SAM card control system and method

Abstract

The invention discloses an SAM card control system and method, the system comprises a to-be-controlled SAM card module, a device terminal and a card issuing bank background server, and the module comprises an SAM card and an NFC unit; when the relative distance condition is met, the equipment terminal establishes near field communication connection with the NFC unit and sends a record reading command; the module determines the NDEF file according to the command and feeds back the NDEF file to the equipment terminal; based on the NDEF file, the device terminal generates an unlocking request and sends the unlocking request to the issuing bank background server when judging that the operation type is an unlocking type, so that the issuing bank background server generates an unlocking ciphertext according to a preset mode and transmits the unlocking ciphertext when verifying that the unlocking request meets an unlocking condition; and when receiving the unlocking ciphertext, the equipment terminal generates an unlocking command and sends the unlocking command to the module based on the preset NFC unit label read-write software and the unlocking ciphertext, so that the module updates the authorization information of the SAM card according to the unlocking command. And through an online unlocking mode, the processing time and the money cost are saved.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a SAM card control system and method. Background Art

[0002] The Security Access Module (SAM) card is a hardware security module used to store and process encrypted data, perform identity authentication and digital signatures. It is widely used in finance, communications, payment, production and other fields. The life cycle of a SAM card is generally divided into four stages: the first stage, SAM card production; the second stage, SAM card initialization; the third stage, SAM card use; the fourth stage, SAM card locking. In order to effectively control the use security of SAM cards, SAM card issuers usually set the first and second stages to occur at the card factory or issuing bank, while the third and fourth stages occur at the terminal, and set the SAM card life cycle to be irreversible. Therefore, if the SAM card enters a locked state due to reaching the limit on the number of uses or detecting abnormal conditions such as attacks, the SAM card use terminal will be restricted and can no longer be used normally.

[0003] In order to solve the recovery problem after locking, the terminal user can choose to reapply for a new SAM card to replace the locked SAM card. The locked SAM card can also be sent to the issuing bank, which will use a special command in a secure environment to unlock and reset the SAM card usage rights, and then send it to the terminal for continued use. Alternatively, the issuing bank will send the corresponding unlocking tool to the terminal user through a secure channel, and the terminal user can use the unlocking tool to unlock the SAM card or reset the number of authorizations.

[0004] However, replacing the SAM card requires extra mailing time, and both the issuing bank and the device terminal need to configure new SAM card management parameters, which increases the complexity of the SAM card management systems at both ends. Although compared with the first technical solution, there is no waste of SAM cards and the workload of terminal reconfiguration; the same second method requires that the locked SAM card first be sent from the terminal user to the issuing bank, and then the issuing bank unlocks and resets the SAM card before sending it back to the terminal user, so it will take more time and money. Then the third method is that the terminal user completes the unlocking and resetting independently, so the issuing bank cannot obtain the SAM card information and cannot uniformly manage the issued SAM cards. Then if the SAM card unlocking tool is cracked, the issuing bank will no longer be able to effectively control the safe and legal use of the SAM card, which may bring serious security threats and economic losses. In addition, the SAM card unlocking tool usually has high requirements for the software operating environment and operating procedures based on security considerations, and may require the issuing bank to manage different versions of the SAM card unlocking tool, thereby additionally increasing the offline tool version management cost. Summary of the invention

[0005] The invention provides a SAM card control system and method to realize online unlocking control of the SAM card.

[0006] According to one aspect of the present invention, a SAM card control system is provided, the system comprising: a SAM card module to be controlled, a device terminal and a backend server of a card issuing bank, the SAM card module to be controlled comprising a SAM card and an NFC unit;

[0007] The device terminal is used to establish a near field communication connection with the NFC unit in the SAM card module to be controlled in response to meeting the relative distance condition, and send a read record command carrying the NFC tag application identifier to the SAM card module to be controlled;

[0008] The SAM card module to be controlled is used to determine the NFC data exchange format NDEF file according to the read record command and feed it back to the device terminal;

[0009] The device terminal is used to determine the operation type of the SAM card based on the NDEF file, and when the operation type is an unlocking type, generate an unlocking request according to the NDEF file and send it to the backend server of the issuing bank;

[0010] The backend server of the issuing bank is used to generate an unlocking ciphertext in a preset manner and transmit it to a preset target when verifying that the unlocking request meets the unlocking condition. The preset target includes the device terminal or other associated devices.

[0011] The device terminal is used to generate an unlock command based on the preset NFC unit tag reading and writing software and the unlock ciphertext when receiving the unlock ciphertext, and send the unlock command to the SAM card module to be controlled;

[0012] The SAM card module to be controlled is used to update the authorization information of the SAM card according to the unlock command.

