Communication method, system and device based on secure element and storage medium

Abstract

The invention relates to a communication method, system and device based on a secure element and a storage medium. The method comprises: determining a session temporary key between the controller and the secure element; the session temporary key is constructed based on the session identifier and an element communication key corresponding to the controller, and the element communication key is constructed based on the element identifier of the secure element; encrypting session communication data of a target session identified by the session identifier based on the session temporary key to obtain session encrypted data; sending the session encrypted data to the secure element; the session encryption data is used for indicating the secure element to decrypt the received session encryption data based on the session temporary key so as to obtain the session communication data. Compared with the prior art, the communication data between the controller and the secure element can be encrypted, and the communication security can be improved.

Description

Technical Field

[0001] The present application relates to the field of secure communication technology, and in particular to a communication method, system, device and storage medium based on a security element. Background Art

[0002] The secure element (SE) is based on an integrated circuit design with physical anti-attack and anti-tampering characteristics. With the help of the on-chip operating system (COS), it achieves secure data storage and high-security encryption and decryption computing functions. The embedded secure element (eSE) is a special form of SE, which is mainly soldered directly on the circuit board in the form of a surface mount package. eSE usually uses communication protocols such as the Serial Peripheral Interface (SPI) or the Inter-Integrated Circuit (I2C) to provide a series of extremely critical security functions for the main control MCU (Microcontroller Unit).

[0003] In the current system architecture, data transmission between the main control MCU and the secure element (SE) module follows the ISO7816-4 standard, is encapsulated in the form of an application protocol data unit (APDU), and is efficiently transmitted through the underlying SPI or I2C communication protocol.

[0004] In the SPI and I2C communication protocols, data is transmitted in plain text, making the system vulnerable to external brute force attacks, causing data tampering or implantation of malicious code, and the security of data transmission is low. Summary of the invention

[0005] Based on this, it is necessary to provide a communication method, system, device and storage medium based on a security element that has high security and can reduce the risks of external interference, data tampering and implantation of malicious code in order to address the above technical problems.

[0006] In a first aspect, the present application provides a communication method based on a security element, which is applied to a controller, and the method includes:

[0007] Determine a temporary session key between the controller and the security element; the temporary session key is constructed based on a session identifier and an element communication key corresponding to the controller, and the element communication key is constructed based on an element identifier of the security element;

[0008] Based on the session temporary key, encrypt the session communication data of the target session identified by the session identifier to obtain session encrypted data;

[0009] The session encrypted data is sent to the security element; the session encrypted data is used to instruct the security element to decrypt the received session encrypted data based on the session temporary key to obtain the session communication data.

[0010] In one embodiment, determining a temporary key for a session between the controller and a secure element includes:

[0011] Obtaining a session identifier and a first master control random parameter, and determining a component communication key corresponding to the controller;

[0012] Generate a first ciphertext based on the session identifier, the first master random parameter, the component identifier, the component communication key, and a communication encryption algorithm for the security element;

[0013] Sending the first ciphertext to the security element; the first ciphertext is used to instruct the security element to generate a second ciphertext based on the session identifier in the first ciphertext, the first element random parameter of the local end, the element communication key of the local end, the element identifier and the communication encryption algorithm, and return the second ciphertext;

[0014] The second ciphertext is received, and a temporary session key between the controller and the security element is generated based on the session identifier, the first master random parameter, the element communication key, and the first element random parameter in the second ciphertext.

[0015] In one embodiment, determining the component communication key corresponding to the controller includes:

[0016] Obtaining a second master random parameter and a preset key for a security element, and determining a communication algorithm type for the security element;

[0017] Generate a third ciphertext based on the second master random parameter, the preset key, the communication algorithm type, and the communication encryption algorithm corresponding to the communication algorithm type;

[0018] Sending the third ciphertext to the security element; the third ciphertext is used to instruct the security element to generate a fourth ciphertext based on the element identifier, the second element random parameter of the local end, the second master random parameter in the third ciphertext, the preset key and the communication encryption algorithm, and return the fourth ciphertext;

[0019] The fourth ciphertext is received, and a component communication key corresponding to the controller is generated based on the second master random parameter, the second component random parameter in the fourth ciphertext, the component identifier, and the preset key.

[0020] In one embodiment, the method further comprises:

[0021] generating a first key verification parameter based on the second master random parameter, the second component random parameter in the fourth ciphertext, the component identification, and the component communication key;

[0022] Sending the first key verification parameter to the security element; the first key verification parameter is used to instruct the security element to verify the element communication key in the first key verification parameter and return a first key verification result;

[0023] Receive the first key verification result, and when the first key verification result indicates that the component communication key has passed the verification, execute the step of generating a first ciphertext based on the session identifier, the first master random parameter, the component identifier of the security element and the component communication key.

[0024] In one embodiment, the method further comprises:

[0025] generating a second key verification parameter based on the session identifier, the first master random parameter, the first element random parameter in the second ciphertext, and the session transient key;

[0026] Sending the second key verification parameter to the security element; the second key verification parameter is used to instruct the security element to verify the session temporary key in the second key verification parameter and return a second key verification result;

[0027] Receive the second key verification result, and when the second key verification result indicates that the session temporary key verification is passed, execute the step of encrypting the session communication data of the target session identified by the session identifier based on the session temporary key to obtain session encryption data.

[0028] In one of the embodiments, encrypting the session communication data of the target session identified by the session identifier based on the session temporary key to obtain the session encrypted data includes:

[0029] Acquire session communication data of the target session identified by the session identifier;

[0030] The session communication data is encrypted according to the session temporary key and the session authentication information corresponding to the target session to obtain session encrypted data.

[0031] In a second aspect, the present application further provides a communication method based on a security element, which is applied to a security element, and the method includes:

[0032] receiving session encrypted data sent by a controller; the session encrypted data is obtained by the controller encrypting session communication data of a target session based on a session temporary key between the controller and the security element; the session temporary key is constructed based on a session identifier of the target session and an element communication key corresponding to the security element, and the element communication key is constructed based on an element identifier of the security element;

[0033] The session encrypted data is decrypted based on the session temporary key to obtain the session communication data of the target session.

[0034] In one embodiment, the method further comprises:

[0035] receiving a first ciphertext sent by the controller, and decrypting the first ciphertext to obtain the session identifier, the first master control random parameter in the first ciphertext, and the component identifier;

[0036] generating a second ciphertext based on the session identifier, the component identifier, the component communication key, a first component random parameter of the local end, and a communication encryption algorithm for the security element;

[0037] The second ciphertext is sent to the controller; the second ciphertext is used to instruct the controller to generate the session temporary key based on the session identifier, the first component random parameter in the second ciphertext, the first master random parameter of the local end, the component communication key of the local end and the communication encryption algorithm.

[0038] In one embodiment, the method further comprises:

[0039] When receiving the second key verification parameter sent by the controller, verifying the session temporary key corresponding to the controller included in the second key verification parameter to obtain a second key verification result; the second key verification parameter is generated by the controller based on the session identifier, the first element random parameter in the second ciphertext, the first master random parameter of the local end, and the session temporary key of the local end;

[0040] The second key verification result is sent to the controller.

[0041] In one embodiment, the method further comprises:

[0042] receiving a third ciphertext sent by the controller, and decrypting the third ciphertext to obtain the second master control random parameter;

[0043] Generate a fourth ciphertext based on the second master random parameter in the third ciphertext, the component identifier, the preset key of the local end, the second component random parameter of the local end, and the communication encryption algorithm for the security element;

[0044] The fourth ciphertext is sent to the controller; the fourth ciphertext is used to instruct the controller to generate the component communication key corresponding to the controller based on the second master random parameter of the local end, the second component random parameter in the fourth ciphertext, the component identifier and the preset key.

