Authentication method and terminal device

Abstract

The application provides an authentication method and a terminal device, and relates to the technical field of terminals. The authentication method comprises the following steps: an NFCC generates a response message in response to a verification instruction from a card reader, wherein the response message carries first verification information; the NFCC sends the response message to the card reader; the NFCC receives encrypted second verification information from the card reader; and the NFCC completes authentication interaction with the card reader by using the first verification information, the encrypted second verification information and preset encrypted card information. Since the functions of generating the response message and sending the response message to the card reader are both independently completed by the NFCC without the processor, the response time delay of the terminal device is short. Therefore, the terminal device with the NFC function can be applied to a scene with strict time delay requirements, the application range is wider, the eSE does not need to be installed, the cost is low, and the experience of the user is ensured.

Description

[0001] This application claims priority to Chinese Patent Application No. 202111294528.0, filed on November 3, 2021, entitled "Authentication Method", the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of terminal technology, and in particular to an authentication method and terminal device. Background Technology

[0003] Currently, Near Field Communication (NFC) technology is widely used in terminal devices. Typically, users can bring an NFC-enabled device close to a card reader and authenticate with it. After authentication, the desired function is achieved. For example, a user can bring an NFC-enabled device close to a bus card reader, authenticate with it, and then swipe their bus card. Similarly, a user can bring an NFC-enabled device close to an access control card reader, authenticate with it, and then unlock the access control system.

[0004] Typically, an embedded secure element (eSE) can be integrated into the NFC chip of a terminal device. When the NFC chip of the terminal device receives an authentication command from the card reader, the eSE can send a response message back to the card reader in real time. Thus, the eSE performs authentication interaction with the card reader in a secure environment. However, installing an eSE in a terminal device is costly.

[0005] Alternatively, when the NFC chip in the terminal device receives an authentication command from the card reader, it transmits the authentication command to the terminal device's processor. The terminal device's processor then performs authentication interaction with the card reader by running a host-based card emulation (HCE) application within a rich execution environment (REE). However, the latency for the HCE application running on the REE to send a response message to the card reader is relatively long. In some scenarios with strict latency requirements (such as unlocking access control systems), the response message sent by the HCE application may be mistakenly identified as invalid by the card reader. This prevents the terminal device from completing the authentication interaction with the card reader, resulting in a narrow application scope.

[0006] Thus, current NFC-enabled terminal devices cannot simultaneously achieve both low cost and applicability to scenarios with strict latency requirements. Summary of the Invention

[0007] This application provides an authentication method and a terminal device to improve the problem that terminal devices with NFC function cannot simultaneously achieve both low cost and application in scenarios with strict latency requirements.

[0008] Firstly, this application provides an authentication method applied to a terminal device, the terminal device including a near-field communication controller (NFCC) and a processor. The method includes: the NFCC generating a response message in response to a verification command from a card reader, wherein the response message carries first verification information; the NFCC sending the response message to the card reader; the NFCC receiving encrypted second verification information from the card reader; and the NFCC using the first verification information, the encrypted second verification information, and encrypted preset card information to complete an authentication interaction with the card reader, wherein the preset card information includes a preset card key.

[0009] The authentication method provided in this application independently handles both the generation and transmission of the response message to the reader via NFCC, eliminating the need for a processor. This results in a shorter response latency for the terminal device. Consequently, it meets the reader's preset protocol requirement that the time from the reader issuing the verification command to receiving the response message (i.e., the response latency) must be within a preset duration. Therefore, the response message from the terminal device is recognized as valid by the reader. This enables authentication interaction between the terminal device and the reader. Consequently, NFC-enabled terminal devices can be used in scenarios with strict latency requirements, broadening their application scope, eliminating the need for an eSE, and reducing costs, while maintaining a consistent user experience.

[0010] In one possible implementation, the NFCC uses first verification information, encrypted second verification information, and encrypted preset card information to complete authentication interaction with the card reader, including: the NFCC decrypts the encrypted card information to obtain a preset card key; the NFCC decrypts the second verification information according to the preset card key; the NFCC verifies the card reader based on the second verification information and the first verification information; if the card reader verification is successful, the NFCC encrypts the second verification information based on the preset card key; and the NFCC sends the encrypted second verification information to the card reader, so that the card reader can verify the terminal device based on the received and sent second verification information.

[0011] In one possible implementation, the terminal device is either powered off or powered on.

[0012] In the process described above, NFCC is powered by the field strength of the signal emitted by the card reader. Thus, whether the terminal device is powered on or off, it can complete the authentication interaction with the access control card reader.

[0013] In one possible implementation, before the NFCC generates a response message in response to a verification command from the card reader, the method provided in this application further includes: the processor writing encrypted card information to the NFCC via the TEE. The NFCC caches the encrypted card information.

[0014] Understandably, NFCC caches encrypted card information, ensuring high data security.

[0015] In one possible implementation, the bus used by the processor to communicate with the NFCC in the REE is the same as the bus used by the processor to communicate with the NFCC in the TEE. The method provided in this application further includes: when instructed to communicate with the NFCC via the bus in the TEE, the processor detects whether the bus is in a communication state in the TEE. If it is not in a communication state, the processor locks the bus in the TEE. The processor communicates with the NFCC via the bus in the TEE. After the processor has finished communicating with the NFCC, the processor unlocks the bus.

[0016] This allows the processor to communicate with the NFCC via the same bus without conflict when calling applications running in the REE or calling TAs running in the TEE, and saves resources by reusing a single bus.

[0017] In one possible implementation, the processor communicates with the NFCC via a first bus in the REE and via a second bus in the TEE, with the first and second buses sharing the same GPIO interface of the processor. The method provided in this application further includes: when instructed to communicate with the NFCC via the first bus in the TEE, the processor detects whether the GPIO interface is in a communication state in the TEE. If it is not in a communication state, the processor locks the GPIO interface in the TEE. The processor communicates with the NFCC via the first bus and the GPIO interface in the TEE. After the processor completes communication with the NFCC, the processor unlocks the GPIO interface.

[0018] This ensures that when the processor calls an application running in the REE or a TA running in the TEE, it can communicate with the NFCC through the same CPIO interface without conflict, and saves resources by reusing the same CPIO interface.

