WO2023197541A1 - 用户识别卡及智能终端、用户识别卡应用方法 - Google Patents
用户识别卡及智能终端、用户识别卡应用方法 Download PDFInfo
- Publication number
- WO2023197541A1 WO2023197541A1 PCT/CN2022/124584 CN2022124584W WO2023197541A1 WO 2023197541 A1 WO2023197541 A1 WO 2023197541A1 CN 2022124584 W CN2022124584 W CN 2022124584W WO 2023197541 A1 WO2023197541 A1 WO 2023197541A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- interface
- subscriber identity
- processing module
- identity card
- spi
- Prior art date
Links
- 238000000034 method Methods 0.000 title claims abstract description 41
- 238000004891 communication Methods 0.000 claims abstract description 85
- 238000012545 processing Methods 0.000 claims abstract description 85
- 230000003993 interaction Effects 0.000 claims abstract description 17
- 230000000630 rising effect Effects 0.000 claims description 8
- 230000008569 process Effects 0.000 claims description 7
- 230000010365 information processing Effects 0.000 abstract description 3
- 238000010586 diagram Methods 0.000 description 10
- 230000002457 bidirectional effect Effects 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 230000002093 peripheral effect Effects 0.000 description 2
- 230000005540 biological transmission Effects 0.000 description 1
- 238000013480 data collection Methods 0.000 description 1
- 230000000977 initiatory effect Effects 0.000 description 1
- 238000013507 mapping Methods 0.000 description 1
- 238000010295 mobile communication Methods 0.000 description 1
- 230000001131 transforming effect Effects 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
- H04W4/60—Subscription-based services using application servers or record carriers, e.g. SIM application toolkits
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/40—Security arrangements using identity modules
Definitions
- the invention relates to the field of communication technology, and in particular to a subscriber identification card, an intelligent terminal, and a subscriber identification card application method.
- SIM Subscriber Identity Module
- IC integrated circuit
- the purpose of the present invention is to provide a subscriber identity card, a smart terminal, and a subscriber identity card application method, especially a method for extending the subscriber identity card's application support capabilities, thereby expanding the application program support capabilities of the subscriber identity card. Improve the performance and security of application operations.
- a subscriber identity card including a first communication interface.
- the first communication interface supports multiplexing of a 7816 interface and an SPI+ interface, wherein the communication rate of the SPI+ interface is higher than that of the 7816 interface. communication rate;
- a first operating unit connected to the first communication interface to transmit data, the first operating unit runs a first subroutine to implement at least one of the following functions: secure startup, encryption, decryption and Certification.
- the first communication interface is connected to the second communication interface of the smart terminal to transmit data.
- an intelligent terminal including a processing module; the processing module includes: a second communication interface, the second communication interface supports multiplexing of the 7816 interface and the SPI+ interface, wherein the SPI+ interface The communication rate is higher than the communication rate of the 7816 interface; a second operating unit is connected to the second communication interface to transmit data, and runs a second subroutine to process non-sensitive data and/or implement human-computer interaction ;
- the second communication interface is connected to the first communication interface of the subscriber identity card to transmit data.
- the first communication interface and/or the second communication interface include a data port for data input and/or output; a clock port for transmitting a clock signal.
- the rising edge of the clock signal or The falling edge is used as the synchronization signal of the data; and the reset port is used to transmit the reset signal, the reset signal is active at high level or low level, wherein when the processing module sends a valid reset signal to the subscriber identification card , the subscriber identification card performs a cold reset; when the subscriber identification card sends a valid reset signal to the processing module, the processing module performs a hot reset on the second subroutine.
- the subscriber identification card or the processing module can serve as the master to initiate communication.
- a subscriber identity card application method including running a first subroutine on the subscriber identity card to implement secure startup and/or encryption and/or decryption and/or authentication; by supporting the 7816 interface and The SPI+ interface multiplexes the communication interface to establish the communication connection between the user identification card and the processing module; and runs the second subroutine on the processing module of the smart terminal.
- the subscriber identity card application method also includes the subscriber identity card/processing module initiating an inquiry to the processing module/user identity card using the 7816 protocol as to whether the SPI+ interface is supported; in the processing module/user When the identification card supports the SPI+ interface, the processing module and the subscriber identification card communicate using the SPI+ interface protocol; when the processing module/subscriber identification card does not support the SPI+ interface, the processing module The module communicates with the subscriber identification card using the 7816 interface protocol.
- the subscriber identity card application method further includes the subscriber identity card sending a first reset signal to the processing module, and the processing module performs a hot reset on the application program after obtaining the first reset signal; Or the processing module sends a second reset signal to the subscriber identity card, and the subscriber identity card performs a cold reset after obtaining the second reset signal.
- the subscriber identity card application method further includes: the subscriber identity card sending a clock signal to the processing module; or the The processing module sends a clock signal to the subscriber identity card, where the rising edge or falling edge of the clock signal serves as a synchronization signal for the data interaction.
- the first subroutine is run on the subscriber identity card to implement secure startup and/or encryption and/or decryption and/or authentication, thereby improving the application program Operational security.
- running the second subroutine on the processing module to execute the application program expands the user identification card's ability to support the application program.
- the communication interface between the user identification card and the processing module is the 7816 interface, which is reused as the SPI+ interface. It has good transmission compatibility, high efficiency, and a wide range of applications.
- Figure 1 shows a schematic structural diagram of a subscriber identity card according to an embodiment of the present invention
- Figure 2 shows a schematic structural diagram of a smart terminal according to an embodiment of the present invention
- Figure 3 shows a device schematic diagram of a smart terminal according to an embodiment of the present invention
- Figure 4 shows a timing diagram according to an embodiment of the present invention
- Figure 5 shows a schematic diagram of function allocation of an application program according to an embodiment of the present invention
- Figure 6 shows a method flow chart of a subscriber identity card application method according to an embodiment of the present invention.
