CN101282347B - Method for controlling intelligent storing card - Google Patents

Abstract

The invention discloses a control method of an intelligent memory card. The invention fully utilizes the existing bus resource of the memory card and is additionally provided with a value added application module in the memory card, thereby being capable of implementing the function expansion by the value added application module, being convenient to have the value added service expansion of the value added service operator, and having stronger compatibility and scalability. Otherwise, the invention implements the management of the intelligent memory card via command data package by the application program, thereby being capable of guaranteeing the normal operation of the intelligent memory card.

Description

A kind of control method of smart memory card

technical field

The invention relates to control technology, in particular to a control method for an intelligent memory card.

Background technique

The value-added applications of the existing mobile terminals are mostly based on the SIM card number, so that the value-added service operators are subject to the mobile operators. If this situation needs to be changed, a smart card chip can be added in the memory card of the mobile phone terminal, and the value-added application can be realized by the smart card chip, so that the value-added application is separated from the SIM card number. Among them, a memory card added with a smart card chip is called a smart memory card.

However, the prior art only provides a process for interacting with the memory card, that is, the application program directly sends a read/write command to the memory card, and then the memory card controller in the memory card performs corresponding read/write operations on the physical storage medium according to the command. /write operation, but does not provide an interactive process for smart memory cards. However, if the interactive process cannot be used to achieve effective control of the smart memory card, such as managing resources in the smart memory card, identity authentication and authorization of the smart memory card, etc., the normal operation of the smart memory card cannot be guaranteed. The addition of smart card chips cannot guarantee the effective realization of value-added applications.

Contents of the invention

In view of this, the present invention provides a control method for an intelligent memory card, which can implement function expansion and management based on the memory card.

A method for controlling a smart memory card provided by the present invention, the smart memory card includes a memory card controller and a physical storage medium, and the smart memory card also carries a value-added application module for realizing value-added applications, the method includes :

The application program sends a command data packet, which carries the target type used to determine the operation object of the command data packet, and the command encoding information used for the memory card controller to obtain the command;

The memory card controller selects a physical storage medium or a value-added application module as an operation object according to the target type, and decodes the command encoding information to obtain a corresponding command, uses the decoded command to perform a corresponding operation on the selected operation object, and then sends the The application program sends a response data packet, which carries response coding information indicating whether the corresponding operation is successful;

Among them, the commands are divided into four categories, which are the first type of command, the second type of command, the third type of command, and the fourth type of command according to their use authority levels from low to high;

Before using the second type of command to perform a corresponding operation on the selected operation object, the method further includes: the application program passes the first-level authentication with the smart memory card;

Before using the third type of command to perform corresponding operations on the selected operation object, the method further includes: the application program passes the first-level and second-level authentication with the smart memory card;

Before using the fourth type of command to perform a corresponding operation on the selected operation object, the method further includes: the application program passes the first-level, second-level and third-level authentication with the smart memory card.

The command data packet further carries: the data packet type identifier used to represent the command data packet, the protocol version number used to represent the command data packet, the serial number of the command data packet, the command data packet used for The data field carrying the data, the length of the data field of the command packet;

The response data packet further carries: a data packet type identifier used to represent the response data packet, a protocol version number used to represent the response data packet, a serial number of the response data packet, and data of the response data packet field, the length of the data field of the response packet.

Setting in the smart memory card an authority register for recording the certified level;

Before using the second to fourth types of commands to perform corresponding operations on the selected operation object, the method further includes: the memory card controller judges whether it has permission to use the current command to perform corresponding operations on the selected operation object according to the authentication level recorded in the authorization register. operate.

The first type of command includes: a command to reset the smart memory card, a command to read the version information of the smart memory card, a command to send an application protocol data unit APDU, a command to read a common area in a physical storage medium, and a command to write a physical storage medium Commands for the common area in the physical storage medium, commands for reading the hidden area in the physical storage medium, commands for writing the hidden area in the physical storage medium, and authentication request commands for authentication respectively.

The smart memory card version information includes: product classification number, product version number, product serial number, encoding information of manufacturer's name, length of manufacturer's name, manufacturer's name, and protocol version number.

A control register is set in the smart memory card, wherein enabling information of whether the physical storage medium is readable or writable is recorded.

The authentication request command includes a first-level authentication request command, and the first-level authentication includes:

The application program sets the encoding information in the command data packet as the command encoding information of the authentication request command, and carries the first-level authentication request command containing the feature information used to identify the identity of the user currently using the application program in the command data packet. sent to the memory card controller in the data domain;

The memory card controller matches the characteristic information in the command data packet with the characteristic information stored in the smart memory card, and returns the first-level authentication result including the matching result in the data field of the response data packet to the application program.

