Near field communication device and method

Abstract

The embodiment of the invention provides a near field communication (NFC) device and method, the near field communication (NFC) device part comprises an NFC controller and middleware, the middleware is used for identity authentication and encryption transmission with a TSM, and processing transmission logic between the NFC controller and an application program, and the application program is communicated with the TSM. In some embodiments, the NFC device is deployed with a trusted execution environment (TEE), and the middleware is a trusted application (TA) deployed for the TEE. According to the embodiment of the invention, the hardware cost and development cost of the NFC equipment can be reduced.

Description

Technical Field

[0001] This application relates to the field of near field communication technology, and particularly to a near field communication device and method. Background Art

[0002] Near field communication (NFC) is a short-range high-frequency radio technology that operates within a distance of 10 centimeters at a working frequency of 13.56 MHz. In real life, there are a large number of NFC card emulation / NFC card emulation devices operating in the Card emulation (CE) mode. In the card emulation mode, the NFC system can be emulated as an NFC card, that is, the NFC system can emulate a contactless radio frequency card that complies with NFC-related standards for data interaction with an NFC reader.

[0003] In the card emulation mode, most current NFC systems request from the Trusted Service Manager (TSM) and store the card data downloaded from the TSM in security modules such as the Embedded Secure Element (eSE) and the Single Wire Protocol SIM (SWP SIM). That is, if the card emulation mode is to be used and security is to be ensured, security modules such as eSE and SWP SIM must be added to the NFC system, which greatly increases the application threshold of the card emulation function of the NFC system and also greatly increases the cost of the chip. Summary of the Invention

[0004] In view of the above problems, embodiments of this application provide a near field communication device and method to solve the above technical problems.

[0005] In a first aspect, an embodiment of this application provides a near field communication device, which includes an NFC controller and middleware. Among them: The middleware is used for performing identity authentication and encrypted transmission with the TSM, and processing the transmission logic between the NFC controller and the application program, and the application program communicates with the Trusted Service Manager (TSM).

[0006] In some embodiments, the middleware is further used for performing identity authentication and encrypted transmission with the NFC controller.

[0007] In some embodiments, authentication and encrypted transmission are performed between the middleware and the TSM based on a first root key. The first root key is used to derive a session key and is pre - set in a Trusted Execution Environment (TEE).

[0008] In some embodiments, authentication and encrypted transmission are performed between the middleware and the NFC controller based on a second root key, where: The second root key is used to derive a session key and is pre - set in the TEE; in the case where the NFC controller includes a permanent storage area, the second root key is also pre - set in this permanent storage area; in the case where the NFC controller has no permanent storage area, the NFC controller obtains the encrypted second root key from the middleware and decrypts it using a fixed key value in the program code, and temporarily stores the decrypted second root key.

[0009] In some embodiments, the middleware is used to: perform authentication with the TSM based on the first root key during the card - opening process; after the application program receives the encrypted card data sent by the TSM after successful authentication: decrypt the encrypted card data based on the first root key and store the decrypted card data; when sending the card data, send the decrypted card data to the NFC controller; or store the encrypted card data; when sending the card data, decrypt the encrypted card data based on the first root key and send the decrypted card data to the NFC controller.

[0010] In some embodiments, the middleware is further used to: perform authentication with the NFC controller based on the second root key when sending the card data, encrypt the card data based on the second root key, and send the encrypted card data to the NFC controller; The NFC controller is used to decrypt the encrypted card data based on the second root key to obtain the decrypted card data.

[0011] In some embodiments, the middleware is used to: generate a first random number during the card opening process, where the first random number is sent to the TSM via the application; receive a response message sent by the TSM via the application, where the response message carries an identity authentication token and a message authentication code, the identity authentication token is generated based on the first root key on the TSM side and the first random number, and the message authentication code is used to verify the legality of the response message; verify the message authentication code of the response message based on the first root key on the middleware side; in the case where the message authentication code is verified successfully, verify the identity authentication token based on the first root key on the middleware side and destroy the first random number; in the case where the identity authentication token is verified successfully, perform the card opening operation, generate a message authentication code for the return code based on the first root key on the middleware side, and send a card opening return result carrying the return code and the message authentication code, where the card opening return result is sent to the TSM via the application, so that the TSM verifies the middleware based on the first root key on the TSM side and the message authentication code.

[0012] In some embodiments, the middleware is used to: request the NFC controller to generate a second random number when distributing card data; generate an identity authentication token and a negotiated session key based on the second root key on the middleware side and the second random number, encrypt the card data based on the session key, and send a card data distribution notification carrying the identity authentication token and the encrypted card data to the NFC controller; the NFC controller is used to receive the card data distribution notification, verify the identity authentication token based on the second root key on the NFC side, and decrypt the encrypted card data.

[0013] In some embodiments, the middleware is further used to: in response to a data migration request from the application, send the encrypted card data to the application, where the application sends the encrypted card data to the TSM.

[0014] In some embodiments, the middleware is further used to read the card data on the NFC side to obtain updated card data; and / or the NFC controller is further used to send a card data update notification to the middleware after the card data on the NFC side is updated; the middleware is further used to update the card data on the middleware side based on the card data update notification from the NFC controller.

[0015] In some embodiments, the NFC device deploys a TEE, and the above middleware is a trusted application (TA) deployed by the TEE.

[0016] In a second aspect, an embodiment of the present application provides a near field communication method, which is applied to an NFC device including an NFC controller and middleware. The method includes: performing identity authentication and encrypted transmission between the middleware and the TSM; the middleware processes the transmission logic between the NFC controller and the application, and the application communicates with the TSM.

