A management method, device and equipment of a smart card

Abstract

This application provides a smart card management method, apparatus, and device, applied in the field of smart card technology. The method includes the following steps during the smart card production stage: the smart card receives authorization code data and personalized data from a production and issuance machine, and writes the authorization code data into an authorization file. The smart card responds to a personalized instruction sent by the production and issuance machine, retrieves key data from the personalized instruction, and saves it. The smart card extracts the authorization code data from the authorization file and generates a first key for the smart card based on a preset key generation strategy, using a first random number, a second random number, and a third random number. The smart card uses the first key to decrypt the authorization code data, obtaining the smart card's authorization sequence. If it is determined that the key data belongs to the authorization sequence, the smart card writes the key data into the smart card. This method can solve the problem of low production efficiency in traditional methods of managing download counts using hardware authorization cards.

Description

Technical Field

[0001] This application relates to the field of smart card management technology, and in particular to a smart card management method, apparatus and device. Background Technology

[0002] Smart card technology, as a highly secure and reliable information storage and processing medium, has been widely used in finance, communications, transportation, identity verification, and other fields. The chip operating system (COS), as the core software system of a smart card, is responsible for managing key functions such as the card's file structure, data access permissions, security mechanisms, and application execution environment. In the smart card production process, card manufacturers typically need to obtain the corresponding COS software and the key data after pre-personalization of the card from the COS developer, and download it to the physical card to complete the personalized configuration and functional deployment.

[0003] In practice, to prevent the misuse or illegal copying of unauthorized cards, COS developers often need to effectively control the number of downloads of COS software and critical data. Currently, a common solution is to use hardware license cards to manage download counts. However, in actual production environments, this hardware license card-based approach significantly slows down the entire production process and impacts production line efficiency because each write operation requires the device to frequently call the license card and interact with commands to send and receive data. Summary of the Invention

[0004] The purpose of this application is to provide a smart card management method, device, and equipment to solve the problem of low production efficiency in the traditional method of managing download counts using hardware authorization cards.

[0005] In a first aspect, embodiments of this application provide a smart card management method, the method comprising: during the smart card production stage, the smart card receives authorization code data and personalized data issued by a production and issuance machine, and writes the authorization code data into an authorization file. The authorization code data includes a first random number and authorization data. The smart card responds to a personalized instruction sent by the production and issuance machine, retrieves key data from the personalized instruction, and saves it. The smart card extracts the authorization code data from the authorization file, and generates a first key for the smart card based on a preset key generation strategy, using a first random number, a second random number, and a third random number. The second and third random numbers are preset in the smart card by the production and issuance machine during the smart card's authorization configuration stage. The smart card uses the first key to decrypt the authorization code data to obtain the smart card's authorization sequence. If it is determined that the key data belongs to the authorization sequence, the smart card writes the key data into the smart card.

[0006] The smart card management method provided in this application receives authorization code data and personalized data from the production and issuance machine. Within the smart card, software decrypts the authorization code data to obtain an authorization sequence. Upon verification that the key data belongs to this authorization sequence, the smart card connects the key data. This process can perform encryption and decryption operations without relying on external devices, improving the production efficiency of smart cards. Simultaneously, the smart card can autonomously complete authorization verification during this process, preventing the abuse or illegal copying of unauthorized cards and improving the quality and reliability of the smart card.

[0007] In one possible implementation, during the smart card authorization configuration phase, the method further includes: a PC acquiring an authorization sequence for authorization. The authorization sequence includes start key data and end key data. The end key data is determined based on the start key data and the number of smart cards to be authorized. The PC generates a first random number based on a preset random number generation algorithm. The PC encrypts the start key data and end key data according to a preset encryption strategy to generate authorization data. The PC combines the authorization data and the first random number according to a preset combination method to obtain authorization code data. The authorization code data is used to indicate the management of the smart card production phase.

[0008] One possible implementation involves a PC encrypting start and end key data based on a preset encryption strategy to generate authorization data. The steps include: the PC generating a second and a third random number using a preset random number generation algorithm; the PC generating a second key using the second random number using a preset authorization code generation program; and encrypting the start and end key data using the second key to obtain encrypted combined data. The PC generating a first key for the smart card using the first, second, and third random numbers based on a preset key generation strategy. Finally, the PC encrypting the encrypted combined data using the first key to obtain the authorization data.

