WO2017012176A1 - 基于hce的移动支付方法及装置、移动终端 - Google Patents

基于hce的移动支付方法及装置、移动终端 Download PDF

Info

Publication number
WO2017012176A1
WO2017012176A1 PCT/CN2015/088477 CN2015088477W WO2017012176A1 WO 2017012176 A1 WO2017012176 A1 WO 2017012176A1 CN 2015088477 W CN2015088477 W CN 2015088477W WO 2017012176 A1 WO2017012176 A1 WO 2017012176A1
Authority
WO
WIPO (PCT)
Prior art keywords
payment
verification information
mobile
hce
verification
Prior art date
Application number
PCT/CN2015/088477
Other languages
English (en)
French (fr)
Inventor
周文容
Original Assignee
宇龙计算机通信科技(深圳)有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 宇龙计算机通信科技(深圳)有限公司 filed Critical 宇龙计算机通信科技(深圳)有限公司
Publication of WO2017012176A1 publication Critical patent/WO2017012176A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/08—Payment architectures
    • G06Q20/20—Point-of-sale [POS] network systems
    • G06Q20/204—Point-of-sale [POS] network systems comprising interface for record bearing medium or carrier for electronic funds transfer or payment credit
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/327—Short range or proximity payments by means of M-devices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3829—Payment protocols; Details thereof insuring higher security of transaction involving key management
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • G06Q20/4014—Identity check for transactions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/12—Messaging; Mailboxes; Announcements
    • H04W4/14—Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD]