[0017] In some embodiments, the method further includes: performing authentication and encrypted transmission between the middleware and the NFC controller.

[0018] In some embodiments, performing authentication and encrypted transmission between the middleware and the TSM includes: during the card opening process, performing authentication between the middleware and the TSM based on the first root key; after the application receives the encrypted card data sent by the TSM after successful authentication: the middleware decrypts the encrypted card data based on the first root key and stores the decrypted card data; when distributing the card data, sending the decrypted card data to the NFC controller; or the middleware stores the encrypted card data; when distributing the card data, decrypts the encrypted card data based on the first root key and sends the decrypted card data to the NFC controller.

[0019] In some embodiments, performing authentication and encrypted transmission between the middleware and the NFC controller includes: when distributing the card data, the middleware performs authentication with the NFC controller based on the second root key, encrypts the card data based on the second root key, and sends the encrypted card data to the NFC controller; the NFC controller decrypts the encrypted card data based on the second root key to obtain the decrypted card data.

[0020] In some embodiments, performing authentication between the middleware and the TSM based on the first root key includes: during the card opening process, the middleware generates a first random number, wherein the first random number is sent to the TSM via the application; the middleware receives, via the application, a response message sent by the TSM, wherein the response message carries an authentication token and a message authentication code, the authentication token is generated based on the first root key and the first random number on the TSM side, and the message authentication code is used to verify the legality of the response message; the middleware verifies the message authentication code of the response message based on the first root key on the middleware side; in the case where the message authentication code is verified successfully, the middleware verifies the authentication token based on the first root key on the middleware side and destroys the first random number; in the case where the authentication token is verified successfully, the middleware performs a card opening operation, generates a message authentication code for the return code based on the first root key on the middleware side, and sends a card opening return result carrying the return code and the message authentication code, wherein the card opening return result is sent to the TSM via the application, so that the TSM verifies the middleware based on the first root key and the message authentication code on the TSM side.

[0021] In some embodiments, authentication and encrypted transmission are performed between the middleware and the NFC controller, including: when issuing card data, the middleware requests the NFC controller to generate a second random number; generating an authentication token and a negotiated session key based on the second root key and the second random number on the middleware side, encrypting the card data based on the session key, and sending a card data issuance notice carrying the authentication token and the encrypted card data to the NFC controller; wherein, the NFC controller receives the card data issuance notice, verifies the authentication token based on the second root key on the NFC side, and decrypts the encrypted card data.

[0022] In some embodiments, the method further includes: in response to a data migration request from an application, the middleware sends the encrypted card data to the application, wherein the application sends the encrypted card data to the TSM.

[0023] In some embodiments, the method further includes: the middleware reads the card data on the NFC side to obtain updated card data; and / or after the card data on the NFC side is updated, the NFC controller sends a card data update notice to the middleware; the middleware updates the card data on the middleware side based on the card data update notice from the NFC controller.

[0024] In some embodiments, a TEE is deployed in the NFC device, and the middleware is a TA deployed for the TEE.

[0025] The near-field communication device and method provided by the embodiments of the present application can also make the CE mode have a certain degree of security and reduce the hardware cost of the NFC device in the case where the NFC device does not have security modules such as eSE and SWP SIM. Based on the authentication and encrypted transmission functions provided by the middleware, it is possible to implement a customized security solution for NFC device manufacturers. During the process of docking the implementation solution, NFC device manufacturers do not need to have a development foundation for security modules such as eSE and SWP SIM, and the process of docking eSE, SWP SIM and other security modules with NFC is omitted, which can reduce the development time cost and technical threshold.

[0026] These aspects or other aspects of the present application will be more clearly understood in the following description of the embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application. For those skilled in the art, without creative efforts, other drawings can be obtained based on these drawings.

[0028] Figure 1The structural schematic diagram of an electronic device to which the technical solution of the embodiment of the present application can be applied is shown.

[0029] Figure 2 The schematic block diagram of a kind of NFC device in the prior art is shown.

[0030] Figure 3 The schematic block diagram of the NFC device of the embodiment of the present application is shown.

[0031] Figure 4 The schematic block diagram of an identity authentication and encrypted transmission of the embodiment of the present application is shown.

[0032] Figure 5 The schematic block diagram of another identity authentication and encrypted transmission of the embodiment of the present application is shown.

[0033] Figure 6 The schematic diagram of a near-field communication method of the embodiment of the present application is shown.

[0034] Figure 7 The schematic flow chart of the identity authentication and encrypted transmission between TA and TSM of the embodiment of the present application is shown.

[0035] Figure 8 The schematic flow chart of the identity authentication between TA and TSM of the embodiment of the present application is shown.

[0036] Figure 9 The schematic flow chart of the identity authentication and encrypted transmission between TA and NFC controller of the embodiment of the present application is shown.

[0037] Figure 10 The schematic flow chart of a typical card opening process of the embodiment of the present application is shown. Detailed implementation manners

[0038] The following details the implementation manners of the present application. The examples of the implementation manners are shown in the accompanying drawings, in which the same or similar reference numerals denote the same or similar elements or elements with the same or similar functions from beginning to end. The implementation manners described below with reference to the accompanying drawings are exemplary only for explaining the present application and should not be construed as a limitation to the present application.

[0039] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiment of the present application will be clearly and completely described below in conjunction with the accompanying drawings in the embodiment of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative efforts shall fall within the protection scope of the present application.

[0040] In the embodiments of the present application, it should be noted that in this text, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations.

[0041] Moreover, the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, such that a process, method, article or device comprising a series of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article or device. Without further limitation, an element defined by the statement "comprising an..." does not exclude the presence of additional identical elements in the process, method, article or device comprising the element.

