NFC card anti-fraud method and device, electronic equipment and storage medium

Abstract

This application discloses an NFC card anti-theft method, device, electronic device, and storage medium, relating to the field of near-field communication technology. It includes: employing asymmetric cryptographic algorithm private key fragmentation technology, where the terminal security chip and SIM card respectively generate and store private key fragments; during the registration phase, the terminal and SIM card collaboratively generate a public key and complete the authentication device registration; during the card authentication phase, the authentication device generates a one-time random challenge, and the terminal and SIM card collaboratively generate a complete digital signature based on their respective private key fragments, with the authentication device verifying the signature using a pre-stored public key. Private key fragmentation eliminates the risk of centralized leakage of the complete private key, collaborative signing ensures that a single terminal cannot independently complete effective authentication, and random challenges prevent replay attacks. This solves the problems of NFC electronic card private key centralized storage being easily cracked and the possibility of a single terminal independently completing signature authentication after the terminal is lost, leading to theft, improving the security of NFC card use, and preventing the risk of the built-in NFC card being stolen after the terminal is lost.

Description

Technical Field

[0001] This application relates to the field of near-field communication technology, and in particular to an NFC card anti-theft method, device, electronic device, and storage medium. Background Technology

[0002] With the popularization of smart terminals, Near Field Communication (NFC) technology has been widely used in mobile payment, public transportation card swiping, electronic access control and other scenarios, greatly improving the convenience of users' lives.

[0003] However, the built-in NFC card faces serious risk of fraudulent use after the terminal is lost. Existing technologies mainly improve security by waking up the NFC function through password verification and setting restrictions on card swiping scenarios. Some solutions adopt encrypted communication mechanisms between the terminal and the authentication device, but there are still obvious defects.

[0004] In related technologies, the private key of NFC electronic cards is usually stored centrally in the terminal's security chip. If the terminal is lost, attackers may use physical or logical means to crack the security chip and obtain the complete private key, thereby completing unauthorized card swiping operations. Furthermore, these solutions lack an effective remote rapid disabling mechanism. If the user does not take timely measures such as reporting the loss after the terminal is lost, the unauthorized holder can still use the NFC card function for a period of time. Moreover, the single-terminal signature mechanism has a single point of security vulnerability, failing to fundamentally solve the problem of NFC card fraud after terminal loss. Summary of the Invention

[0005] This application provides a method, device, electronic device, and storage medium for preventing NFC card skimming. It can solve the problems in related technologies where centralized storage of NFC electronic card private keys makes them vulnerable to hacking, and where a single terminal can independently complete signature authentication after the terminal is lost, leading to skimming issues.

[0006] According to a first aspect of this application, an NFC card anti-fraud method is provided, comprising: Registration phase and card swipe authentication phase; The registration process includes: The terminal generates a card identifier (ID), as well as a first private key fragment and a first public key fragment of an asymmetric cryptographic algorithm, and binds and stores the card identifier ID, the first private key fragment, and the first public key fragment in the terminal security chip. The terminal calls the Subscriber Identity Module (SIM) card collaborative key generation interface, passing in the card identifier ID; The SIM card generates a second private key fragment and a second public key fragment corresponding to the card identifier ID. After secure storage, the second public key fragment is returned to the terminal. The terminal calculates the complete public key based on the first private key fragment and the second public key fragment, and binds and stores the complete public key with the card identifier ID; The terminal sends the card identifier ID and the complete public key to the authentication device via near-field communication to complete the registration; The card swipe authentication process includes: The terminal sends an authentication request to the authentication device, and the authentication request carries the card identifier ID; The authentication device generates a random number as a challenge, sends the challenge to the terminal, and caches it locally; The terminal calculates a digest of the challenge and the card identifier ID, and calls the SIM card collaborative signature interface, passing in the digest; The SIM card calculates a partial digital signature based on the fragments and digest of the second private key, and returns the partial digital signature to the terminal. The terminal calculates the complete digital signature based on the first private key fragment and partial digital signature, and sends the card identifier ID and the complete digital signature to the authentication device. The authentication device uses the complete public key corresponding to the card identifier ID to verify the challenge, the card identifier ID, and the complete digital signature. If the verification passes, the authentication is successful.

[0007] According to a second aspect of this application, an NFC card anti-fraud device is provided, comprising: The registration unit includes: The first generation module is configured to generate a card identifier ID for the terminal, as well as a first private key fragment and a first public key fragment of an asymmetric cryptographic algorithm, and bind and store the card identifier ID, the first private key fragment, and the first public key fragment in the terminal security chip. The first calling module is configured for the terminal to call the SIM card collaborative key generation interface and pass in the card identifier ID; The second generation module is configured to generate the second private key fragment and the second public key fragment corresponding to the SIM card identifier ID, and after secure storage, return the second public key fragment to the terminal. The first computing module is configured to allow the terminal to calculate the complete public key based on the first private key fragment and the second public key fragment, and to bind and store the complete public key with the card identifier ID. The sending module is configured so that the terminal sends the card identifier ID and the complete public key to the authentication device via near-field communication to complete the registration; The card authentication unit includes: The initiation module is configured to allow the terminal to initiate an authentication request to the authentication device, with the authentication request carrying the card identifier ID. The third generation module is configured to generate random numbers as challenges for the authentication device, send the challenges to the terminal, and cache them locally. The second calling module is configured to have the terminal calculate a digest of the challenge and card identifier ID, and then call the SIM card collaborative signature interface, passing in the digest; The second calculation module is configured to have the SIM card calculate a partial digital signature based on the second private key fragment and digest, and return the partial digital signature to the terminal. The third calculation module is configured to enable the terminal to calculate the complete digital signature based on the fragments of the first private key and the partial digital signature, and send the card identifier ID and the complete digital signature to the authentication device. The signature verification module is configured to use the complete public key corresponding to the card identifier ID to verify the challenge, card identifier ID, and complete digital signature of the authentication device. If the signature verification is successful, the authentication is successful.

[0008] According to a third aspect of this application, an electronic device is provided, comprising: At least one processor; and memory that is communicatively connected to at least one processor; The memory stores instructions that can be executed by at least one processor, which are executed by at least one processor to enable the at least one processor to perform the aforementioned NFC card anti-theft method of the first aspect.

