CN103455349B - Method and device for application program to access smart card - Google Patents

Abstract

The present invention provides the method and apparatus that a kind of application program accesses smart card, the method includes: Agent reception application program is by calling the operational order that opening API interface function sends, and described opening API interface function is formed by the standard APDU instruction encapsulation corresponding with described operational order；Operation information in described operational order is added in the standard APDU instruction corresponding with described opening API interface function by Agent, and the instruction of this standard APDU is sent to smart card, so that described smart card operates according to the instruction of described standard APDU.Its operational order is sent to Agent by the opening API interface function that application program only needs to call Agent and provides, it is automatically performed the application program access to smart card by Agent, greatly reduces the development difficulty of the Capability Requirement to developer and application program.

Description

Method and device for application program to access smart card

technical field

The invention belongs to the technical field of communication, and in particular relates to a method and a device for an application program to access a smart card.

Background technique

With the enhancement of smart card processing capabilities, the expansion of storage space and the development of mobile value-added services, smart cards are no longer only used as access authentication modules for mobile communication networks, but can provide relevant storage for applications such as mobile payment and short-distance communication. , authentication and other functions.

At present, many smart phones use the Android system platform. When third-party Android application developers develop new value-added service applications or upgrade and improve existing value-added services, they need to interact with the smart card to call the smart card. The application block (applet) related to the value-added service application completes the corresponding storage, update and other processing. In order to enable Android applications to interact with related Applets in smart cards, the SIM Card Alliance has proposed the OpenMobile API standard. According to the interface defined by this standard, Android applications can send standard applications through the standard Android API functions that interact with smart cards. The protocol data unit (Application Protocol data unit, hereinafter referred to as APDU) command calls the relevant Applet to realize the interaction with the smart card.

However, in the above solution, if the developer wants to realize the interaction between his Android application program and the smart card, he needs to know the interaction process and data format definition of the standard APDU command involved in the interaction with the smart card. In addition, since different terminal manufacturers have different implementations of the above-mentioned Open Mobile API standards, developers need to understand the specific implementation methods of different manufacturers in order to adapt their applications to terminal devices. Requirements greatly increase the difficulty of application development.

Contents of the invention

Aiming at the problems existing in the prior art, the present invention provides a method and device for an application program to access a smart card, so as to overcome the inconvenience caused by calling the Applet related to the application program in the smart card through the standard Android API function in the prior art. Defects with high requirements and difficult application development.

The invention provides a method for an application program to access a smart card, comprising:

The agent program receives the operation instruction sent by the application program by calling the open API interface function, and the open API interface function is encapsulated by a standard APDU instruction corresponding to the operation instruction;

The agent program adds the operation information in the operation instruction to the standard APDU instruction corresponding to the open API interface function, and sends the standard APDU instruction to the smart card, so that the smart card operates according to the standard APDU instruction .

The invention provides a device for an application program to access a smart card, comprising:

The receiving module is used to receive the operation instruction sent by the application program by calling the open API interface function provided by the agent program, and the open API interface function is encapsulated by the standard APDU instruction corresponding to the operation instruction;

A sending module, configured to add the operation information in the operation instruction to the standard APDU instruction corresponding to the open API interface function, and send the standard APDU instruction to the smart card, so that the smart card can transmit the information according to the standard APDU command to operate.

In the method and device for accessing smart cards by application programs provided by the present invention, an agent program is embedded in an Android terminal, and the agent program encapsulates the standard APDU instructions corresponding to the operation instructions of the application program into an open API called by the application program. Interface function, so that when the application program needs to access the smart card, it only needs to call the API interface function it needs from the open API interface function provided by the agent program to send its operation instructions to the agent program, and the agent program will read the information from the operation instructions The obtained operation information is added to the standard APDU command corresponding to the API interface function, and the standard APDU command is sent to the smart card, so that the application program does not need to know the standard APDU command required to access the smart card and the format definition of the standard APDU command , the agent program automatically completes the access of the application program to the smart card, which greatly reduces the ability requirements of the developer and the difficulty of developing the application program.

