Card application communication method and system

Abstract

The present disclosure relates to the field of communication technology, and in particular to a card application communication method and system. The method is applied to a software development kit, and includes: receiving a communication connection request for a card application sent by a business application; sending the configuration information of the business application to a server, so that the server generates a first feature code according to the configuration information; in response to receiving a write result sent by the server, sending an identity authentication request to a terminal operating system, so that the terminal operating system establishes a communication channel with the card application when the comparison result between the first feature code and the second feature code meets the authentication requirements, wherein the write result is used to indicate that the first feature code has been written to the access control file corresponding to the card application, the identity authentication request includes the configuration information, and the second feature code is generated by the terminal according to the configuration information. The present disclosure using the above scheme can open the card capabilities to all APPs.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to a card application communication method and system. Background Art

[0002] As the Universal Subscriber Identity Module (USIM) plays an increasingly important role in daily life, many new applications (APPs) hope to use the functions of the USIM, which requires the APP to communicate with the card application in the USIM card.

[0003] In the related art, the signature of the APP needs to be written into the access control (AC) file corresponding to the card application when the card is made, so that the APP can communicate normally with the card application. If the signature of the APP is not written into the AC file, the APP cannot communicate with the card application. Due to the limited capacity of the AC file, only the signatures of some APPs can be written into the AC file, resulting in only some APPs being able to communicate with the card application. The card capabilities cannot be opened to all APPs, and more APPs cannot be supported for access, resulting in poor scalability. Summary of the invention

[0004] The present disclosure proposes a card application communication method and system to enable card capabilities to be opened to all APPs.

[0005] According to a first aspect of an embodiment of the present disclosure, a card application communication method is proposed, which is applied to a software development kit, including:

[0006] Receiving a communication connection request for a card application sent by a business application;

[0007] Sending configuration information of the business party application to a server, so that the server generates a first feature code according to the configuration information;

[0008] In response to receiving the writing result sent by the server, an identity authentication request is sent to the terminal operating system, so that the terminal operating system establishes a communication channel with the card application when the comparison result between the first feature code and the second feature code meets the authentication requirements, wherein the writing result is used to indicate that the first feature code has been written to the access control file corresponding to the card application, the identity authentication request includes the configuration information, and the second feature code is generated by the terminal according to the configuration information.

[0009] According to a second aspect of an embodiment of the present disclosure, a card application communication method is proposed, which is applied to a server and includes:

[0010] Receive configuration information of the business party application sent by the software development kit;

[0011] Generate a first feature code according to the configuration information;

[0012] The first feature code is sent to the card application corresponding to the configuration information.

[0013] According to a third aspect of an embodiment of the present disclosure, a card application communication method is proposed, which is applied to a terminal operating system, including:

[0014] Receiving an identity authentication request for a business party application sent by a software development kit, wherein the identity authentication request includes configuration information of the business party application;

[0015] Determine the card application corresponding to the identity authentication request, and obtain a first feature code from an access control file corresponding to the card application, wherein the first feature code is generated by the server according to the configuration information;

[0016] A second feature code is generated according to the configuration information, and a communication channel with the card application is established when a comparison result between the first feature code and the second feature code meets an authentication requirement.

[0017] According to a fourth aspect of the embodiments of the present disclosure, a software development kit is provided, characterized in that it includes:

[0018] The transceiver module is used to receive the communication connection request for the card application sent by the business party application;

[0019] The transceiver module is further used to send the configuration information of the business party application to the server, so that the server generates a first feature code according to the configuration information;

[0020] The transceiver module is further used to send an identity authentication request to the terminal operating system in response to receiving a write result sent by the server, so that the terminal operating system establishes a communication channel with the card application when the comparison result between the first feature code and the second feature code meets the authentication requirements, wherein the write result is used to indicate that the first feature code has been written to the access control file corresponding to the card application, the identity authentication request includes the configuration information, and the second feature code is generated by the terminal according to the configuration information.

[0021] According to a fifth aspect of an embodiment of the present disclosure, a server is provided, including:

[0022] The transceiver module is used to receive the configuration information of the business party application sent by the software development kit;

[0023] A processing module, configured to generate a first feature code according to the configuration information;

[0024] The transceiver module is further configured to send the first feature code to the card application corresponding to the configuration information.

[0025] According to a sixth aspect of an embodiment of the present disclosure, a terminal operating system is provided, including:

[0026] A transceiver module, configured to receive an identity authentication request for a business party application sent by a software development kit, wherein the identity authentication request includes configuration information of the business party application;

[0027] The transceiver module is further used to determine the card application corresponding to the identity authentication request, and obtain a first feature code from an access control file corresponding to the card application, wherein the first feature code is generated by the server according to the configuration information;

[0028] A processing module is used to generate a second feature code according to the configuration information, and establish a communication channel with the card application when a comparison result between the first feature code and the second feature code meets the authentication requirement.

[0029] According to a seventh aspect of the embodiments of the present disclosure, a business application is proposed, including:

[0030] one or more processors;

[0031] The business party application is used to execute the card application communication method as described in any one of the first aspects.

[0032] According to an eighth aspect of an embodiment of the present disclosure, a server is provided, including:

[0033] one or more processors;

[0034] Wherein, the server is used to execute the card application communication method as described in any one of the second aspects.

[0035] According to a ninth aspect of an embodiment of the present disclosure, a terminal operating system is provided, including:

[0036] one or more processors;

[0037] Wherein, the terminal operating system is used for the card application communication method as described in any one of the third aspects.

[0038] According to the tenth aspect of an embodiment of the present disclosure, a card application communication system is proposed, comprising: a business party application, a software development kit, a card application, a terminal operating system, and a server, wherein the software development kit is configured to implement the card application communication method as described in any one of the first aspect, the server is configured to implement the card application communication method as described in any one of the second aspect, and the terminal operating system is configured to implement the card application communication method as described in any one of the third aspect.

[0039] According to the eleventh aspect of the embodiments of the present disclosure, a storage medium is proposed which stores instructions. When the instructions are executed on a communication device, the communication device executes the card application communication method as described in any one of the first aspect, the second aspect or the third aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The above and / or additional aspects and advantages of the present disclosure will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0041] Figure 1 A flowchart of a card application communication method provided by an embodiment of the present disclosure;

[0042] Figure 2 A flowchart of a card application communication method provided by another embodiment of the present disclosure;

[0043] Figure 3 A flowchart of a card application communication method provided by another embodiment of the present disclosure;

[0044] Figure 4 An interactive schematic diagram of a card application communication method provided by an embodiment of the present disclosure;

[0045] Figure 5 A schematic diagram of the structure of a software development kit provided by an embodiment of the present disclosure;

[0046] Figure 6 A schematic diagram of the structure of a server provided by an embodiment of the present disclosure;

[0047] Figure 7 A schematic diagram of the structure of a terminal operating system provided by an embodiment of the present disclosure;

[0048] Figure 8 A schematic diagram of the structure of a card application communication system provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0049] The present disclosure proposes a card application communication method and system to optimize the card application communication service.

[0050] According to a first aspect of the embodiment of the present disclosure, a card application communication method is proposed, such as Figure 1 As shown, it is applied to the software development kit, including:

[0051] S1001, receiving a communication connection request for a card application sent by a business application;

[0052] S1002, sending configuration information of the business party application to the server, so that the server generates a first feature code according to the configuration information;

[0053] S1003, in response to receiving the writing result sent by the server, sending an identity authentication request to the terminal operating system, so that the terminal operating system establishes a communication channel with the card application when the comparison result between the first feature code and the second feature code meets the authentication requirement, wherein the writing result is used to indicate that the first feature code has been written to the access control file corresponding to the card application, the identity authentication request includes configuration information, and the second feature code is generated by the terminal according to the configuration information.

[0054] In the above embodiment, by introducing a software development kit and a server, the first feature code is written into the AC file, and the permission of the APP is checked according to the first feature code and the second feature code, thereby achieving the technical effect of opening the card capabilities to all APPs without writing the signature of the APP into the AC file of the card application when making the card, thereby avoiding the problem that the card application cannot support access to all APPs due to the AC file capacity, and can effectively promote the promotion of USIM card services and promote the opening of USIM card capabilities to the outside world.

[0055] In conjunction with some embodiments of the first aspect, in some embodiments, sending configuration information of the business party application to the server includes:

[0056] Read the configuration information of the business party's application program, and encrypt the configuration information to obtain encrypted configuration information;

[0057] Send encrypted configuration information to the server.

[0058] In the above embodiment, by encrypting the configuration information and sending the encrypted configuration information to the server, the security of communication can be improved.