[0042] In the description of the embodiments of the present application, words such as "example" or "for example" are used to indicate examples, explanations or descriptions. Any embodiment or design described as "for example" or "for instance" in the embodiments of the present application is not construed as being more preferred or having more advantages than another embodiment or design. The use of words such as "example" or "for example" is intended to present relative concepts in a clear manner.

[0043] In addition, "a plurality of" in the embodiments of the present application means two or more. In view of this, "a plurality of" in the embodiments of the present application can also be understood as "at least two". "At least one" can be understood as one or more, for example, understood as one, two or more. For example, including at least one means including one, two or more, and there is no limitation on which ones are included. For example, including at least one of A, B, and C, then what can be included is A, B, C, A and B, A and C, B and C, or A, B, and C.

[0044] It should be noted that in the embodiments of the present application, "and / or" describes the association relationship of associated objects, indicating that three relationships can exist. For example, A and / or B can represent: A exists alone, A and B exist simultaneously, and B exists alone. In addition, the character " / ", unless otherwise specified, generally represents an "or" relationship between the associated objects before and after.

[0045] It should be pointed out that "connection" in the embodiments of the present application can be understood as electrical connection, and the connection of two electrical components can be a direct or indirect connection between the two electrical components. For example, when A is connected to B, it can be either a direct connection between A and B or an indirect connection between A and B through one or more other electrical components.

[0046] Figure 1 The structural schematic diagram of an electronic device capable of applying the technical solution of the embodiments of the present application is shown. Please refer toFigure 1 As shown, the typical hardware structure of the electronic device 100 may include: a processor 101, a memory 102, a radio device 103, an audio output unit 104, an A / V input unit 105, a display unit 106, a user input unit 107, an interface unit 108, and a power supply 109. It should be understood that Figure 1 This is only an exemplary illustration of the embodiments of the present application and does not limit the electronic device 100.

[0047] The display unit 106 includes various types of display panels and can display visual graphics, such as a graphical user interface (GUI). The user input unit 107 may include a touch panel, and the touch panel may cover the display panel. The audio output unit 104 includes a speaker, etc. The A / V input unit 105 includes an image processor 1051 and a microphone 1052.

[0048] The memory 102 can store data and instructions that can run on the processor 101. The instructions include an operating system 111, etc. Refer to Figure 1 As shown, the memory 102 stores one or more application programs 110. The one or more application programs 110 include weather, instant messaging, phone, text message, email, or stock, etc.

[0049] Please continue to refer to Figure 1 As shown, in the embodiments of the present application, the electronic device 100 further includes an NFC device 200. The processor 101 can communicate with the NFC device 200. Specifically, the processor 101 can communicate with the NFC device 200. The processor 101 and the NFC device 200 can be connected through a bus interface such as an I2C (Inter-Integrated Circuit) interface or a UART (Universal Asynchronous Receiver / Transmitter) interface. The communication between the processor 101 and the NFC device 200 can be carried out through an NCI (NFC Controller Interface) protocol. The aforementioned operating system 111 and / or application program 110 can control the NFC device 200 to implement NFC functions such as mobile payment, identity recognition, access control, obtaining electronic tag information, data exchange, device connection, electronic wallet, and electronic bus card.

[0050] The electronic device 100 can operate in an active mode or a passive mode. The active mode can include a Peer-to-Peer mode (abbreviated as P2P mode) and a Reader / Writer mode (abbreviated as RW mode). In the Peer-to-Peer mode, two NFC-enabled electronic devices 100 are paired and connected to enable peer-to-peer data transmission, such as quickly transferring files between two electronic devices 100. In the Reader / Writer mode, the NFC-enabled electronic device 100 reads and writes information from media such as tags, stickers, business cards, etc. with NFC chips. The passive mode includes a Card Emulation mode (abbreviated as CE mode), which is also known as NFC card emulation mode, card mode, card emulation mode, etc. In the Card Emulation mode, the NFC device operates similar to a standard contactless smart card. This allows the electronic device 100 to be used in existing contactless smart card infrastructures to perform operations such as access control, contactless payment, firmware replacement, or data transmission. The NFC device emulating the smart card usually operates in the passive NFC mode, and the data transmission is secure at this time. In the Card Emulation mode, the electronic device 100 can be used as a credit card, transportation card, access control card, train ticket, and so on.

[0051] In some specific implementations, referring to Figure 2 as shown, the NFC device 200 can include an NFC controller 201, an NFC antenna interface 202, and an NFC antenna 203. The NFC controller 201 can implement the processing of analog and digital protocols defined by NFC card emulation, reader / writer, and peer-to-peer modes. The NFC antenna 203 can perform electromagnetic coupling with the antenna of the NFC reader 300 to transmit electromagnetic signals through near-field coupling.

[0052] Continuing to refer to Figure 2 , the NFC antenna 203 can use a dedicated NFC antenna and / or reuse components of the electronic device. For example, the frame of the electronic device 100 can be reused as the NFC antenna 203. In an electronic device 100 with a wireless charging coil, the wireless charging coil of the electronic device 100 can be reused as the NFC antenna 203. Based on the product application scenario and functional requirements, the NFC device 200 can include one or more NFC antennas 201. In a specific implementation, for example, in a smartphone, NFC antennas can be set at positions such as the top and the middle of the back to facilitate communication between the smartphone and the NFC reader or reading NFC cards and NFC tags. The NFC antenna interface 202 can include a receiving matching circuit, a filtering circuit, and a receiving circuit, etc. The matching circuit can be used to match the operating frequency and input impedance, and the filtering circuit can be used to filter out the high-order harmonics of the crystal oscillator.

