Communication method and device between server and security chip, equipment and medium

Abstract

The embodiment of the invention relates to a communication method and device between a server and a security chip, equipment and a medium, the method is applied to the server, and the method comprises the following steps: signing a temporary session public key and a random number based on a server private key to obtain a signature character string; performing key negotiation on the temporary session private key and the security chip public key to obtain a first session key, and processing the temporary session public key, the random number and the signature character string to obtain an initial message authentication code; processing the to-be-processed instruction through the first session key to obtain a target message authentication code; initial data including the temporary session public key, the random number, the signature character string and the initial message authentication code and target data including the instruction to be processed and the target message authentication code are sent to intermediate equipment and forwarded to a security chip; and the security chip verifies and processes the target data after verifying the initial data to obtain a processing result, and sends the processing result to the intermediate device. The communication efficiency and the communication security between the server and the security chip can be improved.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to a communication method, device, equipment and medium between a server and a security chip. Background Art

[0002] In the increasingly digital life and work in the future, we will often encounter scenarios such as identity authentication, authorization, and even digital payment. The core of these business scenarios is to authenticate a certain data of the authenticated person. Only after the authentication is passed can subsequent business continue. Therefore, it is necessary to ensure that the authenticated data is protected securely enough and to ensure that the data transmission process is safe and accurate.

[0003] At present, existing identity authentication methods are usually based on insecure data for authentication, without encryption or simple symmetric key encryption processing, and the key lacks unique distribution, which makes it easy for data to be cracked by brute force and copied in large quantities after being intercepted, or use public key encryption to generate random numbers to generate session keys, or multiple back-and-forth interactions are required between the server and the security chip SE (Secure Element) to establish a secure channel. Summary of the invention

[0004] In order to solve the above technical problem or at least partially solve the above technical problem, the present disclosure provides a communication method, device, equipment and medium between a server and a security chip.

[0005] The embodiment of the present disclosure provides a communication method between a server and a security chip, which is applied to the server, wherein the server is connected to the security chip through an intermediate device, the server has a corresponding server public-private key pair, and stores a security chip identifier and a security chip public key corresponding to the security chip, and the method includes:

[0006] In response to the session request, a temporary session public-private key pair and a random number are generated, and the temporary session public key and the random number are signed based on the server private key to obtain a signature string;

[0007] The temporary session private key and the security chip public key are negotiated using a preset key negotiation algorithm to obtain a first session key;

[0008] The temporary session public key, the random number and the signature character string are processed by the first session key based on a preset message authentication code generation algorithm to obtain an initial message authentication code;

[0009] Processing the instruction to be processed by using the first session key based on the message authentication code generation algorithm to obtain a target message authentication code;

[0010] The initial data including the temporary session public key, the random number, the signature string and the initial message authentication code, and the target data including the instruction to be processed and the target message authentication code are sent to the intermediate device and forwarded to the security chip; wherein the security chip verifies the initial data, and verifies and processes the target data after the verification, and obtains the processing result and sends it to the intermediate device.

[0011] Optionally, the method further includes:

[0012] In response to the preprocessing request, generating the server public-private key pair;

[0013] Sending a preprocessing instruction including the server public key to the intermediate device, so that the intermediate device forwards the preprocessing instruction to the security chip, and the security chip responds based on the preprocessing instruction and sends the security chip identifier and the security chip public key to the intermediate device;

[0014] The security chip identifier and the security chip public key sent by the intermediate device are received and stored.

[0015] The embodiment of the present disclosure also provides a communication method between a server and a security chip, which is applied to a security chip. The server is connected to the security chip through an intermediate device. The security chip has a corresponding security chip public-private key pair and stores a server public key corresponding to the server. The method includes:

[0016] Receive initial data including a temporary session public key, a random number, a signature string, and an initial message authentication code sent by the intermediate device, and verify the signature string based on the server public key;

[0017] After the signature verification is passed, the temporary session public key and the security chip private key are negotiated through a preset key negotiation algorithm to obtain a second session key;

[0018] The temporary session public key, the random number and the signature character string are processed by the second session key based on a preset message authentication code generation algorithm to obtain a first verification message authentication code;

[0019] When the initial message authentication code and the first verification message authentication code are the same, the random number is saved, and a communication connection success message is sent to the intermediate device, and the target data sent by the intermediate device containing the instructions to be processed and the target message authentication code is received, and the target data is processed to obtain the processing result and send it to the intermediate device.

[0020] Optionally, the processing the target data to obtain the processing result includes:

[0021] Processing the instruction to be processed by using the second session key based on a preset message authentication code generation algorithm to obtain a second verification message authentication code;

[0022] In the case where the target message authentication code and the second verification message authentication code are the same, respond to the instruction to be processed to obtain the processing result.

[0023] Optionally, the method further includes:

[0024] Receiving a preprocessing instruction including the server public key sent by the intermediate device, and obtaining a status identifier;

[0025] When the state identifier is the first identifier, the server public key is saved, a public-private key pair of the security chip is generated, and the state identifier is updated to the second identifier; wherein the first identifier indicates that the security chip is in an unpreprocessed state, and the second identifier indicates that the security chip has been preprocessed;

[0026] The security chip identifier and the security chip public key are sent to the intermediate device, so that the intermediate device sends the security chip identifier and the security chip public key to the server for storage.

