Data processing method, device, equipment and system

Abstract

The present application embodiment provides a data processing method, device, equipment and system, the method including: a third-party application receives an electronic payment request, generates transaction dynamic data, and obtains a first request message; the third-party application sends the first request message and the transaction dynamic data to the IFAA TA; when the IFAA TA verifies that the first request message is legal, the transaction dynamic data is sent to the SE; the IFAA TA receives the signature result returned by the SE, and the signature result is obtained by the SE using the first digital certificate to sign the transaction dynamic data; the IFAA TA generates a first response message based on the signature result, and sends the first response message to the third-party application; the third-party application initiates electronic payment based on the first response message. The present application embodiment can improve the security of users using the payment client in the electronic device to make electronic payments, thereby improving the user experience.

Description

Technical Field

[0001] The present application relates to the field of communications, and in particular to a data processing method, apparatus, device, and system. Background Art

[0002] Currently, electronic payments are becoming increasingly popular, and using applications on electronic devices (eg, mobile phones) to make electronic payments has become one of the main ways people make payments in their daily lives.

[0003] However, when users use applications on electronic devices to make electronic payments, the security of payment data is poor, and payment data leakage is prone to occur, affecting user experience. Summary of the Invention

[0004] The present application provides a data processing method, apparatus, device, and system that can improve the security of users making electronic payments using applications in electronic devices, thereby enhancing the user experience.

[0005] In a first aspect, an embodiment of the present application provides a data processing method, which is applied to an electronic device, wherein the electronic device includes a REE system and a TEE system, wherein the REE system includes: a third-party application, the TEE system includes: an IFAA TA, and the electronic device further includes: an SE, wherein the SE pre-stores a first digital certificate; including:

[0006] The third-party application receives the electronic payment request, generates transaction dynamic data, and obtains a first request message, wherein the first request message is used to request the use of the first digital certificate to sign the transaction dynamic data;

[0007] The third-party application sends the first request message and the transaction dynamic data to the IFAA TA;

[0008] When the IFAA TA verifies that the first request message is legitimate, it sends the transaction dynamic data to the SE;

[0009] The IFAA TA receives the signature result returned by the SE, where the signature result is obtained by the SE signing the transaction dynamic data using the first digital certificate;

[0010] The IFAA TA generates a first response message according to the signature result, and sends the first response message to the third-party application;

[0011] The third-party application initiates electronic payment according to the first response message.

[0012] In this method, the SE manages digital certificates and signs transaction dynamic data, thereby improving the security of users making electronic payments using applications in electronic devices and thus enhancing user experience.

[0013] In a possible implementation, obtaining the first request message includes:

[0014] The third-party application sends a first request message to the third-party server, where the first request message is used to request the first request message;

[0015] The third-party application receives the first request message sent by the third-party server. The third-party server sends the first request message to the IFAA server, and after receiving the first request message returned by the IFAA server, sends the first request message to the third-party application.

[0016] In a possible implementation, the IFAA TA verifies that the first request message is legitimate, including:

[0017] The IFAA TA uses a preset second digital certificate to verify the legitimacy of the first request message, and obtains a verification result that the first request message is legal.

[0018] In a possible implementation, the IFAA TA generates a first response message according to the signature result, including:

[0019] The IFAA TA signs the signature result using a preset second digital certificate, and generates a first response message using the signed data.

[0020] In one possible implementation, the REE system further includes: an IFAA application;

[0021] The third-party application sends the first request message and the transaction dynamic data to the IFAA TA, including:

[0022] The third-party application sends the first request message and the transaction dynamic data to the IFAA application;

[0023] The IFAA application sends the first request message and the transaction dynamic data to the IFAA TA via the third-party application.

[0024] In one possible implementation, the TEE system further includes: biometric verification TA;

[0025] Before the IFAA TA sends the transaction dynamic data to the SE, it also includes:

[0026] The IFAA TA sends a biometric verification request to the biometric verification TA;

[0027] The IFAATA receives the verification result sent by the biometric verification TA, and the verification result is sent after the biometric verification TA completes the biometric verification;

[0028] The IFAA TA determines that the verification result is verified passed.

[0029] In one possible implementation, the third-party application initiating electronic payment according to the first response message includes:

[0030] The third-party application sends a first response message to the third-party server;

[0031] The third-party application receives the electronic payment result sent by the third-party server, and the third-party server sends the electronic payment result after sending the first response message to the first IFAA server and receiving the electronic payment result returned by the IFAA server.

[0032] In a second aspect, an embodiment of the present application provides a data processing device, which is applied to an electronic device, wherein the electronic device includes: a REE module and a TEE module, and the electronic device also includes: an SE, in which a first digital certificate is pre-stored; the device includes: a third-party application unit provided in the REE module, and an IFAA TA unit provided in the TEE module; wherein,

[0033] The third-party application unit is configured to: receive an electronic payment request, generate transaction dynamic data, and obtain a first request message, wherein the first request message is used to request the use of the first digital certificate to sign the transaction dynamic data; and send the first request message and the transaction dynamic data to the IFAA TA unit;

[0034] The IFAA TA unit is configured to: upon verifying the legitimacy of the first request message, send the transaction dynamic data to the SE; receive a signature result returned by the SE, where the signature result is obtained by the SE signing the transaction dynamic data using the first digital certificate; generate a first response message based on the signature result, and send the first response message to the third-party application unit;

[0035] The third-party application unit is further used to initiate electronic payment according to the first response message.