[0009] One possible implementation of the smart card management method provided in this application embodiment further includes: a PC determining at least one verification stage of the smart card and the verification content of each verification stage based on security requirements, thereby obtaining a verification strategy for the smart card. The step of encrypting the start key data and the end key data using a second key to obtain encrypted combined data includes: the PC combining the verification strategy, the start key data, and the end key data into combined data; and the PC encrypting the combined data using the second key to obtain encrypted combined data.

[0010] One possible implementation involves generating a first key for the smart card based on a preset key generation strategy, using a first random number, a second random number, and a third random number. This includes: performing calculations on all bytes of data from the first and second random numbers to obtain the result of the calculations. Using the result as an index, the corresponding index data is extracted from the third random number. The index order corresponds to the generation order of the calculation results. The extracted index data is then concatenated according to the index order to obtain the first key.

[0011] One possible implementation involves performing calculations on all bytes of data from the first random number and all bytes of data from the second random number to obtain the calculation result for all bytes. This includes performing an XOR operation on all bytes of data from the first random number and all bytes of data from the second random number based on the byte's sequence number, and obtaining the XOR result for each byte as the calculation result.

[0012] One possible implementation involves the smart card decrypting authorization code data using a first key to obtain an authorization sequence. This includes: the smart card generating a second key using a second random number based on a preset authorization code generation program; the smart card decrypting the authorization data using the first key to obtain encrypted combined data; and the smart card decrypting the encrypted combined data using the second key to obtain combined data. The combined data includes start key data and end key data for authorization. Based on the start key data and end key data, the smart card determines the authorization sequence.

[0013] One possible implementation includes a verification strategy in the combined data. This strategy comprises at least one verification stage of the smart card and the verification content for each stage. The verification strategy is determined based on the smart card's management requirements during the smart card's authorization configuration stage. The method further includes: for any target verification stage within the at least one verification stage, the smart card matches target key data from the key data according to the verification content corresponding to the target verification stage. The smart card then verifies the target key data using an authorization sequence.

[0014] Secondly, embodiments of this application provide a smart card management device, the device comprising: a writing module, an acquisition module, a generation module, and a processing module.

[0015] The writing module is used during the smart card production stage to receive authorization code data and personalized data from the production and issuance machine, and write the authorization code data into the authorization file. The authorization code includes a first random number and authorization data.

[0016] The acquisition module is used to retrieve and save key data from personalized instructions sent by the production and distribution machine.

[0017] The generation module extracts authorization code data from the authorization file and generates the first key for the smart card based on a preset key generation strategy, using a first random number, a second random number, and a third random number. The second and third random numbers are pre-set in the smart card by the production and issuing machine during the smart card's authorization configuration phase.

[0018] The processing module is used to decrypt the authorized data using the first key to obtain the authorization sequence of the smart card.

[0019] The write module is used to write critical data into the smart card when it is determined that the critical data belongs to the authorized sequence.

[0020] Thirdly, embodiments of this application provide a smart card management device that has the function of implementing the smart card management method of the first aspect or any possible implementation thereof. This function can be implemented by hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above-described function.

[0021] Fourthly, embodiments of this application provide a computer-readable storage medium storing instructions that, when executed on a computer, enable the computer to perform the smart card management method described in the first aspect or any possible implementation thereof.

[0022] Fifthly, embodiments of this application provide a computer program product containing instructions that, when run on a computer, enable the computer to execute the smart card management method described in the first aspect or any possible implementation thereof.

[0023] The technical effects of any of the design methods in aspects two through five can be found in aspect one or in different possible implementations of aspect one, and will not be repeated here. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in the specific embodiments of this application or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0025] Figure 1 A schematic diagram of a smart card management system provided in an embodiment of this application;

[0026] Figure 2A flowchart illustrating a smart card management method provided in this application embodiment;

[0027] Figure 3 Another flowchart illustrating a smart card management method provided in this application embodiment;

[0028] Figure 4 A schematic diagram of a smart card management device provided in an embodiment of this application;

[0029] Figure 5 This is another structural diagram of a smart card management system provided in an embodiment of this application. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0031] Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0032] In related technologies, to prevent the abuse or illegal copying of unauthorized cards, COS developers primarily use hardware authorization cards to manage the number of downloads of COS software and critical data. For example, when a card manufacturing factory writes personalized data to cards, it needs to encrypt the critical data before writing it. First, the encryption / decryption function of the authorization card is called to encrypt the critical data to be written. Then, the production equipment issues a write command to write the encrypted data into the card. The COS software internally decrypts the encrypted data and verifies its legality. If it is legal, the critical data is written; if it is invalid, an error is reported, causing the personalized data writing to fail. In this process, each time the encryption function of the authorization card is called, the authorization card internally counts the number of downloads. When the count reaches the initially set maximum value, the authorization card cannot be used again, and the card factory needs to obtain authorization again. This authorization method can manage the number of downloads by counting, which can prevent the abuse and illegal copying of unauthorized cards. However, in the actual production process, the production equipment needs to constantly access the authorization card and exchange data through command interaction, which significantly slows down the entire production process and affects the production line efficiency.

