Extension package access control method, device, Java smart card and storage medium

Abstract

The present application is applicable to the field of smart card technology, and provides an extension package access control method, device, Java smart card and storage medium, wherein the method comprises: when a call instruction of a first target application in a Java smart card calling an object in an extension package is detected, verifying the calling authority of the first target application to the object; when the calling authority verification of the first target application to the object is passed, allowing the first target application to call the object. The embodiment of the present application first verifies the calling authority of the first target application, and when the calling authority verification is passed, allows the first target application to call the object, so that the first target application can safely access the object in the extension package.

Description

Technical Field

[0001] The present application belongs to the field of smart card technology, and in particular, relates to an extension package access control method, device, Java smart card and storage medium. Background Art

[0002] Java Smart Card (Java Card) is a smart card that uses Java technology and can download multiple applications to provide different application services.

[0003] When the application in the Java smart card needs to provide more functional requirements, the developer can optimize or expand the functions of the application by building an extension package, so that the application can call the objects in the extension package to perform the corresponding functions, thereby optimizing or expanding the functions of the application. However, the security of the application in the Java smart card accessing the objects in the extension package is currently low. Summary of the invention

[0004] The embodiments of the present application provide an extension package access control method, apparatus, terminal device and storage medium, so that an application in a Java smart card can securely access objects in an extension package.

[0005] In a first aspect, an embodiment of the present application provides an extended package access control method, including:

[0006] When detecting a call instruction of a first target application in the Java smart card to call an object in the extension package, verifying the call authority of the first target application to the object;

[0007] When the first target application passes the verification of its calling authority to the object, the first target application is allowed to call the object.

[0008] In a second aspect, an embodiment of the present application provides an extended package access control device, including:

[0009] A verification module, configured to verify the calling authority of the first target application to the object when a calling instruction of the first target application in the Java smart card to call the object in the extension package is detected;

[0010] The calling module is used to allow the first target application to call the object when the calling authority of the first target application to the object is verified to be successful.

[0011] In a third aspect, an embodiment of the present application provides a Java smart card, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned extension package access control method when executing the computer program.

[0012] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above-mentioned extension package access control method are implemented.

[0013] In a fifth aspect, an embodiment of the present application provides a computer program product. When the computer program product is run on an electronic device, the electronic device executes the steps of the above-mentioned extension package access control method.

[0014] Compared with the prior art, the embodiments of the present application have the following beneficial effects: when a call instruction of a first target application in a Java smart card to call an object in an extension package is detected, the calling authority of the first target application to the object is first verified, and when the calling authority verification of the first target application to the object is passed, the first target application is allowed to call the object. The present application first verifies the calling authority of the first target application, and when the calling authority verification is passed, the first target application is allowed to call the object, so that the first target application can safely access the objects in the extension package. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0016] Figure 1 It is a flowchart of the extension package access control method provided in Example 1 of the present application;

[0017] Figure 2 This is a specific flow chart of step S101 in the first embodiment of the present application;

[0018] Figure 3 It is a flowchart of the extension package access control method provided in the second embodiment of the present application;

[0019] Figure 4 It is a structural diagram of the extension package access control device provided in Embodiment 3 of the present application;

[0020] Figure 5It is a schematic diagram of the structure of the Java smart card provided in Example 4 of the present application. DETAILED DESCRIPTION

[0021] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0022] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0023] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0024] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0025] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0026] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0027] The extension package access control method provided in the embodiment of the present application can be applied to a Java smart card and executed by a processor of the Java smart card when running a computer program.

[0028] In order to illustrate the technical solution described in this application, the following embodiments are used for illustration.

[0029] Embodiment 1

[0030] See also Figure 1 , an extended package access control method provided by an embodiment of the present application includes:

[0031] Step S101: when a call instruction of a first target application in a Java smart card to call an object in an extension package is detected, the calling authority of the first target application to the object is verified.

[0032] In this embodiment, the first target application is an application in the Java smart card that needs to execute the functions of the objects in the extension package. Multiple applications can be run in the Java smart card, and different applications can provide different services to achieve different purposes. For example, the application can be used for transaction services in the financial field, or user identity identification services, etc. The service functions implemented by the application can be downloaded to the Java smart card by the developer after the program is completed, and the corresponding functions are implemented by running the completed program. However, according to the project requirements, when the completed application is to be further optimized or the function is expanded, in order to avoid re-developing the application, an extension package can often be developed, which includes one or more objects that optimize the functions of the application or expand the functions. When it is detected that an application calls an object in the extension package, the application is used as the first target application to directly verify whether the first target application has the authority to call the object. The first target application is any application in the downloaded applications in the Java smart card.

