Data management method and system of intelligent card and intelligent card

Abstract

The invention provides a data management method and system of an intelligent card and the intelligent card, and the method comprises the steps: responding to a received writing request, and recognizing the data type of to-be-written data; if the to-be-written data is the first data type, encrypting the to-be-written data based on mask data associated with a storage address of the to-be-written data, and storing the encrypted to-be-written data in an unlimited writing security area; if the to-be-written data is not the first data type, encrypting the to-be-written data through a preset encryption algorithm, storing the encrypted to-be-written data in a limited writing security area, generating authentication information, and returning the authentication information to the initiator; wherein the writing frequency of the limited writing safety area is limited by a preset writing threshold value. In the mode, through establishing a hierarchical access and encryption control mechanism, the full-ciphertext isolation storage of the intelligent card data is realized, and the data can be prevented from being illegally acquired, compared and tampered, so that the security of the intelligent card data is improved.

Description

Technical Field

[0001] This application relates to the field of smart card technology, and in particular to a data management method, system, and smart card for smart cards. Background Technology

[0002] Smart cards, such as SIM cards, financial IC cards, and eSIMs, are widely used in daily life as important carriers of secure data. These smart cards typically use built-in security chips to store sensitive information such as keys and user data.

[0003] However, existing smart card data protection mechanisms have security vulnerabilities. On the one hand, attackers may exploit operating system vulnerabilities or directly read the contents of the storage chip, making it easy to recover data stored in plaintext or simple encryption. On the other hand, by comparing the data differences between multiple cards, attackers can more easily locate and crack personalized information such as keys. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide a data management method, system and smart card for smart cards. By establishing a hierarchical access and encryption control mechanism, the smart card data is stored in full encrypted isolation, which can prevent the data from being illegally obtained and tampered with, thereby improving the security of smart card data.

[0005] Firstly, this application provides a data management method for a smart card, including: In response to a received write request, the data type of the data to be written is identified; the data type includes the first data type.

[0006] If the data to be written is of the first data type, the data to be written is encrypted based on the mask data associated with the storage address of the data to be written, and the encrypted data to be written is stored in the unrestricted write security area.

[0007] If the data to be written is not of the first data type, the data to be written is encrypted using a preset encryption algorithm, and the encrypted data to be written is stored in a limited write security area. Authentication information is generated and returned to the initiator. The number of times the data can be written to the limited write security area is limited by a preset write threshold.

[0008] In an optional implementation, if the data to be written is a first data type, the steps of encrypting the data to be written based on mask data associated with the storage address of the data to be written, and storing the encrypted data to be written in an unrestricted write secure area, include: Obtain the pre-set random mask root data within the smart card.

[0009] The mask data is calculated based on the random mask root data and the storage address of the data to be written.

[0010] The data to be written is XORed with the mask data to obtain the encrypted data to be written, and the encrypted data to be written is determined to be the first ciphertext data.

[0011] Store the first ciphertext data in the unrestricted write-secure area.

[0012] In an optional implementation, the data type further includes a second data type; the limited write security area includes a first limited write security area; and the preset write threshold includes a first preset write threshold.

[0013] If the data to be written is not of the first data type, the steps of encrypting the data to be written using a preset encryption algorithm and storing the encrypted data to be written in a limited write security area include: If the data to be written is a second data type, read the first write count of the first limited write security area and determine whether the first write count has reached the first preset write threshold.

[0014] If the first write count does not reach the first preset write threshold, a first temporary key is derived based on the master key in the smart card.

[0015] The data to be written is encrypted using the first temporary key to obtain the second ciphertext data.

[0016] Generate a first identifier and a first check code corresponding to the second ciphertext data.

[0017] Save the second ciphertext data, the first identifier, and the first checksum to the first restricted write security area.

[0018] In an optional implementation, after determining whether the first number of writes has reached a first preset write threshold, the method further includes: If the first number of writes reaches the first preset write threshold, the write function of the first limited write security area will be disabled.

[0019] In an optional implementation, the data type further includes a third data type; the limited write security area includes a second limited write security area; the preset write threshold includes a first preset write threshold and a second preset write threshold; the first preset write threshold is less than the second preset write threshold.

[0020] If the data to be written is not of the first data type, the steps of encrypting the data to be written using a preset encryption algorithm and storing the encrypted data to be written in a limited write security area include: If the data to be written is a third data type, read the second write count of the second limited write security area and determine whether the second write count has reached the second preset write threshold.

[0021] If the second write count does not reach the second preset write threshold, a second temporary key is derived based on the master key in the smart card.

[0022] The data to be written is encrypted using the second temporary key to obtain the third ciphertext data.

[0023] Generate a second identifier and a second check code corresponding to the third ciphertext data.

[0024] Save the third ciphertext data, the second identifier, and the second checksum to the second restricted write security area.

[0025] In an optional implementation, after determining whether the second write count has reached the second preset write threshold, the method further includes: If the second number of writes reaches the second preset write threshold, the write function of the second limited write security zone will be permanently disabled based on the circuit breaker mechanism.