[0019] In one possible implementation, the method provided in this application further includes: after the processor establishes an SCP02 / 03 secure channel with the server in the TEE, the processor manages preset card information in response to the user's trigger operation.

[0020] After the processor establishes an SCP02 / 03 secure channel with the server via the TEE, it manages the preset card information, ensuring data security.

[0021] Furthermore, managing preset card information includes: the processor creating preset card information in the TEE before the NFCC generates a response message in response to a verification command from the card reader; and / or the processor activating the preset card information in the TEE; and / or the processor backing up the preset card information to the server in the TEE; and / or the processor downloading the preset card information from the server in the TEE; and / or after the NFCC completes authentication interaction with the card reader using the first verification information, encrypted second verification information, and the preset card information, the processor deleting the preset card information or switching the activated card information in the TEE.

[0022] In one possible implementation, the card reader is an access control card reader, a bus card reader, or a bank card reader.

[0023] Secondly, this application also provides a terminal device, including a processor, an NFCC, and a memory, wherein the memory is used to store code instructions; the NFCC and the processor are used to execute the code instructions, causing the terminal device to perform the authentication method as described in the first aspect or any implementation thereof.

[0024] Thirdly, this application provides a computer-readable storage medium storing instructions that, when executed, cause a computer to perform the authentication method as described in the first aspect or any implementation thereof.

[0025] Fourthly, this application also provides a computer program product, including a computer program that, when run, causes the computer to execute the authentication method as described in the first aspect or any implementation thereof.

[0026] It should be understood that the second to fourth aspects of this application correspond to the technical solutions of the first aspect of this application, and the beneficial effects achieved by each aspect and the corresponding feasible implementation are similar, and will not be repeated here. Attached Figure Description

[0027] Figure 1 Diagram of the operating environment of the terminal device;

[0028] Figure 2 This is a schematic diagram illustrating the interaction between the terminal device and the card reader on the bus.

[0029] Figure 3 This is a signal delay diagram for the access control card reader;

[0030] Figure 4 A schematic diagram of the hardware architecture of the mobile phone 100 provided in this application embodiment;

[0031] Figure 5 One of the operating environment diagrams provided in this application embodiment shows the interaction between the mobile phone 100 and the access control card reader 101.

[0032] Figure 6 One of the interactive flowcharts of the authentication method provided in the embodiments of this application;

[0033] Figure 7 A scene diagram provided in this application embodiment showing a user holding a mobile phone 100 near the access control card reader 101;

[0034] Figure 8 for Figure 6 Further flowchart of S505;

[0035] Figure 9 This is a schematic diagram of the interface of the mobile phone 100 in response to the user's trigger operation and reading the card information stored in the access card 106;

[0036] Figure 10 An interactive flowchart for creating card information using a mobile phone 100 as provided in this application embodiment;

[0037] Figure 11 This is a schematic diagram of the interface of a mobile phone 100 deleting card information in response to a user's trigger operation, as provided in this embodiment of the application.

[0038] Figure 12 This is a schematic diagram of the interface of a mobile phone 100 downloading card information in response to a user's trigger operation, as provided in this embodiment of the application.

[0039] Figures 13-14 The second interactive flowchart of the authentication method provided in the embodiments of this application;

[0040] Figure 15 The third interactive flowchart of the authentication method provided in the embodiments of this application;

[0041] Figure 16 This is a schematic diagram of the interface of a mobile phone 100 activating card information in response to a user's trigger operation, as provided in an embodiment of this application.

[0042] Figure 17 The second diagram shows the operating environment when the mobile phone 100 interacts with the access control card reader 101, as provided in this embodiment of the application.

[0043] Figure 18 The third diagram shows the operating environment when the mobile phone 100 interacts with the access control card reader 101, as provided in this embodiment of the application.

[0044] Figure 19 The fourth diagram shows the operating environment when the mobile phone 100 interacts with the access control card reader 101, as provided in this embodiment of the application.

[0045] Figure 20 This is a schematic diagram of the hardware structure of a terminal device provided in an embodiment of this application;

[0046] Figure 21 This is a schematic diagram of the structure of a chip provided in an embodiment of this application. Detailed Implementation

[0047] To facilitate a clear description of the technical solutions in the embodiments of this application, the terms "first" and "second" are used in the embodiments of this application to distinguish identical or similar items with essentially the same function and effect. For example, the first value and the second value are only used to distinguish different values ​​and do not limit their order. Those skilled in the art will understand that the terms "first" and "second" do not limit the quantity or execution order, and the terms "first" and "second" are not necessarily different.

[0048] It should be noted that, in this application, the terms "exemplary" or "for example" are used to indicate that something is being described as an example, illustration, or illustration. Any embodiment or design described as "exemplary" or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or design solutions. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0049] In this application, "at least one" means one or more, and "more than one" means two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can mean: A alone, A and B simultaneously, or B alone, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0050] Currently, Near Field Communication (NFC) technology is widely used in terminal devices. Typically, users can bring an NFC-enabled terminal device close to a card reader and authenticate with it. After successful authentication, the card reader can then perform the desired function.

[0051] In addition, such as Figure 1As shown, the operating environment of the terminal device's processor when processing data includes a rich execution environment (REE) and a trusted execution environment (TEE). The client application (CA) runs in the REE, and the trusted application (TA) runs in the TEE.

[0052] For example, in a bus card-swiping scenario, when a user's handheld terminal device is brought close to the bus's card reader, such as... Figure 2 As shown, the bus's card reader establishes a short-range communication connection with the terminal device's near field communication controller (NFCC). Subsequently, the terminal device can complete the authentication interaction with the bus's card reader using any of the following methods.

[0053] The first approach involves integrating an embedded eSE into the NFC chip of the terminal device. When the terminal device's NFC chip receives an authentication command from the bus's card reader, the eSE can send a response message back to the bus's card reader in real time. This allows the eSE to perform authentication interaction with the bus's card reader in a secure environment. However, installing an eSE in the terminal device is costly.

[0054] The second method involves the terminal device's NFC chip receiving an authentication command from the bus's card reader, which then transmits the command to the terminal device's processor. The processor then uses the card emulation HCE application within the REE (Remote Access Provider Interface) to send a response message to the bus's card reader, or the terminal device uses a cloud server to do so. This allows for authentication interaction between the terminal device and the card reader; alternatively, the terminal device may use the cloud server to complete the authentication process. However, this method results in a longer delay in the terminal device's response message, meaning the interval between the access control card reader issuing the verification command and receiving the response message exceeds a preset time (e.g., 400µs).