[0036] In a possible implementation, the third-party application unit is configured to obtain the first request message, including:

[0037] The third-party application unit is used to: send a first request message to a third-party server, where the first request message is used to request the first request message; receive the first request message sent by the third-party server, and the third-party server sends the first request message to the IFAA server, and then sends the first request message to the third-party application after receiving the first request message returned by the IFAA server.

[0038] In a possible implementation, the IFAA TA unit is configured to verify the legitimacy of the first request message, including:

[0039] The IFAA TA unit is used to use a preset second digital certificate to verify the legitimacy of the first request message, and obtain a verification result that the first request message is legal.

[0040] In a possible implementation, the IFAA TA unit is configured to generate a first response message according to the signature result, including:

[0041] The IFAA TA unit is used to sign the signature result using a preset second digital certificate, and generate a first response message using the signed data.

[0042] In a possible implementation, the device further includes: an IFAA application unit provided in the REE module; the IFAA application unit is connected to the third-party application unit and the IFAA TA unit respectively;

[0043] The third-party application unit is used to send the first request message and the transaction dynamic data to the IFAA TA unit, including:

[0044] The third-party application unit is used to send the first request message and the transaction dynamic data to the IFAA TA unit via the IFAA application unit.

[0045] In a possible implementation, the device further includes: an IFAA management module provided in the REE module, and a TA entry module provided in the TEE module;

[0046] The third-party application unit is used to send the first request message and the transaction dynamic data to the IFAA TA unit via the IFAA application unit, including:

[0047] The third-party application unit is configured to send the first request message and the transaction dynamic data to the IFAA TA unit via the IFAA application unit, the IFAA management module, and the TA entry module.

[0048] In one possible implementation, the apparatus further includes: a biometric verification unit disposed in the TEE module;

[0049] The IFAA TA unit is further configured to: send a biometric verification request to the biometric verification unit;

[0050] The biometric verification unit is used to: perform biometric verification and send the verification result to the IFAA TA unit after completing the biometric verification;

[0051] The IFAA TA unit is further configured to determine that the verification result is a passed verification.

[0052] In a possible implementation, the third-party application unit is configured to initiate electronic payment according to the first response message, including:

[0053] The third-party application unit is used to: send a first response message to the third-party server, receive the electronic payment result sent by the third-party server, and the third-party server sends the electronic payment result after sending the first response message to the first IFAA server and receiving the electronic payment result returned by the IFAA server.

[0054] In a third aspect, an embodiment of the present application provides a data processing system, comprising: the data processing device described in any one of the second aspects, and further comprising: a third-party server and an IFAA server.

[0055] In a fourth aspect, an embodiment of the present application provides an electronic device, including:

[0056] One or more processors; a memory; and one or more computer programs, wherein the one or more computer programs are stored in the memory, and the one or more computer programs include instructions that, when executed by the device, cause the device to perform any of the methods described in the first aspect.

[0057] In a fifth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, which, when executed on a computer, enables the computer to execute any of the methods described in the first aspect.

[0058] In a sixth aspect, the present application provides a computer program, which, when executed by a computer, is used to execute the method described in the first aspect.

[0059] In one possible design, the program in the sixth aspect may be stored in whole or in part on a storage medium packaged with the processor, or may be stored in whole or in part on a memory not packaged with the processor. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0061] Figure 1 A flowchart of an electronic payment method in the prior art;

[0062] Figure 2 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0063] Figure 3 A schematic diagram of the structure of the SE provided in an embodiment of the present application;

[0064] Figure 4 A schematic diagram of the software structure of the REE system provided in an embodiment of the present application;

[0065] Figure 5 A schematic diagram of the software structure of the TEE system provided in an embodiment of the present application;

[0066] Figure 6 A schematic diagram of a system architecture provided in an embodiment of the present application;

[0067] Figure 7 This is a flow chart of an embodiment of the data processing method of the present application;

[0068] Figure 8 This is a flow chart of another embodiment of the data processing method of the present application;

[0069] Figure 9 This is a schematic structural diagram of an embodiment of a data processing device of the present application;

[0070] Figure 10 This is a structural diagram of another embodiment of the data processing device of the present application. DETAILED DESCRIPTION

[0071] The terms used in the implementation section of this application are only used to explain the specific embodiments of this application and are not intended to limit this application.