[0009] According to a fourth aspect of this application, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to cause a computer to execute the NFC card anti-theft method of the first aspect described above.

[0010] According to a fifth aspect of this application, a computer program product is provided, including a computer program that, when executed by a processor, implements the NFC card anti-theft method as described in the first aspect above.

[0011] This application addresses the problem of fraudulent transactions caused by centralized storage of NFC card private keys in the terminal security chip and SIM card, collaborative generation of a complete digital signature by the terminal and SIM card, and verification by a random challenge generated by the authentication device. This solves the issue of NFC card security being compromised due to centralized storage of private keys, and the possibility of a single terminal independently completing signature authentication after the terminal is lost. The application significantly improves the security of NFC cards and fundamentally prevents the risk of fraudulent transactions involving built-in NFC cards after a terminal is lost.

[0012] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this application, nor is it intended to limit the scope of this application. Other features of this application will become readily apparent from the following description. Attached Figure Description

[0013] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0014] Figure 1 This is a flowchart illustrating an NFC card anti-theft method provided in an embodiment of this application. Figure 2 This is a schematic diagram of the structure of an NFC card anti-theft device provided in an embodiment of this application. Detailed Implementation

[0015] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of this application, including various details to aid understanding. These should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this application. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0016] The following description, with reference to the accompanying drawings, describes an NFC card anti-theft method, apparatus, electronic device, and storage medium according to embodiments of this application.

[0017] Figure 1 This is a flowchart illustrating an NFC card anti-theft method provided in an embodiment of this application.

[0018] like Figure 1 As shown, the method includes a registration phase S1 and a card swipe authentication phase S2: Registration phase S1 includes: S11, the terminal generates a card identifier ID, as well as a first private key fragment and a first public key fragment of an asymmetric cryptographic algorithm, and binds and stores the card identifier ID, the first private key fragment, and the first public key fragment in the terminal security chip.

[0019] In this embodiment, when the terminal creates a new NFC electronic card, it first generates a secure random number as the card identifier ID. This identifier is a globally unique identifier used to distinguish different NFC electronic card instances.

[0020] The terminal generates the first private key fragment and the first public key fragment based on the selected asymmetric cryptography algorithm. The asymmetric cryptography algorithm can be the SM2 elliptic curve cryptography algorithm. The terminal generates a secure random number that meets the private key length requirements of the SM2 algorithm as the first private key fragment, and then calculates the corresponding first public key fragment by using elliptic curve dot product operation according to the elliptic curve parameters specified by the SM2 algorithm.

[0021] The terminal binds and stores the generated card identifier ID, first private key fragment, and first public key fragment in the terminal's built-in security chip. The security chip is an independent hardware security module with an isolated secure execution environment, capable of resisting physical and logical attacks and preventing the stored data from being illegally read, copied, or tampered with. During binding and storage, the terminal establishes a one-to-one correspondence among the three within the security chip's dedicated security domain, ensuring that subsequent calls can accurately retrieve the corresponding first private key fragment and first public key fragment based on the card identifier ID.

[0022] The beneficial effect of this step is that it utilizes the hardware-level security protection capabilities of the terminal security chip to ensure the storage security of the first private key fragment, and achieves the independent identity identification of each NFC electronic card by binding the card identifier ID with the private key fragment, thus providing secure basic data support for the subsequent collaborative key interface generation and collaborative signature process.

[0023] S12, the terminal calls the SIM card collaborative key generation interface and passes in the card identifier ID.

[0024] In this embodiment, after the terminal completes the generation and storage of the card identifier ID and the first private key fragment, it calls the SIM card's collaborative key generation interface to pass the generated card identifier ID to the SIM card.

[0025] This interface call is implemented by sending a proprietary Application Protocol Data Unit (APDU) instruction conforming to the ISO / IEC 7816-4 standard to the SIM card. The instruction code INS is set to 0x2A, which is defined in the application context and does not conflict with registered standard instructions. The P1 parameter of the instruction is set to 0x00, and the P2 parameter is set to 0x01. The data field of the instruction adopts TLV encoding format, encapsulating the card identifier ID as the core transmission data. The TLV encoding format follows the ISO / IEC 7816-4 data object format requirements, organizing data through a tag, length, and value structure to ensure that the SIM card can accurately parse the received card identifier ID information.

[0026] The terminal sends the constructed APDU instruction to the SIM card and waits for the SIM card to return a response. During instruction transmission, the APDU interaction between the terminal and the SIM card can be protected by a secure channel, which encrypts and verifies the integrity of the instruction's data field to prevent data from being eavesdropped on or tampered with during transmission.

[0027] The beneficial effects of this step are that reliable communication between the terminal and the SIM card is achieved through a standardized APDU instruction format. The clear parameter definition ensures that the SIM card can accurately obtain and identify the corresponding card identifier ID, providing the necessary identification information for the subsequent generation of a second private key fragment bound to the card ID. At the same time, the combination of private instructions and secure channels effectively improves the security of interface calls and prevents unauthorized devices from calling the interface to obtain sensitive information.

[0028] S13, the SIM card generates the second private key fragment and the second public key fragment corresponding to the card identifier ID, securely stores them, and then returns the second public key fragment to the terminal.

[0029] In this embodiment, after the SIM card receives the collaborative key generation interface instruction sent by the terminal, it first parses the data field of the instruction and extracts the card identifier ID.

[0030] The SIM card generates a secure random number that meets the private key length requirements of the asymmetric cryptographic algorithm, which serves as the second private key fragment corresponding to the card identifier ID. Subsequently, based on preset elliptic curve parameters, the SIM card calculates the second public key fragment corresponding to the second private key fragment through elliptic curve dot product operations.

[0031] The SIM card securely stores the card identifier ID, the second private key fragment, and the second public key fragment in an internal secure domain or dedicated file. During storage, it is strictly guaranteed that the second private key fragment never leaves the SIM card's secure execution environment, and no external device can directly read this private key fragment data.

[0032] After the SIM card completes data storage, it returns a response message to the terminal. The data field of the response message contains the second public key fragment, and the response status code is set to 9000 to indicate successful operation. If the SIM card detects that the card identifier ID already exists or the command parameters are incorrect, it returns the corresponding error code, such as 6A80 if the card ID already exists.