[0045] In one embodiment, the method further comprises:

[0046] When receiving the first key verification parameter sent by the controller, verifying the component communication key corresponding to the controller included in the first key verification parameter to obtain a first key verification result; the first key verification parameter is generated by the controller based on the component identifier, the second master random parameter of the local end, the component communication key of the local end, and the second component random parameter in the fourth ciphertext;

[0047] The first key verification result is sent to the controller.

[0048] In one embodiment, the method further comprises:

[0049] obtaining component communication data for the target session to be sent to the controller;

[0050] Encrypting the component communication data based on the session temporary key to obtain component communication encrypted data;

[0051] The component communication encrypted data is sent to the controller; the component communication encrypted data is used to instruct the controller to decrypt the received component communication encrypted data based on the local session temporary key to obtain the component communication data.

[0052] In a third aspect, the present application further provides a communication system based on a security element, the system comprising:

[0053] A controller, configured to determine a temporary session key between the controller and a security element; the temporary session key is constructed based on a session identifier and an element communication key corresponding to the controller, and the element communication key is constructed based on an element identifier of the security element; based on the temporary session key, encrypting session communication data of a target session identified by the session identifier to obtain session encrypted data; and sending the session encrypted data to the security element;

[0054] The security element is used to receive the session encrypted data sent by the controller; decrypt the session encrypted data based on the session temporary key to obtain the session communication data of the target session.

[0055] In a fourth aspect, the present application further provides a communication device based on a security element, applied to a controller, the device comprising:

[0056] A temporary key determination module, used to determine a temporary key for a session between the controller and the security element; the temporary key for the session is constructed based on a session identifier and an element communication key corresponding to the controller, and the element communication key is constructed based on an element identifier of the security element;

[0057] A session data encryption module, used to encrypt the session communication data of the target session identified by the session identifier based on the session temporary key to obtain session encrypted data;

[0058] The encrypted data sending module is used to send the session encrypted data to the security element; the session encrypted data is used to instruct the security element to decrypt the received session encrypted data based on the session temporary key to obtain the session communication data.

[0059] In a fifth aspect, the present application further provides a communication device based on a security element, applied to a security element, the device comprising:

[0060] an encrypted data receiving module, configured to receive session encrypted data sent by a controller; the session encrypted data is obtained by the controller encrypting session communication data of a target session based on a session temporary key between the controller and the security element; the session temporary key is constructed based on a session identifier of the target session and an element communication key corresponding to the security element, and the element communication key is constructed based on an element identifier of the security element;

[0061] The session data decryption module is used to decrypt the session encrypted data based on the session temporary key to obtain the session communication data of the target session.

[0062] In a sixth aspect, the present application further provides a controller, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the communication method applied to the controller as described above when executing the computer program.

[0063] In a seventh aspect, the present application further provides a security element, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the communication method applied to the security element as described above when executing the computer program.

[0064] In an eighth aspect, the present application also provides a computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of the communication method applied to the controller as described above are implemented, or the steps of the communication method applied to the security element as described above are implemented.

[0065] The above-mentioned communication method, system, device and storage medium based on the security element, when it is necessary to establish a call between the controller and the security element, by determining the first temporary key between the controller and the security element, then, based on the first temporary key, encrypting the session communication data in the target session identified by the session identifier, after obtaining the session encrypted data, sending the session encrypted data to the security element, the session encrypted data is used to instruct the security element to decrypt the received session encrypted data based on the second temporary key to obtain the session communication data, thereby realizing encrypted communication between the controller and the security element and ensuring communication security; compared with the plaintext communication method, the session communication data is encrypted using the constructed first temporary key to ensure communication security between the controller and the security element; at the same time, the first temporary key is constructed based on the session identifier of the local end of the controller or the session identifier carried in the ciphertext data sent by the security element received by the controller and the first element communication key corresponding to the controller, and the first element communication key is constructed based on the element identifier of the security element received by the controller, the session identifier and the element identifier are embedded in the encryption process, and the target session between the session object can be encrypted one-to-one, which is conducive to further improving communication security. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0067] Figure 1 is an application environment diagram of a communication method based on a security element in an embodiment;

[0068] Figure 2 is a flow chart of a communication method based on a security element applied to a controller in one embodiment;

[0069] Figure 3 A schematic diagram of a process of determining a first temporary key in an embodiment;

[0070] Figure 4 A schematic diagram of a process for determining a first communication key in an embodiment;

[0071] Figure 5 is a flow chart of a communication method based on a security element applied to a security element in an embodiment;

[0072] Figure 6 A schematic diagram of a flow chart of a communication method based on a security element applied to a communication system in an embodiment;

[0073] Figure 7 A schematic diagram of a flow chart for determining a communication algorithm type and a communication encryption algorithm in one embodiment;

[0074] Figure 8 A schematic diagram of a process for generating and verifying a component communication key in one embodiment;

[0075] Fig. 9 A schematic diagram of a process for generating and verifying a session communication key in one embodiment;

[0076] Fig.10 A schematic diagram of a process of performing an encrypted call based on a session communication key in one embodiment;

[0077] Fig.11 is a structural block diagram of a communication device based on a security element applied to a controller in one embodiment;

[0078] Fig.12 FIG. 4 is a structural block diagram of a communication device based on a security element and applied to a security element in an embodiment. DETAILED DESCRIPTION

[0079] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0080] The communication method based on the security element provided in the embodiment of the present application can be applied to Figure 1In the application environment shown, such as a communication system, the communication system can be a car safety system, a smart home system, an NFC payment system, etc. The communication system includes a controller and a security element that communicates with the controller. The controller and the security element perform encrypted communication through a constructed element communication key to ensure secure data transmission. The controller is used to determine the session temporary key between the controller and the security element; the session temporary key is constructed based on the session identifier and the element communication key corresponding to the controller, and the element communication key is constructed based on the element identifier of the security element; based on the session temporary key, the session communication data of the target session identified by the session identifier is encrypted to obtain session encrypted data; the session encrypted data is sent to the security element. The security element is used to receive the session encrypted data sent by the controller; the session encrypted data is decrypted based on the session temporary key to obtain the session communication data of the target session.

[0081] The controller may be an ECU (Electronic Control Unit), microprocessor, embedded control system, etc. integrated in the automobile control system, or an intelligent gateway, processor, embedded system, etc. integrated in the smart home system, or an NFC controller integrated in the NFC payment system, payment terminal or mobile phone, etc. The security element may be an encryption chip, secure memory, biometric module, etc. integrated in the above-mentioned controllers.

[0082] In one embodiment of the present application, Figure 2 As shown, a communication method based on a security element is provided, and the method is applied to Figure 1 The controller in the embodiment is taken as an example to illustrate, and the method includes the following steps S201 to S203. Among them:

[0083] Step S201 , determining a temporary session key between the controller and the security element.

[0084] The session temporary key is constructed based on the session identifier and the component communication key corresponding to the controller, and the component communication key is constructed based on the component identifier of the security element.

[0085] The session identifier refers to an identifier generated by the controller when a session is established between the controller and the security element, and is used to distinguish different sessions. The session identifier can identify and track the session while the controller and the security element are communicating, ensuring the correct handling of the session. In specific implementation, the session identifier can be an ID (Identification), a randomly generated string, or a value generated by an algorithm, which is used to mark the current session, making it easier for the controller and the security element to identify the current session.

[0086] Among them, the component identification refers to the identification pre-written in the security element for distinguishing different components. The component identification can be used by the controller to identify the security element during the process of establishing a call between the controller and the security element to ensure the accuracy of the conversation object. In specific implementation, the component identification can be an ID, a randomly generated string, or a value generated by a certain algorithm and pre-written in the security element. The component identification of each security element is unique. For example, in order to increase communication security, the component identification of this embodiment is a 32-byte component ID consisting of two parts. The first 16 bytes of the component ID are a custom unique personalized ID, and the last 16 bytes are the unique self-contained ID of the security element itself, which is combined to form the component ID. Of course, in some other embodiments, the component ID can also be in other forms, and it only needs to be recognized by the controller to distinguish different security elements.

