WO2016173434A1 - 基于nfc的通信方法和装置 - Google Patents

基于nfc的通信方法和装置 Download PDF

Info

Publication number
WO2016173434A1
WO2016173434A1 PCT/CN2016/079708 CN2016079708W WO2016173434A1 WO 2016173434 A1 WO2016173434 A1 WO 2016173434A1 CN 2016079708 W CN2016079708 W CN 2016079708W WO 2016173434 A1 WO2016173434 A1 WO 2016173434A1
Authority
WO
WIPO (PCT)
Prior art keywords
nfc
communication
application
nfc device
message
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2016/079708
Other languages
English (en)
French (fr)
Inventor
陈成钱
周钰
郭伟
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
China Unionpay Co Ltd
Original Assignee
China Unionpay Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by China Unionpay Co Ltd filed Critical China Unionpay Co Ltd
Priority to EP16785865.3A priority Critical patent/EP3291454A4/en
Priority to US15/570,282 priority patent/US10708744B2/en
Publication of WO2016173434A1 publication Critical patent/WO2016173434A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/80—Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/606—Protecting data by securing the transmission between two devices or processes
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/74—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information operating in dual or compartmented mode, i.e. at least one secure mode
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04B—TRANSMISSION
    • H04B5/00—Near-field transmission systems, e.g. inductive or capacitive transmission systems
    • H04B5/20—Near-field transmission systems, e.g. inductive or capacitive transmission systems characterised by the transmission technique; characterised by the transmission medium
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/50—Secure pairing of devices
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/60—Subscription-based services using application servers or record carriers, e.g. SIM application toolkits