[0033] In one embodiment, before detecting the calling instruction of the first target application in the Java smart card to call the object in the extension package, the method includes: generating the calling instruction when receiving a request instruction sent by the terminal device.

[0034] In order to better understand the technical solution of this embodiment, a specific application scenario is used as an example below. For example, a system can be composed of a Java smart card and a terminal device, and the terminal device triggers the Java smart card to provide services, or a system composed of a Java smart card, a terminal device and a background server provides services. Therefore, the terminal device can communicate with the Java smart card, and the terminal device sends a request instruction for the first target application to execute the function of the object in the extension package. When the Java smart card receives the request instruction sent by the terminal device, the first target application is called to execute the function. Since the first target application itself cannot provide the function of the object in the extension package, the first target application generates a call instruction to call the object. When the generation of the call instruction is detected, the authority of the first target application to call the object is verified.

[0035] In one embodiment, when a call instruction of a first target application in a Java smart card to call an object in an extension package is detected, before verifying the calling authority of the first target application to the object, the method includes: downloading the extension package to a first storage path where the first target application is located; wherein the extension package includes a first access permission parameter of the object, and the first target application includes a second access permission parameter of the object. Figure 2 As shown, in this embodiment, step S101 includes step S1011 and step S1012:

[0036] Step S1011: when detecting a call instruction of a first target application in a Java smart card to call an object in an extension package, verify whether the first access permission parameter of the object matches the second access permission parameter of the object.

[0037] In the application, an access permission parameter is set for each object in the extension package in advance, and the access permission parameter of the object is saved in a data file in the extension package. The legitimate first target application in the Java smart card can import and save the access permission parameter in advance. When the Java smart card downloads the extension package, the extension package is downloaded to the first storage path where the first target application is located.

[0038] The first access permission parameter is an access permission parameter of the object to be called included in the extension package of the first target application, and the second access permission parameter is an access permission parameter of the object to be called included in the first target application.

[0039] In one embodiment, a permission call parameter table is stored in the storage path where the first target application is located, and the permission call parameter table includes the second access control parameters of all objects that can be called by the first target application. When carrying out a certain project, the first target application needs to implement a certain function, or optimize the existing functions in the first target application. An extension package is needed to meet the needs of the first target application. A permission call parameter table can be pre-established in the first target application, and the access permission parameters of all objects in the extension package that can be called by the first target application (that is, the second access permission parameters corresponding to all objects) are imported into the permission call parameter table.

[0040] Step S1012: When the first access permission parameter matches the second access permission parameter, it is determined that the first target application has passed the verification of the calling permission to the object.

[0041] In the application, if the access permission parameters (second access permission parameters) of the object included in the first target application match (for example, are the same as) the access parameters (first access permission parameters) of the object included in the extension package imported into the first target application, it is determined that the calling permission verification of the first target application to the object has passed.

[0042] Step S102: when the first target application passes the verification of its calling authority to the object, the first target application is allowed to call the object.

[0043] In the application, when it is determined that the first target application has passed the verification of its calling authority to the object, the first target application is allowed to call the object.

[0044] In one embodiment, after allowing the first target application to call the object, the method further includes: executing an interface function corresponding to the object to call the object. All objects in the extension package have corresponding interface functions for calling the object, and the interface function corresponding to the object is executed to call the object by executing the interface function so that the object performs data processing. The interface function is a function pre-built in the extension package for calling the object.

[0045] In an embodiment of the present application, when a call instruction of a first target application in a Java smart card to call an object in an extension package is detected, the first target application's call permission to the object is first verified, and when the first target application's call permission verification to the object passes, the first target application is allowed to call the object. In an embodiment of the present application, the first target application is first verified for call permission, and when the call permission verification passes, the first target application is allowed to call the object, so that the first target application can safely access the object in the extension package.

[0046] Embodiment 2

[0047] See also Figure 3 , an extended package access control method provided by an embodiment of the present application includes:

[0048] Step S301: The second target application sends an external authentication request to the first target application.

[0049] In this embodiment, the Java smart card includes a second target application that needs to execute the function of the object in the extension package, and a first target application for externally authenticating the second target application.

[0050] In a specific application, the external authentication request carries key information, and when the external authentication request sent by the second target application to the first target application is detected, the first target application verifies the key information.