[0026] In an optional implementation, the method further includes: In response to a received read request, the data type of the data to be read is identified.

[0027] If the data to be read is of the first data type, identify whether the initiator of the read request has basic access permissions. If the initiator has basic access permissions, read the encrypted data to be read from the unrestricted write security area and return the encrypted data to be read to the initiator so that the initiator can perform reverse XOR decryption on the encrypted data to be read to obtain the data to be read.

[0028] If the data to be read is not of the first data type, verify the authentication information in the read request. If the verification result is successful, read the encrypted data to be read from the restricted write security area, decrypt the encrypted data to be read using a preset decryption algorithm, and return the data to be read to the initiator.

[0029] In an optional implementation, the data type also includes a second data type and a third data type; if the data to be read is not a first data type, the authentication information includes a data identifier to be read and a verification code to be read corresponding to the data to be read.

[0030] If the data to be read is not of the first data type, the authentication information in the read request is verified. If the verification result is successful, the encrypted data to be read is read from the restricted write security area, the encrypted data to be read is decrypted using a preset decryption algorithm, and the data to be read is returned to the initiator. The steps include: Retrieve the identifier of the data to be read and the verification code to be read from the read request.

[0031] Determine whether the data identifier and the checksum to be read are in the list of data identifiers and the list of checksums stored in the smart card.

[0032] If the data identifier to be read is in the data identifier list and the checksum to be read is in the checksum list, the checksum result is determined to be passed.

[0033] Based on the identifier of the data to be read, the temporary key and ciphertext data corresponding to the identifier of the data to be read are obtained from the restricted write security area; the ciphertext data to be read is the encrypted data to be read.

[0034] The encrypted data to be read is decrypted based on the temporary key to be read, and the decrypted data to be read is returned to the initiator.

[0035] Secondly, this application provides a smart card data management system, comprising: The data type identification module is used to identify the data type of the data to be written in response to a received write request; the data type includes the first data type.

[0036] The data writing module is used to encrypt the data to be written based on the mask data associated with the storage address of the data to be written if the data to be written is of the first data type, and store the encrypted data to be written in the unrestricted write security area.

[0037] The data writing module is also used to encrypt the data to be written using a preset encryption algorithm if the data to be written is not the first data type, and to store the encrypted data to be written in a limited write security area, generate authentication information, and return the authentication information to the initiator; wherein, the number of times the limited write security area can be written is limited by a preset write threshold.

[0038] Thirdly, this application provides a smart card, including a smart card body and a smart card data management system according to the aforementioned embodiments; the smart card data management system is deployed on the smart card.

[0039] This application provides a data management method, system, and smart card for smart cards. By dividing smart card data into three levels and employing different encryption strategies for each level, as well as configuring different write count limits and access control mechanisms, it is possible to achieve hierarchical isolation protection and fully encrypted storage of sensitive data within the smart card. This effectively prevents attackers from directly parsing sensitive information after obtaining data from the storage area. Static analysis is used to restore ordinary data, ensuring that important data cannot be decrypted in batches. Furthermore, while maintaining compatibility with existing smart card standards, it enhances the reverse engineering resistance of smart card data and improves the data security of the smart card.

[0040] Other features and advantages of this application will be set forth in the following description and will be apparent in part from the description or may be learned by practicing the application. The objectives and other advantages of this application are realized and obtained through the structures particularly pointed out in the description, claims and drawings.

[0041] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0042] To more clearly illustrate the technical solutions in the specific embodiments of this application or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0043] Figure 1 This is a schematic diagram of a smart card provided in an embodiment of this application; Figure 2 This is a schematic diagram of a smart card data management system provided in an embodiment of this application; Figure 3 A flowchart illustrating the data management method for a smart card provided in this application embodiment.

[0044] Icons: 1-Smart card body; 2-Smart card data management system; 3-Data type recognition module; 4-Data writing module. Detailed Implementation

[0045] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0046] To facilitate understanding of this embodiment, the embodiments of this application will be described in detail below.

[0047] This application provides a smart card, referring to... Figure 1 The smart card includes the smart card body 1 and the smart card data management system 2; the smart card data management system 2 is deployed on the smart card.

[0048] Here, the smart card body 1 can be a conventional SIM card, financial IC card, eSIM, or a hardware device with a security chip. The smart card's data management system 2 can be integrated into the smart card's operating system (e.g., COS) as firmware or software module, running on the smart card's security chip processor, and managing the secure storage area (such as EEPROM (Electrically Erasable Programmable Read-Only Memory) or Flash memory) within the smart card.

[0049] The smart card provided in this application embodiment, through its built-in smart card data management system and the data management method it executes, realizes partitioned storage and differentiated encryption and decryption management of data with different security levels. It can be supported without modifying the hardware, only by upgrading the smart card operating system firmware, and has good compatibility and security.

[0050] Based on the above embodiments, this application provides a smart card data management system that runs on the smart card body 1, serving as part of the smart card operating system or a security firmware module, as described above. Figure 2 The smart card data management system provided in this application embodiment includes a data type identification module 3 and a data writing module 4.