- FIG. 1 shows a schematic structural diagram of a subscriber identity card according to an embodiment of the present invention.
- a subscriber identity card 100 according to an embodiment of the present invention includes a first operating unit 110 and a first communication interface 120 .
- the first operating unit 110 is connected to the first communication interface 120 to transmit data, and the first operating unit 110 runs the first subroutine to implement at least one of the following functions: secure startup, encryption, decryption, and authentication.
- the first running unit 110 runs an applet to implement security functions such as secure startup, encryption, decryption, and authentication of the corresponding application.
- input and/or output data, as well as other data mentioned herein, may be signals, commands, and other forms of information.
- the first communication interface 120 is used for data input and/or output.
- the first communication interface 120 is a 7816 interface multiplexed as SPI+ (Specific Serial Peripheral Interface).
- the first running unit 110 receives input data through the first communication interface 120, runs the first subroutine to implement at least one of the following functions: secure startup, encryption, decryption and authentication, and generates the first subroutine.
- the output data is output through the first communication interface 120.
- FIG. 2 shows a schematic structural diagram of an intelligent terminal according to an embodiment of the present invention.
- a smart terminal according to an embodiment of the present invention is, for example, a mobile phone, a computer, or other equipment (hereinafter, a smart terminal is taken as a mobile phone as an example), and includes a user identification card 100 and a processing module 200 .
- the user identification card 100 includes a first operating unit 110 and a first communication interface 120
- the processing module 200 includes a second operating unit 210 and a second communication interface 220.
- the first operating unit 110 is connected to the first communication interface 120 to input and/or output data.
- the first operating unit 110 runs the first subroutine to implement at least one of the following functions: secure startup, encryption, Decryption and authentication.
- the second running unit 210 is connected to the second communication interface 220 to transmit data and run the second subroutine, for example, by running the second subroutine to execute the application program.
- the second running unit 210 runs (executes) an application program (APP) and is responsible for processing non-sensitive information and human-computer interaction and other functions.
- the second communication interface 220 is a 7816 interface multiplexed as SPI+ (Specific Serial Peripheral Interface).
- a new smart terminal that can expand the ability of a subscriber identification card (SIM card) to support applications.
- SIM card subscriber identification card
- the smart terminal uses a user identification card and the Applet running on it to combine with the processing module and the APP running on it to ensure the performance and security of application running.
- the smart terminal includes a user identification card and the Applet running on it, a processing module and the APP running on it.
- the user identification card and the Applet running on it are responsible for security functions such as secure startup, encryption, decryption, and authentication.
- the processing module and the APP running on it are responsible for processing non-sensitive information and human-computer interaction functions.
- the processing module and the APP running on it extend the processing capabilities of the user identification card.
- FIG. 3 shows a schematic diagram of a device of a smart terminal according to an embodiment of the present invention.
- a smart terminal according to an embodiment of the present invention includes a processing module 200 and a subscriber identity card 100.
- the second operating unit 210 in the processing module 200 includes a baseband processor and/or an application processor, such as a mobile phone baseband/application processor.
- An application program runs on the baseband/application processor of the smart terminal to perform non-sensitive data processing, human-computer interaction and other functions in the application program.
- the first running unit 110 in the subscriber identity card 100 runs an applet to implement secure startup, encryption, decryption and authentication functions of the application.
- the second communication interface 220 on the processing module 200 is connected to the first communication interface 120 on the subscriber identity card 100 to transmit data.
- the first communication interface 120 includes a data port (IO), a clock port (CLK) and a reset port (RST).
- the second communication interface 220 includes a data port (IO), a clock port (CLK) and a reset port (RST). Data ports (IO) are used for data input and/or output.
- the clock port (CLK) is used to transmit clock signals.
- the reset port (RST) is used to transmit reset signals.
- the mobile phone baseband/application processor is connected to the subscriber identification card through three physical ports (input and output ports, clock ports and reset ports), and supports the multiplexing of the 7816 interface and the high-speed interface SPI+ interface.
- the IO port of the 7816 interface is multiplexed as the bidirectional data interface SPI_SDA of SPI+;
- the clock port CLK of the 7816 interface is multiplexed as the clock port SPI_CLK of SPI+;
- the reset port RST of the 7816 interface is multiplexed as the SPI_RST of the reset port of SPI+ .
- the communication interface between the processing module and the subscriber identification card is 7816 or SPI+, and when 7816 is reused with the SPI+ interface, the protocol supports negotiation of the 7816 and SPI+ interfaces.
- the SPI+ interface supports a higher communication rate than 7816.
- the 7816 interface is compatible with existing subscriber identification cards.
- the form of the port is not limited to this.
- Transform the three-wire interface into a four-wire interface or more interfaces and slightly transform the ports of the SPI+ interface, such as transforming the SPI+ interface into input SPI_Datain, output interface SPI_Dataout, SPI_CLK, or input SPI_Datain, output interface SPI_Dataout, SPI_CLK, SPI_RST (increase An interface, mapping it to the undefined port of 7816) can implement the technical solution of this application.
- Each interface of the SPI+ interface is defined as follows:
- SPI_SDA Simplex bidirectional signal interface, the data channel between the mobile phone baseband/application processor and the subscriber identification card;
- SPI_CLK clock signal, rising edge or falling edge as data synchronization signal
- SPI_RST Reset signal, active high level or low level.
- the subscriber identity card performs a cold reset; when the subscriber identity card sends a valid reset signal to the mobile phone baseband/application processor, the mobile phone baseband/application processor only Support hot reset for APPs with extended functions.
