CN101742481B - Method and system for distributing secondary security domain initial keys of smart card and mobile terminal - Google Patents

Abstract

The present invention provides a smart card initial key distribution method and system from the security domain. The system includes a smart card with electronic payment application functions, a card issuer management platform and a service terminal; the smart card communicates with the service terminal through the The card issuer management platform communicates; the card issuer management platform is used to distribute the initial key from the security domain to the smart card through the service terminal. The present invention solves the problem of the symmetric key after the card is issued. When creating the secondary security domain, the initial key of the secondary security domain generated by the management platform of the card issuer is safely imported into the secondary security domain, thereby realizing the initial encryption of the secondary security domain. secure distribution of keys.

Description

Smart card initial key distribution method and system from security domain, mobile terminal

technical field

The invention relates to mobile terminal electronic payment technology, in particular to a smart card initial key distribution method and system from a security domain, and a mobile terminal.

Background technique

After more than ten years of development, IC cards, especially contactless IC cards, have been widely used in fields such as public transport, access control, and small-amount electronic payment. At the same time, after more than 20 years of rapid development, mobile phones have basically been popularized among residents, bringing great convenience to people's work and life. Mobile phones are becoming more and more powerful, and there is a tendency to integrate more functions. The combination of mobile phone and non-contact IC card technology, and the application of mobile phone in the field of electronic payment will further expand the scope of use of mobile phones, bring convenience to people's life, and have broad application prospects.

Near Field Communication (NFC) is a short-range wireless communication technology operating at 13.56MHz, which evolved from the fusion of Radio Frequency Identification (RFID) technology and interconnection technology. After integrating NFC technology, mobile communication terminals such as mobile phones can simulate non-contact IC cards for related applications of electronic payment. To implement this solution on a mobile communication terminal, it is necessary to add an NFC analog front-end chip and an NFC antenna to the terminal, and use a smart card that supports electronic payment.

In order to realize mobile electronic payment based on NFC technology, it is necessary to establish a mobile terminal electronic payment system, through which the management of NFC-based mobile terminal electronic payment, including: the issuance of smart cards, the download, installation and personalization of electronic payment applications, Use relevant technologies and management strategies to realize the security of electronic payment applications, etc.

The business framework of the mobile terminal electronic payment system based on NFC technology usually adopts the multi-application framework of the Global Platform GP (Global Platform) specification. Specification) V2.1.1/V2.2 IC chips or smart cards can be SIM/USIM cards in physical form, that is, Subscriber Identity Model (Subscriber Identity Model)/Universal Mobile Telecommunications System Subscriber Identity Module (UMTS Subscriber Identity Module UMTS), which can be A pluggable smart memory card or an IC chip integrated in a mobile terminal.

If the mobile terminal electronic payment system based on near-field communication (NFC) technology supports the GP2.1.1 specification, the secure channel protocol needs to support SCP02 (based on symmetric keys), and if the mobile terminal electronic payment system based on near-field communication technology supports GP2.2 According to the specification, the secure channel protocol needs to support SCP02 (based on symmetric keys) and SCP10 (based on asymmetric keys), and card issuers and application providers can choose according to security policy requirements.

In general, the NFC-based mobile terminal short-distance electronic payment system is mainly composed of a card issuer management platform, one or more application provider management platforms, and a mobile terminal that supports smart cards with electronic payment application functions.

Multiple applications can be installed on a smart card that supports the Global Platform specification. In order to achieve the security of electronic payment applications, the smart card is divided into several independent security domains to ensure the isolation and independence of multiple applications. Each application provides Providers manage their own security domains, applications, and application data.

The security domain is the representation on the card of entities outside the card, including the card issuer and the application provider, which contain the keys used to support the operation of the secure channel protocol and the management of the content of the smart card. Security domains include primary security domains and secondary security domains. The primary security domain is the card issuer's mandatory representation on the smart card, and a smart card contains only one primary security domain. The secondary security domain is an optional on-card representation of the card issuer or application provider on the smart card.

The key generation and distribution of the security domain is the responsibility of the card issuer or application provider who manages the security domain, which ensures that applications and data from different application providers can coexist on the same card. The keys of the security domain include the key of the main security domain, the initial key of the secondary security domain and the key of the secondary security domain. The main security domain key and the initial key of the secondary security domain are generated by the card issuer management platform, and the secondary security domain keys are generated by the card issuer management platform or the application provider management platform that manages the secondary security domain.

