HCE Security Issues

Most recent projects are often asked: HCE safe?

My answer is: relatively safe.

Hear me this answer, many people may start to say, XXX Bank all on HCE application, how unsafe?

In fact, there are two scenarios for HCE applications: Online mode and offline mode.

Online mode:

Related keys and operations are done in the background, even if security issues occur, it is a network security category. However, there is no large-scale key disclosure issue. At present, the HCE application of bank on line is belong to the online mode.

Offline Mode:

Information such as related keys, sensitive data, and amounts are stored inside the phone. This is troublesome because Android phones are easy to root and all data is read and copied.

Safe solutions for pure HCE:

• Transaction key: Protected by a session key, each login session key changes, and the transaction key is transferred to encrypt.

• Sensitive data and amount: protected by a session key, the full 0 is encrypted with the data plaintext, the checksum is generated, and when the sensitive data and amounts are validated, the checksum is then compared.

Security level: Algorithm hiding

Disadvantage: Anti-replication is not possible.

Hce+tee's security solution:

• HCE applications for simulation industry applications.

• Tee stores keys, sensitive data, amounts, and so on.

Security Level: Kernel security

Disadvantage: The tee adaptation rate is low and requires a reboot of the phone.

HCE Security Issues