[0033] Based on this, embodiments of this application provide a smart card management method, apparatus, and device. The method includes, during the smart card production stage, the smart card receiving authorization code data and personalized data from a production and issuance machine, and writing the authorization code data into an authorization file. The authorization code data includes a first random number and authorization data. The smart card responds to a personalized instruction sent by the production and issuance machine, retrieves key data from the personalized instruction, and saves it. The smart card extracts the authorization code data from the authorization file and, based on a preset key generation strategy, generates a first key for the smart card using a first random number, a second random number, and a third random number. The second and third random numbers are preset in the smart card by the production equipment during the smart card's authorization configuration stage. The smart card uses the first key to decrypt the authorization code data to obtain the smart card's authorization sequence. If it is determined that the key data belongs to the authorization sequence, the smart card writes the key data into the smart card.

[0034] The smart card management method provided in this application receives authorization code data and personalized data from the production and issuance machine. Within the smart card, software decrypts the authorization code data to obtain an authorization sequence. Upon verification that the key data belongs to this authorization sequence, the smart card connects the key data. This process can perform encryption and decryption operations without relying on external devices, improving the production efficiency of smart cards. Simultaneously, the smart card can autonomously complete authorization verification during this process, preventing the abuse or illegal copying of unauthorized cards and improving the quality and reliability of the smart card.

[0035] The methods provided in the embodiments of this application will now be described in conjunction with the specific accompanying drawings.

[0036] On the one hand, embodiments of this application provide a smart card management system. For example... Figure 1 As shown, the smart card management system 100 may include a PC 101, a production and issuance machine 102, and a smart card 103.

[0037] PC 101 is used to manage the authorization and configuration phase of smart card 103.

[0038] Specifically, PC 101 is used to generate authorization code data using the method provided in this application embodiment during the smart card authorization configuration phase. The authorization code data is used for smart card management during the production phase.

[0039] Production and issuance machine 102 is used to manage the production stage of smart card 103.

[0040] Specifically, the production and issuance machine 102 is used to send the generated authorization code data and personalized instructions to the smart card 103 during the smart card production stage, so that the smart card 103 can complete the subsequent verification and writing operations based on the key data in the received authorization code data and personalized instructions.

[0041] The smart card 103 is used to receive authorization code data and personalized instructions sent by the production and issuance machine 102 under the management of the production and issuance machine 102, and to verify the personalized instructions using the authorization code data.

[0042] Specifically, during the production phase, the smart card 103 receives authorization code data and personalized data from the production and issuance machine 102, and writes the authorization code data into the authorization file. Simultaneously, upon receiving a personalized instruction from the production and issuance machine 102, the smart card 103 extracts key data from the personalized instruction and extracts the authorization sequence from the authorization code data using the method provided in this embodiment. Then, the smart card 103 completes the writing of the key data after verifying that the key data belongs to the authorization sequence.

[0043] It should be noted that the above Figure 1 The illustrated smart card management system 100 is merely an example of the application scenario of this application solution and is not intended to limit the application scenario of this application solution.

[0044] On the one hand, embodiments of this application provide a smart card management method, which can be implemented by... Figure 1 The smart card management system 100 shown is executed. The smart card management method provided in this application embodiment can be applied to the smart card production stage and the smart card authorization configuration stage. For example, the smart card authorization configuration stage can be executed before the smart card production stage.

[0045] To facilitate the explanation of smart card management methods during the production phase, we will first explain the smart card management methods during the authorization and configuration phase. For example... Figure 2 As shown, during the smart card authorization configuration phase, the method provided in this application embodiment may include S201-S204.

[0046] S201, the authorization sequence used by the PC to obtain authorization.

[0047] The authorization sequence includes starting key data and ending key data. The ending key data is determined based on the starting key data and the number of smart cards to be authorized. The key data in the authorization sequence exists in a monotonically increasing sequence.

[0048] For example, an authorization sequence can include sequence 1 and sequence 2. Taking sequence 1 as an example, sequence 1 can be [A, B]. Here, A is the starting key data of sequence 1, and B is the ending key data of sequence 1. This sequence 1 can represent all key data that monotonically increase from A to B.