[0055] Typically, bus card readers have relatively low latency requirements; even with intervals exceeding 400µs, they still recognize the received response message as valid. Therefore, the bus card reader can authenticate with the terminal device based on the initial verification information to complete the fare deduction. However, access control card readers have stricter latency requirements, such as… Figure 3 As shown, the time interval between the access card reader issuing the verification command and receiving the response message must be within a certain range. Figure 3The authentication method described above cannot be applied to access control unlocking scenarios because the time interval between the card reader issuing the verification command and receiving the response message must be within a preset time (e.g., 400us).

[0056] In summary, NFC-enabled terminal devices cannot simultaneously achieve both low cost and applicability to scenarios with strict latency requirements.

[0057] In view of this, this application provides an authentication method applied to a terminal device, the terminal device including a near-field communication controller (NFCC) and a processor. The authentication method includes: the NFCC generating a response message in response to a verification command from a card reader. The response message carries first verification information. The NFCC sends the response message to the card reader. The NFCC receives encrypted second verification information from the card reader. Based on the first verification information, the encrypted second verification information, and a preset card key, the NFCC completes the authentication interaction with the card reader.

[0058] As can be seen, in the authentication method provided in this application, after the NFCC responds to the verification command from the card reader, the NFCC directly generates a response message; and the NFCC directly sends the response message to the card reader, without going through a processor, saving time. Furthermore, the interval between the card reader issuing the verification command and receiving the response message is less than a preset time. Thus, even if the card reader has high latency requirements, the response message will be considered valid because the interval is less than the preset time. In this way, the NFCC can receive the encrypted second verification message from the card reader. Then, the NFCC can complete the authentication interaction with the card reader based on the first verification information, the encrypted second verification information, and the preset card key. This allows NFC-enabled terminal devices to be used in scenarios with strict latency requirements, has a wide range of applications, and does not require the installation of an eSE, resulting in low cost.

[0059] It is understood that the aforementioned terminal devices can also be referred to as terminals, user equipment (UE), mobile stations (MS), mobile terminals (MT), etc. Terminal devices can be wearable devices, tablets, computers with wireless transceiver capabilities, virtual reality (VR) terminal devices, augmented reality (AR) terminal devices, and so on. The embodiments of this application do not limit the specific technologies or device forms used in the terminal devices.

[0060] To better understand the embodiments of this application, the structure of the terminal device of this application embodiment is described below. For example, Figure 4 This is a schematic diagram of the structure of a terminal device provided in an embodiment of this application.

[0061] The terminal device may include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, antenna 1, antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a speaker 170A, a receiver 170B, a microphone 170C, a sensor module 180, buttons 190, an indicator 192, a camera 193, and a display screen 194, etc. The sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, a barometric pressure sensor 180C, a magnetic sensor 180D, an accelerometer sensor 180E, a proximity sensor 180F, a proximity light sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, etc.

[0062] It is understood that the structures illustrated in the embodiments of this application do not constitute a specific limitation on the terminal device. In other embodiments of this application, the terminal device may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0063] The processor 110 may include one or more processing units. These processing units may be independent devices or integrated within one or more processors. The processor 110 may also include memory for storing instructions and data.

[0064] USB port 130 is a USB standard compliant interface, which can be a Mini USB port, Micro USB port, USB Type-C port, etc. USB port 130 can be used to connect a charger to charge terminal devices, and can also be used for data transfer between terminal devices and peripheral devices. It can also be used to connect headphones for audio playback. This interface can also be used to connect other electronic devices, such as AR devices.

[0065] The charging management module 140 receives charging input from the charger. The charger can be a wireless charger or a wired charger. The power management module 141 connects the charging management module 140 to the processor 110.

[0066] The wireless communication function of the terminal device can be implemented through antenna 1, antenna 2, mobile communication module 150, wireless communication module 160, modem processor, and baseband processor.

[0067] Antenna 1 and Antenna 2 are used to transmit and receive electromagnetic wave signals. Antennas in terminal equipment can be used to cover one or more communication frequency bands. Different antennas can also be reused to improve antenna utilization.

[0068] The mobile communication module 150 can provide solutions for wireless communication applications including 2G / 3G / 4G / 5G on terminal devices. The mobile communication module 150 may include at least one filter, switch, power amplifier, low noise amplifier (LNA), etc. The mobile communication module 150 can receive electromagnetic waves via antenna 1, and perform filtering, amplification, and other processing on the received electromagnetic waves before transmitting them to a modem processor for demodulation.

[0069] The wireless communication module 160 can provide solutions for wireless communication applications on terminal devices, including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), and near field communication (NFC).

[0070] The terminal device implements display functions through a GPU, a display screen 194, and an application processor. The GPU is a microprocessor for image processing, connecting the display screen 194 and the application processor. The GPU is used to perform mathematical and geometric calculations and for graphics rendering.

[0071] The display screen 194 is used to display images, videos, etc. The display screen 194 includes a display panel. In some embodiments, the terminal device may include one or N display screens 194, where N is a positive integer greater than 1.

[0072] Terminal devices can achieve shooting functions through ISP, camera 193, video codec, GPU, display 194 and application processor.

[0073] Camera 193 is used to capture still images or videos. In some embodiments, the terminal device may include one or N cameras 193, where N is a positive integer greater than 1.

[0074] The external storage interface 120 can be used to connect an external storage card, such as a Micro SD card, to expand the storage capacity of the terminal device. The external storage card communicates with the processor 110 through the external storage interface 120 to perform data storage functions. For example, music, video, and other files can be saved on the external storage card.

[0075] Internal memory 121 can be used to store executable program code, including instructions. Internal memory 121 may include a program storage area and a data storage area.

[0076] The terminal device can implement audio functions such as music playback and recording through an audio module 170, a speaker 170A, a receiver 170B, a microphone 170C, and an application processor.