[0027] Optionally, the method further includes:

[0028] Before saving the random number, determining whether the random number is greater than a stored random number;

[0029] In a case where the random number is greater than the stored random number, a subsequent communication connection operation is performed.

[0030] The embodiment of the present disclosure also provides a communication device between a server and a security chip, which is applied to the server, wherein the server is connected to the security chip through an intermediate device, the server has a corresponding server public-private key pair, and stores a security chip identifier and a security chip public key corresponding to the security chip, and the device includes:

[0031] A response generation module, used to respond to session requests and generate a temporary session public and private key pair and a random number;

[0032] A signature module, used to sign the temporary session public key and the random number based on the server private key to obtain a signature string;

[0033] A first negotiation module, configured to perform key negotiation on a temporary session private key and the security chip public key through a preset key negotiation algorithm to obtain a first session key;

[0034] A first generating module, configured to process the temporary session public key, the random number and the signature string through the first session key based on a preset message authentication code generation algorithm to obtain an initial message authentication code;

[0035] A second generating module, configured to process the instruction to be processed by using the first session key based on the message authentication code generation algorithm to obtain a target message authentication code;

[0036] The first sending module is used to send the initial data including the temporary session public key, the random number, the signature string and the initial message authentication code, and the target data including the instruction to be processed and the target message authentication code to the intermediate device, and forward it to the security chip; wherein the security chip verifies the initial data, and verifies and processes the target data after the verification, and obtains the processing result and sends it to the intermediate device.

[0037] The embodiment of the present disclosure also provides a communication device between a server and a security chip, which is applied to a security chip. The server is connected to the security chip through an intermediate device. The security chip has a corresponding security chip public-private key pair and stores a server public key corresponding to the server. The device includes:

[0038] A receiving module, used to receive initial data including a temporary session public key, a random number and a signature string and an initial message authentication code sent by the intermediate device;

[0039] A signature verification module, used to verify the signature string based on the server public key;

[0040] A second negotiation module is used to negotiate the temporary session public key and the security chip private key through a preset key negotiation algorithm to obtain a second session key after the signature verification is passed;

[0041] A third generation module is used to obtain a first verification message authentication code by performing the verification on the temporary session public key, the random number and the signature string through the second session key based on a preset message authentication code generation algorithm;

[0042] A random number storage module, used for storing the random number when the initial message authentication code and the first verification message authentication code are the same;

[0043] A second sending module, configured to send a communication connection success message to the intermediate device when the initial message authentication code and the first verification message authentication code are the same;

[0044] A first receiving module, configured to receive target data including a to-be-processed instruction and a target message authentication code sent by the intermediate device;

[0045] The processing module is used to process the target data, obtain the processing result and send it to the intermediate device. The target data is processed, and the processing result is sent to the intermediate device.

[0046] An embodiment of the present disclosure also provides an electronic device, comprising: a processor; a memory for storing executable instructions of the processor; the processor is used to read the executable instructions from the memory and execute the instructions to implement the communication method between the server and the security chip provided in the embodiment of the present disclosure.

[0047] The embodiment of the present disclosure further provides a computer-readable storage medium, wherein the storage medium stores a computer program, and the computer program is used to execute the communication method between the server and the security chip provided in the embodiment of the present disclosure.

[0048] The embodiment of the present disclosure further provides a computer program product, including a computer program, wherein the computer program implements the communication method between the server and the security chip described in the above aspect when executed by a processor.

[0049] The technical solution provided by the embodiment of the present disclosure has the following advantages over the prior art: the communication solution between the server and the security chip provided by the embodiment of the present disclosure includes, applied to the server, the server is connected to the security chip through an intermediate device, the server has a corresponding server public-private key pair, and stores the security chip identifier and the security chip public key corresponding to the security chip, responds to a session request, generates a temporary session public-private key pair and a random number, and signs the temporary session public key and the random number based on the server private key to obtain a signature string; the temporary session private key and the security chip public key are negotiated through a preset key negotiation algorithm to obtain a first session key; based on a preset message authentication code generation algorithm, the temporary session public key, the random number and the signature string are negotiated through the first session key to obtain an initial message authentication code; based on the message authentication code generation algorithm, the to-be-processed instruction is processed through the first session key to obtain a target message authentication code; the initial data including the temporary session public key, the random number and the signature string and the initial message authentication code, and the target data including the to-be-processed instruction and the target message authentication code are sent to the intermediate device and forwarded to the security chip; wherein the security chip verifies the initial data, and after the verification is passed, verifies and processes the target data, obtains the processing result and sends it to the intermediate device. Therefore, generating a temporary session public and private key each time during the session processing can prevent brute force cracking problems. Anti-replay random numbers solve the anti-replay attack problem. Asymmetric key negotiation, symmetric key calculation, and message authentication code MAC (Message Authentication Code) increase execution efficiency. In each session processing stage, the server only needs to send data once, reducing the problem of data transmission failure due to network problems, increasing execution efficiency, and further improving the communication efficiency and security between the server and the security chip. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale.