[0013] According to a second aspect of the present invention, a SAM card control method is provided, the method being applied to a SAM card control system as described in any one of the embodiments of the present invention, the system comprising: a SAM card module to be controlled, a device terminal and a backend server of an issuing bank, the SAM card module to be controlled comprising a SAM card and an NFC unit, the method comprising:

[0014] In response to the relative distance condition being met, the device terminal establishes a near field communication connection with the NFC unit in the SAM card module to be controlled, and sends a read record command carrying the NFC tag application identifier to the SAM card module to be controlled;

[0015] Determine the NFC data exchange format NDEF file through the SAM card module to be controlled according to the read record command and feed it back to the device terminal;

[0016] Determine the operation type of the SAM card based on the NDEF file by the device terminal, and when the operation type is an unlocking type, generate an unlocking request according to the NDEF file and send it to the backend server of the issuing bank;

[0017] When the unlock request satisfies the unlock condition through the backend server of the issuing bank, an unlock ciphertext is generated in a preset manner and transmitted to a preset target, which includes the device terminal or other associated devices;

[0018] When the unlocking ciphertext is received by the device terminal, an unlocking command is generated based on the preset NFC unit tag reading and writing software and the unlocking ciphertext and sent to the SAM card module to be controlled;

[0019] The authorization information of the SAM card is updated according to the unlock command by the SAM card module to be controlled.

[0020] The technical solution of the embodiment of the present invention provides a system including: a SAM card module to be controlled, a device terminal and a backend server of an issuing bank, wherein the SAM card module to be controlled includes a SAM card and an NFC unit; the device terminal is used to establish a near field communication connection with the NFC unit in the SAM card module to be controlled in response to meeting a relative distance condition, and send a read record command carrying an NFC tag application identifier to the SAM card module to be controlled; the SAM card module to be controlled is used to determine an NFC data exchange format NDEF file according to the read record command and feed it back to the device terminal; the device terminal is used to, based on the NDEF file, Determine the operation type of the SAM card. When the operation type is unlocking, generate an unlock request according to the NDEF file and send it to the backend server of the issuing bank. The backend server of the issuing bank is used to verify that the unlock request meets the unlocking conditions, generate an unlock ciphertext in a preset manner and transmit it to the preset target, which includes the device terminal or other associated devices. The device terminal is used to generate an unlock command based on the preset NFC unit tag reading and writing software and the unlock ciphertext when receiving the unlock ciphertext and send it to the SAM card module to be controlled. The SAM card module to be controlled is used to update the authorization information of the SAM card according to the unlock command. The information transmission between the NFC unit and the device terminal is established, and the device terminal is unlocked online. There is no need to replace a new SAM card, nor is there a need for the issuing bank to unlock the SAM card offline, saving time and money costs for SAM card exception processing. The issuing bank does not need to send the corresponding unlocking tool software to the terminal user to unlock the SAM card, so the risk is avoided and the workload of unlocking tool software version management is reduced.

[0021] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0023] Figure 1 is a structural schematic diagram of a SAM card control system provided according to Embodiment 1 of the present invention;

[0024] Figure 2 A flowchart of a SAM card control system is provided according to Embodiment 1 of the present invention;

[0025] Figure 3 It is a flow chart of a SAM card control method provided according to the second embodiment of the present invention. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] Embodiment 1

[0029] Figure 1This is a schematic diagram of the structure of a SAM card control system provided by the first embodiment of the present invention. This embodiment can be applied to the control of SAM cards, such as Figure 1 As shown, the system includes: a SAM card module to be controlled, a device terminal and a backend server of the issuing bank, and the SAM card module to be controlled includes a SAM card and an NFC unit.

[0030] The device terminal is used to establish a near-field communication connection with the NFC unit in the SAM card module to be controlled in response to meeting the relative distance condition, and send a read record command carrying the NFC tag application identifier to the SAM card module to be controlled; the SAM card module to be controlled is used to determine the NFC data exchange format NDEF file according to the read record command and feed it back to the device terminal; the device terminal is used to determine the operation type of the SAM card based on the NDEF file, and when the operation type is the unlock type, generate an unlock request according to the NDEF file and send it to the back-end server of the issuing bank; the back-end server of the issuing bank is used to verify that the unlock request meets the unlock condition, generate an unlock ciphertext in a preset manner and transmit it to a preset target, and the preset target includes the device terminal or other associated devices; the device terminal is used to generate an unlock command based on the preset NFC unit tag reading and writing software and the unlock ciphertext when receiving the unlock ciphertext and send it to the SAM card module to be controlled; the SAM card module to be controlled is used to update the authorization information of the SAM card according to the unlock command.