[0087] Among them, the session temporary key of this embodiment refers to the controller session temporary key (i.e., the session temporary key corresponding to the controller, hereinafter referred to as the "first temporary key") constructed by the controller based on the session identifier and stored on the local end, so that when the controller sends data to the security element, the data is encrypted using the first temporary key on the local end. When the controller constructs the first temporary key, the session identifier used generally refers to the session identifier generated and stored on its local end, so as to improve the accuracy of the construction of the first temporary key. It is understandable that in some other embodiments, the session identifier used by the controller when constructing the first temporary key may also be a session identifier carried in the ciphertext data sent by the security element during the communication process with the security element.

[0088] Among them, the component communication key of this embodiment refers to the controller component communication key (i.e., the component communication key corresponding to the controller, hereinafter referred to as the "first communication key") constructed by the controller based on the component identification of the security element and stored in the local end, which is used to establish an association relationship between the controller and the security element to ensure that the controller and the security element establish communication. When the controller constructs the first communication key, the component identification used generally refers to the component identification carried in the ciphertext data sent by the security element during the communication process with the security element.

[0089] Exemplarily, when communication needs to be established between the controller and the security element, the controller determines the first temporary key between it and the security element. When determining the first temporary key, the controller can directly obtain the first temporary key that is pre-built and stored on the local end of the controller to improve communication efficiency and reduce the computational burden of the controller; in addition, the controller can also construct the first temporary key in real time based on the interaction data with the security element in the corresponding round to increase the real-time nature of communication and ensure accurate transmission of data.

[0090] Step S202: Encrypt the session communication data of the target session identified by the session identifier based on the first temporary key to obtain session encryption data.

[0091] The target session refers to a session for data exchange and communication established between the controller and the security element, which is identified by a session identifier of the local end of the controller, during communication between the controller and the security element.

[0092] Among them, session communication data refers to data that is encrypted by the controller and transmitted to the security element when information is exchanged between the controller and the security element. The session communication data can be private key data, label data, and business data for processing by other business devices, etc.

[0093] The session encrypted data refers to the ciphertext data obtained after the controller encrypts the session communication data based on the first temporary key. The session encrypted data is used to instruct the security element to decrypt the received session encrypted data based on the second temporary key of the local end to obtain the session communication data.

[0094] Exemplarily, after determining the first temporary key, the controller determines the target session identified by the session identifier, encrypts the target session based on the first temporary key, and obtains session encryption data.

[0095] Step S203: Send the session encrypted data to the security element.

[0096] Exemplarily, the controller sends the encrypted session encryption data to the security element to instruct the security element to decrypt the received session encryption data based on its local security element session temporary key (i.e., the session temporary key corresponding to the security element, hereinafter referred to as the "second temporary key" for ease of distinction), and thereby obtain the corresponding session communication data.

[0097] In the above-mentioned communication method based on the security element, when it is necessary to establish a call between the controller and the security element, the first temporary key between the controller and the security element is determined, and then, based on the first temporary key, the session communication data in the target session identified by the session identifier is encrypted. After obtaining the session encrypted data, the session encrypted data is sent to the security element, and the session encrypted data is used to instruct the security element to decrypt the received session encrypted data based on the second temporary key to obtain the session communication data, thereby realizing encrypted communication between the controller and the security element and ensuring communication security; compared with the plaintext communication method, the session communication data is encrypted using the constructed first temporary key to ensure communication security between the controller and the security element; at the same time, the first temporary key is constructed based on the session identifier of the local end of the controller or the session identifier carried in the ciphertext data sent by the security element received by the controller and the first element communication key corresponding to the controller, and the first element communication key is constructed based on the element identifier of the security element received by the controller. The session identifier and the element identifier are embedded in the encryption process, and the target session with the session object can be encrypted one-to-one, which is conducive to further improving communication security.

[0098] In one embodiment, Figure 3 As shown, determining a first temporary key between a controller and a security element includes:

[0099] Step S301, obtain a session identifier and a first master random parameter, and determine a first communication key corresponding to the controller.

[0100] The first master random parameter refers to an undetermined parameter generated inside the controller, which can be a randomly generated random number, random string, random vector, random sequence, etc. of any length. For example, a randomly generated 8-byte random string "Ab80De13" is used as the first master random parameter. The first master random parameter is usually randomly generated by a true random number generator, so that the first master random parameter has higher security and unpredictability. The true random number generator can be a random number generator chip integrated in the controller, or it can be implemented by an external random number generator, which is not specifically limited in this embodiment.

[0101] Exemplarily, when a call needs to be established, the controller obtains a session identifier based on a local storage module, generates a first master random parameter through a true random number generator, and determines a first communication key corresponding to the controller; when determining the first communication key, the controller can directly obtain the first communication key that is pre-built and stored on the local end of the controller, and the controller can also construct the first communication key in real time based on the interaction data with the security element in the corresponding round.

[0102] Step S302: Generate a first ciphertext based on the session identifier, the first master random parameter, the element identifier, the first communication key and the communication encryption algorithm for the security element.

[0103] Among them, the communication encryption algorithm for the security element refers to the encryption algorithm determined by the controller according to the communication algorithm type supported by the security element, ensuring that the session encryption data sent by the controller can be received and decrypted by the security element. The communication algorithm type supported by the security element is preset in the security element, and the communication algorithm type includes but is not limited to AES (Advanced Encryption Standard), SM4 (Shangmi 4, a block cipher algorithm); the communication encryption algorithm refers to the encryption module corresponding to the aforementioned communication algorithm type, including but not limited to GCM mode (Galois / Counter Mode, i.e., authenticated encryption mode), ECB mode (Electronic Code Book Mode, i.e., electronic code book mode), CBC mode (Cipher Block Chaining Mode, i.e., cipher block chaining mode), etc.

[0104] Among them, the first ciphertext refers to the data obtained by encrypting the session identifier and the first master random parameter using the communication encryption algorithm on the controller side, with the session identifier and the first master random parameter to be encrypted, the additional information (i.e., the component identifier) ​​and the first communication key used for encryption as input. The first ciphertext is used to indicate that the security element generates the second ciphertext based on the session identifier in the first ciphertext, the first component random parameter of the local end of the security element, the component communication key of the local end of the security element (i.e., the component temporary key corresponding to the security element, hereinafter referred to as the "second communication key" for the convenience of distinction), the component identifier and the communication encryption algorithm, and returns the second ciphertext. The first ciphertext includes the first encrypted data and the first label data, the first encrypted data is composed of the encrypted session identifier and the encrypted first master random parameter, and is used to indicate that the security element generates the second ciphertext based on the session identifier in the first encrypted data and the relevant data of its local end, and the first label data is generated with the component identifier obtained by the controller as additional information, usually in the form of a fixed-length data block or code, and is used to indicate that the security element verifies the integrity and authenticity of the first encrypted data after receiving the first encrypted data to determine whether the first encrypted data has been tampered with.

[0105] Among them, the first component random parameter of the local end refers to the non-determined parameter generated inside the security element. The first component random parameter is similar to the first master control random parameter. For details, please refer to the above records and will not be repeated here.

[0106] The local component communication key refers to the security component communication key (i.e., the second communication key) constructed by the security component based on the component identification and stored in the local end, which is used to establish an association between the security component and the controller and verify the first communication key to ensure that the controller and the security component establish communication. When the security component constructs the second communication key, the component identification used generally refers to the component identification pre-written in the local end.

[0107] Exemplarily, taking the GCM mode of the AES algorithm as an example, the session identifier and the first master random parameter to be encrypted, the additional information (i.e., the component identifier) ​​and the first communication key used for encryption are taken as input, the controller divides the session identifier and the first master random parameter into multiple data blocks respectively, uses the first communication key and performs encryption operation on each data block through the GCM mode of the AES algorithm to obtain multiple ciphertext blocks, and combines the multiple ciphertext blocks to form the first encrypted data; during the encryption process, the controller performs GHASH operation on each ciphertext block and the additional information (i.e., the component identifier) ​​to obtain the first label data, and integrates the first encrypted data and the first label data to obtain the first ciphertext.

