Access request processing method, system and device of secure element, electronic equipment, readable storage medium and program product

Abstract

The invention relates to an access request processing method, system and device for a secure element, electronic equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: sending a first access control signature and a first access control rule obtained from a secure element to a trusted service management platform; the trusted service management platform is used for storing the first access control signature and a second access control rule obtained by preprocessing the first access control rule; when a secure element access request of an application program is received, sending an access control signature acquisition request to the trusted service management platform; receiving a first access control signature sent by the trusted service management platform; acquiring a second access control signature stored in the home terminal; and according to the first access control signature, the second access control signature and a second access control rule from the trusted service management platform, carrying out access processing on the secure element by the application program. By adopting the method, the access processing efficiency of the secure element can be improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a method, system, device, electronic device, computer-readable storage medium, and computer program product for processing access requests of a security element. Background Art

[0002] With the development of information technology, secure elements (SE) are used to protect applications and data with higher security levels. In order to prevent unauthorized access to resources in secure elements, access control rules are usually used to limit the terminal operating system's access to secure elements. However, the storage and management of access control rules in secure elements are highly complex, which can easily affect the access processing efficiency of secure elements. Summary of the invention

[0003] Based on this, it is necessary to provide a method, system, device, electronic device, computer-readable storage medium and computer program product for processing access requests of a security element in response to the above technical problems.

[0004] In a first aspect, the present application provides a method for processing an access request of a security element, comprising:

[0005] Sending a first access control signature and a first access control rule obtained from a security element to a trusted business management platform; the trusted business management platform is used to store the first access control signature and to store a second access control rule obtained by preprocessing the first access control rule;

[0006] When receiving a secure element access request from an application, sending a request for obtaining an access control signature of the secure element to the trusted service management platform;

[0007] Receiving the first access control signature of the security element sent by the trusted service management platform;

[0008] Obtaining a second access control signature of the security element stored on the local end;

[0009] Access processing of the application to the security element is performed according to the first access control signature, the second access control signature, and the second access control rule obtained from the trusted business management platform.

[0010] In one of the embodiments, the access processing of the application to the security element is performed based on the first access control signature, the second access control signature and the second access control rule obtained from the trusted business management platform, including: if the first access control signature and the second access control signature are consistent, sending an access control rule acquisition request for the security element to the trusted business management platform; receiving the second access control rule of the security element sent by the trusted business management platform; if the second access control rule indicates that the application is allowed to access the security element, sending the security element access request to the security element.

[0011] In one of the embodiments, the method further includes: if the first access control signature and the second access control signature are inconsistent after comparison, sending a secure element access error message to the application.

[0012] In one of the embodiments, the method further includes: if the second access control rule indicates that the application is not allowed to access the secure element, sending secure element access error information to the application.

[0013] In a second aspect, the present application provides a method for processing an access request of a security element, comprising:

[0014] Receiving a first access control signature and a first access control rule of a security element sent by a terminal;

[0015] Preprocessing the first access control rule to obtain a second access control rule;

[0016] When receiving an access control signature acquisition request from the terminal, the first access control signature of the security element is sent to the terminal; the first access control signature and the second access control rule are used by the terminal to perform access processing on the security element.

[0017] In one of the embodiments, the method further includes: upon receiving an access control rule acquisition request from the terminal, sending the second access control rule to the terminal.

[0018] In one embodiment, the preprocessing of the first access control rule to obtain the second access control rule includes: deduplicating the first access control rule, and / or deconflicting the first access control rule to obtain the second access control rule.

[0019] In a third aspect, the present application further provides a security element access request processing system, including:

[0020] Terminals, security elements, and trusted business management platforms;

[0021] The secure element access controller of the terminal is used to send the first access control signature and the first access control rule obtained from the secure element to the trusted service management platform;

[0022] The trusted service management platform is used to receive the first access control signature and the first access control rule of the security element sent by the terminal; perform pre-clearing processing on the first access control rule to obtain a second access control rule; the first access control signature and the second access control rule are used by the terminal to perform access processing on the security element;

[0023] The application of the terminal is used to send a secure element access request to the secure element access controller;

[0024] The secure element access controller of the terminal is further configured to send an access control signature acquisition request for the secure element to the trusted service management platform when receiving a secure element access request from an application;

[0025] The trusted service management platform is further configured to send the first access control signature of the security element to the terminal when receiving the access control signature acquisition request from the terminal;

[0026] The security element access controller of the terminal is also used to receive the first access control signature of the security element sent by the trusted business management platform; obtain the second access control signature of the security element stored on this end; and perform access processing of the application to the security element according to the first access control signature, the second access control signature and the second access control rule obtained from the trusted business management platform.