[0033] The beneficial effect of this step is that it utilizes the independent hardware secure execution environment of the SIM card to generate and store the second private key fragment, which physically isolates the possibility of the private key fragment being illegally stolen. At the same time, by binding the card identifier ID with the second private key fragment, it ensures that each NFC electronic card has an independent key system, providing secure and reliable second-party private key support for the subsequent collaborative signature process.

[0034] S14, the terminal calculates the complete public key based on the first private key fragment and the second public key fragment, and binds and stores the complete public key with the card identifier ID.

[0035] In this embodiment, after receiving the second public key fragment returned by the SIM card, the terminal performs calculations based on the key calculation rules of the selected asymmetric cryptography algorithm, using the first private key fragment stored in the local security chip and the received second public key fragment to generate the complete public key corresponding to the NFC electronic card. When using the SM2 elliptic curve cryptography algorithm, the terminal completes the calculation according to the elliptic curve parameters and collaborative key generation rules specified by the SM2 algorithm, ensuring that the generated complete public key corresponds one-to-one with the complete private key composed of the first and second private key fragments.

[0036] After calculating the complete public key, the terminal binds the complete public key with the corresponding card identifier ID and stores it in a dedicated security domain within the terminal's built-in security chip. The terminal establishes a one-to-one mapping between the card identifier ID and the complete public key within the security chip, ensuring that subsequent card authentication operations can quickly and accurately retrieve the corresponding complete public key information based on the card identifier ID. The isolated execution environment of the security chip effectively prevents the complete public key from being illegally tampered with or replaced, ensuring the integrity and reliability of the public key information.

[0037] The beneficial effect of this step is that by calculating the complete public key locally on the terminal, the risk of the second private key fragment being separated from the SIM card's security environment is avoided. At the same time, the complete public key is bound to the card identifier ID and stored in the security chip, providing an accurate and reliable public key basis for the subsequent signature verification operation of the authentication device, thus ensuring the security and consistency of the entire authentication process.

[0038] S15, the terminal sends the card identifier ID and the complete public key to the authentication device via near-field communication to complete the registration.

[0039] In this embodiment, after the terminal completes the calculation and binding storage of the full public key, it activates the near-field communication module and sends the card identifier ID and the corresponding full public key to the authentication device. This process is applicable to various authentication devices that support near-field communication, such as electronic access control systems, mobile payment terminals, and bus / subway turnstiles.

[0040] The terminal encapsulates the card identifier ID and the complete public key into a data frame conforming to the near-field communication standard and sends it to the authentication device via short-range wireless transmission. Upon receiving the data frame, the authentication device parses and extracts the card identifier ID and the complete public key, establishes a one-to-one mapping between the two, and stores this mapping in a local secure storage area. The authentication device's secure storage area has data tamper-proof capabilities, ensuring the integrity of the public key information and preventing unauthorized modification or replacement of the public key data.

[0041] After the authentication device completes data storage, it returns a registration success response message to the terminal. Upon receiving the response message, the terminal confirms that the NFC electronic card registration process is complete, and the card can be used for subsequent card swiping authentication operations.

[0042] The beneficial effect of this step is that it enables point-to-point transmission of registration information over a short distance through near-field communication, avoiding the risks of data eavesdropping and tampering that may arise from remote network transmission. At the same time, the authentication device securely stores the public key mapping relationship locally, ensuring the accuracy and reliability of the public key in subsequent signature verification operations, thus providing a basic guarantee for the secure use of NFC cards.

[0043] The card swipe authentication phase S2 includes: S21, the terminal sends an authentication request to the authentication device, and the authentication request carries the card identifier ID.

[0044] In this embodiment, when a user needs to authenticate their identity using an NFC electronic card, the terminal activates the near-field communication module and initiates an authentication request to the authentication device. The terminal retrieves the card identifier ID of the corresponding NFC electronic card from the dedicated security domain of the built-in security chip and encapsulates it in the authentication request data frame.

[0045] The authentication request data frame conforms to the near-field communication standard protocol specification, ensuring that authentication devices from different manufacturers can be parsed uniformly. Near-field communication is a short-range wireless communication technology, with a communication distance typically not exceeding 10 centimeters. Data transmission can only be completed when devices are in close contact, naturally possessing a certain degree of physical security protection, effectively preventing authentication requests from being remotely eavesdropped on.

[0046] The authentication request is sent to the authentication device via point-to-point transmission using near-field communication (NFC). Upon receiving the request, the authentication device extracts the card identifier ID for subsequent identification of the corresponding NFC electronic card. This step is applicable to various NFC application scenarios such as electronic access control, mobile payment terminals, and public transportation turnstiles.

[0047] The beneficial effect of this step is that by carrying a unique card identifier ID in the authentication request, the authentication device can accurately identify different NFC electronic cards. The short-range transmission characteristics of near-field communication reduce the risk of authentication requests being illegally intercepted and forged from a physical perspective, providing a reliable identity identification basis for subsequent secure authentication processes.

[0048] S22, the authentication device generates a random number as a challenge, sends the challenge to the terminal, and caches it locally.

[0049] In this embodiment, after receiving the authentication request from the terminal and extracting the card identifier ID, the authentication device generates a cryptographically secure random number as the challenge for this authentication process. This random number has sufficient length and unpredictability to effectively resist brute-force and predictive attacks, and its length matches the requirements of the asymmetric cryptographic algorithm used.

[0050] The authentication device encapsulates the generated random number challenge into a data frame conforming to the near-field communication standard and sends it to the terminal via point-to-point transmission. Simultaneously, the authentication device caches the random number challenge in its local secure storage area and establishes a one-to-one mapping between the challenge and the corresponding card identifier ID. The cached data has a preset validity period and is automatically deleted after the validity period expires, avoiding security risks associated with long-term storage.

[0051] The beneficial effect of this step is that by generating a one-time random challenge and binding it to the card identifier ID in the cache, the identity authentication process is associated with a temporary unique challenge, ensuring that the interaction data for each authentication is different. This fundamentally prevents attackers from intercepting historical communication data and carrying out replay attacks, significantly improving the security of the card swipe authentication process.