[0051] Figure 1A An exemplary diagram of a communication system between a server and a security chip provided in an embodiment of the present disclosure;

[0052] Figure 1B An exemplary diagram of another communication system between a server and a security chip provided in an embodiment of the present disclosure;

[0053] Figure 2 A flow chart of a communication method between a server and a security chip provided in an embodiment of the present disclosure;

[0054] Figure 3 A flow chart of another communication method between a server and a security chip provided in an embodiment of the present disclosure;

[0055] Figure 4 An example diagram of communication between a server and a security chip provided in an embodiment of the present disclosure;

[0056] Figure 5 Another example diagram of communication between a server and a security chip provided in an embodiment of the present disclosure;

[0057] Figure 6 A schematic diagram of the structure of a communication device between a server and a security chip provided in an embodiment of the present disclosure;

[0058] Figure 7 A schematic diagram of the structure of another communication device between a server and a security chip provided in an embodiment of the present disclosure;

[0059] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0060] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0061] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0062] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0063] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0064] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0065] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0066] Many of the current identity authentication methods are based on insecure data for authentication. For example, some access control devices only authenticate the ID of the access control card. This type of data is not encrypted and is easy to be stolen. In addition, some authentication mechanisms use data encryption, but the data used is simply encrypted with a symmetric key, and the key lacks unique distribution, which makes it easy for the data to be intercepted and copied in large quantities through brute force, or the public key is used to encrypt a random number to generate a session key and send it to the security chip. Once the attacker knows the public key, the server masquerades as a server to encrypt its own random number to generate a session key, the attacker can operate the security chip at will, so there is still a great risk in terms of security. Or the server and the security chip SE have to interact back and forth many times each time to establish a secure channel. This is relatively inefficient, and most of them do not add anti-replay attack.

[0067] In view of the above problems, the present disclosure provides a communication method between a server and a security chip, which can be applied to Figure 1A In the application environment shown. The communication method between the server and the security chip is applied to the communication system between the server and the security chip. The communication system between the server and the security chip includes a server 101, an intermediate device 102 and a security chip 103. Among them, the server 101 communicates with the intermediate device 102 through a network, and the intermediate device 102 communicates with the security chip 103 through a network. Among them, the security chip 103 can be built into the intermediate device 102, such as a SIM (Subscriber Identity Module, user identification card), or it can be external to the intermediate device 102, such as an access card.

[0068] As an example, Figure 1BAs shown, the connection diagram of the server 101 and the intermediate device 102 includes the intermediate device 102 as the carrier of the security chip 103, the server 101, and the secure communication mechanism that ensures the safety and reliability of the entire issuance and subsequent authentication process. The security chip 103 can be a built-in SE of the TBOX device, or it can exist in the form of a SIM card or PSAM card. The intermediate device 102, as a user terminal, should provide network functions and system interfaces for operating these hardware functions, and provide access to the built-in SE or SIM / PSAM security channel interface. Common ones include smart phones, smart electronic certificates, TBOX, etc.

[0069] Specifically, in the preprocessing stage, the server 101 generates a server public and private key, and sends a preprocessing instruction including the server public key to the intermediate device 102. The intermediate device 102 forwards the preprocessing instruction to the security chip 103. After receiving the preprocessing instruction, the security chip 103 obtains a status identifier. When the status identifier is an unpreprocessed state, the server public key is saved, and a security chip public and private key pair is generated. The status identifier is updated to preprocessed, and the security chip identifier and the security chip public key are sent to the intermediate device 102. The intermediate device 102 sends the sent security chip identifier and security chip public key to the server for storage.

[0070] Specifically, in the session stage, the server 101 generates a temporary session public-private key pair and a random number, and signs the temporary session public key and the random number based on the server private key to obtain a signature string. The temporary session private key and the security chip public key are negotiated through a key negotiation algorithm to obtain a first session key. The temporary session public key, the random number and the signature string are processed through the first session key based on the message authentication code generation algorithm to obtain an initial message authentication code. The instruction to be processed is processed through the first session key based on the message authentication code generation algorithm to obtain a target message authentication code. The initial data including the temporary session public key, the random number and the signature string and the initial message authentication code, and the target data including the instruction to be processed and the target message authentication code are sent to the intermediate device 102. The intermediate device 102 forwards the initial data to the security chip 103. The security chip 103 verifies the initial data. After the verification is passed, the security chip 103 verifies and processes the target data forwarded by the intermediate device 102 to obtain a processing result, and sends the processing result to the intermediate device 102.

[0071] Therefore, placing the server public key in SE in the preprocessing stage and executing the preprocessing stage only once can prevent the problem of network interception and data tampering during the session. Generating a temporary session public and private key pair each time during the session stage can prevent the problem of brute force cracking. The anti-replay random number solves the anti-replay attack problem. The asymmetric key negotiation and symmetric key calculation MAC increase the execution efficiency. In each session processing stage, the server only needs to send data once, reducing the problem of data transmission failure due to network problems and increasing execution efficiency.

[0072] Figure 2 The present invention provides a flow chart of a communication method between a server and a security chip, which can be performed by a communication device between the server and the security chip, wherein the device can be implemented by software and / or hardware, and can generally be integrated in an electronic device. Figure 2 As shown, the method is applied to a server, the server is connected to a security chip through an intermediate device, the server has a corresponding server public and private key pair, and stores a security chip identifier and a security chip public key corresponding to the security chip, including:

[0073] Step 201: In response to a session request, a temporary session public-private key pair and a random number are generated, and the temporary session public key and the random number are signed based on the server private key to obtain a signature string.