[0049] Key data refers to the data used during the smart card's usage phase, and it uniquely identifies the smart card. The smart card usage phase refers to the period after the user places the SIM card in their phone for network authentication and begins normal use.

[0050] For example, the key data could be the International Mobile Subscriber Identity (IMSI) of the smart card or the Integrated Circuit Card Identity (ICCID).

[0051] Specifically, during the smart card production phase, COS developers can provide card production information according to production batches.

[0052] One possible implementation is that the card production information may include the number of smart cards to be authorized in the production batch and initial key data.

[0053] Specifically, after obtaining the number of smart cards to be authorized and the initial key data, the PC generates an authorization sequence for use.

[0054] Another possible implementation is that the card information includes the authorization sequence for authorized use.

[0055] Furthermore, after obtaining the authorized sequence for use, the PC can also determine at least one verification stage of the smart card and the verification content of each verification stage based on security requirements, thereby obtaining the smart card's verification strategy.

[0056] For example, as shown in Table 1 below, Table 1 represents the verification strategy of the smart card. In this verification strategy, different verification rules can be defined using a single byte. Each bit in this byte represents a different verification option. These bits can be combined to determine at least one verification stage of the smart card and the verification content of each verification stage. Specifically, bit 0 is used to determine whether to verify sequence 1, bit 1 is used to determine whether to verify sequence 2, bit 4 is used to determine whether to perform verification during the personalization stage, and bit 5 is used to determine whether to perform verification during the network access authentication stage. Taking verification strategy value 11, (0001 0001) as an example, this indicates that the verification strategy is for the smart card's verification stage to be the personalization stage, and the verification content to be sequence 1.

[0057] Table 1. Smart Card Verification Strategy

[0058]

[0059] It should be noted that Table 1 above is only an example of the verification strategy provided in the embodiments of this application, and is not a limitation on the verification strategy provided in the embodiments of this application. For example, the verification strategy value can also be 23, (0001 0011), indicating that the verification strategy is that the verification stage of the smart card is the personalized verification stage, and the verification content is sequence1 and sequence2.

[0060] This process, by introducing a flexible verification strategy, allows for the definition of verification content and stages based on actual needs. For example, if the verification stage is fixed only at the user network access authentication stage, if the card manufacturer writes unauthorized personalized data during production, the smart card will be unusable in the user's hands, impacting the user experience. Furthermore, since different card production data may have different verification requirements, this verification strategy ensures that the smart card management method is applicable to various card production scenarios and business needs. For instance, in some cases, only the IMSI may need to be verified, while the card serial number does not. In other cases, multiple key data points may need to be verified simultaneously.

[0061] S202, the PC generates the first random number based on a preset random number generation algorithm.

[0062] One possible implementation is that the PC uses a pre-set random number generation algorithm to generate the first random number.

[0063] For example, the PC uses a random number generator to generate a first random number, random1.

[0064] Another possible implementation involves the PC generating a fourth random number based on a preset random number generation algorithm. A preset byte of key data value is extracted from the authorized sequence, and this preset byte of key data value is combined with the fourth random number to obtain the first random number.

[0065] For example, the PC uses a random number generator to generate a 6-byte fourth random number. The PC obtains a 10-byte key data value from the authorized sequence. The PC combines the 10-byte key data value with the 6-byte fourth random number to obtain the first random number random1.

[0066] S203, the PC encrypts the start key data and the end key data based on a preset encryption strategy to generate authorization data.

[0067] First, the PC uses a preset random number generation algorithm to generate a second and a third random number.

[0068] One possible implementation is that the PC uses a preset random number generation algorithm to generate a second and a third random number.

[0069] For example, a PC can use a random number generator to generate a second random number random2 and a third random number random3.

[0070] Secondly, the PC uses a preset authorization code generation program to generate a second key using a second random number, and uses the second key to encrypt the start key data and the end key data to obtain encrypted combined data.

[0071] One possible implementation is that, without determining the verification strategy, the PC directly uses the second key to encrypt the start key data and the end key data to obtain encrypted combined data.

[0072] Another possible implementation involves the PC encrypting the start and end key data using a second key to obtain encrypted combined data. If the PC specifies a verification strategy, it combines the verification strategy, the start key data, and the end key data into combined data. The PC then uses the second key to encrypt the combined data, resulting in encrypted combined data.

[0073] Furthermore, the PC generates the first key of the smart card based on a preset key generation strategy, using a first random number, a second random number, and a third random number.