[0072] Figure 1A kind of electronic payment method is provided, specifically, when third-party client (3rd Part Client) receives the electronic payment initiated by user, payment request is sent to Internet Finance Identity Authentication Alliance (Internet Finance AuthenticationAlliance, IFAA) client, payment request is sent to fingerprint trusted application (TrustedApplication, TA) by IFAA client via IFAA system framework layer, TA entrance, IFAA verification module (IFAA Authenticator), TA underlying interface, user fingerprint is obtained and verified by fingerprint TA, verification result is obtained, verification result and fingerprint ID information are sent to IFAA verification module by fingerprint TA, IFAA verification module encrypts verification result, the encrypted data obtained are sequentially passed through TA entrance, IFAA system framework layer, IFAA client are sent to third-party client, payment data and encrypted data are sent to third-party server by third-party client, encrypted data are sent to IFAA server by third-party server and verified, if the result returned by IFAA server is verification passed through, then payment operation is performed between third-party client and third-party server.

[0073] It can be seen that the security of payment data transmitted to a third-party server in the above-mentioned electronic payment is low, and payment data leakage is prone to occur, affecting the user experience.

[0074] To this end, this application proposes a data processing method to improve the security of electronic payment and thereby enhance the user experience.

[0075] The electronic device of the embodiment of the present application may be a mobile phone, a PAD, a wearable device (for example, a watch, glasses, etc.), etc.

[0076] Figure 2 This is a structural diagram of an electronic device according to an embodiment of the present application. Figure 2 As shown, the electronic device 200 includes a processor 210 and a transceiver 220. Optionally, the electronic device 200 may further include a memory 230. The processor 210, the transceiver 220, and the memory 230 may communicate with each other via internal connection paths to transmit control and / or data signals. The memory 230 is used to store computer programs, and the processor 210 is used to call and execute the computer programs from the memory 230.

[0077] The above-mentioned memory 230 can be a read-only memory (ROM), other types of static storage devices that can store static information and instructions, random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer.

[0078] Optionally, the electronic device 200 may further include an antenna 240 for transmitting the wireless signal output by the transceiver 220 .

[0079] The processor 210 and the memory 230 may be combined into a single processing device, or more commonly, they are independent components. The processor 210 is configured to execute program code stored in the memory 230 to implement the aforementioned functions. In a specific implementation, the memory 230 may also be integrated into the processor 210 or independent of the processor 210.

[0080] In addition, in order to make the functions of the electronic device 200 more complete, the electronic device 200 may further include an input unit 260, a display unit 270, a fingerprint collection unit 250, a SE 280, etc. The display unit 270 may include a display screen.

[0081] SE280 can be packaged in various forms, most commonly smart cards and embedded security modules (eSEs). SE280 is used to store a preset digital certificate and use it to sign dynamic transaction data for electronic payment. For ease of distinction, the digital certificate preset in SE280 is referred to as the first digital certificate in this embodiment of the application.

[0082] like Figure 3 As shown, IFAA auxiliary security domain (IFAA Supplementary SecurityDomain, IFAA SSD) can be set in SE, and IFAA security application (IFAA Applet) is run in IFAA SSD, and IFAA security application is used to sign the transaction dynamic data of electronic payment using the first preset digital certificate.

[0083] The electronic device in the embodiment of the present application can run two software systems, namely the Rich Execution Environment (REE) system and the Trusted Execution Environment (TEE) system. The REE system and the TEE system are logically isolated, can run simultaneously, and can exchange data between them. The following is an exemplary description of the implementation of the above two software systems.

[0084] The REE system may be a general operating system, such as an Android system, an iOS system, etc. Taking the layered architecture Android system as an example, the software structure of the REE system is exemplified.

[0085] In one embodiment, Figure 4 As shown in FIG, the Android system can be divided into four layers, which are the application layer, the application framework layer, the hardware abstraction layer (HAL), and the kernel layer (Kernel) from top to bottom.

[0086] The application layer can include several applications. The application layer of the embodiment of the present application includes: a third-party payment application and an IFAA application. A third-party payment application is an application that requests electronic payment, such as a food ordering application or a shopping application. An IFAA application is an application used to complete electronic payment.

[0087] The application framework layer provides application programming interface (Application Programming Interface, API) and programming framework for the application of application layer, including various components and services to support the Android development of developers. The application embodiment application framework layer includes IFAA manager, which is used as the interface of application in REE system access TEE system.

[0088] The HAL layer is an interface layer between the operating system kernel and the hardware circuit, and may include, for example, an audio hardware abstraction layer (Audio HAL).

[0089] The kernel layer is the layer between hardware and software. The kernel layer may include display drivers, etc.

[0090] The TEE system is in a secure environment (trust zone). In one embodiment, Figure 5 As shown, the TEE system is implemented in a layered architecture, including: application layer and kernel layer;

[0091] The application layer may include several applications, and the applications in the TEE system may be called trusted applications (TA). In the embodiment of the present application, the application layer of the TEE system includes: TA entry, fingerprint TA and IFAA TA.

[0092] TA entry is the application access interface in the TEE system, which can be used with Figure 3 Data is exchanged between the IFAA managers shown in the figure, thereby realizing data transmission between applications in the REE system and applications in the TEE system.

[0093] Fingerprint TA is used to collect and verify user fingerprints.

