How to answer HCE security questions

In recent projects, we are often asked: Is HCE safe?

My answer is: relatively safe.

After hearing my answer, many people may start to say, a certain bank has launched HCE application, why is it unsafe?

In fact, there are two HCE application scenarios: online mode and offline mode.

Online mode:

Even if there are security issues, the processes involving related keys and calculations are completed in the background, so it falls within the scope of network security. However, large-scale key leakage will not occur. Currently, all HCE applications launched by banks are in online mode.

Offline mode:

Relevant keys, sensitive data, amounts and other information will be stored inside the phone. Android phones can be easily rooted, which can cause data to be read and copied, so things can get tricky.

Pure HCE security solution:

• Transaction key: protected by session key. The session key will change each time you log in, and the transaction key will be modified. Convert encryption.

• Sensitive data and amount: protected by session key, encrypt all 0s with data plaintext, and generate check value; when verifying sensitive data and amount, decrypt first, Then compare the check values.

Security level: Algorithm hidden

Disadvantages: Unable to prevent copying.

HCE TEE security solution:

• HCE application implements simulated industry applications.

• TEE stores keys, sensitive data, amounts, etc.

  
  

  
  

Security level: Kernel security

Disadvantages: TEE adaptation rate is low, and Need to restart the phone.

The above is the detailed content of How to answer HCE security questions. For more information, please follow other related articles on the PHP Chinese website!