[0059] In conjunction with some embodiments of the first aspect, in some embodiments, the configuration information includes an application identifier, application identity information, an application key, and an application private key, the application identity information includes an application signature, the communication connection request includes a card application identifier corresponding to the card application, and the configuration information is encrypted to obtain the encrypted configuration information, including:

[0060] Obtaining the international mobile subscriber identity code corresponding to the card application, the terminal parameters corresponding to the terminal operating system, and the first current timestamp;

[0061] Generate a random factor according to the terminal parameters, the first current timestamp and the application signature, and use the random factor to symmetrically encrypt the card application identifier, the application key, the application identifier and the application identity information to obtain the first symmetrically encrypted information;

[0062] Put the first symmetric encrypted information into the request body, perform a hash operation on the first symmetric encrypted information to obtain a summary content, and use the software development kit private key to asymmetrically encrypt the summary content to obtain a digital signature;

[0063] Generate a session identifier, and use the application private key to symmetrically encrypt the digital signature, the terminal parameter, the first current timestamp, the application signature, the session identifier, and the international mobile subscriber identity code to obtain second symmetrically encrypted information;

[0064] The request header and the request body are asymmetrically encrypted using the server public key to obtain encrypted configuration information, wherein the request header includes the second symmetrical encryption information and the application identifier.

[0065] In the above embodiment, the configuration information of the business party application is obtained by using a software development kit, and the configuration information is combined with the terminal parameters and timestamp. The terminal parameters, the first current timestamp and the application signature are used to correspond to the random factor of this communication connection request, and the configuration information is encrypted using the random factor. Since the random factor is randomly generated, it can be guaranteed that the encryption key is different each time. Even if the encryption key of a certain request is cracked, the encryption key of other requests cannot be obtained, which ensures the data security problem when the software development kit sends the APP information to the server, and further improves the technical implementation of controlling the APP permissions through the software development kit and the server. Encryption is performed using the application private key, which only exists in the business party application and the server and will not be exposed to the outside world. In addition, the use of asymmetric encryption for further protection can improve the security of the data transmission process.

[0066] In conjunction with some embodiments of the first aspect, in some embodiments, the method further includes:

[0067] receiving a comparison result sent by the terminal operating system;

[0068] The comparison result is sent to the business application, so that the business application sends the target instruction to the card application through the software development kit and the communication channel.

[0069] According to a second aspect of the embodiment of the present disclosure, a card application communication method is proposed, such as Figure 2 As shown, it is applied to the server and includes:

[0070] S2001, receiving configuration information of a business party application sent by a software development kit;

[0071] S2002, generating a first feature code according to the configuration information;

[0072] S2003: Send the first feature code to the card application corresponding to the configuration information.

[0073] In the above embodiment, by introducing a software development kit and a server, and performing permission verification on the APP according to the first feature code, it is possible to achieve the technical effect of opening the card capabilities to all APPs without writing the APP signature into the AC file of the card application when making the card, thereby avoiding the problem that the card application cannot support access to all APPs due to the AC file capacity, and can effectively promote the promotion of USIM card services and promote the opening of USIM card capabilities to the outside world.

[0074] In conjunction with some embodiments of the second aspect, in some embodiments, receiving configuration information of a business party application sent by a software development kit includes:

[0075] Receive encrypted configuration information of the business party application sent by the software development kit;

[0076] Performing data parsing on the encrypted configuration information to obtain parsed configuration information;

[0077] The parsed configuration information is subjected to data verification, and when the data verification result meets the data verification requirement, the parsed configuration information is determined to be the configuration information of the business party application.

[0078] In the above embodiment, the security and accuracy of configuration signal acquisition can be improved by parsing and verifying the information.

[0079] In conjunction with some embodiments of the second aspect, in some embodiments, data parsing is performed on the encrypted configuration information to obtain the parsed configuration information, including:

[0080] Decrypt the application identifier and the second symmetric encrypted information from the request header of the encrypted configuration information using the server private key, and decrypt the first symmetric encrypted information from the request body of the encrypted configuration information;

[0081] Searching the application identifier in the database, obtaining the application private key corresponding to the application identifier, and using the application private key to decrypt the second symmetrically encrypted information to obtain the digital signature, the terminal parameters corresponding to the terminal operating system, the first current timestamp, the application signature, the session identifier, and the international mobile subscriber identity code corresponding to the card application;

[0082] Performing a hash operation on the first symmetrically encrypted information to obtain a summary content, and using the software development kit public key to decrypt the digital signature to obtain a decrypted content;

[0083] When the decrypted content and the summary content are consistent, determine the random factor corresponding to the terminal parameters, the first current timestamp, and the application signature, and use the random factor to decrypt the first symmetric encryption information to obtain the card application identifier and the parsed configuration information, wherein the parsed configuration information includes the application key, the application identifier, and the application identity information.

[0084] In conjunction with some embodiments of the second aspect, in some embodiments, before searching the database for the application identifier, the method further includes:

[0085] Receiving a permission application request for a card application sent by a business application, wherein the permission application request includes application identity information;

[0086] Determine the application ID, application key, application private key corresponding to the permission application request, the card application ID corresponding to the card application, and the card application access permission information between the business party application and the card application;

[0087] The application identity information, application identifier, application key, application private key, card application identifier and card application access permission information are stored in the database, and the application identifier, application key and application private key are sent to the business party application.

[0088] In the above embodiment, by storing application identity information, application identifier, application key, application private key, card application identifier and card application access permission information in a database, the communication permissions between the APP and the card application can be dynamically managed, and more comprehensive management of the APP communication permissions can be achieved.

[0089] In conjunction with some embodiments of the second aspect, in some embodiments, performing data verification on the parsed configuration information includes:

[0090] Searching the database for application identity information, application key, and card application access permission information between the business party application and the card application corresponding to the application identifier;

[0091] If the application identity information and application key found in the database are consistent with the application identity information and application key in the parsed configuration information, and the card application access permission information indicates that there is communication permission between the business party application and the card application, the data verification result is determined to meet the data verification requirements.

[0092] In the above embodiment, by performing data verification according to the application identity information and the application key, the accuracy of obtaining the data verification result can be improved.

[0093] In conjunction with some embodiments of the second aspect, in some embodiments, generating the first feature code according to the configuration information includes:

[0094] Performing a hash operation on the international mobile subscriber identity code, the application identifier, the application key, the application identity information, the card application identifier, and the session identifier to obtain a first hash operation value;

[0095] Obtaining a second current timestamp, and determining a first time feature value corresponding to the second current timestamp;

[0096] A first feature code is generated according to the first hash operation value and the first time feature value.

[0097] In the above embodiment, since the first timestamp and the session identifier are used as part of the generation process when calculating the first feature code, the first feature code generated for each request is different, which can improve the security of communication.

[0098] In combination with some embodiments of the second aspect, in some embodiments, generating a first feature code according to the first hash operation value and the first time feature value includes:

[0099] Performing a hash message authentication code operation on the first hash operation value and the first time characteristic value to obtain a first character string;

[0100] Starting from the subscript offset of the first string, characters of the first target length are intercepted to obtain a second string, wherein the subscript offset is determined by the characters corresponding to the first target number of digits in the first string;

[0101] Convert the second string into a third string, wherein the second string is a string in the first base and the third string is a string in the second base;

[0102] Starting from the second target digit number of the third character string, characters of a second target length are intercepted to obtain a fourth character string, and the fourth character string is converted into a fifth character string, wherein the fifth character string is a character string of the first base;

[0103] If the number of digits of the fifth character string is less than the digit threshold, a zero padding operation is performed on the fifth character string until the number of digits of the fifth character string is equal to the digit threshold, thereby obtaining a first feature code.

[0104] In the above embodiment, by performing a hash message authentication code operation on the first hash operation value and the first time feature value and performing multi-step processing on the first character string to generate the first feature code, the difficulty of cracking the first feature code can be increased, and the security of communication can be improved.

[0105] In conjunction with some embodiments of the second aspect, in some embodiments, sending the first feature code to the card application corresponding to the configuration information includes:

[0106] Send a data SMS to the global user identity card corresponding to the card application, so that the global user identity card sends the link establishment address and port number in the data SMS to the terminal operating system;

[0107] A card application processing request is sent to a global user identity card via a communication link, wherein the communication link is established by a terminal operating system according to a link establishment address and a port number, and the card application processing request includes a card application identifier and an application protocol data unit instruction, and the application protocol data unit instruction includes a first feature code.

[0108] According to a third aspect of the embodiment of the present disclosure, a card application communication method is proposed, such as Figure 3 As shown, it is applied to the terminal operating system, including:

[0109] S3001, receiving an identity authentication request for a business party application sent by a software development kit, wherein the identity authentication request includes configuration information of the business party application;

[0110] S3002, determining the card application corresponding to the identity authentication request, and obtaining a first feature code from an access control file corresponding to the card application, wherein the first feature code is generated by the server according to configuration information;

[0111] S3003: Generate a second feature code according to the configuration information, and establish a communication channel with the card application if the comparison result between the first feature code and the second feature code meets the authentication requirement.

[0112] In the above embodiment, by introducing a software development kit and a server, and performing permission verification on the APP according to the first feature code and the second feature code, it is possible to achieve the technical effect of opening the card capabilities to all APPs without writing the signature of the APP into the AC file of the card application when making the card, thereby avoiding the problem that the card application cannot support access to all APPs due to the AC file capacity, and can effectively promote the promotion of USIM card services and promote the opening of USIM card capabilities to the outside world.