[0031] In this embodiment, the device terminal can be understood as a device configured with an NFC function, supporting an NFC card reader mode and capable of screen display, such as a mobile phone configured with an NFC function. The relative distance condition can be understood as a condition for determining whether the distance between the device terminal and the SAM card module to be controlled reaches the distance for establishing a near field communication connection. The near field communication (NFC) unit can be understood as a unit provided with an NFC function so that the SAM card module to be controlled has an NFC function. The NFC tag application identifier (AID) can be understood as an NFC tag application identifier AID defined by NFC Forum T4T, which is used to uniquely identify the coding system of the NFC application. The AID can be used to determine whether the NFC Forum T4T application is configured in the NFC unit. The read record command can be understood as a command for reading an NDEF record. The NFC Data Exchange Format (NDEF) file can be understood as a file that encapsulates the transmitted information into one or more "record" forms. NDEF refers to a standardized format for exchanging data between NFC devices. It defines a structured way to store and transmit data, allowing NFC devices to identify, read and write NFC tags containing various types of information. The unlock request can be understood as a request to unlock a locked SAM card. The operation type can be understood as the control method of the SAM card. For example, when the SAM card is locked, it corresponds to the unlock type. When the SAM card is not locked, it can also include information display type, etc., which can be defined according to needs.

[0032] In this embodiment, the backend server of the issuing bank can be understood as the backend server of the issuing bank that issues the SAM card. The unlocking condition can be understood as a condition for verifying whether the SAM card can be unlocked, such as the access rights of the terminal user of the SAM card. The preset method can be understood as a method for generating unlocking ciphertexts set according to different transmission channels. The unlocking ciphertext can be understood as content for unlocking the SAM card in the form of ciphertext. The preset target can be understood as a terminal that receives the unlocking ciphertext, such as a device terminal or other associated device that sends an unlocking request. Other associated devices can be understood as devices for unlocking the SAM card, such as a card reader. The preset NFC unit tag reading and writing software can be understood as an APP that supports NFC unit tag reading and writing. The unlocking command can be understood as a command for unlocking the SAM card so that the SAM card can be unlocked. The authorization information can be understood as information related to the use of the SAM card, such as the usage status, the number of authorizations, and the authorization validity period.

[0033] Specifically, when the user has control requirements for the SAM card, the SAM card module to be controlled can be brought close to the device terminal. When the distance to the SAM card module to be controlled meets the relative distance condition, the device terminal can establish a near field communication connection with the NFC unit in the SAM card module to be controlled, and then perform data interaction through the Application Protocol Data Unit (APDU) format. After the near field communication connection is established, the NFC card reader in the device terminal uses the NFC tag application identifier (AID) defined by the NFCForum T4T fixed application to send a read record command carrying the NFC tag application identifier to the SAM card module to be controlled.

[0034] Specifically, when the SAM card module to be controlled receives the read record command, since the AID is used to identify whether the SAM card module to be controlled contains the NFC tag application corresponding to the AID (that is, the NFC Forum T4T fixed application mentioned above), if the SAM card module to be controlled has an NFC tag application corresponding to the AID, it can first respond to the device terminal with the corresponding status word to indicate that it has the corresponding NFC tag application, and obtain the NDEF file representing the current status of the SAM card from the SAM application through the NFC tag application, and feed it back to the device terminal.

[0035] Specifically, the device terminal can parse the NDEF file based on the feedback from the SAM card module to be controlled, and first determine the operation type of the SAM card module to be controlled. When the operation type is an unlocking type, the device terminal can generate an unlocking request based on the unlocking-related information in the NDEF file, and send the unlocking request to the issuing bank's back-end server through the interactive method provided in the NDEF file.

[0036] Specifically, when the backend server of the issuing bank receives an unlock request, it can first verify the SAM card verification ciphertext in the unlock request. If the ciphertext is correct, the SAM card access rights in the unlock request are determined. If the access rights are available and the unlock conditions are met, the backend server of the issuing bank can generate the corresponding unlock ciphertext in a preset manner and transmit it to the preset target. When the preset target is a device terminal, it can be sent directly through a transmission channel. When the preset target is other associated devices, it can be transmitted to other associated devices through transmission forms such as email. If the unlock conditions are not met, the unlock request is rejected, and feedback can be given to the device terminal by responding to corresponding prompts or other means.

[0037] Specifically, when the device terminal receives the unlock ciphertext, it can copy the NDEF record in the unlock ciphertext based on the preset NFC unit tag reading and writing software to generate an unlock command and send it to the SAM card module to be controlled. When the SAM card module to be controlled receives the unlock command, it can write the NDEF record in the unlock command into the SAM card to update the authorization information of the SAM card.

[0038] The technical solution of the embodiment of the present invention provides a system including: a SAM card module to be controlled, a device terminal and a backend server of an issuing bank, wherein the SAM card module to be controlled includes a SAM card and an NFC unit; the device terminal is used to establish a near field communication connection with the NFC unit in the SAM card module to be controlled in response to meeting a relative distance condition, and send a read record command carrying an NFC tag application identifier to the SAM card module to be controlled; the SAM card module to be controlled is used to determine an NFC data exchange format NDEF file according to the read record command and feed it back to the device terminal; the device terminal is used to, based on the NDEF file, Determine the operation type of the SAM card. When the operation type is unlocking, generate an unlock request according to the NDEF file and send it to the backend server of the issuing bank. The backend server of the issuing bank is used to verify that the unlock request meets the unlocking conditions, generate an unlock ciphertext in a preset manner and transmit it to the preset target, which includes the device terminal or other associated devices. The device terminal is used to generate an unlock command based on the preset NFC unit tag reading and writing software and the unlock ciphertext when receiving the unlock ciphertext and send it to the SAM card module to be controlled. The SAM card module to be controlled is used to update the authorization information of the SAM card according to the unlock command. The information transmission between the NFC unit and the device terminal is established, and the device terminal is unlocked online. There is no need to replace a new SAM card, nor is there a need for the issuing bank to unlock the SAM card offline, saving time and money costs for SAM card exception processing. The issuing bank does not need to send the corresponding unlocking tool software to the terminal user to unlock the SAM card, so the risk is avoided and the workload of unlocking tool software version management is reduced.

[0039] Further, based on the above embodiment, the SAM card module to be controlled may also include a super input and output chip SIO interface. Accordingly, according to the read record command, the steps of determining the NFC data exchange format NDEF file and feeding it back to the device terminal are refined as follows:

[0040] The NFC unit receives the read record command through the NFC tag application and forwards it to the SAM card based on the SIO interface; the SAM card determines the current state through the SAM application. If the current state is unlocked, the type field in the NDEF record is set to the first type, and the SAM card usage information is placed in the payload field of the NDEF record to obtain the organized NDEF file; if the current state is locked, the type field in the NDEF record is set to the second type, the decrypted ciphertext based on the unique number of the SAM card is calculated, the decrypted ciphertext, the uniform resource identifier of the issuing bank's backend server, and the SAM card information are placed in the payload field to obtain the NDEF file; the NDEF file is sent to the NFC tag application through the SIO interface, and the NDEF file is fed back to the device terminal through the NFC unit.

[0041] In this embodiment, the Super Input / Output Chip (SIO) interface can be understood as an interface for data transmission between SAM and NFC. In the software system architecture of the SAM card module to be controlled, the SAM application and the NFC tag application can be separated by multiple firewalls to ensure that each application is independent and will not be affected. Therefore, an SIO interface can be added in the application management platform (i.e., the SAM card operating system) to realize data transmission between the SAM application and the NFC tag application. The SAM application can be understood as encryption, decryption and authentication dedicated to the hardware security module. The current state can be understood as status information used to characterize the locking status of the SAM card. The NDEF record can be understood as a record of the data required for transmitting this SAM card operation. The type field can be understood as a field for distinguishing the type of operation on the SAM card. The first type can be understood as a field for indicating the type of information display, for example, it can be represented by 'T'. The payload field is the payload field, which is used to record the payload. The SAM card usage information can be understood as information related to the current usage of the SAM card, such as the SAM card identification information and the remaining validity period, etc., which can be predefined according to the information that the user wants to display. The second type can be understood as a field used to indicate the unlocking type, for example, it can be represented by 'U'. The SAM card unique number (Universally Unique Identifier, UID) can be understood as a unique identifier used to characterize the identity of the SAM card. The decrypted ciphertext can be understood as an encrypted decryption request. The Uniform Resource Identifier (URI) can be understood as a string used to uniquely identify Internet resources, which can locate and access the issuing bank's back-end server resources on the network, such as a URL that can be accessed by the web. SAM card information can be understood as specific information that organizes the unlocking process.

[0042] Specifically, the device terminal indirectly transmits information with the SAM card through the NFC unit, then the NFC unit of the SAM card module to be controlled receives the read record command through the NFC tag application, and forwards it to the SAM card based on the SIO interface; the SAM card determines the current state through the SAM application, if the current state is unlocked, the type TYPE field in the NDEF record is set to the first type (for example, 'T'), and the SAM card usage information is placed in the payload field PAYLOAD of the NDEF record to obtain the organized NDEF file; if the current state is locked, the type TYPE field in the NDEF record is set to the second type (for example, 'U'), and the decrypted ciphertext based on the unique number of the SAM card is calculated through the SAM application, and the decrypted ciphertext, the uniform resource identifier of the issuing bank's backend server, and the SAM card information are placed in the payload PAYLOAD field to obtain the NDEF file; the NDEF file is sent to the NFC tag application through the SIO interface, and the NDEF file is fed back to the device terminal through the NFC unit.

[0043] Exemplarily, the NDEF record format under the first type can be specifically shown in Table 1:

[0044] Table 1 NDEF record format showing SAM card information

[0045]

[0046] Among them, the first column represents the header information, including flags such as MB, ME, CF, SR, IL and TNF, which are used to describe various attributes of the record; the second column represents the type length, which is used to indicate the length of the record type field; the third column represents the payload length, which is used to record the length of the valid content; the fourth column represents the record type; the fifth column represents the ID length; the sixth column represents the record ID; the seventh column represents the SAM card information content, recording the valid load.

[0047] Table 2 NDEF record format for requesting SAM card unlock

[0048]

[0049] Similar to the above description, it can be seen that the symbols representing the record types are different. The record type that displays information is represented by 'T', while the unlocked record type is represented by 'U'.

[0050] Further, based on the above embodiment, the steps of determining the operation type of the SAM card based on the NDEF file can be refined as follows:

[0051] Extract the type field in the NDEF file; when the type field is the first type, determine that the operation type of the SAM card is the information display type; when the type field is the second type, determine that the operation type of the SAM card is the unlocking type.

[0052] Specifically, when the device terminal receives the NDEF file, it can parse the type field in the NDEF file; when the type field is the first type, the operation type of the SAM card is determined to be the information display type; when the type field is the second type, the operation type of the SAM card is determined to be the unlocking type.

[0053] Optionally, the device terminal further includes:

[0054] When the operation type is the information display type, the NDEF file is parsed to obtain the SAM card usage information, and the SAM card usage information is displayed.

[0055] Specifically, when the operation type is the information display type, the device terminal can parse the NDEF file to obtain the SAM card usage information included therein, and display the SAM card usage information on the screen of the device terminal.

[0056] Further, based on the above embodiment, the steps of generating an unlock request according to the NDEF file and sending it to the backend server of the issuing bank can be refined as follows:

[0057] Parse the NDEF file to obtain the decrypted ciphertext, SAM card information and the uniform resource identifier of the issuing bank's backend server; generate a decryption request based on the decrypted ciphertext and SAM card information; access the uniform resource identifier and send the decryption request to the issuing bank's backend server.

[0058] Specifically, the device terminal can parse the NDER file to obtain the unlocking ciphertext of the SAM card, the SAM card information and the uniform resource identifier of the backend server of the issuing bank. The device terminal can generate a decryption request according to a preset format, access the uniform resource identifier through a web browser, etc., and send the decryption request to the backend server of the issuing bank.

[0059] Exemplarily, the data format of the decryption request can be shown by Table 3.

[0060] Table 3 Unlock request data format for applying for SAM card unlock field

[0061]

[0062] Further, based on the above embodiment, the steps of generating the unlocking ciphertext in a preset manner and transmitting it to the preset target can be refined as follows:

[0063] When the preset method is to transmit to other associated devices, the unlocking ciphertext is generated in the form of an unlocking command set and transmitted to other associated devices; when the preset method is to transmit to a device terminal, the unlocking ciphertext is generated according to the response NDEF record and transmitted to the device terminal.

[0064] In this embodiment, the unlocking command set can be understood as a command set in ciphertext form, which is an executable data frame form.

[0065] Specifically, according to different preset goals, the forms of unlocking ciphertext can be divided into two forms, namely, unlocking command set and NDEF record. When the preset method is to transmit to other associated devices, since other associated devices decrypt and transmit by directly writing to the SAM card, there is no need for NFC forwarding, the backend server of the issuing bank can generate the unlocking ciphertext in the form of unlocking command set and transmit it to other associated devices. When the preset method is to transmit to the device terminal, since the device terminal can directly transmit data with the SAM card module to be controlled through NFC, the backend server of the issuing bank can generate the unlocking ciphertext according to the response NDEF record and transmit it to the device terminal.

[0066] Optionally, the system further comprises:

[0067] When the preset target is other associated devices, the unlocking command in the form of application protocol data unit APDU is generated by other associated devices based on the unlocking command set in the unlocking ciphertext, and is sent to the SAM card module to be controlled one by one.

[0068] In this embodiment, the application protocol data unit APDU is a basic information unit for transmitting commands and responses between the NFC card and the device terminal.

[0069] Specifically, when the preset target is other associated devices, the unlock command in the form of application protocol data unit APDU is generated by other associated devices (such as card readers) based on the unlock command set in the unlock ciphertext, and is sent to the SAM card module to be controlled one by one.

[0070] It is known that there are many devices with NFC functions, such as bank cards or access cards, which will establish near-field communication connections when they are close to the device terminal, but cannot perform the functions mentioned in the present invention. Therefore, a method of distinguishing which devices have control requirements is needed.

[0071] Furthermore, in order to distinguish the devices, the SAM card module to be controlled is also used for:

[0072] When a read record command is received, the NFC tag application of the NFC unit generates a target response status word and feeds it back to the device terminal.

[0073] In this embodiment, the target response status word may be understood as an identifier used to indicate the presence of an NFC tag application.

[0074] Specifically, when the SAM card module to be controlled receives a read record command, a target response status word can be generated by the NFC tag application of the NFC unit and fed back to the device terminal, so as to characterize that the SAM card module to be controlled is a device with control requirements through the target response status word.

[0075] Furthermore, the device terminal is also used for:

[0076] A response status word is received, and when the response status word is not a target response status word, the near field communication connection is disconnected.

[0077] Specifically, since some devices have NFC functions, such as transportation cards, which do not need to be controlled by this method, it is necessary to screen out such devices. When the device terminal receives the response status word, the response status word can be judged first. If the response status word is not the target response status word, that is, the device that establishes the near-field communication connection is only a device with NFC function, but does not have control requirements, the device terminal can disconnect the near-field communication connection.

[0078] The technical solution of the embodiment of the present invention is based on the existing mature and universal communication protocol NFC and the data exchange format NDEF file, to establish a communication connection and data interaction between the SAM card module to be controlled and the device terminal. The device terminal only needs to have the NFC function, which has the advantages of simple implementation, ensuring the security of communication data and compatibility with different devices. The SAM card module to be controlled interacts with the device terminal through the NDEF file, so that the device terminal can independently determine the type of operation to be performed on the SAM card. The traditional reading of SAM card information requires users to be familiar with the complex private commands and data format parsing in the corresponding product manual, and is changed to support the NDEF data format through the SAM card. The device terminal automatically sends and parses the data responded by the SAM card, and displays various types of SAM card information in the form preset by the issuing bank, thereby realizing automatic control of the SAM card. When the operation type is the information display type, the SAM card usage information obtained by parsing the NDEF file can be displayed, solving the problem that the SAM card usage information cannot be displayed. When the operation type is unlocking type, the unlocking request is automatically generated by the device terminal and sent to the backend server of the issuing bank through online connection, so that the backend server of the issuing bank automatically generates the unlocking ciphertext when verifying that the unlocking request meets the unlocking conditions, and realizes the transmission of the unlocking ciphertext on the basis of ensuring the security of the device. Through various transmission forms of the device terminal or other related devices, the unlocking ciphertext is sent to the SAM card module to be controlled, so that the SAM card verifies the unlocking command, and updates the authorization information after the verification, so as to realize the unlocking of the SAM card through online mode. The issuing bank does not need to send the corresponding unlocking tool software to the terminal user to unlock the SAM card, so the risk is avoided, and the double ciphertext verification of the backend server of the issuing bank and the SAM card is used to improve the security and reduce the workload of the unlocking tool software version management. The online unlocking method allows the issuing bank to build a real-time SAM card processing system on the backend server to solve problems such as remote locations and time differences. There is no need to replace a new SAM card, nor is there a need for the issuing bank to unlock the SAM card offline, so the terminal SAM card exception processing time and money costs are saved.

[0079] For the sake of illustration, a specific example is used to facilitate understanding of the overall process of the present invention. Figure 2 A step flow chart of a SAM card control system is provided for the first embodiment of the present invention, such as Figure 2 As shown, this step may include:

[0080] S201, in response to meeting the relative distance condition, establishing a near field communication connection with the NFC unit in the SAM card module to be controlled, and sending a read record command carrying the NFC tag application identifier to the SAM card module to be controlled;

[0081] S202, if there is an NFC tag application corresponding to the NFC tag application identifier in the read record command, the target responds with a status word SW-9000;

[0082] S203, determine whether the SAM card is locked through the SAM application, if yes, jump to step S208; if not, jump to step S204;

[0083] S204, the SAM application organizes the NDEF record, including setting the TYPE field to 'T', and placing the SAM card usage information in the PAYLOAD field;

[0084] S205, parsing the NDEF record and displaying the SAM card usage information on the screen;

[0085] S206. If there is no NFC tag application corresponding to the NFC tag application identifier in the read record command, respond with a status word SW-6A82;

[0086] S207, when the response status word is SW-6A82, disconnect the near field communication connection;

[0087] S208, the SAM application organizes the NDEF record, including setting the TYPE field to 'U', calculating the decrypted ciphertext based on the SAM card UID, and organizing the SAM card information such as the URI for accessing the backend server of the issuing bank into the PAYLOAD field;

[0088] S209, parsing the NDEF file, generating a decryption request, accessing the uniform resource identifier and sending the decryption request to the backend server of the issuing bank;

[0089] S210, verify whether the unlock request meets the unlock condition, if yes, jump to step S212 or S213; if no, jump to step S211;

[0090] S211, rejecting the unlocking request from the device terminal;

[0091] S212: When the preset target is a device terminal, generate an unlocking ciphertext in the form of an NDEF record and feed it back to the device terminal;

[0092] S213, when the preset target is another associated device, generating an unlocking ciphertext in the form of an unlocking command set and transmitting it to the other associated device;

[0093] S214, based on the preset NFC unit tag reading and writing software, copy the NDEF record in the unlocking ciphertext, generate an unlocking command and send it to the SAM card module to be controlled;

[0094] S215, receiving the unlock command through the NFC tag application and forwarding it to the SAM application through the SIO interface, verifying the SAM card unlocking ciphertext through the SAM application, and updating the authorization information when the verification is successful.

[0095] Embodiment 2

[0096] Figure 3 A flow chart of a SAM card control method is provided for the second embodiment of the present invention. This embodiment is applicable to the control of SAM cards. The method can be executed by a SAM card control system. The system includes: a SAM card module to be controlled, a device terminal and a backend server of the issuing bank. The SAM card module to be controlled includes a SAM card and an NFC unit.

[0097] like Figure 3 As shown, the method includes:

[0098] S310. In response to the relative distance condition being met, the device terminal establishes a near field communication connection with the NFC unit in the SAM card module to be controlled, and sends a read record command carrying the NFC tag application identifier to the SAM card module to be controlled.

[0099] S320: Determine the NFC data exchange format NDEF file according to the read record command through the SAM card module to be controlled and feed it back to the device terminal.

[0100] S330. Determine the operation type of the SAM card based on the NDEF file through the device terminal. When the operation type is an unlocking type, generate an unlocking request according to the NDEF file and send it to the backend server of the issuing bank.

[0101] S340. When the unlocking request is verified to meet the unlocking conditions through the backend server of the issuing bank, an unlocking ciphertext is generated in a preset manner and transmitted to a preset target, which includes a device terminal or other associated devices.

[0102] S350. When the unlocking ciphertext is received through the device terminal, an unlocking command is generated based on the preset NFC unit tag reading and writing software and the unlocking ciphertext and sent to the SAM card module to be controlled.

[0103] S360. The SAM card module to be controlled updates the authorization information of the SAM card according to the unlock command.

[0104] The technical solution of the embodiment of the present invention provides a system including: a SAM card module to be controlled, a device terminal and a backend server of the issuing bank, wherein the SAM card module to be controlled includes a SAM card and an NFC unit. In response to the relative distance condition being met, the device terminal establishes a near field communication connection with the NFC unit in the SAM card module to be controlled, and sends a read record command carrying an NFC tag application identifier to the SAM card module to be controlled; the SAM card module to be controlled determines the NFC data exchange format NDEF file according to the read record command and feeds it back to the device terminal; the device terminal determines the operation type of the SAM card based on the NDEF file, and when the operation type is the unlocking type, generates an unlock request according to the NDEF file and sends it to the backend server of the issuing bank; when the backend server of the issuing bank verifies that the unlocking request meets the unlocking condition, generates an unlocking ciphertext in a preset manner and transmits it to a preset target, which includes the device terminal or other associated devices; when the device terminal receives the unlocking ciphertext, it generates an unlocking command based on the preset NFC unit tag reading and writing software and the unlocking ciphertext and sends it to the SAM card module to be controlled; the SAM card module to be controlled updates the authorization information of the SAM card according to the unlocking command. The NFC unit establishes information transmission with the device terminal, and unlocks the device terminal in an online form. There is no need to replace the SAM card with a new one, nor is there a need for the issuing bank to unlock the SAM card offline, saving time and money in handling SAM card exceptions. The issuing bank does not need to send the corresponding unlocking tool software to the end user to unlock the SAM card, thus avoiding risks and reducing the workload of unlocking tool software version management.

[0105] The SAM card control system provided in the embodiment of the present invention can execute the SAM card control method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0106] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0107] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A SAM card control system, characterized in that: The system comprises: a SAM card module to be controlled, a device terminal and a backend server of the issuing bank, wherein the SAM card module to be controlled comprises a SAM card and an NFC unit; The device terminal is used to establish a near field communication connection with the NFC unit in the SAM card module to be controlled in response to meeting the relative distance condition, and send a read record command carrying the NFC tag application identifier to the SAM card module to be controlled; The SAM card module to be controlled is used to determine the NFC data exchange format NDEF file according to the read record command and feed it back to the device terminal; The device terminal is used to determine the operation type of the SAM card based on the NDEF file, and when the operation type is an unlocking type, generate an unlocking request according to the NDEF file and send it to the backend server of the issuing bank; The backend server of the issuing bank is used to generate an unlocking ciphertext in a preset manner and transmit it to a preset target when verifying that the unlocking request meets the unlocking condition. The preset target includes the device terminal or other associated devices. The device terminal is used to generate an unlock command based on the preset NFC unit tag reading and writing software and the unlock ciphertext when receiving the unlock ciphertext, and send the unlock command to the SAM card module to be controlled; The SAM card module to be controlled is used to update the authorization information of the SAM card according to the unlock command.

2. The system according to claim 1, characterized in that The SAM card module to be controlled also includes a super input and output chip SIO interface. Accordingly, according to the read record command, determining the NFC data exchange format NDEF file and feeding it back to the device terminal includes: The NFC unit receives the read record command through the NFC tag application, and forwards it to the SAM card based on the SIO interface; The SAM card determines the current state through the SAM application. If the current state is unlocked, the type field in the NDEF record is set to the first type, and the SAM card usage information is placed in the payload field of the NDEF record to obtain an organized NDEF file; If the current state is locked, the type field in the NDEF record is set to the second type, a decrypted ciphertext based on the unique number of the SAM card is calculated, and the decrypted ciphertext, the uniform resource identifier of the backend server of the issuing bank, and the SAM card information are placed in the payload field to obtain the NDEF file; The NDEF file is sent to the NFC tag application through the SIO interface, and the NDEF file is fed back to the device terminal through the NFC unit.

3. The system according to claim 1, characterized in that The determining the operation type of the SAM card based on the NDEF file includes: Extract the type field from the NDEF file; When the type field is the first type, determining that the operation type of the SAM card is an information display type; When the type field is the second type, it is determined that the operation type of the SAM card is an unlocking type.

4. The system according to claim 3, characterized in that The device terminal further includes: When the operation type is an information display type, the NDEF file is parsed to obtain SAM card usage information, and the SAM card usage information is displayed.

5. The system according to claim 1, characterized in that The step of generating an unlock request according to the NDEF file and sending the unlock request to the backend server of the issuing bank includes: Parsing the NDEF file to obtain the decrypted ciphertext, SAM card information and the uniform resource identifier of the backend server of the issuing bank; Generate a decryption request according to the decrypted ciphertext and the SAM card information; Access the uniform resource identifier and send the decryption request to the card issuer backend server.

6. The system according to claim 1, characterized in that The generating of the unlocking ciphertext in a preset manner and transmitting the unlocking ciphertext to a preset target includes: When the preset method is transmission to other associated devices, an unlocking ciphertext is generated in the form of an unlocking command set and transmitted to the other associated devices; When the preset method is transmission to the device terminal, the unlocking ciphertext is generated according to the response NDEF record and transmitted to the device terminal.

7. The system according to claim 1, characterized in that The system further comprises: When the preset target is the other associated device, the unlock command in the form of an application protocol data unit APDU is generated by the other associated device based on the unlock command set in the unlock ciphertext, and is sent one by one to the SAM card module to be controlled.

8. The system according to claim 1, characterized in that The SAM card module to be controlled is also used for: When the read record command is received, a target response status word is generated by the NFC tag application of the NFC unit and fed back to the device terminal.

9. The system according to claim 8, characterized in that The device terminal is also used for: A response status word is received, and when the response status word is not the target response status word, the near field communication connection is disconnected.

10. A SAM card control method, characterized in that: The method is applied to a SAM card control system as described in any one of claims 1 to 9, the system comprising: a SAM card module to be controlled, a device terminal and a backend server of an issuing bank, the SAM card module to be controlled comprises a SAM card and an NFC unit, and the method comprises: In response to the relative distance condition being met, the device terminal establishes a near field communication connection with the NFC unit in the SAM card module to be controlled, and sends a read record command carrying the NFC tag application identifier to the SAM card module to be controlled; Determine the NFC data exchange format NDEF file through the SAM card module to be controlled according to the read record command and feed it back to the device terminal; Determine the operation type of the SAM card based on the NDEF file by the device terminal, and when the operation type is an unlocking type, generate an unlocking request according to the NDEF file and send it to the backend server of the issuing bank; When the unlock request satisfies the unlock condition through the backend server of the issuing bank, an unlock ciphertext is generated in a preset manner and transmitted to a preset target, which includes the device terminal or other associated devices; When the unlocking ciphertext is received by the device terminal, an unlocking command is generated based on the preset NFC unit tag reading and writing software and the unlocking ciphertext and sent to the SAM card module to be controlled; The authorization information of the SAM card is updated according to the unlock command by the SAM card module to be controlled.

Images