[0052] S23, the terminal calculates a digest of the challenge and card identifier ID, and calls the SIM card collaborative signature interface, passing in the digest.

[0053] In this embodiment, after receiving the random number challenge returned by the authentication device, the terminal retrieves the card identifier ID corresponding to this authentication from the local security chip, and concatenates the challenge and the card identifier ID to form plaintext data to be calculated. The terminal then uses the SM3 cryptographic hash algorithm to calculate a digest of this plaintext data.

[0054] When calculating the digest, the terminal creates a new File object to temporarily store the SM3 hash value, and saves the read plaintext data into this File object as a file. The terminal calculates the hash value of this File object and obtains the hash value string, which is then converted into a byte array. Starting from the first value of the byte array, it shifts four bits to the right sequentially, and then retrieves four consecutive bytes from the positions of the first four bytes to form a four-byte array. The sum of all elements in the four-byte array is obtained as H0. If H0 is greater than 255, the result of dividing H0 by 256 and taking the remainder replaces H0. The final H0 is the digest e calculated in this operation.

[0055] After the terminal completes the digest calculation, it calls the SIM card's collaborative signature interface, sending the calculated digest e to the SIM card. This interface call is implemented by sending a private APDU instruction conforming to the ISO / IEC 7816-4 standard to the SIM card. The instruction code INS is set to 0x2B, the P1 parameter is set to 0x00, and the P2 parameter is set to 0x02. The instruction's data field uses TLV encoding format, encapsulating the digest e as the core input parameter. The TLV encoding follows the ISO / IEC 7816-4 data object format requirements. The APDU interaction between the terminal and the SIM card is protected by a secure channel, encrypting and verifying the integrity of the instruction's data field to prevent the digest data from being eavesdropped on or tampered with during transmission.

[0056] The beneficial effect of this step is that by calculating the digest of the challenge and card identifier ID using the SM3 algorithm, the integrity and uniqueness of the data to be signed are ensured, preventing unauthorized tampering during transmission and processing. The standardized APDU command format and secure channel protection guarantee the security and reliability of interface calls between the terminal and the SIM card, providing accurate and secure input data for the subsequent collaborative signature process.

[0057] S24, the SIM card calculates a partial digital signature based on the second private key fragment and digest, and returns the partial digital signature to the terminal.

[0058] In this embodiment, after receiving the collaborative signature interface instruction sent by the terminal, the SIM card parses the data field of the instruction and extracts the digest e. The SIM card then reads the second private key fragment associated with the current card identifier ID from the internally secure storage security domain or dedicated file. The second private key fragment is always stored in the SIM card's secure execution environment throughout its entire lifecycle, and no external device can directly read or export this data.

[0059] The SIM card follows the cryptographic industry standard "Technical Specification for Collaborative Signature Based on SM2 Cryptographic Algorithm," using a second private key fragment and digest e to perform partial digital signature calculations, resulting in a partial digital signature s1. The entire calculation process is completed within the isolated and secure execution environment of the SIM card, and intermediate data during the calculation process will not be leaked outside the card.

[0060] After completing the partial digital signature calculation, the SIM card returns a response message to the terminal. The data field of the response message contains the generated partial digital signature s1, and the response status code is set to 9000 to indicate successful operation. If the SIM card detects that the corresponding second private key fragment is missing or the instruction parameters are incorrect, it returns error code 6A88. The entire collaborative signature process relies on the Java Card platform and the security domain and object sharing mechanism defined in GlobalPlatform Card Specification version 2.2 to ensure the security of the calculation process.

[0061] The beneficial effect of this step is that the SIM card independently completes part of the digital signature calculation, and the second private key fragment never leaves the SIM card's secure execution environment, fundamentally eliminating the possibility of the private key fragment being illegally stolen. Even if the terminal is compromised, attackers cannot obtain the second private key fragment and cannot independently generate a valid partial signature, further enhancing the security of the entire signature authentication process.

[0062] S25, the terminal calculates the complete digital signature based on the first private key fragment and partial digital signature, and sends the card identifier ID and the complete digital signature to the authentication device.

[0063] In this embodiment, after receiving the partial digital signature s1 returned by the SIM card, the terminal retrieves the first private key fragment d1 corresponding to this authentication from the dedicated security domain of the built-in security chip. The calculation process of the complete digital signature is completed within the isolated execution environment of the terminal security chip. All intermediate data generated during the calculation process will not be leaked outside the security chip, effectively preventing sensitive data from being illegally stolen.

[0064] The terminal follows the cryptographic industry standard "Technical Specification for Collaborative Signature Based on SM2 Cryptographic Algorithm," using the first private key fragment d1 and a partial digital signature s1 to perform calculations and generate the complete digital signature s corresponding to this authentication process. This complete digital signature has the same legal effect as the signature generated by the complete private key composed of the first and second private key fragments, and can be effectively verified by the authentication device using the complete public key.

[0065] After the terminal completes the calculation of the full digital signature, it encapsulates the card identifier (ID) and the full digital signature (s) into a data frame conforming to the near-field communication (NFC) standard, and sends it to the authentication device via near-field point-to-point wireless transmission. NFC communication typically operates at a distance of no more than 10 centimeters, and data transmission can only be completed when devices are in close proximity. This inherently provides physical security, effectively preventing remote eavesdropping or interception of signature data during transmission.

[0066] The beneficial effect of this step is that by synthesizing the complete digital signature within the terminal security chip, the existence and exposure of the complete private key are avoided at any stage. Even if the terminal security chip is compromised, the attacker can only obtain the first fragment of the private key and cannot independently generate a valid complete digital signature. At the same time, the short-range transmission characteristics of near-field communication further ensure the security of signature data transmission, providing reliable input data for subsequent signature verification operations by the authentication device.

[0067] S26. The authentication device uses the complete public key corresponding to the card identifier ID to verify the challenge, the card identifier ID, and the complete digital signature. If the verification passes, the authentication is successful.

[0068] In this embodiment, after receiving the card identifier ID and complete digital signature sent by the terminal, the authentication device first retrieves the complete public key bound to the card identifier ID from its local secure storage area. This complete public key is sent and stored by the terminal during the registration phase, and the storage area has data tamper-proof capabilities, ensuring the integrity and accuracy of the public key information.