[0113] In combination with some embodiments of the third aspect, in some embodiments, the identity authentication request further includes a session identifier and a card application identifier corresponding to the card application, the configuration information includes application identity information, the application identifier, the application key, and the application private key, and generating the second feature code according to the configuration information includes:

[0114] Obtain an international mobile user identity code corresponding to the card application, perform a hash operation on the international mobile user identity code, the application identifier, the application key, the application identity information, the card application identifier, and the session identifier to obtain a second hash operation value;

[0115] Obtaining a third current timestamp, and determining a second time characteristic value corresponding to the third current timestamp;

[0116] A second feature code is generated according to the second Hash operation value and the second time feature value.

[0117] In the above embodiment, since the first timestamp and the session identifier are used as part of the generation process when calculating the first feature code, the first feature code generated for each request is different, which can improve the security of communication.

[0118] In combination with some embodiments of the third aspect, in some embodiments, generating a second feature code according to the second hash operation value and the second time feature value includes:

[0119] Performing a hash message authentication code operation on the second hash operation value and the second time characteristic value to obtain a sixth character string;

[0120] Starting from the subscript offset of the sixth character string, characters of the first target length are intercepted to obtain a seventh character string, wherein the subscript offset is determined by the characters corresponding to the first target number of digits in the sixth character string;

[0121] Convert the seventh character string into an eighth character string, wherein the seventh character string is a character string in the first base, and the eighth character string is a character string in the second base;

[0122] Starting from the second target digit of the eighth character string, characters of the second target length are intercepted to obtain a ninth character string, and the ninth character string is converted into a tenth character string, wherein the tenth character string is a character string of the first base;

[0123] If the number of digits of the tenth character string is less than the digit threshold, a zero padding operation is performed on the tenth character string until the number of digits of the tenth character string is equal to the digit threshold, thereby obtaining a second feature code.

[0124] In the above embodiment, by performing a hash message authentication code operation on the first hash operation value and the first time feature value and performing multi-step processing on the first character string to generate the first feature code, the difficulty of cracking the first feature code can be increased, and the security of communication can be improved.

[0125] In combination with some embodiments of the third aspect, in some embodiments, the second time feature value includes a current time feature value and at least one boundary time feature value, the second feature code includes a first feature subcode corresponding to the current time feature value and a second feature subcode corresponding to at least one boundary time feature value, and the method further includes:

[0126] In the case that any feature subcode in the first feature code and the second feature code is the same, it is determined that the comparison result between the first feature code and the second feature code meets the authentication requirement, wherein the feature subcode includes the first feature subcode and the second feature subcode.

[0127] In the above embodiment, by comparing the first feature code with any feature subcode in the second feature code, the accuracy of obtaining the comparison result between the first feature code and the second feature code can be improved.

[0128] According to a fourth aspect of the embodiments of the present disclosure, a software development kit is provided, characterized in that it includes:

[0129] The transceiver module is used to receive the communication connection request for the card application sent by the business party application;

[0130] The transceiver module is further used to send the configuration information of the business party application to the server, so that the server generates a first feature code according to the configuration information;

[0131] The transceiver module is also used to send an identity authentication request to the terminal operating system in response to receiving a writing result sent by the server, so that the terminal operating system establishes a communication channel with the card application when the comparison result between the first feature code and the second feature code meets the authentication requirements, wherein the writing result is used to indicate that the first feature code has been written to the access control file corresponding to the card application, the identity authentication request includes configuration information, and the second feature code is generated by the terminal according to the configuration information.

[0132] According to a fifth aspect of an embodiment of the present disclosure, a server is provided, including:

[0133] The transceiver module is used to receive the configuration information of the business party application sent by the software development kit;

[0134] A processing module, used for generating a first feature code according to the configuration information;

[0135] The transceiver module is further used to send the first feature code to the card application corresponding to the configuration information.

[0136] According to a sixth aspect of an embodiment of the present disclosure, a terminal operating system is provided, including:

[0137] A transceiver module, configured to receive an identity authentication request for a business party application sent by a software development kit, wherein the identity authentication request includes configuration information of the business party application;

[0138] The transceiver module is further used to determine the card application corresponding to the identity authentication request, and obtain a first feature code from an access control file corresponding to the card application, wherein the first feature code is generated by the server according to the configuration information;

[0139] The processing module is used to generate a second feature code according to the configuration information, and establish a communication channel with the card application when the comparison result between the first feature code and the second feature code meets the authentication requirement.

[0140] According to a seventh aspect of the embodiments of the present disclosure, a business application is proposed, including:

[0141] one or more processors;

[0142] The business side application is used to execute the card application communication method as described in any one of the first aspects.

[0143] According to an eighth aspect of an embodiment of the present disclosure, a server is provided, including:

[0144] one or more processors;

[0145] The server is used to execute the card application communication method as described in any one of the second aspects.

[0146] According to a ninth aspect of an embodiment of the present disclosure, a terminal operating system is provided, including:

[0147] one or more processors;

[0148] Wherein, the terminal operating system is used for the card application communication method as described in any one of the third aspects.

[0149] According to the tenth aspect of an embodiment of the present disclosure, a card application communication system is proposed, comprising: a business party application, a software development kit, a card application, a terminal operating system, and a server, wherein the software development kit is configured to implement a card application communication method as described in any one of the first aspect, the server is configured to implement a card application communication method as described in any one of the second aspect, and the terminal operating system is configured to implement a card application communication method as described in any one of the third aspect.

[0150] According to the eleventh aspect of the embodiments of the present disclosure, a storage medium is proposed which stores instructions. When the instructions are executed on a communication device, the communication device executes the card application communication method as described in any one of the first aspect, the second aspect or the third aspect.

[0151] The embodiments of the present disclosure are not exhaustive, but are only illustrative of some embodiments, and are not intended to be a specific limitation on the scope of protection of the present disclosure. In the absence of contradiction, each step in a certain embodiment can be implemented as an independent embodiment, and the steps can be arbitrarily combined. For example, a solution after removing some steps in a certain embodiment can also be implemented as an independent embodiment, and the order of the steps in a certain embodiment can be arbitrarily exchanged. In addition, the optional implementation methods in a certain embodiment can be arbitrarily combined; in addition, the embodiments can be arbitrarily combined, for example, some or all of the steps of different embodiments can be arbitrarily combined, and a certain embodiment can be arbitrarily combined with the optional implementation methods of other embodiments.

[0152] In each embodiment of the present disclosure, unless otherwise specified or there is a logical conflict, the terms and / or descriptions between the embodiments are consistent and can be referenced to each other, and the technical features in different embodiments can be combined to form a new embodiment based on their internal logical relationships.

[0153] The terms used in the embodiments of the present disclosure are only for the purpose of describing specific embodiments and are not intended to limit the present disclosure.

[0154] In the embodiments of the present disclosure, unless otherwise specified, elements expressed in the singular form, such as "a", "an", "the", "above", "said", "aforementioned", "this", etc., may mean "one and only one", or "one or more", "at least one", etc. For example, when using articles such as "a", "an", "the" in English in translation, the noun after the article may be understood as a singular expression or a plural expression.

[0155] In the embodiments of the present disclosure, “plurality” refers to two or more.

[0156] In some embodiments, the terms “at least one,” “one or more,” “a plurality of,” “multiple,” etc. may be used interchangeably.

[0157] In some embodiments, "at least one of A and B", "A and / or B", "A in one case, B in another case", "in response to one case A, in response to another case B", etc., may include the following technical solutions according to the situation: in some embodiments, A (A is executed independently of B); in some embodiments, B (B is executed independently of A); in some embodiments, execution is selected from A and B (A and B are selectively executed); in some embodiments, A and B (both A and B are executed). When there are more branches such as A, B, C, etc., the above is also similar.

[0158] In some embodiments, the recording method of "A or B" may include the following technical solutions according to the situation: in some embodiments, A (A is executed independently of B); in some embodiments, B (B is executed independently of A); in some embodiments, execution is selected from A and B (A and B are selectively executed). When there are more branches such as A, B, C, etc., the above is also similar.

[0159] The prefixes such as "first" and "second" in the embodiments of the present disclosure are only used to distinguish different description objects, and do not constitute restrictions on the position, order, priority, quantity or content of the description objects. The statement of the description object refers to the description in the context of the claims or embodiments, and should not constitute unnecessary restrictions due to the use of prefixes. For example, if the description object is a "field", the ordinal number before the "field" in the "first field" and the "second field" does not limit the position or order between the "fields", and the "first" and "second" do not limit whether the "fields" they modify are in the same message, nor do they limit the order of the "first field" and the "second field". For another example, if the description object is a "level", the ordinal number before the "level" in the "first level" and the "second level" does not limit the priority between the "levels". For another example, the number of description objects is not limited by the ordinal number, and can be one or more. Taking the "first device" as an example, the number of "devices" can be one or more. In addition, the objects modified by different prefixes may be the same or different. For example, if the description object is "device", then the "first device" and the "second device" may be the same device or different devices, and their types may be the same or different. For another example, if the description object is "information", then the "first information" and the "second information" may be the same information or different information, and their contents may be the same or different.