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to an HCE-based mobile payment method, an HCE-based mobile payment device, and a mobile terminal.
  • HCE High-based Card Emulation
  • Google the payment scheme based on HCE (Host-based Card Emulation) technology is also set by Google as the default support method for mobile payment of Android platform in Android 5.0 operating system.
  • Banks such as VISA, Bankinter, and Privatbank have also begun to support the use of HCE technology for mobile payments, and the security of HCE technology has become increasingly important.
  • the existing HCE-based mobile payment solutions include: (1) HCE-based cloud payment technology solution, providing security guarantee for HCE-based mobile payment through the cloud technology key system; (2) HCE-based front-end payment
  • the technical solution provides a security system for HCE-based mobile payment by providing a key system through an APP of a mobile terminal (for example, a mobile phone).
  • HCE-based mobile payment solution has the following drawbacks: (1) The HCE-based cloud payment technology solution requires real-time networking to enable mobile payment, and in the absence of the network, mobile payment cannot be performed normally; (2) Based on the HCE-based front-end payment technology solution, the key system is stored in the APP in the mobile terminal, and is easily tracked and tampered with, which brings great hidden danger to the security of mobile payment and is not conducive to user experience.
  • the invention is based on the above problems, and proposes a new technical solution, which can effectively prevent the key system from being tracked and tampered to provide a safe and reliable payment environment while not being networked.
  • HCE-based mobile payment can also be performed normally, thereby improving the user experience.
  • an HCE-based mobile payment method for a mobile terminal, including: establishing a communication connection between the mobile terminal and a current settlement terminal, and prompting the user to input payment verification information;
  • the received payment verification information is encrypted and sent to the trusted domain of the mobile terminal;
  • the encrypted payment verification information is verified by the key verification system in the trusted domain, according to the verification result. It is determined whether the mobile payment is made.
  • the mobile terminal first establishing a communication connection between the mobile terminal and the current settlement terminal (such as a POS machine), and reminding the user to input payment verification information after the establishment is completed, and after receiving the payment verification information input by the user for encryption processing, Sent to the trusted domain Trustzone of the terminal to ensure the security of the payment authentication information during the transmission process, avoid unnecessary loss caused by the leakage of the payment verification information, and then verify the system pair through the key stored in the trusted domain Trustzone.
  • the encrypted payment verification information is verified to determine whether to continue the mobile payment process.
  • the trusted domain is called when the payment is made.
  • the key system confirms the payment verification information, which can effectively prevent the key system from being tracked and tampered to provide a secure and reliable payment environment, and can also perform HCE-based mobile payment without being connected to the network, thereby improving the user.
  • the current settlement terminal such as a POS machine
  • the verification, by the key verification system in the trusted domain, the encrypted payment verification information, to determine whether to perform the mobile payment according to the verification result specifically includes: Decrypting the encrypted payment verification information by the key verification system; matching the payment verification information with preset verification information in the key verification system; determining whether to perform the movement according to the matching result Pay.
  • the encrypted payment verification information is sent to the trusted domain Trustzone of the mobile terminal, it is first decrypted by the key verification system stored in the trusted domain Trustzone, and then the decrypted payment is performed.
  • the verification information is matched with the preset verification information (which may be one or more) in the key verification system, and further determines whether to continue the mobile payment process according to the matching result, wherein Trustzone is ARM's security for the consumer electronic device
  • Trustzone is ARM's security for the consumer electronic device
  • determining, according to the matching result, whether to perform the mobile payment specifically, when the payment verification information is successfully matched with the preset verification information in the key verification system, Controlling the mobile payment; controlling to terminate the mobile payment when the payment verification information fails to match the preset verification information in the key verification system.
  • the payment verification information and the preset verification information include: a PIN code, fingerprint verification information, and face verification information.
  • the payment verification information input by the user and the preset verification information in the key verification system in the trusted domain include, but are not limited to, a PIN code (Personal Identification Number, such as a digital password, a graphic password, etc.)
  • the fingerprint verification information and the face verification information may of course also include verification information such as iris verification information that can ensure the smooth implementation of the technical solution of the present application.
  • the method further includes: receiving an application selection APDU command from the current settlement terminal, Establishing a communication connection with the current settlement terminal by selecting an APDU command according to the application and an AID default route value in the mobile terminal.
  • the APDU (Application Protocol Data Unit) instruction for application selection from the current settlement terminal is received, and the APDU command is selected according to the application to search for the AID default route value in the mobile terminal. Determining the payment routing value (payment path) matching the current settlement terminal to further establish a communication connection with the current settlement terminal, that is, a process of device matching identification, which provides the necessary premise guarantee for the implementation of the technical solution.
  • an HCE-based mobile payment device for a mobile terminal, comprising: a communication module, configured to establish communication between the mobile terminal and a current settlement terminal Connecting, and reminding the user to input the payment verification information; the encryption module is configured to encrypt the received payment verification information and send the information to the trusted domain of the mobile terminal; and the verification module is configured to pass the trusted domain
  • the key verification system verifies the encrypted payment verification information to determine whether to perform the mobile payment according to the verification result.
  • a communication connection between the mobile terminal and the current settlement terminal (for example, a POS machine) is first established, and after the establishment is completed, the user is prompted to input payment verification information, and after receiving the payment verification information input by the user, performing encryption processing. Then, it is sent to the trusted domain Trustzone of the terminal to ensure the security of the payment verification information during the transmission process, avoid unnecessary loss caused by the leakage of the payment verification information, and then pass the key verification system stored in the trusted domain Trustzone. Verifying the encrypted payment verification information to determine whether to continue the mobile payment process.
  • the call is trusted when the payment is made.
  • the key system of the domain confirms the payment verification information, which can effectively prevent the key system from being tracked and tampered to provide a secure and reliable payment environment, and can also perform HCE-based mobile payment without being connected to the network. user experience.
  • the verification module specifically includes: a decryption module, configured to decrypt the encrypted payment verification information by using the key verification system; and a matching module, configured to verify the payment The information is matched with the preset verification information in the key verification system; and the control module is configured to determine whether to perform the mobile payment according to the matching result.
  • the encrypted payment verification information is sent to the trusted domain Trustzone of the mobile terminal, it is first decrypted by the key verification system stored in the trusted domain Trustzone, and then the decrypted payment is performed.
  • the verification information is matched with the preset verification information (which may be one or more) in the key verification system, and further determines whether to continue the mobile payment process according to the matching result, wherein Trustzone is ARM's security for the consumer electronic device.
  • control module is specifically configured to: when the payment verification information is successfully matched with the preset verification information in the key verification system, control the implementation The mobile payment; when the payment verification information fails to match the preset verification information in the key verification system, the control terminates the mobile payment.
  • the payment verification information and the preset verification information include: a PIN code, fingerprint verification information, and face verification information.
  • the payment verification information input by the user and the preset verification information in the key verification system in the trusted domain include, but are not limited to, a PIN code (Personal Identification Number, such as a digital password, a graphic password, etc.)
  • the fingerprint verification information and the face verification information may of course also include verification information such as iris verification information that can ensure the smooth implementation of the technical solution of the present application.
  • the method further includes: a receiving module, configured to receive the communication connection from the current settlement terminal before the user establishes a communication connection between the mobile terminal and the current settlement terminal, and reminds the user to input the payment verification information
  • the application selects an APDU command to establish a communication connection with the current settlement terminal according to the application selection APDU command and an AID default route value in the mobile terminal.
  • the APDU (Application Protocol Data Unit) instruction for application selection from the current settlement terminal is received, and the APDU command is selected according to the application to search for the AID default route value in the mobile terminal. Determining the payment routing value (payment path) matching the current settlement terminal to further establish a communication connection with the current settlement terminal, that is, a process of device matching identification, which provides the necessary premise guarantee for the implementation of the technical solution.
  • a mobile terminal comprising: the HCE-based mobile payment device according to any one of the preceding claims, wherein the mobile terminal has any one of the foregoing technical solutions. All the beneficial effects of the HCE-based mobile payment device will not be described here.
  • the key system can be effectively prevented from being tracked and tampered to provide a secure and reliable payment environment, and the HCE-based mobile payment can be performed normally even when the network is not connected, thereby improving the user experience.
  • FIG. 1 is a flow chart showing an HCE-based mobile payment method according to an embodiment of the present invention