[0027] In a fourth aspect, the present application further provides an access request processing device for a security element, comprising:

[0028] A first sending module, used to send a first access control signature and a first access control rule obtained from a security element to a trusted business management platform; the trusted business management platform is used to store the first access control signature and to store a second access control rule obtained by preprocessing the first access control rule;

[0029] The second sending module finally sends an access control signature acquisition request of the security element to the trusted service management platform when receiving the security element access request of the application;

[0030] A first signature acquisition module, configured to receive the first access control signature of the security element sent by the trusted service management platform;

[0031] A second signature acquisition module, used to acquire a second access control signature of the security element stored in the local end;

[0032] An access control module is used to perform access processing of the application to the security element according to the first access control signature, the second access control signature and the second access control rule obtained from the trusted business management platform.

[0033] In a fifth aspect, the present application further provides an access request processing device for a security element, comprising:

[0034] A receiving module, configured to receive a first access control signature and a first access control rule of a security element sent by a terminal;

[0035] A rule processing module, used for preprocessing the first access control rule to obtain a second access control rule;

[0036] A signature sending module is used to send the first access control signature of the security element to the terminal when receiving an access control signature acquisition request from the terminal; the first access control signature and the second access control rule are used by the terminal to perform access processing on the security element.

[0037] In a sixth aspect, the present application further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0038] Sending a first access control signature and a first access control rule obtained from a security element to a trusted business management platform; the trusted business management platform is used to store the first access control signature and to store a second access control rule obtained by preprocessing the first access control rule;

[0039] When receiving a secure element access request from an application, sending a request for obtaining an access control signature of the secure element to the trusted service management platform;

[0040] Receiving the first access control signature of the security element sent by the trusted service management platform;

[0041] Obtaining a second access control signature of the security element stored on the local end;

[0042] Access processing of the application to the security element is performed according to the first access control signature, the second access control signature, and the second access control rule obtained from the trusted business management platform.

[0043] In a seventh aspect, the present application further provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0044] Receiving a first access control signature and a first access control rule of a security element sent by a terminal;

[0045] Preprocessing the first access control rule to obtain a second access control rule;

[0046] When receiving an access control signature acquisition request from the terminal, the first access control signature of the security element is sent to the terminal; the first access control signature and the second access control rule are used by the terminal to perform access processing on the security element.

[0047] In an eighth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0048] Sending a first access control signature and a first access control rule obtained from a security element to a trusted business management platform; the trusted business management platform is used to store the first access control signature and to store a second access control rule obtained by preprocessing the first access control rule;

[0049] When receiving a secure element access request from an application, sending a request for obtaining an access control signature of the secure element to the trusted service management platform;

[0050] Receiving the first access control signature of the security element sent by the trusted service management platform;

[0051] Obtaining a second access control signature of the security element stored on the local end;

[0052] Access processing of the application to the security element is performed according to the first access control signature, the second access control signature, and the second access control rule obtained from the trusted business management platform.

[0053] In a ninth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0054] Receiving a first access control signature and a first access control rule of a security element sent by a terminal;

[0055] Preprocessing the first access control rule to obtain a second access control rule;

[0056] When receiving an access control signature acquisition request from the terminal, the first access control signature of the security element is sent to the terminal; the first access control signature and the second access control rule are used by the terminal to perform access processing on the security element.

[0057] In a tenth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0058] Sending a first access control signature and a first access control rule obtained from a security element to a trusted business management platform; the trusted business management platform is used to store the first access control signature and to store a second access control rule obtained by preprocessing the first access control rule;

[0059] When receiving a secure element access request from an application, sending a request for obtaining an access control signature of the secure element to the trusted service management platform;

[0060] Receiving the first access control signature of the security element sent by the trusted service management platform;

[0061] Obtaining a second access control signature of the security element stored on the local end;

[0062] Access processing of the application to the security element is performed according to the first access control signature, the second access control signature, and the second access control rule obtained from the trusted business management platform.

[0063] In an eleventh aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0064] Receiving a first access control signature and a first access control rule of a security element sent by a terminal;

[0065] Preprocessing the first access control rule to obtain a second access control rule;

[0066] When receiving an access control signature acquisition request from the terminal, the first access control signature of the security element is sent to the terminal; the first access control signature and the second access control rule are used by the terminal to perform access processing on the security element.

[0067] The above-mentioned security element access request processing method, system, device, electronic device, computer-readable storage medium and computer program product first send the first access control signature and the first access control rule obtained from the security element to the trusted business management platform, wherein the trusted business management platform is used to store the first access control signature and the second access control rule obtained after preprocessing the first access control rule, and then when receiving the security element access request of the application, send the security element access control signature acquisition request to the trusted business management platform, and receive the first access control signature of the security element sent by the trusted business management platform, and at the same time obtain the second access control signature of the security element stored on the local end, and then perform access processing on the security element by the application according to the first access control signature, the second access control signature and the second access control rule obtained from the trusted business management platform. This solution enables the trusted business management platform to uniformly store the first access control signature and the first access control rule obtained from the security element, and to uniformly store the obtained second access control rule after preprocessing the first access control signature obtained from the security element by the terminal in advance. Therefore, when the application of the terminal needs to access the security element, the terminal can efficiently obtain the first access control signature and the second access control rule of the security element through interaction with the trusted business platform, and can verify the permission of the application to access the security element in combination with the second access control signature of the security element stored on the local end, which is conducive to better ensuring the security of the application's access to the security element. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0069] Figure 1 A schematic diagram of the architecture of an access request processing system of a security element in one embodiment;