[0160] In some embodiments, “including A”, “comprising A”, “used to indicate A”, and “carrying A” can be interpreted as directly carrying A or indirectly indicating A.

[0161] In some embodiments, terms such as "in response to ...", "in response to determining ...", "in the case of ...", "at the time of ...", "when ...", "if ...", "if ...", etc. can be used interchangeably.

[0162] In some embodiments, terms such as "greater than", "greater than or equal to", "not less than", "more than", "more than or equal to", "not less than", "higher than", "higher than or equal to", "not lower than", and "above" can be replaced with each other, and terms such as "less than", "less than or equal to", "not greater than", "less than", "less than or equal to", "no more than", "lower than", "lower than or equal to", "not higher than", and "below" can be replaced with each other.

[0163] In some embodiments, devices and equipment may be interpreted as physical or virtual, and their names are not limited to the names recorded in the embodiments. In some cases, they may also be understood as "equipment", "device", "circuit", "network element", "node", "function", "unit", "section", "system", "network", "chip", "chip system", "entity", "subject", etc.

[0164] In some embodiments, acquisition of data, information, etc. may comply with the laws and regulations of the country where the data is obtained.

[0165] In some embodiments, data, information, etc. may be obtained with the user's consent.

[0166] In addition, each element, each row, or each column in the table of the embodiments of the present disclosure may be implemented as an independent embodiment, and the combination of any elements, any rows, and any columns may also be implemented as an independent embodiment.

[0167] A card application communication method and system provided by an embodiment of the present disclosure are described in detail below. The method can be implemented by a computer program and can be run on a system that performs the card application communication method. The computer program can be integrated into an application or run as an independent tool application.

[0168] Specifically, the method may include the following steps:

[0169] Step S2101: The business application sends a permission request for the card application to the server;

[0170] According to some embodiments, the business party application (Application, APP) refers to an external APP that needs to communicate with the card application.

[0171] In some embodiments, the card application refers to an application in the USIM. The card application can be used to execute an Application Protocol Data Unit (APDU) instruction.

[0172] According to some embodiments, the server includes a card application management server, and the business application can send a permission application request for the card application to the card application management server to apply for access rights to the card application.

[0173] In some embodiments, the business application may send a permission request to the card application management server in the form of an email.

[0174] According to some embodiments, the permission application request may be used to apply for the application identifier (appid), application key (appkey), and application private key (appsecret) corresponding to the business party APP.

[0175] The application ID is an identifier used to uniquely identify an APP. The purpose of the application ID is to distinguish different APPs and avoid name conflicts.

[0176] Among them, appkey refers to the public key corresponding to the business party APP, and appsecret refers to the private key corresponding to the business party APP. In asymmetric encryption technology, the public key is public and can be used by the sender to encrypt information, while the private key is confidential and held by the receiver to decrypt the information. Data encrypted by the public key can only be decrypted using the private key.

[0177] In some embodiments, the permission application request includes application identity information. The application identity information is used to indicate the identity information of the business party APP. The application identity information includes but is not limited to the application signature, application package name, etc.

[0178] The application signature refers to the signature information set by the developer when signing the APP to ensure its identity authentication and integrity. The application signature can be, for example, a signature fingerprint. By using the fingerprint in the signature, the authenticity, confidentiality and non-repudiation of the signature information can be enhanced.

[0179] The application package name is used to uniquely identify the name of the APP.

[0180] Step S2102, the server receives a permission application request for a card application sent by the business party application, and determines the application identifier, application key, application private key, card application identifier corresponding to the permission application request, and card application access permission information between the business party application and the card application;

[0181] According to some embodiments, a card application identification (AID) is an identifier used to uniquely identify a card application.

[0182] In some embodiments, the card application access permission information (isAllow) is used to indicate whether the business party APP is allowed to communicate with the card application. isAllow can be used to control the business party APP's access permission to the card application.

[0183] Step S2103, the server stores the application identity information, application identifier, application key, application private key, card application identifier and card application access permission information in a database, and sends the application identifier, application key and application private key to the business party application.

[0184] Step S2104, the business party application receives the application identification, application key, and application private key sent by the server, and sends a communication connection request for the card application to the software development kit;

[0185] According to some embodiments, the software development kit (SDK) may be, for example, a communication SDK. The communication SDK refers to an SDK that encapsulates the functions of identity authentication and channel establishment with the card application. The communication SDK may be integrated with the business party APP.

[0186] In some embodiments, the communication connection request is used to request to establish a communication connection with the card application in the USIM. The communication connection request includes the AID corresponding to the card application.

[0187] In some embodiments, the business party APP can use appid, appkey, and appsecret to integrate the communication SDK, and use SID as a parameter to call the interface of the communication SDK to request to establish a communication connection with the card application.

[0188] Step S2105, the software development kit receives the communication connection request for the card application sent by the business party application, and sends the configuration information of the business party application to the server;

[0189] According to some embodiments, the configuration information includes but is not limited to parameters such as appid, appkey, appsecret, application signature, application package name, etc. corresponding to the business party APP.

[0190] In some embodiments, since the configuration information involves the private data of the business party APP, the configuration information needs to be encrypted. Therefore, when the SDK sends the configuration information of the business party APP to the server, the SDK can read the configuration information of the business party application, encrypt the configuration information, obtain the encrypted configuration information, and send the encrypted configuration information to the server.

[0191] According to some embodiments, the SDK encrypts the configuration information, and when obtaining the encrypted configuration information, the following sub-steps may be adopted:

[0192] Step S21051, the SDK obtains the international mobile subscriber identity code corresponding to the card application, the terminal parameters corresponding to the terminal operating system, and the first current timestamp, and generates a random factor according to the terminal parameters, the first current timestamp and the application signature;

[0193] According to some embodiments, the SDK may obtain the International Mobile Subscriber Identity (IMSI) of the USIM corresponding to the card application through the AID.

[0194] In some embodiments, the terminal operating system refers to the operating system of the terminal itself. The terminal parameters corresponding to the terminal operating system include, but are not limited to, parameters such as the terminal serial number and the terminal system version number. Among them, the terminal serial number refers to the unique identifier of the terminal. The terminal system version number refers to the version number of the operating system of the terminal itself. The terminal operating system can be, for example, a mobile phone operating system.

[0195] According to some embodiments, the first current timestamp refers to a timestamp corresponding to the moment when the terminal generates the random factor. The unit of the timestamp may be, for example, seconds.

[0196] In some embodiments, the SDK can take the last two digits of the terminal serial number to form the first two digits of the random factor P, take the last two digits of the terminal system version number to form the third and fourth digits of the random factor P, take the last two digits of the first current timestamp to form the fifth and sixth digits of the random factor P, take the last two digits of the application signature to form the last two digits of the random factor P, and finally generate an 8-bit random factor P.

[0197] It should be noted that the random factor is generated in a manner not limited to the above manner. The random factor may be, for example, a generated random number.

[0198] Step S21052, SDK generates a session identifier;

[0199] According to some embodiments, a session identifier (sessionid) is a mechanism for identifying and distinguishing different sessions. In network communications, a session identifier is used to identify and distinguish different network sessions to ensure that data is correctly transmitted and processed in the network.

[0200] In some embodiments, the SDK may generate a Universally Unique Identifier (UUID) as the sessionid.

[0201] Step S22053, the SDK uses a random factor to symmetrically encrypt the card application identifier, application key, application identifier, and application identity information to obtain first symmetrically encrypted information;

[0202] Step S21054: The SDK puts the first symmetric encryption information into the request body, performs a hash operation on the first symmetric encryption information to obtain a summary content, and uses the software development kit private key to asymmetrically encrypt the summary content to obtain a digital signature;

[0203] According to some embodiments, the software development kit private key refers to the private key of the SDK.

[0204] Step S21055, the SDK uses the application private key as a key to symmetric encrypt the digital signature, terminal parameters, the first current timestamp, the application signature, the session identifier, and the international mobile subscriber identity code to obtain second symmetric encryption information, and puts the second symmetric encryption information and the application identifier into the request header;

[0205] Step S21056: SDK uses the server public key to asymmetrically encrypt the request header and request body to obtain encrypted configuration information.

[0206] According to some embodiments, the server includes an authentication server, which refers to a server used to verify the communication authority of the business party APP. When the SDK uses the server public key to asymmetrically encrypt the request header and the request body, the SDK can use the public key of the authentication server to asymmetrically encrypt the request header and the request body.

[0207] In some embodiments, when the SDK sends the encrypted configuration information to the server, it may send the encrypted configuration information to the authentication server to request the server to perform identity authentication.

[0208] In some embodiments, when the SDK sends configuration information to the server, it may send all the configuration information to the server, or it may send only part of the configuration information that is needed to the server.