- the first clock edge of the SPI+ interface sends new data
- the second clock edge is the receiving port for data collection.
- the first clock edge can be a rising or falling edge
- the second clock edge can be a falling or rising edge.
- both the mobile phone baseband/application processor and subscriber identification card can serve as the master to initiate communication.
- the first subroutine is run on the subscriber identification card
- the second subroutine is run on the smart terminal.
- the communication interface between the subscriber identity card and the smart terminal is 7816 or SPI+, and the 7816 and SPI+ interfaces are complex.
- the protocol supports the negotiation of 7816 and SPI+ interfaces.
- the communication rate supported by the SPI+ interface is higher than that of the 7816 interface.
- the 7816 interface is compatible with existing subscriber identification cards; the subscriber identification card and the first subroutine running on it are responsible for safe startup. , encryption, decryption, authentication and other security functions.
- the smart terminal and the second subroutine running on it are responsible for processing non-sensitive information and human-computer interaction functions.
- the smart terminal and the second subroutine running on it control the processing capabilities of the user identification card. Extension.
- the software and hardware interfaces and workflows of the two are defined, which expands the application support capabilities of the user identification card and improves the performance and security of application operation. .
- FIG. 5 shows a schematic diagram of function allocation of an application program according to an embodiment of the present invention.
- the Applet on the user identification card is responsible for security-related functions such as secure startup, encryption, decryption, and authentication, while the mobile phone baseband/application processor is responsible for non-sensitive data processing and human-computer interaction functions. Both the mobile phone baseband/application processor and subscriber identification card can serve as the master to initiate communication.
- the application when an application is run on the smart terminal, the application is first safely started on the user identification card. Then, the application’s non-sensitive information processing, human-computer interaction functions, etc. are performed on the mobile phone baseband/application processor.
- security functions such as encryption and authentication
- the user identification card performs corresponding encryption and authentication.
- the user identification card interacts with the mobile phone baseband/application processor through the communication interface.
- the functions performed by the user identification card can be set according to specific needs.
- the functions performed by the mobile phone baseband/application processor can be set according to specific needs.
- the functional cooperation and execution process between the user identification card and the mobile phone baseband/application processor can also be designed according to specific needs.
- FIG. 6 shows a method flow chart of a subscriber identity card application method according to an embodiment of the present invention.
- the subscriber identity card application method according to the embodiment of the present invention includes the following steps:
- step S101 run a first subroutine on the subscriber identity card to implement secure startup and/or encryption and/or decryption and/or authentication;
- a first subroutine is run on the subscriber identification card to implement secure boot and/or encryption and/or decryption and/or authentication.
- the first operating unit on the user identification card receives at least one of a startup signal, an encryption signal, a decryption signal and an authentication signal through the first communication interface, and runs the first subroutine based on the received signal to implement the corresponding secure startup, encryption, decryption and authentication, and output the output data generated by the first subroutine through the first communication interface.
- step S102 establish a communication connection between the user identification card and the processing module through a communication interface that supports the multiplexing of the 7816 interface and the SPI+ interface;
- the communication connection between the user identification card and the processing module is established to carry out data interaction between the user identification card and the processing module.
- the second operating unit in the processing module transmits data through the second communication interface
- the first operating unit in the user identification card transmits data through the first communication interface.
- step S103 a second subroutine is run on the processing module.
- Run the second subroutine on the processing module for example, by running the second subroutine to realize non-sensitive information processing, human-computer interaction and other functions of the application program.
- the processing module receives the output data output by the user identification card, and runs the second subroutine according to the received output data.
- the subscriber identity card application method further includes the following steps:
- the processing module uses the 7816 protocol to initiate an inquiry to the subscriber identity card whether it supports the SPI+ interface;
- the processing module and the subscriber identity card communicate using the SPI+ interface protocol
- the processing module communicates with the subscriber identity card using the 7816 interface protocol.
- the 7816 communication interface and the SPI+ interface negotiation protocol are used for communication interface negotiation. That is, after the subscriber identity card is powered on and completes safe startup, the mobile phone baseband/application processor acts as the master to initiate protocol negotiation, that is, the mobile phone baseband/application processor negotiates the communication protocol with the subscriber identity card.
- the specific negotiation method includes: the mobile phone baseband/AP processor first uses the 7816 protocol to initiate an inquiry to the subscriber identity card about whether it supports the SPI interface; if the subscriber identity card supports the SPI+ interface, it will reply that it supports it.
- the mobile phone baseband/AP processor and the subscriber identity card If it is not supported, the next command of the mobile phone will still use the 7816 interface protocol for communication.
- the subscriber identity card acts as the master to initiate protocol negotiation, that is, the subscriber identity card negotiates the communication protocol with the mobile phone baseband/application processor.
- the specific negotiation method includes: the user identification card first uses the 7816 protocol to inquire whether the SPI+ interface is supported by the mobile phone baseband/application processor; if the mobile phone baseband/application processor supports the SPI+ interface, it will reply that it supports the user identification card and the mobile phone baseband/application The processors will use the SPI+ interface protocol for communication starting from the next instruction; if it is not supported, the next instruction will still use the 7816 interface protocol for communication.
- the user identification card application method also includes:
- the subscriber identity card sends a first reset signal to the processing module, and the processing module performs a hot reset on the application program after obtaining the first reset signal;
- the processing module sends a second reset signal to the subscriber identity card, and the subscriber identity card performs a cold reset after acquiring the second reset signal.
- a communication connection between the user identification card and the processing module is established for data interaction.
- the subscriber identity card application method also includes the subscriber identity card sending a clock signal to the processing module; or the processing module sending a clock signal to the subscriber identity card, wherein the rising edge or falling edge of the clock signal As a synchronization signal for the data interaction.