[0070] Figure 2 Another schematic diagram of the architecture of a method for processing access requests of a security element in one embodiment;

[0071] Figure 3 A schematic diagram of a processing flow of an access request processing system of a security element in one embodiment;

[0072] Figure 4A schematic diagram of a flow chart of a method for processing an access request of a security element in one embodiment;

[0073] Figure 5 is a flowchart of a method for processing an access request of a security element in another embodiment;

[0074] Figure 6 is a structural block diagram of an access request processing device of a security element in one embodiment;

[0075] Figure 7 is a structural block diagram of an access request processing device of a security element in another embodiment;

[0076] Figure 8 is a diagram of the internal structure of an electronic device in one embodiment;

[0077] Fig. 9 FIG. 4 is a diagram showing the internal structure of an electronic device in another embodiment. DETAILED DESCRIPTION

[0078] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0079] Specifically, secure elements (SE) are usually used to install applications with higher security levels and store data with higher security levels. Applications and data sealed in secure elements cannot be directly operated by the operating system, but need to be accessed using specific interfaces. In order to prevent unauthorized abuse of the access interface of the secure element and avoid unauthorized access to resources in the secure element, the issuing agency of the secure element and the provider of the secure element application in the secure element usually limit the access of the terminal application to the secure element by formulating access control rules for the secure element. In the related art, when the application of the terminal needs to access the secure element, the terminal needs to analyze whether the application has the corresponding access rights to the secure element according to the access control rules obtained from the secure element, so as to implement control over the application's access to the corresponding secure element.

[0080] However, a security element can usually store multiple access control rules, which may include rules applied to a single or multiple applications, or rules applied to a single or multiple security elements. These access control rules can be stored in different locations of the security element, such as in the Access Rule Application Master (ARA-M) or in the form of access rule files in a secure file system. Based on this, it is difficult to achieve efficient acquisition of access control rules in related technologies, and after obtaining access control rules, the terminal usually needs to combine multiple access control rules to analyze the application's access rights to the security element, which further affects the efficiency of access control.

[0081] Based on this, in one embodiment, Figure 1 As shown, a security element access request processing system is provided, which may include a terminal, a security element, and a trusted business management platform.

[0082] The terminal may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, IoT devices and portable wearable devices. IoT devices may be smart speakers, smart TVs, smart air conditioners, smart car devices, projection devices, etc. Portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. Head-mounted devices may be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. The security element may be connected to the terminal, which may be, but is not limited to, various embedded security chips, smart cards, universal integrated circuit cards, etc. The trusted business management platform may be a server, such as an independent physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides cloud computing services. The trusted business management platform may be connected to the terminal and the security element through a network.

[0083] For example, please refer to Figure 2 , which is another schematic diagram of the architecture of the access request processing system of the security element in this embodiment. Figure 2 As shown, the terminal may be installed with one or more applications and configured with a secure element access interface and a secure element access controller, wherein the secure element access controller may be configured in the secure element access interface. The secure element access interface may be used to provide a standard interface for the application to access the secure element, and the secure element access controller may be used to process the secure element access request of the application.

[0084] Among them, Figure 2As shown, the terminal can be connected to one or more security elements. Optionally, the security element may include a secure domain (SD), which can manage one or more security element applications, such as installing, deleting, updating, locking and unlocking security element applications, where the security element application can provide security services for the terminal's application. At the same time, the security domain can also be configured with an access rule main library, which can be used to store access control rules for security elements. Optionally, the security element may also include an application security domain and a security domain, and the application security domain may be installed with a security element application and configured with an access rule auxiliary library, which can be used to store the access control rules set by the provider of the security element application for the application security domain, and these rules can be synchronously stored in the access rule main library configured by the security domain. Optionally, the security element may also include a security element file system, which can store access control rules in the form of access rule files.

[0085] Among them, Figure 2 As shown, the trusted service management platform can be connected to the terminal and the security element, which can include an application management unit, a security domain management unit and a security element management unit. Among them, the application management unit can be used to provide the terminal with remote real-time management services such as remote download, installation / uninstallation, update, lock / unlock of applications; the security domain management unit can be used to provide the security element with management services such as remote download, installation / uninstallation, personalization, key update, lock / unlock of security domains; the security element management unit can centrally store and manage the access control signatures and access control rules of the security element.

[0086] The following combination Figure 1 and Figure 2 , further illustrating the access request processing system of the security element provided in this embodiment.

