WO2010000131A1 - Smart card, terminal processing for supporting web service system and realizing method thereof - Google Patents

Abstract

A smart card (30), a terminal processing system and a realizing thereof. The smart card (30) comprises an application logic unit (306) which stores the corresponding data information, and a web server (304) which stores the logic program for the smart card application and accesses the application logic unit (306). The terminal processing system at least comprises a terminal operating system (20) and a smart card (30), in which the terminal operating system (20) sets a web browser (202), uses the web browser (202) and the web server (304) to communicate, in order to realize the web service for the smart card application. The terminal processing system has the web browser (202) and the web server (304), so it can perform web communication between the terminal operating system (20) and the smart card (30), and the terminal operating system (20) only provides logic display of application interface, input and output and online function etc. This invention greatly enhances the expansion capacity and portability of the entire terminal processing system, and improves the security, openness and maintainability of system.

Description

 TECHNICAL FIELD The present invention relates to the field of smart card web applications and information security technologies, and in particular, to a smart card including a web server and a terminal for web communication, and an embedded Web server and web browser and implement terminal processing system for web services. Background technique

Currently, people often carry a number of bank cards when they travel to avoid the inconvenience and potential security problems caused by cash business. With the lack of security in the existing magnetic stripe cards, banks at home and abroad are gradually pushing smart cards to replace magnetic stripe cards. In general, a smart card is a plastic card that contains an embedded integrated circuit (IC) that contains a tiny central processing unit (CPU), read-only memory, read-write memory, and other peripheral circuitry. The integrated circuit has similar capabilities to a computer, such as: running programs, processing input and output data. When using the financial smart card, it is necessary to provide power and other interface devices from the outside. For an IC card (usually referred to as a CPU card), the realization of "one card multi-use" is an urgent development direction. The so-called "one card multi-use" means that there are multiple applications on the same smart card, such as e-wallet application, debit Goods applications, rapid transit applications (such as transportation cards for public transport, rental and subway) and social security applications (such as social security cards). The existing IC card operating system generally follows the directory and file mode based on the IS07816 standard, as shown in FIG. Part 1-7 of ISO 7816, as defined by the International Organization for Standardization, specifies a set of standards covering all aspects of the CPU card. ISO7816 includes: physical characteristics, size and contact locations, electronic signals and transmission protocols, inter-industry exchange instructions, application identifiers, inter-industry data elements, and inter-industry SCQL instructions. Figure 1 shows the storage mechanism of a smart card based on the ISO7816 standard on application data. The CPU card generally includes file types such as a main file MF (Master File), a dedicated file DF (Dedicated File), and a basic data file EF. The card's dedicated file DF and the basic data file EF present a tree structure. The main file MF is the root directory, which is the root of the smart card file system, which is equivalent to the root directory of DOS, and each card has one and only one MF file; the special file DF is equivalent to a subdirectory of DOS, and can be further divided into ADF and DDF, where DDF is the DF containing the subordinate directory, and ADF is the DF that does not contain the subordinate directory. For existing IC cards, please confirm this The implementation is achieved by creating multiple ADFs. Each ADF represents an application, such as Application 1, Application 2, and Application n. There is a corresponding file under each ADF, and the corresponding file stores the corresponding data. Existing terminal smart cards are all in the form of security information services. Only through the development of specialized terminals (such as POS machines of financial terminals or mobile phones of mobile terminals) can a complete application be realized, and smart cards and terminals conform to IS〇. ⁷⁸ 16 standard commands for communication. To further illustrate the communication process between the terminal and the terminal smart card, FIG. 2 is a schematic diagram of communication between the terminal operating system and the terminal smart card using the POS terminal as an example in the prior art. Referring to FIG. 2, at least the terminal operating system 100 and the terminal smart card 102 are included in the POS terminal. The terminal operating system 100 includes an application logic unit 104, which is substantially a terminal processing program in the terminal operating system 100, and includes information such as a user's bank card account number and password, an account opening name, and an available balance. The terminal smart card 102 includes security. Information service 106, which is the material basis for the terminal smart card 102 to display the terminal application logic unit 104. The ISO7816/ISO 14443 standard is used for communication between the terminal operating system 100 and the terminal smart card 102. However, it can be known from the communication process described in FIG. 2 that the application development of the terminal smart card is distributed in the smart card and the terminal, and the development cycle is very long. Simply developing the smart card or developing the terminal may cause the corresponding terminal or smart card to be unapplied. Poor portability. In addition, the security mechanism of the smart card application is implemented by both the smart card and the terminal, and the security of the application system as a whole is lowered due to the lower security of the application logic unit on the terminal. SUMMARY OF THE INVENTION The present invention provides a terminal smart card based on the HTTP protocol for the above-mentioned drawbacks of the terminal smart card application in the prior art. Because it uses the HTTP protocol in Web technology, it is often called WebCard. In view of the above drawbacks of the smart card application in the prior art, the present invention provides a terminal processing system and an implementation method for supporting a Web service. According to an aspect of the present invention, a smart card is provided, wherein the smart card has at least: an application logic unit for saving a phase of a smart card application in a card application container of the smart card Off data information; and

a web server, configured to store a logic program of the smart card application, to access the application logic unit, where the service provided by the application in the application logic unit and the corresponding web service for the terminal application accept the terminal operation together System request service. The web server includes at least a web service interpretation layer, a web service communication management layer, a web service symptom container, and a web service application programming interface. Further, the web service interpretation layer invokes the web service application container, and sends the corresponding HTML script file in the web service application container to the terminal operating system for logical display through the web service communication management layer. Among them, the Web service communication management layer supports the ISO7816/ISO14443 protocol and the HTTP protocol loaded on ISO7816/ISO14443. Preferably, the web service communication management layer can directly support one of the HTTP protocol, the TCP/IP protocol, the USB protocol, or a combination thereof. The card application container and the web service application container are in different logical storage areas. Specifically, the physical storage carrier of the card application container is typically manufactured by an EEPROM process, and the physical storage carrier of the web service application container is typically manufactured by the FLASH process. In addition, the web service application container accesses the application logic unit in one direction through the web service application programming interface. The application logic unit may include an e-wallet application conforming to the regulations of the People's Bank of China, a debit-keeping application conforming to the regulations of the People's Bank of China, a fast traffic application, a social security application, and other industry applications. According to another aspect of the present invention, a terminal processing system in a smart card application is provided, the terminal processing system has at least one terminal operating system, and a smart card, wherein a web browser is set in the terminal operating system; and the smart card is At least: an application logic unit, configured to save related data information of the smart card application in a card application container of the smart card; and a web server, configured to store a logic program of the smart card application, to access the application logic unit, where The service provided by the application in the application logic unit and the corresponding web service for the terminal application accept the request service of the terminal operating system. The terminal operating system may be a POS or ATM terminal of a financial terminal or a mobile terminal in a wireless communication system. The web service interpretation layer invokes the web service application container, and sends a corresponding HTML script file in the web service application container to the terminal operating system for logical display. And, the terminal operating system logically displays the smart card application through the web browser. According to a third aspect of the present invention, an implementation method for supporting a web application service in a terminal processing system is provided. The terminal processing system includes at least one terminal operating system and a smart card, and the implementation method includes: Setting a web browser; storing an application logic unit in a card application container of the smart card; setting a web server in the smart card; and communicating with the web server by using the web browser to implement a smart card application Web service. The web browser determines whether it is a remote request or a local request according to the received URL request, and when the URL request is a remote request, the web browser communicates with the remote web server; when the URL request is a local request, and When the port number of the local request is sent as the port number of the smart card, communication is established between the web browser and the web server of the smart card. Wherein, when the URL request is a local request, and the port number of the local request is not the port number of the smart card, the other port agent is queried. The web server includes at least a web service interpretation layer, a web service communication management layer, a web service application container, and a web service application programming interface. Further, the web service interpretation layer invokes the web service application container, and sends a corresponding HTML script file in the web service application container to a web browser of the terminal operating system for logical display. The Web application application container accesses the application logic unit through the Web service application programming interface. The smart card, the terminal processing system and the implementation method thereof of the present invention have an application logic unit migrated from the terminal operating system in the smart card, and a web server is built in the smart card, and the terminal operating system is built in the terminal operating system Web browser, so web communication can be performed between the terminal operating system and the smart card, and the terminal operating system only needs to provide logic display and input of the application interface. Output and online functions greatly enhance the scalability and portability of the entire terminal processing system, and also improve the security, openness and maintainability of the system. BRIEF DESCRIPTION OF THE DRAWINGS [0007] Various aspects of the invention will be apparent from the Detailed Description of the Drawing. 1 shows an architectural diagram of storing application data on a smart card based on the IS07816 standard directory and file mode. FIG. 2 shows a communication between a terminal operating system and a terminal smart card using a POS terminal as an example in the prior art. FIG. 3 is a schematic diagram of communication between a terminal smart card and a terminal operating system based on the HTTP protocol according to the present invention, taking a POS terminal as an example; FIG. 4 shows a web service application container accessing a smart card through a web service application programming interface. A schematic diagram of an application container; and FIG. 5 is a flow chart showing the processing of a received URL request by a web browser in a terminal operating system. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Before explaining the specific embodiments of the present invention in detail, the communication mechanism between the smart card and the terminal in the prior art will be further understood by referring to FIG. 2 again. Those skilled in the art should understand that the terminal herein may be not only a financial terminal POS, but also a mobile terminal or an ATM terminal. Taking the electronic wallet of a typical application of a smart card as an example, the entire consumption process mainly involves a user card and a POS terminal. First, the POS terminal selects the e-wallet application in the application logic unit through the terminal operating system, and then accesses and retrieves some data in the security information service of the terminal smart card through the interface of ISO7816/ISO 14443 to identify or authenticate the user card. legality. When the dedicated Application Protocol Data Unit (APDU) command is sent, the consumption of the electronic wallet is completed. In this process, the POS terminal plays a very important role, and the terminal smart card only uses its security letter. In the technology, the structure of the terminal operating system and the terminal smart card in the POS terminal is not difficult to see. All aspects of the development, deployment, operation and maintenance of the smart card application involve the terminal and the smart card. If the terminal is replaced or the smart card supplier is replaced. , must be re-adjusted or developed in some aspects of smart cards and terminals. Simply replacing the terminal, or replacing the smart card, does not allow for a complete application. In addition, the application logic unit is located in the terminal operating system in the terminal, and when the terminal is attacked, the application logic unit will be in danger. At this point, how to liberate the terminal from the "heavy" labor of the smart card application is an urgent problem for the technical personnel.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be further described in detail with reference to the accompanying drawings. FIG. 3 is a schematic diagram showing the communication between the terminal smart card based on the HTTP protocol and the terminal operating system according to the present invention, taking the POS terminal as an example. Referring to FIG. 3, the terminal operating system 20 includes at least a web browser 202, and the terminal smart card 30 includes at least a security information service 302, a web server 304, and an application logic unit 306. The web browser 202 in the terminal operating system 20 communicates with the web server 304 in the financial smart card 30 through the HTTP protocol or the HOAP (HTTP Over APDU Protocol), and the web server 304 stores the smart card. Application logic programs that correspond to applications in application logic unit 306. When the web browser 202 requests a certain URL, the corresponding web application in the application logic unit 306 is invoked through the web server 304 to implement the application of the terminal smart card. It should be understood by those skilled in the art that although the communication between the terminal operating system 20 and the terminal smart card 30 shown in FIG. 3 uses the HTTP protocol based on the APDU protocol, with the development of software programming technology, The interaction between the terminal smart card and the terminal operating system can directly support the HTTP protocol, or the TCP/IP protocol, or the USB protocol. For a clearer understanding of the present invention, in conjunction with FIG. 2 and FIG. 3, it is not difficult to see that in the prior art POS terminal, the terminal operating system contains an application logic unit, and the terminal smart card only contains a security information service. In contrast, in the terminal operating system of the present invention, the terminal operating system has a web browser, and the terminal smart card includes not only a security information service but also a web server and an application logic unit. That is to say, the application logic unit originally in the terminal operating system is "decentralized" to the financial smart card, and the terminal operating system uses the Web browser to access the terminal smart card based on ISO7816/ISO14443 and the HTTP protocol, and the terminal smart card communicates with the Web through the Web server. The browser communicates, when the application logic unit sends to the terminal operating system through the web service communication management layer, on the web browser The web page is displayed in the form of a web page. Therefore, after the web technology is adopted, the web browser and the web server are respectively introduced in the terminal operating system and the terminal smart card to implement the web application of the terminal smart card. At the same time, the functions of the POS terminal have been greatly weakened, the positioning is more clear, and it is more suitable for service-oriented applications and application functions. It should also be pointed out that the terminal smart card stores the application logic unit and its security information service, and the terminal only needs to provide the application interface display, input and output, and online functions, etc., then the terminal is changed from the core component of the smart card application to having the ordinary browser function. The shell greatly enhances the scalability and portability of the entire application system. 4 shows a schematic diagram of a web service application container accessing a smart card application container through a web service application programming interface. Referring to FIG. 4, the terminal smart card has an application container of a card, a web service application container, a web service interpretation layer, and an API interface between the application container of the card and the web service application container. More specifically, the application container of the card is a storage area of the terminal smart card application, which adopts a traditional implementation manner, does not need to be specifically defined, and does not need to be associated with a specific manufacturer's product, and can be accessed through an application interface of a corresponding application specification. Realization, such as social security regulations, labor practices, financial norms, etc. The web service application container is a storage area of an application displayed by the terminal operating system using a web browser, which is substantially a web application corresponding to each application in the application container of the card. These web applications consist of one or more HTML script files. The web service interpretation layer manages and calls these web applications, and displays the called web applications on the web browser of the terminal operating system through ISO7816/ISO 14443 and HTTP protocols. . In addition, using the API of the web service, the API interface only supports one-way access operations, that is, the application container of the card cannot use the API interface to access the web service application container. The terminal smart card of the present invention has both an application container of a card and an application container of a web service. So how do you implement the Web server to display the application in the application container of the card on the web browser of the terminal operating system? In general, the traditional smart card application container is logically in the form of a file system, just like the FAT file system, and provides a service interface (such as an APDU instruction). Since the application container of the card only needs to provide a small amount of data information such as storage of sensitive data and key service, the physical storage carrier is usually an EEPROM (Electrically Erasable Read Only Memory). The EEPROM is a highly secure storage carrier with a capacity of several Kbytes. However, the Web application implements application logic and contains a large amount of information such as pictures, text, and process scripts, which are not required for security. Though Logically, it exists in the form of a file system. However, compared with the card application container, the amount of data is huge, and it is usually necessary to reach the M-level byte to meet the requirements. Such a large storage space cannot be achieved by the EEPROM process. More rewritable FLASH implementation. It can be seen that the application container of the smart card and the application container of the Web service are stored in one chip by using different storage media, and mutual access between them is also limited. As shown in FIG. 4, the components participating in the communication in the application system include a Web service communication management layer 400, which supports at least ISO7816, ISO 14443, and HTTP protocols; and an application container 402 of the smart card, which is stored in accordance with the People's Bank of China. Standardized e-wallet application, debit-keeping application conforming to the People's Bank of China regulations, fast traffic application, social security application and other industry applications; API interface 404 of Web server; Web service application container 406, corresponding to e-wallet application An HTML script file, an HTML script file corresponding to the debit application, an HTML script file corresponding to the fast traffic application, an HTML script file corresponding to the social security application, and the like; and a Web service interpretation layer 408.

 Taking the fast traffic application as an example, when the service provided by the application in the application logic unit and the corresponding web service for the terminal application are accepted by the terminal operating system for the application request service of the fast traffic application, the web browser is used by the web browser. The request communicates with the web server in the terminal smart card, and the web service interpretation layer 408 receives the URL request from the web browser and performs corresponding processing. First, the web service application container 406 accesses the fast traffic application logic located in the smart card's application container 402 via the web server's API interface 404, and the return code from the smart card's application container 402 is directly returned or translated into a standard HTML response code. Then, the Web service interpretation layer 408 calls the Web service application container 406, and sends the HTML script file corresponding to the fast traffic application to the Web browser in the terminal operating system through the IS07816/IS014443 and HTTP protocols for display. FIG. 5 is a flow chart showing the processing of a received URL request by a web browser in a terminal operating system. The processing method includes: Step 500: Receive a URL request. The web browser in the terminal operating system receives the URL request;

Step 502: The web browser determines whether the URL request is a remote request or a local request by determining a host address of the received URL. If the URL request is a remote request, then web browsing The device requests to communicate with the remote web server, go to step 510; Step 504, if the URL request is a local request, determine whether the port number of the local request is the port number of the terminal smart card, and if yes, go to step 506; If not, go to step 508; Step 506, request to communicate with the terminal smart card; Step 508, determine that the port number for sending the local request is not from the financial smart card, query other port agents; and Step 512, in the Web browser Establishing communication with the web server. After the web server successfully invokes the application logic unit in the terminal smart card, the web application corresponding to the application logic unit is logically displayed on the web browser of the terminal operating system. Hereinabove, the specific embodiments of the present invention have been described with reference to the drawings. However, it will be apparent to those skilled in the art that various modifications and changes can be made in the embodiments of the present invention without departing from the spirit and scope of the invention. Such changes and substitutions are intended to fall within the scope of the appended claims.

Claims

Claim A smart card, characterized in that the smart card has at least: an application logic unit for storing related data information of a smart card application in a card application container of the smart card; a web server, configured to store a logic program of the smart card application, to access the application logic unit, where the service provided by the application in the application logic unit and the corresponding web service for the terminal application accept the terminal operation together System request service. The smart card according to claim 1, wherein the smart card further comprises data information of a security information service in the smart card application. The smart card according to claim 1, wherein the web server comprises at least a web monthly interpretation layer, a web service communication management layer, a web service application container, and a web service application programming interface.  The smart card according to claim 3, wherein the web service interpretation layer invokes the web service application container, and manages a corresponding HTML script file in the web service application container through web service communication. The layer is sent to the terminal operating system for logical presentation. The smart card according to claim 4, wherein the HTML script file corresponds to a smart card application of the application logic unit. The smart card according to claim 3, wherein the web service communication management layer supports the ISO7816/IS014443 protocol and the HTTP protocol loaded on the ISO7816/ISO14443. The smart card according to claim 3, wherein the web service communication management layer directly supports one of a HTTP protocol, a TCP/IP protocol, a USB protocol, or a combination thereof. 8. The smart card of claim 3, wherein the card application container and the web service application container are in different logical storage areas. 9. The smart card of claim 8, wherein the physical storage carrier of the card application container is typically fabricated by an EEPROM process. 10. The smart card of claim 8, wherein the physical storage carrier of the web service application container is typically manufactured by a FLASH process. The smart card according to claim 8, wherein the web service application container unidirectionally accesses the application logic unit through the web service application programming interface. The smart card according to claim 1, wherein the application logic unit comprises an e-wallet application conforming to the regulations of the People's Bank of China, a debit-keeping application conforming to the regulations of the People's Bank of China, a rapid transit application and a social security application, and Other industry applications. 13. A terminal processing system in a smart card application, the terminal processing system having at least one terminal operating system and a smart card, characterized in that  The terminal operating system is configured with a web browser; and the smart card has at least: an application logic unit configured to save related data information of the smart card application in a card application storage area of the smart card; and a web server, configured to store a logic program of the smart card application, and access a web service of the application logic sheet to receive a request service of the terminal operating system. The terminal processing system according to claim 13, wherein the terminal operating system is a POS of a financial terminal, an ATM terminal, or a mobile terminal in a wireless communication system. The terminal processing system according to claim 13, wherein the web server comprises at least a web service interpretation layer, a web service communication management layer, a web service application container, and a web service application programming interface. The terminal processing system according to claim 15, wherein the web service interpretation layer calls the web service application container, and passes a corresponding HTML script file in the web service application container through the web service. The communication management layer sends the terminal operating system to perform logical display. The terminal processing system according to claim 16, wherein the terminal operating system logically displays the smart card application through the web browser. 18. A method for supporting a web application service in a terminal processing system, the terminal processing system comprising at least one terminal operating system and a smart card, wherein a web browser is set in the terminal operating system; The logic unit is stored in the card application container of the smart card; a web server is disposed in the smart card; and the web browser is used to communicate with the web server to implement a web service of the smart card application. , The implementation method according to claim 18, wherein the web browser determines whether the remote request or the local request is according to the received URL request, and when the URL request is a remote request, the web browser and the web browser The remote web server communicates; when the URL request is a local request, and the port number of the local request is the port number of the smart card, communication is established between the web browser and the web server of the smart card. The implementation method according to claim 19, wherein when the URL request is a local request, and the port number of the local request is not the port number of the smart card, the other port agent is queried. The implementation method according to claim 18, wherein the web server includes at least a web service interpretation layer, a web service communication management layer, a web service application container, and a web service application programming interface. The implementation method of claim 21, wherein the web service interpretation layer invokes the web service application container, and sends a corresponding HTML script file in the web service application container to the terminal operation The system's web browser performs logical presentations. The implementation method according to claim 21, wherein the web service application container accesses the application logic unit in one direction through the web service application programming interface. The implementation method according to claim 18, wherein the web browser and the web server both support an ISO7816/ISO14443 protocol, and an HTTP protocol loaded on ISO7816/ISO14443. The implementation method according to claim 18, wherein the web browser and the The web server directly supports one or a combination of the HTTP protocol, the TCP/IP protocol, and the USB protocol.