[0077] Audio module 170 is used to convert digital audio information into analog audio signal output, and also to convert analog audio input into digital audio signal. Speaker 170A, also called a "loudspeaker," is used to convert audio electrical signals into sound signals. Terminal devices can listen to music or make hands-free calls through speaker 170A. Receiver 170B, also called a "handset," is used to convert audio electrical signals into sound signals. When a terminal device answers a phone call or audio message, it can listen to the sound by bringing the receiver 170B close to the user's ear. Microphone 170C, also called a "microphone" or "voice transducer," is used to convert sound signals into electrical signals.

[0078] A pressure sensor 180A is used to sense pressure signals and can convert them into electrical signals. In some embodiments, the pressure sensor 180A may be disposed on the display screen 194. A gyroscope sensor 180B can be used to determine the motion posture of the terminal device. A barometric pressure sensor 180C is used to measure barometric pressure. A magnetic sensor 180D includes a Hall sensor. An accelerometer sensor 180E can detect the magnitude of the acceleration of the terminal device in various directions (generally three axes). A distance sensor 180F is used to measure distance. A proximity sensor 180G may include, for example, a light-emitting diode (LED) and a photodetector, such as a photodiode. An ambient light sensor 180L is used to sense ambient light intensity. A fingerprint sensor 180H is used to collect fingerprints. A temperature sensor 180J is used to detect temperature. A touch sensor 180K, also called a "touch device," may be disposed on the display screen 194, and the touch sensor 180K and the display screen 194 together form a touch screen, also called a "touchscreen." A bone conduction sensor 180M can acquire vibration signals.

[0079] Buttons 190 include a power button, volume buttons, etc. Buttons 190 can be mechanical buttons or touch-sensitive buttons. The terminal device can receive button input and generate key signal inputs related to user settings and function control of the terminal device. Indicator 192 can be an indicator light, used to indicate charging status, battery level changes, messages, missed calls, notifications, etc.

[0080] The software system of terminal devices can adopt layered architecture, event-driven architecture, microkernel architecture, microservice architecture, or cloud architecture, etc., which will not be elaborated here.

[0081] Technical terms involved in this patent:

[0082] REE and TEE: REE can also be called the normal world of the ARM CPU, and TEE can also be called the secure world of the ARM CPU. When CA runs in the user mode of the normal world of the ARM CPU, CA is used to receive input data from the application in the terminal device and pass the received data to TA running in the user mode of the secure world of the ARM CPU, so that TA can perform critical operations, such as fingerprint verification, personal identification number (PIN) verification, and secure storage of private keys or certificates.

[0083] NFCC: This can be understood as a microprocessor (MCU) integrated into the NFC module, which can be used for data processing, transmission, and other functions.

[0084] I2C (Inter-Integrated Circuit) bus: It is a bidirectional two-wire synchronous serial bus that requires only two wires to transmit information between devices connected to the bus.

[0085] SPI bus: Serial Peripheral Interface (SPI) is a high-speed, full-duplex, synchronous communication bus that only occupies four pins on the chip, saving chip pins.

[0086] GPIO interface: General-purpose input / output (GPIO) interface. Its pins can be freely used by the user through program control. The pins of the GPIO interface can be used as general-purpose input (GPI), general-purpose output (GPPO), or general-purpose input and output (GPIO).

[0087] The authentication method provided in this application embodiment will be described below using a mobile phone 100 as the terminal device and an access control card reader 101 as an example. This example does not constitute a limitation on the embodiments of this application. The following embodiments can be combined with each other, and the same or similar concepts or processes will not be described again.

[0088] Among them, such as Figure 5 As shown, the mobile phone 100 includes a processor 102 and an NFCC 103. The processor 102 operates in a Rich Execution Environment (REE) and a Trusted Execution Environment (TEE) when processing data. The client application CA runs in the REE, and the trusted application TA runs in the TEE. The CA can interact with user-interacting wallet applications or access control applications (i.e., target applications) to exchange data. The NFCC 103 is connected to the processor 102 via a bus. Data in the REE can be exchanged with the NFCC 103 via the I2C bus; data in the TEE can be exchanged with the NFCC 103 via the SPI bus. Understandably, before using the mobile phone 100 for access control unlocking, card information needs to be created on the mobile phone 100. The process of creating card information can be referred to in the following text. Figures 9-10 The description of [the specific component] is not provided here. For example... Figure 6 As shown, the authentication method provided in this application includes:

[0089] S501: NFCC103 establishes a short-range communication connection with the access control card reader 101.

[0090] Understandably, such as Figure 7 As shown, when a user wants to unlock the access control system by holding their mobile phone 100, they can bring the mobile phone 100 close to the access control card reader 101. Then, the NFCC 103 can establish a short-range communication connection with the access control card reader 101.

[0091] S502: NFCC103 generates a response message in response to a verification command from the access control reader 101. The response message carries first verification information.

[0092] After the NFCC103 establishes a short-range communication connection with the access control reader 101, the access control reader 101 sends a verification command (i.e., Auth CMD) to the NFCC103. Then, in response to the verification command (i.e., Auth CMD) from the access control reader 101, the NFCC103 generates a response message. This response message carries a first random number "Token RB," which is the first verification message.

[0093] S503: NFCC103 sends a response message to the access control card reader 101.

[0094] S504: NFCC103 receives encrypted second authentication information from the access control reader 101.

[0095] Understandably, after receiving the response information carrying the first random number "Token RB", the access control card reader 101 generates a second random number "Token RA". Then, it encrypts the first random number "Token RB" and the second random number "Token RA" based on a preset card key. Understandably, the encrypted first random number "Token RB" and the second random number "Token RA" constitute the second verification information. Thus, the NFCC 103 can receive the encrypted first random number "Token RB" and the second random number "Token RA" from the access control card reader 101.

[0096] S505: NFCC103 completes authentication interaction with card reader 101 based on the first verification information, encrypted second verification information, and a preset card key. The preset card key is contained within the preset encrypted card information. Before using the preset card key, the card information needs to be decrypted to obtain the preset card key.

[0097] For example, such as Figure 8 As shown, the specific process of S505 above may include: S601: NFCC103 decrypts the second verification information based on a preset card key. If decryption is successful, a first random number "Token RB" and a second random number "Token RA" can be obtained. S602: NFCC103 compares whether the first random number "Token RB" sent by processor 102 is consistent with the first random number "Token RB" received. If they are consistent, the access control card reader 101 is verified. Then, S603: NFCC103 encrypts the second random number "Token RA" based on the preset card key. S605: NFCC103 sends the encrypted second random number "Token RA" to the access control card reader 101. S606: The access control card reader 101 decrypts the encrypted second random number "Token RA" based on the preset card key. If decryption is successful, the access control card reader 101 compares the sent second random number "Token RA" with the received second random number "Token RA". If they match, the verification of the mobile phone 100 is successful. Then, the access control card reader 101 notifies the unlocking module to unlock, completing the access control unlocking function.