Definitions

  • the present invention relates to an NFC-based communication method and apparatus, and more particularly to an NFC-based communication method and apparatus within an SE, an NFC-based communication method within a smart terminal, a security unit, and a smart terminal.
  • TEE Trusted Execution Environment
  • TEE applications can be implemented at the TEE to ensure security.
  • NFC Near Field Communication
  • RFID radio frequency identification
  • the NFC function of an application in REE is usually implemented in a multimedia execution environment REE (Rich Execution Environment) such as Android, IOS.
  • REE Real Execution Environment
  • Android Android
  • IOS IOS
  • the NFC function of the TEE application is implemented by the service agent in the REE, as shown in FIG.
  • the solution utilizes the ability of the REE to connect with the NFC device on the smart terminal, and sets the NFC service agent in the REE to provide the NFC capability for the TEE application.
  • the NFC device may be an NFC controller, for example, an NFC chip disposed in the smart terminal.
  • FIG. 1 shows an NFC function of an NFC service agent under REE and an NFC client set in a TEE based on a predetermined protocol to implement a TEE application.
  • the NFC service agent receives the message from the TEE application via the NFC client and invokes the NFC protocol stack to operate the NFC device to perform specific NFC functions, such as card emulation, card reader functionality, and the like. Since data interaction between the TEE application and the NFC device requires an unsecure REE, the TEE application is difficult to perform securely. For example, for trading applications under TEE, payment information transmitted via REE may be stolen.
  • the NFC capability is provided for the TEE application by setting an NFC driver in the TEE and implementing the NFC protocol stack, as shown in FIG. 2.
  • the solution needs to additionally set the NFC virtual driver in the REE to interface with the NFC driver in the actual TEE. Since the NFC driver in the TEE needs to coordinate the communication between the NFC protocol stack, the NFC virtual drive and the NFC device, this will inevitably increase the complexity in the TEE.
  • the REE kernel does not include an NFC virtual drive, changing the original NFC driver of the REE kernel to an NFC virtual drive will also increase the complexity of the REE, especially with the addition of new NFC devices and the upgrade of the REE kernel.
  • the NFC virtual drive needs to be independently expanded.
  • the present invention proposes a new NFC-based communication architecture that uses a new connection path to make the TEE application NFC capable.
  • the present invention implements the NFC capability of the TEE application by utilizing the security element SE (Security Element) as a communication intermediary between the TEE application and the NFC device.
  • SE Secure Element
  • the SE is a stand-alone module (such as a SIM card, smart SD card, etc.) with computing and storage functions that provides a security mechanism to secure data stored therein and to communicate with external devices.
  • the SE and the NFC device can communicate with each other through a Host Controller Interface (HCI) based on the Single Wire Protocol (SWP) protocol.
  • HCI Host Controller Interface
  • SWP Single Wire Protocol
  • the SE and the TEE can communicate through an interface supported by the SE (for example, 7816 interface, SPI interface).
  • the present invention discloses the following technical solutions.
  • An NFC-based communication method in an SE comprising: receiving a first message from a communication module in a TEE, forwarding the first message to an NFC device, and receiving a second message from the NFC device to the communication module Forwarding the second message.
  • the process comprising a process for establishing a communication channel between the TEE application and the NFC device, in the process, receiving a create channel command originating from the application from the communication module, forwarding the device to the NFC device
  • the create channel command receives a return message including a channel number from the NFC device, the channel number is used to identify the application, and the return message including the channel number is forwarded to the communication module.
  • a process for data interaction between the application and the NFC device in which a message containing the channel number and interaction data is received from the NFC device, the interaction data being from NFC communication Entity forwarding, to the communication module, a message including the channel number and interaction data, the channel number being used by the communication module to determine the application, and receiving, from the communication module, the application originating from the application
  • the response message of the NFC communication entity forwards the response message to the NFC device.
  • the same communication protocol is used for messaging of the communication module and messaging with the NFC device.
  • An NFC-based communication device in an SE comprising: a first module, configured to receive a first message from a communication module in a TEE, and a second module, configured to forward the first message to an NFC device, a third module And for receiving a second message from the NFC device, where the fourth module is configured to forward the second message to the communication module.
  • the apparatus is configured to establish a communication channel between the TEE application and the NFC device, wherein the first module is configured to receive a create channel command originating from the application from the communication module, The second module is configured to forward the create channel command to the NFC device, the third module configured to receive a return message including a channel number from the NFC device, the channel number being used to identify the application The fourth module is configured to forward the return message containing the channel number to the communication module.
  • the apparatus is further configured to transceive interaction data between the application and the NFC device, wherein the third module is configured to receive the channel number and interaction data from the NFC device Message that the interaction data is from an NFC communication entity, the fourth module being configured to forward a message including the channel number and interaction data to the communication module, the channel number being used by the communication module to determine the
  • the first module is configured to receive a response message from the communication module for the NFC communication entity from the communication module
  • the second module being configured to forward the response message to an NFC device.
  • the same communication protocol is used for messaging of the communication module and messaging with the NFC device.
  • An NFC-based communication method in an intelligent terminal comprising: transmitting, by the SE, a first message to an NFC device via the SE, and receiving a second from the NFC device via the SE, when the smart terminal is running at a TEE Message.
  • the process comprising a process for establishing a communication channel between the TEE application and the NFC device, in the process, sending, by the SE, a create channel command originating from the application to the NFC device via the SE Said SE, receiving a return message containing a channel number from the NFC device, the channel number being used to identify the application.