[0074] Specifically, the PC performs calculations using all bytes of data from the first and second random numbers to obtain the result of the calculations. This result is then used as an index to extract the corresponding index data from the third random number. The extracted index data is then concatenated according to the index order to obtain the first key. The index order corresponds to the order in which the calculation results were generated.

[0075] In this process, the PC uses all the data in the first random number and all the data in the second random number to perform calculations and obtain the calculation results of all bytes. The steps include: performing an XOR operation on all the data in the first random number and all the data in the second random number based on the byte sequence number, and obtaining the XOR result corresponding to each byte as the calculation result.

[0076] For example, the 0th byte of the first random number random1[0] and the 0th byte of the second random number random2[0] are XORed to obtain the operation result random1[0] ^ random2[0] = 0x56. Using 0x56 as the index, the data at 0x56 in the third random number random3 is obtained as the first byte of the first key.

[0077] XOR the first byte random1[1] of the first random number and the first byte random2[1] of the second random number to get the result random1[1] ^ random2[1] = 0x75. Use 0x75 as the index to get the data at 0x75 from the third random number random3 as the second byte of the first key.

[0078] The second byte of the first random number, random1[2], and the second byte of the second random number, random2[2], are XORed to obtain the result random1[2] ^ random2[2] = 0x86. Using 0x86 as the index, the data at 0x86 in the third random number, random3, is obtained as the third byte of the first key. This process continues until all bytes of the first key are obtained. The extracted index data are then concatenated in index order to obtain the first key.

[0079] Finally, the PC uses the first key to encrypt the encrypted combination data to obtain the authorized data.

[0080] S204, the PC combines the authorization data and the first random number according to a preset combination method to obtain the authorization code data.

[0081] The authorization code data is used to indicate the management of the smart card production stage.

[0082] Furthermore, such as Figure 3 As shown, during the smart card production stage, the method provided in this application embodiment may include S205-S209.

[0083] S205, during the smart card production stage, the smart card receives authorization code data and personalized data issued by the production and issuance machine, and writes the authorization code data into the authorization file.

[0084] The authorization file is created by the smart card during the pre-personalization stage. Simultaneously, after the authorization file is created, a second and third random number are written to a designated memory location on the smart card via private instructions.

[0085] Specifically, during the smart card production stage, the smart card receives authorization code data and personalized data from the production and issuance machine. Before updating the key data of the smart card, the authorization code is written into the smart card's authorization file.

[0086] S206, the smart card responds to personalized instructions sent by the production and issuance machine, retrieves key data from the personalized instructions, and saves them.

[0087] Specifically, during the process of updating critical data on the smart card, the production and issuance machine sends a personalized instruction to the smart card. The smart card responds to the personalized instruction sent by the production and issuance machine, retrieves and saves the critical data from the instruction, and triggers the authorization code data verification process.

[0088] For example, the production and issuance machine sends a personalized instruction update to the smart card. In response to the personalized instruction update, the smart card retrieves and retains key data E from the personalized instruction update. This key data E may or may not belong to sequence 1.

[0089] It should be noted that the order in which authorization code data, personalized data, and critical data are written during this process is strictly defined. That is, if critical data is retrieved and saved directly from personalized instructions without first writing the authorization code data to the authorization file, the smart card's COS software will report an error, and the data cannot be written correctly. Only after the smart card has written the authorization code data to the authorization file can the process of retrieving and saving critical data from personalized instructions be executed.

[0090] This process, through strict writing order and verification mechanisms, ensures the security and legitimacy of smart cards during production, preventing smart card malfunctions or security issues caused by data errors or unauthorized writing.

[0091] S207, the smart card extracts the authorization code data from the authorization file, and generates the first key of the smart card based on the preset key generation strategy, using the first random number, the second random number and the third random number.

[0092] The second and third random numbers are preset in the smart card by the PC during the smart card authorization configuration phase.

[0093] It should be noted that the process by which the smart card generates its first key using the first random number, the second random number, and the third random number is the same as the process in S203 where the production and issuing machine generates the first key of the smart card using the first random number, the second random number, and the third random number based on a preset key generation strategy. This application will not elaborate on this process.

[0094] S208, the smart card uses the first key to decrypt the authorization code data to obtain the smart card's authorization sequence.

[0095] Specifically, the smart card generates a second key using a second random number based on a preset authorization code generation program. The smart card decrypts the authorization data using the first key to obtain encrypted combined data. The smart card then decrypts the encrypted combined data using the second key to obtain combined data. The combined data includes start and end key data for authorization. Based on the start and end key data, the smart card determines the authorization sequence.