[0094] The IFAA TA is used to exchange information with the fingerprint TA and can also be used to encrypt or decrypt information using a preset digital certificate. To distinguish it from the digital certificate preset in the SE, the digital certificate used in the IFAA TA is called the second digital certificate. The IFAA TA can also access the SE in the above-mentioned electronic device and exchange data with the SE.

[0095] The kernel layer is the layer between hardware and software. In the embodiment of the present application, the kernel layer of the TEE system may include: TA bottom interface, fingerprint collection driver and fingerprint library access driver.

[0096] The TA underlying interface is used to connect to the TA at the application layer and enable data transmission between the two TAs. Data exchange between two TAs in a TEE system cannot be performed at the application layer and must be achieved through the TA underlying interface. Optionally, the TA underlying interface can encapsulate or parse data using BIO communication.

[0097] The fingerprint collection driver is used to drive the fingerprint collection unit 250 to obtain the fingerprint information of the user collected by the fingerprint collection unit 250.

[0098] The electronic device's memory may pre-store a fingerprint library, which includes several fingerprint templates. The fingerprint templates are fingerprint information of users with payment authority. The fingerprint library access driver is used to read the fingerprint templates in the fingerprint library.

[0099] When performing fingerprint verification, the fingerprint TA can obtain the user's fingerprint information from the fingerprint collection driver, obtain the fingerprint template in the fingerprint library from the fingerprint library access driver, and compare the user's fingerprint information with the fingerprint module one by one. If the similarity between the user's fingerprint information and a certain fingerprint template exceeds the preset threshold, the fingerprint verification is successful, otherwise, the fingerprint verification fails.

[0100] It should be noted that the above fingerprint verification is only an example. The TEE system can also support other biometric verifications, such as facial feature verification, etc. At this time, the application layer can set the facial feature verification TA, and the kernel layer can set the corresponding facial feature acquisition driver (camera driver), and facial feature library access driver, etc., which will not be listed one by one here.

[0101] The above-mentioned TEE end can provide security features and ensure that sensitive operations are performed in a trusted environment.

[0102] In combination with the structure and software architecture of the above-mentioned electronic device, the embodiment of the present application provides a schematic diagram of a system architecture applicable to the data processing method of the present application, such as Figure 6 Shown, including:

[0103] Electronic device 61, third-party server 62, IFAA server 63, IFAA certification center 64, certificate issuing certification authority (CA) 65, service provider trusted service management platform (SP-TSM) 66, SE provider trusted service management platform (SEI-TSM) 67. Among them,

[0104] The electronic device 61 includes: REE terminal, TEE terminal and SE, wherein:

[0105] The REE side corresponds to the REE system, and includes: third-party applications, IFAA applications, and IFAA manager;

[0106] The TEE side corresponds to the TEE system, and the TEE side includes: TA entrance, IFAA TA, TA underlying interface, and fingerprint TA;

[0107] SE can exchange data with IFAA TA.

[0108] The third-party server 62 is a server set up by the provider of the third-party application in the electronic device and used to support the third-party application service.

[0109] IFAA server 63: a server set up by the provider of the IFAA application in the electronic device to support IFAA application services.

[0110] The IFAA certification center 64 is used to issue digital certificates to the IFAA TA in the electronic device, so that the IFAA TA in the electronic device can use the digital certificates. The IFAA certification center can communicate with the certificate issuing CA and the IFAA SP-TSM respectively.

[0111] The CA65 is an e-commerce certification authority, responsible for issuing and managing digital certificates. It can be used to issue and manage public key certificates for CSRs generated by users in the IFAA Applet within SE.

[0112] The certificate issuing CA65 can issue a root certificate. The IFAA certification center generates a corresponding second digital certificate for the IFAATA in the electronic device based on the root certificate, generates a first digital certificate for the IFAA security application in the SE, and so on.

[0113] The IFAA SP-TSM66 is the provider of the IFAA security application within the SE and is responsible for managing the lifecycle of the IFAA security application. Specifically, the IFAA SP-TSM66 can update the lifecycle of the IFAA security application. This updated data can be transmitted to the IFAA security application via the IFAA Certification Center, the IFAA server, the IFAA application, and the IFAA TA.

[0114] SEI-TSM67 is a platform for trusted service management of the SE lifecycle in electronic devices.

[0115] The data processing method of the embodiment of the present application is described in more detail below in combination with the above system architecture and the structure of the electronic device.

[0116] Figure 7 This is a flow chart of an embodiment of the data processing method of this application, as shown in FIG. Figure 6 As shown, the method may include:

[0117] Step 701: The third-party application receives an electronic payment request, generates transaction dynamic data, and obtains a first request message, wherein the first request message is used to request the use of a first digital certificate to sign the transaction dynamic data;

[0118] Step 702: The third-party application sends the first request message and transaction dynamic data to the IFAA TA;

[0119] Step 703: When the IFAA TA verifies that the first request message is legitimate, it sends the transaction dynamic data to the SE;

[0120] Step 704: The IFAA TA receives the signature result returned by the SE. The signature result is obtained by the SE signing the transaction dynamic data using the first digital certificate.

