块对数据的处理方式为加密、 完整性保护; 步骤 S606: 中间安全应用模块按照指示从数字证书中读取出加密和完整性保护算 法, 并且从数字证书中读取出公钥对数据进行加密和完整性保护; 步骤 S608: 中间安全应用模块给应用服务器转发数据, 将安全处理后的数据发送 给应用服务器; 步骤 S610: 应用服务器接收到来自于中间安全应用模块的转发数据后, 将消息进 行解密并完整性验证; 步骤 S612: 应用服务器随后产生一个随机密钥, 使用该随机密钥对应答数据进行 加密和完整性保护; 步骤 S614: 应用服务器随后使用用户的公钥产生一个数字信封, 将加密和完整性 保护的随机密钥保护起来, 并附加在应答数据后; 步骤 S616: 应用服务器向中间安全应用模块发送应答数据, 并附加了保护随机密 钥的数字信封; 步骤 S618: 中间安全应用模块接收到来自于应用服务器的应答数据后, 将其中的 数字信封提取出来, 中间安全应用模块向智能卡发送一个打开数字信封请求, 指示智 能卡打开数字信封, 取出其中的随机密钥; 步骤 S620: 智能卡在收到来自于中间安全应用模块的打开数字信封请求后, 使用 用户私钥打开数字信封, 并取出其中的随机密钥。 智能卡随后给中间安全应用模块发 送一个打开数字信封应答, 将数字信封内的随机密钥发送给中间安全应用模块; 步骤 S622: 中间安全应用模块接收到来自于智能卡的打开数字信封应答后, 从数 字证书中读取出解密和完整性验证算法, 并且使用智能卡发送过来的随机密钥对应答 数据进行解密和完整性验证; 步骤 S624: 中间安全应用模块给移动应用模块发送一个转发应答数据, 包括解密 和完整性验证后的应答数据。
从以上的描述中, 可以看出, 本发明实现了如下技术效果: 通过在移动终端上增 加中间安全应用模块, 使得移动终端能够访问智能卡, 解决了相关技术中的移动终端 缺少直接访问智能卡的接口,以致智能卡上的数据或功能不能被移动终端调用的问题, 进而加快了基于智能卡业务认证的推广, 提高了移动终端应用与业务的安全性和可靠 性。 显然, 本领域的技术人员应该明白, 上述的本发明的各模块或各步骤可以用通用 的计算装置来实现, 它们可以集中在单个的计算装置上, 或者分布在多个计算装置所 组成的网络上, 可选地, 它们可以用计算装置可执行的程序代码来实现, 从而, 可以 将它们存储在存储装置中由计算装置来执行, 并且在某些情况下, 可以以不同于此处 的顺序执行所示出或描述的步骤, 或者将它们分别制作成各个集成电路模块, 或者将 它们中的多个模块或步骤制作成单个集成电路模块来实现。 这样, 本发明不限制于任 何特定的硬件和软件结合。 以上仅为本发明的优选实施例而已, 并不用于限制本发明, 对于本领域的技术人 员来说, 本发明可以有各种更改和变化。 凡在本发明的精神和原则之内, 所作的任何 修改、 等同替换、 改进等, 均应包含在本发明的保护范围之内。
Claims
1. 一种安全性操作执行***, 包括: 移动终端和智能卡;
所述移动终端包括:
至少一个移动应用模块, 设置为发送安全性操作指令;
中间安全应用模块, 与所述智能卡相对应, 设置为接收来自于所述移动应 用模块的所述安全性操作指令, 和所述智能卡联合实现与所述安全性操作指令 对应的安全性操作;
所述智能卡, 设置为储存移动应用模块所需的安全性信息, 并与所述中间 安全应用模块联合实现与所述安全性操作指令对应的安全性操作。
2. 根据权利要求 1所述的***, 其中, 所述移动终端还包括:
自检模块, 设置为检测所述中间安全应用模块与所述智能卡是否来自于同 一发行商***, 并设置为保证所述终端内只存在一个中间安全应用。
3. 根据权利要求 1所述的***, 其中, 所述中间安全应用模块包括:
移动应用管理单元, 设置为对需要接入所述中间安全应用模块的移动应用 模块进行鉴权;
智能卡访问单元, 设置为从所述智能卡获取与所述安全性操作指令相对应 的第一安全性操作信息;
指令执行单元, 设置为根据所述第一安全性操作信息对所述安全性操作指 令执行所述安全性操作。
4. 根据权利要求 3所述的***, 其中, 所述指令执行单元包括:
文件管理单元, 设置为在所述移动应用模块被授权接入所述中间安全应用 模块时, 向所述智能卡发送获取与所述安全性操作指令相对应的所述第一安全 性操作信息, 并创建和删除用于保存所述第一安全性操作信息的安全存储域; 安全存储单元, 设置为保证所述文件管理单元创建的安全存储域仅能被所 述中间安全应用模块访问;
安全运算单元, 设置为根据所述安全存储域中的所述第一安全性操作信息 对所述安全性操作指令执行所述安全性操作。
5. 根据权利要求 3所述的***, 其中, 所述第一安全性操作信息包括以下至少之 与数字证书相关的消息、 应用服务器产生的随机对称密钥、 智能卡产生的 密钥对中的公钥。
6. 根据权利要求 3所述的***, 其中, 所述智能卡包括:
安全数据存储模块, 设置为存储第二安全性操作信息, 其中, 所述第二安 全性操作信息包括: 所述第一安全性操作信息以及智能卡产生的密钥对中的私 钥;
接入控制模块, 设置为控制所述智能卡仅接收来自于所述中间安全应用模 块的所述安全性操作指令;
安全运算模块, 设置为执行与所述安全性操作指令相对应的安全性操作。
7. 根据权利要求 1至 6中任一项所述的***, 其中, 所述安全性操作指令包括以 下至少之一: 加密指令、 解密指令、 完整性保护指令、 完整性验证指令、 产生 密钥对指令、 安全委托接入请求。
8. 根据权利要求 1至 6中任一项所述的***, 其中, 所述安全性操作包括以下至 少之一: 加密操作、 解密操作、 完整性保护操作、 完整性验证操作、 产生密钥 对操作、 安全委托接入验证。
9. 一种权利要求 1至 6中任一项所述安全性操作执行***的安全性操作执行方法, 包括:
移动终端的中间安全应用模块接收来自于至少一个移动应用模块的安全性 操作指令;
所述中间安全应用模块和智能卡联合实现与所述安全性操作指令对应的安 全性操作。
10. 根据权利要求 9所述的方法, 其中, 在所述中间安全应用模块和智能卡联合实 现与所述安全性操作指令对应的安全性操作之前, 还包括:
所述移动终端检测所述中间安全应用模块与所述智能卡是否来自于同一发 行商***。
11. 根据权利要求 9所述的方法, 其中, 在所述中间安全应用模块接收来自于所述 移动应用模块的所述安全性操作指令之前, 还包括:
所述中间安全应用模块对需要接入所述中间安全应用模块的移动应用模块 进行鉴权。
12. 根据权利要求 9所述的方法, 其中, 所述中间安全应用模块和智能卡联合实现 与所述安全性操作指令对应的安全性操作, 包括:
所述中间安全应用模块从所述智能卡获取与所述安全性操作指令相对应的 第一安全性操作信息;
所述中间安全应用模块根据所述第一安全性操作信息对所述安全性操作指 令执行所述安全性操作。
13. 根据权利要求 12所述的方法,其中,根据所述第一安全性操作信息对所述安全 性操作指令执行所述安全性操作, 还包括:
在所述移动应用模块被授权接入所述中间安全应用模块时, 所述中间安全 应用模块向所述智能卡发送获取与所述安全性操作指令相对应的所述第一安全 性操作信息, 并创建和删除用于保存所述第一安全性操作信息的安全存储域, 其中, 所述安全存储域仅能被所述中间安全应用模块访问;
所述中间安全应用模块根据所述安全存储域中的所述第一安全性操作信息 对所述安全性操作指令执行所述安全性操作。
14. 根据权利要求 12所述的方法,其中,所述第一安全性操作信息包括以下至少之 数字证书相关消息、 应用服务器产生的随机对称密钥、 智能卡产生的密钥 对中的公钥。
15. 根据权利要求 12所述的方法,其中,在所述智能卡与所述中间安全应用模块联 合实现与所述安全性操作指令对应的安全性操作之前, 还包括以下至少之一: 所述智能卡将第二安全性操作信息进行存储, 其中, 所述第二安全性操作 信息包括: 所述第一安全性操作信息以及智能卡产生的密钥对中的私钥; 所述智能卡控制该智能卡仅接收来自于所述中间安全应用模块的所述安全 性操作指令。
16. 根据权利要求 9至 15中任一项所述的方法,其中,所述安全性操作指令包括以 下至少之一: 加密指令、 解密指令、 完整性保护指令、 完整性验证指令、 打开 数字信封指令、 产生数字信封指令、 产生密钥对指令。
17. 根据权利要求 9至 15中任一项所述的方法,其中,所述安全性操作包括以下至 少之一: 加密操作、 解密操作、 完整性保护操作、 完整性验证操作、 打开数字 信封操作、 产生数字信封操作、 产生密钥对操作。
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201110357700.2 | 2011-11-11 | ||
CN201110357700.2A CN103108323B (zh) | 2011-11-11 | 2011-11-11 | 安全性操作执行***及执行方法 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2013067793A1 true WO2013067793A1 (zh) | 2013-05-16 |
Family
ID=48288494
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2012/072328 WO2013067793A1 (zh) | 2011-11-11 | 2012-03-14 | 安全性操作执行***及执行方法 |
Country Status (2)
Country | Link |
---|---|
CN (1) | CN103108323B (zh) |
WO (1) | WO2013067793A1 (zh) |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN107451490A (zh) * | 2017-07-21 | 2017-12-08 | 广州大学 | 基于TrustZone的安全认证方法、装置、***及存储介质 |