The first-level authentication request command further includes: the command identifier of the first-level authentication request command, the length of the first-level authentication request command, the session identifier identifying the current first-level authentication interaction, and the type of feature information;

The first-level authentication result further includes: the response identifier of the first-level authentication result, the length of the first-level authentication result, the session identifier identifying the current first-level authentication interaction, the failure reason when the authentication result is a failure, indicating whether Key agreement identifier for key agreement.

The authentication request command includes a second-level authentication request command, and the second-level authentication includes:

The application program sets the encoding information in the command packet as the encoding information of the authentication request command, generates the first random number, and sends the second-level authentication request command containing the first random number in the data field of the command packet to the memory card controller;

The memory card controller uses the preset key seed to perform a Hash operation on the first random number to obtain the first Hash operation result, and carries the second-level authentication response containing the first Hash operation result in the data field of the response data packet returned to the application in

The application uses the same key seed as that of the memory card controller to perform Hash operation on the first random number generated by it, and compares the obtained second Hash operation result with the first Hash operation result in the response data packet, if two or the same, the second-level authentication result indicating successful authentication is carried in the data field of the command packet and sent to the memory card controller.

The second-level authentication request command further includes: the command identifier of the second-level authentication request command, the length of the second-level authentication request command, the session identifier identifying the current second-level authentication interaction, the Hash algorithm type identifier, the Hash algorithm password Key length, key of Hash algorithm, key seed identification;

The second-level authentication response further includes: the response identifier of the second-level authentication response, the length of the second-level authentication response, the session identifier identifying the current second-level authentication interaction, the error reason when the Hash operation is wrong, the first Hash The length of the operation result.

The authentication request command includes a third-level authentication request command, and the third-level authentication includes:

The application program sets the coded information in the command data packet as the coded information of the authentication request command, and generates a second random number to be carried in the data field of the command data packet together with the third-level authentication request command and sent to the memory card controller;

The memory card controller generates a third random number, and performs an XOR operation on the third random number and the second random number in the command packet, and then uses the private key corresponding to the preset public key certificate in the smart memory card to pair the XOR operation. or carry out a digital signature on the operation result; carry the third-level authentication response containing the public key certificate and digital signature in the data field of the response packet and return it to the application program;

The application program uses the public key certificate in the response data packet to verify the digital signature, and if the verification is passed, the third-level authentication result indicating successful authentication is carried in the data field of the command data packet and sent to the memory card controller.

The third-level authentication request command further includes: the command identifier of the third-level authentication request command, the length of the third-level authentication request command, and the session identifier identifying the current third-level authentication interaction;

The third-level authentication response further includes: the response identifier of the third-level authentication response, the length of the third-level authentication response, the session identifier identifying the current third-level authentication interaction, the XOR operation or the cause of the error when the signature is processed incorrectly , the algorithm type identification of the digital signature, the third random number, the length of the digital signature, and the length of the public key certificate.

A control register for recording the read and write enable information of the physical storage medium is set in the smart memory card;

Before using the decoded commands to perform corresponding operations on the physical storage medium, the method further includes: the memory card controller judges whether to allow the current command to perform read and write operations on the physical storage medium according to the read and write enable information recorded in the control register.

The enable information includes: general enable information indicating whether the physical storage medium is accessible, write enable information indicating whether the common area of the physical storage medium is writable, and read enable information indicating whether the common area of the physical storage medium is readable information.

The second type of command includes: a command to read a control register, a command to write a control register, and a command indicating to send multiple application protocol data units APDU at the same time.

A special control register for recording download and pre-personalization enabling information is set in the smart memory card;

Before using the decoded command to perform corresponding operations on the selected operation object, the method further includes: the memory card controller judges whether to allow the download of the application program and/or whether to Allows for pre-personalization.

The third type of commands include: commands for reading special control registers and commands for writing special control registers.

The fourth type of commands include: commands for writing version information of the smart memory card, commands for testing the smart memory card, commands for initializing the smart memory card, commands for reading the key in the smart memory card, and commands for writing the key in the smart memory card .

It can be seen from the above technical solution that the present invention makes full use of the existing bus resources of the memory card, and adds a value-added application module to the memory card so that the function expansion can be realized through the value-added application module, so that the realization of the value-added application is no longer limited by SIM card, so it is convenient for value-added service operators to expand value-added services, and has strong compatibility and upgradeability. Moreover, in the present invention, the management of the smart memory card is realized by the application program through the command data packet, so as to ensure the normal operation of the smart memory card.

Description of drawings

FIG. 1 is a schematic structural diagram of a smart memory card in an embodiment of the present invention.

FIG. 2 is a schematic diagram of the protocol layer structure of the smart memory card system in the embodiment of the present invention.

Fig. 3 is an exemplary flow chart of a method for controlling a smart memory card in an embodiment of the present invention.

FIG. 4 is a schematic diagram of a multi-level authentication process in an embodiment of the present invention.

