A multi-application security design method for an immigration and emigration certificate smart card

Abstract

A kind of smart card multi-application security design method suitable for entry and exit certificate belongs to the field of smart card operating system, comprising the following steps: the security system function module division of entry and exit certificate smart card operating system;The security system function module of the entry and exit certificate smart card operating system includes: password support subsystem, authentication subsystem, file access subsystem, command management subsystem, data protection subsystem, security management subsystem;File structure design suitable for various entry and exit certificates;According to the importance of different file information, design different levels of data storage and security encryption mode;Using a byte to represent the application state of smart card operating system in different periods.The present application can establish more effective electronic anti-forgery security system for various types of entry and exit certificates, further improve the level of entry and exit certificate in business logic design, security application design and the like.

Description

Technical Field

[0001] This invention belongs to the field of smart card operating system technology, specifically relating to a multi-application security design method for smart cards suitable for entry and exit documents. Background Technology

[0002] The smart card operating system is the core software for smart card applications, responsible for hardware resource management, external command processing, and application support. Multi-application design is key to achieving "one card, multiple uses," widely serving scenarios such as financial payments, identity authentication, and transportation. To ensure application security, smart card operating systems, when designed for multi-application use, must pay particular attention to avoiding certain security vulnerabilities, such as data area isolation in hardware and software, and differentiation of user permissions and identity authentication.

[0003] In existing technologies, ARM-based chips generally rely on their advantages of low power consumption and high performance. Leveraging the chip's hardware expansion capabilities and coprocessors, such as standardized interfaces like I2C and UART, they adapt to readers and terminal devices, resolving compatibility issues between applications and hardware in different scenarios. Simultaneously, they optimize and adapt encryption algorithms, employing a modular design to decompose the core functions of the smart card operating system, enabling multiple application functions such as information reading and writing, data transmission, and security management. For example, the Linkcore LKCOS / PSAM smart card uses a 32-bit ARM chip core, a built-in TDES coprocessor, and also employs algorithms such as DES and AES, efficiently handling the encryption requirements of applications such as financial payments and identity authentication.

[0004] In existing technologies, chips based on the RISC-V architecture leverage their modular instruction set characteristics to adapt to the computing power requirements of multiple applications through custom extended instructions, employ hierarchical storage to allocate independent resources, and rapidly integrate various applications with open-source system frameworks. For example, the Chipstar CC2560A Super SIM chip addresses the performance issues of digital RMB applications through dedicated RISC-V extended instructions. Combined with dedicated instructions, it can support the simultaneous deployment of multiple applications, covering scenarios such as transportation and digital payments.

[0005] Both types of chips adhere to international standards such as ISO / IEC 7816, improving compatibility through standardized interfaces and ensuring data security for multiple applications through layered storage design, secondary authentication, and key management technologies. They achieve efficient coordination and secure isolation of multiple applications within limited hardware resources. However, these two existing chip types still have the following problems:

[0006] For ARM-based chips, smart card operating system design is often limited by complex instruction sets, and licensing models restrict underlying modifications, making it difficult to thoroughly trim redundant modules and apply them flexibly. RISC-V-based chips, on the other hand, suffer from insufficient maturity in their smart card operating system software ecosystem, a lack of middleware and algorithm libraries, poor compatibility and portability, and difficulty in implementing multi-application isolation. Furthermore, when multiple applications share resources, security isolation is prone to issues such as permission violations, data leaks, and performance degradation. For example, a smart card chip equipped with Zephyr RTOS software experienced isolation failure due to PMP region register configuration and firmware vulnerabilities, allowing the authentication key to be read by the OTA module and posing a risk of payment data leakage. The main reason for this problem is that existing technology only sets different read / write permissions for different applications without further granularity, leading to overlapping regions. This allows one module to illegally read the key memory area of ​​another module, resulting in isolation failure. Summary of the Invention

[0007] To address the application data security issues that are prone to occur in existing technologies, this invention provides a multi-application security design method for smart cards suitable for entry and exit documents.