Before the electronic payment application is downloaded and installed on the smart card, it is necessary to create a secondary security domain for the application on the smart card. The creation of the smart card secondary security domain is completed by the card issuer management platform. After the smart card is issued, when the smart card secondary security domain is created, the initial key of the secondary security domain must be imported into the secondary security domain of the smart card by the card issuer management platform through a secure channel.

The distribution process of the initial key from the security domain is related to the specific implementation of the system network architecture. In order to realize the security management of the smart card and the download and installation of payment applications, the smart card needs to establish communication with the card issuer management platform and the application provider management platform. Smart cards can establish communication through service terminals and management platforms. A service terminal is a device that can read and write smart cards, such as a POS machine connected to a computer. When using a business terminal, how to securely import the initial key from the secondary security domain generated by the card issuer management platform to the secondary security domain on the smart card in the case of a symmetric key is a problem that needs to be solved in the electronic payment of the mobile terminal.

Contents of the invention

The technical problem to be solved by the present invention is to provide a smart card secondary security domain initial key distribution method and system, and a mobile terminal to safely import the secondary security domain initial key generated by the card issuer management platform into the secondary security domain, Thus, the secure distribution of the initial key from the security domain is realized.

In order to solve the above-mentioned technical problems, the initial key distribution method of the smart card from the security domain, the method is realized based on the mobile terminal electronic payment system, the system includes a smart card with electronic payment application functions, a card issuer management platform and a service terminal, the smart card It is an independent device or installed on a mobile terminal; the smart card communicates with the card issuer management platform through the service terminal, and the card issuer management platform distributes the initial key from the security domain through the service terminal to the smart card.

Further, the method includes: (a) the user submits an application download request to the card issuer management platform; (b) after the card issuer management platform receives the application download request information, the card issuer management platform and Establish a secure channel between the primary security domains of the smart card; (c) the card issuer management platform creates a secondary security domain and generates an initial key for the secondary security domain, and transfers the initial key for the security domain through the established security channel via the service terminal. The key is imported into the smart card from the security domain.

Further, in step (a), the user triggers an application download request through the smart card program or the service terminal client program, and the application download request includes smart card identification information, application identification and application provider identity information, step (b ) and before step (c), further comprising: the card issuer management platform judging whether to create a secondary security domain according to the smart card identification information, application identification and application provider identity information, or according to the status information of the smart card.

Further, the process of establishing a secure channel in step (b) includes: (b1) the card issuer management platform and the main security domain of the smart card perform mutual authentication through the service terminal, and the mutual authentication process passes through the service terminal in the between the card issuer management platform and the smart card main security domain; (b2) establishing a temporary session key between the card issuer management platform and the smart card main security domain, thereby establishing a secure channel.

Further, the service terminal is a card issuer service terminal, and the interactive information between the card issuer management platform and the smart card is forwarded through the card issuer service terminal; or, the service terminal is an application provider service terminal, The message from the card issuer management platform to the smart card is forwarded through the application provider management platform and the application provider service terminal in turn, and the message from the smart card to the card issuer management platform is sequentially passed through the application provider service terminal And application provider management platform forwarding.

In order to solve the above technical problems, the present invention also provides a smart card initial key distribution system from the security domain, the system includes a smart card with electronic payment application functions, a card issuer management platform and a service terminal; the smart card passes through the The service terminal communicates with the card issuer management platform; the card issuer management platform is used to distribute the initial key from the security domain to the smart card through the service terminal.

Further, the smart card is also used to provide support for submitting an application download request to the card issuer management platform, perform mutual authentication with the card issuer management platform and establish a temporary session key, and is also used to decrypt the obtained from the security domain initial key, and initialize the secondary security domain; the card issuer management platform is also used for mutual authentication and establishing a temporary session key with the smart card primary security domain, and is also used for downloading requests or smart card The state information judges whether to establish the secondary security domain, and establishes the secondary security domain, generates and distributes the initial key of the secondary security domain to the smart card.

Further, the service terminal is a card issuer service terminal, which is used to forward the interaction information between the card issuer management platform and the smart card; or;

The service terminal is an application provider service terminal, and the system also includes an application provider management platform; the application provider service terminal is used to receive the message sent by the application provider management platform and forward it to the smart card; It is also used to receive the message sent by the smart card and forward it to the application provider management platform; the application provider management platform is used to receive the message sent by the card issuer management platform and forward it to the application provider The service terminal is also used to receive the message sent by the application provider service terminal and forward it to the card issuer management platform.

Further, the smart card is an independent device or installed on a mobile terminal.