Description of drawings

Fig. 1 is the flow chart of Embodiment 1 of the method for accessing the smart card by the application program of the present invention;

Fig. 2 is the flowchart of Embodiment 2 of the method for accessing the smart card by the application program of the present invention;

FIG. 3 is a schematic diagram of Embodiment 1 of a device for accessing a smart card by an application program of the present invention;

FIG. 4 is a schematic diagram of Embodiment 2 of the device for accessing a smart card by an application program in the present invention.

detailed description

Fig. 1 is a flow chart of Embodiment 1 of the method for accessing a smart card by an application program of the present invention. As shown in Fig. 1 , the method for accessing a smart card by an application program provided in this embodiment is especially suitable for a scenario where a third-party Android application program needs to access a smart card. The smart card is specifically carried in terminal devices with an Android system such as smart phones, palmtop computers, and tablet computers. The smart card includes various application program blocks (applets) placed by operators, such as storage, computing, etc., and Android applications During the development of the program, it is necessary to access these Applets in the smart card to complete corresponding operations. In order to realize the access to the Applet in the smart card, it is necessary to use the standard APDU command compatible with the smart card to complete the interaction with the smart card. In the prior art, the Android application developer needs to know which standard APDU instructions and the format definition of each standard APDU instruction to use in order to complete its operation, so as to construct its operation information into a standard APDU instruction, and then send it to the smart card. The solution provided by the embodiment is to introduce an agent program in the terminal device, and the agent program will encapsulate the standard APDU instructions required to complete the operation of the application program into an open API interface function for the application program to call, because the open API interface The versatility of the function facilitates the development work of the application program developer, and the agent program completes the interaction with the standard APDU command of the smart card on its behalf.

The method for an application program accessing a smart card provided in this embodiment specifically includes:

Step 101, the agent program receives the operation instruction sent by the application program by calling the open API interface function, and the open API interface function is encapsulated by a standard APDU instruction corresponding to the operation instruction;

In this embodiment, the operator can insert an agent program in the terminal device using the Android system. The agent program can pre-define multiple card access operations according to the smart card access operations generally performed by the application program, such as adding, reading, updating, and deleting. An open API interface function that can be called by a third-party Android application program, such as add function, read function, update function, delete function, etc., and encapsulate the corresponding standard APDU instructions required to complete the access to the smart card in the open API interface function Among them, for example, if the standard APDU instructions needed to complete the update operation include: channel establishment instructions, data processing instructions, and channel closing instructions, then the update function provided by the agent program encapsulates these three standard APDU instructions.

Specifically, when the application program needs to access the smart card, the application program will send its operation instruction to the agent program by calling the corresponding open API interface function. Specifically, each open API interface function can be identified by a function name, so that the application program can call the interface function suitable for its operation instruction.

Step 102, the agent program adds the operation information in the operation instruction to the standard APDU instruction corresponding to the open API interface function, and sends the standard APDU instruction to the smart card, so that the smart card can be processed according to the standard APDU command to operate.

Specifically, after the agent program receives the operation instruction sent by the application program by calling the open API interface function, it will extract and obtain the operation information of the operation instruction from the operation instruction, such as operation type, data content, etc., and store the operation information Adding to the standard APDU instruction corresponding to the open API interface function called is equivalent to writing the required parameter information to the standard APDU instruction, and then sending the standard APDU instruction added into the operation information to the smart card, so that The smart card can complete corresponding operations according to the standard APDU command.

The application program access smart card method provided in this embodiment, by introducing an agent program in the Android terminal device, the agent program encapsulates the standard APDU instruction corresponding to the operation instruction of the application program, and encapsulates it into an open API interface for the application program to call Function, so that when the application needs to access the smart card, it only needs to send its operation instructions to the agent program by calling the open API interface function, and the agent program automatically uses the standard APDU instruction corresponding to the called open API interface function. The access of the application program to the smart card is completed, so that the application program does not need to know the standard APDU instruction required to access the smart card and the format definition of the standard APDU instruction, which greatly reduces the ability requirements for developers and the development difficulty of application programs.