[0098] As can be seen, in the above process, the objects executed in S501-S505 are all NFCC103, which is powered by the field strength of the signal emitted by the access control card reader 101. Thus, whether the mobile phone 100 is powered on or off, it can complete the authentication interaction with the access control card reader 101.

[0099] Understandably, the above Figure 6 This describes the authentication process between mobile phone 100's NFCC103 and access control card reader 101, and the authentication process between access control card reader 101 and mobile phone 100. Specifically, it describes the authentication interaction process between mobile phone 100's NFCC103 and card reader 101.

[0100] In summary, in the authentication method provided in this application embodiment, after the NFCC103 of the mobile phone 100 responds to the verification command from the card reader, the NFCC103 directly generates a response message; and the NFCC directly sends the response message to the card reader without going through the processor 102, saving time. Furthermore, the interval between the access control card reader 101 issuing the verification command and receiving the response message is less than a preset time. That is, the latency of the mobile phone 100's response message meets the latency requirements of the access control card reader 101. In this way, the access control card reader 101 will consider the response message valid, and thus, the NFCC103 can receive the encrypted second verification message from the card reader. Therefore, the NFCC103 can complete the authentication interaction with the access control card reader 101 based on the first verification information, the encrypted second verification information, and the preset card key. Thus, the NFC-enabled mobile phone 100 can be applied to scenarios with strict latency requirements, has a wider application range, and does not require the installation of an eSE, resulting in low cost.

[0101] Furthermore, the preset card key mentioned in the above embodiments is content from pre-created card information. Understandably, to improve the security of card information, the processor 102 can establish an SCP02 / 03 secure channel with the server via the TEE, and then the mobile phone 100 manages the card information. The mobile phone 100 can manage card information in the following ways: creating card information, deleting card information, activating card information, backing up card information, and downloading card information. Below, using a "wallet" application as an example, we will introduce how the mobile phone 100 manages card information.

[0102] For example, such as Figure 9As shown in (a), mobile phone 100 displays a system main interface 701, which includes an icon 702 for the "Wallet" application (i.e., the target application). The "Wallet" application runs on the REE of the processor 102 of mobile phone 100. Mobile phone 100 can respond to a user's triggering operation on the "Wallet" application icon 702 and display a first interface 703. Figure 9 As shown in (b) above, the first interface 703 includes a first control 704, which is used to indicate the creation of card information. Figure 9 As shown in (c), the mobile phone 100 can respond to the user's trigger operation on the first control 704, displaying multiple second controls on the first interface 703. Each second control is used to indicate a different card type to be created. The card type can include access cards, public transport cards, bank cards, and car keys, etc., and is not limited here. Thus, the user can bring the access card 706 close to the mobile phone 100. Furthermore, as... Figure 9 As shown in (c), the mobile phone 100 can respond to the user's trigger operation on the second control 705 indicating that the card type is access card, and read the card information stored in the access card 706 via NFCC103.

[0103] Understandably, the above process involves mobile phone 100 responding to the user's trigger operation and reading the card information stored in access card 106. Below, in conjunction with... Figure 10 This section explains how the mobile phone 100 stores and reads card information.

[0104] like Figure 10As shown, S1001: NFCC103 reads the card information stored in access card 106. NFCC103 can write the read card information into the secure memory of the REE running on processor 102 via the I2C bus. Then, S1002: Mobile phone 100 calls the "Wallet" application running on the REE to send a card information creation request (createcard req) to the server of the "Wallet" application. S1003: The "Wallet" application receives the card information creation instruction (create card cmd) from the server of the "Wallet" application. S1004: The "Wallet" application transmits the card information creation command (execute cmd) to the TA located in the TEE via the application programming interface (OM API). The creation instruction (execute cmd) carries the card information. Then, S1005: The TA located in the TEE writes the card information into the secure memory of the TEE, completing the creation of the card information. S1006: The TA located in the TEE sends a feedback message (execute rsp) to the "Wallet" application via the application programming interface. The feedback message (execute rsp) indicates that the card information was created successfully. S1007: The "Wallet" application sends a feedback message (create card CMD rsp) to the "Wallet" application's server to notify the server that the card information was created successfully. Understandably, in the above process, the card information is created and stored in the TEE, thus improving the security of the card information.

[0105] In addition, the successful creation feedback message (create card CMD rsp) can also carry card information. Furthermore, the "wallet" application's server can store this card information to perform a backup of the card information on the "wallet" application's server.

[0106] In other embodiments, such as Figure 11 As shown in (a), the first interface 703 may also include a third control 901, which is used to indicate the deletion of card information. The mobile phone 100 can respond to the user's triggering operation on the third control 901 and display a second interface 902. For example... Figure 11 As shown in (b), the second interface 902 includes multiple fourth controls, each used to indicate the identification of different types of cards. The mobile phone 100 can respond to a user's triggering operation on the fourth control 903 indicating the access card identification, deleting the stored access card information. Figure 11 As shown in (c), after the access card information is deleted, the second interface 902 no longer displays the fourth control 903 indicating the access card identifier.

[0107] In other embodiments, similarly, such as Figure 12 As shown in (a), the second interface 902 also includes a fifth control 1001, which is used to indicate the viewing of deleted card information. The mobile phone 100 also displays a third interface 1002 in response to the user's triggering operation on the fifth control 1001. Figure 12 As shown in (b), the third interface 1002 includes an identifier for a deleted card (i.e., an access card) and a sixth control 1003 located next to the identifier. The mobile phone 100 can respond to a user's triggering operation on the sixth control 1003 by sending a download request for the access card information to the server of the "Wallet" application. Then, the "Wallet" application of the mobile phone 100 receives the access card information from the server of the "Wallet" application, and transmits the card information to the TA located in the TEE through the application interface, thereby storing the card information in the TA located in the TEE. In the above process, the downloaded card information is stored in the TA in the TEE, thus improving the security of the card information. It is understandable that the above... Figure 12 The process described is as follows: In response to the user's operation, the mobile phone 100 downloads the access card information from the access card server of the "Wallet" application.

[0108] In the above embodiments, the default card information is cached in NFCC103 as an example. In other embodiments, the card information may also be cached in processor 102. Please refer to [the relevant documentation]. Figures 13-14 The authentication method provided in this application embodiment can also be implemented in the following manner:

[0109] S1201: Processor 102 receives a power-off signal.

[0110] For example, when the power button of the mobile phone 100 is triggered, the processor 102 of the mobile phone 100 is able to receive the power off signal from the power button.

[0111] S1202: Processor 102 writes card information to NFCC103.

[0112] For example, the TA running in the TEE of the processor 102 of the mobile phone 100 writes card information to the NFCC 103 via the SPI bus.

[0113] S1203: NFCC103 caches card information.

[0114] Understandably, after the processor 102 of the mobile phone 100 transmits the card information to the NFCC 103, the mobile phone 100 is powered off. Understandably, the NFCC 103 caches the card information. Since the mobile phone 100 is powered off, the NFCC 103 can be powered by the field strength of the signal emitted by the access control card reader 101, enabling the NFCC 103 to directly complete authentication interaction with the access control card reader 101 based on the card information.

[0115] Following S1203, NFCC103 continues to execute S501-S505. Among these, Figure 14 S501-S505 and Figure 6 The S501-S505 are the same, so they will not be described again here.

[0116] It should be noted that when the NFCC103 uses the key from the card information to authenticate with the access card reader 101 in S505, the card information needs to be decrypted. As before... Figure 14 As shown, after S505, the method provided in this application embodiment may further include:

[0117] S1204: When the processor receives the power-on signal, it notifies NFCC103 to delete the decrypted card information.

[0118] After the authentication process is complete, the NFCC103 deletes the decrypted card information, thus further ensuring the security of the card information and saving storage space.

[0119] Understandably, Figure 6 In a corresponding embodiment, to further ensure the security of card information, this application embodiment also provides... Figure 15 The corresponding implementation method.

[0120] For example, such as Figure 15 As shown, prior to S501, the method provided in this application embodiment may further include:

[0121] S1301: Processor 102 calls the TA running by TEE to respond to the activation instruction and activate the card information.

[0122] For example, the specific implementation process of S1301 can be as follows: Figure 16 As shown in (a), the second interface 703 of the mobile phone 100 also includes a seventh control 1401, which is used to indicate the activation of the created card information. In response to the user's triggering operation on the seventh control 1401, the mobile phone 100 displays a fourth interface 1402. Figure 16As shown in (b), the fourth interface 1402 includes multiple eighth controls, each used to indicate a different type of card. Furthermore, the "wallet" application running on the REE of the processor 102 can, in response to a user's triggering operation on the eighth control 1403 used to indicate the access card, transmit an activation command to the TA running in the TEE of the processor 102 via the application interface. Thus, the TA running in the TEE of the processor 102 activates the card information of the access card stored in the secure memory of the TEE. Understandably, once the access card information is activated, the mobile phone 100 can use the key in the access card information to complete authentication interaction with the access control card reader 101.

[0123] It should be noted that if other active card information (such as public transport card information) exists in the TEE's secure memory, these other active card information must be put to sleep. This is equivalent to completing the "switch" of active card information.

[0124] S1302: Processor 102 calls the TA running in TEE to encrypt the card information.

[0125] S1303: In processor 102, the TA of TEE writes the encrypted card information to NFCC103.

[0126] Understandably, the NFCC103 can read encrypted card information via the SPI bus.

[0127] S1304: NFCC103 caches encrypted card information.

[0128] Understandably, since the NFCC caches encrypted card information, this ensures the security of the card information. Understandably, caching card information in the NFCC103 allows the NFCC103 to directly complete authentication interactions with the access control card reader 101 based on the card information.

[0129] Furthermore, as Figure 15 As shown, NFCC103 continues to execute S501-S505. Among them, Figure 15 S501-S505 and Figure 6 S501-S505 are the same and will not be described again here. It should be noted that when the NFCC103 uses the key in the card information to authenticate with the access card reader 101 in S505, the card information needs to be decrypted.

[0130] Still Figure 15 As shown, after S505, the method provided in this application embodiment may further include:

[0131] S1305: NFCC103 deletes decrypted card information.

[0132] After the authentication process is complete, the NFCC103 deletes the decrypted card information, thus further ensuring the security of the card information and saving storage space.

[0133] Understandably, in the above embodiments, the examples illustrate how processor 102 communicates with NFCC103 via one of the GIPO interfaces and the I2C bus when calling the "wallet" application running in the REE; and how processor 102 communicates with NFCC103 via another GIPO interface and the SPI bus when calling the TA running in the TEE. In other embodiments, such as Figure 17 As shown, when processor 102 calls TA running in TEE, it can communicate with NFCC103 through another GIPO interface and I2C bus or SWP bus.

[0134] As can be seen, in the above embodiments, the "wallet" application running in the REE and the TA in the TEE communicate with the NFCC103 through different buses and different GIPO interfaces. In other embodiments, such as Figure 18 As shown, when processor 102 calls the "wallet" application running in the REE or the TA running in the TEE, it can also communicate with NFCC103 through the same I2C bus. This saves resources.

[0135] Understandably, in order to prevent conflicts when processor 102 calls the "wallet" application running in the REE or the TA running in the TEE to communicate with NFCC103 via the same I2C bus, processor 102 needs to perform a lock-on lock on the I2C bus in the communication state. The following describes how processor 102 performs a lock-on lock on the I2C bus in the communication state to enable the "wallet" application in the REE to communicate with NFCC103 via the I2C bus, or the TA in the TEE to communicate with NFCC103 via the I2C bus.

[0136] For example, the processor 102 pre-stores a first identifier indicating that the I2C bus is occupied or a second identifier indicating that the I2C bus is idle in the secure memory of the TEE. When the processor 102 needs to call the TA in the TEE to read or write data from the NFCC103 via the I2C bus (e.g., reading an acknowledgment message from the NFCC103, or writing an encrypted second random number "Token RA" to the NFCC103), the processor 102 calls the TA in the TEE to check whether the identifier in the secure memory of the TEE is the second identifier. If it is not the second identifier, it means that the "wallet" application in the REE is communicating with the NFCC103 via the I2C bus, and the TA in the TEE waits until the second identifier is detected. If it is the second identifier, it means that the I2C bus is idle. Then, the TA in the TEE updates the second identifier in the secure memory of the TEE to the first identifier to indicate that the I2C bus is occupied. In this way, the processor 102 can call the TA in the TEE to read or write data from the NFCC103 via the I2C bus. After reading and writing data, the processor will update the first identifier of the secure memory in the TEE to the second identifier to indicate that the I2C bus returns to an idle state.

[0137] Similarly, when the processor 102 needs to read or write data between the "wallet" application in the REE and the NFCC103 via the I2C bus (e.g., reading a card message written to the NFCC103, or writing a deletion instruction to the NFCC103), the processor 102 calls the "wallet" application in the REE to obtain an identifier from the secure memory in the TEE through the application interface. Then, the "wallet" application in the REE checks whether the identifier in the secure memory in the TEE is the second identifier. If it is not the second identifier, it means that the TA in the TEE is communicating with the NFCC103 via the I2C bus, and the "wallet" application in the REE waits until the second identifier is detected. If it is the second identifier, it means that the I2C bus is idle. Then, the "wallet" application in the REE notifies the TA in the TEE to update the second identifier in the secure memory of the TEE to the first identifier to indicate that the I2C bus is occupied. In this way, the "wallet" application in the REE reads and writes data from the NFCC103 via the I2C bus. After reading and writing data is complete, the "Wallet" application in the REE notifies the TA in the TEE to update the first identifier of the secure memory in the TEE to the second identifier, instructing the I2C bus to return to an idle state.

[0138] It should be noted that the first identifier mentioned above can be the string "true" and the second identifier can be the string "false"; or, the first identifier can be the string "false" and the second identifier can be the string "true". Additionally, the first identifier can also be the binary number "1" and the second identifier can be the binary number "0"; or, the first identifier can be the binary number "0" and the second identifier can be the binary number "1", without limitation here.

[0139] In addition, with Figure 18 Unlike the corresponding embodiments, in other embodiments, such as Figure 19 As shown, the "Wallet" application running in the REE and the TA in the TEE can communicate with the NFCC103 through different buses and the same GIPO interface. This also saves resources.

[0140] To prevent conflicts between the "wallet" application in the REE communicating with the NFCC103 via the I2C bus and the TA in the TEE communicating with the NFCC103 via the I2C bus, the processor 102 can also lock the GIPO interface of the processor 102. The method by which the processor locks the GIPO interface is the same as described above. Figure 16 The principle of locking the I2C bus in the communication state is the same in the corresponding embodiment, and will not be repeated here.

[0141] Furthermore, the above embodiment is illustrated using the card reader 101 for access control as an example. The card reader provided in this application embodiment can also be a bus card reader, a bank card reader, or a vehicle card reader, etc., which will not be elaborated here.

[0142] In addition, the triggering operation mentioned in the above-described authentication method provided in the embodiments of this application may include: click operation, long press operation, and gesture triggering operation, etc., which are not limited here.

[0143] In addition, after the mobile phone 100 sends a response message to the card reader 101 of the access control system, it can also perform functions such as data reading and writing, data addition and subtraction, data recovery, and data transmission, which are not limited here.

[0144] For example, Figure 20 This is a schematic diagram of the hardware structure of a terminal device provided in an embodiment of this application, such as... Figure 20 As shown, the terminal device includes a processor 2001, a communication line 2004, an NFCC 2006, and at least one communication interface. Figure 20 (The example provided uses the communication interface 2003 as an example.)

[0145] The processor 2001 may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits used to control the execution of the program of the present application.

[0146] The communication line 2004 may include circuitry for transmitting information between the aforementioned components.

[0147] Communication Interface 2003 uses any transceiver-like device for communicating with other devices or communication networks, such as Ethernet, wireless local area networks (WLAN), etc.

[0148] Possibly, the terminal device may also include a memory 2002.

[0149] The memory 2002 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. The memory may exist independently and be connected to the processor via communication line 2004. The memory may also be integrated with the processor.

[0150] The memory 2002 is used to store computer execution instructions for executing the scheme of this application, and the execution is controlled by the processor 2001.

[0151] It is possible that the computer execution instructions in the embodiments of this application may also be referred to as application code, and the embodiments of this application do not specifically limit this.

[0152] In a specific implementation, as one example, the processor 2001 may include one or more CPUs, for example... Figure 20 CPU0 and CPU1 in the CPU.

[0153] In a specific implementation, as one example, the terminal device may include multiple processors, for example... Figure 20 The processors mentioned are processor 2001 and processor 2005. Each of these processors can be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. Here, "processor" can refer to one or more devices, circuits, and / or processing cores used to process data (such as computer program instructions).

[0154] In a specific implementation, as one example, NFCC2006 can be an MCU (microprocessor) in an NFC chip, capable of short-range communication with a card reader. NFCC2006 executes computer-defined instructions stored in memory 2002 to implement the authentication method provided in this application embodiment.

[0155] For example, in response to a verification command from a card reader, the NFCC2006 generates a response message, which carries first verification information. The NFCC2006 then sends the response message to the card reader. The NFCC2006 receives encrypted second verification information from the card reader. Using the first verification information, the encrypted second verification information, and encrypted preset card information, the NFCC2006 completes the authentication interaction with the card reader. The preset card information includes a preset card key.

[0156] For example, Figure 21 This is a schematic diagram of a chip structure provided in an embodiment of this application. Chip 210 includes one or more (including two) processors 2110, a communication interface 2130, and an NFCC 2150.

[0157] In some implementations, memory 2140 stores elements such as executable modules or data structures, or subsets thereof, or extended sets thereof.

[0158] In this embodiment, memory 2140 may include read-only memory and random access memory, and provides instructions and data to processor 2110. A portion of memory 2140 may also include non-volatile random access memory (NVRAM).

[0159] In this embodiment, the memory 2140, the communication interface 2130, and the memory 2140 are coupled together via a bus system 2120. The bus system 2120 may include a data bus, a power bus, a control bus, and a status signal bus, in addition to the data bus. For ease of description, in... Figure 21The general labeled all buses as Bus System 2120.