[0008] This invention designs a specific file structure applicable to various entry and exit documents, and strengthens isolation by adapting to different types of application data and setting application lifecycle-based access permissions. This invention enhances the maintainability and portability of the smart card operating system by designing a highly cohesive and loosely coupled security architecture functional module, thereby further improving system protection and data security capabilities. This invention not only avoids the application inflexibility issues caused by ARM architecture licensing restrictions, but also achieves secure isolation between multiple applications.

[0009] The technical solution adopted by this invention to solve the technical problem is as follows:

[0010] This invention provides a multi-application security design method for smart cards applicable to entry and exit documents, comprising the following steps:

[0011] Step S101: Division of security system functional modules of the smart card operating system for entry and exit documents;

[0012] The security system functional modules of the smart card operating system for entry and exit documents include:

[0013] The cryptographic support subsystem employs key generation, key computation, or procedural key destruction methods to ensure that attackers cannot obtain the real key in response to potential attacks.

[0014] The authentication subsystem is responsible for user authentication.

[0015] The file access subsystem is responsible for protecting sensitive data.

[0016] The command management subsystem is responsible for checking and processing APDU commands;

[0017] The data protection subsystem is used to implement data isolation and secure message transmission;

[0018] The security management subsystem is responsible for managing security status, data limits, and APDU commands.

[0019] Step S102: Document structure design applicable to various entry and exit documents;

[0020] The file structure includes: a directory file, readable files, secure files, and keys; the secure files and keys are not readable externally.

[0021] Step S103: Adapt to different types of application data;

[0022] Different levels of data storage and security encryption modes are designed according to the importance of different file information;

[0023] Step S104: Set application lifecycle-specific permissions;

[0024] One byte is used to represent the application status of the smart card operating system at different times: the directory file uses one byte to represent its life cycle, and the basic file uses one byte to represent its read / write status.

[0025] Furthermore, the cryptographic support subsystem includes:

[0026] The session key generation module is used for generating session keys that conform to the ICAO 9303 specification.

[0027] The random number generation module is used to generate truly random numbers;

[0028] Symmetric key operation module for secure channel encryption conforming to ICAO 9303 standard;

[0029] RSA key processing module, used for active authentication functions compliant with ICAO 9303 specifications;

[0030] Hash and CRC operation modules are used for seed generation of BAC session keys and PACE session keys conforming to ICAO 9303 specifications;

[0031] The ECDH operation module is used for PACE key exchange in accordance with the ICAO 9303 standard.

[0032] Furthermore, the identification subsystem includes:

[0033] An external authentication module is used for role identification;

[0034] An active authentication module is used to prevent chip cloning;

[0035] The BAC authentication module is used to generate session keys for subsequent secure channel encryption.

[0036] The PACE authentication module is used to generate more secure session keys for subsequent secure channel encryption.

[0037] Custom authentication module one is used to generate a session key using the key in the encryption machine for subsequent secure channel encryption;

[0038] Custom authentication module two is used to generate a more secure session key using the key in the encryption machine for subsequent secure channel encryption.

[0039] Furthermore, the file access subsystem includes:

[0040] The file access control module is used to manage permissions for accessing files;

[0041] The lifecycle management module is used to manage and restrict commands executed at different stages and in different scenarios.

[0042] Furthermore, the command management subsystem includes:

[0043] The command validity management module is used to determine the lifecycle and legality of commands;

[0044] The command processing module is used to implement specific functions based on instructions passed in from the outside.

[0045] Furthermore, the data protection subsystem includes:

[0046] The data backup module is used to prevent data loss during power outages;

[0047] An internal TSF data protection module is used to protect sensitive data;

[0048] The secure message transmission module is used for secure, encrypted transmission of information.

[0049] Furthermore, the security management subsystem includes:

[0050] The security status management module is used to manage the permissions for the chip to perform security authentication.

[0051] The security audit management module is used to manage secure access and role authentication.