[0069] The authentication device extracts the random number challenge corresponding to this authentication from its local cache, concatenates the challenge with the card identifier ID to form the data to be verified, and calculates the digest of the data to be verified using the same SM3 cryptographic hash algorithm as the terminal. Subsequently, the authentication device uses the retrieved complete public key and follows the signature verification rules of the SM2 elliptic curve cryptography algorithm to verify the calculated digest and the received complete digital signature, confirming that the digital signature was generated by the complete private key corresponding to the complete public key.

[0070] If the signature verification passes, the authentication device determines that the identity authentication is valid and executes the corresponding successful authentication operation, including unlocking electronic access control doors, allowing passage through bus and subway turnstiles, and authorizing mobile payments. Simultaneously, the authentication device immediately destroys the locally cached random number challenge; regardless of whether the signature verification succeeds or fails, the cached challenge cannot be reused after the authentication process ends. If the signature verification fails, the authentication device determines that the identity authentication is invalid, refuses to execute any authorization operation, and returns an authentication failure response message to the terminal.

[0071] The beneficial effect of this step is that it ensures the legitimacy of the digital signature and the integrity of the data to be authenticated through a standard asymmetric cryptographic signature verification process, effectively preventing signature forgery or data tampering. The random number challenge is immediately destroyed after authentication, completely eliminating the possibility of replay attacks, ensuring the uniqueness and security of each card swipe authentication, and guaranteeing that only users with legitimate terminal and corresponding SIM card rights can pass authentication.

[0072] Compared with related technologies, in this embodiment, a card identifier ID is generated by the terminal, along with a first private key fragment and a first public key fragment of an asymmetric cryptographic algorithm. The card identifier ID, the first private key fragment, and the first public key fragment are then bound and stored in the terminal's security chip. The terminal calls the SIM card collaborative key generation interface, passing in the card identifier ID. The SIM card generates a second private key fragment and a second public key fragment corresponding to the card identifier ID, securely stores them, and then returns the second public key fragment to the terminal. The terminal calculates the complete public key based on the first private key fragment and the second public key fragment, and binds and stores the complete public key with the card identifier ID. The terminal sends the card identifier ID and the complete public key to the authentication device via near-field communication to complete the registration. The terminal initiates an authentication request to the authentication device, carrying the card identifier ID. The authentication device generates a random number as a challenge, sends the challenge to the terminal, and caches it locally. The terminal calculates a digest based on the challenge and the card identifier ID, and calls the SIM card collaborative signature interface, passing in the digest. The SIM card fragments based on the second private key and calculates a partial digital signature, returning the partial digital signature to the terminal. The terminal calculates the complete digital signature based on the first private key fragment and the partial digital signature, and sends the card identifier ID and the complete digital signature to the authentication device. The authentication device uses the complete public key corresponding to the card identifier ID to verify the challenge, the card identifier ID, and the complete digital signature. If the verification passes, authentication is successful. This method can solve the problem of fraudulent transactions caused by the centralized storage of NFC electronic card private keys, which makes them vulnerable to cracking, and the ability of a single terminal to independently complete signature authentication after the terminal is lost. It significantly improves the security of NFC card use and fundamentally prevents the risk of fraudulent transactions using built-in NFC cards after the terminal is lost.

[0073] As a specific implementation of this application, based on the basic scheme, the asymmetric cryptography algorithm is further specified as the SM2 elliptic curve cryptography algorithm; The SM3 cryptographic hash algorithm is used to calculate the digest of the challenge and the card identifier ID.

[0074] Specifically, in the specific implementation of this application, the asymmetric cryptography algorithm adopts the SM2 elliptic curve cryptography algorithm, and the hash calculation adopts the SM3 cryptographic hash algorithm. The SM2 elliptic curve cryptography algorithm is a commercial asymmetric cryptography algorithm released by the State Cryptography Administration. It is designed based on the elliptic curve discrete logarithm problem, and has higher security and shorter key length. Under the same security strength, its key length is much shorter than that of the RSA algorithm, and its computational efficiency is higher.

[0075] During the registration phase, the terminal generates a secure random number that meets the private key length requirements of the SM2 algorithm as the first private key fragment. Based on the elliptic curve parameters specified by the SM2 algorithm, the corresponding first public key fragment is calculated through elliptic curve dot product operations. The SIM card also generates a second private key fragment and a corresponding second public key fragment based on the SM2 algorithm. The terminal calculates the complete public key according to the first and second private key fragments, following the SM2 collaborative key generation rules. This complete public key corresponds strictly one-to-one with the complete private key composed of the first and second private key fragments.

[0076] During the card swipe authentication phase, the SIM card uses its second private key to fragment and digest data, and calculates a partial digital signature following the "Technical Specification for Collaborative Signatures Based on SM2 Cryptographic Algorithm". The terminal uses its first private key to fragment and partially digest the digital signature, and calculates the complete digital signature according to the same specification. The authentication device uses the complete public key to verify the digital signature according to the SM2 algorithm signature verification rules.

[0077] When calculating the digest of the challenge and card identifier ID, the SM3 cryptographic hash algorithm is used. The SM3 algorithm is a commercial hash algorithm released by the State Cryptography Administration, with an output length of 256 bits, possessing collision resistance and second preimage resistance. During calculation, the terminal concatenates the challenge and card identifier ID into plaintext data, creates a new temporary file object to store the SM3 hash value, saves the plaintext data to this file object, calculates its hash value string, converts it into a byte array, and then performs shift, truncation, summation, and modulo operations to finally obtain a 256-bit digest value.

[0078] The beneficial effects of this implementation are that it adopts the national commercial cryptographic algorithm system, achieving independent control over the cryptographic algorithm and avoiding the security risks that may arise from relying on foreign cryptographic algorithms. The combined use of the SM2 and SM3 algorithms ensures high security while also taking into account computational efficiency, meeting the dual requirements of real-time performance and security in NFC card swiping authentication scenarios.