[0074] In the embodiment of the present disclosure, before performing session processing, the server and the security chip have completed preprocessing through the intermediate device, and the security chip identification and security chip public key of the security chip are obtained and stored in the server. Specifically, after obtaining the preprocessing request, the server generates a server public-private key pair, and sends a preprocessing instruction including the server public key to the intermediate device, so that the intermediate device forwards the preprocessing instruction to the security chip, and the security chip responds based on the preprocessing instruction, and sends the security chip identification and security chip public key to the intermediate device, and the server receives and stores the security chip identification and security chip public key sent by the intermediate device.

[0075] In the disclosed embodiment, after obtaining the session processing request, a temporary session public-private key pair and a random number are generated, and the temporary session public key and the random number are signed by the server private key based on a digital signature algorithm (such as an ECC signature, etc.) to obtain a signature string.

[0076] Step 202: The temporary session private key and the security chip public key are negotiated using a preset key negotiation algorithm to obtain a first session key.

[0077] In the disclosed embodiment, the generated temporary session public-private key pair includes a temporary session private key. The temporary session private key and the security chip public key are subjected to key negotiation through a preset key negotiation algorithm to obtain a first session key; wherein the preset key negotiation algorithm can be selected and set according to application needs, such as an ECC key negotiation algorithm, etc.

[0078] Step 203: Based on a preset message authentication code generation algorithm, the temporary session public key, the random number and the signature string are processed by the first session key to obtain an initial message authentication code.

[0079] In the embodiments of the present disclosure, a message authentication code generation algorithm is pre-set, such as CMAC, etc., and the setting is selected according to application needs.

[0080] In the disclosed embodiment, after obtaining the first session key, an initial message authentication code is generated by a message authentication code generation algorithm based on the first session key, a temporary session public key, a random number and a signature string; usually the initial message authentication code is one.

[0081] Step 204: Based on the message authentication code generation algorithm, the instruction to be processed is processed using the first session key to obtain a target message authentication.

[0082] In the embodiment of the present disclosure, the pending instruction refers to the instruction that the security chip needs to execute. The pending instruction is different in different application scenarios. For example, if the security chip is a vehicle-side security chip, the pending instruction may be to add or modify a vehicle-side key.

[0083] In the embodiment of the present disclosure, the message authentication code generation algorithm is the same as the message authentication code generation algorithm of step 203, and the instructions to be processed are processed by the first session key based on the message authentication code generation algorithm to obtain the target message authentication; wherein the number of target message authentications is the same as the number of instructions to be processed.

[0084] Step 205: Send the initial data including the temporary session public key, the random number and the signature string and the initial message authentication code, and the target data including the instructions to be processed and the target message authentication code to the intermediate device, and forward them to the security chip; wherein the security chip verifies the initial data, and verifies the target data after the verification is passed, and obtains the processing result and sends it to the intermediate device.

[0085] In the embodiment of the present disclosure, after the initial message authentication code and the target message authentication code are generated, the temporary session public key, the random number and the signature string are combined with the initial message authentication code into initial data, usually the initial data is one piece of data, and the instructions to be processed and the target message authentication code are combined into target data and sent to the intermediate device, usually there are as many pieces of target data as there are instructions to be processed.

[0086] In the disclosed embodiment, the server usually calculates multiple target message authentication codes quickly, but network interaction is time-consuming and there may be network interruptions. In order to ensure the efficiency of communication, the server sends the initial data and target data to the intermediate device at one time. The intermediate device first sends the initial data to the security chip, and the security chip verifies the initial data. After the verification is passed, the intermediate device sends each target data to the security chip, and the security chip verifies and processes the target data, and sends the processing results to the intermediate device.

[0087] The communication scheme between a server and a security chip provided in an embodiment of the present disclosure is applied to a server. The server is connected to the security chip through an intermediate device. The server has a corresponding server public-private key pair, and stores a security chip identifier and a security chip public key corresponding to the security chip. In response to a session request, a temporary session public-private key pair and a random number are generated, and the temporary session public key and the random number are signed based on the server private key to obtain a signature string; the temporary session private key and the security chip public key are negotiated through a preset key negotiation algorithm to obtain a first session key; the temporary session public key, the random number and the signature string are processed through the first session key based on a preset message authentication code generation algorithm to obtain an initial message authentication code; the instruction to be processed is processed through the first session key based on the message authentication code generation algorithm to obtain a target message authentication code; the initial data including the temporary session public key, the random number and the signature string and the initial message authentication code, and the target data including the instruction to be processed and the target message authentication code are sent to the intermediate device to be forwarded to the security chip; wherein the security chip verifies the initial data, and verifies and processes the target data after the verification is passed, and the processing result is sent to the intermediate device. Therefore, generating temporary session public and private keys during each session processing can prevent brute force cracking problems, anti-replay random numbers solve the replay attack problem, asymmetric key negotiation and symmetric key calculation of message authentication code MAC increase execution efficiency. In each session processing stage, the server only needs to send data once, reducing the problem of data transmission failure due to network problems, increasing execution efficiency, and further improving the communication efficiency and security between the server and the security chip.