  • FIG. 2 shows a block diagram of an HCE-based mobile payment device in accordance with one embodiment of the present invention
  • FIG. 3 shows a block diagram of a mobile terminal in accordance with one embodiment of the present invention
  • FIG. 4 is a flow chart showing an HCE-based mobile payment method according to another embodiment of the present invention.
  • FIG. 1 shows a flow chart of an HCE-based mobile payment method according to an embodiment of the present invention.
  • an HCE-based mobile payment method for a mobile terminal, includes: Step 102, establishing a communication connection between the mobile terminal and a current settlement terminal, and reminding the user to input payment verification.
  • the mobile terminal first establishing a communication connection between the mobile terminal and the current settlement terminal (for example, a POS machine), and reminding the user to input the payment verification information after the establishment is completed, and in the connection
  • the authentication information is sent to the trusted domain Trustzone of the terminal to ensure the security of the payment verification information during the transmission process, thereby avoiding unnecessary loss caused by the leakage of the payment verification information, and then,
  • the encrypted payment verification information is verified by the key verification system stored in the trusted domain Trustzone, thereby determining whether to continue the mobile payment process, and thus, by storing the key system of the HCE-based mobile payment scheme on the mobile
  • the key system that calls the trusted domain at the time of payment confirms the payment verification information, which can effectively prevent the key system from being tracked and tampered to provide a secure and reliable payment environment while not being connected to the network.
  • HCE-based mobile payment can also be performed normally, thereby improving the user experience.
  • the step 106 includes: decrypting the encrypted payment verification information by using the key verification system; and the payment verification information and the key verification system The preset verification information is matched; and whether the mobile payment is performed is determined according to the matching result.
  • the encrypted payment verification information is sent to the trusted domain Trustzone of the mobile terminal, it is first decrypted by the key verification system stored in the trusted domain Trustzone, and then the decrypted payment is performed.
  • the verification information is matched with the preset verification information (which may be one or more) in the key verification system, and further determines whether to continue the mobile payment process according to the matching result, wherein Trustzone is ARM's security for the consumer electronic device.
  • determining, according to the matching result, whether to perform the mobile payment specifically, when the payment verification information is successfully matched with the preset verification information in the key verification system, Controlling the mobile payment; controlling to terminate the mobile payment when the payment verification information fails to match the preset verification information in the key verification system.
  • the payment verification information and the preset verification information include: a PIN code, fingerprint verification information, and face verification information.
  • the payment verification information input by the user and the preset verification information in the key verification system in the trusted domain include, but are not limited to, a PIN code (Personal Identification Number, such as a digital password, a graphic password, etc.)
  • the fingerprint verification information and the face verification information may of course also include verification information such as iris verification information that can ensure the smooth implementation of the technical solution of the present application.
  • the method further includes: receiving an Application Selection Data Unit (APDU) instruction from the current settlement terminal, to select an APDU according to the application.
  • APDU Application Selection Data Unit
  • the command and the AID default route value in the mobile terminal establish a communication connection with the current settlement terminal.
  • FIG. 2 shows a block diagram of an HCE-based mobile payment device in accordance with one embodiment of the present invention.
  • an HCE-based mobile payment device 200 for a mobile terminal includes: a communication module 202, configured to establish a communication connection between the mobile terminal and a current settlement terminal, and remind The user inputs the payment verification information; the encryption module 204 is configured to encrypt the received payment verification information and send the information to the trusted domain of the mobile terminal; and the verification module 206 is configured to use the key in the trusted domain.
  • the verification system verifies the encrypted payment verification information to determine whether to perform the mobile payment according to the verification result.
  • a communication connection between the mobile terminal and the current settlement terminal (for example, a POS machine) is first established, and after the establishment is completed, the user is prompted to input payment verification information, and after receiving the payment verification information input by the user, performing encryption processing. Then, it is sent to the trusted domain Trustzone of the terminal to ensure the security of the payment verification information during the transmission process, avoid unnecessary loss caused by the leakage of the payment verification information, and then pass the key verification system stored in the trusted domain Trustzone.
  • Verify the encrypted payment verification information to determine whether to continue this The secondary mobile payment process, in this way, by storing the key system of the HCE-based mobile payment scheme in the trusted domain of the mobile terminal, the key system that calls the trusted domain at the time of payment confirms the payment verification information, which can effectively prevent
  • the key system is tracked and tampered with to provide a secure and reliable payment environment, and HCE-based mobile payment can also be performed normally without networking, thereby improving the user experience.
  • the verification module 206 specifically includes: a decryption module 2062, configured to decrypt the encrypted payment verification information by using the key verification system; and a matching module 2064, configured to The payment verification information is matched with the preset verification information in the key verification system; the control module 2066 is configured to determine whether to perform the mobile payment according to the matching result.
  • the encrypted payment verification information is sent to the trusted domain Trustzone of the mobile terminal, it is first decrypted by the key verification system stored in the trusted domain Trustzone, and then the decrypted payment is performed.
  • the verification information is matched with the preset verification information (which may be one or more) in the key verification system, and further determines whether to continue the mobile payment process according to the matching result, wherein Trustzone is ARM's security for the consumer electronic device.
  • control module 2066 is specifically configured to: when the payment verification information is successfully matched with the preset verification information in the key verification system, control the mobile payment; When the payment verification information fails to match the preset verification information in the key verification system, the control terminates the mobile payment.
  • the payment verification information and the preset verification information include: a PIN code, fingerprint verification information, and face verification information.
  • the preset verification information in the system includes but is not limited to a PIN code (Personal Identification Number, such as a digital password, a graphic password, etc.), fingerprint verification information, and face verification information, and may also include iris verification information.
  • PIN code Personal Identification Number
  • fingerprint verification information such as a digital password, a graphic password, etc.
  • face verification information such as a digital password, a graphic password, etc.
  • iris verification information may also include iris verification information.
  • the method further includes: a receiving module 208, configured to receive the communication connection from the mobile terminal and the current settlement terminal, and prompt the user to input the payment verification information, and receive the current settlement terminal.
  • the application selects an APDU command to establish a communication connection with the current settlement terminal according to the application selection APDU command and the AID default route value in the mobile terminal.
  • the APDU (Application Protocol Data Unit) instruction for application selection from the current settlement terminal is received, and the APDU command is selected according to the application to search for the AID default route value in the mobile terminal. Determining the payment routing value (payment path) matching the current settlement terminal to further establish a communication connection with the current settlement terminal, that is, a process of device matching identification, which provides the necessary premise guarantee for the implementation of the technical solution.
  • FIG. 3 shows a block diagram of a mobile terminal in accordance with one embodiment of the present invention.
  • the mobile terminal 300 includes: the HCE-based mobile payment device 200 according to any one of the foregoing technical solutions, and therefore, the mobile terminal 300 has the above technical solution. All the beneficial effects of the HCE-based mobile payment device 200 described in any one of the above are not described herein.
  • FIG. 4 is a flow chart showing an HCE-based mobile payment method according to another embodiment of the present invention.
  • an HCE-based mobile payment method when mobile payment is performed by an HCE-based mobile payment scheme of NFC (Near Field Communication) technology, Trustzone (which can be used)
  • NFC Near Field Communication
  • Trustzone which can be used
  • the domain domain provides the key system authentication for the APP to ensure the security of the mobile payment.
  • the mobile terminal for example, an Andorid mobile phone or a PC
  • the POS the settlement terminal
  • the NFCC NFC Controller
  • the trusted domain Trustzone is ARM's security for consumer electronic devices. Architecture provides a low-cost solution for adding a dedicated security core to a single chip in a system. The hardware-built access control supports two virtual processors, allowing the application core to be between two states. Switching, in this architecture, can prevent information from leaking from a more trusted core domain to a less secure domain, mainly in the complete execution of the operating system in a security-deficient environment, and in a trusted environment A code that can have less security.
  • the technical solution provides a key system for saving the HCE mobile payment solution to the Trustzone of the mobile terminal, so that the key system in the Trustzone provides key authentication for the APP for mobile payment.
  • This solution saves the key system through Trustzone, and implements a scheme similar to the HCE-based front-end payment technology, which effectively prevents the key system from being tracked and tampered, and avoids the HCE-based cloud payment technology solution in the real-time network.
  • the technical bottleneck that cannot be used in the case finds a good balance between the convenience and security of mobile payment for users.
  • the key system of the HCE-based mobile payment solution is stored in the trusted domain of the mobile terminal, and the payment system is called by the key system of the trusted domain when the payment is made. It is confirmed that the key system can be effectively prevented from being tracked and tampered to provide a secure and reliable payment environment, and the HCE-based mobile payment can be performed normally even when the network is not connected, thereby improving the user experience.