[0079] As a specific implementation of this application, based on the basic scheme, the terminal is further limited to calling the SIM card collaborative key generation interface and collaborative signature interface, which is achieved by sending APDU private instructions conforming to the ISO / IEC 7816-4 standard to the SIM card.

[0080] Specifically, in the specific implementation of this application, the terminal calls the SIM card collaborative key generation interface and collaborative signature interface by sending APDU private instructions conforming to the ISO / IEC 7816-4 specification to the SIM card. ISO / IEC 7816-4 is an international standard for interaction between smart cards and terminal devices, defining the general structure, data encoding format, and response mechanism of APDU instructions, ensuring that terminals and SIM cards from different manufacturers can achieve standardized communication interaction.

[0081] The collaborative key generation interface is implemented using proprietary instructions. The instruction code INS is set to 0x2A, which is independently defined within the application context and does not conflict with registered standard APDU instructions. The P1 parameter of the instruction is set to 0x00, and the P2 parameter is set to 0x01. The data field of the instruction is organized using TLV encoding format, following the data object format specified in ISO / IEC 7816-4. The card identifier ID is encapsulated as the core transmission parameter through a three-level structure of tag, length, and value. After receiving the instruction, the SIM card parses the data field according to the standard format to extract the card identifier ID and completes the subsequent second private key fragment generation operation. After the operation is completed, the SIM card returns a standard APDU response to the terminal. A response status code of 9000 indicates successful operation, and the response data field contains the generated second public key fragment. If the card identifier ID already exists or the instruction parameters are incorrect, the corresponding error code is returned. If the card ID is duplicated, 6A80 is returned.

[0082] The collaborative signature interface also employs proprietary APDU instructions compliant with the ISO / IEC 7816-4 standard. The instruction code INS is set to 0x2B, parameter P1 to 0x00, and parameter P2 to 0x02. The instruction data field uses TLV encoding, encapsulating a digest e as the core input parameter. Upon receiving the instruction, the SIM card parses the data field to extract the digest e and reads the corresponding second private key fragment to complete a partial digital signature calculation. After completion, the SIM card returns a standard APDU response. A status code of 9000 indicates success, and the response data field contains the generated partial digital signature s1. If the corresponding second private key fragment is missing or the instruction parameters are incorrect, an error code 6A88 is returned.

[0083] The advantages of this implementation are that it adopts the internationally standard APDU instruction format to realize the interface interaction between the terminal and the SIM card, ensuring the universality and compatibility of the solution on terminals and SIM cards from different manufacturers. The use of proprietary instructions avoids instruction conflicts with other SIM card applications, ensuring the independence and security of interface calls. The TLV encoding format has a clear structure and high parsing efficiency, which can effectively improve the reliability and processing speed of data transmission.

[0084] As a specific implementation of this application, based on the basic scheme, the APDU interaction between the terminal and the SIM card is further limited to using a secure channel for protection, and the data field of the APDU command is encrypted and its integrity is verified.

[0085] Specifically, in the specific implementation of this application, all APDU interactions between the terminal and the SIM card are protected by a secure channel. Only the data field of the APDU command is encrypted and its integrity is verified. The command headers CLA, INS, P1, and P2 are transmitted in plaintext to support normal command routing between the terminal and the SIM card.

[0086] At the sending end, the plaintext data generated by the application layer is first encrypted and then filled into the data field of the APDU. A MAC value is then appended to the end of the data field. The MAC value is calculated using the HMAC-SHA256 algorithm and is used to verify data integrity. The data field can also include optional sequence numbers and encryption mode identifiers as needed, used to uniquely identify the session and the encryption method.

[0087] At the receiving end, the APDU data field is first decrypted, followed by verification of the attached MAC value. If the MAC verification fails, the receiving end discards the instruction without performing any subsequent operations to prevent illegally tampered instructions from being executed. If the MAC verification passes, the plaintext parameters in the data field are parsed, and the corresponding interface function is executed.

[0088] The session key used in the secure channel is generated independently for each interaction, supporting forward security features. Even if a single session key is leaked, it will not affect the security of other sessions. If the length of a single APDU data field exceeds the maximum processing length of the SIM card, the terminal performs segmented transmission, strictly following the chained command rules specified in ISO / IEC 7816-4, and does not use custom segmented encryption methods to ensure compatibility with SIM cards from different manufacturers.

[0089] The beneficial effects of this implementation are that by encrypting and verifying the integrity of the APDU data field through a secure channel, it effectively prevents sensitive data from being eavesdropped on, tampered with, or forged during the interaction between the terminal and the SIM card, while maintaining the plaintext transmission of the command header to ensure the normal operation of command routing. The forward-secure session key mechanism and standard segmented transmission rules enhance communication security while also ensuring the versatility and compatibility of the solution.

[0090] As a specific implementation of this application, based on the basic solution, the embodiments of this application further include: The operator's server sends a sensitive data deletion command to the SIM card through a secure channel; After the SIM card receives and verifies the clear command, it destroys the second private key fragment stored internally, thus disabling the card swipe authentication function.

[0091] Specifically, in the specific implementation of this application, a remote anti-fraud processing procedure is also included after the terminal is lost. The second private key fragment in the SIM card is remotely destroyed through the operator's server to quickly disable the NFC card function.

[0092] The operator's server sends sensitive data deletion commands to the SIM card through a secure channel. Command transmission follows the secure channel protocol defined in GlobalPlatform Card Specification v2.3 and later, and can use either SCP03 or SCP11. The commands are sent to the terminal via a remote management mechanism, supporting multiple transmission methods such as SMS-PP, CAT_TP, or BIP. Communication between the operator's server and the terminal is encrypted using TLS 1.3 or a proprietary OTA secure channel to ensure that the commands are not eavesdropped on or tampered with during transmission. Upon receiving the commands, the terminal converts them into APDU commands conforming to the ISO / IEC 7816-4 standard and forwards them to the SIM card.

[0093] After receiving the APDU command, the SIM card first verifies the MAC value of the data field using the session key in the security domain. If MAC verification fails, status code 6988 is returned, indicating that the security message verification failed, and no operation is performed. If MAC verification succeeds, the COS parses the target object identifier and clear type parameters in the command and checks the corresponding access permissions. If the security status does not meet the clearing conditions, status code 6982 is returned.

