SIMalliance发布Open Mobile API V2.04：安全移动服务架构详解

需积分: 10 175 浏览量更新于2024-07-19 收藏 618KB PDF 举报

SIMalliance发布的Open Mobile API规范V2.04是一个专注于安全、身份和移动服务的关键标准，主要应用于Android开发中的NFC（近场通信）应用。该规范旨在确保移动设备上各种服务的安全交互，并为用户提供无缝的用户体验。 1. **Terminology (术语)**: 规范首先定义了缩写和符号，以便于开发者理解和使用。这包括对涉及的术语进行明确的解释，如SEService（安全元素服务）、Reader（读卡器）、CallBack（回调接口）等。 2. **Overview (概述)**: Open Mobile API V2.04提供了一个框架，让应用程序能够与NFC设备进行安全通信。它强调了API设计的核心在于保护数据安全，支持用户身份验证和设备间高效互动。 3. **Architecture (架构)**: 规范详细描述了整个系统的架构，包括不同类和接口之间的关系。例如，SEService是核心组件，负责管理与安全元素的连接，而Reader类则代表实际的NFC读卡器设备。 4. **API Description (API描述)**: API的核心部分是SEService类，其构造函数接收一个Context对象和CallBack监听器，用于初始化并管理与NFC设备的连接。getReaders()方法返回可用的读卡器列表，isConnected()检查连接状态，shutdown()用于关闭服务。SEService:CallBack接口定义了服务连接事件的处理方法。 5. **Transport API (传输API)**: 运输层API关注于数据的传输，如Reader类提供了getName()方法获取设备名称，getSEService()获取与之关联的SEService实例，isSecureElementPresent()检测是否安装了安全元素，以及Session类用于管理和控制NFC交易，包括打开和关闭session以及获取ATR（设备固件特征）。 6. **Security and Identity (安全与身份)**: Open Mobile API注重保护用户隐私和数据安全，通过Session类实现加密通信，确保数据在NFC交互过程中的安全性。此外，通过回调机制，应用可以响应如服务连接成功或失败等身份验证相关事件。 Open Mobile API V2.04是一个全面的框架，帮助Android开发者利用NFC技术构建安全可靠的应用程序，通过标准化的接口和流程确保设备间的通信安全，同时提供了灵活的身份管理和设备管理功能。对于从事移动应用开发或对NFC技术感兴趣的人员，理解并遵循这一规范是至关重要的。

Securing the future of mobile services

Open Mobile API specification

Security, Identity, Mobility

6. Transport API

The Transport API as part of the Open Mobile API provides a communication framework to Secure

Elements available in the Open Mobile device.

6.1 Overview

The role of the Transport API is to provide a mean for applications to access the Secure

Element(s) available on the device. The access provided is based on the concepts defined by

ISO/IEC 7816-4:

 APDUs: the format of the messages which are exchanged with the Secure Element, basically

a byte array is sent to the SE (or more precisely to an Applet in the SE) and the SE responds

with another byte array. For the details of the exact formatting of such byte arrays, refer to

ISO/IEC 7816-4.

 Basic and Logical Channels: the communication abstraction to the SE: Channels are the way

to transmit APDUs, and can be opened simultaneously (although one can send an APDU at a

time, by waiting for the response before sending the next APDU).

This API relies on a “connection” pattern: the client application (running on the device

connected to the SE, e.g. the phone) opens a connection to the SE (a.k.a session in the rest of

the document) and then opens a logical or basic channel to an Applet running in the SE.

On top of this pattern, there are a number of constraints that are enforced by the system:

An application cannot send “channel management” APDUs on its own, as this would break the

isolation feature given by the logical channel. Once a channel is opened, it is allocated to

communicate with one and only one Applet in the SE. In the same manner, the SELECT by DF

name APDU cannot be sent by the terminal application.

The restrictions for the system should be implemented in the modules that are directly handling

the communication with the Secure Element and not in the API itself to ensure that attackers

cannot overcome the APDU filters. Thus if possible, the baseband should take care of the

filtering or at least the RIL that communicates with the baseband.

Secure Element (SE)

Applet

Mobile Device

Open Mobile API

Transport API

Device Application

Figure 6-1: Transport API overview

Securing the future of mobile services

Open Mobile API specification

Security, Identity, Mobility

6.4 Class: SEService

The SEService realises the communication to available Secure Elements on the device.