  • a process for data interaction between the application and the NFC device is included, in which a message containing the channel number and interaction data is received from the NFC device via the SE, The interaction data is from an NFC communication entity, the application is determined according to the channel number, via which the response message for the NFC communication entity is sent to the NFC device.
  • the SE communication message is based on a communication protocol between the SE and the NFC device.
  • An NFC-based communication device in an intelligent terminal the device being configured to: when the smart terminal is running at a TEE, send a first message to an NFC device via the SE, and receive, from the NFC device, via the SE Second message.
  • the apparatus is configured to establish a communication channel between the TEE application and the NFC device, the apparatus further configured to, via the SE, send a creation originating from the application to the NFC device A channel command, via the SE, receives a return message containing a channel number from the NFC device, the channel number being used to identify the application.
  • the apparatus is configured to implement a process of data interaction between the application and the NFC device, the apparatus further configured to receive, via the SE, the channel number and interaction from the NFC device A message of data from an NFC communication entity that determines the application based on the channel number, via which the response message for the NFC communication entity is sent to the NFC device.
  • the apparatus is configured to communicate with the SE based on a communication protocol between the SE and the NFC device.
  • 1 is a block diagram showing the NFC function of implementing a TEE application through a service agent in a REE.
  • FIG. 2 is a block diagram showing the NFC capability provided to a TEE application by implementing an NFC driver under the TEE.
  • FIG. 3 is a schematic diagram showing messaging of an NFC-based communication method within an SE, in accordance with one embodiment.
  • FIG. 4 is a schematic diagram showing the communication module, SE, and NFC of FIG.
  • 5 is a schematic diagram showing messaging of an NFC-based communication method within an SE, in accordance with one embodiment.
  • the communication method includes the following steps: the SE receives a first message from a communication module in the TEE, the SE forwards the first message to the NFC device, the SE receives the second message from the NFC device, and the SE forwards the message to the communication module.
  • the first message is derived from a TEE application
  • the second message may originate from an NFC device or an external NFC communication entity (eg, a POS terminal, a mobile communication terminal).
  • the messaging of the SE with the communication module and the messaging of the SE with the NFC device may use the same communication protocol, such as the HCI protocol. Since the HCI protocol between the SE and the NFC device is not complicated, implementing the HCI protocol stack in the TEE does not increase the complexity of the TEE.
  • FIG. 4 a schematic diagram of the communication module, SE, NFC device of Figure 3 is shown.
  • the communication module is disposed in an intelligent terminal capable of running both REE and TEE operating systems, and the NFC device can be disposed in the smart terminal or attached to the smart terminal, and the SE can be set in the smart terminal. Or attached to the smart terminal.
  • the TEE application is coupled to the communication module and utilizes the SE driver to interact with the SE through the communication module.
  • the NFC device also interacts with the NFC communication entity. Thus, the interaction of the TEE application with the NFC communication entity is achieved via the SE.
  • the communication module is used to implement the HCI protocol stack, whereby messages from the TEE application are sent by the communication module to the SE in a data packet in accordance with the HCI protocol. Similarly, the communication module receives the data packet according to the HCI protocol from the SE, and obtains a message for the TEE application from the data packet, and then transmits the message to the TEE application. Since the communication information is transmitted in accordance with the communication path of the trusted environment formed by the TEE, SE, and NFC devices, the TEE application can be safely executed.
  • a communication module including an HCI protocol stack is set in the TEE, whereby the transmission of the HCI protocol message between the SE and the TEE can be performed through an application protocol data unit APDU (Application Protocol Data) between the SE and the TEE. Unit) channel is performed.
  • APDU Application Protocol Data
  • the transmission of the HCI protocol message between the SE and the NFC device can be performed through the SWP channel between the SE and the NFC device.
  • a create channel command originating from the application as a first message is received from the communication module, a create channel command is forwarded to the NFC device, and a return message containing the channel number as the second message is received from the NFC device.
  • the channel number is used to identify the application, and forwards the return message including the channel number to the communication module.
  • the HCI data packet is unpacked by the communication module of the TEE, the channel number is obtained, and the corresponding relationship between the channel number and the TEE application is recorded, thereby completing the communication channel between the TEE application and the NFC device. create.
  • FIG. 5 is a schematic diagram showing messaging of an NFC based communication method within an SE, in accordance with one embodiment.
  • a message including a channel number and interaction data as a second message is received from the NFC device, the interaction data is from an NFC communication entity, and the channel module is forwarded to the communication module.
  • the message of the interaction data, the channel number is used by the communication module to determine the application, and the response message for the NFC communication entity originating from the application as the first message is received from the communication module, and the response message is forwarded to the NFC device.
  • the HCI data packet is parsed by the SE, and the channel number is obtained, and the channel number is determined according to the channel table to be a TEE application or an SE application, and if the SE application is used, the interaction data is sent to a specific application on the SE; If it is a TEE application, the HCI data packet is sent to the communication module in the TEE through the APDU channel;
  • the communication module in the TEE unpacks the HCI data packet, obtains the interaction data, and finds the specified TEE application according to the channel number therein, and sends the interaction data to the TEE application.
  • the TEE application utilizes the NFC device and the SE to perform data transmission and reception with an external NFC communication entity. It should be understood that the specific capabilities of NFC, including card emulation and card reader capabilities, can be used in accordance with specific commands.
  • the NFC device is connected to the REE, controlled by the REE.
  • NFC equipment maintains the original implementation architecture and functions, and REE also controls NFC equipment in the original way and provides NFC capabilities for REE applications. Therefore, this solution does not require any software or hardware changes to the REE and NFC devices.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • General Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Health & Medical Sciences (AREA)
  • Mathematical Physics (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephone Function (AREA)