Landscapes

  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Strategic Management (AREA)
  • Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • Finance (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Development Economics (AREA)
  • Economics (AREA)
  • Signal Processing (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
  • Telephone Function (AREA)

Abstract

本发明提出了一种基于HCE的移动支付方法、一种基于HCE的移动支付装置和一种移动终端，其中，基于HCE的移动支付方法包括：建立所述移动终端与当前结算终端的通信连接，并提醒用户输入支付验证信息；将接收到的所述支付验证信息加密后发送至所述移动终端的可信域；通过所述可信域中的密钥验证***对加密后的所述支付验证信息进行验证，以根据验证结果确定是否进行所述移动支付。该技术方案，通过将基于HCE的移动支付方案的密钥***存储在移动终端的可信域中，支付时调用可信域的密钥***对支付验证信息进行确认，可以有效地防止密钥***被跟踪和篡改，以提供安全可靠的支付环境的同时在不联网的情况也可以正常进行基于HCE的移动支付，从而提升用户体验。

Description

基于HCE的移动支付方法及装置、移动终端 技术领域
本发明涉及通信技术领域，具体而言，涉及一种基于HCE的移动支付方法、一种基于HCE的移动支付装置和一种移动终端。
背景技术
随着移动支付在生活中越来越普及，基于HCE(Host-based Card Emulation，基于主机的卡模拟)技术的支付方案也在Android 5.0操作***中被Google设置成了Android平台移动支付的默认支持方式，以及VISA、Bankinter、Privatbank等银行也已经开始支持使用HCE技术进行移动支付，HCE技术的安全性也已经显得越来越重要。
目前，现有的基于HCE的移动支付方案包括：(1)基于HCE的云端支付技术方案，通过云端技术的密钥***，为基于HCE的移动支付提供安全保证；(2)基于HCE的前端支付技术方案，通过移动终端(比如，手机)的APP提供密钥***，为基于HCE的移动支付提供安全保证。
但是，上述基于HCE的移动支付方案存在以下缺陷：(1)基于HCE的云端支付技术方案，需要实时联网才可以进行移动支付，在没有网络的情况下，将不能正常进行移动支付；(2)基于HCE的前端支付技术方案，密钥***保存在移动终端中的APP中，很容易被跟踪和篡改，给移动支付的安全带来很大隐患，不利于用户体验。
因此，如何有效地防止密钥***被跟踪和篡改，以提供安全可靠的支付环境的同时在不联网的情况也可以正常进行基于HCE的移动支付，从而提升用户体验，成为亟待解决的技术问题。
发明内容
本发明正是基于上述问题，提出了一种新的技术方案，可以有效地防止密钥***被跟踪和篡改，以提供安全可靠的支付环境的同时在不联网的 情况也可以正常进行基于HCE的移动支付，从而提升用户体验。
有鉴于此，本发明的第一方面，提出了一种基于HCE的移动支付方法，用于移动终端，包括：建立所述移动终端与当前结算终端的通信连接，并提醒用户输入支付验证信息；将接收到的所述支付验证信息加密后发送至所述移动终端的可信域；通过所述可信域中的密钥验证***对加密后的所述支付验证信息进行验证，以根据验证结果确定是否进行所述移动支付。
在该技术方案中，首先建立移动终端与当前结算终端(比如POS机)的通信连接，并在建立完成后提醒用户输入支付验证信息，以及在接收到用户输入的支付验证信息进行加密处理后再发送至终端的可信域Trustzone中，以确保支付验证信息在传输过程的安全性，避免因支付验证信息泄漏而造成不必要的损失，然后，通过可信域Trustzone中存储的密钥验证***对加密后的支付验证信息进行验证，从而确定是否继续完成此次移动支付过程，如此，通过将基于HCE的移动支付方案的密钥***存储在移动终端的可信域中，支付时调用可信域的密钥***对支付验证信息进行确认，可以有效地防止密钥***被跟踪和篡改，以提供安全可靠的支付环境的同时在不联网的情况也可以正常进行基于HCE的移动支付，从而提升用户体验。
在上述技术方案中，优选地，所述通过所述可信域中的密钥验证***对加密后的所述支付验证信息进行验证，以根据验证结果确定是否进行所述移动支付，具体包括：通过所述密钥验证***对加密后的所述支付验证信息进行解密；将所述支付验证信息与所述密钥验证***中的预设验证信息进行匹配；根据匹配结果确定是否进行所述移动支付。
在该技术方案中，当将经过加密处理的支付验证信息发送至移动终端的可信域Trustzone后，首先通过可信域Trustzone中存储的密钥验证***对其进行解密，进而将解密后的支付验证信息与密钥验证***中的预设验证信息(可以有一个或多个)进行匹配，并进一步根据匹配结果确定是否继续完成此次移动支付过程，其中，Trustzone是ARM针对消费电子设备安全提出的一种架构，提供了一种低成本的方案，在此架构下可以避免资讯从较可信的核心领域泄漏至较不安全的领域，如此，既可以有效地防止密钥***被跟踪 和篡改，也可以确保产品的生产成本，以进一步提升用户体验。
在上述技术方案中，优选地，所述根据匹配结果确定是否进行所述移动支付，具体包括：当所述支付验证信息与所述密钥验证***中的所述预设验证信息匹配成功时，控制进行所述移动支付；当所述支付验证信息与所述密钥验证***中的所述预设验证信息匹配失败时，控制终止所述移动支付。
在该技术方案中，当用户输入的支付验证信息与存储在移动终端的可信域Trustzone中的密钥验证***中的预设验证信息匹配成功时，则控制完成此次支付，否则终止交易，在有效提高移动支付安全性和可靠性的同时，也确保了移动支付不受是否联网的影响，可见，解决了现有的基于HCE的前端或云端支付技术方案中存在的问题，更利于用户体验。
在上述技术方案中，优选地，所述支付验证信息和所述预设验证信息包括：PIN码、指纹验证信息和人脸验证信息。
在该技术方案中，用户输入的支付验证信息和可信域中的密钥验证***中的预设验证信息包括但不限于PIN码(Personal Identification Number，个人识别密码，比如数字密码、图形密码等)、指纹验证信息和人脸验证信息，当然也可以包括虹膜验证信息等可以保证本申请的技术方案顺利实施的验证信息。
在上述技术方案中，优选地，在所述建立所述移动终端与当前结算终端的通信连接，并提醒用户输入支付验证信息之前，还包括：接收来自所述当前结算终端的应用选择APDU指令，以根据所述应用选择APDU指令和所述移动终端中的AID默认路由值建立与所述当前结算终端的通信连接。
在该技术方案中，通过接收来自当前结算终端的用于应用选择的APDU(Application Protocol Data Unit，应用协议数据单元)指令，并根据该应用选择APDU指令在移动终端中的AID默认路由值中查找确定与该当前结算终端相匹配的支付路由值(支付路径)，以进一步建立与当前结算终端的通信连接，即一个设备匹配识别的过程，为该技术方案的实现提供了必要的前提保障。
根据本发明的第二方面，提出了一种基于HCE的移动支付装置，用于移动终端，包括：通信模块，用于建立所述移动终端与当前结算终端的通信 连接，并提醒用户输入支付验证信息；加密模块，用于将接收到的所述支付验证信息加密后发送至所述移动终端的可信域；验证模块，用于通过所述可信域中的密钥验证***对加密后的所述支付验证信息进行验证，以根据验证结果确定是否进行所述移动支付。