[0121] Step 705: The IFAA TA generates a first response message based on the signature result and sends the first response message to the third-party application;

[0122] Step 706: The third-party application initiates electronic payment according to the first response message.

[0123] Figure 7 In the method shown, the SE signs the transaction dynamic data, and the IFAA TA generates a first response message based on the signature result, so that the third-party application initiates electronic payment based on the first response message, thereby ensuring the security of the transaction dynamic data, improving the security of users using third-party applications in electronic devices to make electronic payments, and thus improving the user experience.

[0124] The following combination Figure 6 The data processing method of this application is described in more detail. Figure 8 As shown, the data processing method includes:

[0125] Step 801: A third-party application generates transaction dynamic data.

[0126] The user enters the electronic payment interface in the third-party application and clicks the "Confirm Payment" control displayed in the interface. The third-party application receives the payment request and generates transaction dynamic data in response to the payment request.

[0127] Transaction dynamic data may include, but is not limited to: payment amount, identifier of the IFAA application used for payment, user identifier of the payer, and user identifier of the payee.

[0128] Step 802: Apply for signature using IFAA SE digital certificate.

[0129] The third-party application sends a request message to the third-party server. The request message is used to apply for signature using the IFAA SE digital certificate. The request message may include: the identifier of the IFAA application used for the payment.

[0130] Step 803: The third-party server forwards the request message to the IFAA server.

[0131] The third-party server may forward the request message to the IFAA server corresponding to the IFAA application according to the identifier of the IFAA application.

[0132] Step 804: The IFAA server generates an IFAA SE digital certificate signature request message.

[0133] The IFAA SE digital certificate signature request message is used to request IFAA SE to sign a digital certificate.

[0134] Optionally, the IFAA server may store a public key corresponding to the second digital certificate in the IFAA TA, and generate an IFAA SE digital certificate signature request message according to the public key.

[0135] Step 805: The IFAA server returns the IFAA SE digital certificate signature request message to the third-party server.

[0136] Step 806: The third-party server returns the IFAA SE digital certificate signature request message to the third-party application.

[0137] Step 807: The third-party application sends the IFAA SE digital certificate signature request message, transaction dynamic data and application instructions to the IFAA application.

[0138] The application instruction is used to request IFAA TA to perform fingerprint verification and signature of transaction dynamic data.

[0139] Step 808: The IFAA application sends the IFAA SE digital certificate signature request message, transaction dynamic data and application instructions to the IFAA TA.

[0140] The IFAA SE digital certificate signature request message and transaction dynamic data can be transmitted to the IFAA TA through the IFAA manager and TA portal in sequence.

[0141] Step 809: The IFAA TA verifies the legitimacy of the IFAA SE digital certificate signature request message and obtains transaction dynamic data and application instructions.

[0142] The IFAA TA can use the private key in the second digital certificate to verify the legitimacy of the IFAA SE digital certificate signature request message.

[0143] Step 810: The IFAA TA sends a fingerprint verification request message to the fingerprint TA. The fingerprint verification request message is used to request the fingerprint TA to perform fingerprint verification.

[0144] Step 811: Fingerprint TA performs fingerprint verification.

[0145] The IFAA TA can collect the user's fingerprint information through the fingerprint collection driver on the TEE side, and obtain the fingerprint template pre-stored in the fingerprint library through the fingerprint library access driver. It then performs fingerprint verification on the user's fingerprint information based on the fingerprint template to obtain a fingerprint verification result. The fingerprint verification result can include: verification passed or verification failed.

[0146] Step 812: The fingerprint TA sends the fingerprint verification result to the IFAA TA.

[0147] Step 813: The IFAA TA sends the signature instruction and transaction dynamic data to the IFAA security application.

[0148] In the embodiment of the present application, the fingerprint verification result is taken as an example. If the fingerprint verification is passed, the IFAA TA sends a signature instruction and transaction dynamic data to the IFAA security application.

[0149] It should be noted that if the fingerprint verification result is failure, the IFAA TA can directly feedback the fingerprint verification failure information to the IFAA application, and the IFAA application can feedback the fingerprint verification failure information to the third-party application, thereby ending the current electronic payment. This is not detailed here.

[0150] Step 814: The IFAA security application responds to the signature instruction and signs the transaction dynamic data according to the first digital certificate to obtain a signature result.

[0151] Step 815: The IFAA security application returns the signature result to the IFAA TA.

[0152] Step 816: The IFAA TA returns an IFAA SE digital certificate signature response message to the IFAA application.

[0153] The IFAA TA receives the signature result, generates an IFAA SE digital certificate signature response message based on the signature result, and returns the IFAA SE digital certificate signature response message to the IFAA application.

[0154] Optionally, the IFAA TA may use the private key in the second digital certificate to sign the signature result to obtain the above-mentioned IFAA SE digital certificate signature response message.

