Method and apparatus for realizing smart card extension

Abstract

A method for realizing smart card extension, which method is applicable to a terminal device based on iOS or iPadOS. The terminal device includes a host application and an extension reliant on the host application. After the terminal device establishes a connection with a smart card device, the host application registers a device certificate in the smart card device into a token configuration; when the extension is called by a third-party application, a smart card token is initialized by using the token configuration; when a PIN authentication interface in the extension is called by the third-party application, the extension enumerates certificate object identifiers and key object identifiers in the smart card token and prompts a user to perform selection; when user selection information has been received, a PIN is sent to the smart card device for verification; and when a signature interface in the extension is called by the third-party application, if the extension determines that the PIN has successfully passed verification, data to be signed that is in the signature interface is sent to the smart card device for signing. The present invention can expand the application range of a smart card device without the need to change the smart card device, and thus has good compatibility and is convenient to use.

Description

A METHOD AND APPARATUS FOR REALIZING SMART CARD EXTENSION Technical Field Background

[0002] With the rapid rise of Apple Inc., the iPhone smart phone has won the favor of many users with its excellent performance and high-quality industrial design. Apple smart phones are equipped with the iOS operating system developed by Apple Inc. In existing technology, smart card functions (such as SSL (Secure Sockets Layer) mutual authentication services and PDF file signing) cannot be used on iOS devices or iPadOS devices, and therefore a method capable of solving the above problem is needed. Invention Content

[0003] The objective of the present invention is to provide a method and apparatus for realizing smart card extension, by combining an extension and a host application to expand the application range of a smart card device on iOS devices or iPadOS devices, without any modification to the smart card device, thereby achieving better compatibility and greater convenience.

[0004] According to a first aspect of the present invention, a method for realizing smart card extension is provided, applicable to a terminal device based on an iOS system or iPadOS system. The terminal device comprises a host application and an extension reliant on the host application, after the terminal device establishes a connection with the smart card device, the method comprises:

[0005] Step S1, the host application selects a smart card application from the smart card device, reads a device object from the smart card device with a preset filter condition, and performs a hash calculation on a device certificate in the device object to obtain a certificate hash value;

[0006] Step S2, the host application acquires device configuration information, determines whether the certificate hash value is present in a configured token configuration in the device configuration information, reports an error if yes, and otherwise writes the certificate hash value into the token configuration, and executes Step S3;

[0007] Step S3, the host application creates a certificate template, stores data in the device certificate into the certificate template to obtain a new device certificate, and determines whether the new device certificate is valid, and executes Step S4 if yes, and otherwise reports an error;

[0008] Step S4, the host application generates a certificate object and a key object according to the new device certificate, creates corresponding certificate object identifiers and key object identifiers, and writes the certificate object identifiers, the certificate objects, the key object identifiers, and the key objects into the token configuration;

[0009] Step S5, when the extension program is called by a third-party application, the extension program acquires imported token configuration parameters, acquires a corresponding token configuration based on the token configuration parameters, and initializes a created smart card token based on the token configuration;

[0010] Step S6, when a PIN (Personal Identification Number) authentication interface of the extension program is called by the third-party application, the extension program enumerates certificate object identifiers and key object identifiers in the smart card token and prompts a user to perform selection, when the certificate object identifier and the key object identifier selected by the user have been received, the extension program prompts the user to input a PIN, and sends the received PIN to the smart card device for verification;

[0011] Step S7, when a signing interface of the extension program is called by the third-party application, the extension program determines whether the PIN has successfully passed verification, if yes, a signing algorithm is determined, a signing instruction is generated based on the certificate object identifier and the corresponding certificate object selected by the user, the key object identifier and the corresponding key object selected by the user, the signing algorithm, and data to be signed in the signing interface parameters, and the signing instruction is sent to the smart card device, otherwise, an error is reported; and

[0012] Step S8, when signing data returned by the smart card device is received, the extension program returns the signing data to the third-party application.

[0013] According to a second aspect of the present invention, an apparatus for realizing smart card extension is provided, disposed in a terminal device based on an iOS system or iPadOS system, the apparatus comprising a host application module and an extension module reliant on the host application module, the host application module comprising: a reading and computing unit, an acquiring and determining unit, a creating and determining unit, and a generating and writing unit; the extension program module comprising: an enumerating and acquiring unit, a first receiving and sending unit, a determining and confirming unit, a first generating and sending unit, and a second receiving and sending unit;

[0014] The reading and computing unit, configured to select a smart card application in the smart card device after the terminal device establishes a connection with the smart card device, read a device object from the smart card device with a preset filter condition, and perform a hash calculation on a device certificate in the device object to obtain a certificate hash value;

[0015] The acquiring and determining unit, configured to acquire device configuration information, determine whether the certificate hash value is present in a configured token configuration in the device configuration information, report an error if yes, and otherwise write the certificate hash value into the token configuration, and trigger the creating and determining unit;

[0016] The creating and determining unit, configured to create a certificate template, store data in the device certificate into the certificate template to obtain a new device certificate, determine whether the new device certificate is valid, and trigger the generating and writing unit if yes; otherwise, report an error;

[0017] The generating and writing unit, configured to generate a certificate object and a key object according to the new device certificate, create corresponding certificate object identifiers and key object identifiers, and write the certificate object identifiers, the certificate objects, the key object identifiers, and the key objects into the token configuration;

[0018] The enumerating and acquiring unit, configured to acquire imported token configuration parameters when the extension program module is called by a third-party application, acquire a corresponding token configuration based on the token configuration parameters, and initialize a created smart card token based on the token configuration;

[0019] The first receiving and sending unit, configured to enumerate certificate object identifiers and key object identifiers in the smart card token and prompt a user to perform selection when a PIN authentication interface in the extension program module is called by the third-party application, when receiving the certificate object identifier and the key object identifier selected by the user, prompt the user to input a PIN, and send the received PIN to the smart card device for verification;

[0020] The determining and confirming unit, configured to determine whether the PIN has successfully passed verification when a signing interface in the extension program module is called by the third-party application, if yes, confirm a signing algorithm, otherwise, report an error;

[0021] The first generating and sending unit, configured to generate a signing instruction based on the certificate object identifier and the corresponding certificate object selected by the user, the key object identifier and the corresponding key object selected by the user, the signing algorithm, and data to be signed in the signing interface parameters, and send the signing instruction to the smart card device;

[0022] The second receiving and sending unit, configured to receive the signing data returned by the smart card device and return the signing data to the third-party application.

[0023] According to a third aspect of the present invention, the present invention provides an electronic device, the electronic device comprises at least one processor, a storage, and instructions stored in the storage and executable by at least one processor, the processor executes the instructions to implement the method for realizing smart card extension described above.

[0024] According to a fourth aspect of the present invention, the present invention provides a computer-readable storage medium, the computer-readable storage medium comprises a computer program, when the computer program runs on an electronic device, the electronic device executes the method for realizing smart card extension described above.

[0025] According to a fifth aspect of the present invention, the present invention provides a chip system, the chip system comprises a chip, the chip is coupled to a storage and is used to execute a computer program stored in the storage, to execute the method for realizing smart card extension described above.