[0051] The data type identification module 3 is used to identify the data type of the data to be written in response to the received write request; the data type includes the first data type.

[0052] Here, when the smart card operating system's write interface is invoked, for example, when an application requests to write data, the data type identification module 3 is triggered. The data type identification module 3 classifies the data into a preset data type based on the request parameters or data attributes. The first data type can correspond to data with a lower security level but requiring frequent writing, such as ordinary data.

[0053] The data writing module 4 is used to encrypt the data to be written based on the mask data associated with the storage address of the data to be written if the data to be written is of the first data type, and store the encrypted data to be written in the unrestricted write security area.

[0054] Here, there is no limit to the number of writes to the secure area. The encryption method (based on mask data) can be mask XOR encryption to meet the performance requirements of high-frequency writes.

[0055] The data writing module 4 is also used to encrypt the data to be written using a preset encryption algorithm if the data to be written is not the first data type, and store the encrypted data to be written in a limited write security area, generate authentication information, and return the authentication information to the initiator; wherein, the number of times the limited write security area is written is limited by a preset write threshold.

[0056] Here, data not classified as a primary data type can correspond to high-security data, such as important or privileged data. The default encryption algorithm is a high-strength encryption algorithm, such as AES (Advanced Encryption Standard) or TDES (Triple Data Encryption Standard). The write-to-secure area has a write limit. Authentication information is used for read verification.

[0057] In an optional implementation, the data writing module 4 is further configured to: Obtain the pre-set random mask root data within the smart card.

[0058] The mask data is calculated based on the random mask root data and the storage address of the data to be written.

[0059] The first ciphertext data is obtained by XOR encryption of the data to be written based on the mask data.

[0060] Store the first ciphertext data in the unrestricted write-secure area.

[0061] In an optional implementation, the data type further includes a second data type; the limited write security area includes a first limited write security area; and the preset write threshold includes a first preset write threshold.

[0062] Data writing module 4 is also used for: If the data to be written is a second data type, read the first write count of the first limited write security area and determine whether the first write count has reached the first preset write threshold.

[0063] If the first write count does not reach the first preset write threshold, a first temporary key is derived based on the master key in the smart card.

[0064] The data to be written is encrypted using the first temporary key to obtain the second ciphertext data.

[0065] Generate a first identifier and a first check code corresponding to the second ciphertext data.

[0066] Save the second ciphertext data, the first identifier, and the first checksum to the first restricted write security area.

[0067] In an optional implementation, the data writing module 4 is further configured to: If the first number of writes reaches the first preset write threshold, the write function of the first limited write security area will be disabled.

[0068] In an optional implementation, the data type further includes a third data type; the limited write security area includes a second limited write security area; the preset write threshold includes a first preset write threshold and a second preset write threshold; the first preset write threshold is less than the second preset write threshold.

[0069] Data writing module 4 is also used for: If the data to be written is a third data type, read the second write count of the second limited write security area and determine whether the second write count has reached the second preset write threshold.

[0070] If the second write count does not reach the second preset write threshold, a second temporary key is derived based on the master key in the smart card.

[0071] The data to be written is encrypted using the second temporary key to obtain the third ciphertext data.

[0072] Generate a second identifier and a second check code corresponding to the third ciphertext data.

[0073] Save the third ciphertext data, the second identifier, and the second checksum to the second restricted write security area.

[0074] In an optional implementation, the data writing module 4 is further configured to: If the second number of writes reaches the second preset write threshold, the write function of the second limited write security zone will be permanently disabled based on the circuit breaker mechanism.

[0075] In an optional implementation, the data writing module 4 is further configured to: In response to a received read request, the data type of the data to be read is identified.

[0076] If the data to be read is of the first data type, identify whether the initiator of the read request has basic access permissions. If the initiator has basic access permissions, read the encrypted data to be read from the unrestricted write security area and return the encrypted data to be read to the initiator so that the initiator can perform reverse XOR decryption on the encrypted data to be read to obtain the data to be read.

[0077] If the data to be read is not of the first data type, verify the authentication information in the read request. If the verification result is successful, read the encrypted data to be read from the restricted write security area, decrypt the encrypted data to be read using a preset decryption algorithm, and return the data to be read to the initiator.

[0078] In an optional implementation, the data type also includes a second data type and a third data type; if the data to be read is not a first data type, the authentication information includes a data identifier to be read and a verification code to be read corresponding to the data to be read.

[0079] Data writing module 4 is also used for: Retrieve the identifier of the data to be read and the verification code to be read from the read request.

[0080] Determine whether the data identifier and the checksum to be read are in the list of data identifiers and the list of checksums stored in the smart card.

[0081] If the data identifier to be read is in the data identifier list and the checksum to be read is in the checksum list, the checksum result is determined to be passed.

[0082] Based on the identifier of the data to be read, the temporary key and ciphertext data corresponding to the identifier of the data to be read are obtained from the restricted write security area; the ciphertext data to be read is the encrypted data to be read.

[0083] The encrypted data to be read is decrypted based on the temporary key to be read, and the decrypted data to be read is returned to the initiator.