[0053] In the prior art, continuing to refer to Figure 2, the NFC device 200 further includes a Secure Element (SE) 204. The secure element 204 is a tamper-proof hardware module for securely storing and processing sensitive information such as payment information and identity credentials. The secure element 204 can run one or more card applications (Applets), which are also known as smart card applications or applets. A card application is a small program unit running inside the secure element 204, which can be regarded as a software module performing specific functions in the secure space of the secure element 204. The secure element 204 can be integrated into the electronic device 100 in various ways. In some specific implementations, the secure element 204 serves as a secure chip in the electronic device 100. In this case, the secure element 204 is also referred to as an Embedded Secure Element (eSE) or a built-in secure element. When the secure element 204 is an embedded secure element, the secure element 204 is generally only connected to the NFC controller 201. The secure element 204 can communicate with the processor 101 of the electronic device 100 through the NFC controller 201 and perform near-field communication through the NFC controller 201. For other integration methods of the secure element 204, please refer to the prior art, which will not be elaborated in this specification.

[0054] In the electronic device 100, when the application 110 (such as the wallet 110a) needs to perform operations such as payment and authentication, it generally first accesses the card application in the secure element 204, and the card application implements functions such as transaction processing and authentication. In the NFC card emulation mode, when an external NFC reader 300 initiates a communication request, the NFC controller 201 can transfer the signal of the NFC reader 300 to the secure element 204. After receiving the request, the card application in the secure element 204 performs corresponding processing according to the type of the request (such as an authentication request, a payment request, etc.). After the processing is completed, the card application returns the result to the NFC reader 300 through the secure element 204 and the NFC controller 201.

[0055] In the prior art, in the CE mode, most NFC systems request the TSM and store the card data downloaded from the TSM in the secure element 204. That is, if the CE mode is to be used and security is to be ensured, it is necessary to add the secure element 204 or a similar security module to the NFC system, which greatly increases the application threshold of the card emulation function of the NFC system and also greatly increases the cost of the chip.

[0056] Therefore, the embodiments of the present application provide an NFC device, which may include, but is not limited to, such as Figure 1The electronic device 100 shown. In the embodiments of the present application, the NFC device may include an application, middleware, and an NFC controller. The application and the middleware run on the application processor. The NFC controller can implement the processing of analog and digital protocols defined by NFC card emulation, reader / writer, and peer-to-peer mode. The middleware processes the transmission logic between the NFC controller and the application. In some embodiments, the NFC device is deployed with a TEE, and the middleware is a TA deployed in the TEE, so that the middleware has a high level of security. For the sake of convenience of description, in the embodiments of the present application, the middleware is described as a TA.

[0057] In the embodiments of the present application, as Figure 3 shown, the NFC device 400 may include an application 401, a TA 402, and an NFC controller 403. The NFC device 400 is deployed with a TEE, and the TA 402 is deployed in the TEE, so that the TA 402 has a high level of security. The application 401 generally runs in a Rich Execution Environment (REE). The application 401 and the TA 402 run on the application processor of the NFC device 400, and the application processor may include, but is not limited to, the processor 101 as Figure 1 shown.

[0058] The application 401 may include a wallet, a client of a bus company, a client of an access control card company, etc. The application 401 communicates with the TSM 500 to implement downloading from the TSM 500 and uploading user data that needs to be stored to the TSM 500.

[0059] The NFC controller 403 can implement the processing of analog and digital protocols defined by NFC card emulation, reader / writer, and peer-to-peer mode. The TA 402 processes the transmission logic between the NFC controller 403 and the application 401. The TA 402 and the NFC controller 403 can communicate based on communication commands specified by the NFC Controller Interface (NCI) specification, including but not limited to Application Protocol Data Unit Transfer (APDU Transfer), Card Info Update, and Get Card Info, etc. The TA 402 can provide an Application Programming Interface (API) to the application 401, and the application 401 interacts with the TA 402 by calling the API of the TA 401.

[0060] In an embodiment of the present application, in the CE mode, the NFC controller 403 forwards the commands that need to be processed by the application 401 and give responses during the interaction with the NFC reader to the TA 402. The TA 402 forwards the command to the application 401, and the application 401 processes the command corresponding thereto. Correspondingly, the application 401 forwards the response to the TA 402. The TA 402 forwards the response to the NFC controller 403, and the NFC controller 403 processes the response, such as sending a response to the NFC reader.

[0061] In order to enable the NFC device to dispense with a security unit and similar hardware, and at the same time make the CE mode have a certain degree of security, in an embodiment of the present application, identity authentication and encrypted transmission are implemented through the TA 402. The TEE is a secure computing environment created by hardware isolation technology, ensuring that identity authentication and encrypted transmission are processed in an independent secure environment and guaranteeing the security of the key. The exemplary solutions of the embodiments of the present application are described below.

[0062] In some embodiments, as Figure 4 shown, identity authentication and encrypted transmission are performed between the TA 402 and the TSM 500, and the decrypted card data is transmitted between the TA 402 and the NFC controller 403. Continuing to refer to Figure 4 , the transmission nodes of the card data include the TSM 500, the application 401, the TA 402, and the NFC controller 403. Through this embodiment, the card data is encrypted and transmitted between the TSM 500 and the TA 402. The application 401 cannot obtain the ciphertext, and other programs cannot steal the card data, ensuring the security of the card data.

[0063] In some embodiments, identity authentication and encrypted transmission are performed between the TA 402 and the TSM 500 based on a first root key. The first root key is used to derive a session key and can be pre-set in the TEE of the TA 402 to ensure that the root key is processed in an independent secure environment and guarantee the security of the root key. In a specific implementation, the production line device can write the root key into the TEE of the TA 402 before the NFC device leaves the factory.