[0209] Step S2106, the server receives configuration information of the business party application sent by the software development kit;

[0210] According to some embodiments, the server can receive encrypted configuration information of a business party application sent by a software development kit, and perform data parsing on the encrypted configuration information to obtain parsed configuration information; perform data verification on the parsed configuration information, and when the data verification result meets the data verification requirements, determine that the parsed configuration information is the configuration information of the business party application.

[0211] In some embodiments, when the server performs data parsing on the encrypted configuration information, the following sub-steps may be used:

[0212] Step S21061, the server uses the server private key to decrypt the application identifier from the request header of the encrypted configuration information, searches the application identifier in the database, and obtains the application private key corresponding to the application identifier;

[0213] According to some embodiments, the server private key refers to a private key of the server.

[0214] In some embodiments, if there is no record corresponding to the appid in the database, a prompt "APP has not completed the permission application" is returned to the SDK. If there is a corresponding record, the appsecret corresponding to the appid is obtained.

[0215] Step S21062: The server uses the server private key to decrypt the second symmetric encrypted information from the request header, and uses the application private key to decrypt the second symmetric encrypted information to obtain the digital signature, the terminal parameters corresponding to the terminal operating system, the first current timestamp, the application signature, the session identifier, and the international mobile subscriber identity code corresponding to the card application, and determines the random factor corresponding to the terminal parameters, the first current timestamp, and the application signature;

[0216] Step S21063: the server uses the server private key to decrypt the first symmetric encrypted information from the request body of the encrypted configuration information, and performs a hash operation on the first symmetric encrypted information to obtain a summary content;

[0217] Step S21064: the server uses the public key of the software development kit to decrypt the digital signature to obtain decrypted content, and compares the decrypted content with the summary content to see if they are consistent;

[0218] According to some embodiments, if the decrypted content is consistent with the summary content, it means that the encrypted configuration information sent by the SDK to the server has not been tampered with, indicating that the signature verification is successful.

[0219] Step S21065: when the decrypted content and the summary content are consistent, the first symmetrically encrypted information is decrypted using the random factor as a key to obtain the card application identifier and the parsed configuration information.

[0220] The parsed configuration information includes application key, application identifier, and application identity information.

[0221] According to some embodiments, when the server performs data verification on the parsed configuration information, it can search the database for application identity information, application key, and card application access permission information between the business party application and the card application corresponding to the application identifier; when the application identity information and application key obtained by searching the database are consistent with the application identity information and application key in the parsed configuration information, and the card application access permission information indicates the existence of communication permission between the business party application and the card application, the server can determine that the data verification result meets the data verification requirements.

[0222] In some embodiments, if the appkey, application signature, and application package name in the parsed configuration information are consistent with the records in the database, it means that the parameters of the business party APP are legal.

[0223] In some embodiments, the corresponding isAllow field can be searched according to appid and AID. If the isAllow field is false, it means that the business party APP is not allowed to communicate with the card application, and the server can return a prompt "APP does not obtain communication permission" to the SDK. If the isAllow field is true, it means that the business party APP is allowed to communicate with the card application, and the following process can be carried out.

[0224] Step S2107, the server generates a first feature code according to the configuration information;

[0225] According to some embodiments, the server can perform a hash operation on the international mobile user identification code, application identifier, application key, application identity information, card application identifier, and session identifier to obtain a first hash operation value; obtain a second current timestamp, and determine a first time feature value corresponding to the second current timestamp; and generate a first feature code based on the first hash operation value and the first time feature value.

[0226] In some embodiments, the second current timestamp refers to a timestamp corresponding to the moment when the first feature code is generated.

[0227] In some embodiments, the first time characteristic value refers to the time characteristic value corresponding to the second current timestamp.

[0228] The first time characteristic value C1 corresponding to the second current timestamp T1 may be C1=T1 / 60, so the C1 value in each minute is equal, otherwise it is unequal.

[0229] In some embodiments, the first feature code may be generated by the authentication server according to the configuration information.

[0230] According to some embodiments, when the server generates a first feature code based on a first hash operation value and a first time feature value, it can perform a hash message authentication code operation on the first hash operation value and the first time feature value to obtain a first character string; intercept characters of a first target length starting from a subscript offset of the first character string to obtain a second character string; convert the second character string into a third character string; intercept characters of a second target length starting from a second target number of bits of the third character string to obtain a fourth character string, and convert the fourth character string into a fifth character string; if the number of bits of the fifth character string is less than a bit threshold, perform a zero-padding operation on the fifth character string until the number of bits of the fifth character string is equal to the bit threshold to obtain the first feature code.

[0231] In some embodiments, the hash message authentication code operation may be, for example, an hmacSHA256 operation. By performing an hmacSHA256 operation on the first hash operation value and the first time characteristic value, a first hexadecimal character string with a length of 64 may be obtained.

[0232] In some embodiments, the subscript offset of the first string may be determined by the character corresponding to the first target digit in the first string. For example, the subscript offset of the first string may be the value of the first character in the first string.

[0233] In some embodiments, the first target length does not specifically refer to a fixed length. The first target length may be, for example, 8, which is equivalent to 4 bytes.

[0234] In some embodiments, the second character string is a character string in the first base, and the third character string is a character string in the second base. For example, when the first target length is 8 and the first base is hexadecimal, the second base can be decimal.

[0235] In some embodiments, the second target number of bits and the second target length may be set according to actual application scenarios. For example, the fourth character string may be the lower 8 bits of the third character string.

[0236] In some embodiments, when the server performs the zero-padding operation on the fifth character string, it may perform a left-bit zero-padding operation or a right-bit zero-padding operation.

[0237] According to some embodiments, the server may further include a communication server. The communication server refers to a server for data communication with the card application. After the authentication server generates the first feature code, the first feature code and the IMSI may be sent to the communication server.

[0238] Step S2108, the server sends the first feature code to the card application corresponding to the configuration information;

[0239] According to some embodiments, the server may send a data message to the global user identity card corresponding to the card application, so that the global user identity card sends the link establishment address and port number in the data message to the terminal operating system; and sends the card application processing request to the global user identity card through the communication link.

[0240] In some embodiments, the communication link may be established by the terminal operating system according to the link establishment address and the port number.

[0241] According to some embodiments, the server may send a card application processing request to an Application Provider Security Domain (APSD) in the USIM. The card application processing request may include a card application identifier and an Application Protocol Data Unit (APDU) instruction.

[0242] In some embodiments, APDU refers to a standard instruction structure used when the USIM communicates with the outside and exchanges data. The APDU instruction includes a first feature code.

[0243] In some embodiments, the APDU instruction may be composed of CLA, INS, P1, P2, Lc, and Data, which are arranged in sequence. The content convention may be as shown in Table (1):

[0244]

[0245]

[0246] Table (1)

[0247] It should be noted that the data format of the APDU instruction is not limited to the data format shown in Table (1), and the data format can be adjusted according to the actual application scenario.

[0248] According to some embodiments, the first feature code may be sent to the card application corresponding to the configuration information through the communication server.

[0249] Taking a scenario as an example, after the communication server obtains the IMSI sent by the authentication server, it can obtain the number corresponding to the IMSI. Then, the communication server can send a data SMS to the USIM corresponding to the number through the Bearer Independent Protocol (BIP) gateway. The data SMS carries parameters such as the link establishment address and port number. After the USIM receives the data SMS, it can send an instruction to open the channel to the USIM's card operating system (COS) to establish communication with the terminal operating system, and send the link establishment address and port number to the terminal operating system. Then, the terminal operating system can establish an HTTPS link with the BIP gateway through the Transmission Control Protocol (TCP)\Internet Protocol (IP), and the USIM can subsequently use the HTTPS link to interact with data.

[0250] BIP is a communication protocol of USIM, which defines the connection method and process between the gateway and USIM. BIP gateway refers to the server dedicated to managing BIP connection.

[0251] Step S2109, the card application writes the first feature code into the access control file corresponding to the card application;

[0252] According to some embodiments, the access control (AC) file may be, for example, an access control conditions file (ACCF).

[0253] In some embodiments, when APSD receives a card application processing request, APSD can find the corresponding card application according to the AID in the card application processing request, and send a card write instruction to the card application. Then, the card application can call the COS file read interface to read the content of the access control rule file (ACRF) in the access control file (ARF) module, and obtain the address of the ACCF corresponding to the card application. Finally, the card application can parse the data of the first feature code in the card application processing request, and then call the COS file write interface to write the data into the ACCF.

[0254] Step S2110, the card application returns the writing result to the server;

[0255] According to some embodiments, the writing result is used to indicate that the first feature code has been written into the access control file corresponding to the card application.

[0256] Step S2111, the server sends the writing result to the software development kit;

[0257] According to some embodiments, the card application may return the writing result to the communication service end, the communication service end returns the writing result to the authentication service end, and the authentication service end sends the writing result to the SDK.

[0258] Step S2112, in response to receiving the write result sent by the server, the software development kit sends an identity authentication request to the terminal operating system;

[0259] According to some embodiments, the identity authentication request includes, but is not limited to, parameters such as configuration information of the business party APP, a session identifier, and a card application identifier corresponding to the card application.