[0051] Step S302: When verifying that the external authentication request is passed, the first target application initiates a call instruction to call an object in the extension package.

[0052] In a specific application, when the first target application verifies the key information correctly, it is determined that the external authentication verification of the second target application is passed, and when the external authentication request is verified to be passed, a call instruction for calling the object in the extension package is initiated through the first target application.

[0053] For example, the first target application may verify the key information by pre-storing ciphertext in the first target application and pre-storing the corresponding key in a legitimate second target application. When the second target application sends an external authentication request carrying the key information to the first target application, it can be verified whether the external authentication request is passed by detecting whether the key can correctly decrypt the ciphertext.

[0054] In a specific embodiment, when verifying that the external authentication request passes, the first target application initiates a calling instruction to call the object in the extension package, including: when verifying that the external authentication request passes, the second target application sends a request to the first target application to call the object in the extension package through the shared interface of the first target application, so that the first target application initiates a calling instruction to call the object in the extension package.

[0055] In the application, the first target application pre-sets a shared interface, and the shared interface is a function for the second target application to call a corresponding object. When the first target application passes the external authentication request for the second target application, the second target application sends a request to the first target application to call an object in an extension package through the shared interface of the first target application. The request includes parameters of the object to be called. The first target application uses the parameters as input parameters of the function corresponding to the shared interface, and initiates a call instruction to call the object in the extension package based on the parameters of the called object.

[0056] In a specific embodiment, the external authentication request sent by the second target application to the first target application includes: when a request from a terminal device for the second target application to execute the function of the object is received, the external authentication request is sent by the second target application to the first target application.

[0057] Step S303: when detecting a calling instruction of the first target application in the Java smart card to call the object in the extension package, verifying the calling authority of the first target application to the object.

[0058] In a specific application, when verifying that the external authentication request is passed, the first target application initiates a call instruction to call the object in the extension package. At this time, the call instruction of the first target application in the Java smart card to call the object in the extension package will be detected to verify the calling authority of the first target application to the object.

[0059] In a specific embodiment, when a call instruction of a first target application in a Java smart card to call an object in an extension package is detected, before verifying the calling permission of the first target application to the object, it includes: downloading the extension package to a first storage path where the first target application is located; wherein the extension package includes a first access permission parameter of the object, and the first target application includes a second access permission parameter of the object; step S201 includes, when a call instruction of a first target application in a Java smart card to call an object in the extension package is detected, verifying whether the first access permission parameter of the object matches the second access permission parameter; when the first access permission parameter matches the second access permission parameter, determining that the calling permission verification of the first target application to the object has succeeded.

[0060] In a specific embodiment, a permission calling parameter table is stored in the storage path where the first target application is located, and the permission calling parameter table includes second access control parameters of all objects that can be called by the first target application.

[0061] Step S304: when the first target application passes the verification of its calling authority to the object, the first target application is allowed to call the object.

[0062] In one embodiment, the first target application is allowed to call the object, and the object will execute a corresponding function when called. The second target application obtains the result of the object executing the corresponding function and feeds it back to the terminal device.

[0063] In one embodiment, after allowing the first target application to call the object, the method further includes: executing an interface function corresponding to the object to call the object. All objects in the extension package have corresponding interface functions for calling the object, and the interface function corresponding to the object is executed to call the object by executing the interface function so that the object performs data processing. The interface function is a function pre-built in the extension package for calling the object.

[0064] To better understand the technical solution of this embodiment, a specific application scenario is used as an example below. For example, a system can be composed of a Java smart card and a terminal device, and the terminal device triggers the Java smart card to provide services, or a system composed of a Java smart card, a terminal device and a background server provides services. Therefore, the terminal device can communicate with the Java smart card, and the terminal device sends a request instruction for the second target application to execute the function of the object in the extension package. When the Java smart card receives the request instruction sent by the terminal device, the second target application is called to execute the function. Since the second target application itself cannot provide the function of the object in the extension package, the second target application sends an external authentication request to the first target application; when the first target application verifies that the external authentication request is passed, the second target application sends a request to call the object in the extension package to the first target application through the shared interface of the first target application. The first target application includes the parameters of the object to be called according to the request. The first target application uses the parameters as the input parameters of the function corresponding to the shared interface, and can initiate a call instruction to call the object in the extension package. At this time, the call instruction of the first target application to call the object in the extension package will be detected, and then the first target application will be verified whether it has the authority to call the object. When the first target application passes the verification of the calling authority of the object, the first target application is allowed to call the object. Then the interface function corresponding to the object is executed to call the object. After the object is called, the corresponding function is automatically executed. The second target application obtains the result of the object executing the corresponding function and feeds it back to the terminal device.