[0155] Step 817: The IFAA application returns an IFAA SE digital certificate signature response message to the third-party application.

[0156] Step 818: The third-party application sends an IFAA SE digital certificate signature response message to the third-party server.

[0157] Step 819: The third-party server sends an IFAA SE digital certificate signature response message to the IFAA server.

[0158] Step 820: The IFAA server verifies the legitimacy of the IFAA SE digital certificate signature response message. If the verification result is legal, the electronic payment is completed according to the transaction dynamic data.

[0159] Specifically, the IFAA server can use the public key corresponding to the second digital certificate to decrypt the IFAA SE digital certificate signature response message to obtain a signature result, and then use the public key corresponding to the first digital certificate to decrypt the above signature result to obtain transaction dynamic data, thereby completing electronic payment according to the transaction dynamic data.

[0160] Step 821: The IFAA server returns the payment result to the third-party server.

[0161] The payment results may include: payment successful, payment failed.

[0162] Step 822: The third-party server receives the payment result.

[0163] It is understood that some or all of the steps or operations in the above embodiments are merely examples, and the present application embodiments may also perform other operations or variations of various operations. In addition, the various steps may be performed in a different order than those presented in the above embodiments, and it is possible that not all of the operations in the above embodiments need to be performed.

[0164] Figure 9 This is a structural diagram of an embodiment of the data processing device of the present application, which is applied to an electronic device, wherein the electronic device includes: a REE module and a TEE module, and the electronic device also includes: an SE, in which a first digital certificate is pre-stored; the device 900 includes: a third-party application unit 910 provided in the REE module, and an IFAA TA unit 920 provided in the TEE module; wherein,

[0165] The third-party application unit 910 is configured to: receive an electronic payment request, generate transaction dynamic data, and obtain a first request message, wherein the first request message is used to request the use of a first digital certificate to sign the transaction dynamic data; and send the first request message and the transaction dynamic data to the IFAA TA unit;

[0166] The IFAA TA unit 920 is configured to: upon verifying the legitimacy of the first request message, send the transaction dynamic data to the SE; receive the signature result returned by the SE, where the signature result is obtained by the SE signing the transaction dynamic data using the first digital certificate; generate a first response message based on the signature result, and send the first response message to the third-party application unit;

[0167] The third-party application unit 910 is further configured to initiate electronic payment according to the first response message.

[0168] Alternatively, as Figure 10 As shown, an IFAA security application unit 980 may be provided in the SE to sign transaction dynamic data.

[0169] Optionally, the third-party application unit 910 is configured to obtain the first request message, which may include:

[0170] The third-party application unit 910 is used to: send a first request message to the third-party server, where the first request message is used to request a first request message; receive the first request message sent by the third-party server, and the third-party server sends the first request message to the IFAA server. After receiving the first request message returned by the IFAA server, the third-party server sends the first request message to the third-party application.

[0171] Optionally, the IFAA TA unit 920 is configured to verify the legitimacy of the first request message, including:

[0172] The IFAA TA unit is used to use a preset second digital certificate to verify the legitimacy of the first request message, and obtain a verification result that the first request message is legal.

[0173] Optionally, the IFAA TA unit 920 is configured to generate a first response message according to the signature result, including:

[0174] The IFAA TA unit 920 is configured to sign the signature result using a preset second digital certificate, and generate a first response message using the signed data.

[0175] Alternatively, as Figure 10 As shown, the data processing device may further include: an IFAA application unit 930 provided in the REE module; the IFAA application unit 930 is connected to the third-party application unit 910 and the IFAA TA unit 920 respectively;

[0176] The third-party application unit 910 is used to send the first request message and transaction dynamic data to the IFAA TA unit, which may include:

[0177] The third-party application unit 910 is configured to send the first request message and transaction dynamic data to the IFAA TA unit via the IFAA application unit.

[0178] Optionally, the device further includes: an IFAA management module 940 provided in the REE module, and a TA entry module 950 provided in the TEE module;

[0179] The third-party application unit 910 is configured to send the first request message and transaction dynamic data to the IFAA TA unit via the IFAA application unit, including:

[0180] The third-party application unit 910 is configured to send the first request message and transaction dynamic data to the IFAA TA unit 920 via the IFAA application unit 930 , the IFAA management module 940 , and the TA entry module 950 .

[0181] Alternatively, as Figure 9As shown, the device may further include: a biometric verification unit 960 provided in the TEE module;

[0182] The IFAA TA unit 920 is further configured to: send a biometric verification request to the biometric verification unit;

[0183] The biometric verification unit 960 is used to: perform biometric verification and send the verification result to the IFAA TA unit after completing the biometric verification;

[0184] The IFAA TA unit 920 is further configured to determine that the verification result is verification passed.

[0185] Alternatively, as Figure 9 As shown, the device may further include: a TA bottom layer interface unit 970, which is connected to the biometric verification unit 960 and the IFAA TA unit 920 respectively, so as to realize communication between the biometric verification unit 960 and the IFAA TA unit 920.