[0094] If the authorization verification passes, the SIM card performs a destruction operation on the second private key fragment, logically zeroing or physically overwriting the storage area containing the second private key fragment. The physical overwrite operation calls the hardware erase primitives supported by the chip to ensure that the erased data is physically unrecoverable, completely eliminating the possibility of unauthorized recovery of the private key fragment. After the operation is completed, the SIM card returns a status code 9000 to the terminal to indicate successful erasure. After the second private key fragment is destroyed, the SIM card can no longer generate a valid partial digital signature, the collaborative signing process between the terminal and the SIM card cannot be completed, and the NFC card's swipe authentication function is permanently disabled.

[0095] The beneficial effect of this implementation is that it provides a remote emergency handling mechanism after the terminal is lost. Users can quickly destroy the second private key fragment in the SIM card by simply reporting the loss of the phone card through the operator, without relying on the operation of the terminal device. Even if the terminal is illegally held and the SIM card is not removed, the NFC card function can be immediately disabled, effectively preventing the risk of fraudulent use after the terminal is lost, and greatly improving the security and practicality of the solution.

[0096] As a specific implementation of this application, based on the basic scheme, the sensitive data clearing instruction is further limited to performing the destruction operation by logically zeroing or physically overwriting the storage area where the second private key fragment is located.

[0097] Specifically, in the specific implementation of this application, when the sensitive data clearing instruction executes the destruction operation of the second private key fragment, it adopts two methods: logical zeroing or physical overwriting, and is executed on the internal secure storage area of ​​the SIM card where the second private key fragment is located.

[0098] The logical zeroing operation sets every bit in the storage area to binary 0, directly overwriting the original second private key fragment data. This operation is fast and causes minimal wear and tear on the SIM card storage medium, making it suitable for emergency scenarios requiring rapid disabling of NFC card functionality. After execution, the original private key fragment data cannot be retrieved by any read command at the logical level; all read operations targeting this storage area will only return all zeros.

[0099] The physical overwrite operation invokes the hardware erase primitives natively supported by the SIM card chip to perform multiple random data overwrites on the target storage area. The overwrite process follows cryptographic security standards, using an unpredictable sequence of random numbers to cover the physical traces of the original data byte by byte, ensuring that even if the chip is physically disassembled and the contents of the storage medium are extracted, no valid second private key fragment information can be recovered.

[0100] After receiving a sensitive data clearing command and completing authorization verification, the SIM card will select the corresponding destruction method based on the clearing type parameter specified in the command data field. If the command does not explicitly specify a clearing type, the SIM card will perform a physical overwrite operation by default to ensure the highest level of data destruction security. After the second private key fragment is destroyed, the SIM card will permanently delete the private key fragment record corresponding to the card identifier ID. When the terminal initiates a collaborative signature request again, the SIM card will return error code 6A88, the collaborative signature process cannot be completed, and the NFC card's swipe authentication function will be permanently disabled.

[0101] The beneficial effect of this implementation is that by providing two differentiated data destruction methods, it addresses both the needs for rapid emergency response and secure data destruction. The physical overwrite method completely eliminates the possibility of private key fragmentation residues at the physical level, preventing any unauthorized data recovery and further strengthening the NFC anti-theft security defense after the terminal is lost.

[0102] Figure 2 This is a schematic diagram of the structure of an NFC card anti-theft device provided in an embodiment of this application, as shown below. Figure 2 As shown, it includes: registration unit 3 and card swiping authentication unit 4; Registration Unit 3 includes: The first generation module 31 is configured to generate a card identifier ID, a first private key fragment and a first public key fragment of an asymmetric cryptographic algorithm, and bind and store the card identifier ID, the first private key fragment and the first public key fragment in the terminal security chip. The first calling module 32 is configured to allow the terminal to call the SIM card collaborative key generation interface and pass in the card identifier ID; The second generation module 33 is configured to generate the second private key fragment and the second public key fragment corresponding to the SIM card identifier ID, and after secure storage, return the second public key fragment to the terminal. The first calculation module 34 is configured to enable the terminal to calculate the complete public key based on the first private key fragment and the second public key fragment, and to bind and store the complete public key with the card identifier ID. The sending module 35 is configured to allow the terminal to send the card identifier ID and the complete public key to the authentication device via near-field communication in order to complete the registration; Card swipe authentication unit 4 includes: Initiation module 41 is configured to allow the terminal to initiate an authentication request to the authentication device, with the authentication request carrying the card identifier ID; The third generation module 42 is configured to generate random numbers as challenges for the authentication device, send the challenges to the terminal, and cache them locally. The second calling module 43 is configured to have the terminal calculate a digest of the challenge and card identifier ID, and call the SIM card collaborative signature interface, passing in the digest; The second calculation module 44 is configured to calculate a partial digital signature based on the second private key fragment and digest of the SIM card, and return the partial digital signature to the terminal. The third calculation module 45 is configured to have the terminal calculate the complete digital signature based on the first private key fragment and partial digital signature, and send the card identifier ID and the complete digital signature to the authentication device. The signature verification module 46 is configured to use the complete public key corresponding to the card identifier ID to verify the challenge, card identifier ID, and complete digital signature of the authentication device. If the signature verification is successful, the authentication is successful.

[0103] It should be noted that other corresponding descriptions of the functional units involved in the NFC card anti-theft device provided in this embodiment can be found in [reference]. Figure 1 The corresponding descriptions in [the document] will not be repeated here.

[0104] Based on the above, Figure 1 The embodiment illustrates an NFC card anti-theft method. Correspondingly, this embodiment also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the above-described method. Figure 1 This illustrates a method for preventing theft and fraudulent use of NFC cards.

[0105] Based on the above, Figure 1 The embodiment illustrates an NFC card anti-theft method. Correspondingly, this embodiment also provides a computer program product storing a computer program that, when executed by a processor, implements the above-described method. Figure 1 This illustrates a method for preventing theft and fraudulent use of NFC cards.

[0106] Based on this understanding, the technical solution of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as CD-ROM, USB flash drive, mobile hard drive, etc.) and includes several instructions to cause a computer device (such as personal computer, server, or network device, etc.) to execute the methods of various implementation scenarios of this application.