[0052] The residual information protection module is used for the destruction of session keys, etc.

[0053] The key management module is used to manage the key permissions and number of attempts stored in the chip;

[0054] The lifecycle management module is used to determine the validity of external commands.

[0055] Furthermore, the directory file includes international public areas and business application areas; the readable files include document type codes, DG1, DG2, DG11, DG15, SOD, entry and exit records, visas, basic personal information, biometrics, other private information, and business information.

[0056] Furthermore, the international public area stores the data page information that countries need to read during inspections in accordance with international standards, while the business application area stores other private information that can only be read internally.

[0057] Furthermore, a security file is set up under each region to store the local key, which is used only to encrypt and decrypt data within that region; and the security file is only used within the smart card operating system and cannot be read externally.

[0058] The beneficial effects of this invention are:

[0059] 1. From the perspective of application benefits: This invention helps to establish a more effective electronic anti-counterfeiting security system for various types of entry and exit documents, and can further improve the level of entry and exit documents in terms of business logic design and security application design.

[0060] 2. From the perspective of application effectiveness:

[0061] (1) In terms of security, this invention has passed the highest level of security certification, EAL5+, through the evaluation of domestic IT product information security certification certificates.

[0062] (2) In terms of application performance, when the method proposed in this invention is applied to passports, compared with the new versions of passports from other countries, the performance of both BAC and PACE verification methods achieved by the method proposed in this invention reaches the same level or is improved, indicating that the method proposed in this invention supports good verification performance of entry and exit document samples. See the table below for details:

[0063] Attached Figure Description

[0064] Figure 1 The flowchart illustrates a multi-application security design method for smart cards applicable to entry and exit documents, as provided by this invention.

[0065] Figure 2 This is a schematic diagram of the cryptographic support subsystem.

[0066] Figure 3 The schematic diagram for identifying the subsystem.

[0067] Figure 4 This is a schematic diagram of the file access subsystem.

[0068] Figure 5 This is a schematic diagram of the command management subsystem.

[0069] Figure 6 This is a schematic diagram of the data protection subsystem.

[0070] Figure 7 This is a schematic diagram of the safety management subsystem.

[0071] Figure 8 This is a schematic diagram illustrating the specific document structure applicable to various entry and exit documents.

[0072] Figure 9 This invention provides a structural block diagram of an entry / exit document smart card operating system. Detailed Implementation

[0073] The present invention will be further described in detail below with reference to the accompanying drawings.

[0074] In a first aspect, the present invention provides a multi-application security design method for smart cards applicable to entry and exit documents.

[0075] The approach to implementing multi-application security design and business applications for entry and exit documents involves scheduling various instructions from the security architecture functional modules (i.e., the functional layer) of its smart card operating system and calling various hardware and algorithm libraries in the driver layer. This enables a series of complex functions from pre-designed subsystems, including cryptographic support, authentication, file access, command management, data protection, and security management. These functions are then directly invoked by the application layer of the smart card operating system to ultimately meet the smart card's business requirements. To adapt to the low-power requirements of RISC-V chips and the high real-time and high reliability requirements of entry and exit documents, the design of the security architecture functional modules of the smart card operating system must adhere to the principles of high cohesion, low coupling, and hardware-software collaboration.

[0076] This invention provides a multi-application security design method for smart cards applicable to entry and exit documents, such as... Figure 1 As shown, the specific implementation process is as follows:

[0077] Step S101: Division of security system functional modules of the smart card operating system for entry and exit documents;

[0078] Taking into account the characteristics and security requirements of entry and exit document services, the security system of the smart card operating system for entry and exit documents is mainly divided into six subsystems: password support subsystem, authentication subsystem, file access subsystem, command management subsystem, data protection subsystem, and security management subsystem. This ensures that the functions of each subsystem module are relatively independent and that the application is highly portable.

[0079] The following provides a detailed description of each subsystem module.

