[go: up one dir, main page]

WO2018161224A1 - Procédé de traitement de données et dispositif associé - Google Patents

Procédé de traitement de données et dispositif associé Download PDF

Info

Publication number
WO2018161224A1
WO2018161224A1 PCT/CN2017/075786 CN2017075786W WO2018161224A1 WO 2018161224 A1 WO2018161224 A1 WO 2018161224A1 CN 2017075786 W CN2017075786 W CN 2017075786W WO 2018161224 A1 WO2018161224 A1 WO 2018161224A1
Authority
WO
WIPO (PCT)
Prior art keywords
nfcc
application
message
user identity
identity verification
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2017/075786
Other languages
English (en)
Chinese (zh)
Inventor
赵晓娜
梅敬青
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to PCT/CN2017/075786 priority Critical patent/WO2018161224A1/fr
Priority to CN201780026377.6A priority patent/CN109076428B/zh
Publication of WO2018161224A1 publication Critical patent/WO2018161224A1/fr
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W40/00—Communication routing or communication path finding
    • H04W40/02—Communication route or path selection, e.g. power-based or shortest path routing

Definitions

  • the present application relates to the field of wireless communications, and in particular, to a data processing method and related apparatus.
  • NFC Near field communication
  • RFID radio frequency identification
  • the NFC device is mainly composed of three functional entities: a device host (DH), a near rield communication controller (NFCC), and a near field communication execution environment (NFCEE).
  • DH is responsible for the management of NFCC, such as initialization, configuration and power management;
  • NFCC is responsible for the physical transmission of data through the RF interface and antenna;
  • NFCEE can provide a safe execution environment for NFC applications.
  • the NFC controller interface (NCI) defines a logical interface for communication between DH and NFCC. The communication between DH and NFCC can be performed through the NCI protocol.
  • the host control interface can be used between NFCC and NFCEE.
  • the host controller interface (HCI) communication protocol communicates.
  • the NFC device includes at least one NFCEE, and at least one card application can be installed on each NFCEE.
  • multiple card applications on the same NFCEE, or multiple card applications on different NFCEEs can be activated simultaneously, and each The card application has a corresponding application identifier (AID); when the card application on the NFC device is activated, the card applies related radio frequency (RF) parameters (such as RF technical parameters, RF protocol parameters, etc.), Routing tables in listen mode (such as AID-based routing entries, protocol data unit pattern APDU Pattern routing entries, protocol-based routing entries, technology-based routing entries, etc.) are configured on the NFCC.
  • RF radio frequency
  • the peer NFC device (such as the point-of-sale terminal POS) discovers the RF protocol corresponding to the activated card application in the RF discovery process, so that the peer NFC device according to its own service requirements (such as banking, bus service, and access control service) Etc.) Select one of the card applications to communicate by applying a selection command (such as selectAID). Accordingly, the NFC device receives the application selected by the peer NFC device. Command matching routing entry based on the routing table to the application selection command, and subsequently received data frame is forwarded to the matching routing entry corresponding NFCEE processed.
  • a selection command such as selectAID
  • One of the existing standards can activate multiple card applications on one or more NFCEE at the same time, and does not fully consider that different types of card applications may have different requirements for security and convenience in implementation, such as bank cards.
  • the application requires more safety than the convenience requirement, and the bus card application requires higher convenience than the security requirement. Therefore, it is not conducive to actual product development, which has some impact on user experience or user capital security.
  • it is possible to design a scheme that activates only one card application at a time. When the bus card is activated, the bank POS machine reports an error, and when the bank card is activated, the bus POS machine requires the user.
  • Switching card application and other issues it is also possible to design a scheme to activate multiple card applications at a time, but limit the conditions used by the card application (such as which mobile phone energy state can be used by the routing item corresponding to the card application (such as AID-based routing items) ), wherein the mobile phone energy status is such as shutdown, unlock & bright screen, lock & bright screen, unlock & unlock screen, lock & unlock screen, etc., assuming that the AID-based routing item corresponding to the bank card application can only be unlocked & Under the bright screen, the user must first illuminate the screen and unlock the phone before swiping the bank card for payment.
  • the conditions used by the card application such as which mobile phone energy state can be used by the routing item corresponding to the card application (such as AID-based routing items)
  • the mobile phone energy status is such as shutdown, unlock & bright screen, lock & bright screen, unlock & unlock screen, lock & unlock screen, etc.
  • the user operation is cumbersome and the experience is not good; if the bank card application is based on the AID-based If the routing item can be used in the off-screen state, there is a risk of being stolen or mistakenly brushed for a passwordless credit card or some scenarios that support small-sized confidential business.
  • the embodiment of the present application provides a data processing method and related device, which are used to provide a unified solution for card applications with different security and convenience requirements.
  • the embodiment of the present application provides a data processing method, which is used by a host DH of a first terminal, where the first terminal further includes a near field communication controller NFCC and at least one near field communication execution environment NFCEE, Methods include:
  • the DH receives the first message sent by the NFCC, where the first message may be used to notify the DH that the second terminal is to select the first application on the first terminal, and/or to request the DH to perform the user identity verification operation.
  • the first application may be any type of card application activated on the first terminal, such as a bank card application and a bus card application, and the request for the DH to perform the user identity verification operation is required when using the first application.
  • Verifying the identity of the user, the user identity mentioned here is the identity of the current user of the first terminal, or, further, the first application on the first terminal or the electronic wallet where the first application is located (such as a mobile phone manufacturer such as huawei)
  • the wallet application such as pay, apple pay, and the controller of the wallet application such as ICBC mobile banking and google wallet launched by various banks or third parties (that is, knowing the password of the e-wallet or presetting the fingerprints related to the e-wallet)
  • the identity of the user, in addition, the second terminal is a terminal that performs NFC communication with the first terminal;
  • the DH determines that user authentication is required, the DH performs a user identity verification operation, wherein it can be understood that after the DH performs the user identity verification operation, the DH can learn according to the result of the user identity verification operation. Whether the user identity can use the first application.
  • the user authentication mentioned here is an operation that needs to be performed before using the first application, that is, determining whether the first application can be used by determining whether the user identity verification is passed, and only allowing the first application to be used after the user authentication is passed. Performing subsequent services with the second terminal.
  • the DH sends a second message to the NFCC, where the second message is a first command that allows the NFCC to perform data routing on the data frame, and the data frame is the second terminal. Sent to the NFCC and used to indicate that the first application is to be selected.
  • the embodiments of the present application have the following advantages:
  • the present application has a unified solution according to the different security and convenience requirements of different card applications, which can make the implementation simpler, the development cost is lower, the cycle is shorter, etc., and the user authentication is required.
  • the application of the card indicates that the security requirement is higher than the convenience requirement; for the card application that does not require the user identity verification, the convenience requirement is higher than the security requirement; therefore, the security requirements of the embodiment of the present application can be higher than
  • the card application for convenience requires user authentication, and the card application with higher convenience than the security requirement can realize the function of fast payment, and can also avoid the problems of affecting the user experience or complicating the user operation as described above.
  • the method before the DH receives the first message sent by the NFCC, the method further includes:
  • the DH sends and configures a first routing entry to the NFCC, where the first routing entry includes a user identity verification request identifier, where the user identity verification request identifier is used to indicate that the user needs to perform user identity verification when using the first application. Or no user authentication is required.
  • the DH may send the first user identifier verification request identifier to the NFCC after determining that the user identity verification request identifier corresponding to the first application indicates that the user needs to perform user identity verification when using the first application.
  • the routing item; or, whether the user authentication request identifier corresponding to the first application indicates whether the user needs or does not need to perform user authentication when using the first application the DH sends the first routing item including the user identity verification request identifier to the NFCC.
  • the user authentication request identifier is used to indicate that the user needs to perform user authentication when using the first application, or does not need to perform user authentication.
  • the DH configures the first routing item including the user identity verification requirement identifier to the NFCC, and the NFCC can conveniently learn, according to the user identity verification request identifier, whether the user identity is needed or not needed when using the first application. verification.
  • the DH determines that the user identity needs to be performed. Validation includes:
  • the DH When the DH receives the first message sent by the NFCC, and the function of the first message is used to notify the DH that the second terminal is to select the first application, in this scenario, the DH may be determined according to the user identity corresponding to the first application.
  • the identifier further determines whether user authentication is required or not, wherein the user authentication request identifier indicates that the user identity needs to be verified when the first application is used, and therefore, the DH determines that the user needs to perform the indication according to the user identity verification request identifier.
  • User authentication User authentication.
  • the DH since the first message does not indicate that the request DH performs the user identity verification operation, but notifies the DH second terminal that the first application is to be selected, the DH needs to determine the use of the first application by itself. Whether user authentication is required, it can be understood that the DH can obtain the user identity verification request identifier according to the registration information or the user indication information, or the user identity determined for each application according to the registration information or the user indication information. The user identification verification request identifier corresponding to the first application is obtained in the verification request identifier.
  • the method before the DH receives the first message that is sent by the NFCC, the method further includes:
  • the DH configures a second routing entry to the NFCC.
  • the user authentication request identifier corresponding to the first application indicates that the user identity needs to be verified when the first application is used, where the second routing entry includes the near field communication execution environment DH corresponding to the DH.
  • An identifier of the NFCEE which is used to indicate the near field communication execution environment DH-NFCEE corresponding to the DH.
  • the DH-NFCEE is not the NFCEE where the first application is located. It can be understood that the DH sends a second routing item to the NFCC.
  • the NFCC is configured with a route to DH-NFCEE.
  • the DH configures a route to the NFCC to point to the DH-NFCEE, so it is understandable that DH can simply point to DH-NFCEE according to the route corresponding to the first application to know that user identity verification is required when using the first application.
  • the DH receives the first message sent by the NFCC, and specifically includes:
  • the DH receives the first message sent by the NFCC, and the first message includes a data frame sent by the second terminal, where the data frame is used to notify the DH that the second terminal selects the first application;
  • the DH learns the first application according to the first message, and determines, according to the user identity verification request identifier corresponding to the first application, that the user identity verification is required when the first application is used, it may be understood that, at this time, the first Applying a corresponding user authentication request identifier indicates that user authentication is required when the first application is used;
  • the DH sends a second message to the NFCC, where the second message includes a third routing entry, where the third routing entry includes an identifier of the NFCEE where the first application is located. It can be understood that the identifier indicates the first application.
  • the NFCEE is located.
  • the data frame sent by the second terminal is directly forwarded as the first message, and the DH is notified.
  • This implementation manner is simpler and more convenient, and no need to configure the first message.
  • the method further includes:
  • the DH reconfigures the second routing entry to the NFCC, where the second routing entry includes an identifier of the near field communication execution environment DH-NFCEE corresponding to the DH, and is used to indicate the near field communication execution corresponding to the DH.
  • the DH may reconfigure the second routing entry to the NFCC when the DH does not receive the data frame sent by the second terminal for selecting the first application again within the preset time after the end of the communication. .
  • the DH reconfigures the second routing entry to the NFCC, so that after the first application is used, the user can automatically restore the route to wait for the next normal use of the first application.
  • the user identity verification request identifier may be determined by the DH according to the registration information of the first application and/or the user indication, where
  • the registration information of the first application includes an application type of the first application and/or a requirement parameter for indicating authentication.
  • the user identity verification request identifier is determined according to the registration information of the first application and/or the user indication, and the implementation manner is strong and easy to implement.
  • the DH performs a user identity verification operation, and specifically includes:
  • the DH determines that the user identity verification success flag corresponding to the first application exists, the DH determines, according to the user identity verification success flag, that the user identity verification operation passes;
  • the DH determines that there is no user identity verification success flag corresponding to the first application, the DH receives and determines the user identity information by using the identity verification module of the first terminal to determine whether the user identity verification operation passes.
  • this possible implementation method also considers the delay caused by the user to verify the fingerprint or other forms of identity information during the user authentication process or the user's usage habits, and may require the user to leave the NFC mobile phone and verify the NFC mobile phone. After the identity is successful, it is close to the POS machine, which improves the fault tolerance rate of the solution to some extent.
  • the user identity verification success flag is that the DH determines the user identity verification by using an identity verification module of the first terminal. The operation is saved after passing.
  • the method further includes:
  • the DH When the DH does not receive the first message sent by the NFCC again within the preset time period, the DH deletes the user identity verification success flag; or, after the DH determines that the user identity verification grass passes according to the user identity verification success flag, DH deletes the user authentication request token.
  • the user identity verification success flag is deleted in time after the user authentication success flag is used, which can effectively improve the security of the user identity verification.
  • the method further includes:
  • the DH When the DH determines that user authentication is not required, the DH sends a second message to the NFCC, wherein the second message is a second command that does not allow the NFCC to route the data frame.
  • the DH directly sends the first command to instruct the NFCC to route the data frame to the NFCEE where the first application is located, thereby effectively improving the use of the first application.
  • the processing speed increases the user experience.
  • the method further includes:
  • the DH may indicate the NFCC by sending a second message to the NFCC, where the second message is a second command that does not allow the NFCC to perform data routing on the data frame, to inform the NFCC not to perform data on the data frame. Routing processing; DH may not send any messages. It should be understood that when the NFCC does not receive any message within the preset time period, the NFCC does not route the data frame to the NFCEE where the first application is located.
  • the NFCC does not perform routing processing on the data frame, so that the security of using the first application can be effectively improved, and property loss may be prevented when the user is stolen.
  • the embodiment of the present application provides a data processing method, where the method is used for a near field communication controller NFCC of a first terminal, where the first terminal further includes a host DH and at least one near field communication execution environment NFCEE, where Methods include:
  • the NFCC receives the data frame sent by the second terminal, and finds a matching first routing item according to the data frame, where the data frame is used to indicate that the second terminal selects the first application on the first terminal,
  • the second terminal is a terminal that performs NFC communication with the first terminal;
  • the NFCC determines whether it needs to send the first message to the DH according to the preset condition, where the first message may be used to notify the DH that the second terminal is to select the first application on the first terminal. And/or, can be used to request DH to perform a user authentication operation;
  • the NFCC determines that the first message needs to be sent to the DH, then the NFCC sends the first message to the DH, it being understood that the first message can be used to perform any of the above steps or perform two functions simultaneously. ;
  • the NFCC when the NFCC receives the second message sent by the DH, the NFCC performs routing processing on the data frame according to the indication of the second message.
  • the embodiments of the present application have the following advantages:
  • the present application has a unified solution according to the different security and convenience requirements of different card applications, which can make the implementation simpler, the development cost is lower, the cycle is shorter, etc., and the user authentication is required.
  • the application of the card indicates that the security requirement is higher than the convenience requirement; for the card application that does not require the user identity verification, the convenience requirement is higher than the security requirement; therefore, the security requirements of the embodiment of the present application can be higher than
  • the card application for convenience requires user authentication, and the card application with higher convenience than the security requirement can realize the function of fast payment, and can also avoid the problems of affecting the user experience or complicating the user operation as described above.
  • the method further includes:
  • the NFCC determines that the first message does not need to be sent to the DH according to the preset condition, the NFCC routes the data frame, that is, the NFCC routes the data frame to the NFCEE where the first application is located.
  • the NFCC when the NFCC does not need to send the first message to the DH, the NFCC routes the data frame to the NFCEE where the first application is located, so that the routing and forwarding processing speed can be effectively improved.
  • the method before the NFCC finds the matched first routing item after receiving the data frame sent by the second terminal, the method further includes: :
  • the NFCC receives the first routing entry of the DH configuration, where the first routing entry includes the identifier of the first application and the first NFCEE identifier.
  • the first NFCEE identifier may be the identifier of the NFCEE where the first application is located, and The identification of the environment DH-NFCEE may be performed for the near field communication corresponding to the DH.
  • the NFCC before the NFCC finds the matched first routing item after receiving the data frame sent by the second terminal, the NFCC receives the first routing item including the first NFCEE identifier configured by the DH, so that the NFCC can be based in advance.
  • the first routing entry knows the NFCEE information, which NFCEE information should be routed to the data frame.
  • the first NFCEE identifier is an identifier of the NFCEE where the first application is located
  • the first routing entry is further The user authentication request identifier is included; the NFCC determines whether to send the first message to the DH according to the preset condition, including:
  • the NFCC determines, according to the user identity verification request identifier in the first routing item, whether to send the first message to the DH, and specifically, if the user identity verification request identifier indicates that the user identity needs to be verified when using the first application, The NFCC determines that the first message is to be sent to the DH; similarly, if the user identity verification request indicates that the user identity is not required to be used when the first application is used, the NFCC determines not to send the first message to the DH.
  • the NFCC judges according to the user identity verification request identifier in the first routing item, and can effectively determine that the first message needs to be sent to the DH or does not need to send the first message to the DH.
  • the NFCC determines, according to the preset condition, whether to send the first message to the DH, including:
  • the first message, the user authentication success flag is saved after the NFCC receives the message sent by the DH indicating that the user authentication operation passes.
  • the NFCC determines whether the current energy status or the identity verification success flag is The first message needs to be sent, so that the judgment can be accurately made and the timeliness and security of the NFC communication can be improved.
  • the NFCC determines, according to the current energy state of the first terminal, whether the first message needs to be sent to the DH, specifically including :
  • the NFCC determines that the first message needs to be sent to the DH, and it should be understood that the power of the first terminal can maintain the NFC communication. The NFCC determines that the first message needs to be sent to the DH. Secondly, when the current energy state of the first terminal is no power or power-off state, the NFCC determines that the first message does not need to be sent to the DH, it should be understood that when When the current energy state of a terminal is no power or power-off state, the DH of the first terminal cannot be used normally, and the message sent by the NFCC cannot be received, processed, or acknowledged. Therefore, the NFCC does not send the first message at this time. .
  • the first message is sent to the DH when the first terminal is not powered off or not, so that waste of resources on the NFCC can be effectively avoided.
  • the NFCC determines whether the presence or absence of the user identity verification success token corresponding to the first application needs to be sent to the DH.
  • the first message specifically includes:
  • the NFCC determines that the first message needs to be sent to the DH. It should be understood that when there is a user identity verification success flag, it indicates that there is a record of successful user identity verification, and no need to verify again; If there is a user authentication success token, then the NFCC determines that the first message does not need to be sent to the DH. It should be understood that when there is no user authentication success token, it indicates that there is no record of successful user authentication, and authentication is required; It should be noted that the user authentication success flag is marked as a token when the user authentication is passed.
  • the first message is sent or not by the user identity success flag, so that when there is a user identity verification success flag, the processing speed can be improved, and the first application can be solved.
  • the delay problem brought by the time increases the fault tolerance rate of the program.
  • the NFCC performs routing processing on the data frame according to the second message, specifically:
  • the NFCC routes the data frame sent by the second terminal to the NFCEE where the first application is located, where the first command is to allow the NFCC to perform data routing to the data frame to the first The NFCEE where the application is located, and the first command is sent when the DH performs the user authentication operation and the result is passed;
  • the NFCC does not route the data frame sent by the second terminal to the NFCEE where the first application is located, where the second command indicates that the NFCC is not allowed to perform data routing to the data frame.
  • the command of the NFCEE where the application is located and is sent by DH when the user authentication operation is performed to get a failed result.
  • the first command or the second command in the second message is used to determine whether the NFCC needs to or need to route the data frame sent by the second terminal to the NFCEE where the first application is located, so that The NFCC is effectively prevented from making an error in data routing processing of the above data frame according to the second message.
  • the NFCC when the first NFCEE identifier in the first routing item is the identifier of the DH-NFCEE, the NFCC sends the first to the DH.
  • a message including:
  • the NFCC sends a first message to the DH, where the first message includes a data frame that is sent by the second terminal and is used to select the first application in the first terminal.
  • the NFCC performs routing processing on the data frame according to the second message, and specifically includes:
  • the NFCC routes the data frame sent by the second terminal to the NFCEE where the first application is located, where the second message is The DH is sent after the user authentication operation is passed, or is sent after determining that the first application is used without verifying the identity of the user.
  • the NFCC performs routing processing on the data frame, specifically:
  • the NFCC directly forwards the data frame sent by the second terminal for selecting the first application of the first terminal to the NFCEE where the first application is located.
  • the NFCC directly routes the data frame to the NFCEE where the first application is located, so that the data frame can be correspondingly operated.
  • the method further includes:
  • the NFCC When the NFCC does not receive any message sent by the DH within a preset period of time, the NFCC terminates the communication.
  • the NFCC does not receive any message sent by the DH within a preset time period, and the NFCC may choose to terminate the communication, so that the first application may be prevented from being stolen to some extent.
  • the NFCC after receiving the data frame sent by the second terminal, finds the matching first routing item, and specifically includes:
  • the NFCC receives the data frame sent by the second terminal, and secondly, the NFCC finds a first routing item that matches the first application in the data frame according to the corresponding routing manner, where a possible routing manner may be It is based on the routing method of the application identification AID.
  • the current selection mode of the route may also be other types of routing methods, such as a routing mode based on the application protocol data unit mode APDU Pattern, a routing method based on the system number SC, a protocol-based routing method, or a technology-based routing method.
  • the identifier of the first application included in the data frame for selecting the first application is the APDU Pattern, SC, protocol or technology related to the first application.
  • the AID-based routing method can be used to find the first routing item that matches it more effectively, and the implementation is more general and applicable.
  • the embodiment of the present application provides a policy entity, where the policy entity has the function of implementing the first terminal in the first aspect of the foregoing method embodiment.
  • This function can be implemented in hardware or in hardware by executing the corresponding software.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • an embodiment of the present application provides a policy entity, including: a processor, a memory, a bus, and a communication interface; the memory is configured to store a computer execution instruction, and the processor is connected to the memory through the bus, when the policy entity In operation, the processor executes the computer-executed instructions stored in the memory to enable the policy entity to execute as The data processing method of any of the above aspects.
  • the embodiment of the present application provides a computer readable storage medium, configured to store computer software instructions used by the policy entity, when executed on a computer, to enable the computer to perform any one of the foregoing first aspects. Data processing method.
  • an embodiment of the present application provides a computer program product comprising instructions, which when executed on a computer, cause the computer to perform the data processing method of any of the above first aspects.
  • the embodiment of the present application provides a policy entity, where the policy entity has the function of implementing the first terminal in the second aspect of the foregoing method embodiment.
  • This function can be implemented in hardware or in hardware by executing the corresponding software.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • an embodiment of the present application provides a policy entity, including: a processor, a memory, a bus, and a communication interface; the memory is configured to store a computer execution instruction, and the processor is connected to the memory through the bus, when the policy entity In operation, the processor executes the computer-executed instructions stored in the memory to cause the policy entity to perform the data processing method of any of the second aspects above.
  • the embodiment of the present application provides a computer readable storage medium, configured to store computer software instructions used by the policy entity, when executed on a computer, to enable the computer to perform any one of the foregoing second aspects.
  • the data processing method of the item is not limited to:
  • the embodiment of the present application provides a computer program product comprising instructions, which when executed on a computer, enable the computer to perform the data processing method of any of the above second aspects.
  • FIG. 1 is a schematic diagram of a system for processing data in an embodiment of the present application
  • FIG. 2 is a schematic diagram of an embodiment of a data processing method in an embodiment of the present application.
  • FIG. 3 is a schematic diagram of another embodiment of a data processing method according to an embodiment of the present application.
  • FIG. 4 is a schematic diagram of another embodiment of a data processing method according to an embodiment of the present application.
  • FIG. 5 is a schematic diagram of another embodiment of a data processing method according to an embodiment of the present application.
  • FIG. 6 is a schematic diagram of another embodiment of a data processing method according to an embodiment of the present application.
  • FIG. 7 is a schematic diagram of an embodiment of a host DH according to an embodiment of the present application.
  • FIG. 8 is a schematic diagram of another embodiment of a host DH according to an embodiment of the present application.
  • FIG. 9 is a schematic diagram of an embodiment of a near field communication controller NFCC according to an embodiment of the present application.
  • FIG. 10 is a schematic diagram of another embodiment of a near field communication controller NFCC according to an embodiment of the present application.
  • FIG. 11 is a schematic diagram of another embodiment of a host DH according to an embodiment of the present application.
  • the embodiment of the present application provides a data processing method and related device, which are used to provide a unified solution for card applications with different security and convenience requirements.
  • NFC technology is a short-range wireless connection technology based on RFID. It uses magnetic field induction to realize NFC equipment communication at close range. Users only need to touch or touch the equipment to exchange information and conduct transactions safely and quickly.
  • the NFC operates at a frequency of 13.56 MHz with an effective communication range of 0-20 cm and a typical value of 4 cm.
  • the working mode of the NFC device can be divided into three types: one, peer-to-peer mode (P2P), which is specifically applied to business card sharing, web page sharing, NFC pairing Bluetooth/WIFI, and the like; Card Emulation (CE), which is specifically used for mobile payment or authentication scenarios such as bank cards, transportation cards, membership cards, coupons, ID cards, etc. 3. Reader/Writer, R /W), this mode is specifically used for mobile payment or authentication scenarios such as bank card POS machines, bus card POS machines, and tag read/write scenarios.
  • P2P peer-to-peer mode
  • CE Card Emulation
  • Reader/Writer, R /W this mode is specifically used for mobile payment or authentication scenarios such as bank card POS machines, bus card POS machines, and tag read/write scenarios.
  • the first terminal and the second terminal are both NFC devices, where the first terminal and the second terminal are mutually peer devices.
  • the NFC device includes a host DH, a near field communication controller NFC, and at least one near field communication execution environment NFCEE, as follows:
  • the DH is responsible for the management of the first terminal, including the management of the NFCC, and may specifically be NFCC initialization, NFCC configuration, and the like.
  • DH is a term used in the NFC Forum Interface (NCI) specification developed by the NFC Forum to correspond to the Host Controller Interface (Host Controller) developed by the European Telecommunication Standards Institute (ETSI).
  • NCI NFC Forum Interface
  • Host Controller Host Controller Interface
  • ETSI European Telecommunication Standards Institute
  • the Terminal Host in the Interface (HCI) specification; in addition, the Management Entity (ME) in the specification developed by the Global Platform (GP) can also be implemented on the Terminal Host.
  • DH is called Management Host (MH).
  • the NFC device is an NFC-enabled device, which can be a smart phone, an NFC Bluetooth stereo, an NFC-enabled notebook, an NFC digital camera, and an NFC TV. If the NFC device is a smart phone, the DH can be a CPU in the smart phone, which can be understood.
  • the operating system of the smartphone described below (OS, Operating Stytem, such as Android OS, iOS, etc.).
  • the NFCC is responsible for physical transmission of data through the RF RF interface and the antenna to enable the first terminal to communicate with the second terminal.
  • NFCC is a term used in the NCI specification developed by the NFC Forum. It can correspond to the Contactless Front-end (CLF) in the HCI specification developed by ETSI. At this time, the Host Controller of HCI should be implemented. On the NFCC.
  • NFCEE is an entity that provides a secure execution environment for NFC applications on the first terminal, such as bank card, bus card and other card emulation applications.
  • NFCEE is a term used in the NCI specification developed by the NFC Forum. It can correspond to the Universal Integrated Circuit Card (UICC) embedded in the HCI specification developed by ETSI. Embedded Secure Element (eSE), Secure Digital Memory Card (SD card), etc.; can also correspond to the Secure Element (SE) in the specification of the GP, or the card simulation environment ( Card Emulation Environment, CEE).
  • UICC Universal Integrated Circuit Card
  • eSE Embedded Secure Element
  • SD card Secure Digital Memory Card
  • SE Secure Element
  • One of the special NFCEEs is DH-NFCEE, which is directly connected to DH or NFCEE in DH.
  • the physical carrier of the NFCEE or SE may be an eSE, a UICC, an SD card, or the like.
  • the NFC application on the first terminal may also be a peer-to-peer application such as a business card sharing, and a card reader application such as a bank POS or a bus POS, and the user may be on the first terminal in some manner (such as a mobile application market). Download and install these NFC applications.
  • these applications can also be preset to the eSE of the phone when the phone is shipped from the factory or preset to the UICC when the UICC card is shipped.
  • the above DH and NFCC can communicate through the interface defined by the NCI protocol; the NFCC and the NFCEE can communicate through the interface defined by the HCI protocol (the upper layer is the HCI protocol, and the bottom layer can be the single-line protocol SWP), of course, other interfaces can also be used. Communication (such as eSE and NFCC can communicate through NFC Wired Interface (NFC-WI)); DH and NFCEE can also communicate through the interface defined by HCI protocol.
  • NFC-WI NFC Wired Interface
  • the Radio Protocol is a protocol used when an NFC device's NFCC communicates with a peer NFC device.
  • RF Technology is a collection of transmission parameters used to transmit data between two NFC devices, such as RF carrier, communication mode, bit rate, modulation mode, bit coding, frame format, protocol, and command set. Wait.
  • the NFC standard mainly includes four RF technologies: NFC-A, NFC-B, NFC-F, and NFC-V, and each technology corresponds to a set of transmission parameters defined by a standard for completing communication.
  • the RF Discovery Porcess defined by the NCI protocol allows the NFCC to detect whether the NFC device exists at the peer end and respond to the device detection performed by the peer NFC device.
  • the defined RF Communication Configuration allows The DH configures some parameters required by the NFCC to perform the radio frequency discovery process to the NFCC, such as each RF technology, the poll mode parameter and the listen mode parameter corresponding to the RF protocol, the RF discovery frequency, the RF technology and mode,
  • the RF interface activates the required mapping table (such as the protocol-interface mapping table) and the routing table required for data routing (such as the listening mode routing table), and the forced NFCEE routing mechanism ForcedNFCEE routing.
  • the required mapping table such as the protocol-interface mapping table
  • the routing table required for data routing such as the listening mode routing table
  • the NFC device responds to the technical test or the device detection related command sent by the peer NFC device, and notifies the peer end of the RF protocol supported by the locally activated application, thereby making the opposite NFC device
  • the RF protocol is selected for the activation of the protocol according to the service requirements.
  • the NFC device sends a technical detection or device detection-related command to the peer NFC device, and selects the RF protocol to perform the protocol according to the service requirements after collecting the RF protocol supported by the peer NFC device. activation.
  • the two NFC devices are based on an application supporting the RF protocol (the application may be selected by a NFC device by selecting an application command such as SELECT AID or SELECT PPSE, or may be activated in the RF protocol).
  • the interactive service data is determined by the service data directly sent based on the RF protocol to complete the communication.
  • the first terminal is an NFC mobile phone with an NFC communication function
  • the second terminal is a POS device.
  • the NFC mobile phone includes a DH, an NFCC, and at least one NFCEE.
  • NFCEE is described as an example, specifically:
  • the DH determines the user identity verification requirement corresponding to each application by using a routing item (such as an AID-based routing entry defined by the NCI protocol) according to the requirement of the user authentication.
  • a routing item such as an AID-based routing entry defined by the NCI protocol
  • the NFCC receives the data frame sent by the peer NFC device (such as a POS machine) (such as the command SELECT AID or SELECT PPSE for selecting the application, or the service data sent based on the currently activated RF protocol)
  • the peer NFC device such as a POS machine
  • User authentication requirements in the routing entries corresponding to the application to be used ie, the application selected by the peer NFC device, or the application determined according to the activated RF protocol between the two NFC devices
  • the identifier determines whether user authentication is required, and if necessary, sends a message to DH to request DH to authenticate the user, otherwise it does not send.
  • the routing entry may also be other types of routing entries defined by the routing table defined by the NCI protocol, such as an APDU Pattern-based routing entry based on the application protocol data unit pattern (APDU Pattern-based routing entry), and a system-based routing entry. (System Code-based routing entry), protocol-based routing entry, technology-based routing entry, or NCI protocol definition configured by mandatory NFCEE routing mechanism. Routing item.
  • APDU Pattern-based routing entry based on the application protocol data unit pattern
  • System-based routing entry System Code-based routing entry
  • protocol-based routing entry protocol-based routing entry
  • technology-based routing entry or NCI protocol definition configured by mandatory NFCEE routing mechanism. Routing item.
  • an embodiment of a data processing method in an embodiment of the present application includes:
  • the DH records an identifier of each application (such as an application identifier AID) and a corresponding user identity verification request.
  • each application can be understood as a card application, such as a bank card issued by a bank, a bus card issued by a transportation company, a prepaid card issued by a merchant, a membership card, and the like.
  • card applications can be separate applications, that is, they are understood as card applications that users download separately from the application market, such as a Host-based Card Emulation (HCE) cloud card introduced by a bank; or they can exist in a wallet application.
  • HCE Host-based Card Emulation
  • the sub-applications managed by the wallet application such as a bank card, a bus card, etc. in a mobile wallet developed by a mobile phone manufacturer such as Huawei wallet huawei pay, apple wallet apple pay, and the like.
  • the NFC mobile phone may include at least one NFCEE, and at least one card application may be installed on each NFCEE. According to the current NCI standard, multiple card applications on the same NFCEE, or multiple card applications on different NFCEEs may be activated simultaneously.
  • the identifier of an application may be an application identifier defined by an application developer (AID, which may be registered with the system OS when each card application is downloaded to the mobile phone), or other identifiers.
  • Information about an application (such as an identification message associated with its AID set by the mobile phone after the card application is downloaded to the mobile phone), and the user authentication requirement of an application indicates whether the user identity is required to use the application. Verification, that is, whether the legality of the user's identity is required to be verified.
  • a smart electronic device such as a mobile phone, it is possible to verify whether the current user operating the mobile phone is a legitimate user of the mobile phone by entering a password or a biometric identification method such as fingerprint recognition.
  • the DH determines that the implementation of the user identity verification requirement corresponding to each application is multiple, and the specific implementation manner is as follows:
  • Possible implementation method 1 is based on the existing HCE implementation.
  • the OS can register its own policy type. For example, the category type of the bank card is registered as the payment payment class, and the category type of the bus card is registered as the other other. class. Therefore, the DH can determine the user authentication requirement corresponding to each card application according to the type of the policy registered by each card application, such as determining the user identity verification requirement corresponding to the card application of the policy type as the payment type. User authentication is performed to determine that the user authentication requirement corresponding to the card application of the other type is that no user authentication is required.
  • Possible implementation method 2 Extend the policy type in the existing HCE implementation, such as subdividing the current payment and other types into a secure payment class (corresponding to user identity authentication), an exempt payment class, and other classes;
  • the policy type of the bank card can be registered as a secure payment class
  • the policy type of the bus card is registered as an exempt payment or other class
  • the policy type of the coupon is registered as the other class, and the like. Therefore, the DH can determine the user authentication requirement corresponding to each card application according to the type of the policy registered by each card application. For example, the user authentication request corresponding to the card application of the security type is determined to require user identity verification. It is determined that the user authentication requirement corresponding to the card application of the confidential payment or other class is that no user authentication is required, and the like.
  • Possible implementation method 3 The card application developer sets a dedicated registration parameter UserValidationPara for each card application, which is used to indicate whether the user authentication operation needs to be performed, and further defines the type of user authentication mode, such as fingerprint verification and password. Verification of accessories such as verification and watches/wrists. Therefore, when downloading each card application, the DH can directly determine the user identity verification request corresponding to each card application according to the dedicated parameter UserValidationPara registered for each card application.
  • the possible implementation method 4 can also be determined according to user settings. For example, if a wallet application has multiple bank cards and multiple bus cards, the user needs to perform user identity verification when using the bank card, and is not required when using the bus card. Therefore, DH can determine the user authentication requirements corresponding to each card application according to the settings of the user for each card application.
  • Possible implementation method 5 When the card application is downloaded to the NFCEE, a dedicated parameter for indicating its user authentication requirement is simultaneously saved to the NFCEE, and subsequently, when the DH obtains all the card application related parameters from each NFCEE ( When it is mainly used for calculating RF parameters and completing the above-mentioned RF communication configuration, the dedicated parameters of each card application for indicating its user identity verification requirements may be acquired together, thereby determining each according to the dedicated parameters. Apply the corresponding user authentication requirements.
  • the wallet application can be installed in a secure environment such as a Trusted Execution Environment (TEE), and the application AID and its user authentication requirements can be stored in a secure environment such as TEE.
  • TEE Trusted Execution Environment
  • the “user identity” described in all embodiments of the present invention may be understood as the identity of the current user of the first terminal, or, further, the first application or the first application on the first terminal.
  • the e-wallet (such as the wallet application launched by mobile phone manufacturers such as huawei pay, apple pay, wallet applications such as ICBC mobile banking, google wallet, etc.) (that is, knowing the password or pre-email of the e-wallet)
  • the identity of the user who has set the biometrics such as fingerprints associated with the electronic wallet. Only after the user authentication is passed, the user is allowed to use the first application to perform subsequent services with the peer NFC device (such as the card card service of the bank card, the card card service of the bus card, the recharge service, etc.).
  • the verification of the identity of the user in the solution of the present invention is not equivalent to the verification of a card password such as a bank card as it is now, because the user identity in the solution of the present invention is locally verified by the terminal and is used to determine Whether to allow the current user to use the card application for subsequent transactions with the peer POS machine, where the card password is verified by the peer POS machine through the bank card server connected in the background (ie, the verification of the card password is one of the above-mentioned subsequent transactions) Card person verification link).
  • the DH configures, to the NFCC, a routing item that includes a user identity verification request identifier.
  • the DH configures a routing entry corresponding to the first application to the NFCC according to the user identity verification requirement corresponding to the first application, where the first application is any one of the foregoing applications, or is activated for each application. Any of at least one of the applications, wherein the meaning of "activated” applies to all embodiments of the inventive solution, and it can be understood that if a card application is activated, DH is in calculating the RF parameters.
  • the RF parameters related to the application of the card such as RF protocol related parameters, etc.
  • the NFCC can send the activated card application to the NFC device of the opposite end through the RF discovery process, so that the card application can be selected. For subsequent business (such as bank card credit card business, bus card card business or recharge business, etc.).
  • the manner in which the routing entry is configured by the DH may be any of the following:
  • a routing item including the user identity verification requirement identifier is configured for the first application.
  • the value of the user identity verification request identifier is determined by the user identity corresponding to the first application.
  • the verification request decision is used to indicate that user authentication is required or not required when using the first application, for example, setting a bit to indicate a user authentication request identifier, and when the bit is 1b, indicating that user authentication is required, When the bit is 0b, it means that user authentication is not required. or,
  • the routing item including the user identity verification request identifier is configured for the first application only when the user authentication request corresponding to the first application indicates that the user identity authentication is required. At this time, the user identity verification request identifier is used to indicate the usage. User authentication is required for an application. Otherwise, the configured authentication item does not include the user authentication request identifier.
  • the implementation of the present invention is not limited.
  • the user identity verification request identifier corresponding to the first application is determined by the user identity verification request corresponding to the first application, and is determined according to any possible implementation manner described in step 201, that is, according to the first application.
  • the registration information and/or the user indication are determined, wherein the registration information of the first application includes an application type of the first application and/or a requirement parameter for indicating identity verification (such as the dedicated parameter described above) ).
  • the routing entry can be configured through the listening mode routing table defined by the NCI protocol, or configured by the mandatory NFCEE routing mechanism. For details, see the corresponding content of the NCI protocol.
  • another possible implementation method is: using an AID-based routing item defined by the NCI standard as an example, corresponding to the AID-based routing item in the foregoing Table 1.
  • the Value field (which is described in detail in Table 4 below) is extended.
  • a parameter Identity Validation Flag is added to indicate the user authentication request identifier: if the value of the parameter is 1, it indicates the routing entry. After the application corresponding to the AID is selected, user authentication is required. Otherwise, it indicates that user authentication is not required.
  • the DH can also configure the parameter in the value field when the user identity verification requirement corresponding to the application corresponding to the AID in the routing item is that the user identity authentication is required. Otherwise, there is no such parameter.
  • the AID-based routing item (including the AID of the first application) defined by the NCI standard is taken as an example, and other types of routing items, such as an APDU pattern, are not excluded. Routing items (including first application related reference data and mask), SC based routing items (including the first application related system coding list SC list), protocol based routing items (including the first application related) The identifier of the RF protocol, the technology-based routing item (including the identifier of the RF technology related to the first application), and the like, and the information included in each routing item may be considered as the identifier of the first application.
  • the NFC mobile phone performs an RF discovery process with the peer POS machine to activate the RF protocol required for the POS machine to perform the service.
  • the NFC mobile phone may send a detection command to the outside, or the peer POS machine may send a detection command to detect whether the NFC device exists at the opposite end, and when the opposite end has an NFC device, the pair Which RF protocols are supported by the NFC devices on the side.
  • the foregoing detection command may be a command related to technical detection or device detection.
  • NFC-A there are mainly four kinds of RFs: NFC-A, NFC-B, NFC-F, and NFC-V.
  • Techniques each of which corresponds to a set of standard defined transmission parameters for completing communications, such as RF carrier, communication mode, bit rate, modulation scheme, bit coding, frame format, protocol, command set, and the like.
  • the above-mentioned technical detection command may be a detection command of any one of the above four RF technologies.
  • the NFC mobile phone simulates at least one card application as an example.
  • the peer POS machine should send a detection command to detect which RF protocols are supported by the NFC mobile phone side, and after the NFC mobile phone sends a detection response for the detection command, the POS machine It can be inferred which activated card applications are on the NFC mobile phone, so as to determine what data frame to send according to the business needs of the POS machine (such as banking, bus service, etc.) (for example, the command SELECT AID or SELECT PPSE for selecting the card application, or , is the business-related data).
  • the POS machine sends a data frame to the NFCC, where the data frame is an application selection command for selecting the first application.
  • the POS device sends an application selection command to the NFCC according to the service requirement, such as the Select command defined by the ISO/IEC 7816- protocol (ie, the SELECT Command, if it includes the AID of a card application, it can be regarded as a Select AID command, Or, if it includes the AID of the Proximity Payment Systems Environment (PPSE) application (such as "2PAY.SYS.DDF01"), it can be considered as a SELECT PPSE command) to inform the NFCC peer POS machine that it will choose
  • the first application in the NFC mobile phone such as the application identified by the AID
  • the first application may include an application requiring user authentication (such as a bank card application), and may also include an application that does not require user authentication (such as a bus card application) ).
  • the application selection command is a data frame sent by the POS machine to the NFCC
  • the service data sent by the POS machine to the NFCC in the subsequent data interaction phase ie, the data related to the executed service, Such as encrypted data in a card transaction, etc.
  • service data sent by the NFCC to the POS machine is also a type of data frame.
  • the application selection command may also be a command defined by another protocol for selecting an application on the NFC mobile phone, and there is no limitation here.
  • the NFCC finds a matching routing item for the received data frame.
  • the NFCC receives the selectAID command as an example, and the NFCC searches according to the routing table, and finds an AID-based routing item that matches the AID included in the command. Specifically, the NFCC will select the selectAID The AID in the command matches the AID contained in each AID-based routing entry in the routing table until an AID is found to match (if the two AIDs are identical, or the first X bits of the two AIDs are identical, X is the specified integer) based on the AID-based routing entry.
  • the manner in which the NFCC searches for a matching routing entry may be performed according to the listening mode routing table, that is, according to the AID-based routing item, the APDU Pattern-based routing item, the SC-based routing item, and the protocol-based routing.
  • the NFCC determines that the user identity verification requirement identifier in the matched routing item indicates that user identity verification is not required, the NFCC routes the data frame to the NFCEE where the first application is located.
  • the NFCC determines whether the user identity verification request identifier in the matched routing entry found in the foregoing step 205 indicates that the user identity verification is required, and if not, the first application corresponding to the AID in the routing entry is considered to be used. User authentication is not required. If the bit corresponding to the user authentication request identifier in the routing entry is 0b, it is considered that user identity verification is not required when the first application corresponding to the AID is used. At this time, the NFCC does not need to send any message to the DH, but directly routes the data frame (ie, the application selection command), that is, forwards the application selection command to the NFCEE where the first application is located, waiting for the NFCEE to select for the application. The command returns a response.
  • the data frame ie, the application selection command
  • all "routing" means forwarding or sending.
  • the NFCC routes the data frame to the NFCEE where the first application is located.
  • the NFCC forwards the data frame to the NFCEE where the first application is located, and then The NFCEE is forwarded to the first application for processing, so that the first application can return the message (such as the Select response) for answering the data frame to the NFCC, so that the NFCC is sent to the peer POS.
  • the NFCC determines that the user identity verification request identifier in the matched routing item indicates that user identity verification is required, the NFCC reports the first message to the DH.
  • the NFCC determines whether the user identity verification request identifier in the matched routing entry found in the foregoing step 205 indicates that the user identity verification is required, and if yes, the first application corresponding to the AID in the routing entry is considered to be used. User authentication is required. If the bit corresponding to the user authentication request identifier in the routing entry is 1b, it is considered that the user identity authentication is required when the first application corresponding to the AID is used. At this time, the NFCC reports the first message to the DH, where the first message is used to request the DH to perform a user identity verification operation.
  • the first message includes the foregoing data frame, or the route matching result in step 205 is used to notify the DH peer POS machine to select the first application in the NFC mobile phone, where the data frame includes the application of the first application.
  • the identifier such as the AID, needs to be described, the application identifier of the first application may also be other identification information other than the AID that uniquely identifies the first application.
  • the NFCC when the NFCC reports the first message to the DH, the NFCC can report the information through the RF NFCEE Action mechanism defined by the NCI protocol (that is, the notification is reported by the RF_NFCEE_ACTION_NTF).
  • a new notification of the DH may be added, such as a user authentication request notification USER_VALIDATION_REQUEST_NTF notification, for requesting DH to perform a user authentication operation, or a user identity. Verification decision notifies USER_VALIDATION_JUDGEMENT_NTF notification for request DH determines for itself whether user authentication is required, and there is no limit here.
  • the RF NFCEE Action notification may be extended, that is, (a) if the user identity needs to be verified, the NFCC sends an RF NFCEE Action notification to the DH, where the first indication information is included to indicate that the user identity verification is required; Alternatively, (b) if it is not necessary to verify the identity of the user, the NFCC sends an NFCEE Action notification to the DH, including second indication information indicating that no user authentication is required.
  • the first indication information and the second indication information may be respectively represented by two parameters in the notification, for example, the first parameter indicates that user identity verification is required, and the second parameter indicates that user identity verification is not required; or, the first The two indication information may also be represented by the same parameter when two values are respectively taken.
  • the value of the third parameter indicates that user identity authentication is required, and when it is 0, it indicates that it is not required.
  • the RF NFCEE Action notification may also include information related to the matching routing item, such as an AID, an NFCEE identifier, etc., for details, refer to the corresponding content of the NCI protocol.
  • the NFCC determines whether the first message needs to be sent to the DH according to the current energy state of the NFC mobile phone, where the NFCC determines that the NFC mobile phone does not need to send the first message to the DH when the current energy state of the NFC mobile phone is no power or shutdown state.
  • the current energy state may include an unpowered state, a power-off state, a bright screen and a locked state, a bright screen and an unlocked state, a screen-off state, a locked state, a screen-off state, and an unlocked state.
  • the routing items corresponding to the security-critical applications can be set to be unavailable in the no-power and/or shutdown state (for example, the corresponding energy state field)
  • the bit of no power and/or power-off state is set to 0b), so that if there is no power and/or power-off state, the NFCC cannot route the data frame to these cards even if it finds a matching routing item for the received data frame.
  • the NFCEE where the application is located is then forwarded to these card applications for processing, so as to avoid the consumption of these cards for consumption in the absence of power and/or shutdown. Therefore, in the no-power and/or power-off state, the NFCC no longer needs to send the first message to the DH to avoid waste of resources (because even if it is sent, the processing and response of the DH are not obtained).
  • the DH performs a user identity verification operation.
  • the DH can directly perform the user identity verification operation after receiving the first message.
  • the DH may further perform a user identity verification operation after determining that the user identity is required to use the first application according to the user identity verification requirement corresponding to the first application.
  • the DH performs the user identity verification operation, specifically, the DH invokes the user identity verification module to perform user identity verification, where the user identity verification module may be a fingerprint module, that is, the user identity is verified by verifying the user fingerprint, and of course, Other authentication methods, such as P1N authentication, iris, and other biometric verification, wearable device verification (ie, verifying the presence or absence of a particular wearable device connected to the terminal via a wireless technology (such as Bluetooth)) There are no restrictions here.
  • the DH indicates that the NFCC does not route the data frame to the NFCEE where the first application is located.
  • DH when DH performs user identity verification and fails verification, DH indicates that the NFCC does not route the data frame to the NFCEE where the first application is located.
  • the specific instructions are as follows:
  • the DH sends a second message to the NFCEE, the second message being NFCC not allowed. Routing the data frame to the second command of the NFCEE where the first application is located.
  • the DH when the DH performs user authentication and does not pass the verification, the DH does not send any message to the NFCC. It should be understood that the NFCC does not receive the preset time period after reporting the first message. When any indication message is received, then the NFCC can know that the DH indicates that it does not route the data frame to the NFCEE where the first application is located.
  • the NFCC does not route the data frame to the NFCEE where the first application is located, the NFCC cannot send a response message to the POS machine at the opposite end. Therefore, the POS machine terminates when it does not receive any response message within the preset time (that is, the response timeout condition). This communication.
  • the DH may also terminate the communication, such as sending an RF protocol deactivation command defined by the NCI protocol or other commands that may terminate the communication to the NFCC.
  • the user identity verification fails, which may be specifically: if the user identity verification fails within the preset identity verification time period or within the preset identity verification times, the DH determines the user identity verification. Failed (ie allows the user to perform multiple verifications within a preset time).
  • the DH sends a second message to the NFCC.
  • the DH when the result of the user identity verification operation is passed, the DH sends a second message to the NFCC, where the second message is a first command for allowing the NFCC to route the data frame to the NFCEE where the first application is located, the data.
  • the frame is sent by the POS to the NFCC to indicate that the message of the first application is to be selected (ie, the application selection command described above).
  • the content included in the first command may be information related to user identity verification (ie, the result of performing a user identity verification operation is passed), and/or information indicating that the NFCC is allowed to perform data routing.
  • the NFCC can only determine according to the content that the DH allows the NFCC to route the data frame to the NFCEE where the first application is located.
  • the NFCC routes the data frame to the NFCEE where the first application is located.
  • the NFCC when the NFCC receives the second message sent by the DH, the NFCC routes the data frame to the NFCEE where the first application is located.
  • a pair of command responses may be added in the NCI standard as the second message, which is used to instruct the NFCC to route the data frame to the NFCEE where the first application is located.
  • DH sends a command RF_ROUTE_PERMISSION_CMD to the NFCC, including the route permission identifier RoutingFlag parameter.
  • RoutingFlag the route permission identifier RoutingFlag parameter.
  • the parameter value is 1, it indicates that the NFCC is allowed to perform data routing, and when it is other values, it may indicate that it is not allowed.
  • the NFCC may respond to the DH response RF_ROUTE_PERMISSION_RSP and start forwarding the previously received data frame (such as the above application selection command) to the NFCEE where the first application is located (of course, the subsequently received service data is also directly forwarded. To the NFCEE where the first application is located).
  • the routing entry including the user identity verification request identifier is configured to the NFCC by using the DH for the first application, so that the NFCC can directly according to the route after receiving the data frame sent by the peer NFC device for selecting the first application.
  • the user authentication requirement in the item determines whether the user authentication is required when using the first application, and only requests the DH to perform user authentication when the user authentication is required, and then routes the data frame after determining that the verification has passed. To the NFCEE where the first application is located, and directly route the data frame to the NFCEE where the first application is located when user authentication is not required.
  • the most suitable first application processing method is adopted, and a unified solution is developed, which can realize simpler implementation and lower development cost.
  • the cycle is shorter, etc., wherein for the card application that needs to perform user identity verification, the security requirement is higher than the convenience requirement, and for the card application that does not need the user identity verification, the convenience requirement is higher than the security requirement;
  • the user identity verification can be performed on the card application with the security requirement higher than the convenience requirement, and the card application with the convenience requirement higher than the security requirement can realize the function of fast payment, and the frontage can be avoided.
  • the implementation method of using the first application to complete the payment is implemented.
  • Embodiment 2 referring to FIG. 3, another embodiment of the data processing method in the embodiment of the present application includes:
  • DH records the AID of each application and its corresponding user authentication requirements.
  • the DH configures, to the NFCC, a routing item that includes a user identity verification request identifier.
  • the NFC mobile phone and the peer POS perform an RF discovery process to activate the RF protocol required by the POS to perform the service.
  • the POS machine sends a data frame to the NFCC, where the data frame is an application selection command for selecting the first application.
  • the NFCC finds a matching routing item for the received data frame.
  • the NFCC determines that the user authentication request identifier in the matched routing item indicates that user authentication is not required, the NFCC routes the data frame to the NFCEE where the first application is located.
  • the NFCC determines that the user identity verification request identifier in the matched routing entry indicates that user identity authentication is required, the NFCC reports the first message to the DH.
  • the steps 301 to 307 are similar to the steps 201 to 207 in the first embodiment, and details are not described herein again.
  • the DH performs a user identity verification operation.
  • the DH may directly verify the identity of the user after receiving the first message, or may determine that the user needs to be used when using the first application according to the user identity verification requirement corresponding to the first application. Authenticate the user after authentication. Then, the DH specifically determines the identity of the user, and may determine whether the user identity verification success token corresponding to the first application is saved locally. If not, the DH does not perform the user identity verification operation for the first application before, or The user authentication operation performed before the DH for the first application is not successful, that is, at this time, the DH needs to perform the user authentication identity operation.
  • the user identity verification is required, and the first message is reported to the DH to indicate that the DH is required to perform the user identity verification operation, and if the DH determines that the user identity corresponding to the first application does not exist,
  • DH performs a user authentication operation.
  • the DH performs the user identity verification operation, and specifically may call the fingerprint module for the DH, that is, verify the user identity by verifying the user fingerprint, and in addition to the fingerprint verification, for other authentication methods that may generate delay (such as P1N verification, iris verification, etc.)
  • P1N verification verifying the user fingerprint
  • iris verification iris verification
  • the DH indicates that the NFCC does not route the data frame to the NFCEE where the first application is located, and the specific implementation manner is similar to the step 209 in the foregoing Embodiment 1. Narration.
  • the DH sends a second message to the NFCC, to allow the NFCC to route the data frame to the NFCEE where the first application is located, and the specific implementation is the same as step 210 in the first embodiment. Similar, this will not be repeated here.
  • the corresponding user identity verification success flag may be set and saved for the first application, so that when the NFC mobile phone approaches the POS device again, the DH receives the NFCC transmission again.
  • the user authentication success token can be directly used for judgment, as in step 309 below. Because this is because the user may need to leave the POS and then re-close when verifying the fingerprint, or the time required for user authentication may be greater than the maximum delay handled by the POS, etc., it is designed for the completion of this transaction for two credit cards. Implementation plan.
  • the user identity verification success flag in this step is deleted after being used once, that is, when it is determined in the following step 309 that the user identity verification success flag exists, it is determined that the user identity verification is successful, and then the user identity is deleted. Verify the success flag to prevent the risk of property damage from being stolen when the NFC phone is stolen without being deleted.
  • the DH sends a second message to the NFCC.
  • the DH may directly verify the identity of the user after receiving the first message, or may determine that the user needs to be used when using the first application according to the user identity verification requirement corresponding to the first application. Authenticate the user after authentication. Then, the DH specifically determines the identity of the user, and may determine whether the user identity verification success token corresponding to the first application is saved locally. If yes, it is considered that the user authentication operation is performed for the first application before the DH, and the verification succeeds, that is, That is to say, at this time, DH no longer needs to perform user authentication identity operation, and can directly send a second message to the NFCC. It should be noted that the user identity verification success flag may be set and saved after the user authentication operation succeeds after the DH receives the first message sent by the NFCC when the DH is last close to the POS machine.
  • the NFCC determines to use the first application
  • the user identity verification is required
  • the first message is reported to the DH to indicate that the DH is required to perform the user identity verification operation
  • the DH determines that the user identity corresponding to the first application exists
  • the DH determines that the user authentication operation passes, sending a second message to the NFCC, the second message being the first command to allow the NFCC to route the data frame to the NFCEE where the first application is located.
  • the user identity verification success flag may be deleted after the user identity verification success flag is used to determine that the user identity verification operation does not need to be performed again (ie, after the user identity verification success flag is used once).
  • the DCH is directly used by the DH to judge the success of the verification (ie, it is not required to verify the identity of the current user (ie, the pirate) because the NFC mobile phone is stolen when the NFC mobile phone is stolen. Risk of property damage such as stolen brush.
  • the DH may also receive the NFCC transmission according to the preset time (which may be set by the user or the system).
  • the first message essentially, the NFCC receives the data frame sent by the POS machine) to determine whether to delete the success flag, and if the first message is not received within the preset time, the success flag is deleted, otherwise continue save.
  • the NFCC routes the data frame to the NFCEE where the first application is located according to the second message.
  • the step is similar to the step 211 in the first embodiment, and details are not described herein again.
  • the delay problem caused by the user to verify the fingerprint or other forms of identity information during the user identity verification process or the user usage habit is considered, and the user may need to leave the POS machine and verify the identity is successful.
  • the POS machine has improved the fault tolerance of the solution to some extent.
  • the DH receives the first message sent by the NFCC and executes the first message.
  • User authentication operation and when the user authentication operation is passed, the user authentication success token set for the first application is sent to the NFCC, so that the NFCC saves the user authentication success token; in the second credit card (ie, the NFC mobile phone)
  • the NFCC receives the POS machine (that is, the POS machine that is close to the first time when the card is swiped.
  • the POS machine that is close to the first card when judging the second card swipe.
  • the POS machine that is close to the time is judged by the same NFC device, for example, it can be judged by the terminal identification information of the NFC device, etc., and is not limited herein.
  • the user who sends the data selects the data frame of the first application, it can directly determine whether the local area is The user authentication success flag corresponding to the first application is saved, and if yes, the first message is not sent to the DH, but the routing of the data frame can be directly performed; otherwise, the first message is sent to the DH.At this time, the manner of saving or deleting the user identity verification success flag corresponding to the first application on the NFCC side is similar to the manner of saving or deleting the user identity verification success flag on the DH side, and details are not described herein again.
  • the embodiment of the present application is described in terms of determining whether the user authentication is required by the NFCC.
  • the following is a description of whether the DH needs to perform user identity verification.
  • FIG. 4 another embodiment of the data processing method in the embodiment of the present application includes:
  • DH records the AID of each application and its corresponding user authentication requirements.
  • step is similar to step 201 in the first embodiment, and details are not described herein again.
  • the DH sets a corresponding user identity verification request identifier for each application according to the user identity verification requirement corresponding to each application, and saves, for example, the association between the application AID and its corresponding user identity verification request identifier.
  • the relationship table is saved.
  • the DH configures a routing entry to the NFCC.
  • the DH configures a routing entry for the first application to the NFCC.
  • the first application may be any one of the applications installed on the DH, or Any one of the at least one application that has been activated in the application; the routing item may be an AID-based routing item, or may be other types of routing items, and details are not described herein again.
  • the DH can configure a routing entry to the NFCC through the listening mode routing table.
  • the routing table includes an AID-based routing entry corresponding to the first application. It should be noted that, the routing item corresponding to the first application does not include information indicating whether user identity verification is required when the first application is used, such as the user identity verification request identifier in the first embodiment.
  • the NFC mobile phone and the peer POS perform an RF discovery process to activate the RF protocol required by the POS to perform the service.
  • the POS machine sends a data frame to the NFCC, where the data frame is an application selection command for selecting the first application.
  • the NFCC finds a matching routing item for the received data frame.
  • the steps 403 to 405 are similar to the steps 203 to 205 in the foregoing embodiment, and details are not described herein again.
  • the NFCC sends a first message to the DH.
  • the NFCC sends a first message to the DH, where the first message is used to notify the DH peer POS machine to select the first application in the NFC mobile phone.
  • the NFCC passes the RF NFCEE.
  • the action mechanism reports the route to the DH, including the AID, the NFCEE identifier, and the like, and the NFCEE identifier is a unique identifier indicating the NFCEE where the first application is located.
  • the NFCC sends a first message including the foregoing data frame to the DH, where the data frame is used to notify the DH peer POS machine to select the first application in the NFC mobile phone, and the first message is used in addition to the foregoing data.
  • the DH peer POS machine can be directly notified to select the first application in the NFC mobile phone, which is not limited herein.
  • the NFCC when the NFCC reports the first message to the DH, the NFCC can report the information through the RFNFCEEAction mechanism.
  • a new notification of the DH may be added, such as the user identity verification notification USER_VALIDATION_JUDGEMENT_NTF, for requesting the DH to determine whether the user authentication is required.
  • the RF NFCEE Action mechanism reports the RF_NFCEE_ACTION_NTF notification.
  • the NFCC determines whether the first message needs to be sent to the DH according to the current energy state of the NFC mobile phone, where the NFCC determines that the NFC mobile phone does not need to send the first message to the DH when the current energy state of the NFC mobile phone is no power or shutdown state.
  • the current energy state may include an unpowered state, a power-off state, a bright screen and a locked state, a bright screen and an unlocked state, a screen-off state, a locked state, a screen-off state, and an unlocked state.
  • the routing items corresponding to the security-critical applications can be set to be unavailable in the no-power and/or shutdown state (for example, the corresponding energy state field)
  • the no-power and/off-off status bits are set to 0b), so that in the absence of power and/or shutdown, the NFCC cannot route the data frame to these card applications even if it finds a matching routing item for the received data frame.
  • the NFCEE is then forwarded to these card applications for processing, which avoids the consumption of these cards for consumption in the event of no power and/or shutdown. Therefore, in the no-power and/or power-off state, the NFCC no longer needs to send the first message to the DH to avoid waste of resources (because even if it is sent, the processing and response of the DH are not obtained).
  • the DH determines that the user identity verification request identifier corresponding to the first application indicates that user identity verification is not required, the DH instructs the NFCC to route the data frame to the NFCEE where the first application is located.
  • the DH may determine the user identity verification request identifier corresponding to the first application by using the identifier of the first application (such as the AID) included in the first message, where specifically, The DH searches for the user identity verification request identifier corresponding to the AID from the association table of the AID saved in step 401 and its corresponding user identity verification request identifier according to the AID. Then, DH determines the user authentication request corresponding to the first application. Whether the identifier indicates that the user authentication is required when using the first application, and if not, it is considered that the user authentication is not required when the first application is used. For example, if the user authentication request identifier corresponding to the bit is 0b, the indication is used. The first application corresponding to the AID does not require user authentication.
  • the DH indicates that the NFCC routes the data frame to the NFCEE where the first application is located, where a possible indication manner is that the DH sends a second message to the NFCC, where the second message is to allow the NFCC to perform data routing on the data frame.
  • a possible indication manner is that the DH sends a second message to the NFCC, where the second message is to allow the NFCC to perform data routing on the data frame.
  • the content included in the first command may be information related to user identity verification (ie, no user identity verification is required), and/or information indicating that the NFCC is allowed to perform data routing.
  • the NFCC can only determine according to the content that the DH allows the NFCC to route the data frame to the NFCEE where the first application is located.
  • the DH determines that the user identity verification request identifier corresponding to the first application indicates that user identity verification is required when using the first application, the DH performs a user identity verification operation.
  • the DH may determine the user identity verification request identifier corresponding to the first application by using the identifier of the first application (such as the AID) included in the first message, where specifically, The DH searches for the user identity verification request identifier corresponding to the AID from the association table of the AID saved in step 401 and its corresponding user identity verification request identifier according to the AID. Then, the DH determines whether the user identity verification request identifier corresponding to the first application indicates that the user identity verification is required when using the first application, and if yes, it is determined that the user identity verification is required when using the first application, that is, DH Perform user authentication operations.
  • the DH may determine the user identity verification request identifier corresponding to the first application by using the identifier of the first application (such as the AID) included in the first message, where specifically, The DH searches for the user identity verification request identifier corresponding to the AID from the association table of the AID saved in step 401 and its corresponding user identity verification request identifier according to
  • the DH performs the user identity verification operation, and the implementation manner is similar to the implementation manner described in the step 208 in the first embodiment, and details are not described herein again.
  • the DH sends a second message to the NFCC.
  • the DH when the user identity verification operation is passed, the DH sends a second message to the NFCC, where the second message is a first command that allows the NFCC to perform data routing processing on the data frame, where the NFCC is allowed to perform data routing on the data frame.
  • the process is to allow the NFCC to route the data frame to the NFCEE where the first application is located.
  • the content included in the first command may be information related to user identity verification (ie, the result of performing a user identity verification operation is passed), and/or information indicating that the NFCC is allowed to perform data routing.
  • the NFCC can only determine according to the content that the DH allows the NFCC to route the data frame to the NFCEE where the first application is located.
  • the NFCC performs routing processing on the data frame according to the second message.
  • the NFCC receives the second message, and performs routing processing on the data frame according to the second message.
  • the specific implementation manner is as follows:
  • the second message is a first command that allows the NFCC to perform data routing processing on the data frame.
  • the NFCC routes the data frame to the NFCEE where the first application is located.
  • Step 211 is similar, and will not be described here.
  • the NFCC may also receive the second message, but only the second message is a second command that does not allow the NFCC to perform data routing processing on the data frame. Then, the NFCC does not route the data frame to the first application. NFCEE, that is, NFCC cannot send a response message to the peer POS, so the POS machine is at the preset time. This communication is terminated when no response message is received (ie, the response timeout condition).
  • the DH indicates that the NFCC does not route the data frame to the NFCEE corresponding to the first application.
  • DH when DH performs user identity verification and fails verification, DH indicates that the NFCC does not route the data frame to the NFCEE where the first application is located.
  • the specific indication manner is similar to the step 209 in the first embodiment, and details are not described herein again.
  • the DH determines whether the user identity verification is required when the first application is used, and implements the application according to different cards.
  • Different security and convenience requirements adopt the most suitable first-application processing method, and a unified solution can be made, which makes the implementation simpler, lower development cost, shorter cycle, etc., where user authentication is required.
  • the application of the card indicates that the security requirement is higher than the convenience requirement.
  • the convenience requirement is higher than the security requirement; therefore, the security requirements of the embodiment of the present application are higher than the convenience.
  • the card application for sexual requirements performs user authentication, and the card application with higher convenience than the security requirement can realize the function of fast payment, and can also avoid the problems of affecting the user experience or complicating the user operation as described above.
  • the DH itself determines whether the user authentication is required.
  • the following describes an embodiment corresponding to the two card swipe scenarios of the solution similar to the second embodiment.
  • Embodiment 4 referring to FIG. 5, another embodiment of the data processing method in the embodiment of the present application includes:
  • DH records the AID of each application and its corresponding user authentication requirements.
  • the DH configures a routing entry to the NFCC.
  • the NFC mobile phone and the peer POS perform an RF discovery process to activate the RF protocol required by the POS to perform the service.
  • the POS machine sends a data frame to the NFCC, where the data frame is an application selection command for selecting the first application.
  • the NFCC finds a matching routing item for the received data frame.
  • the NFCC sends a first message to the DH.
  • DH determines that user authentication is not required when using the first application, DH instructs the NFCC to route the data frame to the NFCEE where the first application is located.
  • the steps 501 to 507 are similar to the steps 401 to 407 in the third embodiment, and details are not described herein again.
  • the DH determines that the user authentication is required when the first application is used, and the user identity verification success flag corresponding to the first application exists, the DH indicates that the NFCC routes the data frame to the NFCEE where the first application is located.
  • the DH determines whether the user identity verification success flag corresponding to the first application exists or not, and if the DH determines that the user identity corresponding to the first application exists. To verify the success flag, DH instructs the NFCC to route the data frame to the NFCEE where the first application is located.
  • the DH determines that the first application is required to perform user identity verification. Specifically, after receiving the first message sent by the NFCC, the DH may pass the identifier of the first application (such as an AID) included in the first message. Determining a user identity verification request identifier corresponding to the first application, for example, the DH searches for the user identity verification request identifier corresponding to the AID from the association relationship between the AID saved in step 401 and the corresponding user identity verification request identifier according to the AID, The DH determines whether the user identity verification request identifier corresponding to the first application indicates that the user identity verification is required when the first application is used, and if yes, it is determined that the user identity verification is required when the first application is used.
  • the identifier of the first application such as an AID
  • the DH indicates that the NFCC routes the data frame to the NFCEE where the first application is located, where a possible indication manner is that the DH sends a second message to the NFCC, where the second message is to allow the NFCC to perform data routing on the data frame.
  • the content included in the foregoing first command may be information related to user identity verification (that is, the result of performing the user identity verification operation is passed, or information indicating that the user identity verification success flag exists), and/or , indicating the information that allows the NFCC to perform data routing.
  • the NFCC can only determine according to the content that the DH allows the NFCC to route the data frame to the NFCEE where the first application is located.
  • the DH determines that the user authentication is required when the first application is used, and the user identity verification success flag corresponding to the first application does not exist, the DH performs a user identity verification operation.
  • the DH determines whether the user identity verification success flag corresponding to the first application exists or not, and if the DH determines that the user corresponding to the first application does not exist. If the authentication is successfully marked, the DH performs the user authentication operation.
  • the specific implementation mode is that the DH invokes the fingerprint module, that is, the user identity is verified by verifying the user fingerprint, and in addition to the fingerprint verification, other authentication methods that may generate delays (such as The P1N verification, the iris verification, and the like are also applicable to the embodiment, which is not limited herein.
  • the DH sends a second message to the NFCC.
  • the corresponding user identity verification success flag may be set and saved for the first application, so that the NFC mobile phone is close to the POS machine again.
  • the DH receives the first message sent by the NFCC again, the DH can directly use the user identity verification success flag to perform the determination, as in step 508 or 509 above. Because this is because the user may need to leave the POS and then re-close when verifying the fingerprint, or the time required for user authentication may be greater than the maximum delay handled by the POS, etc., it is designed for the completion of this transaction for two credit cards. Implementation plan.
  • the user identity verification success flag in this step is deleted after being used once, that is, when it is determined in the above step 508 that the user identity verification success flag is present, it is determined that the user identity verification is successful, and then the user identity is deleted. Verify the success flag to prevent the risk of property damage from being stolen when the NFC phone is stolen without being deleted.
  • the NFCC routes the data frame to the NFCEE where the first application is located according to the second message.
  • the NFCC is instructed not to route the data frame to the NFCEE corresponding to the first application.
  • step 510 to step 512 are performed under the condition that the DH determines that there is no user identity verification success flag corresponding to the first application, which is different from step 409 to step 411 in the third embodiment.
  • the usage habits of the user in performing identity verification are also considered (such as directly checking the fingerprint in the process of attaching the POS machine, or picking up the fingerprint after attaching the POS machine) or a possible delay, therefore, To some extent, the fault tolerance rate of the program has been improved.
  • the routing entry corresponding to the first application when the routing entry corresponding to the first application is configured by the DH to the NFCC, the routing entry needs to be set to point to the NFCEE where the first application is located (that is, the Route in the routing item defined in the NCI protocol).
  • the parameter is set to the NFCEE identifier of the first application), whether it is NFCC or DH, the first choice for the opposite POS machine.
  • the corresponding user authentication request identifier is used for judging, and the NFCC is allowed to perform routing processing on the data frame sent by the POS machine only if the user authentication is not required or the user authentication is required and the verification is passed.
  • the frame is routed to the NFCEE where the first application is located.
  • the DH When the DH configures the routing entry corresponding to the first application to the NFCC, the DH only sets the routing entry corresponding to the application that does not require user authentication to the NFCEE where the application is located. And the routing item corresponding to the first application that requires the user authentication is set to point to the DH, then the NFCC can route the data frame to the DH after receiving the data frame of the first application, and then the DH pair The user identity verification request identifier corresponding to the first application is determined, and the routing entry corresponding to the first application is reconfigured to the NFCC to change the routing entry to the NFCC only if the user authentication is required and the verification is passed. Points to the NFCEE where the first application is located.
  • Embodiment 5 Referring to FIG. 6, another embodiment of the data processing method in the embodiment of the present application includes:
  • the DH records the identifier of each application (such as the application identifier AID) and its corresponding user identity verification requirement.
  • the step is similar to the step 401 in the foregoing embodiment 3.
  • the DH sets a corresponding user identity verification request identifier for each application according to the user identity verification requirement corresponding to each application, and saves the identifier, for example, by applying the AID.
  • the association table corresponding to the user authentication request identifier is saved. Others will not go into details.
  • the DH configures a second routing entry to the NFCC.
  • step 602 is different from step 402 in the third embodiment.
  • each routing item configured by the DH to the NFCC is directed to the NFCEE where each application (such as the application corresponding to the AID in the routing entry) is located. .
  • the DH selects a specific AID, and configures a second routing entry for the first application corresponding to the specific AID, where the second routing entry is a near field communication execution environment DH-NFCEE corresponding to the DH.
  • the DH selects a specific AID according to the user identity verification request identifier corresponding to each AID in step 601. For example, the DH marks the AID corresponding to the user identity verification request identifier that needs to perform user identity verification, thereby selecting a specific AID. And configuring a second routing item for the first application corresponding to the specific AID.
  • the second routing item may include an identifier of the DH-NFCEE, where the identifier is used to uniquely identify the DH-NFCEE corresponding to the DH corresponding near field communication execution environment.
  • the DH is When setting a routing item, you can set the NFCEE ID in the second routing entry set for bank card 1 to the ID of DH-NFCEE (for example, 0x00), and the routing items set for bank card 2 and bus card respectively point to the card.
  • DH-NFCEE for example, 0x00
  • the NFC mobile phone and the peer POS perform an RF discovery process to activate the RF protocol required by the POS to perform the service.
  • the POS machine sends a data frame to the NFCC, where the data frame is an application selection command for selecting the first application.
  • the NFCC finds a matching second routing item for the received data frame.
  • the steps 603 to 605 are similar to the steps 203 to 205 in the foregoing embodiment, and details are not described herein again.
  • the NFCC sends a first message to the DH according to the second routing item, where the first message is the data frame.
  • the NFCC after the NFCC receives the data frame sent by the POS machine, the NFCC selects a command according to an application in the data frame (such as a SelectAID command), and finds a matching second routing item (such as the AID in the command and the Second After the AIDs in the routing entries match, the NFCC routes the above data frame to the routing destination DH pointed to by the second routing entry.
  • a command such as a SelectAID command
  • a matching second routing item such as the AID in the command and the Second
  • the RF communication is terminated. If the command to configure the third routing entry sent by the DH is received within the set time, the data frame is rerouted according to the newly configured third routing entry.
  • the DH determines that the user identity verification request identifier corresponding to the first application indicates that user identity verification is required when using the first application, perform a user identity verification operation.
  • the DH determines that the user identity verification request identifier corresponding to the first application indicates that the user identity needs to be performed when the first application is used, and the AID corresponding to the first application selected by the DH to determine the data frame is marked as Specific AID.
  • the DH performs the user identity verification operation, specifically, the DH invokes the user identity verification module to perform user identity verification, where the user identity verification module may be a fingerprint module, that is, the user identity is verified by verifying the user fingerprint, and of course, Other authentication methods, such as PIN verification, iris, and other biometric verification, wearable device verification (ie, verifying the presence of a particular wearable device connected to the terminal via a wireless technology (such as Bluetooth)) There are no restrictions here.
  • the user identity verification module may be a fingerprint module, that is, the user identity is verified by verifying the user fingerprint, and of course, Other authentication methods, such as PIN verification, iris, and other biometric verification, wearable device verification (ie, verifying the presence of a particular wearable device connected to the terminal via a wireless technology (such as Bluetooth)
  • the DH determines that the user authentication request identifier corresponding to the first application indicates that the user authentication is not required when using the first application, it indicates that the NFCEE where the first application is located is originally DH-NFCEE, thus, DH The message that the user answers the data frame (such as the Select response) can be directly sent to the NFCC, so that the NFCC can reply it to the peer POS machine. Therefore, the solution of the fifth embodiment design is for those card applications that are not operating in DH (ie, DH-NFCEE).
  • the DH indicates that the NFC does not route the data frame to the NFCEE where the first application is located.
  • the DH indicates that the NFC does not route the data frame to the NFCEE where the first application is located.
  • the specific instructions are as follows:
  • the DH terminates the communication. Specifically, the DH sends an RF protocol deactivation command defined by the NCI protocol or other command that can terminate the communication to the NFCC. Alternatively, the DH does not send any information to the NFCC. The message is acknowledged, so that the NFCC cannot answer the POS machine of the opposite end. Once the response times out, the POS machine terminates the current communication with the NFC mobile phone (ie, disconnects the NFC connection between the two).
  • the DH sends a second message to the NFCEE, the second message is a command that does not allow the NFCC to route the data frame to the NFCEE where the first application is located, or does not allow the NFCC to the opposite POS.
  • the command to answer the machine.
  • the user identity verification fails, which may be specifically: if the user identity verification fails within the preset identity verification time period or within the preset identity verification times, the DH determines the user identity verification. Failed (ie allows the user to perform multiple verifications within a preset time).
  • the DH sends a second message to the NFCC, where the second message is used for configuration.
  • the third routing item If the user authentication operation passes, the DH sends a second message to the NFCC, where the second message is used for configuration.
  • the DH configures a third routing entry to the NFCC, where the third routing entry is set to point to the NFCEE where the first application is located, and the NFCEE where the first application is located is not DH.
  • the corresponding near field communication execution environment DH-NFCEE is not DH.
  • the third routing item configured by the DH to the NFCC includes an identifier of the first application (such as an AID of the first application), a unique identifier indicating the NFCEE where the first application is located, and the like.
  • the NFCEE routes the data frame to the NFCEE where the first application is located.
  • the NFCC after the NFCC receives the second message (that is, the second command for configuring the third routing entry), the NFCC routes the data frame to the NFCEE where the first application pointed to by the third routing entry is located.
  • the DH reconfigures the second routing entry to the NFCC.
  • the DH when the radio frequency RF communication ends, the DH reconfigures the second routing item to the NFCC, where the second routing item includes a near field communication execution environment DH-NFCEE corresponding to the DH.
  • the radio frequency RF communication described herein ends, specifically, the DH is determined after receiving the notification that the NFCC reports that the opposite radio frequency RF field disappears (ie, by the RF_FIELD_INFO_NTF notification), or DH Determined when no message of NFCC is received within the specified time, or DH deactivates the RF interface RF interface between DH and NFCC for any reason (such as transmission error in data interaction, protocol error, timeout, etc.)
  • the method defined by the other NCI protocol to determine the end of the RF communication is not limited herein.
  • the method of swiping the card may be used once in the first embodiment or the third embodiment, or the method of swiping the card twice in the second embodiment or the fourth embodiment.
  • the routing item can only be configured when the RF communication state machine is in the IDLE state (ie, RFST_IDLE)
  • the following manner can be implemented. Re-configuration of the routing entry (that is, updating the second routing entry corresponding to the first application to the third routing entry).
  • the DH sends a corresponding command (such as RF_DEACTIVE_CMD (Idle mode)) to the NFCC to enable the state machine to perform the data interaction phase.
  • the corresponding ACTIVE state (ie, RFST_LISTEN_ACTIVE) becomes the IDLE state, and then the routing table is updated (ie, reconfigured); again, the DH is allowed to reconfigure the routing table directly in the ACTIVE state.
  • the time limit may be increased in the first embodiment or the third embodiment. For example, after the NFCC forwards the received data frame to the DH through the first message, if the DH is received within the preset time, the third routing entry is configured.
  • the second command (ie, the second message) re-routes the data frame according to the newly configured routing item (that is, routes the data frame to the NFCEE where the first application is located according to the third routing item); otherwise, the NFCC considers this
  • the secondary RF communication ends.
  • the NFC mobile phone and the POS machine perform two RF communications in succession, as long as the NFC mobile phone is in the IDLE state after leaving the POS.
  • DH can reconfigure routing entries for NFCC. At this time, similar to the second or fourth embodiment, the time limit is increased.
  • the DH configures the third routing item by using the second message
  • the next RF communication is not performed with the peer POS machine within a preset time (more specifically, If the DH does not receive the data frame for the first application to be forwarded by the NFCC within the preset time after the reconfiguration of the routing entry, the DH needs to configure the routing entry again to restore the original routing table (that is, the first application corresponds to the first application).
  • the third routing entry is updated again to the second routing entry, that is, the routing entry of the application represented by the specific AID is also Is pointing to DH).
  • DH saves the user identity success token after verifying the user identity after the first card swiping, and then directly uses the card when the second card is swiped.
  • the success flag is determined whether the user identity verification is passed by determining whether the success flag exists, and details are not described herein again.
  • the DH does not modify the current NCI standard, so that the DH sets a routing entry that points to the DH by using the first application that needs to perform user authentication, and receives the data for selecting the first application that is forwarded by the NFCC.
  • User authentication is performed after the frame, and the routing entry pointing to the NFCEE where the first application is located is reconfigured to the NFCC only when it is determined that the verification has passed, so that the NFCC can route the data frame to the NFCEE where the first application is located.
  • the user identity verification can be performed on the card application with the security requirement higher than the convenience requirement, and the card application with the convenience requirement higher than the security requirement can realize the function of fast payment, and can also avoid the foregoing.
  • the impact of the user experience or the complexity of the user's operation, in addition, the above two brushing schemes can still be to some extent High fault tolerance of the program.
  • the actions of the policy entity in the first embodiment to the fifth embodiment may also be performed by the processor in the first terminal 8 as shown in FIG. 8 by calling the application code stored in the memory 803. There are no restrictions on the case.
  • the DH records the application identifier as an example of the AID of the application, and the DH configures the routing entry as an example.
  • the routing item may also be other types of routing items, such as an APDU pattern-based routing item defined by the NCI, an SC-based routing item, a protocol-based routing item, a technology-based routing item, and a mandatory NFCEE routing mechanism, etc.
  • the identifier of the application may also be other information that can represent the application, such as application-related APDU pattern information (such as reference data and mask), application-related SC information (such as SC list), and application-related RF protocol information (such as ISO).
  • NFCEE in which it is located, etc., is not limited by the present invention.
  • the data processing method in the embodiment of the present application has been described above.
  • the host DH in the embodiment of the present application is described below.
  • an embodiment of the host DH in the embodiment of the present application includes:
  • the first receiving unit 701 is configured to receive a first message sent by the NFCC, where the first message is used to notify the DH that the second terminal is to select the first application on the first terminal, and/or to request the DH to be executed.
  • User authentication operation
  • the verification unit 702 is configured to perform a user identity verification operation if the DH determines that user identity verification is required;
  • the first sending unit 703 is configured to: when the result of the user identity verification operation is passed, send a second message to the NFCC, where the second message is a first command that allows the NFCC to perform data routing on the data frame, where the data frame
  • the message sent by the second terminal to the NFCC indicates that the first application is to be selected.
  • the host DH formulates a unified solution according to different security and convenience requirements of different card applications, and indicates that the security requirement is higher than the convenience requirement for the card application that needs to perform user identity verification; For card applications that do not require user authentication, the convenience requirements are higher than the security requirements.
  • other possible embodiments of the host DH in the embodiment of the present application may further include:
  • the first receiving unit 801 may specifically include a first receiving module 8011.
  • the first receiving module 8011 is specifically configured to:
  • the verification unit 802 may specifically include: one or more modules of the first determining module 8021, the second determining module 8022, the third determining module 8023, or the fourth determining module 8024.
  • the functions of each module are as follows:
  • the first determining module 8021 is configured to determine, according to the user identity verification request identifier corresponding to the first application, that the user identity verification is required; wherein the user identity verification request identifier is used to indicate that the user identity needs to be verified when the first application is used;
  • the second determining module 8022 is configured to determine, according to the user identity verification request identifier corresponding to the first application, that user identity verification is required when the first application is used;
  • the third determining module 8023 is configured to: if the DH determines that the user identity verification success flag corresponding to the first application exists, determine, according to the user identity verification success flag, that the user identity verification operation passes; or
  • the fourth determining module 8024 is configured to: if the DH determines that the user identity verification success flag corresponding to the first application does not exist, receive, by the identity verification module of the first terminal, the user identity information to determine the user identity verification operation. Whether it passed.
  • the first sending unit 803 includes a first sending module 8031, where the first sending module 8031 is configured to send, to the NFCC, a second message including a third routing item, where The third routing entry includes an identifier of the NFCEE where the first application is located.
  • the host DH further includes: a second sending unit 804, a third sending unit 805, a fourth sending unit 806, a fifth sending unit 807, a deleting unit 808, or a configuration unit 809.
  • a second sending unit 804 a third sending unit 805, a fourth sending unit 806, a fifth sending unit 807, a deleting unit 808, or a configuration unit 809.
  • a third sending unit 805 a fourth sending unit 806, a fifth sending unit 807, a deleting unit 808, or a configuration unit 809.
  • a second sending unit 804 configured to send, to the NFCC, a first routing item that includes a user identity verification request identifier, where the user identity verification request identifier is used to indicate that the user identity is required or not required to use the first application;
  • the third sending unit 805 is configured to: if the user identity verification request identifier corresponding to the first application indicates that the user identity needs to be verified when the first application is used, send a second routing item to the NFCC, where the second routing item includes the DH Corresponding near field communication execution environment DH-NFCEE identifier, the DH-NFCEE is not the NFCEE where the first application is located;
  • the fourth sending unit 806 is configured to: if the DH determines that user identity verification is not required, send the second message to the NFCC, where the second message is the first command that allows the NFCC to perform data processing on the data frame;
  • the fifth sending unit 807 is configured to send a second message to the NFCC or not send any message when the user identity verification operation fails, the second message is a second that does not allow the NFCC to perform data routing on the data frame. command;
  • the deleting unit 808 is configured to: when the DH does not receive the first message sent by the NFCC again within a preset time period, or after the DH determines, according to the user identity verification success flag, that the user identity verification operation is passed, Delete the user authentication success token;
  • the configuration unit 809 is configured to: when the communication ends, or when the DH does not receive the data frame sent by the second terminal for selecting the first application again within a preset time after the end of the communication Reconfigure to the NFCC The second routing entry.
  • the user identity verification request identifier is determined by the DH according to the registration information and/or the user indication of the first application, where the registration information of the first application includes the first The application type of an application and/or the required parameters for representing authentication.
  • the user identity verification success flag is that the DH is saved after the identity verification module of the first terminal determines that the user identity verification operation is passed.
  • the sixth embodiment is described in detail in the main sentence DH in the embodiment of the present application.
  • the near field communication controller NFCC in the embodiment of the present application is described below.
  • an embodiment of the near field communication controller NFCC in the embodiment of the present application includes:
  • the first receiving unit 901 is configured to: after receiving the data frame sent by the second terminal, find a matching first routing item, where the data frame is used to indicate that the first application on the first terminal is to be selected;
  • the first determining unit 902 is configured to determine, according to the preset condition, whether to send the first message to the DH, where the first message is used to notify the DH that the second terminal is to select the first application on the first terminal, And/or for requesting the DH to perform a user authentication operation;
  • the first sending unit 903 is configured to: if yes, send the first message to the DH;
  • the first routing unit 904 is configured to: if the NFCC receives the second message sent by the DH, perform routing processing on the data frame according to the second message.
  • the near field communication controller NFCC formulates a unified solution according to different security and convenience requirements of different card applications.
  • the security requirement is higher than the convenience.
  • the method may further include:
  • the first receiving unit 1001 may include a first query module 10011, where the first query module 10011 is configured to: after the NFCC receives the data frame sent by the second terminal, And determining, by the routing manner, the first routing item that matches the first application, where the routing manner includes a routing manner based on the application identifier AID.
  • the first determining unit 1002 may include: a first determining module 10021, a first determining module 10022, a second determining module 10023, a second determining module 10024, or a third determining module 10025.
  • a first determining module 10021 a first determining module 10021, a first determining module 10022, a second determining module 10023, a second determining module 10024, or a third determining module 10025.
  • One or more modules in the module; wherein the functions of each module are as follows:
  • the first determining module 10021 is configured to determine, according to the user identity verification request identifier in the first routing item, whether to send the first message to the DH.
  • the first determining module 10022 is configured to: if the user identity verification request identifier indicates that the user identity needs to be verified when using the first application, determine that the first message is to be sent to the DH;
  • the second determining module 10023 is configured to: if the user identity verification request identifier indicates that the user identity is not required to be used when the first application is used, determine that the first message is not sent to the DH;
  • the second determining module 10024 is configured to determine, according to the current energy state of the first terminal, whether the first message needs to be sent to the DH; or
  • the third determining module 10025 is configured to determine, according to the presence or absence of the user identity verification success flag corresponding to the first application, whether the first message needs to be sent to the DH, where the user identity verification success flag is that the NFCC is receiving, the DH The message sent after the message indicating the user authentication operation is saved.
  • the second determining module 10024 can include a first determining submodule 100241 and a second determining submodule 100242, where
  • the first determining sub-module 100241 is configured to determine that the first message needs to be sent to the DH if the current energy state of the first terminal is not the power-off state and the power-off state;
  • the second determining sub-module 100242 is configured to determine that the first message does not need to be sent to the DH if the current energy state of the first terminal is an unpowered or powered-off state.
  • the third determining module 10025 may include a third determining submodule 100251 and a fourth determining submodule 100252.
  • a third determining sub-module 100251 configured to: if the user identity verification success flag exists, determine that the first message needs to be sent to the DH;
  • the fourth determining submodule 100252 is configured to determine that the first message does not need to be sent to the DH if the user identity verification success flag does not exist.
  • the first sending unit 1003 may include a first sending module 10031, where the first sending module 10031 is configured to send a first message including the data frame to the DH.
  • the first routing unit 1005 may include: one or more modules in the first routing module 10051, the second routing module 10052, or the third routing module 10053, and functions of each module. details as follows:
  • the first routing module 10051 is configured to: when the second message is sent by the DH after the user identity verification operation is passed, indicating that the NFCC is allowed to perform the first command of data routing, routing the data frame to the first application NFCEE; or,
  • the second routing module 10052 is configured to: when the second message is sent by the DH after the user identity verification operation fails, indicating that the NFCC is not allowed to perform the second command of data routing, the data frame is not routed to the first NFCEE where the application is located, or terminate this communication;
  • the third routing module 10053 is configured to: when the second message is a routing configuration command including the second routing item, routing the data frame to the NFCEE where the first application is located, where the second message is the user authentication of the DH After the operation is passed or after determining that the first application is used, it is not required to verify the identity of the user.
  • the second routing item includes the identifier of the first application and the identifier of the NFCEE where the first application is located.
  • the near field communication controller NFCC further includes one or two units of the second routing unit 1006 and the terminating unit 1007.
  • the specific functions of the two units are as follows:
  • a second routing unit 1006, configured to perform routing processing on the data frame if not;
  • the terminating unit 1007 is configured to terminate the current communication if the NFCC does not receive any message sent by the DH within a preset time period.
  • the second routing unit 1006 can include a fourth routing module 10061, where the fourth routing module 10061 is configured to route the data frame to the NFCEE where the first application is located.
  • the near field communication controller NFCC further includes a second receiving unit 1004,
  • the second receiving unit 1004 is configured to receive the first routing entry of the DH configuration, where the first routing entry includes an identifier of the first application and the first NFCEE identifier, where the first NFCEE identifier is the first The identifier of the NFCEE where the application is located or the identifier of the near field communication execution environment DH-NFCEE corresponding to the DH.
  • the above embodiments respectively describe the functional entities of the host DH and the near field communication controller NFCC in the embodiments of the present application. It should be noted that the near field communication controller NFCC and the host DH are similar in hardware implementation, and the near field communication control is performed.
  • the NFCC can refer to the description of the hardware aspect of the host DH. For details, the host DH in the embodiment of the present application is described below.
  • the processor in the host DH11 as shown in FIG. 11 can perform the actions of the policy entity in the foregoing Embodiments 1 to 5 by calling the application code stored in the memory 1103. Do not make any restrictions.
  • a hardware structure diagram of a host DH11 includes at least one processor 1101, a communication bus 1102, a memory 1103, and at least one communication unit 1104.
  • the processor 1101 may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more programs for controlling the execution of the program of the present application. integrated circuit.
  • CPU central processing unit
  • ASIC application-specific integrated circuit
  • the processor 1101 may configure a listening mode routing table to the NFCC by using an NCI based routing configuration command/response (RF_SET_LISTEN_MODE_ROUTING_CMD/RSP) in an initialization phase of the NFC device, which may include The routing entry of the AID (including the application identifier AID and the NFCEE ID of the NFCEE where the application is located), etc., so that the NFCC can find the matching route target NFCEE according to the AID-based routing item after receiving the selectAID command.
  • an NCI based routing configuration command/response RF_SET_LISTEN_MODE_ROUTING_CMD/RSP
  • the processor 1101 can also correspond to the NFCEE of the NFC device, and the NFCEE can communicate with the NFCC through a protocol (such as HCI/SWP), so that the NFCEE can receive and process the peer NFC device forwarded by the NFCC (ie, the second terminal).
  • a protocol such as HCI/SWP
  • Communication bus 1102 can include a path for communicating information between the components described above.
  • the communication unit 1104 uses a device such as any transceiver for communicating with other devices or communication networks, such as Ethernet, Radio Access Network (RAN), Wireless Local Area Networks (WLAN), etc. .
  • a device such as any transceiver for communicating with other devices or communication networks, such as Ethernet, Radio Access Network (RAN), Wireless Local Area Networks (WLAN), etc. .
  • RAN Radio Access Network
  • WLAN Wireless Local Area Networks
  • the communication unit 1104 may further include a module for communicating with the NFCC, such as an interface between the DH and the NFCC, the interface may support the NCI protocol at the upper layer, and may be used at the bottom layer.
  • Universal Asynchronous Receiver/Transmitter (UART), 12C bus (Inter-Integrated Circuit) or half-duplex Serial Peripheral Interface (SPI) to transmit data.
  • the DH can configure the RF parameters, the routing table, and the like to the NFCC through the communication unit 1104, so that the NFCC can communicate with the NFC device of the opposite end in the RF discovery process, and receive the first message sent by the NFCC to perform corresponding according to the first message.
  • the memory 1103 can be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type that can store information and instructions.
  • ROM read-only memory
  • RAM random access memory
  • EEPROM Electrically erasable programmable read only memory
  • CD-ROM Compact Disc Read-Only Memory
  • CD-ROM Compact Disc Read-Only Memory
  • optical disc storage including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.
  • the memory 1103 is configured to store application code for executing the solution of the present application, and is controlled by the processor 1101 to execute.
  • the processor 1101 is configured to execute the application code stored in the memory 1103, thereby implementing the AR projection method in the above embodiment.
  • the storage unit may store an NFC application installed in the DH-NFCEE or NFCEE(s), and a routing program and a routing table in the NFCC.
  • the processor 1101 may include one or more CPUs, such as CPU0 and CPU1 in FIG.
  • the host DH11 may include multiple processors, such as the processor 1101 and the processor 1108 in FIG. Each of these processors can be a single-CPU processor or a multi-core processor.
  • a processor herein may refer to one or more devices, circuits, and/or processing cores for processing data, such as computer program instructions.
  • the host DH11 may further include an output device 1105 and an input device 1106.
  • the output device 1105 is in communication with the processor 1101 and can display information in a variety of ways.
  • the output device 1105 can be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector. Wait.
  • Input device 1106 is in communication with processor 1101 and can accept user input in a variety of ways.
  • input device 1106 can be a mouse, keyboard, touch screen device, or sensing device, and the like.
  • the host DH11 described above may be a general terminal or a dedicated terminal.
  • the host DH11 may be a desktop computer, a portable computer, a network server, a personal digital assistant (PDA), a mobile phone, a tablet, a wireless terminal device, an embedded device, or a device having a similar structure as in FIG. .
  • PDA personal digital assistant
  • the embodiment of the present application does not limit the type of the host DH11.
  • the communication unit 1104 may further include a module for communicating with the DH, such as an interface between the DH and the NFCC, and the interface may be in the upper layer.
  • Support NCI protocol at the bottom layer can use Universal Asynchronous Receiver/Transmitter (UART), 12C bus (Inter-Integrated Circuit) or half-duplex Serial Peripheral Interface (SPI) to transmit data
  • UART Universal Asynchronous Receiver/Transmitter
  • 12C bus Inter-Integrated Circuit
  • SPI Serial Peripheral Interface
  • the NFCC can receive the RF parameters, the routing table, and the like of the DH configuration through the communication unit 1104, so as to be able to communicate with the NFC device of the opposite end in the RF discovery process, and send the first message to the DH, so that the DH performs the first message according to the first message.
  • SPI Serial Peripheral Interface
  • Corresponding user authentication processing, and receiving a second message sent by the DH to perform corresponding data routing processing according to the second message, and the like may further include performing, for performing, with the NFC device (ie, the second terminal) of the peer end a module for communication (ie, transmitting data to and receiving data from a second terminal), such as a transceiver circuit in the NFCC, and the NFC in the transceiver circuit Line operating frequency may be 13.56MHz, NFCC may transmit data to the second terminal through the NFC antenna may also receive data from the second terminal.
  • a module for communication ie, transmitting data to and receiving data from a second terminal
  • the NFC in the transceiver circuit Line operating frequency may be 13.56MHz
  • NFCC may transmit data to the second terminal through the NFC antenna may also receive data from the second terminal.
  • the disclosed system, apparatus, and method may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium.
  • a computer readable storage medium A number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present application.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

Des modes de réalisation de la présente invention concernent un procédé de traitement de données et un dispositif associé pour fournir une solution unifiée pour des applications de carte ayant différentes exigences de sécurité et de commodité. Le procédé dans les modes de réalisation de l'invention comprend les étapes suivantes : un DH reçoit un premier message envoyé par un NFCC, le premier message étant utilisé pour notifier au DH qu'un second terminal doit sélectionner une première application sur un premier terminal, et/ou étant utilisée pour demander au DH d'effectuer une opération d'authentification d'identité d'utilisateur ; le DH effectuant l'opération d'authentification d'identité d'utilisateur si le DH détermine que l'authentification d'identité d'utilisateur est requise ; le DH envoie un second message au NFCC si l'opération d'authentification d'identité d'utilisateur est réussie, le second message étant une première commande qui permet au NFCC d'effectuer un routage de données sur une trame de données, et la trame de données étant un message qui est envoyé par le second terminal au NFCC et indiquant que le second terminal doit sélectionner la première application.
PCT/CN2017/075786 2017-03-06 2017-03-06 Procédé de traitement de données et dispositif associé Ceased WO2018161224A1 (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2017/075786 WO2018161224A1 (fr) 2017-03-06 2017-03-06 Procédé de traitement de données et dispositif associé
CN201780026377.6A CN109076428B (zh) 2017-03-06 2017-03-06 一种数据处理方法及相关装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2017/075786 WO2018161224A1 (fr) 2017-03-06 2017-03-06 Procédé de traitement de données et dispositif associé

Publications (1)

Publication Number Publication Date
WO2018161224A1 true WO2018161224A1 (fr) 2018-09-13

Family

ID=63447153

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/075786 Ceased WO2018161224A1 (fr) 2017-03-06 2017-03-06 Procédé de traitement de données et dispositif associé

Country Status (2)

Country Link
CN (1) CN109076428B (fr)
WO (1) WO2018161224A1 (fr)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111383011B (zh) * 2018-12-29 2023-09-29 华为技术有限公司 一种处理中继攻击的方法以及安全单元
CN112929921B (zh) * 2019-12-05 2023-01-13 维沃移动通信有限公司 波束失败恢复方法、终端及网络侧设备
CN114386960B (zh) * 2020-10-19 2025-08-22 中国移动通信有限公司研究院 基于nfc的交易方法、装置、用户身份识别设备及终端

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130217323A1 (en) * 2012-02-13 2013-08-22 Qualcomm Incorporated Methods and apparatus for secure updates to persistent data in a near field communication controller
CN103503323A (zh) * 2013-03-05 2014-01-08 华为终端有限公司 近场通信射频通信方法、装置和终端设备
CN103828408A (zh) * 2011-09-23 2014-05-28 高通股份有限公司 用于改进nfcee发现过程的方法和装置
CN105574723A (zh) * 2015-12-14 2016-05-11 联想(北京)有限公司 信息的安全处理方法及安全处理装置
CN105608572A (zh) * 2015-07-27 2016-05-25 宇龙计算机通信科技(深圳)有限公司 基于nfc的支付方法、基于nfc的支付系统和终端
CN105868983A (zh) * 2016-04-26 2016-08-17 北京小米移动软件有限公司 信息输出控制方法和装置、智能终端

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102100121B (zh) * 2008-07-20 2016-08-03 三星电子株式会社 在近距离通信中管理多个应用的方法和系统
CN105659507B (zh) * 2014-09-30 2019-02-26 华为技术有限公司 路由的方法、近场通信控制器、主控制器和终端

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103828408A (zh) * 2011-09-23 2014-05-28 高通股份有限公司 用于改进nfcee发现过程的方法和装置
US20130217323A1 (en) * 2012-02-13 2013-08-22 Qualcomm Incorporated Methods and apparatus for secure updates to persistent data in a near field communication controller
CN103503323A (zh) * 2013-03-05 2014-01-08 华为终端有限公司 近场通信射频通信方法、装置和终端设备
CN105608572A (zh) * 2015-07-27 2016-05-25 宇龙计算机通信科技(深圳)有限公司 基于nfc的支付方法、基于nfc的支付系统和终端
CN105574723A (zh) * 2015-12-14 2016-05-11 联想(北京)有限公司 信息的安全处理方法及安全处理装置
CN105868983A (zh) * 2016-04-26 2016-08-17 北京小米移动软件有限公司 信息输出控制方法和装置、智能终端

Also Published As

Publication number Publication date
CN109076428B (zh) 2021-06-29
CN109076428A (zh) 2018-12-21

Similar Documents

Publication Publication Date Title
US12022290B2 (en) Secure elements broker (SEB) for application communication channel selector optimization
CN109844789B (zh) 一种终端交易方法及终端
US20210287204A1 (en) Near Field Communication NFC-Based Transaction Method and Device
KR101354804B1 (ko) 추가 요소를 이용한 이동 장치의 갱신
CN104115173B (zh) 用于在仿真非接触式支付卡的移动终端内进行路由的方法
JP6305559B2 (ja) セキュアエレメント管理方法及び端末
CN103548395B (zh) 用于具有安全元件的电池的方法和设备
RU2481617C2 (ru) Способ и устройство автоматического выбора приложения связи ближнего радиуса действия в электронном устройстве
CN110020569A (zh) 自动选择nfc模拟卡的方法、电子设备及通信系统
WO2019206201A1 (fr) Procédé de transmission de fichier de configuration, dispositif associé et support de stockage
KR20120082010A (ko) 무선 주파수 신호의 증폭
WO2010022642A1 (fr) Terminal mobile enfc et procédé associé de contrôle de paiement électronique
JP6858200B2 (ja) データフレームをルーティングするための方法、近距離無線通信コントローラ、および端末
CN109076428B (zh) 一种数据处理方法及相关装置
CN112840572B (zh) 近场通信路由方法、近场通信设备和蜂窝电话
CN109408127B (zh) 芯片系统加载方法及芯片卡
CN106462845A (zh) 一种非接触前端的配置方法及终端
CN205847259U (zh) 一种蓝牙设备和蓝牙系统
JP5869953B2 (ja) 情報端末

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17900154

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17900154

Country of ref document: EP

Kind code of ref document: A1