[0065] In an embodiment of the present application, when a call instruction of a first target application calling an object in an extension package is detected, the calling authority of the first target application to the object is first verified, and when the calling authority verification of the first target application to the object is passed, the first target application is allowed to call the object. In an embodiment of the present application, the calling authority of the first target application is first verified, and when the calling authority verification is passed, the first target application is allowed to call the object, so that the first target application can safely access the objects in the extension package.

[0066] Embodiment 3

[0067] Corresponding to the extended package access control method described in the above embodiment, Figure 4 The structural block diagram of the extended package access control device provided by the embodiment of the present application is shown. For the convenience of explanation, only the part related to the embodiment of the present application is shown. The extended package access control device can be a virtual appliance in a smart card, which is run by a processor of the smart card, or it can be the smart card itself.

[0068] See also Figure 4 , the extended package access control device 400 includes:

[0069] Verification module 401, for verifying the calling authority of the first target application to the object when detecting a calling instruction of the first target application in the Java smart card to call the object in the extension package;

[0070] The calling module 402 is used to allow the first target application to call the object when the calling authority of the first target application to the object is verified to be successful.

[0071] In one embodiment, the extension package access control device 400 includes:

[0072] The first download module is used to download the extension package to the first storage path where the first target application is located; wherein the extension package includes the first access permission parameter of the object, and the first target application includes the second access permission parameter of the object. The verification module 401 includes:

[0073] A first verification unit, configured to verify whether the first access permission parameter and the second access permission parameter of the object match when detecting a call instruction of a first target application in the Java smart card to call an object in the extension package;

[0074] The first determination unit is configured to determine that the calling permission verification of the first target application to the object has passed when the first access permission parameter matches the second access permission parameter.

[0075] In one embodiment, the extension package access control device 400 includes:

[0076] The first execution module is used to execute the interface function corresponding to the object to call the object after allowing the first target application to call the object.

[0077] In one embodiment, the extension package access control device 400 includes:

[0078] An external request authentication module, used for sending an external authentication request to the first target application via a second target application;

[0079] The calling module is used to initiate a calling instruction of calling an object in the extension package through the first target application program when verifying that the external authentication request is passed.

[0080] The initiating call module is specifically used for: when verifying that the external authentication request is passed, the second target application sends a request to the first target application through the shared interface of the first target application to call the object in the extension package, so that the first target application initiates a calling instruction to call the object in the extension package.

[0081] The external request authentication module is specifically used to: upon receiving a request from a terminal device for the second target application to execute the function of the object, send an external authentication request to the first target application through the second target application.

[0082] In one embodiment, a permission calling parameter table is stored in the storage path where the first target application is located, and the permission calling parameter table includes second access control parameters of all objects that can be called by the first target application.

[0083] In application, each module in the extended package access control device may be a software program module, or may be implemented by different logic circuits integrated in a processor, or may be implemented by multiple distributed processors.

[0084] When the embodiment of the present application detects a call instruction of the first target application to call an object in the extension package, the first target application is first verified to have call permission on the object, and when the first target application passes the call permission verification on the object, the first target application is allowed to call the object. The embodiment of the present application first verifies the call permission of the first target application, and when the call permission verification passes, the first target application is allowed to call the object, so that the first target application can safely access the objects in the extension package.

[0085] Embodiment 4

[0086] Figure 5 This is a schematic diagram of the structure of a Java smart card provided by an embodiment of the present application. Figure 5 As shown, the Java smart card 500 of this embodiment includes: a processor 501, a memory 502, and a computer program 503 stored in the memory 502 and executable on the processor 501, such as an extension package access control program. When the processor 501 executes the computer program 503, the steps in the above-mentioned extension package access control method embodiments are implemented. When the processor 501 executes the computer program 503, the functions of the modules in the above-mentioned device embodiments are implemented, such as Figure 4 Functions of modules 401 to 402 are shown.

[0087] Exemplarily, the computer program 503 may be divided into one or more modules, which are stored in the memory 502 and executed by the processor 501 to complete the present invention. The one or more modules may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program 503 in the Java smart card 500. For example, the computer program 503 may be divided into a verification module and a calling module, and the specific functions of each module have been described in the above-mentioned embodiment 3, and will not be repeated here.