[0107] Based on the above, Figure 1 The method for preventing NFC card skimming shown is as follows: Figure 2 To achieve the above objectives, the present application also provides an electronic device, such as a personal computer or a server, in the illustrated virtual device embodiment. This device includes a storage medium and a processor; the storage medium stores a computer program; the processor executes the computer program to implement the above-described virtual device. Figure 1 This illustrates a method for preventing theft and fraudulent use of NFC cards.

[0108] In some embodiments, the aforementioned physical device may further include a user interface, a network interface, a camera, radio frequency (RF) circuitry, sensors, audio circuitry, a Wi-Fi module, etc. The user interface may include a display screen, an input unit such as a keyboard, etc., and optionally, a USB interface, a card reader interface, etc. In some embodiments, the network interface may include a standard wired interface, a wireless interface (such as a Wi-Fi interface), etc.

[0109] The storage medium may also include an operating system and a network communication module. The operating system is a program that manages the hardware and software resources of the aforementioned physical device, supporting the operation of information processing programs and other software and / or programs. The network communication module is used to enable communication between the various components within the storage medium, as well as communication with other hardware and software in the information processing physical device.

[0110] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the element.

[0111] The above are merely specific embodiments of this application, enabling those skilled in the art to understand or implement this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to these embodiments, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A method for preventing theft of NFC cards, characterized in that, This includes the registration phase and the card-swiping authentication phase; The registration phase includes: The terminal generates a card identifier ID, as well as a first private key fragment and a first public key fragment of an asymmetric cryptographic algorithm, and binds and stores the card identifier ID, the first private key fragment, and the first public key fragment in the terminal security chip. The terminal calls the SIM card collaborative key generation interface and passes in the card identifier ID; The SIM card generates a second private key fragment and a second public key fragment corresponding to the card identifier ID, and after securely storing them, returns the second public key fragment to the terminal; The terminal calculates the complete public key based on the first private key fragment and the second public key fragment, and binds and stores the complete public key with the card identifier ID; The terminal sends the card identifier ID and the complete public key to the authentication device via near-field communication to complete the registration; The card swiping authentication stage includes: The terminal initiates an authentication request to the authentication device, and the authentication request carries the card identifier ID; The authentication device generates a random number as a challenge, sends the challenge to the terminal, and caches it locally. The terminal calculates a digest of the challenge and the card identifier ID, and calls the SIM card collaborative signature interface, passing in the digest; The SIM card calculates a partial digital signature based on the second private key fragment and the digest, and returns the partial digital signature to the terminal. The terminal calculates the complete digital signature based on the first private key fragment and the partial digital signature, and sends the card identifier ID and the complete digital signature to the authentication device. The authentication device uses the complete public key corresponding to the card identifier ID to verify the challenge, the card identifier ID, and the complete digital signature. If the verification passes, the authentication is successful.

2. The NFC card anti-theft method according to claim 1, characterized in that, The asymmetric cryptography algorithm is the SM2 elliptic curve cryptography algorithm; The digest of the challenge and the card identifier ID is calculated using the SM3 cryptographic hash algorithm.

3. The NFC card anti-theft method according to claim 1, characterized in that, The terminal invokes the SIM card collaborative key generation interface and collaborative signature interface, which is achieved by sending APDU private instructions conforming to the ISO / IEC 7816-4 standard to the SIM card.

4. The NFC card anti-theft method according to claim 3, characterized in that, The APDU interaction between the terminal and the SIM card is protected by a secure channel, and the data field of the APDU command is encrypted and its integrity is verified.

5. The NFC card anti-theft method according to claim 1, characterized in that, Also includes: The operator's server sends a sensitive data deletion command to the SIM card through a secure channel; After receiving and verifying the clearing command, the SIM card destroys the second private key fragment stored inside it, thereby disabling the card swipe authentication function.

6. The NFC card anti-fraud method according to claim 5, characterized in that, The sensitive data clearing instruction performs the destruction operation by logically zeroing or physically overwriting the storage area where the second private key fragment is located.

7. An NFC card anti-theft device, characterized in that, Includes a registration unit and a card-swipe authentication unit; The registration unit includes: The first generation module is configured to generate a card identifier ID for the terminal, as well as a first private key fragment and a first public key fragment of an asymmetric cryptographic algorithm, and bind and store the card identifier ID, the first private key fragment and the first public key fragment in the terminal security chip. The first calling module is configured to allow the terminal to call the SIM card collaborative key generation interface and pass in the card identifier ID; The second generation module is configured to generate a second private key fragment and a second public key fragment corresponding to the card identifier ID of the SIM card, and after securely storing the second public key fragment, return the second public key fragment to the terminal. The first calculation module is configured to have the terminal calculate a complete public key based on the first private key fragment and the second public key fragment, and bind and store the complete public key with the card identifier ID. The sending module is configured so that the terminal sends the card identifier ID and the complete public key to the authentication device via near-field communication to complete the registration; The card-swiping authentication unit includes: The initiation module is configured to allow the terminal to initiate an authentication request to the authentication device, the authentication request carrying the card identifier ID; The third generation module is configured to generate a random number as a challenge for the authentication device, send the challenge to the terminal, and cache it locally. The second calling module is configured to have the terminal calculate a digest of the challenge and the card identifier ID, and then call the SIM card collaborative signature interface, passing in the digest; The second calculation module is configured to have the SIM card calculate a partial digital signature based on the second private key fragment and the digest, and return the partial digital signature to the terminal. The third calculation module is configured to have the terminal calculate the complete digital signature based on the first private key fragment and the partial digital signature, and send the card identifier ID and the complete digital signature to the authentication device. The signature verification module is configured so that the authentication device uses the complete public key corresponding to the card identifier ID to verify the challenge, the card identifier ID, and the complete digital signature. If the signature verification is successful, the authentication is successful.

8. An electronic device, characterized in that, include: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores instructions that can be executed by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform the NFC card anti-theft method according to any one of claims 1-6.

9. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to execute the NFC card anti-theft method according to any one of claims 1-6.

10. A computer program product, characterized in that, The method includes a computer program that, when executed by a processor, implements the NFC card anti-theft method according to any one of claims 1-6.

Images