Fig. 2 is the flowchart of the second embodiment of the method for accessing the smart card by the application program of the present invention. As shown in Fig. 2, the method includes:

Step 201, the terminal access control program authenticates the agent program according to the access control file in the smart card to determine whether the agent program can access the smart card. Describe the read-only file of the identity information of the agent program, if the authentication is passed, then execute step 202, otherwise, end;

In this embodiment, the agent program is a special application program in the terminal device and outside the smart card. In order to ensure the security of the smart card access, it is generally necessary to authenticate the agent program to determine whether the agent program is placed by the operator. Legal agency.

The authentication of the agent program adopts a scheme similar to that of the third-party application program in the prior art, which is briefly introduced as follows:

When the operator presets the agent program in the terminal device, an access control file (Access Rule File, hereinafter referred to as ARF) corresponding to the agent program is created in the smart card. The access control file is a read-only file. It internally stores the identity information of the legitimate agent program placed by the operator, and the identity information may be, for example, the package name and digital digest signature of the agent program.

In the prior art, the authentication of the application program is performed through the terminal access control program in the terminal device, and the authentication of the application program is started when the application program is initialized. In this embodiment, the authentication of the agent program is also performed by the terminal access control program, which authenticates the agent program according to the access control file in the smart card to determine whether the agent program can access smart card. Specifically, the terminal access control program obtains the identification information of the agent program; the terminal access control program determines whether the agent program identity information in the access control file is consistent with the identification information, and if they are consistent, the agent program can access smart card.

Because in the prior art, each application program has an ARF corresponding to one of them in the smart card, since the ARF cannot be modified, whenever there is a new application program, it is necessary to add the corresponding ARF of the application program in the smart card. The ARF is inconvenient to operate and takes up too many smart card resources. In this application, ideally, the operator only needs to set up an agent program for the terminal device with the Android system. Correspondingly, in the smart card, only one ARF needs to be created to complete the authentication of the agent program.

Step 202, the agent program receives the operation instruction sent by the application program by calling the open API interface function, and the open API interface function is encapsulated by a standard APDU instruction corresponding to the operation instruction;

Step 203, the agent program calls the access control program block in the smart card to authenticate the application program, and the access control program block is a readable and writable application program block pre-installed in the smart card that contains authorized application program permission information, If the authentication is passed, then execute step 204, otherwise, end;

In this embodiment, the authentication of the application program is performed through an access control program block preset in the smart card by the operator. The access control program block stores the permission information of all applications authorized by the operator. In addition, because the access control program block allows read and write operations, when a new application program is authorized to access the smart card, the operator It is only necessary to add permission information of the new application program in the program block.

Specifically, the authorized application permission information includes:

The identity information of the authorized application, the smart card application block information corresponding to the identity information, and the access type information corresponding to the smart card application block information.

In this embodiment, the identity information of the authorized application program may be, for example, a package name and a digital abstract signature of the application program. In fact, when the application program accesses the smart card, it means accessing the smart card application program block. The smart card application program block exists in the smart card and is an execution function unit that completes the operations required by the application program. The smart card application program block can, for example, complete data update, A program block for operations such as deletion, the smart card application block information includes, for example, a smart card application block identifier. The access type information may be update, delete, etc., for example.

Specifically, the agent program calls the access control program block in the smart card to authenticate the application program, including:

The agent program sends the authentication information obtained from the operation instruction to the access control program block, and the authentication information includes the identification information of the application program, the operation type and the identifier of the smart card application program block to be accessed;

The access control program block determines whether the identity information of the authorized application program includes the identification information of the application program, so as to determine the legality of the identity of the application program;

If legal, the access control program block determines whether the smart card application block information corresponding to the identity information contains the smart card application block identifier to be accessed, so as to determine the legitimacy of the application program access;

If it is legal, the access control program block determines whether the access type information corresponding to the smart card application program block information contains the operation type, so as to determine the legality of the operation of the application program.