[0186] Optionally, the third-party application unit 910 is configured to initiate electronic payment according to the first response message, which may include:

[0187] The third-party application unit 910 is used to: send a first response message to the third-party server, receive the electronic payment result sent by the third-party server, and the third-party server sends the electronic payment result after sending the first response message to the first IFAA server and receiving the electronic payment result returned by the IFAA server.

[0188] Figure 9 The device provided in the embodiment shown can be used to implement the present application Figures 3 to 5 The technical solution of the method embodiment shown, its implementation principle and technical effects can be further referred to the relevant description in the method embodiment.

[0189] It should be understood that the above Figures 6 and 7The division of the various modules of the device shown is only a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. And these modules can all be implemented in the form of software calling through processing elements; they can also all be implemented in the form of hardware; some modules can also be implemented in the form of software calling through processing elements, and some modules can be implemented in the form of hardware. For example, the third-party application unit can be a separately established processing element, or it can be integrated in a chip of an electronic device. The implementation of other modules is similar. In addition, these modules can be fully or partially integrated together, or they can be implemented independently. For example, the above-mentioned data processing device can be a chip or a chip module, or the above-mentioned data transmission device can be a part of a chip or a chip module. In the implementation process, each step of the above-mentioned method or each of the above modules can be completed by the hardware integrated logic circuit in the processor element or the instructions in the form of software.

[0190] For example, the above modules may be one or more integrated circuits configured to implement the above methods, such as one or more application-specific integrated circuits (ASICs), one or more digital signal processors (DSPs), or one or more field programmable gate arrays (FPGAs). For another example, these modules may be integrated together to implement a system-on-a-chip (SOC).

[0191] The present application also provides a data processing system, comprising: the data processing device described in the above embodiment, and also comprising: a third-party server and an IFAA server.

[0192] The present application also provides an electronic device, comprising: one or more processors; a memory; and one or more computer programs, wherein the one or more computer programs are stored in the memory, and the one or more computer programs include instructions, which, when executed by the device, enable the device to execute the method described in any of the above embodiments.

[0193] The present application also provides an electronic device, the device comprising a storage medium and a central processing unit, the storage medium may be a non-volatile storage medium, the storage medium stores a computer executable program, the central processing unit is connected to the non-volatile storage medium, and executes the computer executable program to implement the present application Figures 1 to 5 The method provided by the illustrated embodiment.

[0194] The embodiment of the present application also provides a computer-readable storage medium, which stores a computer program, which, when executed on a computer, enables the computer to execute the present application. Figures 1 to 5 The method provided by the illustrated embodiment.

[0195] The present invention also provides a computer program product, which includes a computer program that, when executed on a computer, enables the computer to execute the present invention. Figures 1 to 5 The method provided by the illustrated embodiment.

[0196] In the embodiments of the present application, "at least one" refers to one or more, and "more" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent the existence of A alone, the existence of A and B at the same time, and the existence of B alone. Among them, A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b and c can represent: a, b, c, a and b, a and c, b and c or a and b and c, where a, b, c can be single or multiple.

[0197] Those skilled in the art will appreciate that the various units and algorithm steps described in the embodiments disclosed herein can be implemented using a combination of electronic hardware, computer software, and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0198] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0199] In the several embodiments provided in this application, if any function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of this application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory; hereinafter referred to as: ROM), random access memory (Random Access Memory; hereinafter referred to as: RAM), magnetic disk or optical disk, and other media that can store program code.

[0200] The above description is merely a specific embodiment of the present application. Any person skilled in the art may easily conceive of variations or substitutions within the technical scope disclosed in this application, and such variations or substitutions shall be within the scope of protection of this application. The scope of protection of this application shall be subject to the scope of protection of the claims.

Claims

1. A data processing method, applied to an electronic device, wherein the electronic device includes a REE system and a TEE system, wherein the REE system includes: A third-party application, wherein the TEE system includes an IFAA TA, and the electronic device further includes an SE, wherein the SE pre-stores a first digital certificate; wherein the SE is provided with an IFAA security application; and wherein the method includes: The third-party application receives the electronic payment request, generates transaction dynamic data, and obtains a first request message, wherein the first request message is used to request the use of the first digital certificate to sign the transaction dynamic data; The third-party application sends the first request message and the transaction dynamic data to the IFAA TA; The IFAA TA uses a preset second digital certificate to verify the legitimacy of the first request message. When the verification result is that the first request message is legal, the transaction dynamic data is sent to the IFAA security application in the SE; The IFAA TA receives the signature result returned by the IFAA security application, where the signature result is obtained by the IFAA security application signing the transaction dynamic data using the first digital certificate; The IFAA TA signs the signature result using a preset second digital certificate, generates a first response message using the signed data, and sends the first response message to the third-party application; The third-party application initiates electronic payment according to the first response message.

2. The method according to claim 1, characterized in that The obtaining of the first request message includes: The third-party application sends a first request message to the third-party server, where the first request message is used to request the first request message; The third-party application receives the first request message sent by the third-party server. The third-party server sends the first request message to the IFAA server, receives the first request message returned by the IFAA server, and then sends the first request message to the third-party application.