[0260] For example, the identity authentication request may include appid, appkey, application signature, application package name, AID, and sessionid.

[0261] Step S2113, the terminal operating system receives the identity authentication request for the business party application sent by the software development kit, determines the card application corresponding to the identity authentication request, and obtains the first feature code from the access control file corresponding to the card application;

[0262] According to some embodiments, the terminal operating system can access the card file system through the access controller module according to the AID in the identity authentication request, read the content of the ACRF of the ARF module in the USIM, obtain the address of the ACCF corresponding to the card application according to the AID, and read the content of the ACCF to obtain the data of the first feature code.

[0263] Step S2114: the terminal operating system generates a second feature code according to the configuration information, and establishes a communication channel with the card application if the comparison result between the first feature code and the second feature code meets the authentication requirement;

[0264] According to some embodiments, the terminal operating system may generate the second feature code according to the configuration information.

[0265] In some embodiments, the terminal operating system can obtain the international mobile user identification code corresponding to the card application, perform a hash operation on the international mobile user identification code, application identifier, application key, application identity information, card application identifier, and session identifier to obtain a second hash operation value; obtain a third current timestamp, and determine a second time feature value corresponding to the third current timestamp; generate a second feature code based on the second hash operation value and the second time feature value.

[0266] The third current timestamp refers to the timestamp corresponding to the moment when the second feature code is generated.

[0267] According to some embodiments, when the terminal operating system generates a second feature code based on the second hash operation value and the second time feature value, it can perform a hash message authentication code operation on the second hash operation value and the second time feature value to obtain a sixth character string; intercept characters of the first target length starting from the subscript offset of the sixth character string to obtain a seventh character string; convert the seventh character string into an eighth character string; intercept characters of the second target length starting from the second target number of bits of the eighth character string to obtain a ninth character string, and convert the ninth character string into a tenth character string; if the number of digits of the tenth character string is less than the number of digits threshold, perform a zero-padding operation on the tenth character string until the number of digits of the tenth character string is equal to the number of digits threshold to obtain the second feature code.

[0268] The subscript offset of the sixth character string may be determined by the character corresponding to the first target digit in the sixth character string. For example, the subscript offset of the sixth character string may be the value of the first character in the sixth character string.

[0269] It should be noted that, since the first feature code and the second feature code need to be compared and authenticated, the hash message authentication code operation, the first target length, the second target length, the first target number of bits, the second target number of bits, the first base, the binary, and the zero-padding operation in step S2114 all use the same settings as those in step S2107.

[0270] It should be noted that the generation method of the first feature code and the second feature code is not limited to the above formula, as long as the identity information of the business party APP can be identified. For example, the first feature code and the second feature code can be random numbers generated by the server and the terminal operating system respectively.

[0271] According to some embodiments, in order to support boundary time, when determining the second time feature value corresponding to the third current timestamp, it is necessary to calculate the current time feature value and the boundary time feature value, that is, the second time feature value includes the current time feature value and at least one boundary time feature value.

[0272] In some embodiments, the current time feature value is calculated in the same manner as the first time feature value.

[0273] In some embodiments, the at least one boundary time feature value may include a first boundary time feature value C2 and a second boundary time feature value C3.

[0274] Among them, the first boundary time characteristic value C2 corresponding to the third current timestamp T2 can be C2=(T2 / 60)+1.

[0275] The second boundary time characteristic value C3 corresponding to the third current timestamp T2 may be C3=(T2 / 60)-1.

[0276] According to some embodiments, when generating the second feature code, the first feature subcode may be generated according to the second hash operation value and the current time feature value, and the second feature subcode may be generated according to the second hash operation value and the boundary time feature value. In other words, the second feature code includes the first feature subcode and at least one second feature subcode.

[0277] In some embodiments, when the terminal operating system compares and authenticates the first feature code and the second feature code, the first feature code may be compared with the first feature subcode and at least one second feature subcode respectively. If the first feature code is the same as any of the first feature subcode and at least one second feature subcode, it means that the authentication is successful, and the terminal operating system may determine that the comparison result between the first feature code and the second feature code meets the authentication requirements, so that the terminal operating system can establish a communication channel (communication link) with the card application.

[0278] Step S2115, the terminal operating system sends the comparison result to the software development kit;

[0279] Step S2116, the software development kit receives the comparison result sent by the terminal operating system, and sends the comparison result to the business party application;

[0280] Step S2117: if the comparison result meets the authentication requirements, the business application sends the target instruction to the card application through the software development kit and the communication channel;

[0281] According to some embodiments, the business party APP may send a target instruction to the card application by calling the sending instruction interface of the SDK and the communication channel.

[0282] Step S2118, the card application sends the execution result corresponding to the target instruction to the business party application;

[0283] Step S2119: the business party application receives the execution result corresponding to the target instruction sent by the card application.

[0284] Take a scenario as an example. Figure 4 This is an interactive schematic diagram of a card application communication method provided by an embodiment of the present disclosure. The method can be implemented by a computer program and can be run on a system that performs the card application communication method. The computer program can be integrated into an application or run as an independent tool application.

[0285] Among them, the card application communication system includes card application, business party APP, SDK, server, and terminal operating system. The SDK adopts communication SDK, the server includes authentication server and communication server, and the terminal operating system adopts mobile phone operating system.

[0286] Specifically, the method may include the following steps:

[0287] Step S3101, the service party APP requests the communication SDK to establish a communication connection with the card application in the USIM;

[0288] Step S3102, the communication SDK sends the APP configuration information (i.e. configuration information) of the business party APP to the authentication server, requesting identity authentication;

[0289] Step S3103, the authentication server parses and verifies the APP configuration information, and generates a first feature code and transmits it to the communication server;

[0290] Step S3104, the communication service end sends the first feature code to the card application;

[0291] Step S3105, the card application writes the first feature code into the AC file;

[0292] Step S3106, the card application returns the writing result to the communication server, the communication server returns the writing result to the authentication server, and the authentication server returns the writing result to the communication SDK;

[0293] Step S3107, the communication SDK requests identity authentication from the mobile phone operating system (i.e., sends an identity authentication request);

[0294] Step S3108, the mobile phone operating system obtains the first feature code from the AC file of the card application;

[0295] Step S3109, the card application returns the first feature code to the mobile phone operating system;

[0296] Step S3110: the mobile phone operating system generates a second feature code according to the parameters in the identity authentication request sent by the communication SDK, and compares it with the read first feature code. If they match, the authentication is successful and a communication channel is established.

[0297] Step S3111, the mobile phone operating system returns the comparison result to the communication SDK;

[0298] Step S3112: The communication SDK notifies the business party APP of the comparison result.

[0299] It should be noted that the explanation of steps S3101 to S3112 can refer to steps S2101 to S2119, and will not be repeated here.

[0300] It should be noted that the card application communication method involved in the embodiment of the present disclosure may include at least one of steps S2101 to S2119 and steps S3101 to S3112. For example, steps S2105, S2113, and S2114 may be implemented as independent embodiments, and steps S3101, S3102, and S3110 may be implemented as independent embodiments, but are not limited thereto.

[0301] In some embodiments, steps S2101 to S2104, steps S2106 to S2112, steps S2115 to S2119, steps S3103 to S3109, step S3111, and step S3112 are optional, and one or more of these steps may be omitted or replaced in different embodiments.

[0302] In the embodiments of the present disclosure, part or all of the steps and their optional implementations may be arbitrarily combined with part or all of the steps in other embodiments, or may be arbitrarily combined with optional implementations of other embodiments.

[0303] The embodiments of the present disclosure also propose a device for implementing any of the above methods, for example, a device is proposed, the above device includes a unit or module for implementing each step performed by the software development kit in any of the above methods. For another example, another device is proposed, including a unit or module for implementing each step performed by the server in any of the above methods. For another example, another device is proposed, including a unit or module for implementing each step performed by the terminal operating system in any of the above methods.

[0304] It should be understood that the division of the units or modules in the above device is only a division of logical functions, and in actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. In addition, the units or modules in the device can be implemented in the form of a processor calling software: for example, the device includes a processor, the processor is connected to a memory, and instructions are stored in the memory. The processor calls the instructions stored in the memory to implement any of the above methods or implement the functions of the units or modules of the above device, wherein the processor is, for example, a general-purpose processor, such as a central processing unit (CPU) or a microprocessor, and the memory is a memory inside the device or a memory outside the device. Alternatively, the units or modules in the device can be implemented in the form of hardware circuits, and the functions of some or all of the units or modules can be realized by designing the hardware circuits. The above hardware circuits can be understood as one or more processors; for example, in one implementation, the above hardware circuit is an application-specific integrated circuit (ASIC), and the functions of some or all of the above units or modules are realized by designing the logical relationship of the components in the circuit; for example, in another implementation, the above hardware circuit can be realized by a programmable logic device (PLD), taking a field programmable gate array (FPGA) as an example, which can include a large number of logic gate circuits, and the connection relationship between the logic gate circuits is configured by a configuration file, so as to realize the functions of some or all of the above units or modules. All units or modules of the above devices can be realized in the form of a processor calling software, or in the form of a hardware circuit, or in part by a processor calling software, and the rest by a hardware circuit.