[0026] According to the present invention, an extension and a host application are combined to expand the application range of smart card devices [such as smart card (can be combined with a card reader) and KEY] on iOS devices or iPadOS devices, without any modification to the smart card devices, thereby achieving better compatibility and greater convenience. Drawing Description

[0027] Figure 1 is a flowchart of a method for realizing smart card extension according to Embodiment 1 of the present invention;

[0028] Figure 2 is a flowchart of a method for realizing smart card extension according to Embodiment 2 of the present invention;

[0029] Figure 3 is a flowchart of a method for realizing smart card extension according to Embodiment 3 of the present invention. Specific Embodiment Methods

[0030] In order to make the objectives, technical solutions, and advantages of the present invention clearer, the embodiments of the present invention are described in detail below with reference to the drawings. Embodiment 1

[0031] Embodiment 1 of the present invention provides a method for realizing smart card extension, as shown in Figure 1, the method comprises:

[0032] Step S1, the host application selects a smart card application in the smart card device, reads a device object from the smart card device with a preset filter condition, and performs a hash calculation on a device certificate in the device object to obtain a certificate hash value;

[0033] Specifically, in Embodiment 1, reading the device object from the smart card device with a preset filter condition comprises: the host application retaining the context object of the smart card application, acquiring a card slot array through the context object, traversing the card slot array, reading a device name from the card slot array, and reading the device object from the smart card device through the device name.

[0034] Acquiring the card slot array through the context object comprises acquiring the card slot array through the context object and a first interface.

[0035] Reading the device object from the smart card device through the device name comprises obtaining the device object through a second interface and the device name.

[0036] Performing a hash calculation on the device certificate in the device object to obtain the certificate hash value comprises reading the device certificate in the device object through a fifth interface, and performing a hash calculation on the device certificate according to a preset algorithm to obtain the certificate hash value;

[0037] Step S2, the host application acquires device configuration information, determines whether the certificate hash value is present in a configured token configuration in the device configuration information, reports an error if yes, and otherwise writes the certificate hash value into the token configuration, and executes Step S3;

[0038] Specifically, in Embodiment 1, Step S2 comprises:

[0039] Step B1, the host application acquires device configuration information, acquires a driver configuration type object from the device configuration information according to a preset extension interface file identifier, acquires token driver configuration data, keychain token data, and system token driver configuration context from the driver configuration type object;

[0040] Step B2, the host application acquires a token configuration with a preset name as a key value from a dictionary object in the system token driver configuration context;

[0041] Step B3, the host application determines whether the certificate hash value is present in the token configuration; if yes, an error is reported, otherwise, the certificate hash value, the token driver configuration data, and the keychain token data are stored into the token configuration, and Step S3 is executed;

[0042] Step S3, the host application creates a certificate template, stores data in the device certificate into the certificate template to obtain a new device certificate, determines whether the new device certificate is valid, and executes Step S4 if yes, and otherwise reports an error;

[0043] Step S4, the host application generates a certificate object and a key object according to the new device certificate, creates corresponding certificate object identifiers and key object identifiers, and writes the certificate object identifiers, the certificate objects, the key object identifiers, and the key objects into the token configuration;

[0044] Specifically, in Embodiment 1, Step S4 comprises:

[0045] Step C1, the host application generates a certificate object according to the new device certificate, generates a key object according to a key in the device certificate, and creates corresponding certificate object identifiers and key object identifiers, sets the key to be signable, decryptable, and login-enabled;

[0046] Step C2, the host application uses the certificate object identifier, the certificate object, the key object identifier, and the key object as keychain items to create a token configuration with the certificate hash value as the key value and the keychain items as the name;

[0047] Step C3, the host application adds the token configuration to the dictionary object;

[0048] Step S5, when the extension program is called by a third-party application, the extension program acquires imported token configuration parameters; acquires a corresponding token configuration based on the token configuration parameters, initializes a created smart card token based on the token configuration; in the present Embodiment 1, the extension program provides one interface, the third-party application invokes the extension program through the interface;

[0049] Step S6, when a PIN authentication interface of the extension program is called by the third-party application, the extension program enumerates certificate object identifiers and key object identifiers in the smart card token and prompts a user to perform selection, when the certificate object identifier and the key object identifier selected by the user have been received, the user is prompted to input a PIN, the received PIN is sent to the smart card device for verification;

[0050] Step S7, when a signing interface of the extension program is called by the third-party application, the extension program determines whether the PIN has successfully passed verification, if yes, a signing algorithm is determined, a signing instruction is generated based on the certificate object identifier and the corresponding certificate object selected by the user, the key object identifier and the corresponding key object selected by the user, the signing algorithm, and data to be signed in the signing interface parameters, and the signing instruction is sent to the smart card device, otherwise, an error is reported;

[0051] Step S8, when signing data returned by the smart card device is received, the extension program returns the signing data to the third-party application.

[0052] Preferably, in Embodiment 1, Step S5 to Step S8 have different implementations, for example, when the third-party application is a browser, implementation 1 is:

[0053] Step S5 comprises:

[0054] Step S5-1, when the extension program is called by the browser, the extension program enumerates a corresponding extension program interface according to a preset interface identifier, acquires token configuration parameters from the extension program application interface, acquires a corresponding token configuration based on the token configuration parameters, and initializes a created smart card token based on the token configuration;

[0055] Step S5-2, the extension program creates a token session based on the smart card token, initializes the token session, and binds the token session to the smart card token.

[0056] Correspondingly, Step S6 comprises:

[0057] Step S6-1, when a PIN authentication interface of the extension program is called by the browser, the extension program enumerates certificate object identifiers and key object identifiers in the smart card token and prompts a user to perform selection, when the certificate object identifier and the key object identifier selected by the user have been received, a PIN input box is popped up through the browser to prompt the user to input a PIN;

[0058] Step S6-2, when the extension program receives the PIN input by the user, the PIN is sent to the corresponding smart card device through the Lighting communication method;

[0059] Step S6-3, the extension program receives the PIN verification result returned by the smart card device and returns the result to the browser, the PIN verification result comprises a PIN verification success result or a PIN verification failure result.

[0060] Correspondingly, Step S7 comprises:

[0061] Step S7-1, when a signing interface of the extension program is called by the browser, the extension program determines whether the PIN has successfully passed verification, if yes, Step S7-2 is executed, otherwise, an error is reported;

[0062] Step S7-2, the extension program negotiates a signing algorithm with the token session;

[0063] Step S7-3, the extension program separately acquires the certificate object and the key object corresponding to the certificate object identifier and the key object identifier selected by the user from the smart card token, generates a signing instruction based on the certificate object identifier, the certificate object, the key object identifier, the key object, the signing algorithm, and data to be signed in the signing interface parameters, and sends the signing instruction to the smart card device through the Lighting communication method.

[0064] Preferably, Steps S5 to S8 have Implementation 2:

[0065] Before Step S1, further comprising: the extension program registers a notification, and the host application establishes a notification listener and creates an application group;

[0066] Step S5 comprises:

[0067] Step S51, when the extension program is called by the browser, the extension program enumerates a corresponding extension program interface according to a preset interface identifier, acquires token configuration parameters from the extension program application interface, acquires a corresponding token configuration based on the token configuration parameters, and initializes a created smart card token based on the token configuration;

[0068] Step S52, the extension program creates a token session based on the smart card token, initializes the token session, and binds the token session to the smart card token.

[0069] Correspondingly, Step S6 comprises:

[0070] Step S61, when a PIN authentication interface of the extension program is called by the browser, the extension program enumerates certificate object identifiers and key object identifiers in the smart card token and prompts a user to perform selection, when the certificate object identifier and the key object identifier selected by the user have been received, a PIN input box is popped up through the browser to prompt the user to input a PIN;

[0071] Step S62, the extension program sends the received PIN to the host application through a notification method, blocking and waiting for the host application to return data;

[0072] Step S63, the host application generates a PIN verification instruction according to the PIN code, and sends the PIN verification instruction to the smart card device;

[0073] Step S64, the host application receives the PIN verification result returned by the smart card device and stores the result in an application group, and sends a broadcast;

[0074] Step S65, when the extension program receives the broadcast and monitors a change in the data stored in the application group, the extension program returns the PIN verification result in the application group to the browse; in the present Embodiment 1, the PIN verification result comprises a PIN verification success result or a PIN verification failure result.