[0088] Figure 3 This is a flow chart of another communication method between a server and a security chip provided by an embodiment of the present disclosure. The method can be executed by a communication device between a server and a security chip, wherein the device can be implemented by software and / or hardware and can generally be integrated in an electronic device. Figure 3 As shown, the method is applied to a security chip, the server is connected to the security chip through an intermediate device, the security chip has a corresponding security chip public and private key pair, and stores a server public key corresponding to the server, including:

[0089] Step 301: Receive initial data including a temporary session public key, a random number, a signature string, and an initial message authentication code sent by an intermediate device, and verify the signature string based on the server public key.

[0090] In the embodiment of the present disclosure, before performing session processing, the server and the security chip have completed the preprocessing stage processing through the intermediate device. Specifically, after the security chip receives the preprocessing instruction including the server public key sent by the intermediate device, the security chip responds based on the preprocessing instruction, obtains and stores the server public key corresponding to the server, generates a security chip public-private key pair, and sends the security chip identifier and the security chip public key to the intermediate device for forwarding to the server for storage.

[0091] In some embodiments, in order to ensure that the preprocessing stage is performed only once, a preprocessing instruction including a server public key is received from an intermediate device, a status identifier is obtained, and when the status identifier is a first identifier, the server public key is saved, and a security chip public-private key pair is generated, and the status identifier is updated to a second identifier; wherein the first identifier indicates that the security chip is in an unpreprocessed state, and the second identifier indicates that the security chip has been preprocessed, and the security chip identifier and the security chip public key are sent to the intermediate device, so that the intermediate device sends the security chip identifier and the security chip public key to the server for storage.

[0092] In the embodiment of the present disclosure, session processing can be performed after the preprocessing is completed, thereby receiving the initial data sent by the intermediate device, including a temporary session public key, a random number and a signature string and an initial message authentication code, and further verifying the signature string in the initial data, and verifying the signature string through the server public key based on the same data signature algorithm.

[0093] Step 302: After the signature verification is passed, the temporary session public key and the security chip private key are negotiated through a preset key negotiation algorithm to obtain a second session key.

[0094] In the disclosed embodiment, after the signature verification is passed, the temporary session public key and the security chip private key are subjected to key negotiation through the same key negotiation algorithm to obtain a second session key.

[0095] Step 303: Based on a preset message authentication code generation algorithm, the temporary session public key, the random number and the signature character string are processed by the second session key to obtain a first verification message authentication code.

[0096] In the disclosed embodiment, based on the same message authentication code generation algorithm, the temporary session public key, the random number and the signature character string are processed by the second session key to obtain the first verification message authentication code.

[0097] Step 304: When the initial message authentication code and the first verification message authentication code are the same, the random number is saved, and a communication connection success message is sent to the intermediate device. The target data including the instructions to be processed and the target message authentication code sent by the intermediate device is received, and the target data is processed to obtain the processing result and sent to the intermediate device.

[0098] In the embodiment of the present disclosure, when the initial message authentication code and the first verification message authentication code are the same, the random number can be further saved. In order to improve security, before the random number is saved, it is determined whether the random number is greater than the stored random number. If the random number is greater than the stored random number, the subsequent communication connection operation is performed. Therefore, in the secure channel establishment request, the security chip determines whether the new random number is greater than the previously saved random number. If the new random number is greater than the previous random number, communication is allowed, otherwise, the communication is deemed illegal to implement an anti-replay attack mechanism.

[0099] In an embodiment of the present disclosure, when the initial message authentication code and the first verification message authentication code are the same, a communication connection success message can be sent to the intermediate device, so that the intermediate device can continue to send the target data containing the instructions to be processed and the target message authentication code to the security chip, thereby processing the target data and sending the processing results to the intermediate device.

[0100] In the embodiments of the present disclosure, there are many ways to process the target data and obtain the processing result. For example, based on a preset message authentication code generation algorithm, the instruction to be processed is processed with a second session key to obtain a second verification message authentication code. When the target message authentication code and the second verification message authentication code are the same, the instruction to be processed is responded to to obtain the processing result. Another example is to input the target data into a pre-trained processing module to obtain the processing result.

[0101] The communication method between the server and the security chip of the embodiment of the present disclosure includes a preprocessing stage and a session stage. The preprocessing stage is executed only once for each security chip, while the session stage is executed for each session.

[0102] Specifically, Figure 4As shown, the preprocessing stage includes: step 1, the server generates a server public-private key pair, such as generating and saving the server's SM2 or ECC public-private key pair; step 2, the server sends a preprocessing instruction to a specific intermediate device, and the preprocessing instruction includes the server public key; step 3, the intermediate device receives the preprocessing instruction and transparently transmits it to the security chip; step 4, after receiving the preprocessing instruction, the security chip first determines whether the preprocessing has been completed. If the preprocessing has not been completed, the server public key is saved and the public-private key pair of the security chip is generated and saved in the security chip. If it has been personalized, an error prompt is given (for example, if the status status is judged to be 2, an error is given; if the status status is 1, the server public key is saved and the SM2 or ECC public-private key pair is generated and saved, and the status status is set to 2); step 5, the security chip marks the completion of the preprocessing stage and replies to the intermediate device with the preprocessing result, which includes the unique identifier of the security chip (the security chip identifier, i.e., the security chip id) and the public key of the security chip; step 6, the intermediate device transparently transmits the return result of the security chip to the server, and the server saves the corresponding security chip public key and security chip identifier.