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and examples.

FIG. 1 is a schematic structural diagram of a smart memory card in an embodiment of the present invention. As shown in FIG. 1 , the smart memory card in this embodiment includes: a physical interface, a memory card controller, a physical storage medium, and a smart card chip. Among them, the physical interface, memory card controller, and physical storage medium are all structures in the existing memory card; while the smart card chip carries a value-added application module for implementing value-added applications, which can realize various value-added applications without the SIM card.

Among them, the value-added application module can realize the value-added application through the transparent transmission of the terminal equipment and the interaction with the network side according to the existing SIM card mode. The interaction mode between the SIM and the network side can be realized by those skilled in the art, and the present invention mainly aims at How to control and manage the smart memory card is not aimed at the interaction involved in implementing value-added applications, so it will not be described in detail in this article.

Both the physical storage medium and the value-added application modules in the smart card chip can be regarded as accessible resources in the smart memory card, and the resource management in the present invention mainly refers to the management of the smart card chip.

In this embodiment, the access of the application program to the smart card chip can be realized in the following manner:

1. Develop a driver program to enable applications to access addresses other than physical storage media. How to develop the driver program according to the above requirements can be realized by those skilled in the art, and will not be repeated here.

2. Use the memory card extension protocol to define commands dedicated to accessing the smart card chip, and ensure that the memory card controller can recognize it. How to define the dedicated command can be realized by those skilled in the art, and will not be repeated here.

3. Map the address of the smart card chip to the preset address of the physical storage medium, so that the memory card controller can locate the extended application chip according to the access address. When the application program needs to access the extended application chip, the memory card controller can locate the Extends the address of the application chip. How to realize the address mapping and the positioning based on the address mapping can also be realized by those skilled in the art, and will not be repeated here.

The above three methods can ensure that the application program can access the smart card chip, but in comparison, the development of the driver program is more difficult to develop and requires a longer development cycle; the use of the memory card extension protocol requires modification of the mobile phone terminal and storage device. Card controller; and the way of address mapping does not have the defects of the first two ways. Therefore, address mapping is preferably used in this embodiment.

Referring to Fig. 2, when accessing the physical storage medium in the smart memory card, the application program and the smart memory card interact through the application interface, the driver program and the terminal device.

Still referring to Figure 2, taking the address mapping method to ensure that the application program can access the smart card chip as an example, the application program sequentially sends command packets to the smart card chip in the smart memory card through the preset interface file, driver program, and terminal equipment for The value-added application module in the smart card chip performs corresponding operations. Correspondingly, the value-added application module in the smart card chip will also return a response data packet to the application program through a reverse path.

Among them, the interface file is mapped to the preset address of the smart card chip in the physical storage medium. The interface file follows the principle of the file system, and the basic unit of occupying disk space is not a byte but a cluster. Even if an interface file has only one byte, It will also be assigned to a smallest unit, a cluster.

When the application interface needs to send a command packet to the smart card chip, it only needs to write the command packet in the interface file, and the command written in the interface file is sent to the smart card via the driver and the terminal device through the command packet. memory card, and the target operation object of the command data packet can be set as the preset address mapped with the smart card chip.

Then, the memory card controller in the smart memory card judges whether the target operation object of the command data packet is the preset address representing the extended application chip. If the target operation object is the preset address, the interface protocol program is transferred to the entry program for operating the extended application chip corresponding to the extended application type identifier, and the command data packet is sent to the corresponding extended application chip.

The above is a brief description of the structure and basic working principle of the smart memory card, and the control method of the smart memory card will be described in detail below.

Fig. 3 is an exemplary flow chart of a method for controlling a smart memory card in an embodiment of the present invention. As shown in Figure 3, the method includes:

Step 301 , the application program sends a command data packet to the smart memory card, which carries command encoding information for determining the target type of the operation object of the application command data packet and for the memory card controller in the smart memory card to acquire the command.

Step 302, the memory card controller in the smart memory card selects the physical storage medium or the value-added application module as the operation object according to the target type, and decodes the command encoding information to obtain the corresponding command, and uses the decoded command to perform the operation on the selected operation object. Operate accordingly.

In this embodiment, the commands can be divided into four types, which are the first type of commands, the second type of commands, the third type of commands, and the fourth type of commands according to their use authority levels from low to high.

Before the smart memory card uses the second type of command to perform corresponding operations on the selected operation object, the application program needs to pass the first-level authentication with the smart memory card;

Before the smart memory card uses the third type of command to perform corresponding operations on the selected operation object, the application program needs to pass the first-level and second-level authentication with the smart memory card;

Before the smart memory card uses the fourth type of command to perform corresponding operations on the selected operation object, the application program needs to pass the first level, second level and third level authentication with the smart memory card.

If the corresponding level of certification is not passed, the operation fails.