[0075] Correspondingly, Step S7 comprises:

[0076] Step S71, when a signing interface of the extension program is called by the browser, the extension program determines whether the PIN has successfully passed verification, if yes, Step S72 is executed, otherwise, an error is reported;

[0077] Step S72, the extension program negotiates a signing algorithm with the token session;

[0078] Step S73, the extension program separately acquires the certificate object and the key object corresponding to the certificate object identifier and the key object identifier selected by the user from the smart card token, the data to be signed is encapsulated to obtain a encapsulated result based on the certificate object identifier, the certificate object, the key object identifier, the key object, the signing algorithm, and data to be signed in the signing interface parameters, the encapsulated result is sent to the host application through a notification method, blocking and waiting for the host application to return data;

[0079] Step S74, when the host application monitors the encapsulated result, the host application parses the encapsulated result a signing instruction is generated based on the parsed certificate object identifier, certificate object, key object identifier, key object, signing algorithm, and data to be signed, the signing instruction is sent to the smart card device;

[0080] Specifically, the signing instruction is sent to the smart card device through communication methods such as USB / BLE / NFC / Lighting;

[0081] Correspondingly, Step S8 comprises:

[0082] Step S81, the host application stores the signing result returned by the smart card device into the application group and sends a broadcast; in the present Embodiment 1, the signing result comprises a signing failure message or signing data;

[0083] Step S82, when the extension program receives the broadcast and monitors a change in the data stored in the application group, the extension program determines whether the application group contains signing data, if yes, Step S83 is executed, otherwise, an error is reported;

[0084] Step S83, the extension program acquires the signing data from the application group and returns the signing data to the browser.

[0085] In summary, the present invention combines an extension and a host application to expand the application range of smart card devices [such as smart card (can be combined with a card reader) and KEY] on iOS devices or iPadOS devices, without any modification to the smart card devices, thereby achieving better compatibility and greater convenience. Embodiment 2

[0086] Embodiment 2 of the present invention provides a method for realizing smart card extension, applicable to terminal devices based on iOS system and iPadOS system, the terminal device comprises a host application and an extension, the extension program operates relying on the host application, embodiment 2 specifically uses SSL (Secure Sockets Layer) login operation through a smart card device as an example for description, as shown in Figure 2, the method comprises:

[087] Step 201, when the host application detects a smart card device connected to the terminal device, a smart card application is selected, and a context object is retained;

[8800] The host application In the present Embodiment 2 is used to store the certificate object and key object of the device certificate to the corresponding smart card token, for the extension program to invoke the certificate object and key object;

[0089] Step 202, the host application acquires a card slot array through a context object;

[0090] Specifically, In the present Embodiment 2, the card slot array is acquired through the context object and a first interface;

[0091] For example, the first interface is: TKSmartCardSlotManager * manager = [TKSmartCardSlotManager defaultManager];

[0092] Step 203, the host application traverses the card slot array, reads the device name from the card slot array, and reads the device object from the smart card device through the device name;

[0093] Specifically, In the present Embodiment 2, the device object with the name read is acquired through a second interface;

[0094] For example, the second interface is: TKSmartCard *m TKsc = [[manager slotnamed:"device name"] makeSmartCard];

[0095] Or, the device object is read from the smart card device through a fourth interface based on the first device name in the card slot array;

[0096] For example, the fourth interface is: TKSmartCard *m TKsc=[[manager slotnamed:manager.slotNames.firstObject] makeSmartCard]; wherein manager.slotNames is the card slot array;

[0097] Step 204, the host application performs a hash calculation on the device certificate in the device object to obtain a certificate hash value;

[0098] Specifically, In the present Embodiment 2, the device certificate in the device object is read through a fifth interface, and a sha256 algorithm is used to perform a hash calculation on the device certificate to obtain the certificate hash value (certSHA256Value);

[0099] For example, the fifth interface is: [m_TKsc transmitRequest: read certificate APDU (Application Protocol Data Unit) reply: \(\(\text{NData*}\) certData, \(\text{NSError*}\) error\\{\}\], wherein certData is the device certificate;

[0100] Step 205, the host application acquires device configuration information, enumerates a configured token configuration in the device configuration information, and determines whether the certificate hash value is present in the token configuration; if yes, an error is reported, otherwise, Step 206 is executed;

[0101] In the present Embodiment 2, enumerating the configured token configuration in the device configuration information comprises:

[0102] Step B1, the token driver configuration type object (TKTokenDriverConfiguration class) is acquired from the device configuration information (TKTokenDriverConfiguration class) according to the preset extension interface file identifier (com.apple.ctk.class-id), and the token driver configuration data, keychain token data, and the system token driver configuration context are acquired from the driver configuration type object;

[0103] In the present Embodiment 2, an object storing certificate hash values is stored in the driver configuration (TKTokenDriverConfiguration) type object;

[0104] Specifically, the host application acquires the system token driver configuration context through NSDictionary *driverConfigDict=[TKTokenDriverConfiguration driverConfigurations];

[0105] Step B2, the host application acquires a token configuration with a preset name as a key value from a dictionary object in a system token driver configuration context;

[0106] In the present Embodiment 2, the preset name is com.ftsafe.SCManager.ProviderToken;

[0107] Wherein the dictionary object is a two-dimensional array, the first column is key and the second column is item, the item column can hold various types of variables;

[0108] Step 206, the host application stores the certificate hash value, the token driver configuration data, and the keychain token data into the token configuration;

[0109] Step 207, the host application creates a certificate template, stores data in the device certificate into the certificate template to obtain a new device certificate, determines whether the new device certificate is valid, if yes, a certificate object is generated according to the new device certificate, a key object is generated according to a key in the new device certificate, and corresponding certificate object identifiers and key object identifiers are created, the certificate object identifiers and the corresponding certificate objects, the key object identifiers, and the corresponding key objects are written into the token configuration, and Step 208 is executed, otherwise, an error is reported;

[0110] In the present Embodiment 2, Step 207 of generating the certificate object according to the new device certificate, generating the key object according to a key in the new device certificate, and creating corresponding certificate object identifiers and key object identifiers, and writing the certificate object identifiers, the certificate objects, the key object identifiers, the key objects, and the certificate hash value into the token configuration comprises:

[0111] Step 207-1, generating the certificate object according to the new device certificate, generating the key object according to a key in the new device certificate, and creating the certificate object identifiers and the key object identifiers;

[0112] Step 207-2, setting the key to be signable, decryptable, and login-enabled;

[0113] Step 207-3, using the certificate object identifiers, the certificate objects, the key object identifiers, and the key objects as keychain items;

[0114] Step 207-4, creating a token configuration with the certificate hash value as the key value and the keychain items as the name;

[0115] Step 207-5, adding the token configuration to the dictionary object;

[0116] Step 208, when the extension program is called by the browser, the extension program acquires imported token configuration parameters, acquires a corresponding token configuration based on the token configuration parameters, initializes a created smart card token based on the token configuration, creates a token session based on the smart card token, initializes the token session, and binds the token session to the smart card token;

[0117] In the present Embodiment 2, the extension program is encapsulated as an interface, the browser invokes the extension program application interface through the token configuration parameters to invoke the extension program;

[0118] The host application In the present Embodiment 2 is used to register the certificate object and key object of the smart card device into the token configuration, In the present Embodiment 2, the browser invokes the extension program application interface, acquires the certificate object and communicates with the smart card device through Lighting and other communication methods through access to the token configuration, uses the smart card device to invoke the interface in the extension program to complete PIN verification, signing, or decryption operations;