在该技术方案中，首先建立移动终端与当前结算终端(比如，POS机)的通信连接，并在建立完成后提醒用户输入支付验证信息，以及在接收到用户输入的支付验证信息进行加密处理后再发送至终端的可信域Trustzone中，以确保支付验证信息在传输过程的安全性，避免因支付验证信息泄漏而造成不必要的损失，然后，通过可信域Trustzone中存储的密钥验证***对加密后的支付验证信息进行验证，从而确定是否继续完成此次移动支付过程，如此，通过将基于HCE的移动支付方案的密钥***存储在移动终端的可信域中，支付时调用可信域的密钥***对支付验证信息进行确认，可以有效地防止密钥***被跟踪和篡改，以提供安全可靠的支付环境的同时在不联网的情况也可以正常进行基于HCE的移动支付，从而提升用户体验。
在上述技术方案中，优选地，所述验证模块具体包括：解密模块，用于通过所述密钥验证***对加密后的所述支付验证信息进行解密；匹配模块，用于将所述支付验证信息与所述密钥验证***中的预设验证信息进行匹配；控制模块，用于根据匹配结果确定是否进行所述移动支付。
在该技术方案中，当将经过加密处理的支付验证信息发送至移动终端的可信域Trustzone后，首先通过可信域Trustzone中存储的密钥验证***对其进行解密，进而将解密后的支付验证信息与密钥验证***中的预设验证信息(可以有一个或多个)进行匹配，并进一步根据匹配结果确定是否继续完成此次移动支付过程，其中，Trustzone是ARM针对消费电子设备安全提出的一种架构，提供了一种低成本的方案，在此架构下可以避免资讯从较可信的核心领域泄漏至较不安全的领域，如此，既可以有效地防止密钥***被跟踪和篡改，也可以确保产品的生产成本，以进一步提升用户体验。
在上述技术方案中，优选地，所述控制模块具体用于：当所述支付验证信息与所述密钥验证***中的所述预设验证信息匹配成功时，控制进行所 述移动支付；当所述支付验证信息与所述密钥验证***中的所述预设验证信息匹配失败时，控制终止所述移动支付。
在该技术方案中，当用户输入的支付验证信息与存储在移动终端的可信域Trustzone中的密钥验证***中的预设验证信息匹配成功时，则控制完成此次支付，否则终止交易，在有效提高移动支付安全性和可靠性的同时，也确保了移动支付不受是否联网的影响，可见，解决了现有的基于HCE的前端或云端支付技术方案中存在的问题，更利于用户体验。
在上述技术方案中，优选地，所述支付验证信息和所述预设验证信息包括：PIN码、指纹验证信息和人脸验证信息。
在该技术方案中，用户输入的支付验证信息和可信域中的密钥验证***中的预设验证信息包括但不限于PIN码(Personal Identification Number，个人识别密码，比如数字密码、图形密码等)、指纹验证信息和人脸验证信息，当然也可以包括虹膜验证信息等可以保证本申请的技术方案顺利实施的验证信息。
在上述技术方案中，优选地，还包括：接收模块，用于在所述建立所述移动终端与当前结算终端的通信连接，并提醒用户输入支付验证信息之前，接收来自所述当前结算终端的应用选择APDU指令，以根据所述应用选择APDU指令和所述移动终端中的AID默认路由值建立与所述当前结算终端的通信连接。
在该技术方案中，通过接收来自当前结算终端的用于应用选择的APDU(Application Protocol Data Unit，应用协议数据单元)指令，并根据该应用选择APDU指令在移动终端中的AID默认路由值中查找确定与该当前结算终端相匹配的支付路由值(支付路径)，以进一步建立与当前结算终端的通信连接，即一个设备匹配识别的过程，为该技术方案的实现提供了必要的前提保障。
根据本发明的第三方面，提出了一种移动终端，包括：如上述技术方案中任一项所述的基于HCE的移动支付装置，因此，该移动终端具有上述技术方案中任一项所述的基于HCE的移动支付装置的所有有益效果，在此不再赘述。
通过本发明的技术方案，可以有效地防止密钥***被跟踪和篡改，以提供安全可靠的支付环境的同时在不联网的情况也可以正常进行基于HCE的移动支付，从而提升用户体验。
附图说明
图1示出了根据本发明的一个实施例的基于HCE的移动支付方法的流程示意图；
图2示出了根据本发明的一个实施例的基于HCE的移动支付装置的框图；
图3示出了根据本发明的一个实施例的移动终端的框图；
图4示出了根据本发明的另一个实施例的基于HCE的移动支付方法的流程示意图。
具体实施方式
为了可以更清楚地理解本发明的上述目的、特征和优点，下面结合附图和具体实施方式对本发明进行进一步的详细描述。需要说明的是，在不冲突的情况下，本申请的实施例及实施例中的特征可以相互组合。
在下面的描述中阐述了很多具体细节以便于充分理解本发明，但是，本发明还可以采用其他不同于在此描述的其他方式来实施，因此，本发明的保护范围并不受下面公开的具体实施例的限制。
图1示出了根据本发明的一个实施例的基于HCE的移动支付方法的流程示意图。
如图1所示，根据本发明的一个实施例的基于HCE的移动支付方法，用于移动终端，包括：步骤102，建立所述移动终端与当前结算终端的通信连接，并提醒用户输入支付验证信息；步骤104，将接收到的所述支付验证信息加密后发送至所述移动终端的可信域；步骤106，通过所述可信域中的密钥验证***对加密后的所述支付验证信息进行验证，以根据验证结果确定是否进行所述移动支付。
在该技术方案中，首先建立移动终端与当前结算终端(比如，POS机)的通信连接，并在建立完成后提醒用户输入支付验证信息，以及在接 收到用户输入的支付验证信息进行加密处理后再发送至终端的可信域Trustzone中，以确保支付验证信息在传输过程的安全性，避免因支付验证信息泄漏而造成不必要的损失，然后，通过可信域Trustzone中存储的密钥验证***对加密后的支付验证信息进行验证，从而确定是否继续完成此次移动支付过程，如此，通过将基于HCE的移动支付方案的密钥***存储在移动终端的可信域中，支付时调用可信域的密钥***对支付验证信息进行确认，可以有效地防止密钥***被跟踪和篡改，以提供安全可靠的支付环境的同时在不联网的情况也可以正常进行基于HCE的移动支付，从而提升用户体验。
在上述技术方案中，优选地，所述步骤106具体包括：通过所述密钥验证***对加密后的所述支付验证信息进行解密；将所述支付验证信息与所述密钥验证***中的预设验证信息进行匹配；根据匹配结果确定是否进行所述移动支付。
在该技术方案中，当将经过加密处理的支付验证信息发送至移动终端的可信域Trustzone后，首先通过可信域Trustzone中存储的密钥验证***对其进行解密，进而将解密后的支付验证信息与密钥验证***中的预设验证信息(可以有一个或多个)进行匹配，并进一步根据匹配结果确定是否继续完成此次移动支付过程，其中，Trustzone是ARM针对消费电子设备安全提出的一种架构，提供了一种低成本的方案，在此架构下可以避免资讯从较可信的核心领域泄漏至较不安全的领域，如此，既可以有效地防止密钥***被跟踪和篡改，也可以确保产品的生产成本，以进一步提升用户体验。
在上述技术方案中，优选地，所述根据匹配结果确定是否进行所述移动支付，具体包括：当所述支付验证信息与所述密钥验证***中的所述预设验证信息匹配成功时，控制进行所述移动支付；当所述支付验证信息与所述密钥验证***中的所述预设验证信息匹配失败时，控制终止所述移动支付。
在该技术方案中，当用户输入的支付验证信息与存储在移动终端的可信域Trustzone中的密钥验证***中的预设验证信息匹配成功时，则控制完成此次支付，否则终止交易，在有效提高移动支付安全性和可靠性的同时，也确保了移动支付不受是否联网的影响，可见，解决了现有的基于HCE的前端或云端支付技术方案中存在的问题，更利于用户体验。
在上述技术方案中，优选地，所述支付验证信息和所述预设验证信息包括：PIN码、指纹验证信息和人脸验证信息。
在该技术方案中，用户输入的支付验证信息和可信域中的密钥验证***中的预设验证信息包括但不限于PIN码(Personal Identification Number，个人识别密码，比如数字密码、图形密码等)、指纹验证信息和人脸验证信息，当然也可以包括虹膜验证信息等可以保证本申请的技术方案顺利实施的验证信息。