[0064] Identity authentication between the TA 402 and the TSM 500 based on the first root key can adopt a Challenge-Response authentication mechanism. In some embodiments, identity authentication between the TA 402 and the TSM 500 based on the root key includes:

[0065] TA 402 generates a first random number during the card opening process, and the first random number is sent to the TSM 500 via the application 401. Specifically, the application 401 can initiate the card opening process based on user operations to generate an NFC card. When the application 401 initiates the card opening process, it requests TA 402 to generate a first random number. TA 402 generates the first random number in response to the request of the application 401 and sends the generated first random number to the application 401. The application 401 requests card opening from the TSM 500, and the first random number generated by TA 402 is carried in this request.

[0066] The TSM 500 receives the request sent by the application 401, obtains the first random number generated by TA 402 from the request, and generates an authentication token and a message authentication code based on the first root key on the TSM side and this first random number. The TSM 500 carries the authentication token and the message authentication code in the response message and sends the response message to the application 401. The message authentication code is used to verify the legality of the response message. The application 401 sends the response message to TA 402.

[0067] TA 402 verifies the message authentication code of the response message based on the first root key on the TA side. If the message authentication code verification passes, TA 402 verifies the authentication token based on the first root key on the TA side and destroys the first random number. If the authentication token verification passes, TA 402 confirms that the TSM 500 is legal, performs the card opening operation, generates the message authentication code of the return code based on the first root key on the TA side, and sends the card opening return result carrying the return code and the message authentication code. The card opening return result is sent to the TSM 500 via the application 401. The TSM 500 verifies TA 402 based on the first root key on the TSM side and this message authentication code. If TA 402 passes the verification, then TA 402 and the TSM 500 complete mutual authentication.

[0068] After TA402 and TSM 500 complete mutual authentication, TSM 500 encrypts the card data based on the first root key and sends the encrypted card data to the application 401. The application 401 receives the encrypted card data sent by TSM 500 and sends the encrypted card data to TA 402. TA 402 performs card data storage and decryption. In some implementations, TA 402 decrypts the encrypted card data and stores the decrypted card data in the TEE of TA 402. When issuing the card data, the decrypted card data is sent to the NFC controller 403. Storing the decrypted card data in the TEE can ensure the security of the card data and enable fast transmission without decryption when issuing the card data. In other implementations, TA402 stores the encrypted card data in the TEE of TA 402, and when issuing the card data, decrypts the encrypted card data and sends the decrypted card data to the NFC controller 403. Storing the encrypted card data in the TEE can further ensure the security of the card data.

[0069] In some embodiments, the NFC controller 403 has storage modules such as RAM and FLASH, or the NFC controller 403 is externally connected with storage modules such as E2PROM, RAM, and FLASH. The reading and storage speeds of the external storage are relatively slow compared to the internal storage. The NFC controller 403 can store the card data in the NFC controller 403 after receiving the card data sent by TA 402. In this embodiment, TA402 sends the decrypted card data, and the NFC controller 403 stores the decrypted card data. The NFC controller 403 can use the card data stored by itself to swipe the card, realizing offline and shutdown card swiping.

[0070] As Figure 5 shown, in some embodiments, identity authentication and encrypted transmission are also performed between TA402 and the NFC controller 403. Referring to Figure 5 , the transmission nodes of the card data include TSM 500, the application 401, TA 402, and the NFC controller 403. Through this embodiment, the card data is encrypted and transmitted between TSM 500 and TA 402, and between TA402 and the NFC controller 403. The application 401 cannot obtain the ciphertext, and other programs cannot steal the card data, ensuring the security of the card data.

[0071] The same root key or different root keys can be used between TA402 and the NFC controller 403, and between TA 402 and the TSM 500. The root key between TA402 and the TSM 500 is called the first root key, and the root key between TA402 and the NFC controller 403 is called the second root key. In some embodiments, authentication and encrypted transmission are performed between TA 402 and the NFC controller 403 based on the second root key, where: The second root key is used to derive a session key and is pre - set in the TEE of TA 402. The NFC controller 403 can be pre - set with the second root key or obtain the second root key from TA401. In some implementations, the NFC controller 403 includes a permanent storage area, and the second root key is also pre - set in the permanent storage area of the NFC controller 403. In other implementations, the NFC controller 403 has no permanent storage area, and the NFC controller 403 can obtain the encrypted second root key from TA401. For example, TA40 can send the encrypted second root key to the NFC controller 403 after the NFC device is powered on. The NFC controller 403 can decrypt it using a fixed key value in the program code and temporarily save the decrypted second root key. In a specific implementation, the second root key can be pre - set in the TEE of TA402 and the NFC controller 403 by production line equipment before the NFC device leaves the factory. The permanent storage area can be a flash memory (FLASH), a read - only memory (Read - Only Memory, ROM), a one - time programmable (One - Time Programmable, OTP) memory, etc.

[0072] In some embodiments, when TA 402 distributes card data, it can authenticate with the NFC controller 403 based on the second root key, encrypt the card data based on the second root key, and send the encrypted card data to the NFC controller 403. The NFC controller can decrypt the encrypted card data based on the second root key to obtain the decrypted card data.

[0073] In a specific implementation, when TA 402 distributes card data, it can request the NFC controller 403 to generate a second random number. The NFC controller 403 generates the second random number and sends it to TA 402. TA can generate an authentication token and a negotiated session key based on the second root key on the TA side and the received second random number, encrypt the card data based on the session key, and send a card data distribution notice carrying the authentication token and the encrypted card data to the NFC controller 403. The NFC controller 403 receives the card data distribution notice sent by TA 402, verifies the authentication token carried in the card data distribution notice based on the second root key on the NFC side, and decrypts the encrypted card data.