3. The method according to claim 1 or 2, characterized in that The REE system also includes: an IFAA application; The third-party application sends the first request message and the transaction dynamic data to the IFAA TA, including: The third-party application sends the first request message and the transaction dynamic data to the IFAA application; The IFAA application sends the first request message and the transaction dynamic data to the IFAA TA via the third-party application.

4. The method according to claim 1 or 2, characterized in that The TEE system further includes: a biometric verification TA; Before the IFAA TA sends the transaction dynamic data to the IFAA security application in the SE, the method further includes: The IFAA TA sends a biometric verification request to the biometric verification TA; The IFAA TA receives the verification result sent by the biometric verification TA, and the verification result is sent after the biometric verification TA completes the biometric verification; The IFAA TA determines that the verification result is verified passed.

5. The method according to claim 1 or 2, characterized in that The third-party application initiating electronic payment according to the first response message includes: The third-party application sends a first response message to the third-party server; The third-party application receives the electronic payment result sent by the third-party server, and the third-party server sends the electronic payment result after sending the first response message to the first IFAA server and receiving the electronic payment result returned by the IFAA server.

6. A data processing device, applied to an electronic device, the electronic device comprising: REE module and TEE module, the electronic device further includes: SE, the SE pre-stored with a first digital certificate; characterized in that the SE is provided with an IFAA security application; the device includes: a third-party application unit provided in the REE module, and an IFAA TA unit provided in the TEE module; wherein, The third-party application unit is configured to: receive an electronic payment request, generate transaction dynamic data, and obtain a first request message, wherein the first request message is used to request the use of the first digital certificate to sign the transaction dynamic data; and send the first request message and the transaction dynamic data to the IFAA TA unit; The IFAA TA unit is used to verify the legitimacy of the first request message using a preset second digital certificate. When the verification result is that the first request message is legal, the transaction dynamic data is sent to the IFAA security application in the SE; the signature result returned by the IFAA security application is received, and the signature result is obtained by the IFAA security application using the first digital certificate to sign the transaction dynamic data; the signature result is signed using the preset second digital certificate, the data obtained using the signature generate a first response message, and the first response message is sent to the third-party application unit; The third-party application unit is further used to initiate electronic payment according to the first response message.

7. The device according to claim 6, characterized in that The third-party application unit is configured to obtain a first request message, including: The third-party application unit is used to: send a first request message to a third-party server, where the first request message is used to request the first request message; receive the first request message sent by the third-party server, and the third-party server sends the first request message to the IFAA server, and after receiving the first request message returned by the IFAA server, sends the first request message to the third-party application.

8. The device according to claim 6 or 7, characterized in that The device further includes: an IFAA application unit provided in the REE module; the IFAA application unit is connected to the third-party application unit and the IFAA TA unit respectively; The third-party application unit is configured to send the first request message and the transaction dynamic data to the IFAATA unit, including: The third-party application unit is used to send the first request message and the transaction dynamic data to the IFAA TA unit via the IFAA application unit.

9. The device according to claim 8, characterized in that The device further includes: an IFAA management module provided in the REE module, and a TA entry module provided in the TEE module; The third-party application unit is used to send the first request message and the transaction dynamic data to the IFAA TA unit via the IFAA application unit, including: The third-party application unit is configured to send the first request message and the transaction dynamic data to the IFAA TA unit via the IFAA application unit, the IFAA management module, and the TA entry module.

10. The device according to claim 6 or 7, characterized in that The device further includes: a biometric verification unit disposed in the TEE module; The IFAA TA unit is further configured to: send a biometric verification request to the biometric verification unit; The biometric verification unit is used to: perform biometric verification and send the verification result to the IFAA TA unit after completing the biometric verification; The IFAA TA unit is further configured to determine that the verification result is a passed verification.

11. The device according to claim 8, characterized in that The third-party application unit is configured to initiate electronic payment according to the first response message, including: The third-party application unit is configured to send a first response message to a third-party server and receive an electronic payment result sent by the third-party server. The third-party server sends the electronic payment result after sending the first response message to a first IFAA server and receiving the electronic payment result returned by the IFAA server.

12. The device according to claim 9, characterized in that The third-party application unit is configured to initiate electronic payment according to the first response message, including: The third-party application unit is configured to send a first response message to a third-party server and receive an electronic payment result sent by the third-party server. The third-party server sends the electronic payment result after sending the first response message to a first IFAA server and receiving the electronic payment result returned by the IFAA server.

13. A data processing system, characterized in that: include: The data processing device according to any one of claims 6 to 12, further comprising: a third-party server and an IFAA server.

14. An electronic device, characterized in that: include: one or more processors; Memory; and one or more computer programs, wherein the one or more computer programs are stored in the memory, and the one or more computer programs include instructions that, when executed by the processor, cause the electronic device to perform the method according to any one of claims 1 to 5.

15. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed on a computer, enables the computer to execute the method according to any one of claims 1 to 5.

Images