[0087] The secure element access controller of the terminal is used to send the first access control signature and the first access control rule obtained from the secure element to the trusted service management platform.

[0088] The first access control signature of the security element may be preset by the terminal manufacturer and stored in the security element, and the first access control rule may be stored in the security domain of the security element or the security element file system. Exemplarily, when the terminal is started, the security element access controller of the terminal may read the first access control signature and the first access control rule of the security element from all valid security elements connected to the terminal, and upload the first access control signature and the first access control rule of each security element to the trusted business management platform.

[0089] The trusted business management platform is used to receive a first access control signature and a first access control rule of a security element sent by a terminal; pre-process the first access control rule to obtain a second access control rule; the first access control signature and the second access control rule are used by the terminal to perform access processing on the security element.

[0090] Among them, after receiving the first access control signature and the first access control rule of each security element sent by the terminal, the trusted business management platform can uniformly store the first access control signature of each security element, and pre-process the first access control rule of each security element to obtain the second access control rule corresponding to each security element. Subsequently, the second access control rule corresponding to each security element can be stored in the access control rule library. Exemplarily, the pre-processing of the first access control rule by the trusted business management platform may include but is not limited to optimizing and adjusting the content of the rule, optimizing the storage method of the rule, etc. Optionally, the optimization of the rule content may include removing duplicate first access control rules, resolving conflicts between first access control rules, etc. Exemplarily, the trusted business management platform can also support updating the access control signature and access control rules of the security element.

[0091] The application of the terminal can be used to send a secure element access request to the secure element access controller.

[0092] When the application of the terminal needs to access the secure element, it can send a secure element access request to the secure element access controller, and the request can be used to request to establish a communication channel between the application and the secure element application in the secure element.

[0093] The secure element access controller of the terminal is also used to send a request for obtaining the access control signature of the secure element to the trusted business management platform when receiving a secure element access request from an application.

[0094] When receiving a secure element access request from an application, the secure element access controller of the terminal can obtain the first application identifier of the application, the second application identifier of the target secure element application that the application needs to access, and determine the target secure element where the target secure element application is located. Then, the secure element access controller can send an access control signature acquisition request for acquiring the access control signature of the target secure element to the trusted service management platform.

[0095] The trusted service management platform is further configured to send the first access control signature of the security element to the terminal upon receiving an access control signature acquisition request from the terminal.

[0096] Among them, when the trusted business management platform receives an access control signature acquisition request from the terminal, it can obtain the first access control signature corresponding to the target security element that the terminal needs to access from the first access control signatures of each security element stored centrally, and send it to the terminal.

[0097] The terminal's security element access controller is also used to receive a first access control signature of the security element sent by a trusted business management platform; obtain a second access control signature of the security element stored on the local end; and process the application's access to the security element based on the first access control signature, the second access control signature and a second access control rule obtained from the trusted business management platform.

[0098] It is understandable that the terminal's application can access the security element normally only when the terminal obtains the correct access control signature of the security element and the access control rule of the security element allows the application to access the security element.

[0099] Based on this, the terminal's security element access controller can determine how to handle the application's access to the security element based on the access control signature and access control rules of the target security element. Exemplarily, the security element access controller can receive the first access control signature of the target security element sent by the trusted business management platform, and obtain the second access control signature of the target security element stored on this end, and determine whether the terminal holds the correct access control signature of the target security element by comparing the two. Exemplarily, the security element access controller can also obtain the second access control rule of the target security element from the trusted business management platform, and analyze the second access control rule based on the first application identifier of the application and the second application identifier of the target security element application that the application needs to access, so as to determine whether the application is allowed to access the target security element application.

[0100] Among them, when the first access control signature and the second access control signature are consistent, and the second access control rule indicates that the application is allowed to access the target secure element application, it can be determined that the application can normally access the corresponding target secure element. Then, the secure element access controller can forward the secure element access request of the application to the corresponding target secure element, so that a secure access channel can be established between the application and the target secure element.

[0101] Among them, when the first access control signature and the second access control signature are inconsistent, or when the second access control rule indicates that the application is not allowed to access the target security element application, it can be determined that the application cannot access the corresponding target security element, so that the security element access controller can return a security element access error message to the application.

[0102] In the access request processing system of the above-mentioned security element, by sending the first access control signature and the first access control rule obtained from the security element to the trusted business management platform in advance by the terminal, the trusted business management platform can uniformly store the first access control signature of the security element, and uniformly store the second access control rule obtained after preprocessing the first access control rule, so that when the application of the terminal needs to access the security element, the terminal can achieve efficient acquisition of the first access control signature and the second access control rule of the security element through interaction with the trusted business platform, and can verify the permission of the application to access the security element in combination with the second access control signature of the security element stored on the local end. Compared with the related art, the access request processing system of the security element in this embodiment can reduce the complexity of acquiring and processing the access control rules of the security element, which is conducive to improving the acquisition efficiency and processing efficiency of the terminal to the access control rules of the security element, thereby improving the efficiency of the application to access the security element. In addition, the scheme also combines the access control signature and the access control rule to perform access control, which can better ensure the security of the application's access to the security element.