Abstract

本发明涉及基于NFC的通信方法和装置，并且尤其涉及在SE内的基于NFC的通信方法和装置、在智能终端内的基于NFC的通信方法、安全单元和智能终端。本发明提出一种新的与NFC设备的连接方式来达到让TEE应用使用NFC能力的目的。

Description

基于NFC的通信方法和装置 技术领域
本发明涉及基于NFC的通信方法和装置，并且尤其涉及在SE内的基于NFC的通信方法和装置、在智能终端内的基于NFC的通信方法、安全单元和智能终端。
背景技术
可信执行环境TEE(Trusted Execution Environment)技术能够为诸如移动电话等智能终端提供受到硬件隔离保护的可信执行环境/操作系统。智能终端上的与安全相关的应用，即TEE应用可以在TEE执行以保证安全性。
近场通信NFC(Near Field Communication)是一种近距离无线通信技术，其基于射频识别RFID(Radio Frequency Identification)技术，利用磁场感应来实现智能终端间的近距离通信。
通常在诸如安卓、IOS等多媒体执行环境REE(Rich Execution Environment)中实现REE中的应用的NFC功能。当TEE应用需要实现NFC功能时，存在以下的技术方案。
通过REE中的服务代理实现TEE应用的NFC功能，如图1所示。该方案利用智能终端上REE与NFC设备连接的能力，在REE中设置NFC服务代理为TEE应用提供NFC能力。这里，NFC设备可以是NFC控制器(NFC Controller)，例如是设置在智能终端内的NFC芯片。图1示出REE下的NFC服务代理与在TEE中设置的NFC客户基于预定的协议来实现TEE应用的NFC功能。具体地，NFC服务代理经由NFC客户接收来自TEE应用的消息并调用NFC协议栈来操作NFC设备以执行具体的NFC功能，例如卡模拟、读卡器功能等。由于TEE应用和NFC设备之间的数据交互需要通过不安全的REE，TEE应用难以被安全地执行。例如，对于TEE下的交易应用，经由REE传输的支付信息可能会被窃取。
在其它方案中，通过在TEE中设置NFC驱动、实现NFC协议栈来为TEE应用提供NFC能力，如图2所示。为了兼容REE应用的NFC功能，该方案需要在REE中额外设置NFC虚拟驱动与实际的TEE中的NFC驱动对接。由于TEE中的NFC驱动需要协调NFC协议栈、NFC虚拟驱动与NFC设备之间的通信，这将不可避免地增加在TEE的复杂性。另一方面，由于REE内核并不包含NFC虚拟驱动，将REE内核的原有NFC驱动改成NFC虚拟驱动也会增加REE的复杂性，尤其是随着新的NFC设备的增加和REE内核的升级，NFC虚拟驱动需要独立地被维扩。
发明内容
本发明提出一种新的基于NFC的通信架构，该架构使用新的连接路径让TEE应用具备NFC能力。本发明通过利用安全单元SE(Security Element)作为TEE应用和NFC设备的通信中介来实现TEE应用的NFC能力。这里，SE是具有计算和存储功能的独立模块(例如SIM卡、智能SD卡等)，其提供安全机制保护在其中存储的数据以及与外部设备通信的安全。SE和NFC设备之间可以通过基于单线协议SWP(Single Wire Protocol)协议的主机控制接口HCI(Host Controller Interface)进行通信。SE与TEE之间可以通过SE支持的接口(例如7816接口、SPI接口)通信。
本发明公开以下技术方案。
一种在SE内的基于NFC的通信方法，包括：从TEE中的通信模块接收第一消息，向NFC设备转发所述第一消息，从所述NFC设备接收第二消息，向所述通信模块转发所述第二消息。
优选地，包括用于建立TEE应用和所述NFC设备之间的通信通道的过程，在该过程中，从所述通信模块接收源自所述应用的创建通道命令，向所述NFC设备转发所述创建通道命令，从所述NFC设备接收包含通道号的返回消息，该通道号用于标识所述应用，向所述通信模块转发所述包含通道号的返回消息。
优选地，包括用于所述应用和所述NFC设备之间的数据交互的过程，在该过程中，从所述NFC设备接收包含所述通道号和交互数据的消息，该交互数据来自NFC通信实体，向所述通信模块转发包含所述通道号和交互数据的消息，所述通道号用于供所述通信模块确定所述应用，从所述通信模块接收源自所述应用的针对所述NFC通信实体的响应消息，向NFC设备转发所述响应消息。
优选地，与所述通信模块的消息传递和与所述NFC设备的消息传递使用相同的通信协议。