The present invention also provides a mobile terminal, which includes a smart card with an electronic payment application function, and the initial key of the smart card from the security domain is distributed by the card issuer management platform through the card issuer service terminal, or through the application Provider management platform and application provider business terminal distribution.

The present invention can solve the problem of the symmetric key after the card is issued. When creating the secondary security domain, the initial key of the secondary security domain generated by the management platform of the card issuer is safely imported into the secondary security domain, thereby realizing the initialization of the secondary security domain. Secure distribution of keys.

Description of drawings

Fig. 1 is a schematic diagram of the architecture of a mobile terminal electronic payment system based on near-field communication technology in the present invention;

Fig. 2 is a schematic flow diagram of initial key distribution from the security domain through the card issuer service terminal in Embodiment 1 of the present invention;

Fig. 3 is a schematic flow diagram of initial key distribution from the security domain through the service terminal of the application provider in the second embodiment of the present invention.

Detailed ways

As shown in Figure 1, the mobile terminal electronic payment system in the present invention includes: application provider management platform, card issuer management platform, application provider management platform, service terminal (comprising card issuer service terminal and application provider service terminal), Mobile terminal and smart card with electronic payment application function, the smart card in this system can be installed on a mobile terminal. In other embodiments, the system may not include a mobile terminal, and in this case the smart card is an independent device.

The smart card supports the Global Platform Card Specification V2.1.1/V2.2; the smart card with electronic payment application function can be directly managed by the card issuer management platform or the application provider through the card issuer business terminal and the application provider business terminal respectively. Platform connection, when a smart card with electronic payment application functions is installed on a mobile terminal, the mobile terminal can be connected to the card issuer management platform and the application provider management platform through the card issuer service terminal or the application provider service terminal respectively.

The smart card can be installed on the mobile terminal, the smart card and the mobile terminal can support the OTA function, the mobile terminal can be connected with the OTA server through the mobile communication network, and the OTA server is connected with the card issuer management platform and the application provider management platform respectively connect.

The card issuer management platform is responsible for the issuance and management of smart cards, manages the resources and life cycle of smart cards, keys, and certificates, is responsible for the creation of secondary security domains, and interacts with other security domains for application data, including the creation of secondary security domains. , performing mutual authentication with the smart card and establishing a temporary session key, and generating an initial key of the secondary security domain and a new key of the secondary security domain. In terms of specific implementation, the card issuer management platform may include a card management system, an application management system, a key management system, a certificate management system, an application provider management system, etc., where the certificate management system supports asymmetric keys To use, the certificate management system is connected to the card issuer certification authority (CA) system;

The application provider management platform is responsible for the provision and management of electronic payment applications, providing various business applications, and performing security management on the corresponding secondary security domain on the smart card. etc. to provide functions such as safe download and installation of applications. It includes performing mutual authentication with the smart card, establishing a temporary session key, and generating a new secondary security domain key. In terms of specific implementation, the application provider management platform may include an application management system, a key management system, and a certificate management system, wherein the certificate management system is used when supporting asymmetric keys, and the certificate management system and the application provider certification authority (CA) system connection.

The card issuer management platform and the application provider management platform can provide electronic payment-related services through their respective business terminals: participate in the processing of electronic payment user information management, participate in the creation of security domains and key distribution, download of electronic payment applications, and electronic payment. Personalization of payment applications, etc. The application provider management platform and the card issuer management platform can communicate through a secure connection (such as a dedicated line connection).

The smart card can be installed on the mobile terminal, and is used to communicate with the card issuer management platform through the mobile terminal and the service terminal, or directly communicate with the card issuer management platform through the service terminal; It is used to provide support for submitting an application download request to the card issuer management platform, perform mutual authentication with the card issuer management platform and establish a temporary session key, and is also used to decrypt the obtained secondary security domain initial key, and The security domain is initialized;

The card issuer service terminal is managed by the card issuer management platform; it is used to forward the interaction information between the card issuer management platform and the smart card.

The application provider service terminal is managed by the application provider management platform; it is used to receive the message sent by the application provider management platform and forward it to the smart card; it is also used to receive the message sent by the smart card and forward it to the application Provider management platform.

The present invention is described based on the mobile terminal electronic payment system architecture shown in FIG. 1 as an example, but is not limited to the mobile terminal electronic payment system architecture shown in FIG. 1 .