[0103] In an exemplary embodiment, the secure element access controller of the terminal is further configured to send a request to obtain access control rules of the secure element to the trusted service management platform if the first access control signature and the second access control signature are consistent with each other.

[0104] Specifically, the processing flow of the access request processing system of the security element in this embodiment can be as follows: Figure 3 As shown. Among them, as described in the above-mentioned embodiment, the secure element access controller of the terminal can first obtain the first access control signature and the first access control rule from the security domain of the secure element, and send them to the trusted business management platform; then the trusted business management platform can store the received first access control signature of the secure element, and store the second access control rule obtained after preprocessing the first access control rule; the application of the terminal can send a secure element access request to the secure element access controller, and the secure element access controller can request the trusted business management platform to obtain the access control signature of the secure element and receive the first access control signature of the secure element sent by the trusted business management, and obtain the second access control signature stored on the local end.

[0105] Among them, Figure 3As shown, after obtaining the first access control signature and the second access control signature respectively, the secure element access controller of the terminal can first compare the two. Among them, if the two signatures are consistent, it can be determined that the terminal has obtained the correct access control signature of the target secure element, and the secure element access controller can further send an access control rule acquisition request for the target secure element to the trusted business management platform.

[0106] Optionally, the access control rule acquisition request may be used to request acquisition of all second access control rules of the target secure element.

[0107] Optionally, the access control rule acquisition request can also be used to request to obtain part of the second access control rules of the target security element. For example, it can carry the first application identifier of the application and the second application identifier of the target security element application that the application needs to access, and request the trusted service management platform to obtain the second access control rule that can be applied to the access control of the application to the target security element application.

[0108] In an exemplary embodiment, the secure element access controller of the terminal may also be used to send a secure element access error message to the application if the first access control signature and the second access control signature are inconsistent.

[0109] Among them, when the first access control signature of the security element received from the trusted business management platform is inconsistent with the second access control signature stored on the local end, it can be determined that the second access control signature stored in the terminal may be tampered with or forged. Based on this, the security element access controller can send a security element access error message to the application, indicating that the application cannot access the corresponding security element normally.

[0110] The trusted service management platform is further configured to send a second access control rule to the terminal upon receiving an access control rule acquisition request from the terminal.

[0111] When receiving the access control rule acquisition request from the terminal, the trusted service management platform may send the second access control rule of the target security element to the terminal.

[0112] Optionally, when the access control rule acquisition request indicates that all second access control rules of the target secure element need to be acquired, the trusted service management platform may send all second access control rules of the target secure element to the terminal.

[0113] Optionally, when the access control rule acquisition request indicates the need to obtain part of the second access control rules of the target security element, the trusted business management platform can filter out the second access control rules suitable for access control of the application of the terminal to the target security element application from the second access control rules of the target security element based on the first application identifier, second application identifier and other information carried in the access control rule acquisition request, and send it to the terminal.

[0114] The secure element access controller of the terminal is also used to receive a second access control rule of the secure element sent by the trusted business management platform; if the second access control rule indicates that the application is allowed to access the secure element, a secure element access request is sent to the secure element.

[0115] After receiving the second access control rule of the security element sent by the trusted business management platform, the security element access controller of the terminal can analyze the second access control rule according to the first application identifier of the application and the second application identifier of the target security element application that the application needs to access, so as to determine whether the application is allowed to access the target security element application. If it is determined that the access is allowed, the security element access request of the application can be forwarded to the corresponding target security element, so that a secure access channel can be established between the application and the target security element.

[0116] In an exemplary embodiment, the secure element access controller of the terminal is further configured to: send secure element access error information to the application if the second access control rule indicates that the application is not allowed to access the secure element.

[0117] Among them, when it is determined after analyzing the second access control rule that the second access control rule does not allow the application to access the corresponding target security element, the security element access controller can send a security element access error message to the application, indicating that the application cannot access the corresponding security element normally.

[0118] In this embodiment, the terminal's security element access controller first compares the first access control signature and the second access control signature, and when it is determined that the two are consistent, sends a request to obtain the security element's access control rules to the trusted business management platform, and processes the application's access to the security element application after receiving the second access control rule sent from the trusted business management platform. Therefore, when the first access control signature and the second access control signature are inconsistent, there is no need for communication between the terminal and the trusted business management platform and analysis of the second access control rule by the terminal, which is beneficial to saving computing resources and communication resource overheads, and is beneficial to more securely and flexibly implementing security access control of the application to the security element application.

[0119] In an exemplary embodiment, the trusted service management platform may be used to: perform deduplication processing on the first access control rule, and / or perform deconflict processing on the first access control rule to obtain the second access control rule.