在上述技术方案中，优选地，在所述步骤102之前，还包括：接收来自所述当前结算终端的应用选择APDU(Application Protocol Data Unit，应用协议数据单元)指令，以根据所述应用选择APDU指令和所述移动终端中的AID默认路由值建立与所述当前结算终端的通信连接。
在该技术方案中，通过接收来自当前结算终端的用于应用选择的APDU指令，并根据该应用选择APDU指令在移动终端中的AID默认路由值中查找确定与该当前结算终端相匹配的支付路由值(支付路径)，以进一步建立与当前结算终端的通信连接，即一个设备匹配识别的过程，为该技术方案的实现提供了必要的前提保障。
图2示出了根据本发明的一个实施例的基于HCE的移动支付装置的框图。
如图2所示，根据本发明的一个实施例的基于HCE的移动支付装置200，用于移动终端，包括：通信模块202，用于建立所述移动终端与当前结算终端的通信连接，并提醒用户输入支付验证信息；加密模块204，用于将接收到的所述支付验证信息加密后发送至所述移动终端的可信域；验证模块206，用于通过所述可信域中的密钥验证***对加密后的所述支付验证信息进行验证，以根据验证结果确定是否进行所述移动支付。
在该技术方案中，首先建立移动终端与当前结算终端(比如，POS机)的通信连接，并在建立完成后提醒用户输入支付验证信息，以及在接收到用户输入的支付验证信息进行加密处理后再发送至终端的可信域Trustzone中，以确保支付验证信息在传输过程的安全性，避免因支付验证信息泄漏而造成不必要的损失，然后，通过可信域Trustzone中存储的密钥验证***对加密后的支付验证信息进行验证，从而确定是否继续完成此 次移动支付过程，如此，通过将基于HCE的移动支付方案的密钥***存储在移动终端的可信域中，支付时调用可信域的密钥***对支付验证信息进行确认，可以有效地防止密钥***被跟踪和篡改，以提供安全可靠的支付环境的同时在不联网的情况也可以正常进行基于HCE的移动支付，从而提升用户体验。
在上述技术方案中，优选地，所述验证模块206具体包括：解密模块2062，用于通过所述密钥验证***对加密后的所述支付验证信息进行解密；匹配模块2064，用于将所述支付验证信息与所述密钥验证***中的预设验证信息进行匹配；控制模块2066，用于根据匹配结果确定是否进行所述移动支付。
在该技术方案中，当将经过加密处理的支付验证信息发送至移动终端的可信域Trustzone后，首先通过可信域Trustzone中存储的密钥验证***对其进行解密，进而将解密后的支付验证信息与密钥验证***中的预设验证信息(可以有一个或多个)进行匹配，并进一步根据匹配结果确定是否继续完成此次移动支付过程，其中，Trustzone是ARM针对消费电子设备安全提出的一种架构，提供了一种低成本的方案，在此架构下可以避免资讯从较可信的核心领域泄漏至较不安全的领域，如此，既可以有效地防止密钥***被跟踪和篡改，也可以确保产品的生产成本，以进一步提升用户体验。
在上述技术方案中，优选地，所述控制模块2066具体用于：当所述支付验证信息与所述密钥验证***中的所述预设验证信息匹配成功时，控制进行所述移动支付；当所述支付验证信息与所述密钥验证***中的所述预设验证信息匹配失败时，控制终止所述移动支付。
在该技术方案中，当用户输入的支付验证信息与存储在移动终端的可信域Trustzone中的密钥验证***中的预设验证信息匹配成功时，则控制完成此次支付，否则终止交易，在有效提高移动支付安全性和可靠性的同时，也确保了移动支付不受是否联网的影响，可见，解决了现有的基于HCE的前端或云端支付技术方案中存在的问题，更利于用户体验。
在上述技术方案中，优选地，所述支付验证信息和所述预设验证信息包括：PIN码、指纹验证信息和人脸验证信息。
在该技术方案中，用户输入的支付验证信息和可信域中的密钥验证系 统中的预设验证信息包括但不限于PIN码(Personal Identification Number，个人识别密码，比如数字密码、图形密码等)、指纹验证信息和人脸验证信息，当然也可以包括虹膜验证信息等可以保证本申请的技术方案顺利实施的验证信息。
在上述技术方案中，优选地，还包括：接收模块208，用于在所述建立所述移动终端与当前结算终端的通信连接，并提醒用户输入支付验证信息之前，接收来自所述当前结算终端的应用选择APDU指令，以根据所述应用选择APDU指令和所述移动终端中的AID默认路由值建立与所述当前结算终端的通信连接。
在该技术方案中，通过接收来自当前结算终端的用于应用选择的APDU(Application Protocol Data Unit，应用协议数据单元)指令，并根据该应用选择APDU指令在移动终端中的AID默认路由值中查找确定与该当前结算终端相匹配的支付路由值(支付路径)，以进一步建立与当前结算终端的通信连接，即一个设备匹配识别的过程，为该技术方案的实现提供了必要的前提保障。
图3示出了根据本发明的一个实施例的移动终端的框图。
如图3所示，根据本发明的一个实施例的移动终端300，包括：如上述技术方案中任一项所述的基于HCE的移动支付装置200，因此，该移动终端300具有上述技术方案中任一项所述的基于HCE的移动支付装置200的所有有益效果，在此不再赘述。
图4示出了根据本发明的另一个实施例的基于HCE的移动支付方法的流程示意图。
如图4所示，根据本发明的另一个实施例的基于HCE的移动支付方法，通过NFC(Near Field Communication，近场通信)技术的基于HCE的移动支付方案进行移动支付时，使用Trustzone(可信域)为APP提供密钥***认证，以确保移动支付的安全进行，具体地，当移动终端(比如，Andorid手机、PC机)将移动支付方式默认设置成基于HCE的支付方式后，用户持移动终端进行POS刷卡时，POS机(结算终端)向移动终端发出应用选择的APDU指令，移动终端的NFCC(NFC Controller，NFC控制器)在收到APDU指令后，从AID默认路由值中选择相应的应 用(即建立移动终端与当前结算终端的通信连接)，应用被选择后，则要求用户输入相应的PIN码(或者是指纹，脸部等认证信息)等认证信息(支付验证信息)，然后，移动终端则会调用Trustzone中的密钥***对认证信息进行解密和确认，当认证信息确认正确后则进行交易处理，否则终止交易，其中，可信域Trustzone是ARM针对消费电子设备安全提出的一种架构，提供了一种低成本的方案，针对***单芯片内加入专属的安全核心，由硬件建构的存取控制方式支援两颗虚拟的处理器，使得应用程式核心能够在两个状态之间切换，在此架构下可以避免资讯从较可信的核心领域泄漏至较不安全的领域，其主要是能在一个缺乏安全性的环境下完整地执行操作***，并可在可信的环境下能有更少的安全性的编码。
本技术方案提供了一种将HCE移动支付方案的密钥***保存到移动终端的Trustzone中，进而使Trustzone中的密钥***为进行移动支付的APP提供密钥认证。
本方案通过Trustzone对密钥***进行保存，实现类似于基于HCE的前端支付技术的方案，有效地防止了密钥***被跟踪和篡改，同时又避免了基于HCE的云端支付技术方案在未实时联网的情况下不能使用的技术瓶颈，在给用户进行移动支付的便捷性和安全性之间找到了一个很好的平衡点。
以上结合附图详细说明了本发明的技术方案，通过将基于HCE的移动支付方案的密钥***存储在移动终端的可信域中，支付时调用可信域的密钥***对支付验证信息进行确认，可以有效地防止密钥***被跟踪和篡改，以提供安全可靠的支付环境的同时在不联网的情况也可以正常进行基于HCE的移动支付，从而提升用户体验。
以上所述仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (11)