Families Citing this family (9)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN104348952B (zh) * | 2013-07-24 | 2017-03-29 | 北京握奇数据***有限公司 | 一种卡片应用管理***的控制方法 |
CN104636666A (zh) * | 2013-11-07 | 2015-05-20 | ***通信集团公司 | 一种用于移动终端进行安全地信息处理的方法和安全装置 |
CN105208558B (zh) * | 2014-06-20 | 2019-06-11 | 中国电信股份有限公司 | 实现手机卡应用安全接入的方法、手机终端、平台及*** |
CN105827565A (zh) * | 2015-01-05 | 2016-08-03 | ***通信集团江苏有限公司 | 一种应用的安全认证***、方法、及终端 |
CN106548346A (zh) * | 2015-09-16 | 2017-03-29 | 深圳市中兴微电子技术有限公司 | 一种电子支付的用户验证方法、安全支付客户端及控制器 |
CN107688473B (zh) * | 2016-08-03 | 2020-09-08 | 北京数码视讯科技股份有限公司 | 一种智能卡内自定义安全域的实现方法及智能卡 |
CN106295259B (zh) * | 2016-08-03 | 2019-02-12 | 杭州晟元数据安全技术股份有限公司 | 一种利用不可屏蔽中断提高物联网产品安全性的方法 |
CN109803254A (zh) * | 2017-11-16 | 2019-05-24 | 北京握奇智能科技有限公司 | 一种应用于移动终端的安全服务方法和装置 |
CN113612836B (zh) * | 2021-07-30 | 2023-04-07 | 恒宝股份有限公司 | 连接方法、装置、电子设备及计算机可读存储介质 |
Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101394615A (zh) * | 2007-09-20 | 2009-03-25 | ***股份有限公司 | 一种基于pki技术的移动支付终端及支付方法 |
CN101765105A (zh) * | 2009-12-17 | 2010-06-30 | 北京握奇数据***有限公司 | 实现通信加密的方法和***、移动终端 |
CN101938520A (zh) * | 2010-09-07 | 2011-01-05 | 中兴通讯股份有限公司 | 一种基于移动终端签名的远程支付***及方法 |
CN102026182A (zh) * | 2009-09-23 | 2011-04-20 | 联通兴业科贸有限公司 | 一种移动终端的安全控制方法及*** |
Family Cites Families (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101729245B (zh) * | 2008-10-24 | 2011-12-07 | 中兴通讯股份有限公司 | 密钥分发方法和*** |
CN101951361B (zh) * | 2010-07-30 | 2013-04-24 | 北京握奇数据***有限公司 | 访问智能卡的方法及服务器 |
-
2011
- 2011-11-11 CN CN201110357700.2A patent/CN103108323B/zh active Active
-
2012
- 2012-03-14 WO PCT/CN2012/072328 patent/WO2013067793A1/zh active Application Filing
Patent Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101394615A (zh) * | 2007-09-20 | 2009-03-25 | ***股份有限公司 | 一种基于pki技术的移动支付终端及支付方法 |
CN102026182A (zh) * | 2009-09-23 | 2011-04-20 | 联通兴业科贸有限公司 | 一种移动终端的安全控制方法及*** |
CN101765105A (zh) * | 2009-12-17 | 2010-06-30 | 北京握奇数据***有限公司 | 实现通信加密的方法和***、移动终端 |