[0108] Step S303: Send the first ciphertext to the security element.

[0109] Step S304, receiving the second ciphertext, and generating a first temporary key between the controller and the security element based on the session identifier, the first master random parameter, the first communication key, and the first element random parameter in the second ciphertext.

[0110] Among them, the second ciphertext refers to the data obtained by encrypting the first element random parameter using the communication encryption algorithm on the side of the security element, and taking the first element random parameter to be encrypted, additional information (i.e., element identification and session identification) and the second communication key used for encryption as input. The second ciphertext is used to instruct the controller to generate the first temporary key based on the session identification, the first element random parameter in the second ciphertext, the first master random parameter of the local end and the first communication key of the local end. The second ciphertext includes the second encrypted data and the second tag data. The second encrypted data is the encrypted first element random parameter, which is used to instruct the controller to generate the first temporary key based on the first element random parameter in the second encrypted data, the session identification and the first master random parameter of its local end; the second tag data is generated with the element identification of the local end of the security element and the session identification in the first ciphertext as additional information. Similarly, it is usually expressed as a fixed-length data block or code, which is used to instruct the controller to verify the integrity and authenticity of the second encrypted data after receiving the second encrypted data to determine whether the second encrypted data has been tampered with.

[0111] Among them, when the controller generates the first temporary key based on the session identifier, the first element random parameter in the second ciphertext, the first master random parameter of the local end and the first communication key of the local end, the session identifier used can be the session identifier generated by the local end of the controller, or it can be the session identifier in the second tag data obtained by decrypting the second ciphertext.

[0112] Exemplarily, taking the GCM mode of the AES algorithm as an example, when the controller receives the second ciphertext, it takes the second ciphertext to be decrypted, additional information (i.e., the session identifier of the local end of the controller and the element identifier of the security element) and the first communication key as input, and the controller uses the first communication key and the GCM mode of the AES algorithm to decrypt each ciphertext block in the second encrypted data to obtain the original data block of each ciphertext block, and integrates the decrypted data blocks to obtain the first element random parameter in the second ciphertext; during the decryption process, the controller re-performs a GHASH operation on each ciphertext block and additional information (i.e., the session identifier of the local end of the controller and the element identifier of the security element) to obtain second verification data corresponding to the second tag data, and compares the second verification data with the second tag data. If the two match, it means that the second ciphertext has not been tampered with and the decryption is successful. If they do not match, it means that the second ciphertext has been tampered with or the decryption fails.

[0113] When the controller successfully decrypts, it obtains the first component random parameter that has not been tampered with in the second ciphertext, and generates the first temporary key between the controller and the security element based on the session identifier of the local end, the first master random parameter of the local end, the first communication key and the first component random parameter in the second ciphertext. Specifically, taking the CMAC algorithm (Cipher-basedMessage Authentication Code, i.e., a message authentication code algorithm based on block encryption) as an example, the controller concatenates the first component random parameter in the second ciphertext, the first master random parameter of the local end and the session identifier of the local end in a predetermined order to obtain a long string as input data to ensure that all relevant information is included; then, the first communication key is used to initialize CMAC, and two subkeys (a first subkey and a second subkey) are generated, the input data is divided into a plurality of blocks of a preset length, each block is encrypted using the first subkey, the first subkey is subjected to an XOR operation, and the result after the XOR operation is encrypted using the second subkey, and the data of a preset length is intercepted from the encrypted result of the second subkey to obtain the first temporary key.

[0114] In this embodiment, when generating the first ciphertext, the controller embeds the element identification of the security element as additional information into the first ciphertext, ensuring that only the security element with the corresponding element identification can decrypt the first ciphertext, preventing malicious or unauthorized elements from intercepting or decrypting the ciphertext content, so as to enhance communication security and protect the confidentiality and integrity of data; and, encrypting the first master random parameter and the session identification together can prevent malicious users from hijacking the session or replaying old communication content, so as to protect the integrity and authenticity of the communication. At the same time, the controller generates a first temporary key based on the first master random parameter and the first element random parameter. The random parameter is a randomly generated value that may be different in each session, thereby increasing the randomness and unpredictability of the communication, making it difficult for malicious users to predict the communication content, which is conducive to further improving communication security.

[0115] In one embodiment, Figure 4 As shown, determining a first communication key corresponding to the controller includes:

[0116] Step S401: obtain a second master random parameter and a preset key for a security element, and determine a communication algorithm type for the security element.

[0117] Among them, the second master control random parameter is similar to the first master control random parameter, and the details can be found in the above embodiment, which will not be described in detail in this embodiment.

[0118] The preset key refers to a key pre-written in the controller and the security element, which is used to encrypt the second master random parameter and generate the first communication key when the controller and the security element establish a connection. The preset key can be generated externally by the encryption machine and the number of preset keys can be determined by itself for the controller to randomly select and use during encryption.

[0119] Exemplarily, when the system initiates an association request, the controller randomly selects a preset key from multiple preset keys written, and controls the true random number generator to generate a second master random parameter; at the same time, the controller determines the communication algorithm type and communication encryption algorithm for the security element by receiving the communication algorithm type and corresponding communication encryption algorithm list supported by the security element, combined with the communication algorithm type and corresponding communication encryption algorithm supported by the controller itself.

[0120] Step S402: Generate a third ciphertext based on the second master random parameter, the preset key, the communication algorithm type, and the communication encryption algorithm corresponding to the communication algorithm type.

[0121] Among them, the third ciphertext refers to the data obtained by encrypting the second master random parameter using the communication encryption algorithm on the controller side, and taking the second master random parameter to be encrypted, additional information (i.e., communication algorithm type, communication encryption algorithm, and preset key identifier) ​​and the preset key used for encryption (hereinafter referred to as the "first preset key" for easy distinction) as input. The third ciphertext is used to indicate that the security element generates the fourth ciphertext based on the local component identifier, the local second component random parameter, the second master random parameter in the third ciphertext, the preset key (hereinafter referred to as the "second preset key", the second preset key is determined based on the identifier of the first preset key in the third ciphertext) and the communication encryption algorithm, and returns the fourth ciphertext. The third ciphertext includes third encrypted data and third label data. The third encrypted data is the encrypted second master random parameter, which is used to instruct the security element to generate a fourth ciphertext based on the second master random parameter in the third encrypted data, the second preset key of its local end determined by the first preset key identifier, and other relevant data of the local end; the second label data is generated with the communication algorithm type determined by the controller, the communication encryption algorithm corresponding to the communication algorithm type, and the identifier of the determined first preset key as additional information, and is usually expressed as a data block or code of a fixed length, which is used to instruct the security element to verify the integrity and authenticity of the third encrypted data after receiving the third encrypted data, so as to determine whether the third encrypted data has been tampered with.

[0122] Among them, the second component random parameter at the local end refers to the non-determined parameter generated inside the security element. The second component random parameter is similar to the first component random parameter. For details, please refer to the description of the above embodiment, which will not be repeated in this embodiment.

[0123] Exemplarily, taking the GCM mode of the AES algorithm as an example, the controller takes the second master control random parameters to be encrypted, additional information (i.e., the communication algorithm type, the communication encryption algorithm, and the first preset key identifier), and the first preset key used for encryption as input, and generates a third ciphertext based on the second master control random parameters, additional information, and the first preset key. The specific process can be found in the generation process of the first ciphertext in the above embodiment, which will not be repeated in this embodiment.

[0124] Step S403: Send the third ciphertext to the security element.

[0125] Step S404, receiving the fourth ciphertext, and generating a first communication key corresponding to the controller based on the second master random parameter, the second component random parameter in the fourth ciphertext, the component identifier and the preset key.