[0103] Specifically, Figure 5As shown, the session phase includes: step 1, the server generates a temporary session public-private key pair (for example, generates a temporary SM2 or ECC public-private key pair); step 2, the server uses the snowflake algorithm or timestamp to generate an anti-replay random number (i.e., an ordered random number); step 3, the server uses the server private key pair (temporary session public key + random number) to sign the signature string; step 4, the server uses the temporary session private key and the security chip public key to negotiate (such as the key negotiation algorithm ECC, etc.) to generate a session key; step 5, the session key pair (temporary session public key + random number + the previous one) is used to calculate the MAC, and the MAC generation algorithm can use the NIST Special Publication 800-38B or other algorithms; Step 6, use the session key to calculate MAC for other instructions (assuming there are N) that need to be sent to the security chip; Step 7, the security chip sends the prepared 1+N instructions to the intermediate device, and the intermediate device caches the 1+N instructions to be sent; Step 8, save the N+1 instructions that need to be sent, Step 9, the intermediate device first transparently transmits the first instruction to establish a secure channel; Step 10, after receiving the instruction, the security chip uses the server public key saved in the preprocessing stage to verify the signature of the data; Step 11, use the temporary session public key and the security chip private key to coordinate The middle device generates a session key, which is theoretically the same as the session key negotiated by the server; Step 12, the security chip uses the negotiated session key to calculate the MAC and perform MAC verification; Step 13, if the MAC calculated by the server is consistent, the secure channel is successfully established, and the anti-replay random number is saved; Step 14, the information of successful channel establishment is returned to the middle device; Step 15, the middle device transmits the remaining N instructions one by one, and the security chip uses the session key to perform MAC verification on each instruction, and then responds to the processing instruction after the consistency is consistent, and the processing result is fed back to the middle device. Among them, 1+N instructions are sent to the middle device together, and the middle device sends them to the security chip one by one. If the first verification fails, the middle device will not continue to send, thus reducing the number of network interactions; the interaction between the middle device and SE does not require the network, and the interaction between the middle device and the server needs to go through the network, thereby improving communication efficiency.

[0104] Therefore, a communication method between a server and a security chip is provided. In the preprocessing stage, the server public key is placed in the SE and the preprocessing stage is only executed once. The security chip can prevent the problem of network interception and data tampering during the session by verifying the server public key. During the session, a temporary session key is generated each time to prevent the problem of brute force cracking. The anti-replay random number solves the problem of anti-replay attack (for example, the N+1 instructions are hijacked by the network and then repeatedly sent to the SE). The asymmetric key negotiation symmetric key calculation mac increases the execution efficiency. In each session processing stage, the server only needs to send data once, which reduces the problem of data sending failure due to network problems and increases the execution efficiency.

[0105] Figure 6 This is a schematic diagram of the structure of a communication device between a server and a security chip provided by an embodiment of the present disclosure. The device can be implemented by software and / or hardware and can generally be integrated into an electronic device. Figure 6 As shown, the device is applied to a server, the server is connected to the security chip through an intermediate device, the server has a corresponding server public and private key pair, and stores a security chip identifier and a security chip public key corresponding to the security chip, including:

[0106] A response generation module 601 is used to respond to a session request and generate a temporary session public and private key pair and a random number;

[0107] The signature module 602 is used to sign the temporary session public key and the random number based on the server private key to obtain a signature string;

[0108] A first negotiation module 603 is used to perform key negotiation on a temporary session private key and the security chip public key through a preset key negotiation algorithm to obtain a first session key;

[0109] A first generating module 604 is used to process the temporary session public key, the random number and the signature string through the first session key based on a preset message authentication code generation algorithm to obtain an initial message authentication code;

[0110] A second generating module 605 is used to process the instruction to be processed by using the first session key based on the message authentication code generation algorithm to obtain a target message authentication code;

[0111] The first sending module 606 is used to send the initial data including the temporary session public key, the random number, the signature string and the initial message authentication code, and the target data including the instruction to be processed and the target message authentication code to the intermediate device, and forward it to the security chip; wherein the security chip verifies and processes the initial data, and processes the target data after the verification is passed, and obtains the processing result and sends it to the intermediate device.

[0112] Optionally, the device further includes:

[0113] A response module, used for generating the server public and private key pair in response to the preprocessing request;

[0114] A third sending module is used to send a pre-processing instruction including the server public key to the intermediate device, so that the intermediate device forwards the pre-processing instruction to the security chip, and the security chip responds based on the pre-processing instruction and sends the security chip identifier and the security chip public key to the intermediate device;

[0115] The second receiving module is used to receive and store the security chip identifier and the security chip public key sent by the intermediate device.