一种在SE内的基于NFC的通信装置，包括：第一模块，用于从TEE中的通信模块接收第一消息，第二模块，用于向NFC设备转发所述第一消息，第三模块，用于从所述NFC设备接收第二消息，第四模块，用于向所述通信模块转发所述第二消息。
优选地，该装置被配置成用于建立TEE应用和所述NFC设备之间的通信通道，其中，所述第一模块被配置成从所述通信模块接收源自所述应用的创建通道命令，所述第二模块被配置成向所述NFC设备转发所述创建通道命令，所述第三模块被配置成从所述NFC设备接收包含通道号的返回消息，该通道号用于标识所述应用，所述第四模块被配置成向所述通信模块转发所述包含通道号的返回消息。
优选地，该装置还被配置成用于收发所述应用和所述NFC设备之间的交互数据，其中，所述第三模块被配置成从所述NFC设备接收包含所述通道号和交互数据的消息，该交互数据来自NFC通信实体，所述第四模块被配置成向所述通信模块转发包含所述通道号和交互数据的消息，所述通道号用于供所述通信模块确定所述应用，所述第一模块被配置成从所述通信模块接收源自所述应用的针对所述NFC通信实体的响应消息，所述第二模块被配置成向NFC设备转发所述响应消息。
优选地，与所述通信模块的消息传递和与所述NFC设备的消息传递使用相同的通信协议。
一种在智能终端内的基于NFC的通信方法，该方法包括：当所述智能终端运行在TEE时，经由SE，向NFC设备发送第一消息，经由该SE，从所述NFC设备接收第二消息。
优选地，包括用于建立TEE应用和所述NFC设备之间的通信通道的过程，在该过程中，经由所述SE，向所述NFC设备发送源自所述应用的创建通道命令，经由所述SE，从所述NFC设备接收包含通道号的返回消息，该通道号用于标识所述应用。
优选地，包括用于所述应用和所述NFC设备之间的数据交互的过程，在该过程中，经由所述SE，从所述NFC设备接收包含所述通道号和交互数据的消息，该交互数据来自NFC通信实体，根据通道号确定所述应用，经由所述SE，向NFC设备发送针对所述NFC通信实体的响应消息。
优选地，基于所述SE与所述NFC设备之间的通信协议与所述SE通信消息。
一种在智能终端内的基于NFC的通信装置，该装置被配置成：当所述智能终端运行在TEE时，经由SE，向NFC设备发送第一消息，经由该SE，从所述NFC设备接收第二消息。
优选地，该装置被配置成，建立TEE应用和所述NFC设备之间的通信通道的过程，该装置进一步被配置成，经由所述SE，向所述NFC设备发送源自所述应用的创建通道命令，经由所述SE，从所述NFC设备接收包含通道号的返回消息，该通道号用于标识所述应用。
优选地，该装置被配置成实现所述应用和所述NFC设备之间的数据交互的过程，该装置进一步被配置成，经由所述SE，从所述NFC设备接收包含所述通道号和交互数据的消息，该交互数据来自NFC通信实体，根据通道号确定所述应用，经由所述SE，向NFC设备发送针对所述NFC通信实体的响应消息。
优选地，该装置被配置成基于所述SE与所述NFC设备之间的通信协议与所述SE通信消息。
附图说明
在参照附图阅读了本发明的具体实施方式以后，本领域技术人员将会更清楚地了解本发明。本领域技术人员应当理解的是，附图仅仅用于配合具体实施方式说明本发明的技术方案，而并非意在对本发明的保护范围构成限制。
图1是示出通过REE中的服务代理实现TEE应用的NFC功能的框图。
图2是示出通过在TEE下设置NFC驱动、实现NFC协议栈为TEE应用提供NFC能力的框图。
图3是示出根据一个实施例在SE内的基于NFC的通信方法的消息传递的示意图。
图4是出示出了图3中的通信模块、SE、NFC的示意图。
图5是示出根据一个实施例在SE内的基于NFC的通信方法的消息传递的示意图。
具体实施方式
下面参照附图，对本发明的具体实施方式作进一步的详细描述。应当理解的是，可对所描述的实施例进行结构和功能修改。另外，可针对任何给定的或特定的应用，组合一个实施例的一个或多个特征与另一个实施例的一个或多个特征。
图3是示出根据一个实施例在SE内的基于NFC的通信方法的消息传递的示意图。如图3所示，该通信方法包括以下步骤：SE从TEE中的通信模块接收第一消息，SE向NFC设备转发第一消息，SE从NFC设备接收第二消息，以及SE向通信模块转发第二消息。这里，第一消息源自TEE应用，第二消息可以源自NFC设备或者外部NFC通信实体(例如POS终端、移动通信终端)。通过上述步骤，TEE应用与NFC设备之间的数据交互不通过不安全的REE，由此TEE应用可以被安全地执行。