[0126] Among them, the fourth ciphertext refers to the data obtained by encrypting the second element random parameter and the element identification using the communication encryption algorithm on the side of the security element, and taking the second element random parameter to be encrypted and the element identification to be encrypted, the additional information (i.e., the second master random parameter in the third ciphertext) and the second preset key for encryption as input. The fourth ciphertext is used to instruct the controller to generate the first communication key based on the second master random parameter of the local end, the second element random parameter in the fourth ciphertext, the element identification and the first preset key. The fourth ciphertext includes the fourth encrypted data and the fourth tag data, the fourth encrypted data is composed of the encrypted second element random parameter and the encrypted element identification, and is used to instruct the controller to generate the first communication key based on the second element random parameter in the fourth encrypted data, the element identification and the second master random parameter of the local end; the fourth tag data is generated with the second master random parameter in the third ciphertext as additional information, and similarly, it is usually expressed as a fixed-length data block or code, which is used to instruct the controller to verify the integrity and authenticity of the fourth encrypted data after receiving the fourth encrypted data to determine whether the fourth encrypted data has been tampered with.

[0127] Exemplarily, taking the GCM mode of the AES algorithm as an example, when the controller receives the fourth ciphertext, it takes the fourth ciphertext to be decrypted, the additional information (i.e., the second master random parameter in the third ciphertext) and the first preset key as input, and the controller uses the first communication key and the GCM mode of the AES algorithm to decrypt the fourth ciphertext to obtain the second component random parameter and component identification in the fourth ciphertext; the specific process can refer to the decryption process of the second ciphertext in the above embodiment, which will not be described in detail in this embodiment. When the controller successfully decrypts, it obtains the untampered second component random parameter and component identification, and generates the first communication key based on the second master random parameter of the local end, the second component random parameter in the fourth ciphertext, the component identification and the first preset key; the specific process can refer to the generation process of the first temporary key in the above embodiment, which will not be described in detail in this embodiment.

[0128] In this embodiment, when generating the third ciphertext, the controller embeds the communication algorithm type supported by the selected security element and the selected first preset key identifier into the third ciphertext, ensuring that when the security element is associated with the controller, it can index and match the second preset key pre-written in it according to the first preset key identifier, and successfully decrypt the third ciphertext through the selected communication algorithm type and the second preset key to obtain the second master random parameter, thereby indicating that the security element can generate the corresponding second communication key; and, after encrypting the second master random parameter and sending it to the security element, malicious users can be prevented from hijacking the session or replaying the old encrypted content to protect the integrity and authenticity of the data, and ensure that the controller is correctly associated and bound with the specified security element. At the same time, the controller generates the first communication key based on the second master random parameter and the second element random parameter. In the process of using the first communication key to create a session and generate the first temporary key, the randomness and unpredictability of the session creation process and the first temporary key generation process can be increased, which is conducive to further improving communication security.

[0129] In one embodiment, after step S404, the method further includes:

[0130] Generate a first key verification parameter based on the second master random parameter, the second element random parameter in the fourth ciphertext, the element identification and the first communication key; send the first key verification parameter to the security element; receive the first key verification result, and when the first key verification result indicates that the first communication key has passed the verification, execute the above step S302.

[0131] The first key verification parameter is used to instruct the security element to verify the first communication key in the first key verification parameter and return a first key verification result.

[0132] Exemplarily, taking the CMAC algorithm as an example, the controller uses the second master random parameter of the local end, the second element random parameter obtained by decrypting the fourth ciphertext, and the element identifier of the local end as input, uses the first communication key to calculate the CMAC value, and determines the CMAC value as the first key verification parameter. Specifically, the controller splices the second master random parameter, the second element random parameter, and the element identifier in a predetermined order to obtain a long string as input data, then initializes CMAC using the first communication key, and generates two subkeys (the third subkey and the fourth subkey) based on key expansion, divides the input data into multiple blocks of preset lengths, uses the third subkey or the fourth subkey to perform an XOR operation on each input block, and then uses the corresponding subkey to encrypt, splices all encrypted blocks to obtain a spliced ​​ciphertext, takes the last group of the spliced ​​ciphertext, and determines it as the first key verification parameter; then, sends the first key verification parameter to the security element; and receives the first key verification result sent by the security element. When the first key verification result indicates that the first communication key has passed the verification, the above step S302 is executed.

[0133] In this embodiment, the first key verification parameter is generated based on the second master random parameter of the local end of the controller, the second element random parameter in the fourth ciphertext, the element identification and the first communication key of the local end. On the one hand, the first key verification parameter is generated by jointly generating multiple types of data, which can increase the complexity of the first key verification parameter, making it more difficult for malicious users or attackers to guess or crack the key verification parameter, so as to improve the security of the system. On the other hand, the data of the local end of the controller is integrated into the first key verification parameter, which is conducive to the security element to match it with the data generated by the security element end to determine whether the first communication key is accurate, and then associate the controller with the corresponding security element after the first communication key verification is passed, so that only the security element associated with the controller can successfully bind to the controller and establish a session and communicate in the subsequent process, so as to further improve the security of communication.

[0134] In one embodiment, after step S304, the method further includes:

[0135] Generate a second key verification parameter based on the session identifier, the first master random parameter, the first element random parameter in the second ciphertext and the first temporary key; send the second key verification parameter to the security element; receive a second key verification result, and when the second key verification result indicates that the first temporary key verification has passed, execute the above step S202.

[0136] The second key verification parameter is used to instruct the security element to verify the first temporary key in the second key verification parameter and return the second key verification result.

[0137] Exemplarily, taking the CMAC algorithm as an example, the controller uses the first master random parameter of the local end, the session identifier of the local end, and the first element random parameter obtained by decrypting the second ciphertext as input, uses the first temporary key to calculate the CMAC value, and determines the CMAC value as the second key verification parameter; then, the second key verification parameter is sent to the security element; and the second key verification result is received. When the second key verification result indicates that the first temporary key verification is passed, the above step S202 is executed. The specific process of determining the second key verification parameter can refer to the record of generating the first key verification parameter in the above embodiment, which will not be repeated in this embodiment;

[0138] In this embodiment, the second key verification parameter is generated based on the first master random parameter of the local end of the controller, the first element random parameter in the second ciphertext, the session identifier and the first temporary key of the local end. On the one hand, the second key verification parameter is generated by jointly generating multiple types of data, which can increase the complexity of the second key verification parameter, making it more difficult for malicious users or attackers to guess or crack the key verification parameter, so as to improve the security of the system. On the other hand, the data of the local end of the controller is integrated into the second key verification parameter, which is conducive to the security element to match it with the data generated by the security element end to determine whether the first temporary key is accurate, and then establish communication with the corresponding security element after the first temporary key verification is passed, so that only the security element associated with the controller can communicate, so as to further improve the security of communication.

[0139] In one embodiment, based on the first temporary key, encrypting the session communication data of the target session identified by the session identifier to obtain the session encrypted data includes:

[0140] Acquire the session communication data of the target session identified by the session identifier; encrypt the session communication data according to the first temporary key and the session authentication information corresponding to the target session to obtain session encrypted data.

[0141] The session authentication information refers to the information input as additional information when the controller encrypts the session communication data based on the first temporary key. When the session is just established, the first round of session communication data sent by the controller to the security element is encrypted with the element identification as additional information, so that the element identification can identify and verify the target call after receiving the encrypted session encryption data. After that, when the controller sends the session communication data to the security element again, the tag data obtained in the encryption process of the previous call round of session communication data is used as additional information for encryption, forming a chain encryption structure, so that each round of encryption is associated with the previous encryption result, thereby improving the security of the entire communication process.