[0120] It is understandable that the first access control rules stored in each security element may include multiple different access control rules. These rules may have different applicable objects and rule contents, for example, different access control rules may be applicable to a single or multiple applications, or to a single or multiple security element applications, or the rule content may include different permission conditions for application protocol data units (APDU) or near field communication (NFC) events, etc. Different access control rules may also be defined in different locations of the security element, for example, they may be defined in the access rule main library and the access rule auxiliary library. As a result, the first access control rules of the security element are prone to duplication, overlap or conflict.

[0121] Based on this, the pre-processing of the first access control rule by the trusted business management platform may include one or more of de-duplication processing and de-conflict processing.

[0122] Optionally, the trusted business management platform may compare the first access control rules of the same security element with each other. When there are multiple consistent first access control rules, only one of the first access control rules may be retained, thereby achieving deduplication of the first access control rules.

[0123] Optionally, the trusted business management platform can identify conflicting first access control rules (for example, applicable to the same application and security element application but with opposite rule contents, etc.) for each first access control rule of the same security element according to its scope of application and specific permission setting content, and perform deconfliction processing on these rules to obtain the second access control rules that are ultimately applicable to the corresponding application and security element application. Exemplarily, different first access control rules can have corresponding priorities. When there is a conflict between two or more first access control rules, the first access control rule with the highest priority can be retained as the second access control rule obtained after deconfliction processing according to the priority order of the conflicting first access control rules, or the conflicting first access control rules can be merged or split according to the priority order to obtain the second access control rule after deconfliction processing.

[0124] Exemplarily, the priority order between conflicting first access control rules can be determined according to one or more principles such as specific rule priority, rule priority related to terminal entity certificates, and restrictive rule priority. For example, assuming that there are first access control rules A and B at the same time, wherein the first access control rule A indicates that application p is not allowed to access secure element application q, and the first access control rule B indicates that application p is allowed to access secure element application q, then there is a conflict between the first access control rule A and the first access control rule B. Among them, according to the principle of restrictive rule priority, the first access control rule A has a higher priority than the first access control rule B, so that the first access control rule A can be used as the second access control rule obtained after de-conflicting. For another example, assuming that there are first access control rules C and D at the same time, wherein the first access control rule C indicates that application p is allowed to access secure element application q, and the first access control rule D indicates that all applications are not allowed to access all secure element applications, then there is a conflict between the first access control rules C and D. Among them, according to the principle of specific rule priority, the first access control rule C has a higher priority than the first access control rule D, so that the second access control rule obtained after de-conflicting according to the first access control rules C and D may include: the second access control rule A indicates that application p is allowed to access security element application q, the second access control rule B indicates that other applications other than application p are not allowed to access security element application q, and the second access control rule C indicates that all applications are not allowed to access other security element applications other than security element application q.

[0125] In this embodiment, the trusted business management platform performs pre-processing including de-duplication and de-conflict processing on the received first access control rule, thereby being able to effectively solve problems such as duplication or conflict that are prone to occur in the access control rules of security elements in related technologies, and being able to formulate flexible security access control rules for each security element application in the security element, thereby achieving effective management of the access control rules and more flexibly, efficiently and securely implementing security access control of applications to security element applications.

[0126] Based on the same inventive concept, the embodiment of the present application also provides a method for processing access requests of a security element. The implementation scheme for solving the problem provided by the method is similar to the implementation scheme recorded in the above system embodiment, so the specific limitations in the embodiments of the method for processing access requests of one or more security elements provided below can refer to the limitations of the access request processing system for security elements above, and will not be repeated here.

[0127] In an exemplary embodiment, Figure 4 As shown, a method for processing access requests of a security element is provided, and the method is applied to Figure 1The terminal in is used as an example to illustrate, including the following steps:

[0128] Step S401, sending the first access control signature and the first access control rule obtained from the security element to the trusted service management platform. The trusted service management platform is used to store the first access control signature and the second access control rule obtained by preprocessing the first access control rule.

[0129] Step S402: When a secure element access request from an application is received, a request for obtaining an access control signature of the secure element is sent to a trusted service management platform.

[0130] Step S403: receiving a first access control signature of the security element sent by the trusted service management platform.

[0131] Step S404: Obtain a second access control signature of the security element stored on the local end.

[0132] Step S405 , performing access processing of the application program to the security element according to the first access control signature, the second access control signature and the second access control rule obtained from the trusted service management platform.

[0133] In an exemplary embodiment, access processing of an application to a secure element is performed based on a first access control signature, a second access control signature, and a second access control rule obtained from a trusted business management platform, which may include: if the first access control signature and the second access control signature are consistent, sending a request to obtain the access control rules of the secure element to the trusted business management platform; receiving the second access control rules of the secure element sent by the trusted business management platform; if the second access control rule indicates that the application is allowed to access the secure element, sending a secure element access request to the secure element.

[0134] In an exemplary embodiment, the method may further include: if the first access control signature and the second access control signature are inconsistent, sending a secure element access error message to the application.