[0096] The combined data also includes a verification strategy, which includes at least one verification stage of the smart card and the verification content of each verification stage. The verification strategy is determined based on the management requirements of the smart card during the authorization configuration stage of the smart card.

[0097] Specifically, for any target verification stage within at least one verification stage, the smart card matches target key data from the key data based on the verification content corresponding to the target verification stage. The smart card then verifies the target key data using an authorization sequence.

[0098] S209, if it is determined that the key data belongs to the authorized sequence, the smart card writes the key data into the smart card.

[0099] Exemplarily, after the smart card decrypts the authorization code data using the first key to obtain the authorization sequence sequence1[A, B] of the smart card, it compares the key data E with sequence1[A, B]. If the key data E belongs to sequence1[A, B], that is, A ≤ E ≤ B, it is determined that the key data belongs to the authorization sequence, and the smart card writes the key data into the smart card. If the key data E does not belong to sequence1[A, B], that is, E B, it is determined that the key data does not belong to the authorization sequence, and at this time the personalization instruction will report an error.

[0100] Further, if the verification policy specifies that both sequence1 and sequence2 need to be verified. The smart card will also use the decrypted authorization sequence sequence2[C, D] to verify the smart card. For example, at this time, the key data extracted from the personalization instruction is F, and the key data F is compared with sequence2[C, D]. If the key data F belongs to sequence2[C, D], that is, C ≤ E ≤ D, it is determined that the key data belongs to the authorization sequence, and the smart card writes the key data into the smart card. If the key data F does not belong to sequence2[C, D], that is, E < C or E > D, it is determined that the key data does not belong to the authorization sequence, and at this time the personalization instruction will report an error and end the process.

[0101] In this process, when the smart card verifies that the key data belongs to the authorization sequence, the smart card accesses the key data into the smart card and can perform encryption and decryption operations without relying on external devices, which improves the production efficiency of the smart card. At the same time, in this process, the smart card can independently complete the authorization verification, which can avoid the abuse or illegal copying of unauthorized cards and improve the quality and reliability of the smart card.

[0102] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the working principle of the device. It can be understood that in order to implement the above functions, the management device of the smart card includes the corresponding hardware structure and / or software module for executing each function. Those skilled in the art should easily realize that, in combination with the algorithm steps of each example described in the embodiments disclosed in this article, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed in the way of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to implement the described functions for each specific application, but this implementation should not be considered to exceed the scope of the present application.

[0103] This application embodiment can divide the smart card management device into functional modules according to the above method example. For example, each function can be divided into a separate functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module.

[0104] It should be noted that the module division in this embodiment is illustrative and represents only one logical functional division; in actual implementation, other division methods may be used. When dividing functional modules according to their respective functions, Figure 4 A schematic diagram illustrating a possible configuration of the smart card management device described above and in the embodiments is shown. Figure 4 As shown, the smart card management device 400 may include: a writing module 401, an acquisition module 402, a generation module 403, and a processing module 404.

[0105] The writing module 401 is used to support the smart card management device 400 in execution. Figure 3 S205 and S209 are illustrated in the smart card management method.

[0106] Acquisition module 402 is used to support the execution of smart card management device 400. Figure 3 S206 in the illustrated smart card management method.

[0107] Generation module 403 is used to support the execution of smart card management device 400. Figure 3 S207 is an example of a smart card management method.

[0108] Processing module 404 is used to support the execution of smart card management device 400. Figure 3 S208 is an example of a smart card management method.

[0109] In one possible implementation, the smart card management device is also used by the PC to obtain an authorization sequence for authorization. The authorization sequence includes start key data and end key data. The end key data is determined based on the start key data and the number of smart cards to be authorized. The PC generates a first random number based on a preset random number generation algorithm. The PC encrypts the start key data and end key data according to a preset encryption strategy to generate authorization data. The PC combines the authorization data and the first random number according to a preset combination method to obtain authorization code data. The authorization code data is used to indicate the management of the smart card production stage.

[0110] One possible implementation involves a smart card management device where a PC generates a second and a third random number based on a preset random number generation algorithm. The PC then uses the second random number to generate a second key based on a preset authorization code generation program. This second key is used to encrypt start and end key data, resulting in encrypted combined data. Finally, the PC generates a first key for the smart card using the first, second, and third random numbers based on a preset key generation strategy. The PC then uses the first key to encrypt the encrypted combined data, obtaining authorization data.