This is the entry point of this API. It is used to connect to the infrastructure and get access to a

list of Secure Element Readers.

6.4.1 Constructor: SEService(Context context, SEService.CallBack listener)

Establishes a new connection that can be used to connect to all the Secure Elements

available in the system. The connection process can be quite long, so it happens in an

asynchronous way. It is usable only if the specified listener is called or if isConnected()

returns true.

The call-back object passed as a parameter will have its serviceConnected() method

called when the connection actually happen.

Parameters:

context - the context of the calling application. Cannot be null.

listener - a SEService.CallBack object. Can be null.

6.4.2 Method: Reader[] getReaders()

Returns the list of available Secure Element readers. There must be no duplicated

objects in the returned list.

Return value:

The readers list, as an array of Readers. If there are no readers the returned array is of

length 0.

6.4.3 Method: boolean isConnected()

Tells whether or not the service is connected.

Return value:

True if the service is connected.

6.4.4 Method: void shutdown()

Releases all Secure Elements resources allocated by this SEService (including any

binding to an underlying service). As a result isConnected() will return false after

shutdown() was called. After this method call, the SEService object is invalid.

It is recommended to call this method in the termination method of the calling application

(or part of this application) which is bound to this SEService.

6.4.5 Method: String getVersion()

Returns the version of the Open Mobile API specification this implementation is based

on.

Return value:

String containing the Open Mobile API version (e.g. "2.04").

6.5 Class (or interface): SEService:CallBack

Interface to receive call-backs when the service is connected.

If the target language and environment allows it, then this shall be an inner interface of the

SEService class.

6.5.1 Method: void serviceConnected(SEService service)

Called by the framework when the service is connected.

Securing the future of mobile services

Open Mobile API specification

Security, Identity, Mobility

Parameters:

service - the connected service.

6.6 Class: Reader

Instances of this class represent Secure Element Readers connected to this device. These

Readers can be physical devices or virtual devices. They can be removable or not. They can

contain one Secure Element that can or cannot be removed.

6.6.1 Method: String getName()

Return the user-friendly name of this reader.

 If this reader is a SIM reader, then its name must start with the "SIM" prefix.

 If the reader is a SD or micro SD reader, then its name must start with the “SD” prefix

 If the reader is a embedded SE reader, then its name must start with the “eSE” prefix

Return value:

The reader name, as a String.

6.6.2 Method: SEService getSEService()

Return the Secure Element service this reader is bound to.

Return value:

The SEService object.

6.6.3 Method: boolean isSecureElementPresent()

Check if a Secure Element is present in this reader.

Return value:

True if the SE is present, false otherwise.

6.6.4 Method: Session openSession()

Connects to a Secure Element in this reader.

This method prepares (initialises) the Secure Element for communication before the

Session object is returned (i.e. powers the Secure Element by ICC ON if it is not already

on).

There might be multiple sessions opened at the same time on the same reader. The

system ensures the interleaving of APDUs between the respective sessions.

Return value:

A Session object to be used to create Channels.

Errors:

IOError - if something went wrong when communicating with the Secure Element or the

reader.

6.6.5 Method: void closeSessions()

Close all the sessions opened on this reader. All the channels opened by all these

sessions will be closed.

6.7 Class: Session

Instances of this class represent a connection session to one of the Secure Elements available

on the device. These objects can be used to get a communication channel with an Applet in the

Secure Element. This channel can be the basic channel or a logical channel.

剩余65页未读，继续阅读

跑跑跑蜗牛

粉丝: 0
资源: 3

SIMalliance发布Open Mobile API V2.04：安全移动服务架构详解

OpenMobileAPI jar包

org.simalliance.openmobileapi.jar

SIMalliance_OpenMobileAPI2_02.rar

SIMAlliance规范

SIMalliance_OpenMobileAPI2_05_release-Feb143

SIMalliance_OpenMobileAPI_v3_2.pdf

OMA接口测试demo和org.simalliance.openmobileapi.jar 下载

OpenMobileAPI jar包(org.simalliance.openmobileapi.jar)

NFC能力开放 参考交互设计 v1.2-20150429

OpenMobileAPI使用中注意的问题-附件资源

最新资源

NFC能力开放参考交互设计 v1.2-20150429