优选地，SE与通信模块的消息传递和SE与NFC设备的消息传递可以使用相同的通信协议，例如HCI协议。由于SE与NFC设备之间的HCI协议并不复杂，在TEE中实现HCI协议栈不会增加TEE的复杂度。
现参考图4，其示出了图3中的通信模块、SE、NFC设备的示意图。如图4所示，通信模块被设置在能够运行REE和TEE两种操作系统的智能终端中，NFC设备可以被设置在智能终端中或者附接到智能终端上，SE可以被设置在智能终端中或者附接到智能终端上。TEE应用与通信模块耦合，利用SE驱动通过通信模块与SE交互。NFC设备还与NFC通信实体交互。由此，经由SE，实现了TEE应用与NFC通信实体的交互。
继续参考图4，通信模块被用于实现HCI协议栈，由此来自TEE应用的消息由通信模块包含按照HCI协议的数据包中被发送至SE。相似地，通信模块接收来自SE的按照HCI协议的数据包，并从该数据包中获得针对TEE应用的消息，然后将该消息发送给TEE应用。由于通信信息按照TEE、SE、NFC设备形成的可信环境的通信路径传送，TEE应用可以被安全地执行。
现在描述通信模块、SE、NFC设备之间的通信路径。如上所述，在TEE中设置了包含HCI协议栈的通信模块，由此，SE与TEE之间的按照HCI协议消息的传送可以通过在SE与TEE之间的应用协议数据单元APDU(Application Protocol Data Unit)通道进行。SE与NFC设备之间的按照HCI协议消息的传送，可以通过SE与NFC设备之间的SWP通道进行。
以下描述建立TEE应用和NFC设备之间的通信通道的过程。重新参考图3，在该过程中，从通信模块接收源自应用的作为第一消息的创建通道命令，向NFC设备转发创建通道命令，从NFC设备接收作为第二消息的包含通道号的返回消息，该通道号用于标识应用，向通信模块转发包含通道号的返回消息。
以下是一个实例：
(1)由TEE应用生成创建通道命令，指定NFC设备的接口；
(2)由通信模块将该创建通道命令转换HCI数据包，以及将该HCI数据包通过APDU通道发送给SE的HCI模块；
(3)由SE的HCI模块接收该HCI数据包，并将其转换成SWP数据包，通过SWP通道发送到NFC设备；
(4)由NFC设备的HCI模块接收该HCI数据包，处理该数据包中的创建通道命令，生成通道号，然后将包含通道号的消息以HCI数据包的格式返回给SE；
(5)由SE的HCI模块解析该HCI数据包，获得其中的通道号，并将该通道号与TEE应用的对应关系记录在通道表中，然后将HCI数据包通过APDU通道发送到TEE；
(6)由TEE的通信模块对该HCI数据包进行解包，获得其中的通道号，并记录该通道号与TEE应用的对应关系，由此，完成TEE应用和NFC设备之间的通信通道的创建。
在完成通道创建后，智能终端可以开始与NFC通信实体交互。以下描述实现应用和NFC设备之间的数据交互的过程。参考图5，图5是示出根据一个实施例在SE内的基于NFC的通信方法的消息传递的示意图。在该过程中，从NFC设备接收作为第二消息的包含通道号和交互数据的消息，该交互数据来自NFC通信实体，向通信模块转发包含通道号和 交互数据的消息，通道号用于供通信模块确定应用，从通信模块接收源自应用的作为第一消息的针对NFC通信实体的响应消息，向NFC设备转发响应消息。
以下是一个实例：
(1)由NFC设备从NFC通信实体获得交互数据，并将该交互数据以HCI数据包格式发送给SE；
(2)由SE解析该HCI数据包，获取其中的通道号，并根据通道表判断该通道号对应的是TEE应用还是SE应用，若是SE应用，则将交互数据发送至SE上的具体应用；若是TEE应用，则把该HCI数据包通过APDU通道发送至TEE中的通信模块；
(3)TEE中的通信模块解包该HCI数据包，获取交互数据，并根据其中的通道号，找到指定的TEE应用，将交互数据发往TEE应用。
如此，TEE应用利用NFC设备和SE与外部NFC通信实体完成数据收发。应当理解的是，可以按照具体的命令使用NFC的具体能力，包括卡模拟和读卡器能力等。
再参考图4，在该实施例中，NFC设备与REE连接，由REE控制。NFC设备保持原有的实现架构和功能，REE也按照原有的方式控制NFC设备并为REE应用提供NFC能力。因此，该方案不需要对REE、NFC设备进行任何软件或者硬件方面的改动。
通过以上实施方式的描述，本领域中的普通技术人员能够理解，在不偏离本发明的精神和范围的情况下，还可以对本发明的具体实施方式作各种变更和替换。这些变更和替换都落在本发明权利要求书所限定的范围内。