[0074] The NFC controller 403 can store card data in the NFC controller 403, for example, temporarily store it in a Random Access Memory (RAM). The NFC controller 403 can use the card data stored by itself to swipe the card, realizing offline and shutdown card swiping. In a specific implementation, the NFC controller 403 can store the encrypted card data, decrypt the encrypted card data based on the second key during card swiping, which can ensure the security of the card data. In some other implementations, the NFC controller 403 decrypts the encrypted card data based on the second key and stores the decrypted card data, and uses the stored decrypted card data to swipe the card during card swiping, which can avoid decrypting during card swiping and reduce the card swiping speed.

[0075] In some embodiments, the TA 402 can, in response to a data migration request from the application 401, send the encrypted card data to the application 401. The application 401 receives the encrypted card data sent by the TA 402 in response to the data migration request, and sends the encrypted card data to the TSM 500. The TSM 500 can migrate the card data to other NFC devices.

[0076] During the interaction between the NFC controller 403 and an external NFC card reader, in some cases the NFC card reader will modify the card data. In some embodiments, the TA 402 can read the card data on the NFC side to obtain the updated card data. Specifically, the TA402 can actively read the card data stored in the NFC controller 403 by means of software NCI commands or hardware interface reading. In some embodiments, after the card data on the NFC side is updated, the NFC controller 403 can send a card data update notification to the TA. The TA402 can update the card data on the TA side based on the card data update notification sent by the NFC controller 403.

[0077] The embodiments of the present application further provide a near field communication method, which is applied to an NFC device including an NFC controller and deploying a TEE, and a TA is deployed in the TEE. The NFC device may include, but is not limited to Figure 1 the electronic device 100 shown in Figure 3 , Figure 4 and Figure 5 the NFC device 400 shown in Figure 6 As shown in

[0078] In some embodiments, encryption transmission and identity authentication can be performed between the TA 402 and the NFC controller 403, and between the TA 402 and the TSM 500 by deriving a session key from a root key. In a specific implementation, the same root key or different root keys can be used between the TA 402 and the NFC controller 403, and between the TA 402 and the TSM 500. The root key between the TA 402 and the TSM 500 is called the first root key, and the root key between the TA 402 and the NFC controller 403 is called the second root key.

[0079] In some specific embodiments, as Figure 7 shown, identity authentication and encryption transmission between the TA and the TSM can include the following steps. During the card opening process, identity authentication is performed between the TA and the TSM based on the first root key. The TA and the TSM perform identity authentication based on their respective first root keys. After the identity authentication between the TA and the TSM is passed, the TSM sends the encrypted card data to the application. The application receives the encrypted card data sent by the TSM and forwards the encrypted card data to the TA. The TA stores the card data and sends the card data to the NFC controller when the card data is issued. Specifically, the application can send a card switching request to the TA, and the TA, in response to the card switching request from the application, sends the card data to the NFC controller.

[0080] Further, in some implementations, the TA stores the decrypted card data. In this case, after the TA receives the encrypted card data sent by the TSM, it decrypts the encrypted card data based on the first root key on the TA side and stores the decrypted card data. When the TA issues the card data, for example, when it receives a card switching request sent by the application, it sends the decrypted card data to the NFC controller. In this implementation, there is no need to decrypt when issuing the card data, and the card data can be issued quickly. In some implementations, the TA stores the encrypted card data. In this case, after the TA receives the encrypted card data sent by the TSM, it stores the encrypted card data. When the TA issues the card data, for example, when it receives a card switching request sent by the application, the TA decrypts the encrypted card data based on the first root key and sends the decrypted card data to the NFC controller. Storing the encrypted card data in this implementation can improve the security of the card data.

[0081] In some specific embodiments, as Figure 7As shown, the authentication and encrypted transmission between the TA and the NFC controller may include: when issuing card data, the TA authenticates with the NFC controller based on the second key, encrypts the card data based on the second key, and sends the encrypted card data to the NFC controller. The NFC controller decrypts the encrypted card data based on the second key to obtain the decrypted card data.

[0082] In some specific embodiments, such as Figure 8 As shown, the authentication between the TA and the TSM based on the first key may include the following steps.

[0083] During the card opening process, the TA generates a first random number, and the first random number is sent to the TSM via the application program. In a specific implementation, the application program may initiate the card opening process based on a user request. When the application program initiates the card opening process, it requests the TA to generate a first random number. The TA generates a first random number in response to the request of the application program and returns the generated first random number to the application program. After receiving the first random number generated by the TA, the application program sends a card opening request to the TSM, and the card opening request carries the first random number generated by the TA.

[0084] The TSM receives the card opening request sent by the application program, generates an authentication token and a message authentication code based on the first key on the TSM side and the card opening request carried in the card opening request. The message authentication code is used to verify the legality of the response message. The TSM sends a response message carrying the authentication token and the message authentication code to the application program. The TA receives the response message sent by the TSM via the application program.

[0085] The TA verifies the message authentication code of the response message based on the first key on the TA side. In the case where the message authentication code is verified successfully, the TA verifies the authentication token based on the first key on the TA side and destroys the first random number. In the case where the authentication token is verified successfully, the TA performs the card opening operation. Further, the TA generates a message authentication code for the return code based on the first key on the TA side and sends a card opening return result carrying the return code and the message authentication code. The card opening return result is sent to the TSM via the application program.