[0080] (1) Cryptographic support subsystem;

[0081] The cryptographic support subsystem is primarily designed to counter cryptographic or brute-force attacks that attackers may attempt. It employs methods including, but not limited to, key generation, key computation, and procedural key destruction to ensure that attackers cannot obtain the real key.

[0082] As a preferred embodiment, the cryptographic algorithms used in the key operation method mainly include general security algorithms such as 3DES, AES, and RSA.

[0083] According to the present invention, such as Figure 2 As shown, the cryptographic support subsystem mainly includes: a session key generation module, a random number generation module, a symmetric key operation module, an RSA key operation module, a hash and CRC operation module, and an ECDH operation module. The session key generation module is mainly used to generate BAC session keys conforming to ICAO 9303 standards and PACE session keys conforming to ICAO 9303 standards. The random number generation module is mainly used to generate truly random numbers. The symmetric key operation module is mainly used for secure channel encryption conforming to ICAO 9303 standards, specifically using the 3DES algorithm or AES256 algorithm. The RSA key operation module is mainly used for active authentication functions conforming to ICAO 9303 standards, including signing and key pair generation. The hash and CRC operation module is mainly used for seed generation of BAC session keys and PACE session keys conforming to ICAO 9303 standards, including SHA1 / SHA256 and CRC16. The ECDH operation module is mainly used for PACE session key exchange conforming to ICAO 9303 standards.

[0084] (2) Identification subsystem;

[0085] The authentication subsystem is primarily responsible for user authentication, including handling successful and failed authentication. The authentication mechanisms employed by this subsystem can utilize internationally recognized algorithms (3DES, RSA, etc.) and security mechanisms compliant with ICAO 9303 requirements, such as BAC, PACE (access rights), external authentication, PA (ensuring the legitimacy of data within the chip), AA (ensuring against cloning), and CA (chip authentication), to meet the specific business requirements of entry and exit documents.

[0086] According to the present invention, such as Figure 3As shown, the authentication subsystem mainly includes an external authentication module, an active authentication module, a BAC authentication module, a PACE authentication module, a custom authentication module one, and a custom authentication module two. The external authentication module is mainly used for role authentication. The active authentication module is mainly used to prevent chip cloning, specifically using the RSA1024 signature algorithm recommended by DOC9303. The BAC authentication module is mainly used to generate session keys for subsequent secure channel encryption, specifically using the 3DES and SHA1 algorithms recommended by DOC9303. The PACE authentication module is mainly used to generate more secure session keys for subsequent secure channel encryption, specifically using the AES256 and ECDH algorithms recommended by DOC9303. Custom authentication module one is mainly used to generate session keys using keys within the encryption machine for subsequent secure channel encryption; this is a user security authentication for specific business needs and does not interact with international systems. Custom authentication module two is mainly used to generate more secure session keys using keys within the encryption machine for subsequent secure channel encryption to protect sensitive domestic biometrics and does not interact with international systems.

[0087] (3) File access subsystem;

[0088] The file access subsystem is primarily responsible for protecting sensitive data. It provides effective protection for files stored on smart cards, controlling access permissions and denying unauthorized access. The file security access control measures employed by the subsystem include allowing only successfully authenticated initial administrators and personalized administrators to set keys and file access attributes, switching lifecycles via specific commands, and ensuring that users correspond to the correct roles.

[0089] According to the present invention, such as Figure 4 As shown, the file access subsystem mainly includes a file access control module and a lifecycle management module. The file access control module is mainly used to manage access permissions for files, including access control attributes, file status, file attributes, and file type. The lifecycle management module is mainly used to manage and restrict commands executed in different stages and scenarios. Each lifecycle has a state switching instruction, and different lifecycles have their own set of executable commands. Once a lifecycle is switched, it is irreversible.