[0111] In one possible implementation, the smart card management device is further configured to use a PC to determine at least one verification stage of the smart card and the verification content of each verification stage based on security requirements, thereby obtaining the smart card's verification strategy. Specifically, the smart card management device uses the PC to combine the verification strategy, start key data, and end key data into combined data. The PC then encrypts the combined data using a second key to obtain encrypted combined data.

[0112] One possible implementation involves the smart card management device performing calculations using all bytes of data from a first random number and all bytes of data from a second random number to obtain the result of the calculation. The result is then used as an index to extract the corresponding index data from a third random number. The index order corresponds to the generation order of the calculation results. The extracted index data is then concatenated according to the index order to obtain the first key.

[0113] One possible implementation is that the smart card management device is specifically used to perform an XOR operation on all bytes of data from the first random number and all bytes of data from the second random number, based on the byte sequence number, to obtain the XOR result corresponding to each byte as the operation result.

[0114] One possible implementation involves the smart card management device specifically using a preset authorization code generation program to generate a second key using a second random number. The smart card then uses the first key to decrypt the authorization data, obtaining encrypted combined data. The smart card then uses the second key to decrypt the encrypted combined data, obtaining combined data. The combined data includes start key data and end key data for authorization. Based on the start key data and end key data, the smart card determines the authorization sequence.

[0115] In one possible implementation, the combined data also includes a verification strategy. This strategy comprises at least one verification stage of the smart card and verification content for each stage. The smart card management device is further configured to, for any target verification stage within the at least one verification stage, match target key data from the key data based on the verification content corresponding to that target verification stage. The smart card then verifies the target key data using an authorization sequence.

[0116] It should be noted that all relevant content of each step involved in the above method embodiments can be referenced from the functional description of the corresponding functional module, and will not be repeated here.

[0117] The smart card management device 400 provided in this application embodiment is used to perform the above-mentioned... Figure 3 The smart card management method shown can achieve the same effect as the smart card management method described above.

[0118] This application also provides a smart card management device that can execute the smart card management method and related steps described in the above method embodiments.

[0119] This application also provides a computer-readable storage medium storing instructions thereon, which, when executed, perform the smart card management method and related steps in the above method embodiments.

[0120] This application also provides a computer program product that, when run on a computer, causes the computer to execute the smart card management method and related steps described in the above method embodiments.

[0121] In some embodiments, the methods shown in this application can be implemented as computer program instructions encoded in a machine-readable format on a computer-readable storage medium or on other non-transitory media or articles of art.

[0122] This application also provides a smart card management system 100, such as... Figure 5 As shown, the smart card management system 100 includes at least one processor 501 and at least one interface circuit 502.

[0123] As an example, when the smart card management system 100 includes a processor and an interface circuit, the processor can be... Figure 5 The processor 501 shown in the solid box (or the processor 501 shown in the dashed box) can be an interface circuit. Figure 5 The interface circuit 502 is shown in the solid box (or the dashed box). When the smart card management system 100 includes two processors and two interface circuits, the two processors include... Figure 5 The processor 501 shown in the solid box and the processor 501 shown in the dashed box, these two interface circuits include Figure 5 Interface circuit 502 is shown in both solid and dashed boxes. No limitations are imposed on this.

[0124] The processor 501 and the interface circuit 502 can be interconnected via a line. For example, the interface circuit 502 can be used to receive signals. Alternatively, the interface circuit 502 can be used to send signals to other devices (such as the processor 501). For instance, the interface circuit 502 can read computer instructions stored in memory and send those instructions to the processor 501. The processor 501 executes the instructions and, in conjunction with input / output devices, implements the various steps in the above embodiments, such as implementing... Figure 2 or Figure 3 The steps performed in any of the method embodiments shown herein. Of course, the smart card management system may also include other discrete components, and this application embodiment does not specifically limit this.

[0125] Through the above description of the embodiments, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0126] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0127] The units described as separate components may or may not be physically separate. A component shown as a unit can be one or more physical units; that is, it can be located in one place or distributed in multiple different locations. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0128] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0129] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, or the part that contributes to it, or all or part of the technical solution, can be embodied in the form of a software product. This software product is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0130] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method of managing a smart card, characterized by, The method includes: During the smart card production stage, the smart card receives authorization code data and personalized data issued by the production and issuance machine, and writes the authorization code data into an authorization file; the authorization code data includes a first random number and authorization data; The smart card responds to the personalized instructions sent by the production and issuance machine, retrieves key data from the personalized instructions, and saves it. The smart card extracts authorization code data from the authorization file and generates a first key for the smart card based on a preset key generation strategy using a first random number, a second random number, and a third random number; the second random number and the third random number are preset in the smart card by the production and issuing machine during the authorization configuration stage of the smart card; The smart card generates a second key using the second random number based on a preset authorization code generation program. The smart card uses the first key to decrypt the authorized data to obtain encrypted combined data; The smart card uses the second key to decrypt the encrypted combined data to obtain combined data; the combined data includes authorization start key data and authorization end key data; The smart card determines the authorization sequence based on the start key data and the end key data; If it is determined that the key data belongs to the authorized sequence, the smart card writes the key data into the smart card.