[0305] In the disclosed embodiment, the processor is a circuit with signal processing capability. In one implementation, the processor may be a circuit with instruction reading and running capability, such as a central processing unit (CPU), a microprocessor, a graphics processing unit (GPU) (which may be understood as a microprocessor), or a digital signal processor (DSP), etc.; in another implementation, the processor may realize certain functions through the logical relationship of the hardware circuit, and the logical relationship of the above hardware circuit is fixed or reconfigurable, such as a hardware circuit implemented by a processor as an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), such as an FPGA. In a reconfigurable hardware circuit, the process of the processor loading a configuration document and realizing the configuration of the hardware circuit may be understood as the process of the processor loading instructions to realize the functions of some or all of the above units or modules. In addition, it may also be a hardware circuit designed for artificial intelligence, which may be understood as an ASIC, such as a neural network processing unit (NPU), a tensor processing unit (TPU), a deep learning processing unit (DPU), etc.

[0306] Figure 5 A schematic diagram of the structure of a software development kit provided by an embodiment of the present disclosure. Figure 5 As shown, the software development kit 5100 may include: a transceiver module 5101.

[0307] In some embodiments, the above-mentioned transceiver module 5101 can be used to receive a communication connection request for a card application sent by a business party application; it can also be used to send configuration information of the business party application to a server, so that the server generates a first feature code according to the configuration information; it can also be used to send an identity authentication request to the terminal operating system in response to receiving a write result sent by the server, so that the terminal operating system establishes a communication channel with the card application when the comparison result between the first feature code and the second feature code meets the authentication requirements, wherein the write result is used to indicate that the first feature code has been written to the access control file corresponding to the card application, the identity authentication request includes the configuration information, and the second feature code is generated by the terminal according to the configuration information.

[0308] Optionally, the above-mentioned transceiver module 5101 is used to execute at least one of the communication steps such as sending and / or receiving performed by the software development kit 5100 in any of the above methods (for example, step S2105, step S2112, step S2116, step S3102, step S3107, step S3112, but not limited to these), which will not be repeated here.

[0309] Figure 6 A schematic diagram of the structure of a server provided by an embodiment of the present disclosure. Figure 6 As shown, the server 6100 may include: a transceiver module 6101 and a processing module 6102 .

[0310] In some embodiments, the above-mentioned transceiver module 6101 can be used to receive configuration information of the business party application sent by the software development kit; the processing module 6102 can be used to generate a first feature code according to the configuration information; the transceiver module 6101 can also be used to send the first feature code to the card application corresponding to the configuration information.

[0311] Optionally, the above-mentioned transceiver module 6101 is used to execute at least one of the communication steps such as sending and / or receiving performed by the server 6100 in any of the above methods (for example, step S2102, step S2103, step S2106, step S2108, step S2111, step S3103, step S3104, step S3106, but not limited to these), which will not be repeated here.

[0312] Optionally, the processing module 6102 is used to execute at least one of the communication steps such as data processing performed by the server 6100 in any of the above methods (such as step S2107, step S3103, but not limited to these), which will not be repeated here.

[0313] Figure 7 This is a schematic diagram of the structure of a terminal operating system provided by an embodiment of the present disclosure. Figure 7 As shown, the terminal operating system 7100 may include: a transceiver module 7101 and a processing module 7102. In some embodiments, the transceiver module 7101 may be used to receive an identity authentication request for a business party application sent by a software development kit, wherein the identity authentication request includes configuration information of the business party application; the transceiver module 7101 may also be used to determine a card application corresponding to the identity authentication request, and obtain a first feature code from an access control file corresponding to the card application, wherein the first feature code is generated by the server according to the configuration information; the processing module 7102 may be used to generate a second feature code according to the configuration information, and establish a communication channel with the card application when the comparison result between the first feature code and the second feature code meets the authentication requirements.

[0314] Optionally, the above-mentioned transceiver module 7101 is used to execute at least one of the communication steps such as sending and / or receiving performed by the terminal operating system 7100 in any of the above methods (for example, step S2113, step S2115, step S3108, step S3111, but not limited to these), which will not be repeated here.

[0315] Optionally, the processing module 7102 is used to execute at least one of the communication steps such as data processing performed by the terminal operating system 7100 in any of the above methods (such as step S2114, step S3110, but not limited to this), which will not be repeated here.

[0316] Figure 8 This is a schematic diagram of the structure of a card application communication system provided by an embodiment of the present disclosure. Figure 8 As shown, the card application communication system 8100 includes a business application 8101, a software development kit 8102, a card application 8103, a terminal operating system 8104, and a server 8105; wherein,

[0317] The business party application 8101 includes one or more processors, configured to implement at least one of the communication steps such as sending and / or receiving in the above method (for example, step S2101, step S2104, step S2117, step S2119, step S3101, but not limited to these), which will not be repeated here.

[0318] The software development kit 8102 includes one or more processors, configured to implement at least one of the communication steps such as sending and / or receiving in the above method (for example, step S2105, step S2112, step S2116, step S3102, step S3107, step S3112, but not limited to these), which will not be repeated here.

[0319] The card application 8103 includes one or more processors, configured to implement at least one of the communication steps such as sending and / or receiving in the above method (for example, step S2109, step S2110, step S2118, step S3105, step S3106, step S3109, but not limited to these), which will not be repeated here.

[0320] The terminal operating system 8104 includes one or more processors, configured to implement at least one of the communication steps such as sending and / or receiving in the above method (for example, step S2113, step S2114, step S2115, step S3108, step S3110, step S3111, but not limited to these), which will not be repeated here.

[0321] Server 8105 includes one or more processors, and is configured to implement at least one of the communication steps such as sending and / or receiving in the above method (for example, step S2102, step S2103, step S2106, step S2107, step S2108, step S2111, step S3103, step S3104, step S3106, but not limited to these), which will not be repeated here.

[0322] In order to implement the above embodiments, the present disclosure further proposes a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the methods provided by the above embodiments.

[0323] In order to implement the above embodiments, the present disclosure also proposes a computer program product, including a computer program, which implements the methods provided by the above embodiments when executed by a processor.

[0324] The collection, storage, use, processing, transmission, provision and disclosure of user personal information involved in this disclosure shall comply with the relevant laws and regulations and shall not violate public order and good morals.

[0325] It should be noted that personal information from users should be collected for legitimate and reasonable purposes and should not be shared or sold outside of these legitimate uses. In addition, such collection / sharing should be carried out after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign the agreement / authorization including authorization of relevant user information before the user uses the function. In addition, any necessary steps should be taken to protect and safeguard access to such personal information data and ensure that others who have access to personal information data comply with its privacy policy and procedures.

[0326] The present disclosure anticipates providing implementation schemes for users to selectively block the use or access of personal information data. That is, the present disclosure anticipates providing hardware and / or software to prevent or block access to such personal information data. Once the personal information data is no longer needed, risks can be minimized by limiting data collection and deleting the data. In addition, when applicable, such personal information is de-identified to protect the privacy of the user.

[0327] In the description of the aforementioned embodiments, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present disclosure. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, unless they are contradictory.

[0328] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the description of the present disclosure, "plurality" means at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0329] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present disclosure includes additional implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present disclosure belong.

[0330] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute the instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purpose of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or otherwise processing in a suitable manner if necessary, and then stored in a computer memory.

[0331] It should be understood that the various parts of the present disclosure can be implemented in hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented in software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used to implement: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0332] A person skilled in the art may understand that all or part of the steps in the above-mentioned embodiment method may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0333] In addition, each functional unit in each embodiment of the present disclosure may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0334] The storage medium mentioned above may be a read-only memory, a disk or an optical disk, etc. Although the embodiments of the present disclosure have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations of the present disclosure. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present disclosure.

Claims

1. A card application communication method, characterized in that: Applicable to software development kits, including: Receiving a communication connection request for a card application sent by a business application; Sending configuration information of the business party application to a server, so that the server generates a first feature code according to the configuration information; In response to receiving the write result sent by the server, an identity authentication request is sent to the terminal operating system, so that the terminal operating system obtains the first feature code from the access control file corresponding to the card application, and establishes a communication channel with the card application when the comparison result between the first feature code and the second feature code meets the authentication requirements, wherein the write result is used to indicate that the first feature code has been written to the access control file corresponding to the card application, the identity authentication request includes the configuration information, and the second feature code is generated by the terminal according to the configuration information.

2. The method according to claim 1, characterized in that The sending the configuration information of the business party application to the server includes: Reading configuration information of the business party's application program, and encrypting the configuration information to obtain encrypted configuration information; The encrypted configuration information is sent to a server.