- Both the user identification card and the processing module can communicate as the master.
- the subscriber identity card serves as the master
- the subscriber identity card sends a clock signal to the processing module.
- the processing module serves as the master, the processing module sends a clock signal to the subscriber identification card.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Telephone Function (AREA)
Abstract
本发明公开了一种用户识别卡及智能终端、用户识别卡应用方法。根据本发明实施例的用户识别卡上运行有第一子程序,智能终端上运行有第二子程序,用户识别卡与智能终端的通讯接口为7816或SPI+,且7816与SPI+接口复用,协议支持7816、SPI+接口的协商,其中SPI+接口通讯速率高于7816接口的通讯速率,7816接口兼容现有用户识别卡;用户识别卡及其上运行的第一子程序负责安全启动、加解密及认证等安全功能,智能终端及其上运行的第二子程序负责处理非敏感信息及人机交互功能,智能终端及其上运行的第二子程序对用户识别卡的处理能力进行扩展。
Description
本申请要求了申请日为2022年04月12日、申请号为202210383011.7、名称为“用户识别卡及智能终端、用户识别卡应用方法”的中国发明申请的优先权,并且通过参照上述中国发明申请的全部说明书、权利要求、附图和摘要的方式,将其引用于本申请。
本发明涉及通信技术领域,特别涉及一种用户识别卡及智能终端、用户识别卡应用方法。
传统用户识别卡(SIM,Subscriber Identity Module)是移动通讯***中标识移动用户身份的集成电路(Integrated Circuit,IC)卡,用于运营商数据的安全存储及对用户身份鉴权和客户信息加密。用户识别卡广泛应用于手机、智能手表等智能终端。
在现有技术中,用户识别卡受功耗、成本等约束,其处理性能一般较低,且外部接口较少,并且与智能终端上的处理模块间的通信速率较低,制约了其在支持身份认证、金融交易等安全应用方面的能力发挥。同时,智能终端上的处理模块具有很强的处理性能,可以支持丰富的应用,但也由于其具有丰富的逻辑与物理通道,其运行环境复杂,易于受到安全攻击。
因此,希望能有一种新的用户识别卡及智能终端、用户识别卡应用方法,能够克服上述问题。
发明内容
鉴于上述问题,本发明的目的在于提供一种用户识别卡及智能终端、用户识别卡应用方法,特别是一种扩展用户识别卡支持应用能力的方法, 从而扩展用户识别卡的应用程序支持能力,提升应用程序运行的性能与安全性。
根据本发明的一方面,提供一种用户识别卡,包括第一通讯接口,所述第一通讯接口支持7816接口与SPI+接口复用,其中,所述SPI+接口的通讯速率高于所述7816接口的通讯速率;第一运行单元,与所述第一通讯接口相连接以传输数据,所述第一运行单元运行第一子程序来实现以下功能中的至少一种:安全启动、加密、解密和认证。
可选地,所述第一通讯接口与智能终端的第二通讯接口相连接以传输数据。
根据本发明的另一方面,提供一种智能终端,包括处理模块;所述处理模块包括:第二通讯接口,所述第二通讯接口支持7816接口与SPI+接口复用,其中,所述SPI+接口的通讯速率高于所述7816接口的通讯速率;第二运行单元,与所述第二通讯接口相连接以传输数据,并运行第二子程序以处理非敏感数据和/或进行人机交互实现;
可选地,所述第二通讯接口与用户识别卡的第一通讯接口相连接以传输数据。
可选地,所述第一通讯接口和/或所述第二通讯接口包括数据端口,用于数据的输入和/或输出;时钟端口,用于传递时钟信号,所述时钟信号的上升沿或下降沿作为数据的同步信号;以及复位端口,用于传递复位信号,所述复位信号高电平或低电平有效,其中,当所述处理模块向所述用户识别卡发出有效的复位信号时,所述用户识别卡进行冷复位;当所述用户识别卡向所述处理模块发出有效的复位信号时,所述处理模块对所述第二子程序进行热复位。
可选地,所述用户识别卡或所述处理模块均可作为主端发起通讯。
根据本发明的再一方面,提供一种用户识别卡应用方法,包括在用户识别卡上运行第一子程序以实现安全启动和/或加密和/或解密和/或认证;通过支持7816接口与SPI+接口复用的通讯接口,建立所述用户识别卡与处理模块的通讯连接;以及在智能终端的所述处理模块上运行第二子程序。
可选地,所述用户识别卡应用方法还包括所述用户识别卡/处理模块以7816协议向所述处理模块/用户识别卡发起是否支持所述SPI+接口的询问;在所述处理模块/用户识别卡支持所述SPI+接口的情况下,所述处理模块与所述用户识别卡采用SPI+接口协议进行通讯;在所述处理模块/用户识别卡不支持所述SPI+接口的情况下,所述处理模块与所述用户识别卡采用7816接口协议进行通讯。
可选地,所述用户识别卡应用方法还包括所述用户识别卡向所述处理模块发送第一复位信号,所述处理模块获取所述第一复位信号后对所述应用程序进行热复位;或所述处理模块向所述用户识别卡发送第二复位信号,所述用户识别卡获取所述第二复位信号后进行冷复位。
可选地,建立所述用户识别卡与所述处理模块的通讯连接以进行数据交互;所述用户识别卡应用方法还包括:所述用户识别卡向所述处理模块发送时钟信号;或所述处理模块向所述用户识别卡发送时钟信号,其中,所述时钟信号的上升沿或下降沿作为所述数据交互的同步信号。
根据本发明实施例的用户识别卡及智能终端、用户识别卡应用方法,在用户识别卡上运行第一子程序以实现安全启动和/或加密和/或解密和/或认证,提升了应用程序运行的安全性。
进一步地,在处理模块上运行第二子程序以执行应用程序,扩展了用户识别卡对应用程序的支持能力。
进一步地,用户识别卡与处理模块之间的通讯接口为7816接口,并复用为SPI+接口,传输兼容性好且效率高,适用范围广。
通过以下参照附图对本发明实施例的描述,本发明的上述以及其他目的、特征和优点将更为清楚,在附图中:
图1示出了根据本发明实施例的用户识别卡的结构示意图;
图2示出了根据本发明实施例的智能终端的结构示意图;
图3示出了根据本发明实施例的智能终端的装置示意图;
图4示出了根据本发明实施例的时序示意图;
图5示出了根据本发明实施例的应用程序的功能分配示意图;
图6示出了根据本发明实施例的用户识别卡应用方法的方法流程图。
以下将参照附图更详细地描述本发明的各种实施例。在各个附图中,相同的元件采用相同或类似的附图标记来表示。为了清楚起见,附图中的各个部分没有按比例绘制。此外,在图中可能未示出某些公知的部分。
下面结合附图和实施例,对本发明的具体实施方式作进一步详细描述。在下文中描述了本发明的许多特定的细节,例如部件的结构、材料、尺寸、处理工艺和技术,以便更清楚地理解本发明。但正如本领域的技术人员能够理解的那样,可以不按照这些特定的细节来实现本发明。
应当理解,在描述部件的结构时,当将一层、一个区域称为位于另一层、另一个区域“上面”或“上方”时,可以指直接位于另一层、另一个区域上面,或者在其与另一层、另一个区域之间还包含其它的层或区域。并且,如果将部件翻转,该一层、一个区域将位于另一层、另一个区域“下面”或“下方”。
图1示出了根据本发明实施例的用户识别卡的结构示意图。如图1所示,根据本发明实施例的用户识别卡100包括第一运行单元110和第一通讯接口120。
具体地讲,第一运行单元110与第一通讯接口120相连接以传输数据,第一运行单元110运行第一子程序来实现以下功能中的至少一种:安全启动、加密、解密和认证。可选地,第一运行单元110运行小程序(Applet)以实现相应应用程序的安全启动、加解密及认证等安全功能。可选地,输入和/或输出的数据以及本文中提及的其它数据,可以是信号、命令等各种形式的信息。
在本发明的可选实施例中,第一通讯接口120用于数据的输入和/输出。第一通讯接口120为7816接口复用为SPI+(特定串行外设接口)。可选地,第一运行单元110通过第一通讯接口120接收输入数据,运行第一子程序来实现以下功能中的至少一种:安全启动、加密、解密和认 证,并将第一子程序产生的输出数据通过第一通讯接口120输出。
图2示出了根据本发明实施例的智能终端的结构示意图。如图2所示,根据本发明实施例的智能终端例如为手机、电脑等设备(下文中以智能终端为手机举例),包括用户识别卡100和处理模块200。其中,用户识别卡100包括第一运行单元110和第一通讯接口120;处理模块200包括第二运行单元210和第二通讯接口220。
具体地讲,第一运行单元110与第一通讯接口120相连接以输入和/或输出数据,第一运行单元110运行第一子程序来实现以下功能中的至少一种:安全启动、加密、解密和认证。
第二运行单元210与第二通讯接口220相连接以传输数据,并运行第二子程序,例如通过运行第二子程序以执行应用程序。可选地,第二运行单元210运行(执行)应用程序(APP),负责处理非敏感信息及人机交互等功能。第二通讯接口220为7816接口复用为SPI+(特定串行外设接口)。
在本发明的上述实施例中,提出了一种新的智能终端,能够扩展用户识别卡(SIM卡)支持应用的能力。该智能终端采用用户识别卡及其上运行的Applet与处理模块及其上运行的APP结合的方式保证应用程序运行的性能与安全性。具体地,该智能终端包括用户识别卡及其上面运行的Applet,处理模块及其上运行的APP。用户识别卡及其上运行的Applet负责安全启动,加解密及认证等安全功能,处理模块及其上运行的APP负责处理非敏感信息及人机交互功能。处理模块及其上运行的APP对用户识别卡的处理能力进行扩展。
图3示出了根据本发明实施例的智能终端的装置示意图。如图3所示,根据本发明实施例的智能终端包括处理模块200和用户识别卡100。
具体地讲,处理模块200中的第二运行单元210包括基带处理器和/或应用处理器,例如为手机基带/应用处理器。智能终端的基带/应用处理器上运行有应用程序(APP)以进行应用程序中非敏感数据处理、人机交互等功能。
用户识别卡100中的第一运行单元110上运行有小程序(Applet) 以实现应用程序的安全启动、加解密及认证功能等。
处理模块200上的第二通讯接口220与用户识别卡100上的第一通讯接口120相连接以传输数据。
如图3所示,第一通讯接口120包括数据端口(IO)、时钟端口(CLK)和复位端口(RST)。第二通讯接口220包括数据端口(IO)、时钟端口(CLK)和复位端口(RST)。数据端口(IO)用于数据的输入和/输出。时钟端口(CLK)用于传递时钟信号。复位端口(RST)用于传递复位信号。
在本发明的一个具体实施例中,手机基带/应用处理器通过三个物理端口(输入输出端口、时钟端口和复位端口)与用户识别卡相连接,同时支持7816接口与高速接口SPI+接口复用,其中7816接口的IO端口被复用为SPI+的双向数据接口SPI_SDA;7816接口的时钟端口CLK被复用为SPI+的时钟端口SPI_CLK;7816接口的复位端口RST被复用为SPI+的复位端口的SPI_RST。需要说明的是,处理模块与用户识别卡的通讯接口为7816或SPI+,且7816与SPI+接口复用时,协议支持7816、SPI+接口的协商,可选地,SPI+接口支持的通讯速率高于7816接口,7816接口兼容现有用户识别卡。当然,端口的形式并不限于此。将三线接口变形为四线接口或更多接口,对SPI+接口的端口进行轻微变形,如将SPI+接口变形为输入SPI_Datain,输出接口SPI_Dataout,SPI_CLK,或者输入SPI_Datain,输出接口SPI_Dataout,SPI_CLK,SPI_RST(增加一个接口,将其映射到7816的未定义端口)均可实现本申请的技术方案。
SPI+接口的各接口定义如下:
SPI_SDA:单工双向信号接口,手机基带/应用处理器与用户识别卡间的数据通道;
SPI_CLK:时钟信号,上升沿或下降沿作为数据的同步信号;
SPI_RST:复位信号,高电平或低电平有效。当手机基带/应用处理器向用户识别卡发出有效的复位信号时,用户识别卡进行冷复位;当用户识别卡向手机基带/应用处理器发出有效复位信号时,手机基带/应用处理器只对支持功能扩展的APP进行热复位。