2. The method of claim 1, wherein, During the smart card authorization configuration phase, the method further includes: The PC obtains the authorization sequence used for authorization; the authorization sequence includes start key data and end key data; the end key data is determined based on the start key data and the number of smart cards to be authorized; The PC generates the first random number based on a preset random number generation algorithm; The PC encrypts the start key data and the end key data based on a preset encryption strategy to generate authorization data; The PC combines the authorization data and the first random number according to a preset combination method to obtain the authorization code data; the authorization code data is used to indicate the management of the smart card production stage.

3. The method of claim 2, wherein, The step of the PC encrypting the start key data and the end key data based on a preset encryption strategy to generate authorization data includes: The PC generates the second random number and the third random number based on a preset random number generation algorithm; The PC uses a preset authorization code generation program to generate a second key using the second random number, and uses the second key to encrypt the start key data and the end key data to obtain encrypted combined data. The PC generates the first key of the smart card based on a preset key generation strategy, using a first random number, a second random number, and a third random number. The PC uses the first key to encrypt the encrypted combination data to obtain the authorized data.

4. The method of claim 3, wherein, The method further includes: The PC determines at least one verification stage of the smart card and the verification content of each verification stage based on security requirements, thereby obtaining the verification strategy of the smart card. The step of encrypting the start key data and the end key data using the second key to obtain encrypted combined data includes: The PC combines the verification strategy, the starting key data, and the ending key data into combined data. The PC uses the second key to encrypt the combined data to obtain the encrypted combined data.

5. The method according to claim 1 or 3, characterized in that, The method for generating the first key of the smart card based on a preset key generation strategy, using a first random number, a second random number, and a third random number, includes: The calculation is performed using all bytes of data from the first random number and all bytes of data from the second random number to obtain the calculation result for all bytes; The result of the operation is used as an index to extract the corresponding index data from the third random number; the index order corresponds to the generation order of the operation results. The extracted index data is concatenated according to the index order to obtain the first key.

6. The method of claim 5, wherein, The step of performing calculations using all bytes of data from the first random number and all bytes of data from the second random number to obtain the result of the calculation for all bytes includes: For all bytes of data from the first random number and all bytes of data from the second random number, an XOR operation is performed based on the byte sequence number to obtain the XOR result for each byte as the operation result.

7. The method according to claim 1, characterized in that, The combined data also includes a verification strategy, which includes at least one verification stage of the smart card and verification content for each verification stage. The verification strategy is determined based on the management requirements of the smart card during the authorization configuration stage. The method further includes: For any target verification stage in at least one of the verification stages, the smart card matches target key data from the key data according to the verification content corresponding to the target verification stage; The smart card uses the authorization sequence to verify the target key data.

8. A smart card management device, characterized in that, The device includes: The writing module is used during the smart card production stage, whereby the smart card receives authorization code data and personalized data issued by the production and issuance machine, and writes the authorization code data into an authorization file; the authorization code includes a first random number and authorization data. The acquisition module is used to acquire and save key data from the personalized instructions sent by the production and distribution machine in response to the personalized instructions. The generation module is used to extract authorization code data from the authorization file, and generate the first key of the smart card based on a preset key generation strategy using a first random number, a second random number, and a third random number; the second random number and the third random number are preset in the smart card by the production and issuance machine during the authorization configuration stage of the smart card; The processing module is used to generate a second key using the second random number based on a preset authorization code generation program; decrypt the authorization data using the first key to obtain encrypted combined data; decrypt the encrypted combined data using the second key to obtain combined data; the combined data includes starting key data and ending key data for authorization; and determine the authorization sequence based on the starting key data and the ending key data. The writing module is used to write the key data into the smart card when it is determined that the key data belongs to the authorized sequence.

9. A smart card management device, characterized in that, The smart card management device includes a processor and a memory, the memory storing machine-executable instructions that can be executed by the processor, and the processor executing the machine-executable instructions to implement the smart card management method according to any one of claims 1 to 7.

Images