[0090] (4) Command Management Subsystem;

[0091] The command management subsystem is primarily responsible for checking and processing APDU commands. It performs syntax analysis on the command header of each received command, analyzes and checks the correctness of the command parameters, and then executes the corresponding submodules in the security management subsystem and file access subsystem for each command. After command execution, the command management subsystem is responsible for returning the response data from the security management subsystem to the read / write device. When distributing received commands (with authentication codes attached), the command management subsystem establishes a session key and performs command validity checks to ensure that attackers cannot steal information.

[0092] According to the present invention, such as Figure 5 As shown, the command management subsystem mainly includes a command validity management module and a command processing module. The command validity management module is mainly used to determine the lifecycle and legality of commands, including lifecycle checks, command header checks, and command data unpacking. The command processing module is mainly used to implement specific functions based on externally transmitted instructions, including executing command operations and packaging return values.

[0093] (5) Data protection subsystem;

[0094] The data protection subsystem is primarily used to isolate user data from internal data and to transmit secure messages. When transmitting sensitive internal data, all command messages undergo security checks before processing to determine user authorization. These checks include, but are not limited to, lifecycle checks, message format checks, access control checks, and user authentication. When a command's data field requires a MAC address, the command can be transmitted using secure messages. The data protection subsystem ensures the correct recovery of incomplete command operations during write operations through power-loss protection and backup mechanisms.

[0095] According to the present invention, such as Figure 6 As shown, the data protection subsystem mainly includes: a data backup module, an internal TSF data protection module, and a secure message transmission module; the data backup module is mainly used to prevent data loss due to power failure by adopting a power-off protection mechanism; the internal TSF data protection module is mainly used to protect sensitive data through power-on self-test; the secure message transmission module is mainly used for secure channel encrypted transmission of information, and it follows the secure message transmission specification of DOC9303.

[0096] (6) Safety Management Subsystem;

[0097] The security management subsystem is primarily responsible for managing security status, data limits, and APDU commands. Its security management functions mainly target unauthorized access threats. Through security status, it assigns specific permissions to each authorized role to access areas and information allocated or designated by the smart card operating system. Any user must undergo authentication by the authentication subsystem before performing file access operations. The subsystem records the number of authentication failures; if the limit is exceeded, the command is aborted and the smart card operating system is locked. The smart card operating system must clear all previous states after a reset or power-on to ensure information security.

[0098] According to the present invention, such as Figure 7 As shown, the security management subsystem mainly includes: a security status management module, a security audit management module, a residual information protection module, a key management module, and a lifecycle management module. The security status management module primarily manages the permissions for secure authentication performed by the chip. Only roles that have successfully authenticated are authorized to access the corresponding files. Once a user has successfully authenticated, the authentication data is immediately invalidated. The security audit management module primarily manages secure access and role authentication. When the number of authentication failures exceeds a certain limit, the command operation will be terminated and the key will be locked, preventing further operations. If the number of key authentication failures reaches a certain limit, the card will be permanently locked. The residual information protection module primarily destroys session keys, etc. Initialization erases all FLASH memory, and all previous states are cleared upon reset or power-on. The key management module primarily manages the key permissions and attempt counts stored in the chip. Keys are divided into different levels according to the lifecycle of different certificates, and import is performed according to the level. A maximum number of key attempts is set. The lifecycle management module primarily determines the legitimacy of external commands. Different commands can be executed in different lifecycles, each lifecycle has clear switching conditions and instructions, and the lifecycle state is irreversible.

[0099] Step S102: Specific document structure design applicable to various entry and exit documents;

[0100] like Figure 8 As shown, the specific file structure applicable to various entry and exit documents mainly includes: a directory file, a readable file, and a security file; among them, the security file is not readable by external parties.

[0101] This invention, based on different read / write permissions for entry and exit document information, designs an international public area (DF) and a business application area in the directory file, such as Business Application Area 1 (DF), Business Application Area 2 (DF), and Business Application Area 3 (DF), to enhance the security of data isolation between different business application areas. The international public area stores information pages such as document numbers, names, nationalities, and facial images that are required for inspection by various countries, according to international standards. The business application area stores other private information that can only be read internally.