[0084] This application provides a smart card data management system that, through the collaborative work of modules, achieves data hierarchical, partitioned, differentiated encryption, and access control, thereby preventing data from being illegally obtained, compared, and tampered with, and thus improving the security of smart card data.

[0085] Based on the above embodiments, this application provides a data management method for smart cards, referring to... Figure 3 Smart card data management methods include: Step S101: In response to the received write request, identify the data type of the data to be written; the data type includes a first data type.

[0086] Here, the write request can be initiated by an application running on the smart card, or by an external terminal via an APDU (Application Protocol Data Unit) command. The smart card's data management system starts running upon receiving the write request.

[0087] Data types are divided into primary data types (such as ordinary data) and non-primary data types (such as important data and privileged data).

[0088] In one implementation, when the initiator calls the write interface, it can explicitly specify the data type of the data to be written through a specific API (interface) or parameter.

[0089] In another implementation, the smart card's data management system can automatically infer the data type based on the target file where the data to be written is to be stored or its preset storage address range.

[0090] In other implementations, the data type can be implicitly determined based on the identity of the initiating application or the security domain to which it belongs.

[0091] Primary data types typically correspond to data with relatively low security levels, but which are allowed or require frequent updates, such as logs, temporary data, or high-frequency counters. Non-primary data types represent high-security data.

[0092] Step S102: If the data to be written is a first data type, the data to be written is encrypted based on the mask data associated with the storage address of the data to be written, and the encrypted data to be written is stored in the unrestricted write security area.

[0093] Here, the unlimited write security zone is a logical or physical storage area that is optimized for the write cycles of smart card storage media. For example, through specific algorithms or management mechanisms, it allows for almost unlimited write operations to avoid premature wear of storage cells.

[0094] In one specific implementation, the mask data is dynamically calculated. The system first obtains pre-set random mask root data within the smart card, and then derives the address-specific mask data based on this root data and the storage address (e.g., page address) of the data to be written, using methods such as hash calculation. In other feasible implementations, the mask data can also be statically derived. For example, the system pre-sets a mask data lookup table, where different storage address ranges or file IDs correspond to a fixed but distinct mask data.

[0095] In one specific implementation, the encryption method is XOR encryption. In other feasible implementations, other lightweight, address-related bitwise operations can be used, such as address-based cyclic shifts, byte substitutions, or simple linear transformations, as long as they can achieve data obfuscation and have a computational cost far less than that of standard block ciphers.

[0096] Step S103: If the data to be written is not of the first data type, the data to be written is encrypted using a preset encryption algorithm, and the encrypted data to be written is stored in a limited write security area, authentication information is generated, and the authentication information is returned to the initiator; wherein, the number of writes to the limited write security area is limited by a preset write threshold.

[0097] Here, the write-safe zone is defined as a logical or physical storage area where write operations are strictly monitored and restricted.

[0098] The preset encryption algorithm is a stronger algorithm than the mask encryption algorithm.

[0099] In one specific implementation, the preset encryption algorithm can be a standard symmetric block cipher algorithm such as AES or TDES. In other feasible implementations, this can also be an encryption algorithm recommended by other countries or industries, such as SM4 (SM4 block cipher algorithm).

[0100] The encryption key can be a temporary key derived from the master key in the card, or a static key bound to the data type.

[0101] In one specific implementation, for important data, the preset write threshold can be set multiple times and managed by a write counter. When the counter reaches the threshold, the write function is disabled.

[0102] In another specific implementation, for privileged data, the preset write threshold can also be set to only once, implemented through a circuit breaker mechanism. For example, after the first write, a hardware write enable bit is immediately set to permanently disable to ensure that the data cannot be tampered with.

[0103] In other feasible implementations, the preset write threshold can also be based on time (e.g., allowing only one write per day) or other logical conditions.

[0104] The authentication information is used for identity verification when reading or accessing the data in the future.

[0105] In one specific implementation, the authentication information includes a unique ID for the data and a checksum (such as CRC cyclic redundancy check).

[0106] In other feasible implementations, the authentication information can be a key-based MAC (Message Authentication Code), HMAC (Hash-based Message Authentication Code), or a hash value of the data or a digest of a portion of the ciphertext, as long as it can uniquely identify the data and be used for subsequent integrity or authorization verification.

[0107] By using lightweight mask encryption to store high-frequency write data in the unrestricted write security area, and using high-security data with strong encryption and authentication mechanisms to store it in the restricted write area, security is ensured while also taking into account the performance and lifespan of the smart card storage medium.

[0108] In an optional implementation, step S102 includes the following steps S201-S204.

[0109] Step S201: Obtain the preset random mask root data in the smart card.

[0110] Here, the first data type has a relatively low security level but needs to support high-frequency write operations. To protect the data in the first data type, each smart card, upon issuance, pre-generates a page of random mask data (e.g., 256 bytes of random numbers). This data is the root random mask data and is stored in the smart card's secure storage area. The root random mask data is unique to each smart card.

[0111] Step S202: Calculate the mask data based on the random mask root data and the storage address of the data to be written.