In order to record the level of authentication passed, a permission register can be set in the smart memory card, and each flag bit of the permission register can be shown in Table 1.

Table 1

Before the smart memory card uses the second to fourth types of commands to perform corresponding operations on the selected operation object, the memory card controller in the smart memory card can judge whether it has the right to use the current command to select according to the authentication level recorded in the permission register. The operation object performs the corresponding operation.

In step 303, the memory card controller in the smart memory card sends a response data packet to the application program, which carries response coded information indicating whether the corresponding operation is successful.

In this step, the success of the response refers to the successful execution of the corresponding operation of the command; for the response coding information indicating failure, it can be divided into multiple types according to the cause of failure, as shown in Table 2.

Table 2

Step 304, the application program decodes the response coded information to know whether the operation is successful.

So far, this process ends.

It should be noted that not all commands need to be answered, so steps 303 to 304 in the above process are optional steps.

It can be seen that, based on the structure shown in FIG. 1 , function expansion can be realized only by adding a smart card chip into the memory card, and the management and control of the smart memory card can be realized through the above-mentioned process. For example, resources in the smart memory card are managed, identity authentication and permission granting of the smart memory card are performed.

In this embodiment, the formats of the command data packet and the response data packet are shown in Table 3.

name meaning Data field 1 Packet Type Identifier Data field 2 Protocol version number Data field 3 target type Data field 4 Command/response encoding information Data field 5 Packet Sequence Number Data field 6 The length of the data field Data field 7 data field

table 3

In Table 1, in addition to the necessary target type and encoding information, the command data packet and the response data packet can also include: data packet type identification, protocol version number corresponding to the data packet, serial number of the data packet, data field, the length of the data field of the data packet.

The data packet type identifier is used to indicate whether the application interface data packet is a command data packet or a response data packet, for example, 0x53AC can be used to indicate a command data packet, and 0xAC53 can be used to indicate a response data packet;

The protocol version number indicates the protocol version number followed by the application interface data packet. For example, 0x01 can be used to indicate the first version of the protocol, and the rest can be deduced by analogy;

The target type indicates the operation object of the application interface data packet. For example, 0x01 can be used to indicate that the operation object is a value-added application module in a smart card chip, 0x02 can indicate that the operation object is a physical storage medium, and the rest are reserved for extended object operations;

The command/response type encoding includes the encoding information of the command/response carried in the data field, which is used to decode the command/response; for example, if the encoding information in the command data packet is 0x0, the memory card controller can decode it according to 0x0 to obtain the expression Reset command; if the encoded information in the response data packet is 0, the terminal application program can decode it according to 0 to obtain a successful response; in fact, the encoded information in the above method can also be regarded as a command identifier, and the party that obtains the encoded information The corresponding command/response can be obtained according to the corresponding relationship between the preset coding information and the command/response;

The serial number of the data packet can occupy 4 bytes. For example, the first byte can be used to represent the sending month of the data packet, from 1 to 12 (decimal), and the second byte can represent the sending date of the data packet, from 1 to 31 ( Decimal system); the last two bytes represent the serial number sent on the day, from 0x0000 to 0xFFFF.

The length of the data field indicates the length of the data contained in the data packet. The maximum length of the data is 500 (decimal), and it is 0 if there is no data. If the length of the data field is not 0, the data field can carry relevant data of the command or response.

Hereinafter, various commands and their encoding information will be described in detail.

As mentioned above, in this embodiment, all commands can be divided into four categories according to the usage rights of the commands.

Among them, the first type of command is open to ordinary users; the second type of command is used for advanced applications and is limited to ordinary users; the third type of command is used for internal applications of smart memory card manufacturers, and is open to development organizations based on the software developed by the manufacturer itself ; The fourth type of command is used for the internal setting of the smart memory card manufacturer, and is limited to the internal use of the manufacturer.

In this way, this embodiment can control and manage the corresponding functions for the production, development, and user-level applications of the smart memory card.

In this embodiment, the first type of commands may include: a command to reset the smart memory card, a command to read the version information of the smart memory card, a command to send an application protocol data unit (APDU), and a command to read a common area in the physical storage medium commands, commands for writing common areas in physical storage media, commands for reading hidden areas in physical storage media, commands for writing hidden areas in physical storage media, and authentication request commands for authentication respectively.

Correspondingly, the encoding information of the first type of command may be as shown in Table 4.

Table 4

For the command to reset the smart memory card, the length of the data field in the command data packet is 0; in the corresponding response data packet, the response code information indicates whether the reset is successful, and the data field carries an identifier representing the reset response.