[0142] Exemplarily, after the session is established, the controller obtains the session communication data of the target session identified by the session identifier. For the encryption of the session communication data in the first round of session, the controller uses the session communication data to be encrypted, the session identifier to be encrypted, additional information (i.e., the component identifier) ​​and the verified first session key as input, and uses the first session key and the GCM mode of the AES algorithm to encrypt the session communication data and the session identifier to obtain the session encrypted data and the corresponding label data; subsequently, for the encryption of the session communication data in each session round after the first round, the controller uses the session communication data to be encrypted, the session identifier to be encrypted, additional information (i.e., the label data corresponding to the session encrypted data in the previous session round) and the verified first session key of the current session round as input, and uses the first session key and the GCM mode of the AES algorithm to encrypt the session communication data and the session identifier to obtain the session encrypted data and label data of the current session round.

[0143] In this embodiment, the session communication data is encrypted according to the first temporary key and the session authentication information corresponding to the target session to form a chain encryption structure, which makes it difficult for attackers to modify the data without being discovered. Moreover, since each round of encryption is associated with the previous encryption result, the source and transmission path of the data can be tracked by tracking the tag data, which helps to quickly locate the problem and take corresponding countermeasures when data leakage or tampering occurs.

[0144] In another embodiment of the present application, Figure 5 As shown, a communication method based on a security element is also provided, and the method is applied to Figure 1 The security element in FIG. 1 is taken as an example to illustrate, including the following steps S501 to S502. Among them:

[0145] Step S501: receiving session encryption data sent by the controller.

[0146] Among them, the session encryption data is obtained by the controller encrypting the session communication data of the target session based on the session temporary key between the controller and the security element; the session temporary key is constructed based on the session identifier of the target session and the element communication key corresponding to the security element, and the element communication key is constructed based on the element identifier of the security element.

[0147] Exemplarily, when the controller initiates a session, it sends session encryption data to the secure element, and the secure element responds and receives the session encryption data.

[0148] Step S502: decrypt the session encrypted data based on the second temporary key to obtain session communication data of the target session.

[0149] Exemplarily, since the session encrypted data is obtained by the controller using the first temporary key and encrypting it through the GCM mode of the AES algorithm, and since the second temporary key and the first temporary key are obtained based on the same algorithm and input, theoretically the two are the same, therefore, after the security element receives the session encrypted data, the security element can decrypt the session encrypted data based on the second temporary key to obtain the session communication data of the target session. Specifically, the security element uses the second temporary key and the GCM mode of the AES algorithm to decrypt the ciphertext blocks corresponding to the session communication data in the session encrypted data to obtain the original data blocks of each ciphertext block, and integrates the decrypted data blocks to obtain the session communication data in the session encrypted data; during the decryption process, the security element re-performs a GHASH operation on each ciphertext block and additional information (i.e., session authentication information) to obtain verification information corresponding to the session authentication information, and compares the verification information with the session authentication information. If the two match, it means that the session encrypted data has not been tampered with and the decryption is successful. If they do not match, it means that the session encrypted data has been tampered with or the decryption fails.

[0150] In the above-mentioned communication method based on the security element, when the controller initiates a session, it sends session encryption data to the security element, the security element responds and receives the session encryption data, and the security element decrypts the session encryption data based on the second temporary key to obtain the session communication data of the target session, which can realize encrypted transmission and authentication protection of data on buses such as SPI or I2C, thereby improving the security of the entire system.

[0151] In one embodiment, before step S501, the method further includes:

[0152] Receive the first ciphertext sent by the controller, and decrypt the first ciphertext to obtain the session identifier, the first master random parameter and the component identifier in the first ciphertext; generate the second ciphertext based on the session identifier, the component identifier, the second communication key of the local end, the first component random parameter of the local end and the communication encryption algorithm for the security element; send the second ciphertext to the controller.

[0153] Among them, the second ciphertext is used to instruct the controller to generate a temporary session key based on the session identifier, the first component random parameter in the second ciphertext, the first master random parameter of the local end, the component communication key of the local end and the communication encryption algorithm.

[0154] Exemplarily, taking the GCM mode of the AES algorithm as an example, when the security element receives the first ciphertext, it takes the first ciphertext to be decrypted, additional information (i.e., the component identifier of the local end) and the second communication key as input, and the security element uses the second communication key and the GCM mode of the AES algorithm to decrypt each ciphertext block in the first encrypted data to obtain the original data block of each ciphertext block, and integrates the decrypted data blocks to obtain the first master random parameter and session identifier in the first ciphertext; during the decryption process, the security element re-performs a GHASH operation on each ciphertext block and additional information (i.e., the component identifier of the local end) to obtain the first verification data corresponding to the first label data in the first ciphertext, and compares the first verification data with the first label data. If the two match, it means that the first ciphertext has not been tampered with and the decryption is successful. If they do not match, it means that the first ciphertext has been tampered with or the decryption fails.

[0155] When the security element decrypts successfully, the first master random parameter and session identifier that have not been tampered with in the first ciphertext are obtained, and the second temporary key between the controller and the security element is generated based on the local component identifier, the local first component random parameter, the second communication key and the session identifier in the first ciphertext. Specifically, taking the CMAC algorithm as an example, the security element concatenates the local first component random parameter, the first master random parameter in the first ciphertext and the session identifier in the first ciphertext in a predetermined order to obtain a long string as input data to obtain the second temporary key; the specific process can be referred to the process of obtaining the first temporary key in the above real-time, which will not be repeated in this embodiment.

[0156] In this embodiment, on the security element side, when the first master random parameters and session identifier have not been tampered with, and on the controller side, when the first element random parameters have not been tampered with, the first temporary key and the second temporary key generated by the CMAC algorithm should theoretically be the same (because the first communication key and the second communication key used by the CMAC algorithm are theoretically the same based on the aforementioned reasons). In this way, a symmetric encryption and decryption method can be formed between the controller and the security element, which can ensure the security and integrity of data during transmission, and can improve the operating efficiency and compatibility of the system, and reduce resource consumption and the complexity of key management.

[0157] In one embodiment, after generating the second temporary key, the method further includes:

[0158] When the second key verification parameter sent by the controller is received, the first temporary key included in the second key verification parameter is verified to obtain a second key verification result; and the second key verification result is sent to the controller.

[0159] Among them, the second key verification parameter is generated by the controller based on the session identifier of the local end, the first component random parameter in the second ciphertext, the first master random parameter of the local end and the first temporary key of the local end.

[0160] Exemplarily, when the security element receives the second key verification parameter sent by the controller, the security element uses the first element random parameter of the local end, the first master random parameter obtained by decrypting the first ciphertext, and the session identifier as input, and uses the second temporary key to calculate a local CMAC value at the local end, and matches the CMAC value of the local end of the security element with the second key verification parameter to obtain a second key verification result; and sends the second key verification result to the controller.

[0161] In this embodiment, by matching the second key verification parameter with the CMAC value calculated locally on the security element, it is possible to determine whether the first temporary key used when the controller interacts with the security element is accurate, so as to determine whether the controller currently creating a session with the security element is the controller associated with it, thereby ensuring the accuracy of the session object and ensuring communication security.

[0162] In one embodiment, the method further comprises:

[0163] Receive the third ciphertext sent by the controller, and decrypt the third ciphertext to obtain the second master random parameter and the second preset key; generate the fourth ciphertext based on the second master random parameter, the second preset key, the component identification, the second component random parameter of the local end and the communication encryption algorithm for the security element in the third ciphertext; send the fourth ciphertext to the controller.

[0164] Among them, the fourth ciphertext is used to instruct the controller to generate a first communication key corresponding to the controller based on the second master random parameter of the local end, the second component random parameter in the fourth ciphertext, the component identifier and the first preset key.