[0112] Here, the smart card's data management system (e.g., the smart card operating system) performs a hash calculation based on the storage address of the data to be written of the first data type and the random mask root data obtained in the previous step. Then, the obtained hash value can be used to continue iterative hash calculations, and the calculated hashes are assembled as the mask data for the current storage address (or current page).

[0113] Based on this, it can be ensured that even if the data to be written is the same on each page, the encrypted data stored on each page will be different. This makes it impossible for an attacker to analyze and locate valid data by comparing the data differences between two different smart cards, even if they read the storage area data.

[0114] Step S203: XOR encryption is performed on the data to be written based on the mask data to obtain the encrypted data to be written, and the encrypted data to be written is determined to be the first ciphertext data.

[0115] Here, the data to be written can be XORed byte by byte with the calculated mask data according to the address offset of the data to be written.

[0116] Based on this, it can be ensured that everything stored in the smart card is encrypted, i.e., the first encrypted data. Even if an attacker directly dumps the physical storage area, they can only obtain meaningless, completely random gibberish, and cannot reconstruct the data to be written through static analysis.

[0117] Step S204: Store the first ciphertext data in the unrestricted write-secure area.

[0118] Here, the unlimited write security zone is logically or physically designed to support an unlimited number of writes to meet the high-frequency update requirements of the first data type without causing premature damage to the storage medium. The first encrypted data is ultimately written to a designated storage address within this zone.

[0119] In an optional implementation, the data type further includes a second data type; the limited write security area includes a first limited write security area; and the preset write threshold includes a first preset write threshold.

[0120] Here, the second type of data (e.g., important data) has a high security level, requires strong encryption protection, and is allowed to be written multiple times within certain limits. The first restricted write security area is the storage area corresponding to the second type of data. The first preset write threshold is the limit on the number of times the second type of data can be written.

[0121] In step S102, if the data to be written is not of the first data type, the step of encrypting the data to be written using a preset encryption algorithm and storing the encrypted data to be written in a limited write security area includes the following steps S301-S306.

[0122] Step S301: If the data to be written is a second data type, read the first write count of the first limited write security area and determine whether the first write count has reached the first preset write threshold.

[0123] Here, when the smart card's data management system (e.g., the smart card operating system) first allocates storage space (i.e., the first restricted write security area) for the second data type, it sets a dedicated write counter for that area. The initial value of this counter can be 0.

[0124] The first write count is read from the current value of the write counter. This value is then compared with a preset first write threshold (e.g., 100 times).

[0125] Step S302: If the first number of writes does not reach the first preset write threshold, derive the first temporary key based on the master key in the smart card.

[0126] To ensure high security, this embodiment does not use a static key directly, but instead employs a dynamic key mechanism. The first temporary key is derived from the unique, non-derivative master key within the smart card.

[0127] One specific derivation method involves the smart card operating system randomly generating a set of random numbers (e.g., 256 bytes) and dividing it into multiple keys (e.g., 16 keys per 16 bytes). The first key is used as the master key, and this master key is used to encrypt and calculate the remaining 15 key data one by one, resulting in 15 encryption keys. Finally, one of these 15 encryption keys is randomly selected as the first temporary key for this operation.

[0128] Step S303: Encrypt the data to be written based on the first temporary key to obtain the second ciphertext data.

[0129] Here, the default encryption algorithm is a high-strength symmetric encryption algorithm. Specifically, the AES or TDES algorithm can be used, with the first temporary key as the key, to encrypt the data to be written of the second type of data, and the generated ciphertext is the second ciphertext data.

[0130] Step S304: Generate a first identifier and a first check code corresponding to the second ciphertext data.

[0131] Here, the first identifier is a unique ID, such as the hash value of the data. The first checksum is a checksum used to verify data integrity, such as a CRC checksum.

[0132] Step S305: Save the second ciphertext data, the first identifier, and the first verification code to the first limited write security area.

[0133] Here, the encrypted second ciphertext data is associated with its corresponding first identifier and first check code, and stored together in the first restricted write security area.

[0134] Optionally, after completing this write operation, the system should also increment the write counter to accurately record the number of writes.

[0135] In an optional implementation, after determining whether the first number of writes has reached the first preset write threshold in step S301, the method further includes: If the first number of writes reaches the first preset write threshold, the write function of the first limited write security area will be disabled.

[0136] Here, when it is determined that the first write count (e.g., the value of the write counter) is equal to or exceeds the first preset write threshold, it indicates that the first limited write safe zone has reached the write limit.

[0137] At this point, the smart card's data management system disables the write function in the first restricted write security area. Specifically, this can be implemented by preventing the caller from writing any data to the first restricted write security area and returning an error code to the caller.

[0138] In an optional implementation, the data type further includes a third data type; the limited write security area includes a second limited write security area; the preset write threshold includes a first preset write threshold and a second preset write threshold; the first preset write threshold is less than the second preset write threshold.

[0139] Here, the third data type (e.g., privileged data) can be root certificates, device unique identifiers, etc. This type of data has the highest security level, and once written, it cannot be tampered with. The second restricted write security area is the storage area corresponding to the third type of data. The second preset write threshold (e.g., a threshold of 1) is used to implement write-only control.