参照图4所示的时序示意图,SPI+接口的第一个时钟沿发送新数据,第二个时钟沿则是接收端口进行数据采集。第一个时钟沿可以为上升沿或下降沿,第二个时钟沿可以为下降沿或上升沿。可选地,手机基带/应用处理器和用户识别卡均可作为主端发起通讯。
在本发明的上述实施例中,用户识别卡上运行有第一子程序,智能终端上运行有第二子程序,用户识别卡与智能终端的通讯接口为7816或SPI+,且7816与SPI+接口复用,协议支持7816、SPI+接口的协商,其中SPI+接口支持的通讯速率高于7816接口的通讯速率,7816接口兼容现有用户识别卡;用户识别卡及其上运行的第一子程序负责安全启动、加解密及认证等安全功能,智能终端及其上运行的第二子程序负责处理非敏感信息及人机交互功能,智能终端及其上运行的第二子程序对用户识别卡的处理能力进行扩展。
进一步地,结合手机基带/应用处理器和用户识别卡各自的特点,定义出两者的软硬件接口及工作流程,扩展了用户识别卡的应用支持能力,并且提升了应用运行的性能与安全性。
图5示出了根据本发明实施例的应用程序的功能分配示意图。如图5所示,用户识别卡上的Applet负责安全启动、加解密及认证等安全相关功能,手机基带/应用处理器则负责非敏感数据处理、人机交互功能。手机基带/应用处理器和用户识别卡均可作为主端发起通讯。
在一个具体实施例中,智能终端上运行一个应用程序时,首先在用户识别卡上进行应用程序的安全启动。然后在手机基带/应用处理器上进行应用程序的非敏感信息处理、人机交互功能等。在涉及到加密、认证等安全功能时,由用户识别卡进行相应的加密、认证。用户识别卡与手机基带/应用处理器通过通讯接口进行数据交互。当然,本发明并不限于此。用户识别卡执行的功能可以根据具体需求设置。手机基带/应用处理器执行的功能可以根据具体需求设置。用户识别卡与手机基带/应用处理器之间功能的配合、执行流程也可以根据具体需求进行设计。
图6示出了根据本发明实施例的用户识别卡应用方法的方法流程图。如图6所示,根据本发明实施例的用户识别卡应用方法包括以下步骤:
在步骤S101中,在所述用户识别卡上运行第一子程序以实现安全启动和/或加密和/或解密和/或认证;
在用户识别卡上运行第一子程序以实现安全启动和/或加密和/或解密和/或认证。可选地,用户识别卡上的第一运行单元通过第一通讯接口接收启动信号、加密信号、解密信号和认证信号中的至少一种,并基于收到的信号运行第一子程序来实现相应的安全启动、加密、解密和认证,并通过第一通讯接口将第一子程序产生的输出数据输出。
在步骤S102中,通过支持7816接口与SPI+接口复用的通讯接口,建立所述用户识别卡与处理模块的通讯连接;
通过支持7816接口与SPI+接口复用的通讯接口,建立用户识别卡与处理模块的通讯连接,以进行用户识别卡与处理模块之间的数据交互。可选地,处理模块中的第二运行单元通过第二通讯接口传输数据,用户识别卡中的第一运行单元通过第一通讯接口传输数据。
在步骤S103中,在所述处理模块上运行第二子程序。
在处理模块上运行第二子程序,例如通过运行第二子程序以实现应用程序的非敏感信息处理、人机交互等功能。可选地,处理模块接收用户识别卡输出的输出数据,并根据接收到的输出数据运行第二子程序。
在本发明的可选实施例中,用户识别卡应用方法还包括以下步骤:
所述处理模块以7816协议向所述用户识别卡发起是否支持SPI+接口的询问;
在所述用户识别卡支持SPI+接口的情况下,所述处理模块与所述用户识别卡采用SPI+接口协议进行通讯;
在所述用户识别卡不支持SPI+接口的情况下,所述处理模块与所述用户识别卡采用7816接口协议进行通讯。
具体地讲,为了扩展对原有用户识别卡的兼容,采用7816通讯接口与SPI+接口协商协议进行通讯接口协商。即用户识别卡上电完成安全启动后,手机基带/应用处理器作为主端发起协议的协商,即手机基带/应用处理器与用户识别卡进行通讯协议协商。具体协商方法包括:手机基带/AP处理器先以7816协议向用户识别卡发起是否支持SPI接口的问询; 如果用户识别卡支持SPI+接口则回复支持,手机基带/AP处理器与用户识别卡之间则从下一条指令开始采用SPI+接口协议进行通讯;如果不支持,手机下一条指令仍采用7816接口协议进行通讯。可选地,用户识别卡上电完成安全启动后,用户识别卡作为主端发起协议的协商,即用户识别卡与手机基带/应用处理器进行通讯协议协商。具体协商方法包括:用户识别卡先以7816协议向手机基带/应用处理器发起是否支持SPI+接口的问询;如果手机基带/应用处理器支持SPI+接口则回复支持,用户识别卡与手机基带/应用处理器之间则从下一条指令开始采用SPI+接口协议进行通讯;如果不支持,下一条指令仍采用7816接口协议进行通讯。
可选地,用户识别卡应用方法还包括:
所述用户识别卡向所述处理模块发送第一复位信号,所述处理模块获取所述第一复位信号后对所述应用程序进行热复位;或
所述处理模块向所述用户识别卡发送第二复位信号,所述用户识别卡获取所述第二复位信号后进行冷复位。
在本发明的可选实施例中,建立所述用户识别卡与所述处理模块的通讯连接以进行数据交互。所述用户识别卡应用方法还包括所述用户识别卡向所述处理模块发送时钟信号;或所述处理模块向所述用户识别卡发送时钟信号,其中,所述时钟信号的上升沿或下降沿作为所述数据交互的同步信号。用户识别卡和处理模块均可作为主端进行通讯。在用户识别卡作为主端时,用户识别卡向处理模块发送时钟信号。在处理模块作为主端时,处理模块向用户识别卡发送时钟信号。
应当说明的是,在本文中,诸如第一和第二等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来,而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。而且,术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含,从而使得包括一系列要素的过程、方法、物品或者设备不仅包括那些要素,而且还包括没有明确列出的其他要素,或者是还包括为这种过程、方法、物品或者设备所固有的要素。在没有更多限制的情况下,由语句“包括一个……”限定的要素,并不排除在包括所述要素的过程、方法、 物品或者设备中还存在另外的相同要素。
依照本发明的实施例如上文所述,这些实施例并没有详尽叙述所有的细节,也不限制该发明仅为所述的具体实施例。显然,根据以上描述,可作很多的修改和变化。本说明书选取并具体描述这些实施例,是为了更好地解释本发明的原理和实际应用,从而使所属技术领域技术人员能很好地利用本发明以及在本发明基础上的修改使用。本发明仅受权利要求书及其全部范围和等效物的限制。