The smart memory card version information shown in Table 4 includes: product classification number, product version number, product serial number, encoding information of the manufacturer’s name, length of the manufacturer’s name, manufacturer’s name, and protocol version number, see Table 5 for details .

table 5

For the command to send APDU, the data carried in the data field is APDU. Wherein, the APDU may carry data for interacting with the network side to implement value-added applications. After the application program receives the response data packet with APDU in the data field sent by the smart memory card, it can transparently transmit the APDU to the network side; after receiving the APDU from the network side, it can carry the APDU in the coded information to indicate sending APDU command packets are sent to the smart memory card.

As mentioned above, because the value-added application module can realize the value-added application through the transparent transmission of the terminal equipment and the interaction with the network side in the way of the existing SIM card, and the interaction mode between the SIM and the network side can be realized by those skilled in the art. Therefore, relevant data related to the interaction in the APDU will not be described in detail herein.

For the command to read the common area and hidden area in the physical storage medium, the data field carries the address number; for the command to write the normal area and the hidden area in the physical storage medium, the data field carries the address number and the For details, see Table 6.

byte offset name meaning 0～3 address address number

4～509 data data to be written

Table 6

The commands for identity authentication can be divided into first-level authentication request commands, second-level authentication request commands, and third-level authentication request commands.

These three types of authentication request commands can use the same command encoding information as shown in Table 4, but carry different command identifiers in the data field respectively. Of course, different command encoding information can also be used, so that there is no need to carry in the data field Command ID.

The first level of certification, also known as simple certification, involves:

1a. The application program sets the encoding information in the command data packet as the command encoding information of the authentication request command, and uses the first-level authentication request (SimAuthRequire) command containing the feature information for identifying the identity of the user currently using the application program to carry sent to the smart memory card in the data field of the command packet;

1b. The memory card controller in the smart memory card matches the characteristic information in the command data packet with the characteristic information stored in the smart memory card, and carries the authentication result (SimAuthResult) information containing the matching result in the response data packet returned to the application in the data field. Certainly, in this step, the response encoding information of the response data packet may also be set as response encoding information indicating success, without carrying AuthResult information in the data field. If the feature information stored in the smart memory card is in the physical storage medium, the target operation object of the command packet carrying the SimAuthRequire command represents the physical storage medium; otherwise, it represents the value-added application module in the smart card chip.

Among them, the format of SimAuthRequire is shown in Table 7, which includes: the command identifier of SimAuthRequire, the length of SimAuthRequire, the session identifier (SessionID) identifying the current first-level authentication interaction, characteristic information (CharInfo), and the type of characteristic information (CharInfoCat ).

field length type Command ID for SimAuthRequire 2 bytes Integer The length of SimAuthRequire 2 bytes Integer SessionID 2 bytes Integer reserved text 2 bytes Integer Feature information 1 byte Integer type of feature information variable Integer/String

Table 7

In Table 7, the characteristic information type may at least include: a user name and a password, and a unique identifier of a smart memory card, represented by 0x00 and 0x01 respectively. The characteristic information is the information shared between the application program and the smart memory card, and the length is arbitrary.

The format of SimAuthResult is shown in Table 8, which includes: the response identifier of SimAuthResult, the length of SimAuthResult, the SessionID that identifies the current first-level authentication interaction, the failure reason when the authentication result (VerifyResult) fails, and whether to perform key negotiation Key agreement flag (KAFlag).

field length type Response ID 2 bytes Integer The length of the first-level certification result 2 bytes Integer SessionID 2 bytes Integer Reason for failure 2 bytes Integer Certification result 1 byte Integer key agreement identifier 1 byte Integer reserved text 2 bytes Integer

Table 8

The second level of certification, also known as limited certification, involves:

2a. The application program sets the encoding information in the command packet as the encoding information of the authentication request command, generates a 64-bit first random number, and carries the second-level authentication request (LimAuthRequire) command containing the first random number in the command sent to the smart memory card in the data field of the data packet;

2b. The memory card controller in the smart memory card uses the preset key seed to perform a hash (Hash) operation on the first random number to obtain the first Hash operation result, and will include the second-level authentication of the first Hash operation result The response (LimAuthResponse) is carried in the data field of the response packet and returned to the application program; if the preset key seed is stored in the physical storage medium, the target operation object of the command packet carrying the LimAuthRequire command represents the physical storage medium, otherwise it represents Value-added application modules in smart card chips;

2c. The application program uses the same key seed as that of the memory card controller to perform Hash operation on the first random number generated by it, and compares the obtained second Hash operation result with the first Hash operation result in the response data packet, If the two are the same, the second-level authentication result (LimAuthResult) indicating successful authentication is carried in the data field of the command packet and sent to the smart memory card.