[0140] Step S103 includes the following steps S401-S405.

[0141] Step S401: If the data to be written is a third data type, read the second write count of the second limited write security area and determine whether the second write count has reached the second preset write threshold.

[0142] Here, the second preset write threshold is 1, the second write count of the second limited write security area is read, and it is determined whether the area has been written to.

[0143] Step S402: If the second write count does not reach the second preset write threshold, derive the second temporary key based on the master key in the smart card.

[0144] Similar to the handling of the second data type, a dynamic key mechanism is also used here to ensure the highest level of security. The smart card's data management system (e.g., the smart card operating system) derives a second temporary key specifically for encrypting this privileged data based on the master key within the card. This second temporary key can be derived in the same or different way as the first temporary key.

[0145] Step S403: Encrypt the data to be written based on the second temporary key to obtain the third ciphertext data.

[0146] Here, a high-strength preset encryption algorithm is used, with the second temporary key as the key, to encrypt the data to be written of the third type of data, and the generated ciphertext is the third ciphertext data.

[0147] Step S404: Generate a second identifier and a second check code corresponding to the third ciphertext data.

[0148] Here, the second identifier is a unique ID, and the second check code is a check code (such as a CRC check code) used to verify data integrity.

[0149] Step S405: Save the third ciphertext data, the second identifier, and the second check code to the second limited write security area.

[0150] Here, the encrypted third ciphertext data is associated with its corresponding second identifier and second check code, and stored together in the second restricted write security area.

[0151] At the same time, the smart card's data management system (i.e., the smart card operating system) also returns the second identifier and the second verification code as authentication information to the caller.

[0152] In an optional implementation, after the step of determining whether the second write count has reached the second preset write threshold in step S401, the method further includes: If the second number of writes reaches the second preset write threshold, the write function of the second limited write security zone will be permanently disabled based on the circuit breaker mechanism.

[0153] Here, the circuit breaker mechanism is a hardware or software locking mechanism that ensures that write operations are not repeatable. When the smart card's data management system allocates storage space for the third data type for the first time (i.e., the second restricted write security area), it sets a dedicated write enable bit for the second restricted write security area.

[0154] After privileged data is written to the second restricted write security area for the first time, the smart card's data management system immediately sets the write enable bit to a write-disabled state. This setting is permanent, thus achieving a physical or logical circuit breaker.

[0155] When the system attempts to write to the second restricted write security area again, it will detect that the second write count has reached the second preset write threshold (or detect that the write enable bit has been disabled), thereby preventing the caller from writing data to the second restricted write security area and ensuring that the data in this area cannot be tampered with.

[0156] In an optional implementation, the method further includes the following steps S501-S503.

[0157] Step S501: In response to the received read request, identify the data type of the data to be read.

[0158] Here, when the read interface is invoked, it is considered that a read request has been received. The smart card's data management system first needs to determine the data type of the data to be read, for example, whether it is a primary data type, a secondary data type, or a tertiary data type.

[0159] Step S502: If the data to be read is of the first data type, identify whether the initiator of the read request has basic access rights. If the initiator has basic access rights, read the encrypted data to be read from the unrestricted write security area and return the encrypted data to be read to the initiator so that the initiator can perform reverse XOR decryption on the encrypted data to be read to obtain the data to be read.

[0160] This section focuses on basic permission checks for the first data type. The smart card's data management system needs to determine whether the caller has the necessary permissions to access this ordinary data.

[0161] If the initiator has basic access permissions, after the permission verification is passed, it writes from the unrestricted secure area and retrieves the corresponding encrypted data according to the requested address. This data is the first ciphertext data generated during the writing process.

[0162] The original text of the first encrypted data (i.e. the encrypted data to be read) is returned to the initiator so that the initiator can perform reverse XOR decryption on the encrypted data to be read to obtain the data to be read.

[0163] After receiving the encrypted data, the initiator is responsible for decryption. Based on its own information (for example, it also knows the address offset between the smart card's random mask data and the ordinary data), the initiator performs the reverse operation (i.e., reverse XOR) on the received ciphertext data, thereby restoring the data to be read (plaintext data) outside the smart card.

[0164] Step S503: If the data to be read is not of the first data type, verify the authentication information in the read request. If the verification result is successful, read the encrypted data to be read from the limited write security area, decrypt the encrypted data to be read using a preset decryption algorithm, and return the data to be read to the initiator.

[0165] Here, for the second or third data type, the initiator (caller) must provide the authentication information it obtained when writing the data when initiating the read request, such as a unique ID and CRC checksum.

[0166] The smart card's data management system retrieves the identifier and checksum that were stored along with the data from the restricted write security area, and compares and verifies them with the authentication information provided by the initiator in this request.

[0167] The verification result is only passed if the authentication information provided by the initiator is completely consistent with the information stored in the smart card.

[0168] After successful verification, the corresponding encrypted data is retrieved from the restricted secure area. This data is either the second or third ciphertext data generated during the writing process.