[0102] In this invention, the readable documents mainly include document type codes (EF), DG1 (EF), DG2 (EF), DG11 (EF), DG15 (EF), SOD (EF), entry and exit records, visas, basic personal information, biometrics, other private information, business 1, and business 2.

[0103] To further ensure independent security for applications, a security file is established in each region to store the local key, and encryption and decryption are performed only on data within that region. The security file is used only within the smart card operating system and is not readable externally.

[0104] Step S103: Adapt to different types of application data;

[0105] Considering that different types of application data have different security levels—for example, basic personal information stored in international public areas has a relatively low security level but high communication timeliness requirements; while sensitive biometric images such as fingerprints are stored in business application areas, with a relatively high security level and slightly lower communication timeliness requirements—this invention designs different levels of data storage and security encryption modes based on the importance of different file information. For example, keys are high-security files, stored in the chip's secure area and cannot be read by external commands; personal information is medium-security files, stored in the chip's ordinary area but requiring authentication and encrypted access; and ordinary information can be read in plaintext without encryption. This achieves a balance between information protection and global interoperability requirements for different types of application data.

[0106] Step S104: Set application lifecycle-specific permissions;

[0107] This invention uses one byte to represent the application state of the smart card operating system at different stages: the root directory file MF, directory file DF, and other directory files use one byte to represent their lifecycle, while the readable EF file, security file, and other basic files use one byte to represent their read / write state. This accurately describes the current state of the application. First, it facilitates the location of security access permissions for different data at different lifecycles and states of the application. Second, it ensures that the smart card operating system can quickly locate and return to a secure state in the event of any failed operation.

[0108] Table 1 Directory File Status (lower four bits indicate lifecycle status)

[0109]

[0110] As shown in Table 1, the first four bits indicate the current application scope, while the last four bits indicate the current stage of the application.

[0111] Table 2 Basic File Status (The lower four bits represent read / write status and permissions)

[0112]

[0113] As shown in Table 2, the first four bits indicate the current application scope, while the last four bits indicate the current file access status.

[0114] This invention takes the multi-application security design of a smart card operating system for entry and exit documents as an example. By establishing a highly cohesive and loosely coupled security system functional module and an extensible specific file structure design, it realizes the secure application of various types of entry and exit documents in a single smart card operating system. At the same time, by designing different levels of data storage and security encryption modes, as well as different application lifecycle-based access control, it achieves secure isolation of multiple applications, effectively improving the application performance and security of entry and exit documents.

[0115] Secondly, the present invention provides a smart card operating system for entry and exit documents. This smart card operating system for entry and exit documents is designed based on a multi-application security design method for smart cards applicable to entry and exit documents provided in the first aspect.

[0116] This invention follows the design pattern of smart cards for entry and exit documents, dividing the smart card operating system into three layers from bottom to top: a driver layer, a function layer, and an application layer. The application layer, function layer, and driver layer communicate with each other using APIs, i.e., they achieve interoperability through API interface calls.

[0117] According to this invention, the driver layer mainly includes communication interfaces, security algorithm interfaces, MMU management interfaces, NVM read / write interfaces, clock and power management interfaces, and interrupt peripheral management interfaces. These interfaces are the lowest-level interfaces provided by the smart card, which are then encapsulated to form the driver layer, enabling the smart card operating system for entry and exit documents to implement the underlying hardware functions.

[0118] According to the present invention, the functional layer is the security system functional module designed in the first aspect.

[0119] According to the present invention, the application layer is mainly used for business applications that interface with electronic passports and other entry and exit documents.