  1. 一种基于HCE的移动支付方法，用于移动终端，其特征在于，包括：
    建立所述移动终端与当前结算终端的通信连接，并提醒用户输入支付验证信息；
    将接收到的所述支付验证信息加密后发送至所述移动终端的可信域；
    通过所述可信域中的密钥验证***对加密后的所述支付验证信息进行验证，以根据验证结果确定是否进行所述移动支付。
  2. 根据权利要求1所述的基于HCE的移动支付方法，其特征在于，所述通过所述可信域中的密钥验证***对加密后的所述支付验证信息进行验证，以根据验证结果确定是否进行所述移动支付，具体包括：
    通过所述密钥验证***对加密后的所述支付验证信息进行解密；
    将所述支付验证信息与所述密钥验证***中的预设验证信息进行匹配；
    根据匹配结果确定是否进行所述移动支付。
  3. 根据权利要求2所述的基于HCE的移动支付方法，其特征在于，所述根据匹配结果确定是否进行所述移动支付，具体包括：
    当所述支付验证信息与所述密钥验证***中的所述预设验证信息匹配成功时，控制进行所述移动支付；
    当所述支付验证信息与所述密钥验证***中的所述预设验证信息匹配失败时，控制终止所述移动支付。
  4. 根据权利要求2或3所述的基于HCE的移动支付方法，其特征在于，所述支付验证信息和所述预设验证信息包括：
    PIN码、指纹验证信息和人脸验证信息。
  5. 根据权利要求1至3中任一项所述的基于HCE的移动支付方法，其特征在于，在所述建立所述移动终端与当前结算终端的通信连接，并提醒用户输入支付验证信息之前，还包括：
    接收来自所述当前结算终端的应用选择APDU指令，以根据所述应用选择APDU指令和所述移动终端中的AID默认路由值建立与所述当前结算终端 的通信连接。
  6. 一种基于HCE的移动支付装置，用于移动终端，其特征在于，包括：
    通信模块，用于建立所述移动终端与当前结算终端的通信连接，并提醒用户输入支付验证信息；
    加密模块，用于将接收到的所述支付验证信息加密后发送至所述移动终端的可信域；
    验证模块，用于通过所述可信域中的密钥验证***对加密后的所述支付验证信息进行验证，以根据验证结果确定是否进行所述移动支付。
  7. 根据权利要求6所述的基于HCE的移动支付装置，其特征在于，所述验证模块具体包括：
    解密模块，用于通过所述密钥验证***对加密后的所述支付验证信息进行解密；
    匹配模块，用于将所述支付验证信息与所述密钥验证***中的预设验证信息进行匹配；
    控制模块，用于根据匹配结果确定是否进行所述移动支付。
  8. 根据权利要求7所述的基于HCE的移动支付装置，其特征在于，所述控制模块具体用于：
    当所述支付验证信息与所述密钥验证***中的所述预设验证信息匹配成功时，控制进行所述移动支付；
    当所述支付验证信息与所述密钥验证***中的所述预设验证信息匹配失败时，控制终止所述移动支付。
  9. 根据权利要求7或8所述的基于HCE的移动支付装置，其特征在于，所述支付验证信息和所述预设验证信息包括：
    PIN码、指纹验证信息和人脸验证信息。
  10. 根据权利要求6至8中任一项所述的基于HCE的移动支付装置，其特征在于，还包括：
    接收模块，用于在所述建立所述移动终端与当前结算终端的通信连接，并提醒用户输入支付验证信息之前，接收来自所述当前结算终端的应用选择 APDU指令，以根据所述应用选择APDU指令和所述移动终端中的AID默认路由值建立与所述当前结算终端的通信连接。
  11. 一种移动终端，其特征在于，包括：如权利要求6至10中任一项所述的基于HCE的移动支付装置。
PCT/CN2015/088477 2015-07-23 2015-08-30 基于hce的移动支付方法及装置、移动终端 WO2017012176A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510439444.X 2015-07-23
CN201510439444.XA CN105631655A (zh) 2015-07-23 2015-07-23 基于hce的移动支付方法及装置、移动终端