[0119] In the present Embodiment 2, the extension program is loaded by the system after installation, when the host application invokes smart card-related services, the corresponding extension is invoked, for example, when the browser supports SSL login, the browser invokes the corresponding extension to perform SSL login operations when the user triggers SSL login;

[0120] Step 209, when a PIN authentication interface in the extension program is called by the browser, the extension program enumerates certificate object identifiers and key object identifiers in the smart card token, presents them to the user for selection, when the certificate object identifier and the key object identifier selected by the user have been received, a PIN input box is popped up through the browser to prompt the user to input a PIN;

[0121] Step 210, the extension program sends the received PIN to the corresponding smart card device through the Lighting communication method, and executes Step 211;

[0122] Step 211, the smart card device verifies the received PIN, if verification succeeds, the PIN verification result is set to success and returned to the extension program, if verification fails, the PIN verification result is set to failure and returned to the extension program;

[0123] Step 212, the extension program returns the received PIN verification result to the browser;

[0124] Step 213, when a signing interface in the extension program is called by the browser, the extension program determines whether the PIN has successfully passed verification based on the PIN verification result, if yes, Step 214 is executed, otherwise, an error is reported;

[0125] Preferably, when the determination in Step 213 is negative, the following is also included: the extension program pops up a PIN input box through the browser to prompt the user to input a PIN, the extension program sends the received PIN to the corresponding smart card device through the Lighting communication method, if the smart card device returns a successful PIN verification result, Step 214 is executed;

[0126] Specifically, determining whether the PIN has successfully passed verification based on the PIN verification result comprises: determining whether the PIN verification result of the extension program is successful, if yes, the PIN has been successfully verified, otherwise, the PIN has not been successfully verified;

[0127] Step 214, the extension program negotiates a signing algorithm with the token session, and separately acquires the certificate object and the key object in the smart card token corresponding to the certificate object identifier and the key object identifier selected by user, a signing instruction is generated based on a certificate object identifier, a certificate object, a key object identifier, a key object, signing algorithm, and data to be signed in signing interface parameters, the signing instruction is sent to the smart card device through the Lighting communication method;

[0128] In the present Embodiment 2, before Step 214 acquires the certificate object and the key object in the smart card token corresponding to a certificate object identifier and a key object identifier selected by user, the following is also included: the extension program determines whether a key object identifier selected by user is valid, if yes, the certificate object and the key object in the smart card token are acquired based on the certificate object identifier and the key object identifier selected by user, otherwise, an error is reported;

[0129] Specifically, determining whether the key object identifier is valid comprises: determining whether the key object identifier selected by user matches a set key object identifier, if yes, the key object identifier is valid, otherwise, the key object is not valid;

[0130] Preferably, In the present Embodiment 2, the data to be signed can be raw data to be signed (binary data) or hash value of the raw data to be signed;

[0131] Step 215, the smart card device receives a signing instruction, parses the certificate object identifier, the certificate object, the key object identifier, the key object, the signing algorithm, and the data to be signed, determines whether the key object identifier is valid, if yes, Step 216 is executed, otherwise, a signing failure message is returned to the extension program, and Step 217 is executed;

[0132] Specifically, determining whether the key object identifier is valid comprises: determining whether the received key object identifier matches the key object identifier in the smart card device, if yes, the key object identifier is valid, otherwise, the key object identifier is not valid;

[0133] Step 216, the smart card device determines a signing private key based on the certificate object, the key object, the key object identifier, and the certificate object identifier, uses the signing private key to sign the data to be signed according to the signing algorithm to obtain signing data, returns the signing data to the extension program, and executes Step 217;

[0134] Specifically, In the present Embodiment 2, Step 216 comprises: the smart card device signs the received data to be signed, forms APDU information data from the signing data, returns the APDU information data to the extension program, and executes Step 217;

[0135] For example, the smart card device sends the dataToSign to form APDU information data and returns the APDU information data to the extension program in the following sending method: [m TKsc2 transmitRequest: APDU data reply:^(NSData *response,NSError *error){}];

[0136] Step 217, the extension program determines whether the data returned by the smart card device is signing data, if yes, the signing data is returned to the browser, otherwise, an error is reported;

[0137] Preferably, the error in this Step can prompt a login failure. Embodiment 3

[0138] Embodiment 3 of the present invention provides a method for realizing smart card extension on iOS, applicable to terminal devices based on iOS system and iPadOS system, the terminal device comprises a host application and an extension, the extension program operates relying on the host application, Embodiment 3 specifically uses SSL login operation through a smart card device as an example for description, as shown in Figure 3, the method comprises:

[0139] Step 300, the extension program registers a notification, and the host application establishes a notification listener and creates an application group;

[0140] Before Step 300, the user adds the host application and the extension program to the same Apple Group, and the application group is initialized through the Apple Group name;

[0141] In the present Embodiment 3, the application group (NSUserDefault) is used to store data, both the host application and the extension program can access data in the application group;

[0142] The host application in the present Embodiment 3 is used to store the certificate object and the key object of the device certificate to the corresponding smart card token, for the extension program to invoke the certificate object and the key object, the host application is also responsible for communication with the smart card device, and completes decryption and signing verification operations together with the smart card device;

[0143] Step 301, when the host application detects a smart card device connected to the terminal device, a smart card application is selected, a context object is retained, and the card slot array is acquired through the context object;

[0144] Specifically, in the present Embodiment 3, selecting a corresponding application is: the host application sends a select application instruction to the smart card, the smart card processes the select application instruction and selects the application corresponding to the select application instruction, and then returns a selection success message to the host application;

[0145] For example, the instruction of the application is in APDU format, specifically 00A40400 0BA0 00 00 03 08 00 00 10 00 01 00, wherein 00A40400 is the instruction header, 0B is the data field length (the application identifier length), and A0 00 00 03 08 00 00 10 00 01 00 is the data in the data field (the application identifier);

[0146] Step 302, the host application traverses a card slot array, reads the device name from the card slot array, and reads the device object from the smart card device through the device name;

[0147] Step 303, the host application performs a hash calculation on the device certificate in the device object to obtain a certificate hash value, acquires device configuration information, and enumerates the configured token configurations in the device configuration information;

[0148] Specifically, in the present Embodiment 3, the process of enumerating the configured token configurations in the device configuration information is the same as In the present Embodiment 2 and will not be repeated here;

[0149] Step 304, the host application determines whether the certificate hash value is present in a token configuration, if yes, an error is reported, otherwise, Step 305 is executed;

[0150] Step 305, the host application stores the certificate hash value, the token driver configuration data, and the keychain token data into the token configuration;

[0151] Preferably, in Step 305, the host application combines the token driver configuration data and the keychain token data into a key item list and stores the list into the token configuration, for example, In the present Embodiment 3, the key item list is keychainItems, and the token configuration is TKTokenConfiguration;

[0152] Step 306, the host application creates a certificate template, stores data in the device certificate into the certificate template to obtain a new device certificate, determines whether the new device certificate is valid, if yes, executes Step 307, otherwise, an error is reported;

[0153] Step 307, the host application generates the certificate object according to the new device certificate, generates the key object according to a key in the new device certificate, and creates corresponding certificate object identifiers and key object identifiers, writes the certificate object identifiers and the corresponding certificate objects, the key object identifiers, and the corresponding key objects into the token configuration, and executes Step 308;

[0154] Specifically, in the present Embodiment 3, writing the certificate object identifiers, the certificate objects, the key object identifiers, the key objects, and the certificate hash value into the token configuration comprises: the host application assembles the certificate object identifiers, the certificate objects, the key object identifiers, and the key objects into a token key item list (TKTokenKeychainItem), encapsulates the token key item list into a token configuration, and uses the certificate hash value to set the corresponding token key item list key value, so the corresponding device private key and device certificate can be found through the key value when signing;