[0165] Exemplarily, also taking the GCM mode of the AES algorithm as an example, when the security element receives the third ciphertext, the third ciphertext to be decrypted, additional information (i.e., communication algorithm type, communication encryption algorithm, and preset key identifier) ​​and the second preset key are used as input, and the security element uses the second preset key and the GCM mode of the AES algorithm to decrypt the third encrypted data to obtain the second master random parameter in the third ciphertext; when the security element decrypts successfully, the second master random parameter that has not been tampered with in the third ciphertext is obtained, and the second communication key is generated based on the local component identifier, the local second component random parameter, the second preset key and the second master random parameter in the third ciphertext. The specific process can be referred to the process of decrypting the first ciphertext and obtaining the first communication key in the above real-time, which will not be repeated in this embodiment.

[0166] In one embodiment, the method further comprises:

[0167] When the first key verification parameter sent by the controller is received, the first communication key included in the first key verification parameter is verified to obtain a first key verification result; and the first key verification result is sent to the controller.

[0168] Among them, the first key verification parameter is generated by the controller based on the component identification, the second master random parameter of the local end, the first communication key of the local end and the second component random parameter in the fourth ciphertext.

[0169] Exemplarily, when the security element receives the first key verification parameter sent by the controller, the security element uses the second element random parameter at the local end, the second master random parameter obtained by decrypting the third ciphertext, and the element identification as input, and uses the second communication key to calculate a local CMAC value at the local end, and matches the CMAC value at the local end of the security element with the first key verification parameter to obtain a first key verification result; and sends the first key verification result to the controller.

[0170] In this embodiment, by matching the first key verification parameter with the CMAC value calculated locally by the security element, it is possible to determine whether the first communication key used when the controller interacts with the security element is accurate, further ensuring the accuracy of the session object and ensuring communication security.

[0171] In one embodiment, the method further comprises:

[0172] Obtain component communication data for a target session to be sent to the controller; encrypt the component communication data based on a second temporary key to obtain component communication encrypted data; and send the component communication encrypted data to the controller.

[0173] Among them, component communication data refers to data that is encrypted by the security element and transmitted to the controller when information is exchanged between the controller and the security element. The component communication data can be tag data and business data for processing by other business devices, etc.

[0174] The component communication encrypted data refers to the ciphertext data obtained after the security element encrypts the component communication data based on the second temporary key. The component communication encrypted data is used to instruct the controller to decrypt the received component communication encrypted data based on the first temporary key of the local end to obtain the component communication data.

[0175] Exemplarily, based on the session request of the controller, the security element obtains the component communication data that needs to be sent to the controller and is for the target session from its internal storage module or other business device, and encrypts the component communication data based on the second temporary key using the communication algorithm type selected by the controller to obtain the component communication encrypted data; and sends the component communication encrypted data to the controller; the specific process can be found in the encryption process of the session communication data in the above embodiment, which will not be repeated in this embodiment.

[0176] In another embodiment of the present application, Figure 6 As shown, a communication method based on a security element is also provided, and the method is applied to Figure 1 The communication system in FIG. 1 is taken as an example to illustrate, and the method includes the following steps S601 to S605. Among them:

[0177] Step S601, writing a preset key into a controller, and writing a component identification and a preset key into a security component.

[0178] Step S602, determine the communication algorithm type and its corresponding communication encryption algorithm.

[0179] Step S603 , generating and verifying a component communication key to associate the controller with the security element.

[0180] Step S604: Generate and verify a session communication key to create a session.

[0181] Step S605: Conduct an encrypted call based on the session communication key.

[0182] In one embodiment, Figure 7 As shown, step S602 includes:

[0183] Step S701: The controller obtains a list of communication algorithm types supported by the security element and their corresponding communication encryption algorithms.

[0184] Step S702: The secure element sends a list of supported communication algorithm types and their corresponding communication encryption algorithms to the controller.

[0185] Step S703: The controller determines the communication algorithm type for the security element and its corresponding communication encryption algorithm based on the communication algorithm type supported by the controller and the corresponding communication encryption algorithm.

[0186] In one embodiment, Figure 8 As shown, step S603 includes:

[0187] Step S801: The controller generates a second master control random parameter.

[0188] Step S802, the controller executes the initialization command, and generates a third ciphertext based on the generated second master random parameter, the randomly selected second preset key, the communication algorithm type determined for the security element, and the communication encryption algorithm corresponding to the communication algorithm type; the controller sends the third ciphertext to the security element.

[0189] Step S803: The secure element receives the third ciphertext sent by the controller, decrypts the third ciphertext to obtain a second master random parameter, and determines a second preset key based on the third ciphertext.

[0190] Step S804, the security element generates a fourth ciphertext based on the second master random parameter, the second preset key, the local component identifier, the local second component random parameter and the communication encryption algorithm for the security element in the third ciphertext; the security element sends the fourth ciphertext to the controller.

[0191] Step S805: The controller receives the fourth ciphertext, and generates a first communication key corresponding to the controller based on the second master random parameter of the local end, the second component random parameter in the fourth ciphertext, the component identifier in the fourth ciphertext, and the first preset key.

[0192] Step S806: The controller generates a first key verification parameter based on the second master random parameter, the second element random parameter in the fourth ciphertext, the element identification, and the element communication key; the controller sends the first key verification parameter to the security element.

[0193] Step S807: The security element receives the first key verification parameter, verifies the first communication key included in the first key verification parameter, and obtains a first key verification result; the security element sends the first key verification result to the controller.

[0194] Step S808: The controller receives the first key verification result and performs association confirmation according to the first key verification result.

[0195] In one embodiment, Fig. 9 As shown, step S604 includes:

[0196] Step S901: The controller generates a first master control random parameter.

[0197] In step S902, the controller executes a session creation command, adds one to the local session identifier, and generates a first ciphertext based on the local session identifier, the generated first master random parameter, the element identifier in the fourth ciphertext, the first communication key, and the communication encryption algorithm for the security element; the controller sends the first ciphertext to the security element.

[0198] Step S903: The security element receives the first ciphertext sent by the controller, and decrypts the first ciphertext to obtain the session identifier, the first master random parameter in the first ciphertext, and the element identifier.

[0199] Step S904, the security element generates a second ciphertext based on the session identifier in the first ciphertext, the component identifier of the local end, the second communication key of the local end, the first component random parameter of the local end, and the communication encryption algorithm for the security element; the security element sends the second ciphertext to the controller.

[0200] Step S905, the controller receives the second ciphertext, and generates a first temporary key between the controller and the security element based on the local session identifier, the local first master random parameter, the first communication key and the first element random parameter in the second ciphertext.

[0201] Step S906, the controller generates a second key verification parameter based on the session identifier of the local end, the first master random parameter of the local end, the first element random parameter in the second ciphertext and the first temporary key; the controller sends the second key verification parameter to the security element.

[0202] Step S907: The secure element receives the second key verification parameter, verifies the first temporary key included in the second key verification parameter, and obtains a second key verification result; the secure element sends the second key verification result to the controller.

[0203] Step S908: The controller receives the second key verification result, and performs session creation confirmation according to the second key verification result.

[0204] In one embodiment, Fig.10 As shown, step S605 includes:

[0205] Step S1001: The controller obtains session communication data of a target session identified by a session identifier.

[0206] Step S1002: The controller encrypts the session communication data according to the first temporary key and the session authentication information corresponding to the target session to obtain session encrypted data, and the controller sends the session encrypted data to the security element.

[0207] Step S1003 : The secure element obtains element communication data for the target session to be sent to the controller.

[0208] Step S1004 : The secure element encrypts the element communication data based on the second temporary key to obtain the element communication encrypted data, and the secure element sends the element communication encrypted data to the controller.

[0209] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0210] Based on the same inventive concept, the embodiment of the present application also provides a communication device based on a security element for implementing the communication method based on a security element involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the one or more embodiments of the communication device based on a security element provided below can refer to the limitations of the communication method based on a security element above, and will not be repeated here.

[0211] In one embodiment, Fig.11 As shown, a communication device based on a security element is provided, which is applied to a controller. The communication device includes: a temporary key determination module 1101, a session data encryption module 1102 and an encrypted data sending module 1103.