CN101938520A (zh) * | 2010-09-07 | 2011-01-05 | 中兴通讯股份有限公司 | 一种基于移动终端签名的远程支付***及方法 |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN107451490A (zh) * | 2017-07-21 | 2017-12-08 | 广州大学 | 基于TrustZone的安全认证方法、装置、***及存储介质 |
Also Published As
Publication number | Publication date |
---|---|
CN103108323B (zh) | 2017-08-11 |
CN103108323A (zh) | 2013-05-15 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
WO2013067793A1 (zh) | 安全性操作执行***及执行方法 | |
US10547604B2 (en) | Information recording apparatus with shadow boot program for authentication with a server | |
US9281949B2 (en) | Device using secure processing zone to establish trust for digital rights management | |
CN103886260B (zh) | 一种基于二次签名验签技术的应用程序管控方法 | |
JP2011507091A (ja) | モバイル・コンピューティング装置上のソフトウェア・アプリケーションを管理するための方法およびシステム | |
US20220109667A1 (en) | Cryptographic trust enabled devices of cybersecurity systems | |
CA2616358A1 (en) | Secure software updates | |
WO2015024253A1 (zh) | 管理权限方法、装置及终端 | |
CN110324358B (zh) | 视频数据管控认证方法、模块、设备和平台 | |
CN108335105B (zh) | 数据处理方法及相关设备 | |
US11582607B2 (en) | Wireless security protocol | |
JP2020088726A (ja) | 鍵生成装置、鍵更新方法および鍵更新プログラム | |
US20210250179A1 (en) | Information processing apparatus, method and program | |
US11838282B2 (en) | Information recording apparatus with server-based user authentication for accessing a locked operating system storage | |
JP5781678B1 (ja) | 電子データ利用システム、携帯端末装置、及び電子データ利用システムにおける方法 | |
JP2015104020A (ja) | 通信端末装置、通信端末関連付けシステム、通信端末関連付け方法、及びコンピュータプログラム | |
CN109474431B (zh) | 客户端认证方法及计算机可读存储介质 | |
CN113545021B (zh) | 预先授权设备的注册 | |
KR101206735B1 (ko) | 모바일 단말기의 보안 관련 정보 보호 장치 및 그 방법 | |
WO2013067792A1 (zh) | 智能卡的访问方法、装置及*** | |
KR101711024B1 (ko) | 부정조작방지 장치 접근 방법 및 그 방법을 채용한 단말 장치 | |
JP5806187B2 (ja) | 秘密情報の交換方法およびコンピュータ | |
KR101208617B1 (ko) | 다중 어플리케이션의 단일 인증서 공유 장치 및 그 방법 | |
CN111246480A (zh) | 基于sim卡的应用通信方法、***、设备及存储介质 | |
WO2014194824A1 (zh) | 一种基于移动设备的认证方法和认证装置 |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 12847644 Country of ref document: EP Kind code of ref document: A1 |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
122 | Ep: pct application non-entry in european phase |
Ref document number: 12847644 Country of ref document: EP Kind code of ref document: A1 |