Among them, the format of LimAuthRequire is shown in Table 9, which includes: the command identifier of LimAuthRequire, the length of LimAuthRequire, the SessionID identifying the current second-level authentication interaction, the Hash algorithm type identifier (HashAlgorithm), the Hash algorithm key length (HashKeyLen), The key (HashKey) of the Hash algorithm, the key seed identifier (SeedID), and the first random number.

field length type Command ID for LimAuthRequire 2 bytes Integer The length of LimAuthRequire 2 bytes Integer

SessionID 2 bytes Integer HashAlgorithm 4 bytes Integer HashKeyLen 2 bytes Integer HashKey variable Integer SeedID 2 bytes Integer The first random number 8 bytes Integer reserved text 2 bytes Integer

Table 9

The format of the LimAuthResponse is shown in Table 10, including: the response identifier of the LimAuthResponse, the length of the LimAuthResponse, the SessionID identifying the current second-level authentication interaction, the error reason when the Hash operation is wrong, the length of the first Hash operation result, and the first Hash operation result(HashVal).

field length type Response ID of LimAuthResponse 2 bytes Integer Length of LimAuthResponse 2 bytes Integer SessionID 2 bytes Integer wrong reason 2 bytes Integer The length of the first Hash operation result 2 bytes Integer HashVal variable Integer reserved text 2 bytes Integer

Table 10

Level 3 Certification, also known as Enhanced Certification, involves:

3a. The application program sets the coded information in the command data packet as the coded information of the authentication request command, and generates a second random number to carry in the data field of the command data packet together with the third-level authentication request (EnhAuthRequire) command and send it to the smart storage card;

3b. The memory card controller in the smart memory card generates a third random number, and performs an XOR operation on the third random number and the second random number in the command packet, and then uses the preset public key certificate in the smart memory card The corresponding private key digitally signs the XOR operation result; carries the third-level response (EnhAuthResponse) containing the public key certificate and digital signature in the data field of the response packet and returns it to the application; if the preset public key The certificate and its corresponding private key are stored in the physical storage medium, then the target operation object of the command packet carrying the EnhAuthRequire command represents the physical storage medium, otherwise it represents the value-added application module in the smart card chip;

3c. The application program uses the public key certificate in the response packet to verify the digital signature. If the verification is passed, the third-level authentication result (EnhAuthResult) that indicates successful authentication is carried in the data field of the command packet and sent to the smart memory card .

Wherein, the format of EnhAuthRequire is shown in Table 11, including: the command identifier of EnhAuthRequire, the length of EnhAuthRequire, the SessionID identifying the current third-level authentication interaction, and the second random number.

field length type Command ID for EnhAuthRequire 2 bytes Integer The length of EnhAuthRequire 2 bytes Integer SessionID 2 bytes Integer second random number 8 bytes Integer reserved text 2 bytes Integer

Table 11

The format of EnhAuthResponse is shown in Table 12, including: the response identifier of EnhAuthResponse, the length of EnhAuthResponse, the SessionID identifying the current third-level authentication interaction, the error reason when XOR operation or signature processing error, and the algorithm type identification of digital signature (SignAlgorithm ), the third random number, the digital signature length (SignLen), the digital signature (Signature), the public key certificate length (PKCertificateLen), and the public key certificate (PKCertificate).

field length type Response ID of EnhAuthResponse 2 bytes Integer The length of EnhAuthResponse 2 bytes Integer SessionID 2 bytes Integer wrong reason 2 bytes Integer Sign Algorithm 2 bytes Integer third random number 8 bytes Integer SignLen 2 bytes Integer

Signature variable Integer/String PKCertificateLen 2 bytes Integer PKCertificate variable Integer/String reserved text 2 bytes Integer

Table 12

The relationship between the above-mentioned levels of authentication may be shown in FIG. 4 . After the smart memory card starts to interact with the application program, the first type of commands can be used to realize common applications; after the first level of authentication, the second type of commands can be used to realize advanced applications, and the first type of commands can be used to realize common applications ; After passing the second-level certification, the third type of commands can be used to realize the internal application of the manufacturer and finally handed over to the card issuer for use. At the same time, the second type of commands can be used to achieve advanced applications, and the first type of commands can also be used to achieve common applications; After the third-level certification, the fourth type of command can be used to realize the manufacturer's internal application and be used by the manufacturer itself. At the same time, the third type of command can be used to realize the manufacturer's internal application and finally be used by the card issuer. The second type of command can also be used In order to realize advanced applications, the first type of commands can also be used to realize ordinary applications.

The processes of encryption and decryption, Hash operation, and key negotiation involved in the above-mentioned authentication levels at all levels can be realized by those skilled in the art, and will not be repeated here.

In this embodiment, a control register for recording read and write enable information of the physical storage medium may be set in the smart memory card. In this way, before using the decoded commands to perform corresponding operations on the physical storage medium, it may be determined whether the current command is allowed to perform read and write operations on the physical storage medium according to the read and write enable information recorded in the control register.

The flag bits representing the read-write enable information in the control register can be as shown in Table 13, including: general enable information indicating whether the physical storage medium is accessible, write enable information indicating whether the common area of the physical storage medium is writable , read enable information indicating whether the common area of the physical storage medium is readable.

Table 13

The second type of command in this embodiment is mainly aimed at the control register, and specifically includes: a command to read the control register, a command to write the control register, and the second type of command may also include a command indicating to send multiple APDUs at the same time.

For the command encoding information of the second type of command, see Table 14.

Table 14

In addition, in this embodiment, a special control register for recording download and pre-personalization enabling information may also be set in the smart memory card. In this way, before using the decoded command to perform corresponding operations on the selected operation object, it can be determined whether to allow downloading of application programs and/or whether to allow pre-personalization according to the download and pre-personalization enabling information recorded in the special control register. How to implement pre-personalization can be realized by those skilled in the art, and will not be repeated here.

Each flag bit representing the read-write enable information in the special control register may be as shown in Table 15.

Table 15

The third type of commands in this embodiment is mainly for special control registers, specifically including: commands for reading special control registers and commands for writing special control registers. For the command encoding information of the third type of command, see Table 16.

Table 16

The fourth type of commands in this embodiment include: commands for writing version information of smart memory cards, commands for testing smart memory cards, commands for initializing smart memory cards, commands for reading keys in smart key command. For the encoding information of the fourth type of command, see Table 17.

Table 17

Wherein, the command to test the smart memory card may be aimed at different test objects, and the test commands corresponding to different objects have different test command identifiers, see Table 18 for details.

Table 18

How to implement the loopback test can be realized by those skilled in the art, and will not be repeated here.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims (18)

1. the control method of an intelligent memory card comprises memory card controller and physical storage medium in the described intelligent memory card, it is characterized in that, also carries the valued added applications module that is used to realize valued added applications in the described intelligent memory card, and this method comprises:

Application program sends command packet, wherein carries the target type that is used for determining this command packet operand, is used for the command code information that memory card controller obtains order;

It is operand that memory card controller is selected physical storage medium or valued added applications module according to described target type, and described command code information decoding obtained corresponding order, the order that utilizes decoding to obtain is carried out corresponding operating to the operand of selecting, send the reply data bag to application program then, carry the whether successful encoding the response information of the described corresponding operating of expression in this reply data bag;

Wherein, described order is divided into four classes, is followed successively by first kind order, the second class order, the 3rd class order, the 4th class order from low to high according to its rights of using rank;

Utilize the second class order that the operand of selecting is carried out before the corresponding operating, this method further comprises: application program by with the first order authentication of intelligent memory card;

Utilize the 3rd class order that the operand of selecting is carried out before the corresponding operating, this method further comprises: application program by with the first order and the second level authentication of intelligent memory card;

Utilize the 4th class order that the operand of selecting is carried out before the corresponding operating, this method further comprises: application program by with the first order, the second level and the third level authentication of intelligent memory card.

2. the method for claim 1, it is characterized in that, further carry in the described command packet: be used to represent that the type of data packet of command packet identifies, is used to represent that sequence number, this command packet of the pairing protocol version of this command packet, this command packet are used to carry the data field of data, the data field length of this command packet;

Further carry in the described reply data bag: be used to represent that the type of data packet of reply data bag identifies, is used to represent the sequence number of the pairing protocol version of this reply data bag, this reply data bag, the data field of this reply data bag, the data field length of this reply data bag.

3. the method for claim 1 is characterized in that, is provided for writing down the authority register that passes through authentication grade in described intelligent memory card;

Utilize the four class orders of second class to that the operand of selecting is carried out before the corresponding operating, this method further comprises: memory card controller judges whether that according to the authentication grade that writes down in the authority register authority utilizes the current command that the operand of selecting is carried out corresponding operating.

4. method as claimed in claim 3, it is characterized in that described first kind order comprises: order, the order of reading the intelligent memory card version information, the order that sends Application Protocol Data Unit APDU, reading matter that intelligent memory card resets are managed the order of hidden area in the order of normal areas in the storage medium, the order of writing normal areas in the physical storage medium, the reading matter reason storage medium, the authentication request order of writing the order of hidden area in the physical storage medium and being respectively applied for authentication.

5. method as claimed in claim 4, it is characterized in that described intelligent memory card version information comprises: product classification number, Production Version, product ID, the coded message of manufacturer's title, the length of manufacturer's title, manufacturer's title, protocol version.

6. whether read-write method as claimed in claim 4 is characterized in that, in described intelligent memory card control register is set, wherein record physical storage medium enable information.

7. method as claimed in claim 4 is characterized in that, comprises the order of first order authentication request in the described authentication request order, and described first order authentication comprises:

Coded message in the application program command packet is set to the command code information of authentication request order, and will include the first order authentication request order of the characteristic information of the user identity that is used to discern current use application program, be carried in the data field of command packet and be sent to memory card controller;

Memory card controller mates the characteristic information of storing in characteristic information in the command packet and the intelligent memory card, and the first order authentication result that will include matching result is carried in the data field of reply data bag and returns to application program.