[0116] Figure 7 This is a schematic diagram of the structure of another communication device between a server and a security chip provided in an embodiment of the present disclosure. The device can be implemented by software and / or hardware and can generally be integrated into an electronic device. Figure 7 As shown, the device is applied to a security chip, the server is connected to the security chip through an intermediate device, the security chip has a corresponding security chip public and private key pair, and stores the server public key corresponding to the server, including:

[0117] The receiving module 701 is used to receive the initial data including the temporary session public key, the random number and the signature string and the initial message authentication code sent by the intermediate device;

[0118] The signature verification module 702 is used to verify the signature string based on the server public key;

[0119] The second negotiation module 703 is used to perform key negotiation on the temporary session public key and the security chip private key through a preset key negotiation algorithm to obtain a second session key after the signature verification is passed;

[0120] The third generation module 704 is used to obtain a first verification message authentication code by performing the verification on the temporary session public key, the random number and the signature string through the second session key based on a preset message authentication code generation algorithm;

[0121] A random number storage module 705, configured to store the random number when the initial message authentication code and the first verification message authentication code are the same;

[0122] A second sending module 706, configured to send a communication connection success message to the intermediate device when the initial message authentication code and the first verification message authentication code are the same;

[0123] The first receiving module 707 is used to receive target data including the instruction to be processed and the target message authentication code sent by the intermediate device;

[0124] The processing module 708 is used to process the target data, obtain the processing result and send it to the intermediate device.

[0125] Optionally, the processing module is specifically used to:

[0126] Processing the instruction to be processed by using the second session key based on a preset message authentication code generation algorithm to obtain a second verification message authentication code;

[0127] In the case where the target message authentication code and the second verification message authentication code are the same, respond to the instruction to be processed to obtain the processing result.

[0128] Optionally, the device further includes:

[0129] A receiving and obtaining module, used for receiving a pre-processing instruction including the server public key sent by the intermediate device, and obtaining a status identifier;

[0130] An update module, configured to save the server public key, generate a public-private key pair of a security chip, and update the status identifier to a second identifier when the status identifier is a first identifier; wherein the first identifier indicates that the security chip is in an unpreprocessed state, and the second identifier indicates that the security chip has been preprocessed;

[0131] The fourth sending module is used to send the security chip identifier and the security chip public key to the intermediate device, so that the intermediate device sends the security chip identifier and the security chip public key to the server for storage.

[0132] Optionally, the device further includes:

[0133] A judgment module, used for judging whether the random number is greater than a stored random number before saving the random number;

[0134] An execution module is used to execute a subsequent communication connection operation when the random number is greater than the stored random number.

[0135] The communication device between the server and the security chip provided in the embodiments of the present disclosure can execute the communication method between the server and the security chip provided in any embodiment of the present disclosure, and has the functional modules and beneficial effects corresponding to the execution method.

[0136] The embodiments of the present disclosure also provide a computer program product, including a computer program / instruction, which, when executed by a processor, implements the communication method between the server and the security chip provided in any embodiment of the present disclosure.

[0137] Figure 8 This is a schematic diagram of the structure of an electronic device provided by an embodiment of the present disclosure. Figure 8, which shows a schematic diagram of the structure of an electronic device 800 suitable for implementing the embodiment of the present disclosure. The electronic device 800 in the embodiment of the present disclosure may include, but is not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 8 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0138] like Figure 8 As shown, the electronic device 800 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 802 or a program loaded from a storage device 808 into a random access memory (RAM) 803. In the RAM 803, various programs and data required for the operation of the electronic device 800 are also stored. The processing device 801, the ROM 802, and the RAM 803 are connected to each other via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0139] Typically, the following devices may be connected to the I / O interface 805: input devices 806 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 807 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 808 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 809. The communication device 809 may allow the electronic device 800 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 8 The electronic device 800 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0140] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 809, or installed from a storage device 808, or installed from a ROM 802. When the computer program is executed by the processing device 801, the above-mentioned functions defined in the communication method between the server and the security chip of the embodiment of the present disclosure are executed.

[0141] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0142] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (Hyper Text Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0143] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0144] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device executes the communication method between the server and the security chip.

[0145] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0146] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0147] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware, wherein the name of a unit does not, in some cases, limit the unit itself.

[0148] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0149] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0150] According to one or more embodiments of the present disclosure, the present disclosure provides an electronic device, including:

[0151] processor;

[0152] a memory for storing instructions executable by the processor;

[0153] The processor is used to read the executable instructions from the memory and execute the instructions to implement any communication method between the server and the security chip provided in the present disclosure.

[0154] According to one or more embodiments of the present disclosure, the present disclosure provides a computer-readable storage medium, wherein the storage medium stores a computer program, wherein the computer program is used to execute any one of the communication methods between a server and a security chip provided by the present disclosure.

[0155] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0156] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0157] Although the subject matter has been described in language specific to structural features and / or methodological logical actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims.

Claims

1. A communication method between a server and a security chip, characterized in that: Applied to a server, the server is connected to a security chip through an intermediate device, the server has a corresponding server public-private key pair, and stores a security chip identifier and a security chip public key corresponding to the security chip, the method comprising: In response to the session request, a temporary session public-private key pair and a random number are generated, and the temporary session public key and the random number are signed based on the server private key to obtain a signature string; The temporary session private key and the security chip public key are negotiated using a preset key negotiation algorithm to obtain a first session key; The temporary session public key, the random number and the signature character string are processed by the first session key based on a preset message authentication code generation algorithm to obtain an initial message authentication code; Processing the instruction to be processed by using the first session key based on the message authentication code generation algorithm to obtain a target message authentication code; The initial data including the temporary session public key, the random number, the signature string and the initial message authentication code, and the target data including the instruction to be processed and the target message authentication code are sent to the intermediate device and forwarded to the security chip; wherein the security chip verifies the initial data, and verifies and processes the target data after the verification, and obtains the processing result and sends it to the intermediate device.