As shown in Figure 2, in Embodiment 1, the card issuer management platform distributes the security domain initial key to the smart card through the card issuer service terminal, specifically including the following steps:

Step 201, the user triggers the application download application through the card issuer business terminal client program or smart card program, and submits the application download application to the card issuer management platform. The application download application can include smart card user identification information, application identification and application provider identity and other information;

Step 202, the card issuer management platform sends a SELECT command message to the smart card via the card issuer service terminal to select the primary security domain;

Step 203, the smart card submits a SELECT command response to the card issuer management platform via the card issuer service terminal;

Step 204, the card issuer management platform establishes an SCP02 secure channel with the smart card main security domain via the card issuer service terminal;

The card issuer management platform starts mutual authentication between the card issuer management platform and the smart card main security domain, and after mutual authentication is completed, a temporary session key is established between the card issuer management platform and the smart card main security domain, Thus establishing a secure channel. The temporary session key can be established according to the GlobalPlatform Card Specification V2.1.1/V2.2, or can be established by other methods;

The mutual authentication process is completed between the card issuer management platform and the smart card primary security domain via the card issuer service terminal.

Step 205, the card issuer management platform judges whether it is necessary to create a secondary security domain, if it is not necessary to create a secondary security domain, then terminate the process of creating a secondary security domain; if it is necessary to create a secondary security domain, continue to perform subsequent steps;

The card issuer management platform judges whether to create a secondary security domain according to information such as the smart card ICCID information, application identification, and application provider identity, or through smart card status information.

The status information of the smart card is obtained from the main security domain of the smart card by the card issuer management platform.

Step 206, the card issuer management platform sends the INSTALL command to the smart card via the card issuer service terminal;

Step 207, the smart card submits the INSTALL command response to the card issuer management platform via the card issuer service terminal;

Step 208, the card issuer management platform generates an initial key, and sends the initial key from the security domain to the primary security domain of the smart card via the card issuer service terminal through the PUTKEY command;

Step 209, after receiving the initial key of the slave security domain, the master security domain of the smart card initializes the slave security domain with the received initial key of the slave security domain;

Step 210, the primary security domain of the smart card sends a PUTKEY command response to the card issuer management platform via the card issuer service terminal, and ends the initial key distribution process of the secondary security domain.

In the first embodiment, the interactive information between the card issuer management platform and the smart card is forwarded through the card issuer service terminal; in the second embodiment, the message from the card issuer management platform to the smart card passes through the application provider management platform and the application provider in turn Forwarding by the service terminal, the message from the smart card to the card issuer management platform is forwarded through the application provider service terminal and the application provider management platform in turn. As shown in Figure 3, in Embodiment 2, the method for distributing the initial key from the security domain specifically includes the following steps:

Step 301, the user triggers an application download application through the application provider's business terminal client program or smart card program, and submits the application download application to the card issuer management platform via the application provider management platform. The application download application may include smart card user identification information, application Identification and application provider identity and other information;

Step 302, the card issuer management platform sends a SELECT command message to the smart card via the application provider management platform and the application provider service terminal, and selects the main security domain;

Step 303, the smart card submits a SELECT command response to the card issuer management platform via the application provider service terminal and the application provider management platform;

Step 304, the card issuer management platform and the smart card main security domain establish the SCP02 security channel via the application provider management platform and the application provider service terminal;

The card issuer management platform starts mutual authentication between the card issuer management platform and the smart card main security domain, and after mutual authentication is completed, a temporary session key is established between the card issuer management platform and the smart card main security domain, Thus establishing a secure channel. The temporary session key can be established according to the GlobalPlatform Card Specification V2.1.1/V2.2, or can be established by other methods;

The mutual authentication process is completed between the card issuer management platform and the smart card main security domain via the application provider management platform and the application provider service terminal.

Step 305, the card issuer management platform judges whether it is necessary to create a secondary security domain, if it is not necessary to create a secondary security domain, then terminate the process of creating a secondary security domain; if it is necessary to create a secondary security domain, continue to perform subsequent steps;

The card issuer management platform judges whether to create a secondary security domain according to information such as the smart card ICCID information, application identification, and application provider identity, or through smart card status information.

The status information of the smart card is obtained from the main security domain of the smart card by the card issuer management platform.

Step 306, the card issuer management platform sends the INSTALL command to the smart card via the application provider management platform and the application provider service terminal;

Step 307, the smart card submits the INSTALL command response to the card issuer management platform via the application provider service terminal and the application provider management platform;

Step 308, the card issuer management platform sends the initial key of the secondary security domain to the smart card primary security domain via the application provider management platform and the application provider service terminal through the PUTKEY command;

Step 309, after the master security domain of the smart card receives the initial key from the security domain, initialize the slave security domain with the received initial key from the security domain;

Step 310, the primary security domain of the smart card sends a PUTKEY command response to the card issuer management platform via the service terminal of the application provider and the management platform of the application provider, and ends the initial key distribution process of the secondary security domain.