It can be known from the above authentication process for the application program that in this embodiment, the application program is authenticated in a layer-by-layer manner. Firstly, the identity legality of the application program is authenticated. Only after the identity legality passes the authentication, will it trigger the authentication of whether the application program can access the application program block in the smart card, that is, to determine whether the application program block in the access control program block is compatible with the application program Whether the smart card application block information corresponding to the program identity information contains the smart card application block identifier carried in the application operation command, and only if the access legitimacy is passed, the authentication of the operation legitimacy is performed. In this authentication method, when the previous authentication is invalid, subsequent authentication is not required, which is beneficial to improve authentication processing efficiency.

Step 204, the agent program obtains the operation information from the operation instruction according to the function form described by the open API interface function, and the operation information includes control domain information and data domain information, wherein the control domain information includes Contains the smart card application block identifier;

Step 205, the agent program adds the control domain information and data domain information to the standard APDU instruction corresponding to the open API interface function, and sends the standard APDU instruction to the smart card corresponding to the smart card application block identifier an application program block, so that the smart card application program block operates according to the standard APDU instruction.

In this embodiment, after the application program is authenticated, the agent program will execute the process of the application program accessing the smart card. Specifically, the agent program obtains the operation information from the received operation instruction according to the function form described by the open API interface function called by the application program, and the operation information includes control domain information and data domain information, wherein the control domain information Contains the smart card application block identifier. Afterwards, the agent program adds the control field information and the data field information to the standard APDU instruction corresponding to the open API interface function, and sends the standard APDU instruction adding operation information to the smart card application block identifier The smart card application program block corresponding to the symbol, so that the smart card application program block operates according to the standard APDU instruction.

The application program that present embodiment provides accesses the method for smart card, and application program only needs to call the open API interface function provided by agent program to send its operation instruction to agent program, and complete this application program to the access of smart card application block by agent program, greatly It reduces the ability requirements for developers and the difficulty of application development; only the access control file corresponding to the agent program needs to be created in the smart card, which greatly saves the occupation of resources such as the storage space of the smart card by the access control file; it can be read through the smart card The written access control program block is used to complete the authentication of the application program, which not only overcomes the resource occupation problem of the smart card caused by the form of the access control file, but also greatly improves the processing efficiency of the application program authentication.

Fig. 3 is a schematic diagram of Embodiment 1 of a device for accessing a smart card by an application program of the present invention. As shown in Fig. 3, the device includes:

The receiving module 11 is used to receive the operation instruction sent by the application program by calling the open API interface function provided by the agent program, and the open API interface function is encapsulated by the standard APDU instruction corresponding to the operation instruction;

The sending module 12 is used to add the operation information in the operation instruction to the standard APDU instruction corresponding to the open API interface function, and send the standard APDU instruction to the smart card, so that the smart card according to the standard APDU command to operate.

The device of this embodiment can be used to execute the technical solution of the method embodiment shown in FIG. 1 , and its implementation principle and technical effect are similar, and details are not repeated here.

Fig. 4 is a schematic diagram of the second embodiment of the device for accessing the smart card by the application program of the present invention. As shown in Fig. 4, the device is based on the embodiment shown in Fig. 3, and the sending module 12 includes:

The obtaining unit 121 is configured to obtain the operation information from the operation instruction according to the function form described by the open API interface function, the operation information includes control field information and data field information, wherein the control field information contains the smart card application block identifier;

The adding unit 122 is used to add the control field information and data field information to the standard APDU instruction corresponding to the open API interface function, and send the standard APDU instruction to the smart card application block identifier corresponding to the A smart card application program block, so that the smart card application program block operates according to the standard APDU instruction.