[0212] in:

[0213] The temporary key determination module 1101 is used to determine the first temporary key between the controller and the security element; the first temporary key is constructed based on the session identifier and the first communication key corresponding to the controller, and the first communication key is constructed based on the element identifier of the security element.

[0214] The session data encryption module 1102 is used to encrypt the session communication data of the target session identified by the session identifier based on the first temporary key to obtain session encrypted data;

[0215] The encrypted data sending module 1103 is used to send the session encrypted data to the security element; the session encrypted data is used to instruct the security element to decrypt the received session encrypted data based on the session temporary key to obtain the session communication data.

[0216] In one embodiment, Fig.12 As shown, a communication device based on a security element is provided, which is applied to a security element. The communication device includes: an encrypted data receiving module 1201 and a session data decryption module 1202. Among them:

[0217] The encrypted data receiving module 1201 is used to receive session encrypted data sent by the controller; the session encrypted data is obtained by the controller encrypting the session communication data of the target session based on the first temporary key between the controller and the security element; the first temporary key is constructed based on the session identifier of the target session and the first communication key corresponding to the security element, and the first communication key is constructed based on the element identifier of the security element.

[0218] The session data decryption module 1202 is used to decrypt the session encrypted data based on the second temporary key to obtain the session communication data of the target session.

[0219] Each module in the above-mentioned communication device based on the security element can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above-mentioned modules can be embedded in or independent of the corresponding controller or processor in the security element in the form of hardware, or can be stored in the memory in the controller or security element in the form of software, so that the processor can call and execute the corresponding operations of each of the above modules.

[0220] In one embodiment, the present application further provides a controller, which includes a processor and a memory. The processor of the controller is used to provide computing and control capabilities. The memory of the controller includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. When the computer program is executed by the processor, a communication method based on a security element is implemented.

[0221] In one embodiment, the present application further provides a security element, which includes a processor and a memory. The processor of the security element is used to provide computing and control capabilities. The memory of the security element includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. When the computer program is executed by the processor, a communication method based on the security element is implemented.

[0222] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the communication method based on the security element of the above embodiment is implemented.

[0223] In one embodiment, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the communication method based on a secure element of the above embodiment is implemented.

[0224] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0225] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0226] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0227] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A communication method based on a security element, characterized in that: Applied to a controller, the method comprises: Determine a temporary session key between the controller and the security element; the temporary session key is constructed based on a session identifier and an element communication key corresponding to the controller, and the element communication key is constructed based on an element identifier of the security element; Based on the session temporary key, encrypt the session communication data of the target session identified by the session identifier to obtain session encrypted data; The session encrypted data is sent to the security element; the session encrypted data is used to instruct the security element to decrypt the received session encrypted data based on the session temporary key to obtain the session communication data.

2. The method according to claim 1, characterized in that The determining a temporary key for a session between the controller and the security element comprises: Obtaining a session identifier and a first master control random parameter, and determining a component communication key corresponding to the controller; Generate a first ciphertext based on the session identifier, the first master random parameter, the component identifier, the component communication key, and a communication encryption algorithm for the security element; Sending the first ciphertext to the security element; the first ciphertext is used to instruct the security element to generate a second ciphertext based on the session identifier in the first ciphertext, the first element random parameter of the local end, the element communication key of the local end, the element identifier and the communication encryption algorithm, and return the second ciphertext; The second ciphertext is received, and a temporary session key between the controller and the security element is generated based on the session identifier, the first master random parameter, the element communication key, and the first element random parameter in the second ciphertext.

3. The method according to claim 2, characterized in that The determining the component communication key corresponding to the controller includes: Obtaining a second master random parameter and a preset key for a security element, and determining a communication algorithm type for the security element; Generate a third ciphertext based on the second master random parameter, the preset key, the communication algorithm type, and the communication encryption algorithm corresponding to the communication algorithm type; Sending the third ciphertext to the security element; the third ciphertext is used to instruct the security element to generate a fourth ciphertext based on the element identifier, the second element random parameter of the local end, the second master random parameter in the third ciphertext, the preset key and the communication encryption algorithm, and return the fourth ciphertext; The fourth ciphertext is received, and a component communication key corresponding to the controller is generated based on the second master random parameter, the second component random parameter in the fourth ciphertext, the component identifier, and the preset key.

4. The method according to claim 3, characterized in that The method further comprises: generating a first key verification parameter based on the second master random parameter, the second component random parameter in the fourth ciphertext, the component identification, and the component communication key; Sending the first key verification parameter to the security element; the first key verification parameter is used to instruct the security element to verify the element communication key in the first key verification parameter and return a first key verification result; Receive the first key verification result, and when the first key verification result indicates that the component communication key has passed the verification, execute the step of generating a first ciphertext based on the session identifier, the first master random parameter, the component identifier of the security element and the component communication key.

5. The method according to claim 2, characterized in that: The method further comprises: generating a second key verification parameter based on the session identifier, the first master random parameter, the first element random parameter in the second ciphertext, and the session transient key; Sending the second key verification parameter to the security element; the second key verification parameter is used to instruct the security element to verify the session temporary key in the second key verification parameter and return a second key verification result; Receive the second key verification result, and when the second key verification result indicates that the session temporary key verification is passed, execute the step of encrypting the session communication data of the target session identified by the session identifier based on the session temporary key to obtain session encryption data.

6. The method according to any one of claims 1 to 5, characterized in that: The step of encrypting the session communication data of the target session identified by the session identifier based on the session temporary key to obtain session encrypted data includes: Acquire session communication data of the target session identified by the session identifier; The session communication data is encrypted according to the session temporary key and the session authentication information corresponding to the target session to obtain session encrypted data.

7. A communication method based on a security element, characterized in that: Applied to a security element, the method comprises: receiving session encrypted data sent by a controller; the session encrypted data is obtained by the controller encrypting session communication data of a target session based on a session temporary key between the controller and the security element; the session temporary key is constructed based on a session identifier of the target session and an element communication key corresponding to the security element, and the element communication key is constructed based on an element identifier of the security element; The session encrypted data is decrypted based on the session temporary key to obtain the session communication data of the target session.

8. A communication system based on a security element, characterized in that: The system comprises: A controller, configured to determine a temporary session key between the controller and a security element; the temporary session key is constructed based on a session identifier and an element communication key corresponding to the controller, and the element communication key is constructed based on an element identifier of the security element; based on the temporary session key, encrypting session communication data of a target session identified by the session identifier to obtain session encrypted data; and sending the session encrypted data to the security element; The security element is used to receive the session encrypted data sent by the controller; decrypt the session encrypted data based on the session temporary key to obtain the session communication data of the target session.

9. A communication device based on a security element, characterized in that: Applied to a controller, the device comprises: A temporary key determination module, used to determine a temporary key for a session between the controller and the security element; the temporary key for the session is constructed based on a session identifier and an element communication key corresponding to the controller, and the element communication key is constructed based on an element identifier of the security element; A session data encryption module, used to encrypt the session communication data of the target session identified by the session identifier based on the session temporary key to obtain session encrypted data; The encrypted data sending module is used to send the session encrypted data to the security element; the session encrypted data is used to instruct the security element to decrypt the received session encrypted data based on the session temporary key to obtain the session communication data.

10. A communication device based on a security element, characterized in that: Applied to a security element, the device comprises: an encrypted data receiving module, configured to receive session encrypted data sent by a controller; the session encrypted data is obtained by the controller encrypting session communication data of a target session based on a session temporary key between the controller and the security element; the session temporary key is constructed based on a session identifier of the target session and an element communication key corresponding to the security element, and the element communication key is constructed based on an element identifier of the security element; The session data decryption module is used to decrypt the session encrypted data based on the session temporary key to obtain the session communication data of the target session.

11. A controller, comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

12. A security element, comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to claim 7 are implemented.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the computer program implements the steps of the method according to any one of claims 1 to 6, or implements the steps of the method according to claim 7.

Images