[0120] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A multi-application security design method for smart cards applicable to entry and exit documents, characterized in that, Includes the following steps: Step S101: Division of security system functional modules of the smart card operating system for entry and exit documents; The security system functional modules of the smart card operating system for entry and exit documents include: The cryptographic support subsystem employs key generation, key computation, or procedural key destruction methods to ensure that attackers cannot obtain the real key in response to potential attacks. The authentication subsystem is responsible for user authentication. The file access subsystem is responsible for protecting sensitive data. The command management subsystem is responsible for checking and processing APDU commands; The data protection subsystem is used to implement data isolation and secure message transmission; The security management subsystem is responsible for managing security status, data limits, and APDU commands. Step S102: Document structure design applicable to various entry and exit documents; The file structure includes: a directory file, readable files, secure files, and keys; the secure files and keys are not readable externally. Step S103: Adapt to different types of application data; Different levels of data storage and security encryption modes are designed according to the importance of different file information; Step S104: Set application lifecycle-specific permissions; One byte is used to represent the application status of the smart card operating system at different times: the directory file uses one byte to represent its life cycle, and the basic file uses one byte to represent its read / write status.

2. The multi-application security design method for smart cards applicable to entry and exit documents according to claim 1, characterized in that, The cryptographic support subsystem includes: The session key generation module is used for generating session keys that conform to the ICAO 9303 specification. The random number generation module is used to generate truly random numbers; Symmetric key operation module for secure channel encryption conforming to ICAO 9303 standard; RSA key processing module, used for active authentication functions compliant with ICAO 9303 specifications; Hash and CRC operation modules are used for seed generation of BAC session keys and PACE session keys conforming to ICAO 9303 specifications; The ECDH operation module is used for PACE key exchange in accordance with the ICAO 9303 standard.

3. The multi-application security design method for smart cards applicable to entry and exit documents according to claim 1, characterized in that, The identification subsystem includes: An external authentication module is used for role identification; An active authentication module is used to prevent chip cloning; The BAC authentication module is used to generate session keys for subsequent secure channel encryption. The PACE authentication module is used to generate more secure session keys for subsequent secure channel encryption. Custom authentication module one is used to generate a session key using the key in the encryption machine for subsequent secure channel encryption; Custom authentication module two is used to generate a more secure session key using the key in the encryption machine for subsequent secure channel encryption.

4. The multi-application security design method for smart cards applicable to entry and exit documents according to claim 1, characterized in that, The file access subsystem includes: The file access control module is used to manage permissions for accessing files; The lifecycle management module is used to manage and restrict commands executed at different stages and in different scenarios.

5. The multi-application security design method for smart cards applicable to entry and exit documents according to claim 1, characterized in that, The command management subsystem includes: The command validity management module is used to determine the lifecycle and legality of commands; The command processing module is used to implement specific functions based on instructions passed in from the outside.

6. The multi-application security design method for smart cards applicable to entry and exit documents according to claim 1, characterized in that, The data protection subsystem includes: The data backup module is used to prevent data loss during power outages; An internal TSF data protection module is used to protect sensitive data; The secure message transmission module is used for secure, encrypted transmission of information.

7. The multi-application security design method for smart cards applicable to entry and exit documents according to claim 1, characterized in that, The security management subsystem includes: The security status management module is used to manage the permissions for the chip to perform security authentication. The security audit management module is used to manage secure access and role authentication. The residual information protection module is used for the destruction of session keys, etc. The key management module is used to manage the key permissions and number of attempts stored in the chip; The lifecycle management module is used to determine the validity of external commands.

8. A multi-application security design method for smart cards applicable to entry and exit documents according to claim 1, characterized in that, The catalog file includes international public areas and business application areas; the readable files include document type codes, DG1, DG2, DG11, DG15, SOD, entry and exit records, visas, basic personal information, biometrics, other private information, and business information.

9. A multi-application security design method for smart cards applicable to entry and exit documents according to claim 8, characterized in that, The international public area stores the data pages that countries need to access during inspections, in accordance with international standards, while the business application area stores other private information that can only be read internally.

10. A multi-application security design method for smart cards applicable to entry and exit documents according to claim 8, characterized in that, A security file is set up under each region to store the key for that region, and it is only used to encrypt and decrypt data within that region; moreover, the security file is only used within the smart card operating system and cannot be read externally.

Images