Claims (10)
- 一种用户识别卡,其特征在于,包括:第一通讯接口,所述第一通讯接口支持7816接口与SPI+接口复用,其中,所述SPI+接口的通讯速率高于所述7816接口的通讯速率;第一运行单元,与所述第一通讯接口相连接以传输数据,所述第一运行单元运行第一子程序来实现以下功能中的至少一种:安全启动、加密、解密和认证。
- 根据权利要求1所述的用户识别卡,其特征在于,所述第一通讯接口与智能终端的第二通讯接口相连接以传输数据。
- 一种智能终端,其特征在于,包括处理模块;所述处理模块包括:第二通讯接口,所述第二通讯接口支持7816接口与SPI+接口复用,其中,所述SPI+接口的通讯速率高于所述7816接口的通讯速率;第二运行单元,与所述第二通讯接口相连接以传输数据,并运行第二子程序以处理非敏感数据和/或进行人机交互实现;
- 根据权利要求3所述的智能终端,其特征在于,所述第二通讯接口与用户识别卡的第一通讯接口相连接以传输数据。
- 根据权利要求4所述的智能终端,其特征在于,所述第一通讯接口和/或所述第二通讯接口包括:数据端口,用于数据的输入和/或输出;时钟端口,用于传递时钟信号,所述时钟信号的上升沿或下降沿作为数据的同步信号;以及复位端口,用于传递复位信号,所述复位信号高电平或低电平有效,其中,当所述处理模块向所述用户识别卡发出有效的复位信号时,所述用户识别卡进行冷复位;当所述用户识别卡向所述处理模块发出有效的复位信号时,所述处理模块对所述第二子程序进行热复位。
- 根据权利要求4所述的智能终端,其特征在于,所述用户识别卡或所述处理模块均可作为主端发起通讯。
- 一种用户识别卡应用方法,其特征在于,包括:在用户识别卡上运行第一子程序以实现安全启动和/或加密和/或解密和/或认证;通过支持7816接口与SPI+接口复用的通讯接口,建立所述用户识别卡与处理模块的通讯连接;以及在智能终端的所述处理模块上运行第二子程序。
- 根据权利要求7所述的用户识别卡应用方法,其特征在于,所述用户识别卡应用方法还包括:所述用户识别卡/处理模块以7816协议向所述处理模块/用户识别卡发起是否支持所述SPI+接口的询问;在所述处理模块/用户识别卡支持所述SPI+接口的情况下,所述处理模块与所述用户识别卡采用SPI+接口协议进行通讯;在所述处理模块/用户识别卡不支持所述SPI+接口的情况下,所述处理模块与所述用户识别卡采用7816接口协议进行通讯。
- 根据权利要求7所述的用户识别卡应用方法,其特征在于,所述用户识别卡应用方法还包括:所述用户识别卡向所述处理模块发送第一复位信号,所述处理模块获取所述第一复位信号后对所述应用程序进行热复位;或所述处理模块向所述用户识别卡发送第二复位信号,所述用户识别卡获取所述第二复位信号后进行冷复位。
- 根据权利要求7所述的用户识别卡应用方法,其特征在于,建立所述用户识别卡与所述处理模块的通讯连接以进行数据交互;所述用户识别卡应用方法还包括:所述用户识别卡向所述处理模块发送时钟信号;或所述处理模块向所述用户识别卡发送时钟信号,其中,所述时钟信号的上升沿或下降沿作为所述数据交互的同步信号。
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202210383011.7 | 2022-04-12 | ||
CN202210383011.7A CN114827961B (zh) | 2022-04-12 | 2022-04-12 | 用户识别卡及智能终端、用户识别卡应用方法 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2023197541A1 true WO2023197541A1 (zh) | 2023-10-19 |
Family
ID=82533880
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2022/124584 WO2023197541A1 (zh) | 2022-04-12 | 2022-10-11 | 用户识别卡及智能终端、用户识别卡应用方法 |
Country Status (2)
Country | Link |
---|---|
CN (1) | CN114827961B (zh) |
WO (1) | WO2023197541A1 (zh) |
Families Citing this family (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN114827961B (zh) * | 2022-04-12 | 2024-02-06 | 北京中电华大电子设计有限责任公司 | 用户识别卡及智能终端、用户识别卡应用方法 |
Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN107451647A (zh) * | 2016-06-01 | 2017-12-08 | 北京军地联合网络技术中心 | 一种内置安全机制的营区专用sim卡 |
CN111641427A (zh) * | 2020-05-29 | 2020-09-08 | 郑州信大捷安信息技术股份有限公司 | 一种多功能sim卡、卡的运行方法及终端 |
CN114827961A (zh) * | 2022-04-12 | 2022-07-29 | 北京中电华大电子设计有限责任公司 | 用户识别卡及智能终端、用户识别卡应用方法 |
Family Cites Families (7)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101616415B (zh) * | 2006-09-13 | 2011-09-14 | 北京握奇数据***有限公司 | 移动通信用户身份识别卡信息直接交互方法及其支持设备 |
CN101848559A (zh) * | 2010-05-13 | 2010-09-29 | 中兴通讯股份有限公司 | 信息传输的实现***和智能卡 |
CN107392034A (zh) * | 2017-06-05 | 2017-11-24 | 努比亚技术有限公司 | 一种敏感信息保护方法、终端及计算机可读存储介质 |
CN108881304B (zh) * | 2018-07-27 | 2020-09-29 | 恒宝股份有限公司 | 一种对物联网设备进行安全管理的方法及*** |
CN109726605B (zh) * | 2018-12-27 | 2022-06-10 | 恒宝股份有限公司 | 一种eSIM智能卡及其工作方法 |
CN112100113A (zh) * | 2020-11-20 | 2020-12-18 | 北京智芯微电子科技有限公司 | 一种智能卡、卡的工作方法及终端 |
CN113365268A (zh) * | 2021-04-21 | 2021-09-07 | 厦门盛华电子科技有限公司 | 带加解密功能的智能卡、智能终端、数据通信***及方法 |
-
2022
- 2022-04-12 CN CN202210383011.7A patent/CN114827961B/zh active Active
- 2022-10-11 WO PCT/CN2022/124584 patent/WO2023197541A1/zh unknown
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN107451647A (zh) * | 2016-06-01 | 2017-12-08 | 北京军地联合网络技术中心 | 一种内置安全机制的营区专用sim卡 |
CN111641427A (zh) * | 2020-05-29 | 2020-09-08 | 郑州信大捷安信息技术股份有限公司 | 一种多功能sim卡、卡的运行方法及终端 |
CN114827961A (zh) * | 2022-04-12 | 2022-07-29 | 北京中电华大电子设计有限责任公司 | 用户识别卡及智能终端、用户识别卡应用方法 |
Also Published As
Publication number | Publication date |
---|---|
CN114827961A (zh) | 2022-07-29 |
CN114827961B (zh) | 2024-02-06 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US10194318B2 (en) | Systems and methods for NFC access control in a secure element centric NFC architecture | |
US9635549B2 (en) | Providing subscriber identity module function | |
WO2019119544A1 (zh) | 嵌入式sim卡的数据访问的方法和设备 | |
US20070254588A1 (en) | Supporting use of connection via electrical interface | |
US20070228164A1 (en) | Smart card read/write control method based on usb interface and reader/writer thereof | |
EP2566287B1 (en) | Wireless Internet Access Module | |
US8700827B2 (en) | Matching method, system and device for data exchange between a communication object and a processing unit | |
WO2023197541A1 (zh) | 用户识别卡及智能终端、用户识别卡应用方法 | |
US20210235245A1 (en) | Terminal Application Activation Method, Apparatus, and System | |
CN211127902U (zh) | 电子设备和蜂窝电话 | |
CN211557320U (zh) | 电子设备和蜂窝电话 | |
WO2018058862A1 (zh) | 一种基于spi的数据传输方法及装置 | |
WO2012068910A1 (zh) | 外接卡的访问方法和*** | |
EP3709687B1 (en) | Electronic device and method for managing an ic card with multiple sim profiles | |
CN113508537B (zh) | 降低近场通信***中的功耗的装置和计算机实现的方法 | |
CN112116054A (zh) | 一种多芯片集成卡 | |
CN211509119U (zh) | 电子设备和蜂窝电话 | |
US8260971B2 (en) | Techniques to exchange information for multiple modems | |
EP2912829A1 (en) | Systems and methods for managing registration and discovery of uri schemes | |
US7281246B1 (en) | Method for loading user interface software | |
CN205847259U (zh) | 一种蓝牙设备和蓝牙*** | |
CN114286345B (zh) | 智能终端内的nfc通信装置及方法 | |
CN116419202B (zh) | 远程访问用户识别模块sim卡的方法和装置 | |
TWI635411B (zh) | 具有生物特徵辨識模組之儲存裝置 | |
CN103279166A (zh) | 一种易于扩展的及带usb接口的接触式cpu卡 |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 22937178 Country of ref document: EP Kind code of ref document: A1 |