[0135] In an exemplary embodiment, the method may further include: if the second access control rule indicates that the application is not allowed to access the secure element, sending secure element access error information to the application.

[0136] In an exemplary embodiment, Figure 5 As shown, a method for processing access requests of a security element is provided, and the method is applied to Figure 1 The trusted business management platform in the example is used to illustrate, including the following steps:

[0137] Step S501: receiving a first access control signature and a first access control rule of a security element sent by a terminal.

[0138] Step S502: pre-process the first access control rule to obtain a second access control rule.

[0139] Step S503: upon receiving an access control signature acquisition request from the terminal, sending the first access control signature of the security element to the terminal, wherein the first access control signature and the second access control rule are used by the terminal to perform access processing on the security element.

[0140] In an exemplary embodiment, the method may further include: upon receiving an access control rule acquisition request from the terminal, sending a second access control rule to the terminal.

[0141] In an exemplary embodiment, preprocessing the first access control rule to obtain the second access control rule may include: deduplicating the first access control rule and / or deconflicting the first access control rule to obtain the second access control rule.

[0142] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0143] Based on the same inventive concept, the embodiment of the present application also provides a secure element access request processing device for implementing the secure element access request processing method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above system embodiment, so the specific limitations in the embodiments of the access request processing device for one or more secure elements provided below can refer to the limitations of the secure element access request processing system above, and will not be repeated here.

[0144] In an exemplary embodiment, Figure 6 As shown, a security element access request processing device 600 is provided, comprising:

[0145] A first sending module 601 is used to send a first access control signature and a first access control rule obtained from a security element to a trusted service management platform; the trusted service management platform is used to store the first access control signature and to store a second access control rule obtained by preprocessing the first access control rule;

[0146] The second sending module 602 finally sends an access control signature acquisition request of the secure element to the trusted service management platform when receiving a secure element access request of the application;

[0147] A first signature acquisition module 603, configured to receive the first access control signature of the security element sent by the trusted service management platform;

[0148] A second signature acquisition module 604 is used to acquire a second access control signature of the security element stored in the local end;

[0149] The access control module 605 is used to perform access processing of the application to the security element according to the first access control signature, the second access control signature and the second access control rule obtained from the trusted business management platform.

[0150] In an exemplary embodiment, the access control module 605 is used to: if the first access control signature and the second access control signature are consistent, send an access control rule acquisition request for the security element to the trusted business management platform; receive the second access control rule of the security element sent by the trusted business management platform; if the second access control rule indicates that the application is allowed to access the security element, send the security element access request to the security element.

[0151] In an exemplary embodiment, the apparatus further includes a third sending module, configured to send secure element access error information to the application if the first access control signature and the second access control signature are inconsistent after comparison.

[0152] In an exemplary embodiment, the apparatus further includes a fourth sending module, configured to send secure element access error information to the application if the second access control rule indicates that the application is not allowed to access the secure element.

[0153] In an exemplary embodiment, Figure 7 As shown, a security element access request processing device 700 is provided, comprising:

[0154] A receiving module 701, configured to receive a first access control signature and a first access control rule of a security element sent by a terminal;

[0155] A rule processing module 702, configured to pre-process the first access control rule to obtain a second access control rule;

[0156] The signature sending module 703 is used to send the first access control signature of the security element to the terminal when receiving an access control signature acquisition request from the terminal; the first access control signature and the second access control rule are used by the terminal to perform access processing on the security element.

[0157] In an exemplary embodiment, the apparatus further includes: a rule sending module, configured to send the second access control rule to the terminal upon receiving an access control rule acquisition request from the terminal.

[0158] In an exemplary embodiment, the rule processing module 702 is used to perform deduplication processing on the first access control rule and / or perform deconflict processing on the first access control rule to obtain the second access control rule.

[0159] Each module in the access request processing device of the security element can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in an electronic device in the form of hardware, or can be stored in a memory in the electronic device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0160] In an exemplary embodiment, an electronic device is provided. The electronic device may be a server, and its internal structure diagram may be as shown in FIG. Figure 8 As shown. The electronic device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the electronic device is used to store data such as the first access control signature and the second access control rule of the security element. The input / output interface of the electronic device is used to exchange information between the processor and an external device. The communication interface of the electronic device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for processing access requests of a security element is implemented.

[0161] In an exemplary embodiment, an electronic device is provided. The electronic device may be a terminal, and its internal structure diagram may be as shown in FIG. Fig. 9 As shown. The electronic device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the electronic device is used to exchange information between the processor and an external device. The communication interface of the electronic device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, a method for processing access requests of a security element is implemented. The display unit of the electronic device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the electronic device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the electronic device casing, or an external keyboard, touchpad or mouse.