[0155] Step 308, when the extension program is called by the browser, the extension program acquires imported token configuration parameters, acquires a corresponding token configuration based on the token configuration parameters, initializes a created smart card token based on the token configuration, creates a token session based on the smart card token, initializes a token session, and binds the token session to the smart card token;

[0156] In the present Embodiment 3, the extension program is encapsulated as an interface for invocation by the browser; <semantics>⌈0157⌉<annotation encoding="application / x-tex">\lceil 0157 \rceil< / annotation>< / semantics> In the present Embodiment 3, the extension program is loaded by the system after installation, when the host application invokes smart card-related services, the corresponding extension is invoked, for example, the browser supports SSL login, the browser invokes the corresponding extension to perform SSL login operations when the user triggers SSL login;

[0158] The extension program in the present Embodiment 3 serves as a communication bridge between the host application and the browser;

[0159] Step 309, when a PIN authentication interface in the extension program is called by the browser, the extension program enumerates certificate object identifiers and key object identifiers in the smart card token, and prompts the user to perform selection;

[0160] Step 310, when the extension program receives a certificate object identifier and a key object identifier selected by user, a PIN input box is popped up through the browser to prompt the user to input a PIN, the received PIN is sent to the host application through a notification method;

[0161] In the present Embodiment 3, after Step 310, the following is also included: the extension program cyclically monitors whether data in the application group is returned;

[0162] Step 311, the host application generates a PIN verification instruction based on the PIN, and sends the PIN verification instruction to the smart card device;

[0163] In the present Embodiment 3, the host application supports sending the PIN verification instruction to the smart card device through the following communication methods: NFC, BLE, USB, Lighting;

[0164] Step 312, the smart card device verifies the PIN in the received PIN verification instruction, if verification succeeds, the host application sets the PIN verification result to success, stores the success PIN verification result in the application group, and sends a broadcast, if verification fails, the PIN verification result is set to failure and returned to the host application, and the host application stores the PIN verification failure result in the application group and sends a broadcast, and Step 313 is executed;

[0165] In the present Embodiment 3, after the application group (NSUserDefaults) caches data, the cached data is periodically written into a disk to prevent data loss caused by the program exiting after successful writing of the data into NSUserDefaults, after the data is successfully written into NSUserDefaults, synchronize can be used to forcibly and immediately write the data into the disk;

[0166] Step 313, when the extension program receives the broadcast and monitors a change in the data stored in the application group, the extension program returns the PIN verification result in the application group to the browser;

[0167] Step 314, when a signing interface in the extension program is called by the browser, the extension program determines whether the PIN has successfully passed verification based on the PIN verification result, if yes, Step 315 is executed, otherwise, an error is reported;

[0168] Preferably, in the present Embodiment 3, when the determination in Step 314 is negative, the following is also included:

[0169] Step T, the extension program pops up a PIN input box again through the browser and sends the received PIN to the host application through a notification method, the host application generates a PIN verification instruction based on the PIN, and sends the PIN verification instruction to the smart card device, the smart card device verifies the PIN in the received PIN verification instruction, if verification succeeds, the PIN verification result is set to success and returned to the host application, and the host application stores the PIN verification result success in the application group and sends a broadcast, if verification fails, the PIN verification result is set to failure and returned to the host application, and the host application stores the PIN verification result failure in the application group and sends a broadcast; when the extension program receives the broadcast and monitors a change in the data stored in the application group, if the data stored in the application group is a PIN verification success, Step 315 is executed;

[0170] Preferably, when the verification is determined to have failed, the following is also included: the extension program determines whether the number of verification failures has reached a preset value, if yes, an error is reported, and the process ends, otherwise, Step T is executed;

[0171] Preferably, Step 313 also comprises: when the extension program detects a broadcast, the data in the application group is retained and the application group is cleared;

[0172] Step 315, the extension program negotiates a signing algorithm with the token session, based on the certificate object identifier and the key object identifier selected by the user, the certificate object and the key object in the smart card token corresponding to the certificate object identifier and the key object identifier are separately acquired, the data to be signed is encapsulated to obtain a encapsulated result based on the certificate object identifier, the certificate object, the key object identifier, the key object, the signing algorithm, and data to be signed in the signing interface parameters, the encapsulated result is sent to the host application through a notification method, blocking and waiting for the host application to return data;

[0173] In the present Embodiment 3, after Step 315 and before generating the encapsulated result from the certificate object identifier, the certificate object, the key object identifier, the key object, the signing algorithm, and data to be signed in the signing interface parameters, the following is also included: the extension program determines whether the format of the data to be signed in the signing interface parameters meets browser requirements, if yes, the process continues, otherwise, an error is reported;

[0174] In the present Embodiment 3, after Step 315, the extension program also cyclically monitors whether data in the application group is returned;

[0175] Step 316, when the host application monitors the encapsulated result, the host application parses the encapsulated result, a signing instruction is generated based on the parsed certificate object identifier, certificate object, key object identifier, key object, signing algorithm, and data to be signed, the signing instruction is sent to the smart card device;

[0176] In the present Embodiment 3, sending the signing instruction to the smart card device comprises: sending the signing instruction to the smart card device through communication methods such as USB / BLE / NFC / Lighting;

[0177] Step 317, the smart card device parses the signing instruction to obtain the certificate object, the key object, the certificate object identifier, the key object identifier, the signing algorithm, and the data to be signed, determines whether the key object identifier is valid, if yes, the key object, the key object identifier, and the certificate object identifier, a signing private key is determined based on the certificate object, the signing private key is used to sign the data to be signed according to the signing algorithm to obtain signing data, the signing data is returned to the host application, and Step 318 is executed, otherwise, the extension program returns a signing failure message, and Step 318 is executed;

[0178] Step 318, the host application stores the signing result returned by the smart card device into the application group and sends a broadcast;

[0179] In the present Embodiment 3, the signing result comprises a signing failure message or signing data;

[0180] In the present Embodiment 3, after the application group caches data, the cached data is periodically written into a disk to prevent data loss caused by the program exiting after successful writing of the data into NSUserDefaults, after the data is successfully written into NSUserDefaults, synchronize can be used to forcibly and immediately write the data into the disk.

[0181] Step 319, when the extension program receives the broadcast and monitors a change in the data stored in the application group, the extension program determines whether the application group contains signing data, if yes, Step 320 is executed, otherwise, an error is reported;

[0182] In the present Embodiment 3, the error in this Step can prompt a login failure;

[0183] Step 319 also comprises: when the extension program receives a broadcast, the data in the application group is retained and the application group is cleared;

[0184] Step 320, the extension program returns the signing data to the browser.

[0185] Specifically, using signing of PDF files as an example to describe in detail the implementation process of the present invention;

[0186] Step T1, when the host application detects that a smart card device is connected to the terminal device, a certificate object and a key object are generated based on the device certificate in the smart card device and registered into the token configuration;

[0187] Specifically, the process of Step T1 refers to Steps 201 to 207 or Steps 301 to 307;

[0188] Step T2, Adobe passes in the token configuration parameters to invoke the extension program to open the file to be signed, a signing button is popped up to prompt the user to confirm the signing operation;

[0189] Step T3, when Adobe receives the user click on the digital signing button information, the extension program acquires a corresponding token configuration based on the imported token configuration parameters, initializes a created smart card token based on the token configuration, Adobe invokes the PIN authentication interface of the extension program to perform PIN verification, Adobe invokes the signing interface of the extension program, and if PIN verification succeeds, the extension program performs the signing operation;

[0190] Specifically, the PIN verification and signing operation process refer to Steps 209 to 217 or Steps 309 to 320;

[0191] If signing succeeds, Adobe adds the digital signing information to the current file in the form of information embedding, and Adobe will also verify the validity of the signing information, if signing fails, Adobe prompts the corresponding error message.