[0086] The TSM verifies the TA based on the first key on the TSM side and the message authentication code. If the message authentication code is verified successfully, the TSM encrypts the card data based on the first key and sends the encrypted card data to the application program.

[0087] In some specific embodiments, such as Figure 9As shown, the authentication and encrypted transmission between the TA and the NFC controller may include the following steps. When issuing card data, the TA requests the NFC controller to generate a second random number. The NFC controller generates a second random number in response to the TA's request and returns the generated second random number to the TA. The TA receives the second random number generated by the NFC controller, generates an authentication token and a negotiated session key based on the second key on the TA side and the second random number, encrypts the card data based on the session key, and sends a card data issuance notification carrying the authentication token and the encrypted card data to the NFC controller. The NFC controller receives the card data issuance notification, verifies the authentication token based on the second key on the NFC side, and decrypts the encrypted card data.

[0088] In some embodiments, the user can initiate data migration through an application. The application sends a data migration request to the TA based on the user's operation. The TA sends the encrypted card data to the application in response to the data migration request of the application. The application receives the encrypted card data sent by the TA and sends the encrypted card data to the TSM.

[0089] During the interaction between the NFC controller and an external NFC card reader, the NFC card reader may modify the card data in some cases. In some embodiments, the TA can read the card data on the NFC side to obtain the updated card data. Specifically, the TA can actively read the card data stored in the NFC controller by means of software NCI commands or hardware interface reading. In some embodiments, the NFC controller can send a card data update notification to the TA after the card data on the NFC side is updated. The TA can update the card data on the TA side based on the card data update notification sent by the NFC controller 403.

[0090] In some embodiments, the NFC controller has storage modules such as RAM and FLASH, or the NFC controller is externally connected with storage modules such as E2PROM, RAM, and FLASH. The external storage has a slower read and storage speed compared to the internal storage. After receiving the card data sent by the TA, the NFC controller can store the card data in the NFC controller. For example, the random access memory temporarily stores it in the RAM. The NFC controller can use the card data stored in itself to swipe the card, realizing offline and shutdown card swiping. If the TA sends the decrypted card data, the NFC controller stores the decrypted card data. If the TA402 sends the encrypted card data, in a specific implementation, the NFC controller can store the encrypted card data and decrypt the encrypted card data based on the second key during card swiping, which can ensure the security of the card data. In some other implementations, the NFC controller decrypts the encrypted card data based on the second key and stores the decrypted card data, and uses the stored decrypted card data to swipe the card during card swiping, which can avoid decrypting during card swiping and reducing the card swiping speed.

[0091] In a typical embodiment, a first key (referred to as Key1) is preset for the TSM and the TA, and the security protection is carried out based on the shared key negotiated between the TA and the NFC controller (NFCC) according to the preset second key (referred to as Key2). The NFC controller implements the access card simulation process as Figure 10 shown. In this specific embodiment, AES-CMAC (Cipher-based Message Authentication Code), a message authentication code algorithm based on the AES encryption algorithm, is used to verify the integrity and authenticity of the data. The specific description is shown in the following table:

[0092]

[0093]

[0094] In this specific embodiment, when the card simulation scheme runs normally, it is imperceptible to the user and no additional commands are sent, disrupting the interaction with the remote device, ensuring the integrity of the NFC system interaction.

[0095] The above are only the preferred embodiments of the present application, and there is no restriction on the present application in any form. Although the present application has been disclosed above with the preferred embodiments, it is not intended to limit the present application. Any person skilled in the art can make some changes or modifications to equivalent embodiments of equivalent changes by using the above-disclosed technical content within the scope of the technical solution of the present application. However, as long as it does not depart from the content of the technical solution of the present application, any brief modifications, equivalent changes and modifications made to the above embodiments based on the technical essence of the present application still fall within the scope of the technical solution of the present application.

Claims

1. A near field communication (NFC) device, characterized in that: The NFC device includes an NFC controller and middleware, wherein: The middleware is used to perform identity authentication and encrypted transmission with the TSM, and to process the transmission logic between the NFC controller and the application, and the application communicates with the trusted service manager TSM.

2. The NFC device according to claim 1, characterized in that: The middleware is also used to perform identity authentication and encrypted transmission with the NFC controller.

3. The NFC device according to claim 1, characterized in that: The middleware and the TSM perform identity authentication and encrypted transmission based on a first root key, where the first root key is used to derive a session key and is preset in a trusted execution environment TEE.

4. The NFC device according to claim 2, characterized in that: The middleware and the NFC controller perform identity authentication and encrypted transmission based on the second root key, wherein: The second root key is used to derive the session key and is preset in the TEE; In the case where the NFC controller includes a permanent storage area, the second root key is also preset in the permanent storage area; In the case that the NFC controller has no permanent storage area, the NFC controller obtains the encrypted second root key from the middleware, decrypts it using a fixed key value in the program code, and temporarily stores the decrypted second root key.

5. The NFC device according to claim 1, wherein: The middleware is used to: During the card opening process, identity authentication is performed between the application and the TSM based on the first root key. After the application receives the encrypted card data sent by the TSM after identity authentication: Decrypting the encrypted card data based on the first root key and storing the decrypted card data; and sending the decrypted card data to the NFC controller when issuing the card data; or The encrypted card data is stored; when the card data is sent, the encrypted card data is decrypted based on the first root key, and the decrypted card data is sent to the NFC controller.

6. The NFC device according to claim 5, characterized in that: The middleware is also used for: when issuing card data, performing identity authentication with the NFC controller based on the second root key, encrypting the card data based on the second root key, and sending the encrypted card data to the NFC controller; The NFC controller is used to decrypt the encrypted card data based on the second root key to obtain decrypted card data.