[0169] Using the corresponding decryption key (e.g., the "first temporary key" or "second temporary key" used during encryption) and a preset decryption algorithm, the encrypted data to be read is decrypted inside the smart card security chip and restored to plaintext, i.e., the data to be read.

[0170] After decryption is complete, the smart card's data management system will return the decrypted plaintext data to the initiator.

[0171] If the authentication information provided by the initiator is incorrect during verification (e.g., the ID or verification code is wrong), meaning the verification result is not passed, the smart card's data management system will reject the read request and may return an error message.

[0172] In an optional implementation, the data type also includes a second data type and a third data type; if the data to be read is not a first data type, the authentication information includes a data identifier to be read and a verification code to be read corresponding to the data to be read.

[0173] Step S503 includes the following steps S601-S605.

[0174] Step S601: Obtain the identifier of the data to be read and the verification code to be read from the read request.

[0175] Here, when the initiator (caller) requests to read data of a second or third data type, it must provide the identifier of the data to be read and the verification code to be read in the read request (e.g., as a parameter of the API).

[0176] Step S602: Determine whether the data identifier to be read and the verification code to be read are in the data identifier list and verification code list stored in the smart card.

[0177] Here, after receiving the read request, the smart card's data management system does not immediately read the data, but first performs authentication verification.

[0178] During a previous write operation, information such as a first identifier, a first checksum, a second identifier, and a second checksum were stored in a defined write security area (e.g., a first defined write security area or a second defined write security area).

[0179] The smart card's data management system searches within a restricted write security area based on the identifier of the data to be read in the read request, and compares it with the check code stored in the card corresponding to the identifier to see if it matches the check code provided in the read request.

[0180] Step S603: If the data identifier to be read is in the data identifier list and the check code to be read is in the check code list, the check result is determined to be passed.

[0181] Here, the smart card's data management system must confirm that both the data identifier to be read and the verification code to be read provided by the initiator have passed verification.

[0182] If the identifier provided by the initiator does not exist, or if the identifier exists but the checksum does not match (which may mean that the data has been tampered with or the initiator's permissions are incorrect), the verification result will be unsuccessful, the smart card's data management system will refuse this read access, and may return an error message.

[0183] Step S604: Based on the identifier of the data to be read, obtain the temporary key and ciphertext data corresponding to the identifier of the data to be read from the restricted write security area; the ciphertext data to be read is encrypted data to be read.

[0184] Here, only after the verification result is confirmed to be successful is the smart card's data management system authorized to perform subsequent data acquisition and decryption operations.

[0185] Based on the verified identifier of the data to be read, two key pieces of data are retrieved from the restricted write security area (e.g., the first restricted write security area or the second restricted write security area): the ciphertext data to be read (i.e., the second or third ciphertext data generated during writing), and the temporary key to be read (i.e., the first or second temporary key used to encrypt the data during writing). This key is either stored along with the ciphertext, or it is derived by the system from the identifier or retrieved from the security area.

[0186] Step S605: Decrypt the encrypted data to be read based on the temporary key to be read, obtain the decrypted data to be read, and return the data to be read to the initiator.

[0187] Here, the smart card's data management system uses the acquired temporary key to be read (e.g., the first temporary key or the second temporary key) and a preset decryption algorithm to decrypt the encrypted data to be read (e.g., the second ciphertext data or the third ciphertext data) inside the smart card's security chip.

[0188] After the decryption operation is completed, the data obtained is the original plaintext data, which is the decrypted data to be read (second type of data or third type of data).

[0189] Finally, the smart card's data management system returns the plaintext data to be read to the initiator.

[0190] This application provides a smart card data management method that divides smart card data into three levels, applies different encryption strategies to different levels of data, and configures different write count limits and access control mechanisms. This enables hierarchical isolation protection and fully encrypted storage of data, making it impossible for attackers to parse sensitive information through static analysis or batch decryption even if they obtain the data in the storage area. Thus, while being compatible with existing smart card standards, it enhances the anti-reverse engineering capability and overall security of smart card data.

[0191] The computer program product provided in this application includes a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the methods described in the preceding method embodiments. For specific implementation details, please refer to the method embodiments, which will not be repeated here.

[0192] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the system and apparatus described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0193] Furthermore, in the description of the embodiments of this application, unless otherwise expressly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.

[0194] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0195] In the description of this application, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this application. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0196] Finally, it should be noted that the above-described embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The protection scope of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the scope of the technology disclosed in this application, or make equivalent substitutions for some of the technical features. Such modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be covered within the protection scope of this application.

Claims

1. A data management method for a smart card, characterized in that, include: In response to a received write request, the data type of the data to be written is identified; the data type includes a first data type; If the data to be written is the first data type, the data to be written is encrypted based on the mask data associated with the storage address of the data to be written, and the encrypted data to be written is stored in the unrestricted write security area. If the data to be written is not the first data type, the data to be written is encrypted using a preset encryption algorithm, and the encrypted data to be written is stored in a limited write security area, authentication information is generated, and the authentication information is returned to the initiator; wherein, the number of times the limited write security area can be written is limited by a preset write threshold.