[0192] In the present Embodiment 3, the third-party application (e.g., browser) can also invoke an encryption interface in the extension program to implement encryption operations, the implementation process can refer to the signing operation process (i.e., replacing the signing algorithm and data to be signed with an encryption algorithm and data to be encrypted), and will not be repeated here. Embodiment 4

[0193] Embodiment 4 of the present invention provides an apparatus for realizing smart card extension, the apparatus is disposed in a terminal device based on an iOS system or iPadOS system, the apparatus comprises a host application module and an extension module reliant on the host application module, the host application module comprises: a reading and computing unit, an acquiring and determining unit, a creating and determining unit, and a generating and writing unit, the extension program module comprises: an enumerating and acquiring unit, a first receiving and sending unit, a determining and confirming unit, a first generating and sending unit, and a second receiving and sending unit;

[0194] The reading and computing unit, configured to select a smart card application in the smart card device after the terminal device establishes a connection with the smart card device, read a device object from the smart card device with a preset filter condition, and perform a hash calculation on a device certificate in the device object to obtain a certificate hash value;

[0195] The acquiring and determining unit, configured to acquire device configuration information, determine whether the certificate hash value is present in a configured token configuration in the device configuration information, report an error if yes, and otherwise write the certificate hash value into the token configuration, and trigger the creating and determining unit;

[0196] The creating and determining unit, configured to create a certificate template, store data in the device certificate into the certificate template to obtain a new device certificate, determine whether the new device certificate is valid, and trigger the generating and writing unit if yes; otherwise, report an error;

[0197] The generating and writing unit, configured to generate a certificate object and a key object according to the new device certificate, create corresponding certificate object identifiers and key object identifiers, and write the certificate object identifiers, the certificate objects, the key object identifiers, and the key objects into the token configuration;

[0198] The enumerating and acquiring unit, configured to acquire imported token configuration parameters when the extension program module is called by a third-party application, acquire a corresponding token configuration based on the token configuration parameters, and initialize a created smart card token based on the token configuration;

[0199] The first receiving and sending unit, configured to enumerate certificate object identifiers and key object identifiers in the smart card token and prompt a user to perform selection when a PIN authentication interface in the extension program module is called by the third-party application, when receiving the certificate object identifier and the key object identifier selected by the user, prompt the user to input a PIN, and send the received PIN to the smart card device for verification;

[0200] The determining and confirming unit, configured to determine whether the PIN has successfully passed verification when a signing interface in the extension program module is called by the third-party application, if yes, confirm a signing algorithm, otherwise, report an error;

[0201] The first generating and sending unit, configured to generate a signing instruction based on the certificate object identifier and the corresponding certificate object selected by the user, the key object identifier and the corresponding key object selected by the user, the signing algorithm, and data to be signed in the signing interface parameters, and send the signing instruction to the smart card device; and

[0202] The second receiving and sending unit, configured to receive the signing data returned by the smart card device and return the signing data to the third-party application.

[0203] In the present Embodiment 4, the reading and computing unit is configured to read the device object from the smart card device with a preset filter condition, comprising: the host application retaining a context object of the smart card application, acquiring a card slot array through the context object, traversing the card slot array, reading the device name from the card slot array, and reading the device object from the smart card device through the device name.

[0204] Furthermore, the reading and computing unit acquires the card slot array through the context object and the first interface, traverses the card slot array, reads the device name from the card slot array, and acquires the device object through the second interface and the device name.

[0205] In the present Embodiment 4, the reading and computing unit is configured to perform a hash calculation on the device certificate in the device object to obtain a certificate hash value, comprising: the reading and computing unit is specifically configured to read the device certificate in the device object through the fifth interface, and perform a hash calculation on the device certificate according to a preset algorithm to obtain the certificate hash value.

[0206] In the present Embodiment 4, the acquiring and determining unit comprises:

[0207] A first acquiring sub-unit, configured to acquire device configuration information, acquire a driver configuration type object from the device configuration information according to a preset extension interface file identifier, and acquire token driver configuration data, keychain token data, and system token driver configuration context from the driver configuration type object;

[0208] A second acquiring sub-unit, configured to acquire a token configuration with a preset name as a key value from a dictionary object in the system token driver configuration context;

[0209] A determining and storing sub-unit, configured to determine whether the certificate hash value is present in the token configuration, if yes, report an error, otherwise, store the certificate hash value, the token driver configuration data, and the keychain token data into the token configuration.

[0210] In the present Embodiment 4, the generating and writing unit comprises:

[0211] A generating and setting sub-unit, configured to generate a certificate object according to the new device certificate, generate a key object according to a key in the new device certificate, create a corresponding certificate object identifier and a key object identifier, and set the key to be signable, decryptable, and login-enabled;

[0212] A second creating sub-unit, configured to use the certificate object identifier and the corresponding certificate object and the key object identifier and the corresponding key object as keychain item, and create a token configuration with the certificate hash value as the key value and the keychain item as the name;

[0213] An adding sub-unit, configured to add the token configuration to the dictionary object.

[0214] Preferably, In the present Embodiment 4, the enumerating and acquiring unit comprises:

[0215] A first enumerating and acquiring sub-unit, configured to acquire imported token configuration parameters when the extension program module is called by a third-party application, acquire a corresponding token configuration based on the token configuration parameters, and initialize a created smart card token based on the token configuration;

[0216] A first creating and binding sub-unit, configured to create a token session based on the smart card token, initialize the token session, and bind the token session to the smart card token.

[0217] Preferably, the first receiving and sending unit is specifically configured to enumerate certificate object identifiers and key object identifiers in the smart card token and prompt the user to perform selection when a PIN authentication interface in the extension program module is called by the browser, when the certificate object identifier and the key object identifier selected by the user have been received, a PIN input box is popped up through the browser to prompt the user to input a PIN, after the PIN input by the user is received, the PIN is sent to the corresponding smart card device through the Lighting communication method.

[0218] Correspondingly, the determining and confirming unit is specifically configured to determine whether the PIN has successfully passed verification when a signing interface in the extension program module is called by the third-party application, if yes, negotiate the signing algorithm with the token session, otherwise, report an error;

[0219] Correspondingly, the first generating and sending unit is specifically configured to separately acquire the certificate object and the key object in the smart card token corresponding to the certificate object identifier and the key object identifier selected by the user, a signing instruction is generated based on the certificate object identifier, the certificate object, the key object identifier, the key object, the signing algorithm, and data to be signed in the signing interface parameters, the signing instruction is sent to the smart card device through the Lighting communication method.

[0220] Preferably, in the present Embodiment 4, the extension program module also comprises a registration unit, configured to register the notification, the host application module also comprises: a creation and establishment unit, configured to establish a notification listener and create an application group.