7. The NFC device according to claim 5, characterized in that: The middleware is used to: generating a first random number during a card activation process, wherein the first random number is sent to the TSM via the application; Receiving, via the application, a response message sent by the TSM, wherein the response message carries an identity authentication token and a message verification code, the identity authentication token is generated based on a first root key on the TSM side and the first random number, and the message verification code is used to verify the legitimacy of the response message; Verifying the message authentication code of the response message based on the first root key on the middleware side; If the message authentication code is verified, verify the identity authentication token based on the first root key on the middleware side, and destroy the first random number; When the identity authentication token is verified successfully, the card activation operation is performed, a message verification code of the return code is generated based on the first root key on the middleware side, and a card activation return result carrying the return code and the message verification code is sent, wherein the card activation return result is sent to the TSM via the application, so that the TSM verifies the middleware based on the first root key on the TSM side and the message verification code.

8. The NFC device according to claim 2, characterized in that: The middleware is used to: When issuing card data, requesting the NFC controller to generate a second random number; Generate an identity authentication token and a negotiated session key based on a second root key on the middleware side and the second random number, encrypt the card data based on the session key, and send a card data delivery notification carrying the identity authentication token and the encrypted card data to the NFC controller; The NFC controller is used to receive the card data sending notification, verify the identity authentication token based on the second root key on the NFC side, and decrypt the encrypted card data.

9. The NFC device according to claim 1, characterized in that: The middleware is further configured to: in response to a data migration request of the application, send the encrypted card data to the application, wherein the application sends the encrypted card data to the TSM.

10. The NFC device according to claim 1 or 9, characterized in that: The middleware is further used to read the card data on the NFC side to obtain updated card data; and / or The NFC controller is further used to send a card data update notification to the middleware after the card data on the NFC side is updated; the middleware is further used to update the card data on the middleware side based on the card data update notification of the NFC controller.

11. The NFC device according to any one of claims 1 to 9, characterized in that: The NFC device is deployed with TEE, and the middleware is a trusted application TA deployed by the TEE.

12. A near field communication (NFC) method, characterized in that: Applied to an NFC device including an NFC controller and middleware, the method comprises: The middleware performs identity authentication and encrypted transmission with the trusted service manager TSM; The middleware handles the transmission logic between the NFC controller and the application, which communicates with the TSM.

13. The NFC method according to claim 12, wherein: Also includes: The middleware performs identity authentication and encrypted transmission with the NFC controller.

14. The NFC method according to claim 12, characterized in that: The middleware and TSM perform identity authentication and encrypted transmission, including: During the card activation process, the middleware and the TSM perform identity authentication based on the first root key; After the application receives the encrypted card data sent by the TSM after identity authentication: The middleware decrypts the encrypted card data based on the first root key and stores the decrypted card data; when issuing the card data, the middleware sends the decrypted card data to the NFC controller; or The middleware stores the encrypted card data; when issuing the card data, the middleware decrypts the encrypted card data based on the first root key and sends the decrypted card data to the NFC controller.

15. The NFC method according to claim 13, wherein: The middleware and the NFC controller perform identity authentication and encrypted transmission, including: When issuing the card data, the middleware performs identity authentication with the NFC controller based on the second root key, encrypts the card data based on the second root key, and sends the encrypted card data to the NFC controller; The NFC controller decrypts the encrypted card data based on the second root key to obtain decrypted card data.

16. The NFC method according to claim 14, wherein: The middleware and the TSM perform identity authentication based on the first root key, including: During the card activation process, the middleware generates a first random number, wherein the first random number is sent to the TSM via the application; The middleware receives a response message sent by the TSM via the application, wherein the response message carries an identity authentication token and a message verification code, the identity authentication token is generated based on the first root key and the first random number on the TSM side, and the message verification code is used to verify the legitimacy of the response message; The middleware verifies the message authentication code of the response message based on a first root key on the middleware side; In the case where the message authentication code is verified, the middleware verifies the identity authentication token based on the first root key on the middleware side, and destroys the first random number; When the identity authentication token is verified successfully, the middleware performs a card activation operation, generates a message verification code for the return code based on the first root key on the middleware side, and sends a card activation return result carrying the return code and the message verification code, wherein the card activation return result is sent to the TSM via the application, so that the TSM verifies the middleware based on the first root key on the TSM side and the message verification code.

17. The NFC method according to claim 15, characterized in that: The middleware and the NFC controller perform identity authentication and encrypted transmission, including: When issuing the card data, the middleware requests the NFC controller to generate a second random number; Generate an identity authentication token and a negotiated session key based on a second root key on the middleware side and the second random number, encrypt the card data based on the session key, and send a card data delivery notification carrying the identity authentication token and the encrypted card data to the NFC controller; The NFC controller receives the card data sending notification, verifies the identity authentication token based on the second root key on the NFC side, and decrypts the encrypted card data.

18. The NFC method according to claim 12, wherein: Also includes: The middleware sends the encrypted card data to the application in response to a data migration request of the application, wherein the application sends the encrypted card data to the TSM.

19. The NFC method according to claim 12 or 18, characterized in that: Also includes: The middleware reads the card data on the NFC side to obtain updated card data; and / or After the card data on the NFC side is updated, the NFC controller sends a card data update notification to the middleware; the middleware updates the card data on the middleware side based on the card data update notification of the NFC controller.

20. The NFC method according to any one of claims 12 to 18, characterized in that: The NFC device is deployed with a trusted execution environment TEE, and the middleware is a trusted application TA deployed by the TEE.

Images