[0162] Those skilled in the art will understand that Figure 8 or Fig. 9 The structure shown in the figure is merely a block diagram of a partial structure related to the scheme of the present application, and does not constitute a limitation on the electronic device to which the scheme of the present application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0163] In one embodiment, an electronic device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0164] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0165] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0166] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0167] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0168] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0169] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for processing access requests of a security element, characterized in that: The method comprises: Sending a first access control signature and a first access control rule obtained from a security element to a trusted business management platform; the trusted business management platform is used to store the first access control signature and to store a second access control rule obtained by preprocessing the first access control rule; When receiving a secure element access request from an application, sending a request for obtaining an access control signature of the secure element to the trusted service management platform; Receiving the first access control signature of the security element sent by the trusted service management platform; Obtaining a second access control signature of the security element stored on the local end; Access processing of the application to the security element is performed according to the first access control signature, the second access control signature, and the second access control rule obtained from the trusted business management platform.

2. The method according to claim 1, characterized in that The performing access processing of the application to the security element according to the first access control signature, the second access control signature, and the second access control rule obtained from the trusted service management platform includes: If the first access control signature and the second access control signature are consistent with each other, sending a request for obtaining access control rules of the security element to the trusted service management platform; receiving the second access control rule of the security element sent by the trusted service management platform; If the second access control rule indicates that the application is allowed to access the secure element, the secure element access request is sent to the secure element.

3. The method according to claim 2, characterized in that The method further comprises: If the first access control signature and the second access control signature are inconsistent, a secure element access error message is sent to the application.

4. The method according to claim 2, characterized in that: The method further comprises: If the second access control rule indicates that the application is not allowed to access the secure element, secure element access error information is sent to the application.

5. A method for processing access requests of a security element, characterized in that: The method comprises: Receiving a first access control signature and a first access control rule of a security element sent by a terminal; Preprocessing the first access control rule to obtain a second access control rule; When receiving an access control signature acquisition request from the terminal, the first access control signature of the security element is sent to the terminal; the first access control signature and the second access control rule are used by the terminal to perform access processing on the security element.

6. The method according to claim 5, characterized in that The method further comprises: When receiving the access control rule acquisition request from the terminal, the second access control rule is sent to the terminal.

7. The method according to claim 5, characterized in that The preprocessing of the first access control rule to obtain the second access control rule includes: The first access control rule is deduplicated and / or deconflicted to obtain the second access control rule.

8. A security element access request processing system, characterized in that: The system includes: a terminal, a security element, and a trusted business management platform; The secure element access controller of the terminal is used to send the first access control signature and the first access control rule obtained from the secure element to the trusted service management platform; The trusted service management platform is used to receive the first access control signature and the first access control rule of the security element sent by the terminal; perform pre-clearing processing on the first access control rule to obtain a second access control rule; the first access control signature and the second access control rule are used by the terminal to perform access processing on the security element; The application of the terminal is used to send a secure element access request to the secure element access controller; The secure element access controller of the terminal is further configured to send an access control signature acquisition request for the secure element to the trusted service management platform when receiving a secure element access request from an application; The trusted service management platform is further configured to send the first access control signature of the security element to the terminal when receiving the access control signature acquisition request from the terminal; The security element access controller of the terminal is also used to receive the first access control signature of the security element sent by the trusted business management platform; obtain the second access control signature of the security element stored on this end; and perform access processing of the application to the security element according to the first access control signature, the second access control signature and the second access control rule obtained from the trusted business management platform.

9. The system according to claim 8, characterized in that The secure element access controller of the terminal is further configured to send an access control rule acquisition request for the secure element to the trusted service management platform if the first access control signature and the second access control signature are consistent with each other; The trusted service management platform is further configured to send the second access control rule to the terminal upon receiving the access control rule acquisition request from the terminal; The security element access controller of the terminal is also used to receive the second access control rule of the security element sent by the trusted business management platform; if the second access control rule indicates that the application is allowed to access the security element, the security element access request is sent to the security element.

10. An access request processing device for a security element, characterized in that: The device comprises: A first sending module, used to send a first access control signature and a first access control rule obtained from a security element to a trusted business management platform; the trusted business management platform is used to store the first access control signature and to store a second access control rule obtained by preprocessing the first access control rule; The second sending module finally sends an access control signature acquisition request of the security element to the trusted service management platform when receiving the security element access request of the application; A first signature acquisition module, configured to receive the first access control signature of the security element sent by the trusted service management platform; A second signature acquisition module, used to acquire a second access control signature of the security element stored in the local end; An access control module is used to perform access processing of the application to the security element according to the first access control signature, the second access control signature and the second access control rule obtained from the trusted business management platform.

11. A security element access request processing device, characterized in that: The device comprises: A receiving module, configured to receive a first access control signature and a first access control rule of a security element sent by a terminal; A rule processing module, used for preprocessing the first access control rule to obtain a second access control rule; A signature sending module is used to send the first access control signature of the security element to the terminal when receiving an access control signature acquisition request from the terminal; the first access control signature and the second access control rule are used by the terminal to perform access processing on the security element.

12. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

14. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images