3. The method according to claim 2, characterized in that The configuration information includes an application identifier, application identity information, an application key, and an application private key; the application identity information includes an application signature; the communication connection request includes a card application identifier corresponding to the card application; and encrypting the configuration information to obtain encrypted configuration information includes: Obtaining an international mobile subscriber identity code corresponding to the card application, terminal parameters corresponding to the terminal operating system, and a first current timestamp; Generate a random factor according to the terminal parameter, the first current timestamp and the application signature, and use the random factor to symmetrically encrypt the card application identifier, the application key, the application identifier and the application identity information to obtain first symmetrically encrypted information; Put the first symmetric encryption information into the request body, perform a hash operation on the first symmetric encryption information to obtain a summary content, and use the software development kit private key to asymmetrically encrypt the summary content to obtain a digital signature; Generate a session identifier, and use the application private key to symmetrically encrypt the digital signature, the terminal parameter, the first current timestamp, the application signature, the session identifier, and the international mobile subscriber identity to obtain second symmetrically encrypted information; The request header and the request body are asymmetrically encrypted using a server public key to obtain encrypted configuration information, wherein the request header includes the second symmetrical encryption information and the application identifier.

4. The method according to claim 1, characterized in that The method further comprises: Receiving the comparison result sent by the terminal operating system; The comparison result is sent to the business application, so that the business application sends a target instruction to the card application through the software development kit and the communication channel.

5. A card application communication method, characterized in that: Applicable to servers, including: Receive configuration information of the business party application sent by the software development kit; Generate a first feature code according to the configuration information; Sending the first feature code to the card application corresponding to the configuration information, so that the card application writes the first feature code into an access control file corresponding to the card application; Receive the write result returned by the card application and send the write result to a software development kit; wherein, in response to receiving the write result sent by the server, the software development kit sends an identity authentication request to the terminal operating system, so that the terminal operating system obtains the first feature code from the access control file corresponding to the card application, and when the comparison result between the first feature code and the second feature code meets the authentication requirement, the terminal operating system establishes a communication channel with the card application, the identity authentication request includes the configuration information, and the second feature code is generated by the terminal according to the configuration information, wherein the write result is used to indicate that the first feature code has been written to the access control file corresponding to the card application.

6. The method according to claim 5, characterized in that The receiving configuration information of the business party application sent by the software development kit includes: Receive encrypted configuration information of the business party application sent by the software development kit; Performing data parsing on the encrypted configuration information to obtain parsed configuration information; Data verification is performed on the parsed configuration information, and when a data verification result meets a data verification requirement, it is determined that the parsed configuration information is the configuration information of the business party application.

7. The method according to claim 6, characterized in that The step of performing data parsing on the encrypted configuration information to obtain parsed configuration information includes: Decrypt the application identifier and the second symmetric encryption information from the request header of the encrypted configuration information using the server private key, and decrypt the first symmetric encryption information from the request body of the encrypted configuration information; Searching the application identifier in a database, obtaining an application private key corresponding to the application identifier, and using the application private key to decrypt the second symmetrically encrypted information to obtain a digital signature, terminal parameters corresponding to the terminal operating system, a first current timestamp, an application signature, a session identifier, and an international mobile subscriber identity code corresponding to the card application; Performing a hash operation on the first symmetrically encrypted information to obtain a summary content, and using a software development kit public key to decrypt the digital signature to obtain a decrypted content; When the decrypted content is consistent with the summary content, determine the random factor corresponding to the terminal parameter, the first current timestamp and the application signature, and use the random factor to decrypt the first symmetric encryption information to obtain the card application identifier and the parsed configuration information, wherein the parsed configuration information includes the application key, the application identifier, and the application identity information.

8. The method according to claim 7, characterized in that Before searching the database for the application identifier, the method further includes: receiving a permission application request for the card application sent by the business party application, wherein the permission application request includes application identity information; Determine the application identifier, application key, application private key corresponding to the permission application request, the card application identifier corresponding to the card application, and the card application access permission information between the business party application and the card application; The application identity information, the application identifier, the application key, the application private key, the card application identifier and the card application access permission information are stored in a database, and the application identifier, the application key and the application private key are sent to the business party application.

9. The method according to claim 8, characterized in that The performing data verification on the parsed configuration information includes: Searching the database for application identity information, application key, and card application access permission information between the business party application and the card application corresponding to the application identifier; If the application identity information and the application key found in the database are consistent with the application identity information and the application key in the parsed configuration information, and the card application access permission information indicates that there is communication permission between the business party application and the card application, it is determined that the data verification result meets the data verification requirements.

10. The method according to claim 7, characterized in that The generating a first feature code according to the configuration information includes: Performing a hash operation on the international mobile subscriber identity code, the application identifier, the application key, the application identity information, the card application identifier, and the session identifier to obtain a first hash operation value; Obtaining a second current timestamp, and determining a first time characteristic value corresponding to the second current timestamp; A first feature code is generated according to the first Hash operation value and the first time feature value.

11. The method according to claim 10, characterized in that The generating a first feature code according to the first Hash operation value and the first time feature value includes: Performing a hash message authentication code operation on the first hash operation value and the first time feature value to obtain a first character string; Starting from the subscript offset of the first character string, characters of a first target length are intercepted to obtain a second character string, wherein the subscript offset is determined by characters corresponding to a first target number of digits in the first character string; Convert the second character string into a third character string, wherein the second character string is a character string in the first base and the third character string is a character string in the second base; Starting from the second target number of digits of the third character string, characters of a second target length are intercepted to obtain a fourth character string, and the fourth character string is converted into a fifth character string, wherein the fifth character string is a character string of the first base; If the number of digits of the fifth character string is less than the digit threshold, a zero padding operation is performed on the fifth character string until the number of digits of the fifth character string is equal to the digit threshold, thereby obtaining a first feature code.

12. The method according to claim 5, characterized in that The sending the first feature code to the card application corresponding to the configuration information includes: Sending a data SMS to the global user identity card corresponding to the card application, so that the global user identity card sends the link establishment address and port number in the data SMS to the terminal operating system; A card application processing request is sent to the global user identity card via a communication link, wherein the communication link is established by the terminal operating system according to the link establishment address and the port number, and the card application processing request includes a card application identifier and an application protocol data unit instruction, and the application protocol data unit instruction includes the first feature code.

13. A card application communication method, characterized in that: Applied to terminal operating systems, including: Receiving an identity authentication request for a business party application sent by a software development kit, wherein the identity authentication request includes configuration information of the business party application; Determine the card application corresponding to the identity authentication request, and obtain a first feature code from an access control file corresponding to the card application, wherein the first feature code is generated by the server according to the configuration information received from the software development kit and sent to the card application, and the card application writes the first feature code into the access control file corresponding to the card application; A second feature code is generated according to the configuration information, and a communication channel with the card application is established when a comparison result between the first feature code and the second feature code meets an authentication requirement.

14. The method according to claim 13, characterized in that The identity authentication request also includes a session identifier and a card application identifier corresponding to the card application, the configuration information includes application identity information, application identifier, application key, and application private key, and generating a second feature code according to the configuration information includes: Obtaining an international mobile user identity code corresponding to the card application, performing a hash operation on the international mobile user identity code, the application identifier, the application key, the application identity information, the card application identifier, and the session identifier to obtain a second hash operation value; Obtaining a third current timestamp, and determining a second time characteristic value corresponding to the third current timestamp; A second feature code is generated according to the second Hash operation value and the second time feature value.

15. The method according to claim 14, characterized in that The generating a second feature code according to the second Hash operation value and the second time feature value includes: Performing a hash message authentication code operation on the second hash operation value and the second time feature value to obtain a sixth character string; Starting from the subscript offset of the sixth character string, characters of the first target length are intercepted to obtain a seventh character string, wherein the subscript offset is determined by the characters corresponding to the first target number of digits in the sixth character string; Convert the seventh character string into an eighth character string, wherein the seventh character string is a character string in the first base and the eighth character string is a character string in the second base; Starting from the second target number of digits of the eighth character string, characters of a second target length are intercepted to obtain a ninth character string, and the ninth character string is converted into a tenth character string, wherein the tenth character string is a character string of the first base; If the number of digits of the tenth character string is less than the digit threshold, a zero padding operation is performed on the tenth character string until the number of digits of the tenth character string is equal to the digit threshold, thereby obtaining a second feature code.

16. The method according to claim 14, characterized in that The second time feature value includes a current time feature value and at least one boundary time feature value, the second feature code includes a first feature subcode corresponding to the current time feature value and a second feature subcode corresponding to at least one boundary time feature value, and the method further includes: In the case that any feature subcode of the first feature code and the second feature code is the same, it is determined that a comparison result between the first feature code and the second feature code meets the authentication requirement, wherein the feature subcode includes a first feature subcode and a second feature subcode.

17. A card application communication system, characterized in that: include: A business party application, a software development kit, a card application, a terminal operating system, and a server, wherein the software development kit is configured to implement the method of any one of claims 1 to 4, the server is configured to implement the method of any one of claims 5 to 12, and the terminal operating system is configured to implement the method of any one of claims 13 to 16.

Images