8. method as claimed in claim 7 is characterized in that,

Further comprise in the order of described first order authentication request: the length of the command id of first order authentication request order, the order of first order authentication request, the current first order of sign authenticate the mutual session identification and the type of characteristic information;

Further comprise in the described first order authentication result: whether the length of replying sign, first order authentication result of first order authentication result, mutual session identification, the failure cause when authentication result is failure, the expression of the current first order authentication of sign carry out the key agreement sign of key agreement.

9. method as claimed in claim 5 is characterized in that, comprises second level authentication request order in the described authentication request order, and the authentication of the described second level comprises:

Coded message in the application program command packet is set to the coded message of authentication request order, generate first random number, and the second level authentication request order that will include first random number is carried in the data field of command packet and is sent to memory card controller;

The default key seed of memory card controller utilization is carried out Hash Hash computing to first random number and is obtained a Hash operation result, and the second level authentication response that will include a Hash operation result is carried in the data field of reply data bag and returns to application program;

The application program utilization key seed identical with memory card controller carried out the Hash computing to first random number of its generation, and the 2nd Hash operation result that will obtain and the Hash operation result in the reply data bag compare, if the two is identical, the data field that the second level authentication result that then will represent authentication success is carried on command packet is sent to memory card controller.

10. method as claimed in claim 9 is characterized in that,

Further comprise in the authentication request order of the described second level: the length of the command id of second level authentication request order, second level authentication request order, mutual session identification, hash algorithm type identification, hash algorithm key length, the key of hash algorithm, the key seed sign of sign current second level authentication;

Further comprise in the authentication response of the described second level: the length of replying sign, second level authentication response of second level authentication response, the error reason when the current second level of sign authenticates mutual session identification, Hash operation mistake, the length of a Hash operation result.

11. method as claimed in claim 4 is characterized in that, comprises the order of third level authentication request in the described authentication request order, described third level authentication comprises:

Coded message in the application program command packet is set to the coded message of authentication request order, and generates second random number and be carried in the data field of command packet with the order of third level authentication request and be sent to memory card controller;

Memory card controller generates the 3rd random number, and second random number in the 3rd random number and the command packet is carried out XOR, utilizes the pairing private key of default public key certificate in the intelligent memory card that the XOR result is carried out digital signature then; The third level authentication response that will include described public key certificate and digital signature is carried in the data field of reply data bag and returns to application program;

Application program utilizes the public key certificate in the reply data bag that digital signature is verified, if the verification passes, the data field that the third level authentication result that then will represent authentication success is carried on command packet is sent to memory card controller.

12. method as claimed in claim 11 is characterized in that,

Further comprise in the order of described third level authentication request: the length of the command id of third level authentication request order, the order of third level authentication request, the mutual session identification of the current third level authentication of sign;

Further comprise in the described third level authentication response: the length of replying sign, third level authentication response of third level authentication response, error reason, the algorithm types sign of digital signature, the 3rd random number, digital signature length, public key certificate length when mutual session identification, XOR or the signature of the current third level authentication of sign handled mistake.

13. method as claimed in claim 3 is characterized in that, is provided for writing down the control register of physical storage medium read-write enable information in described intelligent memory card;

The order that utilizing decodes obtains is carried out before the corresponding operating to physical storage medium, this method further comprises: memory card controller judges whether to allow to utilize the current command that physical storage medium is carried out read-write operation according to the read-write enable information that writes down in the control register.

14. method as claimed in claim 13, it is characterized in that described enable information comprises: the expression physical storage medium whether the normal areas of addressable general enable information, expression physical storage medium whether can write the normal areas of writing enable information, expression physical storage medium whether readable read enable information.

15. method as claimed in claim 13 is characterized in that, the described second class order comprises: the order of read control register, the order of write control register, expression send the order of a plurality of Application Protocol Data Unit APDU simultaneously.

16. method as claimed in claim 3 is characterized in that, is provided for writing down the special control register of downloading and individualizing enable information in advance in described intelligent memory card;

The order that utilizing decodes obtains is carried out before the corresponding operating to the operand of selecting, this method further comprises: whether memory card controller judges whether to allow the down load application program and/or allows pre-individualized according to download of writing down in the special control register and pre-individualized enable information.

17. method as claimed in claim 16 is characterized in that, described the 3rd class order comprises: read special control register order, write the order of special control register.

18. method as claimed in claim 3, it is characterized in that described the 4th class order comprises: write the intelligent memory card version information order, test intelligent memory card order, initialization intelligent memory card order, read key in the intelligent memory card order, write the order of key in the intelligent memory card.

Images