Further, the device also includes:

The first authentication module 21 is configured to authenticate the agent program according to the access control file in the smart card, to determine whether the agent program can access the smart card, and the access control file is pre-installed in the smart card A read-only file containing the identity information of the agent in question;

The first authentication module 21 authenticates the agent program according to the access control file in the smart card to determine whether the agent program can access the smart card, including:

The first authentication module 21 obtains the identification information of the agent program;

The first authentication module 21 determines whether the identity information of the agent program in the access control file is consistent with the identification information, and if they are consistent, the agent program can access the smart card.

Further, the device also includes:

The second authentication module 22 is used to call the access control program block in the smart card to authenticate the application program. application block;

Wherein, the authorized application permission information includes:

Identity information of an authorized application, smart card application block information corresponding to the identity information, and access type information corresponding to the smart card application block information;

The second authentication module 22 calls the access control program block in the smart card to authenticate the application program, including:

The second authentication module 22 sends the authentication information obtained from the operation instruction to the access control program block, and the authentication information includes the identification information of the application program, the operation type and the smart card application program to be accessed block identifier;

The access control program block determines whether the identity information of the authorized application program includes the identification information of the application program, so as to determine the legality of the identity of the application program;

If it is legal, the access control program determines whether the smart card application block information corresponding to the identity information contains the smart card application block identifier to be accessed, so as to determine the legitimacy of the application;

If it is legal, the access control program determines whether the access type information corresponding to the smart card application program block contains the operation type, so as to determine the operation validity of the application program.

The device in this embodiment can be used to implement the technical solution of the method embodiment shown in FIG. 2 , and its implementation principle and technical effect are similar, and details are not repeated here.

Those of ordinary skill in the art can understand that all or part of the steps for realizing the above-mentioned method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the It includes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other various media that can store program codes.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than limiting them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: It is still possible to modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the technical solutions of the various embodiments of the present invention. scope.

Claims (8)

1. the method that an application program accesses smart card, it is characterised in that including:

Agent receives application program by calling the operational order that opening API interface function sends, institute State opening API interface function to be formed by the standard APDU instruction encapsulation corresponding with described operational order；

Operation information in described operational order is added to and described opening API interface function by Agent In corresponding standard APDU instruction, and the instruction of this standard APDU is sent to smart card, so that described Smart card operates according to the instruction of described standard APDU；

Operation information in described operational order is added to and described opening API interface by described Agent In the standard APDU instruction that function is corresponding, and the instruction of this standard APDU is sent to smart card, so that Described smart card operates according to the instruction of described standard APDU, including:

Agent, according to the functional form described by described opening API interface function, refers to from described operation Obtaining described operation information in order, described operation information includes controlling domain information and data domain information, wherein Described control domain information comprises application program of intelligent card block identifier；

Agent adds described control domain information and data domain information to described opening API interface function In corresponding standard APDU instruction, and the instruction of this standard APDU is sent to and described application of IC cards The application program of intelligent card block that brick identifier is corresponding, so that described application program of intelligent card tuber is according to institute State the instruction of standard APDU to operate.

Method the most according to claim 1, it is characterised in that described Agent receives application journey Before sequence is by calling the operational order that opening API interface function sends, also include:

Terminal access controls program and reflects described Agent according to the access control file in smart card Power, to determine whether described Agent is able to access that smart card, described access controls file for insert in advance The read-only file comprising described Agent identity information in described smart card.

Method the most according to claim 2, it is characterised in that described terminal access controls program root Control file according to the access in smart card described Agent to be authenticated, to determine described Agent Whether it is able to access that smart card, including:

Terminal access controls program and obtains the identification information of described Agent；

Terminal access controls program and determines that the described Agent identity information controlled in file that accesses is with described Identification information is the most consistent, if unanimously, the most described Agent is able to access that smart card.