2. The data management method for a smart card according to claim 1, characterized in that, If the data to be written is the first data type, the step of encrypting the data to be written based on mask data associated with the storage address of the data to be written, and storing the encrypted data to be written in an unrestricted write secure area includes: Obtain the preset random mask root data in the smart card; The mask data is calculated based on the random mask root data and the storage address of the data to be written; Based on the mask data, the data to be written is XOR encrypted to obtain the encrypted data to be written, and the encrypted data to be written is determined to be the first ciphertext data. The first ciphertext data is stored in the unrestricted write-secure area.

3. The data management method for a smart card according to claim 1, characterized in that, The data type also includes a second data type; the limited write security area includes a first limited write security area; the preset write threshold includes a first preset write threshold; If the data to be written is not the first data type, the steps of encrypting the data to be written using a preset encryption algorithm and storing the encrypted data to be written in a limited write security area include: If the data to be written is the second data type, read the first write count of the first limited write security area and determine whether the first write count has reached the first preset write threshold; If the first number of writes does not reach the first preset write threshold, a first temporary key is derived based on the master key in the smart card. The data to be written is encrypted using the first temporary key to obtain the second ciphertext data. Generate a first identifier and a first checksum corresponding to the second ciphertext data; The second ciphertext data, the first identifier, and the first verification code are saved to the first restricted write security area.

4. The data management method for a smart card according to claim 3, characterized in that, After determining whether the first number of writes has reached a first preset write threshold, the method further includes: If the first number of writes reaches the first preset write threshold, the write function of the first limited write security zone is set to disabled.

5. The data management method for a smart card according to claim 1, characterized in that, The data type also includes a third data type; the limited write security area includes a second limited write security area; the preset write threshold includes a first preset write threshold and a second preset write threshold; the first preset write threshold is less than the second preset write threshold; If the data to be written is not the first data type, the steps of encrypting the data to be written using a preset encryption algorithm and storing the encrypted data to be written in a limited write security area include: If the data to be written is the third data type, read the second write count of the second limited write security area and determine whether the second write count has reached the second preset write threshold; If the second write count does not reach the second preset write threshold, a second temporary key is derived based on the master key in the smart card. The data to be written is encrypted using the second temporary key to obtain the third ciphertext data. Generate a second identifier and a second check code corresponding to the third ciphertext data; The third ciphertext data, the second identifier, and the second checksum are saved to the second restricted write security area.

6. The data management method for a smart card according to claim 5, characterized in that, After determining whether the second write count has reached the second preset write threshold, the method further includes: If the second number of writes reaches the second preset write threshold, the write function of the second limited write security zone will be permanently disabled based on the circuit breaker mechanism.

7. The data management method for a smart card according to claim 1, characterized in that, The method further includes: In response to a received read request, the data type of the data to be read is identified; If the data to be read is the first data type, identify whether the initiator of the read request has basic access permissions. If the initiator has the basic access permissions, read the encrypted data to be read from the unrestricted write security area and return the encrypted data to be read to the initiator so that the initiator can perform reverse XOR decryption on the encrypted data to be read to obtain the data to be read. If the data to be read is not the first data type, verify the authentication information in the read request. If the verification result is successful, read the encrypted data to be read from the limited write security area, decrypt the encrypted data to be read using a preset decryption algorithm to obtain the data to be read, and return the data to be read to the initiator.

8. The data management method for a smart card according to claim 7, characterized in that, The data type also includes a second data type and a third data type; if the data to be read is not the first data type, the authentication information includes a data identifier and a verification code corresponding to the data to be read. If the data to be read is not the first data type, the authentication information in the read request is verified. If the verification result is successful, the encrypted data to be read is read from the limited write security area. The encrypted data to be read is decrypted using a preset decryption algorithm to obtain the data to be read. The steps of returning the data to be read to the initiator include: Obtain the data identifier to be read and the verification code to be read from the read request; Determine whether the data identifier to be read and the verification code to be read are in the data identifier list and verification code list stored in the smart card; If the data identifier to be read is in the data identifier list and the check code to be read is in the check code list, the check result is determined to be passed; Based on the identifier of the data to be read, the temporary key and the ciphertext data to be read corresponding to the identifier of the data to be read are obtained from the limited write security area; the ciphertext data to be read is the encrypted data to be read. The encrypted data to be read is decrypted based on the temporary key to be read, and the decrypted data to be read is returned to the initiator.

9. A smart card data management system, characterized in that, include: A data type identification module is used to identify the data type of the data to be written in response to a received write request; the data type includes a first data type; The data writing module is used to encrypt the data to be written based on the mask data associated with the storage address of the data to be written if the data to be written is the first data type, and store the encrypted data to be written in the unrestricted write security area. The data writing module is further configured to, if the data to be written is not the first data type, encrypt the data to be written using a preset encryption algorithm, store the encrypted data to be written in a limited write security area, generate authentication information, and return the authentication information to the initiator; wherein, the number of times the limited write security area can be written is limited by a preset write threshold.

10. A smart card, characterized in that, It includes the smart card body and the smart card data management system as described in claim 9; the smart card data management system is deployed on the smart card.

Images