Claims (18)

  1. 一种在SE内的基于NFC的通信方法，其特征在于，包括：
    从TEE中的通信模块接收第一消息，
    向NFC设备转发所述第一消息，
    从所述NFC设备接收第二消息，
    向所述通信模块转发所述第二消息。
  2. 根据权利要求1所述的通信方法，其特征在于，包括用于建立TEE应用和所述NFC设备之间的通信通道的过程，在该过程中，
    从所述通信模块接收源自所述应用的创建通道命令，
    向所述NFC设备转发所述创建通道命令，
    从所述NFC设备接收包含通道号的返回消息，该通道号用于标识所述应用，
    向所述通信模块转发所述包含通道号的返回消息。
  3. 根据权利要求2所述的通信方法，其特征在于，包括用于所述应用和所述NFC设备之间的数据交互的过程，在该过程中，
    从所述NFC设备接收包含所述通道号和交互数据的消息，该交互数据来自NFC通信实体，向所述通信模块转发包含所述通道号和交互数据的消息，所述通道号用于供所述通信模块确定所述应用，
    从所述通信模块接收源自所述应用的针对所述NFC通信实体的响应消息，
    向NFC设备转发所述响应消息。
  4. 根据权利要求1所述的通信方法，其特征在于，
    与所述通信模块的消息传递和与所述NFC设备的消息传递使用相同的通信协议。
  5. 一种在SE内的基于NFC的通信装置，其特征在于，包括：
    第一模块，用于从TEE中的通信模块接收第一消息，
    第二模块，用于向NFC设备转发所述第一消息，
    第三模块，用于从所述NFC设备接收第二消息，
    第四模块，用于向所述通信模块转发所述第二消息。
  6. 根据权利要求5所述的通信装置，其特征在于，该装置被配置成用于建立TEE应用和所述NFC设备之间的通信通道，其中，
    所述第一模块被配置成从所述通信模块接收源自所述应用的创建通道命令，
    所述第二模块被配置成向所述NFC设备转发所述创建通道命令，
    所述第三模块被配置成从所述NFC设备接收包含通道号的返回消息，该通道号用于标识所述应用，
    所述第四模块被配置成向所述通信模块转发所述包含通道号的返回消息。
  7. 根据权利要求6所述的通信装置，其特征在于，该装置还被配置成用于收发所述应用和所述NFC设备之间的交互数据，其中，
    所述第三模块被配置成从所述NFC设备接收包含所述通道号和交互数据的消息，该交互数据来自NFC通信实体，
    所述第四模块被配置成向所述通信模块转发包含所述通道号和交互数据的消息，所述通道号用于供所述通信模块确定所述应用，
    所述第一模块被配置成从所述通信模块接收源自所述应用的针对所述NFC通信实体的响应消息，
    所述第二模块被配置成向NFC设备转发所述响应消息。
  8. 根据权利要求6所述的通信装置，其特征在于，
    与所述通信模块的消息传递和与所述NFC设备的消息传递使用相同的通信协议。
  9. 一种在智能终端内的基于NFC的通信方法，其特征在于，该方法包括：
    当所述智能终端运行在TEE时，
    经由SE，向NFC设备发送第一消息，
    经由该SE，从所述NFC设备接收第二消息。
  10. 根据权利要求9所述的通信方法，其特征在于，包括用于建立TEE应用和所述NFC设备之间的通信通道的过程，在该过程中，
    经由所述SE，向所述NFC设备发送源自所述应用的创建通道命令，
    经由所述SE，从所述NFC设备接收包含通道号的返回消息，该通道号用于标识所述应用。
  11. 根据权利要求10所述的通信方法，其特征在于，包括用于所述应用和所述NFC设备之间的数据交互的过程，在该过程中，
    经由所述SE，从所述NFC设备接收包含所述通道号和交互数据的消息，该交互数据来自NFC通信实体，
    根据通道号确定所述应用，
    经由所述SE，向NFC设备发送针对所述NFC通信实体的响应消息。
  12. 根据权利要求9所述的通信方法，其特征在于，
    基于所述SE与所述NFC设备之间的通信协议与所述SE通信消息。
  13. 一种在智能终端内的基于NFC的通信装置，其特征在于，该装置被配置成：
    当所述智能终端运行在TEE时，
    经由SE，向NFC设备发送第一消息，
    经由该SE，从所述NFC设备接收第二消息。
  14. 根据权利要求12所述的通信装置，其特征在于，该装置被配置成建立TEE应用和所述NFC设备之间的通信通道，该装置进一步被配置成，
    经由所述SE，向所述NFC设备发送源自所述应用的创建通道命令，
    经由所述SE，从所述NFC设备接收包含通道号的返回消息，该通道号用于标识所述应用。
  15. 根据权利要求13所述的通信装置，其特征在于，该装置被配置成实现所述应用和所述NFC设备之间的数据交互，该装置进一步被配置成，
    经由所述SE，从所述NFC设备接收包含所述通道号和交互数据的消息，该交互数据来自NFC通信实体，
    根据通道号确定所述应用，
    经由所述SE，向NFC设备发送针对所述NFC通信实体的响应消息。
  16. 根据权利要求13所述的通信装置，其特征在于，
    该装置被配置成基于所述SE与所述NFC设备之间的通信协议与所述SE通信消息。
  17. 一种包含根据权利要求5至8的任意一项所述的装置的SE。
  18. 一种包含根据权利要求13至16的任意一项所述的装置的智能终端。
PCT/CN2016/079708 2015-04-30 2016-04-20 基于nfc的通信方法和装置 Ceased WO2016173434A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP16785865.3A EP3291454A4 (en) 2015-04-30 2016-04-20 NFC-BASED COMMUNICATION PROCESS AND DEVICE
US15/570,282 US10708744B2 (en) 2015-04-30 2016-04-20 NFC-based communication method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510215296.3A CN105591672A (zh) 2015-04-30 2015-04-30 基于nfc的通信方法和装置
CN201510215296.3 2015-04-30

Publications (1)

Publication Number Publication Date
WO2016173434A1 true WO2016173434A1 (zh) 2016-11-03

Family

ID=55930968

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/079708 Ceased WO2016173434A1 (zh) 2015-04-30 2016-04-20 基于nfc的通信方法和装置

Country Status (4)

Country Link
US (1) US10708744B2 (zh)
EP (1) EP3291454A4 (zh)
CN (1) CN105591672A (zh)
WO (1) WO2016173434A1 (zh)

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106548077B (zh) * 2016-10-19 2019-03-15 沈阳微可信科技有限公司 通信系统和电子设备
CN106547633B (zh) * 2016-10-19 2019-12-31 沈阳微可信科技有限公司 多通道通信系统和电子设备
CN108702357B (zh) * 2017-01-13 2021-01-05 华为技术有限公司 一种授权凭据迁移的方法、终端设备及业务服务器
CN107240157B (zh) * 2017-05-12 2020-08-21 南京心视窗信息科技有限公司 近场通信安全控制方法、移动终端及计算机可读存储介质
CN109151777B (zh) * 2018-06-11 2020-11-24 中国银联股份有限公司 一种非接通信方法以及通信装置
FR3094514A1 (fr) 2019-03-25 2020-10-02 Proton World International N.V. Système électronique
FR3094517A1 (fr) * 2019-03-25 2020-10-02 Proton World International N.V. Système électronique
FR3094516A1 (fr) 2019-03-25 2020-10-02 Proton World International N.V. Système électronique
CN111107525B (zh) 2019-04-26 2022-01-14 华为技术有限公司 一种se的自动路由方法及电子设备
CN114286345B (zh) * 2021-12-27 2024-04-02 无锡融卡科技有限公司 智能终端内的nfc通信装置及方法