[0221] Preferably, in the present Embodiment 4, the first receiving and sending unit is specifically configured to enumerate certificate object identifiers and key object identifiers in the smart card token and prompt the user to perform selection when a PIN authentication interface in the extension program module is called by the browser, when the certificate object identifier and the key object identifier selected by the user have been received, a PIN input box is popped up through the browser to prompt the user to input a PIN, the received PIN is sent to the host application module through a notification method, blocking and waiting for the host application module to return data;

[0222] Correspondingly, the host application module also comprises:

[0223] A second generating and sending unit, configured to generate a PIN verification instruction based on the PIN, and send the PIN verification instruction to the smart card device;

[0224] A receiving and caching and sending unit, configured to receive the PIN verification result returned by the smart card device and cache the result in the application group, and send a broadcast;

[0226] In the present Embodiment 4, the PIN verification result comprises a PIN verification success result or a PIN verification failure result;

[0227] The extension program module also comprises: a first forwarding module, configured to return the PIN verification result in the application group to the browser when the broadcast is received and a change in the data stored in the application group is monitored;

[0228] In the present Embodiment 4, the receiving and confirming unit is specifically configured to determine whether the PIN has successfully passed verification when a signing interface in the extension program module is called by the browser, if yes, negotiate the signing algorithm with the token session, otherwise, report an error;

[0229] The first generating and sending unit is specifically configured to separately acquire the certificate object and the key object in the smart card token corresponding to the certificate object identifier and the key object identifier selected by the user, the data to be signed is encapsulated to obtain a encapsulated result based on the certificate object identifier, the certificate object, the key object identifier, the key object, the signing algorithm, and data to be signed in the signing interface parameters, the encapsulated result is sent to the host application module through a notification method, blocking and waiting for the host application module to return data;

[0230] The host application module also comprises:

[0231] A parsing and sending unit, configured to parse the encapsulated result when the encapsulated result is monitored, a signing instruction is generated based on the parsed certificate object identifier, certificate object, key object identifier, key object, signing algorithm, and data to be signed, the signing instruction is sent to the smart card device;

[0232] A second receiving and caching and sending unit, configured to cache the signing result returned by the smart card device into the application group and send a broadcast;

[0233] In the present Embodiment 4, the signing result comprises a signing failure message or signing data;

[0234] The second receiving and sending unit is specifically configured to determine whether the application group contains signing data when the broadcast is received and a change in the data stored in the application group is monitored, if yes, acquire the signing data from the application group and return the signing data to the third-party application, otherwise, report an error.

[0235] Preferably, the present invention further provides an electronic device, the electronic device comprises at least one processor, a storage, and instructions stored in the storage and executable by the at least one processor, the processor executes the instructions to implement the method for realizing smart card extension, the electronic device can be a chip system, consisting of chips only, or comprising chips and other discrete components, the chip is coupled with the storage for executing the computer programs stored in the storage, to execute the method for realizing smart card extension according to the present invention.

[0236] The present invention can be implemented entirely or partially by software, hardware, firmware, or any combination thereof. When implemented by software, the implementation may be entirely or partially in the form of a computer program product. The computer program product comprises one or more computer programs. When the computer program is loaded and executed on a computer, the processes or functions described according to the embodiments of the present invention are all or partially produced. The computer program can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer- readable storage medium, for example, the computer program can be transmitted from one base station, electronic device, server, or data center to another base station, electronic device, server, or data center via wired (e.g., coaxial cable, optical fiber, digital subscriber line, DSL) or wireless (e.g., infrared, wireless, microwave, etc.) methods. The computer-readable storage medium can be any available medium accessible by a computer or can be a data storage device such as a server or data center integrating one or more available media. The available medium may be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state disk, SSD). In the present invention, the electronic device can comprise the above apparatus.

[0237] Although embodiments have been described herein with reference to embodiments of the present application, during implementation of the present application to be protected, a person skilled in the art can understand and implement other changes to the disclosed embodiments by referring to the drawings, the disclosed content, and the appended claims. In the claims, the term "comprising" does not exclude other components or steps, and "a" or "an" does not exclude a plural number. A single processor or another unit can implement a plurality of functions recited in the claims. Certain measures are recited in mutually different dependent claims, but this does not indicate inability of combination of the measures to produce a good effect.

[0238] Although the present application has been described with reference to specific features and embodiments, apparently, various modifications and combinations can be made thereto without departing from the spirit and scope of the present application. Accordingly, the specification and the drawings are merely illustrative description of the present application defined by the appended claims, and are deemed to cover all modifications, variations, combinations, or equivalents within the scope of the present application. Apparently, a person skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Accordingly, when the changes and modifications fall within the scope of the claims of the present application and equivalent technologies thereof, the present application is also intended to cover the changes and modifications.

Claims

1. A method for realizing smart card extension, applicable to a terminal device based on an iOS system or iPadOS system, the terminal device comprises a host application and an extension reliant on the host application, after the terminal device establishes a connection with a smart card device, the method comprises the following Steps: S1) the host application selects a smart card application in the smart card device, reads a device object from the smart card device with a preset filter condition, and performs a hash calculation on a device certificate in the device object to obtain a certificate hash value; S2) the host application acquires device configuration information, determines whether the certificate hash value is present in a configured token configuration in the device configuration information, if yes, reports an error, otherwise, writes the certificate hash value into the token configuration, and executes Step S3; S3) the host application creates a certificate template, stores data in the device certificate into the certificate template to obtain a new device certificate, determines whether the new device certificate is valid, if yes, executes Step S4, otherwise, reports an error; S4) the host application generates a certificate object and a key object according to the new device certificate, creates corresponding certificate object identifiers and key object identifiers, and writes the certificate object identifiers, the certificate objects, the key object identifiers, and the key objects into the token configuration; S5) when the extension program is called by a third-party application, the extension program acquires imported token configuration parameters, acquires a corresponding token configuration based on the token configuration parameters, and initializes a created smart card token based on the token configuration; S6) when a PIN (Personal Identification Number) authentication interface of the extension program is called by the third-party application, the extension program enumerates certificate object identifiers and key object identifiers in the smart card token and prompts a user to perform selection, when the certificate object identifier and the key object identifier selected by the user have been received, the extension program prompts the user to input a PIN, and sends the received PIN to the smart card device for verification; S7) when a signing interface of the extension program is called by the third-party application, the extension program determines whether the PIN has successfully passed verification, if yes, a signing algorithm is determined, a signing instruction is generated based on the certificate object identifier and the corresponding certificate object selected by the user, the key object identifier and the corresponding key object selected by the user, the signing algorithm and data to be signed in the signing interface parameters, and the signing instruction is sent to the smart card device, otherwise, an error is reported; and S8) when the extension program receives signing data returned by the smart card device, the extension program returns the signing data to the third-party application.

2. The method according to claim 1, wherein reading the device object from the smart card device with a preset filter condition comprises: the host application retaining the context object of the smart card application, acquiring a card slot array through the context object, traversing the card slot array, reading a device name from the card slot array, and reading the device object from the smart card device through the device name.

3. The method according to claim 2, wherein acquiring the card slot array through the context object comprises: acquiring the card slot array through the context object and a first interface; reading the device object from the smart card device through the device name comprises acquiring the device object through a second interface and the device name.

4. The method according to claim 1, wherein performing a hash calculation on the device certificate in the device object to obtain the certificate hash value comprises: reading the device certificate in the device object through a fifth interface, and performing a hash calculation on the device certificate according to a preset algorithm to obtain the certificate hash value.

5. The method according to claim 1, wherein Step S2 comprises the following Steps: B1) the host application acquires device configuration information, acquires a driver configuration type object from the device configuration information according to a preset extension interface file identifier, and acquires token driver configuration data, keychain token data, and system token driver configuration context from the driver configuration type object; B2) the host application acquires a token configuration with a preset name as a key value from a dictionary object in the system token driver configuration context; and B3) the host application determines whether the certificate hash value is present in the token configuration, if yes, an error is reported, otherwise, the certificate hash value, the token driver configuration data, and the keychain token data are stored into the token configuration, and Step S3 is executed.

6. The method according to claim 1, wherein Step S4 comprises the following Steps: C1) the host application generates a certificate object according to the new device certificate, generates a key object according to a key in the new device certificate, and creates corresponding certificate object identifiers and key object identifiers, sets the key to be signable, decryptable, and login-enabled; C2) the host application uses the certificate object identifier, the certificate object, the key object identifier, and the key object as keychain items, creates a token configuration with the certificate hash value as the key value and the keychain items as the name; and C3) the host application adds the token configuration to the dictionary object.

7. The method according to claim 1, wherein Step S5 comprises the following Steps: S5-1) when the extension program is called by a browser, the extension program enumerates a corresponding extension program interface according to a preset interface identifier, acquires token configuration parameters from the extension program application interface, acquires a corresponding token configuration based on the token configuration parameters, and initializes a created smart card token based on the token configuration; and S5-2) the extension program creates a token session based on the smart card token, initializes the token session, and binds the token session to the smart card token.

8. The method according to claim 7, wherein Step S6 comprises the following Steps: S6-1) when a PIN authentication interface of the extension program is called by the browser, the extension program enumerates certificate object identifiers and key object identifiers in the smart card token and prompts a user to perform selection, when the certificate object identifier and the key object identifier selected by the user have been received, a PIN input box is popped up through the browser to prompt the user to input a PIN; S6-2) when the extension program receives the PIN input by the user, the PIN is sent to the corresponding smart card device through the Lighting communication method; and S6-3) the extension program receives the PIN verification result returned by the smart card device and returns the result to the browser; the PIN verification result comprises a PIN verification success result or a PIN verification failure result.

9. The method according to claim 8, wherein Step S7 comprises the following Steps: S7-1) when a signing interface of the extension program is called by the browser, the extension program determines whether the PIN has successfully passed verification, if yes, Step S7-2 is executed, otherwise, an error is reported; S7-2) the extension program negotiates a signing algorithm with the token session; and S7-3) the extension program separately acquires the certificate object and the key object in the smart card token corresponding to the certificate object identifier and the key object identifier selected by the user, generates a signing instruction based on the certificate object identifier, the certificate object, the key object identifier, the key object, the signing algorithm, and data to be signed in the signing interface parameters, and sends the signing instruction to the smart card device through the Lighting communication method.

10. The method according to claim 1, wherein before Step S1, the method further comprises: the extension program registers a notification, and the host application establishes a notification listener and creates an application group.

11. The method according to claim 10, wherein Step S5 comprises the following Steps: S51) when the extension program is called by a browser, the extension program enumerates a corresponding extension program interface according to a preset interface identifier, acquires token configuration parameters from the extension program application interface, acquires a corresponding token configuration based on the token configuration parameters, and initializes a created smart card token based on the token configuration; and S52) the extension program creates a token session based on the smart card token, initializes the token session, and binds the token session to the smart card token.

12. The method according to claim 11, wherein Step S6 comprises the following Steps: S61) when a PIN authentication interface of the extension program is called by the browser, the extension program enumerates certificate object identifiers and key object identifiers in the smart card token and prompts a user to perform selection, when the certificate object identifier and the key object identifier selected by the user have been received, a PIN input box is popped up through the browser to prompt the user to input a PIN; S62) the extension program sends the received PIN to the host application through a notification method, blocking and waiting for the host application to return data; S63) the host application generates a PIN verification instruction based on the PIN, and sends the PIN verification instruction to the smart card device; S64) the host application receives the PIN verification result returned by the smart card device, caches the result in the application group, and sends a broadcast; and S65) when the extension program receives the broadcast and monitors a change in the data stored in the application group, the extension program returns the PIN verification result in the application group to the browser; the PIN verification result comprises a PIN verification success result or a PIN verification failure result.

13. The method according to claim 12, wherein Step S7 comprises the following Steps: S71) when a signing interface of the extension program is called by the browser, the extension program determines whether the PIN has successfully passed verification, if yes, Step S72 is executed, otherwise, an error is reported; S72) the extension program negotiates a signing algorithm with the token session; S73) the extension program separately acquires the certificate object and the key object in the smart card token corresponding to the certificate object identifier and the key object identifier selected by the user, the data to be signed is encapsulated to obtain a encapsulated result based on the certificate object identifier, the certificate object, the key object identifier, the key object, the signing algorithm, and data to be signed in the signing interface parameters, the encapsulated result is sent to the host application through a notification method, blocking and waiting for the host application to return data; and S74) when the host application monitors the encapsulated result, the host application parses the encapsulated result, a signing instruction is generated based on the parsed certificate object identifier, certificate object, key object identifier, key object, signing algorithm, and data to be signed, the signing instruction is sent to the smart card device.

14. The method according to claim 13, wherein Step S8 comprises the following Steps: S81) the host application caches the signing result returned by the smart card device into the application group and sends a broadcast, the signing result comprises a signing failure message or signing data; S82) when the extension program receives the broadcast and monitors a change in the data stored in the application group, the extension program determines whether the application group contains signing data, if yes, Step S83 is executed, otherwise, an error is reported; and S83) the extension program acquires the signing data from the application group and returns the signing data to the browser.

15. An apparatus for realizing smart card extension, disposed in a terminal device based on an iOS system or iPadOS system, the apparatus comprising a host application module and an extension module reliant on the host application module, the host application module comprising: a reading and computing unit, an acquiring and determining unit, a creating and determining unit, and a generating and writing unit; the extension program module comprising: an enumerating and acquiring unit, a first receiving and sending unit, a determining and confirming unit, a first generating and sending unit, and a second receiving and sending unit: the reading and computing unit, configured to select a smart card application in the smart card device after the terminal device establishes a connection with the smart card device, read a device object from the smart card device with a preset filter condition, and perform a hash calculation on a device certificate in the device object to obtain a certificate hash value; the acquiring and determining unit, configured to acquire device configuration information, determine whether the certificate hash value is present in a configured token configuration in the device configuration information, report an error if yes, and otherwise write the certificate hash value into the token configuration, and trigger the creating and determining unit; the creating and determining unit, configured to create a certificate template, store data in the device certificate into the certificate template to obtain a new device certificate, determine whether the new device certificate is valid, and trigger the generating and writing unit if yes; otherwise, report an error; the generating and writing unit, configured to generate a certificate object and a key object according to the new device certificate, create corresponding certificate object identifiers and key object identifiers, and write the certificate object identifiers, the certificate objects, the key object identifiers, and the key objects into the token configuration; the enumerating and acquiring unit, configured to acquire imported token configuration parameters when the extension program module is called by a third-party application, acquire a corresponding token configuration based on the token configuration parameters, and initialize a created smart card token based on the token configuration; the first receiving and sending unit, configured to enumerate certificate object identifiers and key object identifiers in the smart card token and prompt a user to perform selection when a PIN authentication interface in the extension program module is called by the third- party application, when receiving the certificate object identifier and the key object identifier selected by the user, prompt the user to input a PIN, and send the received PIN to the smart card device for verification; the determining and confirming unit, configured to determine whether the PIN has successfully passed verification when a signing interface in the extension program module is called by the third-party application, if yes, confirm a signing algorithm, otherwise, report an error; the first generating and sending unit, configured to generate a signing instruction based on the certificate object identifier and the corresponding certificate object selected by the user, the key object identifier and the corresponding key object selected by the user, the signing algorithm, and data to be signed in the signing interface parameters, and send the signing instruction to the smart card device; and the second receiving and sending unit, configured to receive the signing data returned by the smart card device and return the signing data to the third-party application.

16. An electronic device, a computer-readable storage medium, or a chip system, wherein: the electronic device comprises at least one processor, a storage, and instructions stored in the storage and executable by at least one processor, the processor executes the instructions to implement the method according to claim 1; the computer-readable storage medium comprises a computer program, when the computer program runs on an electronic device, the electronic device executes the method according to claim 1; or the chip system comprises a chip, the chip is coupled with a storage and is used to execute a computer program stored in the storage, to execute the method according to claim 1.