Publications (1)

Publication Number Publication Date
WO2017012176A1 true WO2017012176A1 (zh) 2017-01-26

Family

ID=56046554

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/088477 WO2017012176A1 (zh) 2015-07-23 2015-08-30 基于hce的移动支付方法及装置、移动终端

Country Status (2)

Country Link
CN (1) CN105631655A (zh)
WO (1) WO2017012176A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2018205056A1 (zh) * 2017-05-07 2018-11-15 深圳市卓希科技有限公司 一种密钥保全方法和***
CN115348631A (zh) * 2022-07-01 2022-11-15 鹏城实验室 一种超密集网络中切换控制方法、装置、终端及存储介质

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106357663A (zh) * 2016-09-30 2017-01-25 ***股份有限公司 用于hce模式的数据加密方法
KR101843660B1 (ko) * 2016-12-30 2018-03-29 브이피 주식회사 Hce 모바일 교통 카드 결제 방법
CN106952090A (zh) * 2017-02-27 2017-07-14 努比亚技术有限公司 支付验证装置及方法
CN107256578A (zh) * 2017-04-12 2017-10-17 深圳市微付充科技有限公司 一种闸机支付方法、etc终端、终端附件及移动终端
CN109147164A (zh) * 2017-06-16 2019-01-04 北京橙鑫数据科技有限公司 多卡片的安全认证方法、装置以及移动终端
CN108492101A (zh) * 2018-01-31 2018-09-04 阿里巴巴集团控股有限公司 一种支付乘车费的方法、装置及设备
CN108664772A (zh) * 2018-04-27 2018-10-16 北京可信华泰信息技术有限公司 一种保证***安全性的方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102057386A (zh) * 2008-06-06 2011-05-11 电子湾有限公司 可信服务管理器(tsm)体系架构和方法
US20140025581A1 (en) * 2012-07-19 2014-01-23 Bank Of America Corporation Mobile transactions using authorized tokens
CN103544599A (zh) * 2012-07-09 2014-01-29 马克西姆综合产品公司 用于在移动终端内认证、存储和交易的嵌入式安全元件
KR20140112785A (ko) * 2013-03-14 2014-09-24 에스케이플래닛 주식회사 금융서비스 제공 시스템 및 그 방법, 그리고 이에 적용되는 장치
CN104166914A (zh) * 2014-08-20 2014-11-26 武汉天喻信息产业股份有限公司 基于安全元件的主机卡片模拟技术的安全***及方法

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104657858A (zh) * 2013-11-20 2015-05-27 ***通信集团广东有限公司 一种电子钱包身份认证方法、装置及移动终端
CN104732391A (zh) * 2013-12-24 2015-06-24 ***股份有限公司 使用虚拟卡的支付终端、支付后台和支付方法
CN104598793A (zh) * 2015-01-08 2015-05-06 百度在线网络技术（北京）有限公司 一种指纹认证方法和装置
CN104700268B (zh) * 2015-03-30 2018-10-16 中科创达软件股份有限公司 一种移动支付方法及移动设备

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102057386A (zh) * 2008-06-06 2011-05-11 电子湾有限公司 可信服务管理器(tsm)体系架构和方法
CN103544599A (zh) * 2012-07-09 2014-01-29 马克西姆综合产品公司 用于在移动终端内认证、存储和交易的嵌入式安全元件
US20140025581A1 (en) * 2012-07-19 2014-01-23 Bank Of America Corporation Mobile transactions using authorized tokens
KR20140112785A (ko) * 2013-03-14 2014-09-24 에스케이플래닛 주식회사 금융서비스 제공 시스템 및 그 방법, 그리고 이에 적용되는 장치
CN104166914A (zh) * 2014-08-20 2014-11-26 武汉天喻信息产业股份有限公司 基于安全元件的主机卡片模拟技术的安全***及方法

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2018205056A1 (zh) * 2017-05-07 2018-11-15 深圳市卓希科技有限公司 一种密钥保全方法和***
CN115348631A (zh) * 2022-07-01 2022-11-15 鹏城实验室 一种超密集网络中切换控制方法、装置、终端及存储介质
CN115348631B (zh) * 2022-07-01 2024-04-16 鹏城实验室 一种超密集网络中切换控制方法、装置、终端及存储介质

Also Published As

Publication number Publication date
CN105631655A (zh) 2016-06-01

Similar Documents

Publication Publication Date Title
WO2017012176A1 (zh) 基于hce的移动支付方法及装置、移动终端
JP7043701B2 (ja) ソフトウェアアプリケーションの信頼を最初に確立し、かつ定期的に確認するシステム及び方法
US10699277B2 (en) Security for mobile payment applications
EP2945410B1 (en) Security for mobile applications
US11501294B2 (en) Method and device for providing and obtaining graphic code information, and terminal
AU2012303620B2 (en) System and method for secure transaction process via mobile device
EP4081921B1 (en) Contactless card personal identification system
CN112823335A (zh) 用于非接触卡的密码认证的***和方法
KR20150132471A (ko) 미디어 바인딩을 사용하는 안전한 모바일 결제
CN112889046A (zh) 用于非接触卡的密码认证的***和方法
CN109902477A (zh) 保障音频通信安全
CN113168631A (zh) 用于非接触卡的密码认证的***和方法
JP2024079694A (ja) 顧客サポート呼の事前認証のためのシステムおよび方法
US10778416B2 (en) Cryptographic system management
WO2015168878A1 (zh) 支付方法和装置以及支付要素处理方法和装置
WO2015096645A1 (zh) 使用虚拟卡的支付终端、支付后台和支付方法
KR101625065B1 (ko) 휴대단말기에서의 사용자 인증방법
KR20140007628A (ko) 모바일 계좌이체 검증처리 방법
KR101513434B1 (ko) 키 입력 보호 방법과 이를 위한 키 보호 모듈

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15898732

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15898732

Country of ref document: EP

Kind code of ref document: A1