2. The communication method between a server and a security chip according to claim 1, characterized in that: The method further comprises: In response to the preprocessing request, generating the server public-private key pair; Sending a preprocessing instruction including the server public key to the intermediate device, so that the intermediate device forwards the preprocessing instruction to the security chip, and the security chip responds based on the preprocessing instruction and sends the security chip identifier and the security chip public key to the intermediate device; The security chip identifier and the security chip public key sent by the intermediate device are received and stored.

3. A communication method between a server and a security chip, characterized in that: Applied to a security chip, a server is connected to the security chip through an intermediate device, the security chip has a corresponding security chip public-private key pair, and stores a server public key corresponding to the server, the method comprising: Receive initial data including a temporary session public key, a random number, a signature string, and an initial message authentication code sent by the intermediate device, and verify the signature string based on the server public key; After the signature verification is passed, the temporary session public key and the security chip private key are negotiated through a preset key negotiation algorithm to obtain a second session key; The temporary session public key, the random number and the signature character string are processed by the second session key based on a preset message authentication code generation algorithm to obtain a first verification message authentication code; When the initial message authentication code and the first verification message authentication code are the same, the random number is saved, and a communication connection success message is sent to the intermediate device, and the target data sent by the intermediate device containing the instructions to be processed and the target message authentication code is received, and the target data is processed to obtain the processing result and send it to the intermediate device.

4. The communication method between a server and a security chip according to claim 3, characterized in that: The processing of the target data to obtain the processing result includes: Processing the instruction to be processed by using the second session key based on a preset message authentication code generation algorithm to obtain a second verification message authentication code; In the case where the target message authentication code and the second verification message authentication code are the same, respond to the instruction to be processed to obtain the processing result.

5. The communication method between a server and a security chip according to claim 3, characterized in that: The method further comprises: Receiving a preprocessing instruction including the server public key sent by the intermediate device, and obtaining a status identifier; When the state identifier is the first identifier, the server public key is saved, a public-private key pair of the security chip is generated, and the state identifier is updated to the second identifier; wherein the first identifier indicates that the security chip is in an unpreprocessed state, and the second identifier indicates that the security chip has been preprocessed; The security chip identifier and the security chip public key are sent to the intermediate device, so that the intermediate device sends the security chip identifier and the security chip public key to the server for storage.

6. The communication method between a server and a security chip according to claim 3, characterized in that: The method further comprises: Before saving the random number, determining whether the random number is greater than a stored random number; In a case where the random number is greater than the stored random number, a subsequent communication connection operation is performed.

7. A communication device between a server and a security chip, characterized in that: Applied to a server, the server is connected to a security chip through an intermediate device, the server has a corresponding server public and private key pair, and stores a security chip identifier and a security chip public key corresponding to the security chip, the device comprises: A response generation module, used to respond to session requests and generate a temporary session public and private key pair and a random number; A signature module, used to sign the temporary session public key and the random number based on the server private key to obtain a signature string; A first negotiation module, configured to perform key negotiation on a temporary session private key and the security chip public key through a preset key negotiation algorithm to obtain a first session key; A first generating module, configured to process the temporary session public key, the random number and the signature string through the first session key based on a preset message authentication code generation algorithm to obtain an initial message authentication code; A second generating module, configured to process the instruction to be processed by using the first session key based on the message authentication code generation algorithm to obtain a target message authentication code; The first sending module is used to send the initial data including the temporary session public key, the random number, the signature string and the initial message authentication code, and the target data including the instruction to be processed and the target message authentication code to the intermediate device, and forward it to the security chip; wherein the security chip verifies the initial data, and verifies and processes the target data after the verification, and obtains the processing result and sends it to the intermediate device.

8. A communication device between a server and a security chip, characterized in that: Applied to a security chip, a server is connected to the security chip through an intermediate device, the security chip has a corresponding security chip public-private key pair, and stores a server public key corresponding to the server, the device includes: A receiving module, used to receive initial data including a temporary session public key, a random number and a signature string and an initial message authentication code sent by the intermediate device; A signature verification module, used to verify the signature string based on the server public key; A second negotiation module is used to, after the signature verification is passed, perform key negotiation on the temporary session public key and the security chip private key through a preset key negotiation algorithm to obtain a second session key; A third generation module is used to obtain a first verification message authentication code by performing the verification on the temporary session public key, the random number and the signature string through the second session key based on a preset message authentication code generation algorithm; A random number storage module, used for storing the random number when the initial message authentication code and the first verification message authentication code are the same; A second sending module, configured to send a communication connection success message to the intermediate device when the initial message authentication code and the first verification message authentication code are the same; A first receiving module, configured to receive target data including a to-be-processed instruction and a target message authentication code sent by the intermediate device; The processing module is used to process the target data, obtain the processing result and send it to the intermediate device. The target data is processed, and the processing result is sent to the intermediate device.

9. An electronic device, characterized in that: The electronic device comprises: processor; a memory for storing instructions executable by the processor; The processor is used to read the executable instructions from the memory and execute the instructions to implement the communication method between the server and the security chip described in any one of claims 1-2 or claims 3-6.

10. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and the computer program is used to execute the communication method between the server and the security chip described in claims 1-2 or claims 3-6.

Images