Method the most according to claim 1, it is characterised in that described Agent is by described operation Operation information in instruction adds the standard APDU instruction corresponding with described opening API interface function to In, and the instruction of this standard APDU is sent to smart card, so that described smart card is according to described standard Before APDU instruction operates, also include:

Described application program is authenticated by the access control program block that Agent calls in smart card, institute State access control program block be pre-insert in smart card comprise the readable of authorized applications authority information Write application blocks.

Method the most according to claim 4, it is characterised in that the described authority of authorized applications Information includes:

The application program of intelligent card block that the identity information of authorized applications is corresponding with described identity information Information and the access type information corresponding with described application program of intelligent card block message；

Described application program is reflected by the access control program block that described Agent calls in smart card Power, including:

The authentication information obtained from described operational order is sent to described access control program by Agent Block, described authentication information includes the identification information of described application program, action type and intelligence to be visited Card application block identifier；

Described access control program block determine described in authorized applications identity information in whether comprise institute State the identification information of application program, to determine the identity legitimacy of described application program；

If legal, the most described access control program block determines the application of IC cards corresponding with described identity information Whether brick information comprises described application program of intelligent card block identifier to be visited, described to determine The access legitimacy of application program；

If legal, the most described access control program block determines corresponding with described application program of intelligent card block message Access type information in whether comprise described action type, legal to determine the operation of described application program Property.

6. the device of an application program access smart card, it is characterised in that including: receiver module, use Refer in the operation receiving the opening API interface function transmission that application program provides by calling Agent Order, described opening API interface function is by the standard APDU instruction encapsulation corresponding with described operational order Form；

Sending module, connects with described opening API for the operation information in described operational order being added to In the standard APDU instruction that mouth function is corresponding, and the instruction of this standard APDU is sent to smart card, with Described smart card is made to operate according to the instruction of described standard APDU；

Described sending module includes:

Acquiring unit, for according to the functional form described by described opening API interface function, from described Obtaining described operation information in operational order, described operation information includes controlling domain information and data domain information, Wherein said control domain information comprises application program of intelligent card block identifier；

Adding device, connects for adding described control domain information and data domain information to described opening API In the standard APDU instruction that mouth function is corresponding, and the instruction of this standard APDU is sent to and described intelligence The application program of intelligent card block that card application block identifier is corresponding, so that described application program of intelligent card block Operate according to the instruction of described standard APDU.

Device the most according to claim 6, it is characterised in that also include:

First authentication module, is carried out described Agent for controlling file according to the access in smart card Authentication, to determine whether described Agent is able to access that smart card, it is preset that described access controls file Enter the read-only file comprising described Agent identity information in described smart card；

Described first authentication module controls file according to the access in smart card and reflects described Agent Power, to determine whether described Agent is able to access that smart card, including:

First authentication module obtains the identification information of described Agent；

First authentication module determines the described Agent identity information and described mark accessing and controlling in file Information is the most consistent, if unanimously, the most described Agent is able to access that smart card.

Device the most according to claim 6, it is characterised in that also include:

Second authentication module, enters described application program for the access control program block called in smart card Row authentication, described access control program block be pre-insert in smart card comprise authorized applications authority The read-write application blocks of information；

Wherein, the described authority information of authorized applications includes:

The application program of intelligent card block that the identity information of authorized applications is corresponding with described identity information Information and the access type information corresponding with described application program of intelligent card block message；

Described application program is carried out by the access control program block that described second authentication module is called in smart card Authentication, including:

The authentication information obtained from described operational order is sent to described access and controls by the second authentication module Brick, described authentication information includes the identification information of described application program, action type and to be visited Application program of intelligent card block identifier；

Described access control program block determine described in authorized applications identity information in whether comprise institute State the identification information of application program, to determine the identity legitimacy of described application program；

If legal, the most described access control program determines the application of IC cards journey corresponding with described identity information Whether sequence block message comprises described application program of intelligent card block identifier to be visited, to determine described answering By the access legitimacy of program；

If legal, the most described access control program determines the access corresponding with described application program of intelligent card block Whether type information comprises described action type, to determine the operation validity of described application program.