[0160] The methods described in the embodiments of this application can be applied to NFCC2150, or NFCC2150 and processor 2110.

[0161] The NFCC2150 and processor 2110 may be integrated circuit chips with signal processing capabilities. In implementation, the steps of the above methods can be completed by the NFCC2150, or by integrated logic circuitry in the hardware of the NFCC2150 and processor 2110, or by instructions in software form. The processor 2110 may be a general-purpose processor (e.g., a microprocessor or conventional processor), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gates, transistor logic devices, or discrete hardware components. The processor 2110 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this invention.

[0162] The steps of the method disclosed in the embodiments of this application can be directly embodied in hardware decoding of NFCC2150, or executed by NFCC2150 and processor 2110, or executed by a combination of hardware and software modules in the decoding processor. The software modules can be located in mature storage media in the art, such as random access memory, read-only memory, programmable read-only memory, or electrically erasable programmable read-only memory (EEPROM). This storage medium is located in memory 2140, NFCC2150, or NFCC2150 and processor 2110 read information from memory 2140 and combine it with hardware to complete the steps of the above method.

[0163] In the above embodiments, the instructions stored in the memory for execution by the processor can be implemented in the form of a computer program product. This computer program product can be pre-written into the memory, or it can be downloaded and installed into the memory as software.

[0164] A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a server or data center that integrates one or more available media. For example, available media may include magnetic media (e.g., floppy disks, hard disks, or magnetic tapes), optical media (e.g., digital versatile discs (DVDs)), or semiconductor media (e.g., solid-state disks (SSDs)).

[0165] This application also provides a computer-readable storage medium. The methods described in the above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any combination thereof. The computer-readable medium may include computer storage media and communication media, and may also include any medium capable of transferring a computer program from one place to another. The storage medium can be any target medium accessible by a computer.

[0166] As one possible design, computer-readable media may include compact disc read-only memory (CD-ROM), RAM, ROM, EEPROM, or other optical disc storage; computer-readable media may also include disk storage or other disk storage devices. Furthermore, any connecting cable may also be appropriately referred to as computer-readable media. For example, if software is transmitted from a website, server, or other remote source using coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave, then coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of media. As used herein, disks and optical discs include optical discs (CD), laser discs, optical discs, digital versatile discs (DVD), floppy disks, and Blu-ray discs, where disks typically reproduce data magnetically, while optical discs optically reproduce data using lasers.

[0167] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. An authentication method characterized by, The method is applied to a terminal device in a shutdown state or a startup state, and the terminal device comprises a near field communication controller (NFCC) and a processor, and the method comprises the following steps: The NFCC generates a response message in response to a verification instruction from a card reader, wherein the response message carries first verification information; The NFCC sends the response message to the card reader; the card reader sends a verification instruction to the terminal device within an interval of less than or equal to 400us; The NFCC receives encrypted second verification information from the card reader; The NFCC completes authentication interaction with the card reader by using the first verification information, the encrypted second verification information and encrypted preset card information, wherein the preset card information comprises a preset card key; and the card information is cached in the NFCC, or the processor writes the card information into the NFCC after receiving a shutdown signal.

2. The method of claim 1, wherein, The NFCC completes authentication interaction with the card reader by using the first verification information, the encrypted second verification information and encrypted preset card information, comprising: The NFCC decrypts the encrypted card information to obtain the preset card key; The NFCC decrypts the second verification information according to the preset card key; The NFCC verifies the card reader according to the second verification information and the first verification information; If the card reader is verified, the NFCC encrypts the second verification information based on the preset card key; The NFCC sends the encrypted second verification information to the card reader, so that the card reader verifies the terminal device according to the received second verification information and the sent second verification information.

3. The method of claim 1, wherein, Before the NFCC generates a response message in response to a verification instruction from a card reader, the method further comprises: The processor writes encrypted card information into the NFCC in a TEE; The NFCC caches the encrypted card information.

4. The method of claim 1, wherein, The processor communicates with the NFCC in a REE through a bus which is the same as a bus through which the processor communicates with the NFCC in a TEE, and the method further comprises: In a case where the processor is instructed to communicate with the NFCC through the bus in the TEE, the processor detects whether the bus is in a communication state in the TEE; If not, the processor locks the bus in the TEE; The processor communicates with the NFCC through the bus in the TEE; After the processor finishes communicating with the NFCC, the processor unlocks the bus.

5. The method of claim 1, wherein, The processor communicates with the NFCC through a first bus in a REE, the processor communicates with the NFCC through a second bus in a TEE, and the first bus and the second bus share a same GPIO interface of the processor, and the method further comprises: in response to being instructed to communicate with the NFCC in the TEE via the first bus, the processor detects in the TEE whether the GPIO interface is in a communication state; if not, the processor locks the GPIO interface in the TEE; the processor communicates with the NFCC in the TEE via the first bus and the GPIO interface; after the processor finishes communicating with the NFCC, the processor unlocks the GPIO interface.

6. The method according to any one of claims 1 to 5, characterized in that, The method further comprises: after the processor establishes an SCP02 / 03 secure channel with a server in the TEE, the processor manages the preset card information in response to a user's triggering operation.

7. The method of claim 6, wherein, The management of the preset card information comprises: before the NFCC generates a response message in response to a verification instruction from a card reader, the processor creates the preset card information in the TEE; and / or the processor activates the preset card information in the TEE; and / or the processor backs up the preset card information to a server in the TEE; and / or the processor downloads the preset card information from a server in the TEE; and / or after the NFCC completes an authentication interaction with the card reader using the first verification information, the encrypted second verification information, and the preset card information, the processor deletes the preset card information or switches the activated card information in the TEE.

8. The method according to any one of claims 1 to 5, characterized in that, The card reader is a card reader for access control, a card reader for a bus, or a card reader for a bank card.

9. A terminal device, comprising: A terminal device comprising a processor, an NFCC, and a memory for storing code instructions; the NFCC and the processor are configured to run the code instructions, so that the terminal device performs the authentication method of any one of claims 1-8.

10. A computer-readable storage medium, characterized in that, A computer readable storage medium storing instructions that, when executed, cause a computer to perform the authentication method of any one of claims 1-8.

11. A computer program product, characterised in that, A computer program that, when executed, causes a computer to perform the authentication method of any one of claims 1-8.

Images