Smart card based secret key application method and application apparatus

Abstract

The invention discloses a smart card based secret key application method and an application apparatus for reducing potential safety hazards of secret key leakage. The method comprises: after the smart card receives a first business request sent by an application program, based on a mapping relation between a first secret key index and secret key associated information carried by the first business request, the smart card reads the secret key associated information arranged corresponding to the first secret key index from a secret key storage region designated locally, and obtains a first secret key corresponding to the first secret key index based on the secret key associated information, and employs the first secret key and business to end to complete relevant operation. In this way, when the smart card is processing the first business request, the first secret key is obtained from the secret key storage region designated locally by the mapping relation between the firs secret key index and the secret key associated information, rather than obtained directly from the application program, which prevents safety hazards of secret key leakage caused by attacks to the application programs by hackers or Trojan virus.

Description

technical field [0001] The invention relates to the technical field of computer security, in particular to a key application method and application device based on a smart card. Background technique [0002] Multi-application smart card is an integrated circuit card that integrates multiple functions. It can carry multiple applications. It has the advantages of portability and easy use. It is widely used in finance, transportation, social security, medical communication and other industries. The multi-application smart card mainly realizes the coordinated management of various application programs through the smart card operating system (Card Operating System, COS). Among them, the COS system mainly adopts Java Card open platform technology and Global Platform (Global Platform, GP) Data isolation between applications. However, in the prior art, the key information of each application program is stored and managed by the application program itself, and the key information is...

AI Technical Summary

Problems solved by technology

However, in the prior art, the key information of each application program is stored and managed by the application program itself, and the key information is not isolated from the application program itself. When the smart card performs business processing, it can be obtained directly from the application program. key processing

[0003] In this way, there is still a security risk of key information leakage due to improper management of key information by the application

[0004] For example, due to lack of experience in developing applications, or due to factors such as unqualified application testing, there may be logical defects in the application, and criminals can steal the keys of related services by attacking the loopholes in the application, and then according to The stolen relevant key copies the smart card, and uses the relevant key to interact with the business peer end using the copied smart card, thereby causing serious losses to the cardholder

[0005] Based on the above analysis, there is still the problem that the key of the smart card is easily leaked in the prior art

Images