[0088] The Java smart card 500 may be any type of smart card implemented using Java technology. The terminal device may include, but is not limited to, a processor 501 and a memory 502. Those skilled in the art will appreciate that Figure 5 The Java smart card 500 is merely an example and does not constitute a limitation of the Java smart card 500 , which may include more or less components than those shown in the figure, or may combine certain components, or may have different components.

[0089] The processor 501 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0090] The memory 502 may be an internal storage unit of the Java smart card 500, such as a hard disk or memory of the Java smart card 500. The memory 502 may also be an external storage device of the Java smart card 500, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the Java smart card 500. Further, the memory 502 may also include both an internal storage unit of the Java smart card 500 and an external storage device. The memory 502 is used to store the computer program and other programs and data required by the terminal device. The memory 502 may also be used to temporarily store data that has been output or is to be output.

[0091] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0092] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0093] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0094] In the embodiments provided by the present invention, it should be understood that the disclosed devices / terminal equipment and methods can be implemented in other ways. For example, the device / terminal equipment embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0095] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0096] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0097] If the integrated module is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0098] The embodiments described above are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included in the protection scope of the present invention.

Claims

1. A method for controlling access to an extended package, characterized in that: include: When a call instruction of a first target application in a Java smart card to call an object in an extension package is detected, verifying the calling authority of the first target application to the object, wherein the extension package includes one or more objects for optimizing or extending the functions of the application, and the extension package is used to further optimize or extend the functions of the already written application; When the first target application passes the verification of the calling authority of the object, allowing the first target application to call the object; Wherein, when detecting a call instruction of a first target application in a Java smart card to call an object in an extension package, before verifying the call authority of the first target application to the object, the method includes: The extension package is downloaded to the first storage path where the first target application is located; wherein an access permission parameter is pre-set for each object in the extension package, the extension package includes the first access permission parameter of the object, and the first target application includes the second access permission parameter of the object.

2. The method for controlling access to an extended package according to claim 1, wherein: When detecting that a first target application in the Java smart card calls a call instruction of an object in the extension package, verifying the calling authority of the first target application to the object includes: When detecting a call instruction of a first target application in the Java smart card calling an object in the extension package, verifying whether the first access permission parameter of the object matches the second access permission parameter; When the first access permission parameter matches the second access permission parameter, it is determined that the first target application program has passed the verification of its calling permission on the object.

3. The method for controlling access to an extended package according to claim 2, wherein: After allowing the first target application to call the object, the method further comprises: An interface function corresponding to the object is executed to call the object.

4. The method for controlling access to an extended package according to claim 1, wherein: When the calling instruction of the first target application in the Java smart card to call the object in the extension package is detected, before verifying the calling authority of the first target application to the object, the method includes: An external authentication request sent by a second target application to the first target application; When verifying that the external authentication request passes, the first target application initiates a call instruction to call an object in the extension package.

5. The method for controlling access to an extended package according to claim 4, characterized in that: When verifying that the external authentication request is passed, the first target application program initiates a call instruction for calling an object in the extension package, including: When verifying that the external authentication request passes, the second target application sends a request to the first target application through the shared interface of the first target application to call the object in the extension package, so that the first target application initiates a call instruction to call the object in the extension package.

6. The method for controlling access to an extended package according to claim 4, characterized in that: The external authentication request sent by the second target application to the first target application includes: When receiving a request from a terminal device for the second target application to execute the function of the object, an external authentication request is sent by the second target application to the first target application.

7. The method for controlling access to an extended package according to any one of claims 1 to 6, characterized in that: A permission calling parameter table is stored in the storage path where the first target application is located. The permission calling parameter table includes second access control parameters of all objects that can be called by the first target application.

8. An extended package access control device, characterized in that: include: A verification module, configured to verify the calling authority of a first target application in a Java smart card to an object in an extension package upon detecting a calling instruction of the first target application in the Java smart card to call the object, wherein the extension package includes one or more objects for optimizing or extending the functions of the application, and the extension package is used to further optimize or extend the functions of the completed application; A calling module, configured to allow the first target application to call the object when the calling authority of the first target application to the object is verified to be passed; The first download module is used to download the extension package to the first storage path where the first target application is located; wherein an access permission parameter is set in advance for each object in the extension package, the extension package includes the first access permission parameter of the object, and the first target application includes the second access permission parameter of the object.

9. A Java smart card, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images