The smart card secondary security domain initial key distribution method and system of the present invention can solve the problem of the security of the secondary security domain initial key generated by the card issuer management platform when creating the secondary security domain for the symmetric key after the card is issued. Import to the secondary security domain, so as to realize the safe distribution of the initial key of the secondary security domain.

The present invention can also have other multiple embodiments, without departing from the spirit and essence of the present invention, those skilled in the art can make various corresponding changes and deformations according to the present invention, these corresponding changes and All deformations should belong to the protection scope of the appended claims of the present invention.

Claims (8)

1. The initial key distribution method of a smart card from a security domain is characterized in that the method is realized based on a mobile terminal electronic payment system, and the system includes a smart card with an electronic payment application function, a card issuer management platform and a service terminal, and the smart card It is an independent device or installed on a mobile terminal; the smart card communicates with the card issuer management platform through the service terminal, and the card issuer management platform distributes the initial key from the security domain through the service terminal to said smart card; the method comprising: (a) The user triggers the application download request through the smart card program or the service terminal client program, and submits the application download request to the card issuer management platform, and the application download request includes the smart card identification information, application identification and application provider identity information; (b) After the card issuer management platform receives the application download request information, a secure channel is established between the card issuer management platform and the smart card main security domain; (c) The card issuer management platform creates a secondary security domain and generates a secondary security domain initial key, and imports the security domain initial key into the smart card secondary security domain via the service terminal through the established secure channel. 2. The method of claim 1, wherein After the step (b), before the step (c), it also includes: the card issuer management platform judges whether to create a secondary security domain according to the smart card identification information, application identification and application provider identity information, or according to the smart card status information. . 3. The method of claim 1, wherein, Step (b) The process of establishing a secure channel includes: (b1) The card issuer management platform and the main security domain of the smart card perform mutual authentication via the service terminal, and the mutual authentication process passes through the service terminal in the card issuer (b2) establishing a temporary session key between the card issuer management platform and the smart card main security domain, thereby establishing a secure channel. 4. The method according to any one of claims 1 to 3, wherein The service terminal is a card issuer service terminal, and the interactive information between the card issuer management platform and the smart card is forwarded through the card issuer service terminal; or, the service terminal is an application provider service terminal, from the The message from the card issuer management platform to the smart card is forwarded sequentially through the application provider management platform and the application provider service terminal, and the message from the smart card to the card issuer management platform is sequentially passed through the application provider service terminal and the application provider Business management platform forwarding. 5. The initial key distribution system from the security domain of the smart card is characterized in that the system includes a smart card with electronic payment application functions, a card issuer management platform and a business terminal; The smart card communicates with the card issuer management platform through the service terminal; it is also used to provide support for submitting an application download request to the card issuer management platform, perform mutual authentication with the card issuer management platform and establish a temporary The session key is also used to decrypt the obtained initial key of the secondary security domain and initialize the secondary security domain; The card issuer management platform is used to distribute the initial key from the security domain to the smart card through the service terminal; it is also used to perform mutual authentication and establish a temporary session key with the main security domain of the smart card, and also use Based on judging whether to establish a secondary security domain according to the application download request or the status information of the smart card, and establishing the secondary security domain, generating and distributing the initial key of the secondary security domain to the smart card. 6. The system of claim 5, wherein: The service terminal is a card issuer service terminal, which is used to forward the interaction information between the card issuer management platform and the smart card; or; The service terminal is an application provider service terminal, and the system also includes an application provider management platform; The application provider service terminal is used to receive the message sent by the application provider management platform and forward it to the smart card; it is also used to receive the message sent by the smart card and forward it to the application provider management platform; The application provider management platform is used to receive the message sent by the card issuer management platform and forward it to the application provider service terminal; it is also used to receive the message sent by the application provider service terminal and forward it to the The card issuer management platform. 7. A system as claimed in claim 5 or 6, characterized in that, The smart card is an independent device or installed on a mobile terminal. 8. A mobile terminal adopting a method for initial key distribution from a security domain of a smart card as claimed in claim 1, said mobile terminal comprising a smart card with an electronic payment application function, characterized in that said smart card is initialized from a security domain The key is distributed by the card issuer management platform through the card issuer service terminal, or through the application provider management platform and the application provider service terminal.

Images