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103793815A (zh) * 2014-01-23 2014-05-14 武汉天喻信息产业股份有限公司 适用于银行卡和行业卡的移动智能终端收单系统及方法
CN104143996A (zh) * 2013-05-09 2014-11-12 英特尔公司 无线电通信装置和用于控制无线电通信装置的方法
US20150044995A1 (en) * 2012-11-16 2015-02-12 At&T Intellectual Property I, Lp Methods for provisioning universal integrated circuit cards

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1855229B1 (fr) * 2006-05-10 2010-08-11 Inside Contactless Procédé de routage de données sortantes et entrantes dans un chipset NFC
CN101866463A (zh) * 2009-04-14 2010-10-20 中兴通讯股份有限公司 一种eNFC终端、eNFC智能卡及其通信方法
US8335921B2 (en) * 2010-12-17 2012-12-18 Google, Inc. Writing application data to a secure element
KR102158055B1 (ko) * 2012-02-29 2020-09-21 모비웨이브 시스템즈 유엘씨 디바이스로 보안 금융 거래를 행하는 방법, 디바이스 및 보안 요소
EP2690839B1 (en) * 2012-07-23 2018-09-26 STMicroelectronics (Rousset) SAS NFC apparatus capable to perform a contactless tag reading function
US9594896B2 (en) * 2012-12-21 2017-03-14 Blackberry Limited Two factor authentication using near field communications
US9405898B2 (en) * 2013-05-10 2016-08-02 Proxense, Llc Secure element as a digital pocket
KR102077823B1 (ko) * 2013-06-03 2020-02-14 휴렛-팩커드 디벨롭먼트 컴퍼니, 엘.피. 엔에프씨를 이용한 모바일 프린팅 시스템 및 방법
EP2911076A1 (en) * 2014-02-24 2015-08-26 Mastercard International Incorporated Biometric authentication
FR3035252B1 (fr) * 2015-04-14 2017-04-28 Stmicroelectronics Rousset Procede de gestion de la communication d'informations entre un controleur nfc et un element securise au sein d'un appareil, et appareil et controleur nfc correspondants

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150044995A1 (en) * 2012-11-16 2015-02-12 At&T Intellectual Property I, Lp Methods for provisioning universal integrated circuit cards
CN104143996A (zh) * 2013-05-09 2014-11-12 英特尔公司 无线电通信装置和用于控制无线电通信装置的方法
CN103793815A (zh) * 2014-01-23 2014-05-14 武汉天喻信息产业股份有限公司 适用于银行卡和行业卡的移动智能终端收单系统及方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3291454A4 *

Also Published As

Publication number Publication date
US10708744B2 (en) 2020-07-07
CN105591672A (zh) 2016-05-18
EP3291454A1 (en) 2018-03-07
EP3291454A4 (en) 2019-01-09
US20180139596A1 (en) 2018-05-17

Similar Documents

Publication Publication Date Title
WO2016173434A1 (zh) 基于nfc的通信方法和装置
JP5633336B2 (ja) 通信装置および通信方法、通信制御装置および通信制御方法、並びにプログラム
EP3242494B1 (en) Nfc-based communication device and method
WO2017113970A1 (zh) 近场通信方法及移动终端
KR20150114765A (ko) 근거리 무선 통신(nfc) 기능을 지원하는 화상형성장치 및 화상형성장치의 nfc 동작 모드를 설정하는 방법
CN104135339A (zh) 一种蓝牙低功耗通信的方法、蓝牙设备和系统
JP2012118570A (ja) 通信装置、通信方法、およびプログラム
KR20150120482A (ko) 데이터 접속을 구축하기 위한 방법, 장치 및 시스템
US9820185B2 (en) Electronic device, controller and control method for NFC
EP3007066A1 (en) Method for using shared device in apparatus capable of operating two operating systems
US9577743B2 (en) Communications system having a secure credentials storage device
US9628149B2 (en) Emulation of multiple NFC devices inside a communication device
JP6564070B2 (ja) 近距離無線通信ｎｆｃにおいてデータパケット長を調整するための方法、装置、およびシステム
CN107636982B (zh) 数据帧路由处理的方法、近场通信控制器和终端
CN103368612B (zh) 通过切换至沉默对电子设备通讯进行控制方法和设备
KR101952793B1 (ko) 가입자 아이덴티티 모듈（sim）액세스 프로파일（sap）의 개선들
US9763028B2 (en) Systems and methods for wireless communication interoperability
CN105635873A (zh) Nfc蓝牙耳机、系统及其控制方法
JP2015028813A (ja) 通信装置、通信装置の通信方法、および通信システム、並びに、半導体、半導体の通信方法、およびプログラム
HK1224879B (zh) 一种基於nfc的通信装置和方法
Yue et al. P2P File Transfer System Based on NFC
HK1224879A1 (zh) 一種基於nfc的通信裝置和方法
HK1224879A (zh) 一种基於nfc的通信装置和方法
CN104184699A (zh) 安全性信息交互系统、设备和方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16785865

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 15570282

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE