Abstract:
The present invention belongs to the field of intelligent cards, and disclosed is a method for managing an application on a card. The method comprises: after receiving data sent by a running environment, a card content management module checking a card state; when the card state is not a first preset state or a second preset state, checking the received data; and when the received data meets a preset format, continuing to receive the data sent by the running environment to obtain a complete command, and performing a corresponding command to implement an association of applications on a card. The beneficial effects of the present invention are to provide a method for managing an application on a card, so that loading, installation, update, personalization, and deletion of an application on the card can be implemented.

Description:
CROSS REFERENCE OF RELATED APPLICATION 
       [0001]    This application claims priority to Chinese patent applications, entitled “METHOD FOR IMPLEMENTING CARD DATA MANAGEMENT” with Application Number of 201310146939.4 and filed with the Chinese Patent Office on Apr. 25, 2013 and entitled “METHOD FOR MANAGING APPLICATION ON CARD” with Application Number of 201310399702.7 and filed with the Chinese Patent Office on Sep. 5, 2013, which are hereby incorporated by reference in its entirety. 
       FIELD 
       [0002]    The present disclosure belongs to the field of intelligent cards, and more particularly, relates to a method for managing applications on a card. 
       BACKGROUND 
       [0003]    With developments of the society, intelligent card gets much more attention for its advantages, such as mobility, mass storage, reliable and safe information recording. In order to be adapted for continuous extension of the intelligent card application field, the intelligent card is sought to be extended with more applications. 
         [0004]    In addition, in order to provide more convenience to a user, besides content according to a card issuer, multiple applications can be installed on the intelligent card. Generally, the card issuer may not manage all of the card content, especially the card content which is not the card content of the card issuer. Therefore, there is a need for a mechanism by which a third party can act as a proxy to manage the card content after the third party passes pre-authentication, for example, the managing includes loading, installing, extraditing and deleting, etc. 
         [0005]    In the process of inventing the present invention, the inventors found that there is no specific method for implementing the mechanism of taking a proxy for managing the card content. 
       SUMMARY 
       [0006]    For overcoming the defects in the conventional technology, a method for managing applications on a card is provided according to the present disclosure. 
         [0007]    A method for managing applications on a card is provided, which includes: executing the following steps after data sent by a running environment (RE) is received by a card content management module: 
         [0008]    Step A, checking a card state, generating and returning that the card-state-not-supporting state code to the RE if the card state is a first preset state or a second preset state, and ending the process; otherwise executing Step B; 
         [0009]    Step B, checking whether the received data conforms to a preset format; executing Step C if the received data conforms to a first preset format, executing Step D if the received data conforms to a second preset format, executing Step E if the received data conforms to a third preset format, executing Step F if the received data conforms to a fourth preset format, executing Step G if the received data conforms to a fifth preset format, executing Step H if the received data conforms to a sixth preset format, or executing Step I if the received data conforms to a seventh preset format; or returning a data error state code to the RE if the received data does not conform to the preset format, and ending the process; 
         [0010]    Step C, continuing to receive the data sent by the RE to obtain a complete first command, parsing the first command to obtain a load file identification and a load file association security domain identification, creating a load file structure, filling the load file identification and load file association security domain identification into the created load file structure, generating and returning an operation success state code and an operation result to the RE if the operation is successful, and ending the process; or generating and returning a respective state code to the RE based on a reason of operation failure if the operation is unsuccessful, and ending the process; 
         [0011]    Step D, continuing to receive the data sent by the RE to obtain a complete second command, parsing the second command to obtain a load file data block, obtaining and storing component data based on the load file data block, filling a storage address into the load file structure, generating and returning an operation success state code and an operation result to the RE if the operation is successful, and ending the process; or generating and returning a respective state code to the RE based on a reason of operation failure if the operation is unsuccessful, and ending the process; 
         [0012]    Step E, continuing to receive the data sent by the RE to obtain a complete third command, parsing the third command to obtain an executable load file identification, an executable module identification, an application identification and an application right, searching for the load file structure based on the executable load file identification obtained by the parsing, searching for an executable module corresponding to the executable module identification obtained by the parsing in storage space corresponding to a storage address in the found load file structure, creating an application of the found executable module, identifying the created application with the application identification obtained by the parsing, assigning a right specified by the application right obtained by the parsing to the created application, setting the created association security domain of the created application to be the association security domain of the executable load file corresponding to the executable load file identification obtained by the parsing, generating and returning an operation success state code and an operation result to the RE if the operation is successful, and ending the process; or generating and returning a respective state code to the RE based on a reason of operation failure if the operation is unsuccessful, and ending the process; 
         [0013]    Step F, continuing to receive the data sent by the RE to obtain a complete fourth command, parsing the fourth command to obtain an application identification and an application right, searching for an application corresponding to the application identification obtained by the parsing in the card, updating a state of the found application to be a selectable state and updating a right of the found application to be the right specified by the application right obtained by the parsing, generating and returning an operation success state code and an operation result to the RE if the operation is successful, and ending the process; or generating and returning a respective state code to the RE based on a reason of operation failure if the operation is unsuccessful, and ending the process; 
         [0014]    Step G, continuing to receive the data sent by the RE to obtain a complete fifth command, parsing the fifth command, obtaining an security domain identification and application identification, searching for an application corresponding to the application identification obtained by the parsing and an application corresponding to the security domain identification obtained by the parsing in the card, updating an association security domain of the found application to be the application corresponding to the security domain identification obtained by the parsing, generating and returning an operation success state code and an operation result to the RE if the operation is successful, and ending the process; or generating and returning a respective state code to the RE based on a reason of operation failure if the operation is unsuccessful, and ending the process; 
         [0015]    Step H, continuing to receive the data sent by the RE to obtain a complete sixth command, parsing the sixth command to obtain an application identification, searching for an application corresponding to the application identification obtained by the parsing in the card, setting the found application to be a personalized application, generating and returning an operation success state code and an operation result to the RE if the operation is successful, and ending the process; or generating and returning a respective state code to the RE based on a reason of operation failure if the operation is unsuccessful, and ending the process; and 
         [0016]    Step I, continuing to receive the data sent by the RE to obtain a complete seventh command, parsing the seventh command to obtain a data domain identification, searching for an executable load file and an application corresponding to the data domain identification obtained by the parsing in the card, deleting the found application and executable load file, deleting the found application and executable load file, generating and returning an operation success state code and a result to the RE if the operation is successful, and ending the process; or generating and returning a respective state code to the RE based on a reason of operation failure if the operation is unsuccessful, and ending the process. 
         [0017]    The process of preparing for loading an application in response to the first command includes: 
         [0018]    Step C 1 , determining whether a first data block of the first command is legitimate, checking whether an executable file corresponding to the first data block exists in the card; the operation condition being not met and the operation failing if the executable file corresponding to the first data block exists in the card; otherwise, executing Step C 2 ; the data being error and the operation failing if the first data block is illegitimate; 
         [0019]    Step C 2 , determining whether a second data block of the first command meets a preset requirement, setting an association security domain of a load file corresponding to the first data block to be the card content management module if the second data block of the first command meets a first preset requirement and executing Step C 4 ; executing Step C 3  if the second data block of the first command meets a second preset requirement; the operation failing if the second data block of the first command does not meet the preset requirement; 
         [0020]    Step C 3 , checking whether an application corresponding to the second data block exists in the card, the operation condition being not met and the operation failing if the application corresponding to the second data block does not exist in the card; otherwise, checking whether the application corresponding to the second data block has a security domain right, if the application corresponding to the second data block has a security domain right, setting the association security domain of the load file corresponding to the first data block to be the application corresponding to the second data block and executing Step C 4  if the application corresponding to the second data block has the security domain right; the operation failing if the application corresponding to the second data block has no security domain right; 
         [0021]    Step C 4 , determining whether a third data block of the first command is legitimate, storing respective data in the third data block if the third data block of the first command is legitimate, executing Step C 5 ; otherwise, data being error and the operation failing; 
         [0022]    Step C 5 , processing a fourth data block of the first command and executing Step C 6 ; and 
         [0023]    Step C 6 , determining whether a fifth data block of the first command is legitimate, creating a load file structure if the fifth data block of the first command is legitimate, filling the load file structure based on the first data block and the second data block, initializing the global block number in the card, the operation being successful; otherwise, data being error and the operation failing. 
         [0024]    The process of loading an application in response to the second command includes: 
         [0025]    Step D 1 , determining whether a fourth byte of the second command equals to a global block number in the card, executing Step D 2  if the fourth byte of the second command equals to the global block number in the card; otherwise data being error and the operation failing; 
         [0026]    Step D 2 , checking whether data authentication mode block information is included in the second command, verifying the data authentication mode block information if the data authentication mode block information is included in the second command; executing Step D 3  if the verifying is successful; data being error and the operation failing if the verifying is unsuccessful; executing Step D 3  if the data authentication mode block information is not included in the second command; 
         [0027]    Step D 3 , obtaining and storing the component data based on the load file data block in the second command, filling the storage address into the load file structure, updating the global block number in the card to be the result of the current value plus 1, determining whether the load file data block is the last load file data block of the load file; executing Step D 4  if the load file data block is the last load file data block of the load file; otherwise, the operation being successful; 
         [0028]    Step D 4 , determining whether the load file data block hash value in the card has a value, performing a hash operation on all load file data blocks as a whole stored in the card if the load file data block hash the value in the card has value and determining whether an operation result equals to the load file data block hash value; executing Step D 5  if the operation result equals to the load file data block hash value, otherwise the data being error and the operation failing; executing Step D 5  if the load file data block hash value in the card has no value; and 
         [0029]    Step D 5 , storing and submitting an executable load file structure, and the operation being successful. 
         [0030]    The process of installing an application in response to the third command includes: 
         [0031]    Step E 1 , determining whether a first data block of the third command is legitimate, checking whether a load file structure corresponding to the first data block exists in the card; executing Step E 2  if the load file structure corresponding to the first data block exists in the card, otherwise the operation condition being not met and the operation failing; data being error and the operation failing if the first data block is illegitimate; 
         [0032]    Step E 2 , determining whether a second data block of the third command is legitimate; checking whether an executable module corresponding to the second data block exists in the storage space corresponding to the storage address in the load file structure; executing Step E 3  if the executable module corresponding to the second data block is in the storage space corresponding to the storage address in the load file structure, otherwise the operation condition being not met and the operation failing; data being error and the operation failing if the second data block of the third command is illegitimate; 
         [0033]    Step E 3 , determining whether a third data block of the third command is legitimate; checking whether an application corresponding to the third data block exists in the card; executing Step E 4  if the application corresponding to the third data block exists in the card, otherwise the operation condition being not met and the operation failing; data being error and the operation failing if the third data block of the third command is illegitimate; 
         [0034]    Step E 4 , determining whether a fourth data block of the third command is legitimate, determining whether the application corresponding to the third data block has a default selection right if the fourth data block of the third command is legitimate, executing Step E 5  if the application corresponding to the third data block has the default selection right, otherwise executing Step E 6 ; data being error and the operation failing if the fourth data block of the third command is illegitimate; 
         [0035]    Step E 5 , determining whether a third byte of the third command equals to a preset value, data being error and the operation failing if the third byte of the third command equals to the preset value; determining whether the card content management module has a default selection right if the third byte of the third command does not equal to the preset value; executing Step E 7  if the card content management module has the default selection right; otherwise the operation condition being not met and the operation failing; 
         [0036]    Step E 6 , determining whether the third data block of the third command meets a preset condition, processing a fifth data block of the third command and executing Step E 7  if the a first preset condition or a second preset condition is met; the operation condition being not met and the operation failing if the preset condition is not met; 
         [0037]    Step E 7 , determining whether a sixth data block of the third command is legitimate, registering the application in response to the third command and executing Step E 8  if the sixth data block of the third command is legitimate; otherwise data being error and the operation failing; 
         [0038]    Step E 8 , determining whether a third byte of the third command equals to a preset value, setting a state of the application corresponding to the third data block in the third command to be installing and the operation being successful; otherwise, setting the state of the application corresponding to the third data block in the third command to be selectable and executing Step E 9 ; and 
         [0039]    Step E 9 , determining whether the application corresponding to the third data block of the third command has a default selection right; setting the application corresponding to the third data block of the third command to be a default application and the operation being successful if the application corresponding to the third data block of the third command has the default selection right; otherwise, the operation being successful. 
         [0040]    The process of setting a state of the application in response to the fourth command includes: 
         [0041]    Step F 1 , determining whether both a first data block and a second data block of the fourth command are legitimate, executing Step F 2  if both the first data block and the second data block of the fourth command are legitimate; otherwise, data being error and the operation failing; 
         [0042]    Step F 2 , determining whether a third data block of the fourth command is legitimate; data being error and the operation failing if the third data block of the fourth command is illegitimate, checking whether an application corresponding to the third data block exists in the card if the third data block of the fourth command is legitimate; the operation condition being not met and the operation failing if the application corresponding to the third data block does not exist in the card, determining whether the state of the application corresponding to the third data block is INSTALLED if the application corresponding to the third data block exists in the card; the operation condition being not met and the operation failing if the state of the application corresponding to the third data block is not INSTALLED, executing Step F 3  if the state of the application corresponding to the third data block is INSTALLED; 
         [0043]    Step F 3 , determining whether a fourth data block of the fourth command is legitimate; executing Step F 4  if the fourth data block of the fourth command is legitimate, otherwise data being error and the operation failing; 
         [0044]    Step F 4 , determining whether a fifth data block of the fourth command is legitimate; executing Step F 5  if the fifth data block of the fourth command is legitimate; otherwise data being error and the operation failing; 
         [0045]    Step F 5 , determining whether a sixth data block of the fourth command is legitimate; setting the state of the application corresponding to the third data block to be selectable and executing Step F 6  if the sixth data block of the fourth command is legitimate; otherwise data being error and the operation failing; and 
         [0046]    Step F 6 , determining whether the application corresponding to the third data block has a default selection right, the operation being successful if the application corresponding to the third data block has no default selection right, determining whether the card content management module has a default selection right if the application corresponding to the third data block has the default selection right; setting the application corresponding to the third data block to be a default application if the card content management module has a default selection right; the operation condition being not met and the operation failing if the card content management module has no default selection right. 
         [0047]    The process of updating an association security domain of the application in response to the fifth command includes: 
         [0048]    Step G 1 , determining whether a first data block of the fifth command is legitimate; the data being error and the operation failing if the first data block is illegitimate; checking whether an application corresponding to the first data block exists in the card if the first data block is legitimate; the operation condition being not met and the operation failing if the application corresponding to the first data block does not exist in the card; determining whether the application corresponding to the first data block is the card content management module if the application corresponding to the first data block exists in the card; the operation condition being not met and the operation failing if the application corresponding to the first data block is the card content management module; executing Step G 2  if the application corresponding to the first data block is not the card content management module; 
         [0049]    Step G 2 , determining whether a second data block of the fifth command is legitimate; the data being error and the operation failing if the second data block of the fifth command is illegitimate; determining whether the state of the application corresponding to the first data block is INSTALLED if the second data block of the fifth command is legitimate; the operation condition being not met and the operation failing if the state is not INSTALLED; executing Step G 3  if the state is INSTALLED; 
         [0050]    Step G 3 , determining whether a third data block of the fifth command is legitimate, data being error and the operation failing if the third data block is illegitimate; checking whether an application corresponding to the third data block exists in the card if the third data block is legitimate; the operation condition is not met and the operation failing if the application corresponding to the third data block does not exist in the card; executing Step G 4  if the application corresponding to the third data block exists in the card; 
         [0051]    Step G 4 , determining whether the application corresponding to the first data block has a security domain right; the operation condition being not met and the operation failing if the application has no security domain right; determining whether the state of the application corresponding to the first data block is LOCKED if the application has the security domain right; the operation condition being not met and the operation failing if the state is LOCKED; determining whether the state of the application corresponding to the first data block is Personalized if the state is not LOCKED; executing Step G 5  if the state is PERSONALIZED; the operation condition being not met and the operation failing if the state is not PERSONALIZED; 
         [0052]    Step G 5 , determine whether both of a fourth data block and a fifth data block of the fifth command are legitimate; executing Step G 6  if both of the fourth data block and the fifth data block of the fifth command are legitimate; otherwise, data being error and the operation failing; and 
         [0053]    Step G 6 , determining whether a sixth data block of the fifth command is legitimate; data being error and the operation failing if the sixth data block of the fifth command is illegitimate; determining whether the application corresponding to the third data block has a security domain right if the sixth data block of the fifth command is legitimate; the operation condition being not met and the operation failing if the application corresponding to the third data block has the security domain right; setting the association security domain of the application corresponding to the third data block to be the application corresponding to the third data block and the operation being successful if the application corresponding to the third data block has no security domain right. 
         [0054]    The process of personalizing an application in response to the sixth command includes: 
         [0055]    Step H 1 , determining whether both of a first data block and a second data block of the sixth command are legitimate; executing Step H 2  if both of the first data block and the second data block of the sixth command are legitimate, otherwise, data being error and the operation failing; 
         [0056]    Step H 2 , determining whether a third data block of the sixth command is legitimate; data being error and the operation failing if the third data block of the sixth command is illegitimate, checking whether an application corresponding to the third data block exists in the card; the operation condition being not met and the operation failing if the application corresponding to the third data block does not exist in the card, determining whether an association security domain of the application corresponding to the third data block is the card content management module if the application corresponding to the third data block exists in the card; executing Step H 3  if the association security domain of the application corresponding to the third data block is the card content management module; otherwise, the operation condition being not met and the operation failing; and 
         [0057]    Step H 3 , determining whether all of a fourth data block, a fifth data block and a sixth data block of the sixth command are all legitimate; setting the application corresponding to the third data block to be a personalized application, otherwise the operation condition being not met and the operation failing. 
         [0058]    The process of deleting an application and an executable load file in response to the seventh command includes: 
         [0059]    Step I 1 , determining whether a first data block of the seventh command is legitimate, executing Step I 2  if the first data block of the seventh command is legitimate; otherwise data being error and the operation failing; 
         [0060]    Step I 2 , determining whether a second data block of the seventh command is legitimate, data being error and the operation failing if the second data block of the seventh command is illegitimate; checking whether an application corresponding to the second data block exists in the card, executing Step I 3  if the application corresponding to the second data block is in the card, otherwise executing Step I 4 ; 
         [0061]    Step I 3 , determining whether a fourth byte of the seventh command equals to a preset value, executing Step I 4  if the fourth byte of the seventh command equals to the preset value, otherwise, executing Step I 5 ; 
         [0062]    Step I 4 , checking whether an executable load file corresponding to the second data block exists in the card; the operation condition being not met and the operation failing if the executable load file corresponding to the second data block does not exist in the card; determining whether the fourth byte of the seventh command equals to the preset value if the executable load file corresponding to the second data block exists in the card; deleting the application and executable load file corresponding to the second data block and the operation being successful if the fourth byte of the seventh command equals to the preset value; deleting the executable load file corresponding to the second data block and the operation being successful if the fourth byte of the seventh command does not equal to the preset value; 
         [0063]    Step I 5 , checking whether the application corresponding to the second data block is another application or an association security domain of another executable load file, the operation condition being not met and the operation failing if the application corresponding to the second data block is another application or an association security domain of another executable load file; otherwise executing Step I 6 ; and 
         [0064]    Step I 6 , determining whether the application corresponding to the second data block is the card content management module; the operation condition being not met and the operation failing if the application corresponding to the second data block is the card content management module; otherwise, deleting the application corresponding to the second data block and the operation being successful. 
         [0065]    A method for implementing card data management is provided, which includes: executing the following Steps in a case that a first card data management module itself acts as the current first card data management module after APDU data of application protocol data unit is received by the first card data management module: 
         [0066]    Step A, checking instruction code of the APDU data; executing Step D if the instruction code is effective value of 0xE8, executing Step B if the instruction code is effective value of 0xE6, or executing Step I if the instruction code is effective value of 0xE4; 
         [0067]    Step B, checking a first parameter of the APDU data; executing Step C if the first parameter is 0x02, executing Step E if the first parameter is 0x04 or 0x0C, executing Step F if the first parameter is 0x08, executing Step G if the first parameter is 0x10, or executing Step H if the first parameter is 0x20; 
         [0068]    Step C, receiving a data domain part of a pre-load command to obtain all content of the pre-load command, checking whether a card meets a pre-load condition based on the content of the pre-load command, newly building an executable file structure and setting respective data and executing Step J if the card meets the pre-load condition; otherwise executing Step J directly; 
         [0069]    Step D, receiving a data domain part of a load command to obtain all content of the load command, checking whether the card meets a load condition based on the content of the load command, storing the content of the load command and executing Step J if the card meets the load condition; otherwise directly executing Step J; 
         [0070]    Step E, receiving a data domain part of an install command to obtain all content of the install command, checking whether the card meets an install condition based on the content of the install command, creating an application and setting a respective state and executing Step J if the card meets the install condition; otherwise directly executing Step J; 
         [0071]    Step F, receiving a data domain part of a selectable command to obtain all content of the selectable command, checking whether the card meets a selectable condition based on the content of the selectable command, setting a state of the respective application to be selectable and executing Step J if the card meets the selectable condition; otherwise directly executing Step J; 
         [0072]    Step G, receiving a data domain part of an extradition command to obtain all content of the extradition command, determining whether the card meets an extradition condition based on the content of the extradition command, resetting a security domain associated with the respective application and executing Step J if the card meets the extradition condition; otherwise directly executing Step J; 
         [0073]    Step H, receiving a data domain part of a personalized command to obtain all content of the personalized command, checking whether the card meets a personalized condition based on the content of the personalized command, sending data to the respective application and executing Step J if the card meets the personalized condition; otherwise directly executing Step J; 
         [0074]    Step I, receiving the data domain part of a deleting command to obtain all content of the deleting command, checking whether the card meets a deleting condition based on the content of the deleting command, deleting respective data in the card which is specified in the deleting command and executing Step J if the card meets the deleting condition; otherwise directly executing Step J; and 
         [0075]    Step J, generating and returning the respective returned data and/or respective state code to the RE. 
         [0076]    The advantages of the present disclosure are to provide a method for managing applications on a card, thereby implementing the loading, installing, updating, personalizing and deleting of applications on the card; additionally, it is convenient for managing data on the card, for which there are two aspects as follows: 
         [0077]    1. the card issuer may care little about an unconcerned application; and 
         [0078]    2. the third party can manage own application, and there is no need to manage the application by the card issuer. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0079]    The drawings needed to be used in the description of embodiments or the conventional technology are described briefly as follows, so that technical solutions in the embodiments of the present disclosure or in the conventional technology may become clearer. It is obvious that the drawings in the following description only illustrate some embodiments of the present disclosure. For those skilled in the art, other drawings may be obtained based on these drawings without any creative work. 
           [0080]      FIG. 1  is a flow chart of a method for managing applications on a card according to Embodiment 1 of the present disclosure; 
           [0081]      FIG. 2  is a flow chart of a specific method for preparing for loading an application according to Embodiment 2 of the present disclosure; 
           [0082]      FIG. 3  is a flow chart of a specific method for loading an application according to Embodiment 3 of the present disclosure; 
           [0083]      FIG. 4  is a flow chart of a specific method for installing an application according to Embodiment 4 of the present disclosure; 
           [0084]      FIG. 5  is a flow chart of a specific method for setting a state of an application according to Embodiment 5 of the present disclosure; 
           [0085]      FIG. 6  is a flow chart of a specific method for updating an association security domain of an application according to Embodiment 6 of the present disclosure; 
           [0086]      FIG. 7  is a flow chart of a specific method for personalizing an application according to Embodiment 7 of the present disclosure; 
           [0087]      FIG. 8  is a flow chart of a specific method for deleting an application and an executable load file according to Embodiment 8 of the present disclosure; 
           [0088]      FIG. 9  is a flow chart of a method for implementing card data management according to the present disclosure; 
           [0089]      FIG. 10  is a specific flow chart of Step  1001  to Step  1028 ; 
           [0090]      FIG. 11  is a specific flow chart of Step  1101  to Step  1129 ; 
           [0091]      FIG. 12  is a specific flow chart of Step  1201  to Step  1235 ; 
           [0092]      FIG. 13  is a specific flow chart of Step  1301  to Step  1324 ; 
           [0093]      FIG. 14  is a specific flow chart of Step  1401  to Step  1428 ; 
           [0094]      FIG. 15  is a specific flow chart of Step  1501  to Step  1517 ; and 
           [0095]      FIG. 16  is a specific flow chart of Step  1601  to Step  1625 . 
       
    
    
     DETAILED DESCRIPTION OF THE EMBODIMENTS 
       [0096]    Technical solutions in embodiments of the disclosure are described clearly and completely in conjunction with the drawings hereinafter. Apparently, the described embodiments are merely a part other than all of the embodiments according to the disclosure. Based on the described embodiments of the disclosure, other embodiments obtained by those of ordinary skill in the art without any creative work belong to the scope of the disclosure. 
       Embodiment 1 
       [0097]    A method for managing applications on a card is provided according to Embodiment 1 of the present disclosure. As shown in  FIG. 1 , the method includes executing the following Steps after data sent by a RE device is received by a card content management module. In the present disclosure, the card content management module is a special application in the card. 
         [0098]    In Step  101 , a card state is checked; if the card state is a first preset state or a second preset state, a card-state-not-supporting state code is generated and sent to the RE and the process ends; otherwise, Step  102  is executed. 
         [0099]    Specifically, in Embodiment 1, the first preset state refers to TERMINATED, and the second preset state refers to CARD_LOCKED. 
         [0100]    In Step  102 , it is checked whether the received data conforms to a preset format; if the received data conforms to a first preset format, Step  103  is executed; if the received data conforms to a second preset format, Step  104  is executed; if the received data conforms to a third preset format, Step  105  is executed; if the received data conforms to a fourth preset format, Step  106  is executed; if the received data conforms to a fifth preset format, Step  107  is executed; if the received data conforms to a sixth preset format, Step  108  is executed; if the received data conforms to a seventh preset format, Step  109  is executed; or if the received data does not conform to the preset format, a data error state code is generated and sent back to the RE and the process ends. 
         [0101]    Specifically, in Embodiment 1, Step  102  specifically includes Step B 1  to Step B 3 . 
         [0102]    In Step B 1 , it is checked whether the length of the received data is 5 bytes, if the received data is 5 bytes, Step B 2  is executed; otherwise, the received data does not conform to a preset format, the data error state code is generated and returned to the RE and the process ends. 
         [0103]    In Step B 2 , it is checked whether the first byte of the received data is 0x80 or 0x84, if the first byte of the received data is 0x80 or 0x84, Step B 3  is executed; otherwise, the received data does not conform to the preset formats, the data error state code is generated and returned to the RE and the process ends. 
         [0104]    In Step B 3 , the second byte of the received data is checked, if the second byte is 0xE6, Step B 4  is executed; if the second byte is 0xE8, Step B 5  is executed; if the second byte is 0xE4, Step B 6  is executed; otherwise, the received data does not conform to the preset format, the data error state code is generated and returned to the RE and the process ends. 
         [0105]    In Step B 4 , the third byte to the fifth byte of the received data are checked, if the third byte and the fourth byte are 0x02 and 0x00 respectively and the fifth byte is not less than 0x0A, the received data conforms to the first preset format and Step  103  is executed; if the third byte is 0x04 or 0x0C, the fourth byte is 0x00 and the fifth byte is not less than 0x18, the received data conforms to the third preset format, Step  105  is executed; if the third byte and the fourth byte are 0x08 and 0x00 respectively and the fifth byte is not less than 0x0C, the received data conforms to the fourth preset format and Step  106  is executed; if the third byte and the fourth byte are 0x10 and 0x00 respectively and the fifth byte is not less than 0x10, the received data conforms to the fifth preset format and Step  107  is executed; if the third byte and the fourth byte are 0x20 and 0x00 respectively and the fifth byte is not less than 0x0B, the received data conforms to the sixth preset format and Step  108  is executed; otherwise, the received data does not conform to the preset format, the data error state code is generated and returned to the RE and the process ends. 
         [0106]    In Step B 5 , it is checked whether the third byte of the received data is 0x00 or 0x80, if the third byte of the received data is 0x00 or 0x80, the received data conforms to the second preset format and Step  104  is executed; otherwise, the received data does not conform to the preset format, the data error state code is generated and returned to the RE and the process ends. 
         [0107]    In Step B 6 , if the third byte of the received data is 0x00, the received data conforms to the seventh preset format and Step  109  is executed; otherwise, the received data does not conform to the preset format, the data error state code is generated and returned to the RE and the process ends. 
         [0108]    In Step  103 , the data sent by RE is received continually to obtain complete APDU data, loading an application is prepared according to the APDU data. 
         [0109]    Specifically, in Embodiment 1, the APDU data in Step  103  is a for_Load command. 
         [0110]    The process of preparing for loading an application includes: parsing the for_Load command, obtaining a file load identification and a load file association security domain identification, creating load file structure, filling the obtained file load identification and the load file association security domain identification in the created load file structure, generating and returning an operation success state code and an operation result to the RE if the operation is successful, and ending the process; or generating and returning a respective state code based on a reason of operation failure to the RE if the operation is unsuccessful, and ending the process. 
         [0111]    In Step  104 , the data sent by RE is received continually to obtain complete APDU data and the application is loaded according to the APDU data. 
         [0112]    Specifically, in Embodiment 1, the APDU data in Step  104  is a Load command. 
         [0113]    The application being loading according to the APDU data specifically includes: parsing the Load command to obtain a file loading data block, obtaining component data and storing the component data according to the file loading data block, filling a storage address in the load file structure, generating and returning an operation success state code and an operation result to the RE if the operation is successful, and ending the process; or generating and returning a respective state code based on a reason of operation failure to the RE if the operation is unsuccessful, and ending the process. 
         [0114]    In Step  105 , the data sent by RE is received continually to obtain complete APDU data and the application is installed based on the APDU data. 
         [0115]    Specifically, in Embodiment 1, the APDU data in Step  105  is a for_Install command. 
         [0116]    The application being installed according to the APDU data specifically includes: parsing the for_Install command, obtaining an executable load file identification, an executable module identification, an application identification and an application right, searching for the load file structure according to the executable load file identification obtained by the parsing, searching for an executable module corresponding to the executable module identification obtained by the parsing in storage space corresponding to a stored address storage in the found load file structure, creating an application of the executable module founded by searching, identifying the created application with the application identification obtained by the parsing, assigning a right specified by the application right obtained by the parsing to the created application, setting the association security domain of the created application to be the association security domain of the executable file corresponding to the executable file identification obtained by the parsing, generating and returning an operation successes state operation code and a result to the RE if the operation is successful, and ending the process; or generating a respective state code based on a reason of operation failure if the operation is unsuccessful, and ending the process. 
         [0117]    In Step  106 , the data sent by RE is received continually to obtain complete APDU data and a state of the application is set based on the APDU data. 
         [0118]    Specifically, in Embodiment 1, the APDU data in Step  106  is a for_Makeselectable command. 
         [0119]    The state of the application state being set based on the APDU data specifically includes: paring the for_Makeselectable command, obtaining application identification and application right, searching for the application corresponding to the application identification, updating the state of the found application to be an optional state and updating the right of the found application to be the right specified application right obtained by the parsing, generating and returning the operation success code and a result to the RE if the operation is successful, and ending the process; or generating and returning a respective state code to the RE based on a reason of operation failure if the operation is unsuccessful, and ending the process. 
         [0120]    In Step  107 , the data sent by RE is received continually to obtain complete APDU data and an association security domain of the application is updated based on the APDU data. 
         [0121]    In this case, the association security domain of the application includes services such as providing a key for the application. 
         [0122]    Specifically, in Embodiment 1, the APDU data in Step  107  is a for_Extradition command. 
         [0123]    The association security domain of the application being updated based on the APDU data specifically includes: parsing the for_Extradition command, obtaining security domain identification and application identification, searching for the application corresponding to the application identification obtained by the parsing and the application corresponding to the security domain identification obtained by the parsing, updating the found association security domain of the application corresponding to the application identification obtained by the parsing to be the application corresponding to the security domain identification obtained by the parsing, generating and returning an operation success state code and a result to the RE if the operation is successful, and ending the process; or generating and returning a respective state code based on a reason of operation failure to the RE if the operation is unsuccessful, and ending the process. 
         [0124]    In Step  108 , the data sent by RE is received continually to obtain complete APDU data and the application is personalized based on the APDU data. 
         [0125]    Specifically, in Embodiment 1, the APDU data in Step  108  is a for_Personalized command. 
         [0126]    The application being personalized based on the APDU data specifically includes: parsing the for_Personalized command to obtain the application identification, searching for the application corresponding to the application identification obtained by the parsing, setting the found application to be a personalized application, generating and returning an operation success state code and a result to the RE if the operation is successful, and ending the process; or generating and returning a respective state code based on a reason of operation failure to the RE if the operation is unsuccessful, and ending the process. 
         [0127]    In Step  109 , the data sent by RE is received continually to obtain complete APDU data, the application and the executable load file are deleted based on the APDU data. 
         [0128]    Specifically, in Embodiment 1, the APDU data in Step  109  is a Delete command. 
         [0129]    The application and the executable load file being deleted based on the APDU data specifically includes: parsing the Delete command, obtaining the data domain identification, searching for the application corresponding to the data domain identification obtained by the parsing and the executable load file in the card, deleting the found application and the executable file, generating and returning an operation success state code and a result to the RE if the operation is successful, and ending the process; or generating and returning a respective state code based on a reason of operation failure to the RE if the operation is unsuccessful, and ending the process. 
         [0130]    Specifically, in Embodiment 1, the returned result is 0x00 and the reason of operation failure includes that operation condition is not met and data error; in a case that the reason of operation failure is that the operation condition is not met, a state code not meeting the operation condition is generated and sent to the RE; in a case that the reason of operation failure is that the data is error, a data error state identification is returned to the RE. 
       Embodiment 2 
       [0131]    A specific method for preparing for loading an application in the method for managing the application on the card according to Embodiment 1 is provided according to Embodiment 2 of the present disclosure. The APDU data in Embodiment 2 is complete APDU data obtained in Step  103 ; the data domain of the APDU data can be considered to be made up of multiple data blocks, each data block is in a LV structure, i.e. a data length+a data; as shown in  FIG. 2 , the method includes Step  201  to Step  212 . 
         [0132]    In Step  201 , it is determined whether a first data block of the APDU data is legitimate, Step  202  is executed if the first data block is legitimate; otherwise, data is error and the operation fails. 
         [0133]    In Embodiment 2, the first data block is a load file identification length+a load file identification. 
         [0134]    The process of determining whether a first data block of the APDU data is legitimate includes: determining whether the load file identification length of the first data block of the APDU data is in a preset range, checking each byte of the load file identification in the first data block of the APDU data if the load file identification length is in a preset range, the first data block is illegitimate if each byte is 0x00, the first data block is legitimate if not all of the bytes are 0x00; the first data block is illegitimate if the load file identification length is not in the preset range. 
         [0135]    The preset range is from 0x05 to 0x10. 
         [0136]    In Step  202 , it is checked whether an executable file corresponding to the load file identification exists in the card, the operating condition is not met and the operation fails if the executable file exists in the card; otherwise, Step  203  is executed. 
         [0137]    In Step  203 , it is checked whether a second data block of the APDU data meets a preset requirement, Step  204  is executed if a first preset requirement is met; Step  205  is executed if a second preset requirement is met; data is error and the operation fails if the preset requirement is not met. 
         [0138]    In Embodiment 2, the second data block is a load file association security domain identification length+a load file association security domain identification. 
         [0139]    The process of checking whether a second data block of the APDU data meets a preset requirement includes: determining whether the load file association security domain identification length in the second data block of the APDU data is 0x00, where the second data block of the APDU data meets the first preset requirement if the load file association security domain identification length is 0x00; checking each byte of the load file association security domain identification in the second data block of the APDU data if the load file association security domain identification length is not 0x00; the second data block of the APDU data does not meet the preset requirement if each byte of the load file association security domain identification is 0x00, the second data block of the APDU data meets the second preset requirement if not all bytes are 0x00. 
         [0140]    In Step  204 , the association security domain of the load file is set to be a card content management module, and Step  208  is executed. 
         [0141]    In this case, the load file is a load file corresponding to the load file identification of the first data block in the first block of the APDU data. 
         [0142]    In Step  205 , it is checked whether an application corresponding to the load file association security domain exists in the card, Step  206  is executed if the application corresponding to the load file association security domain exists in the card; otherwise the operation condition is not met and the operation fails. 
         [0143]    In Step  206 , it is checked whether the application corresponding to the load file association security domain has a security domain right; Step  207  is executed if the application has the security domain right; otherwise, the operation condition is not met and the operation fails. 
         [0144]    Specifically, whether the application has a security domain right is determined through right attribution of the application, the right attribution of the application is one byte data, which includes b8 b7 b6 b5 b4 b3 b2 b1 in an order from a high bit to a low bit; checking whether the application corresponding to the load file association security domain has security domain right specifically is checking the b8 of right attribution of the application corresponding to the load file association security domain identification, the application corresponding to the load file association security domain identification has security domain right if b8 is 1; the application corresponding to the load file association security domain identification has no security domain right if b8 is not 1. 
         [0145]    In Step  207 , the association security domain of the load file is set to be an application corresponding to the load file association security domain identification. 
         [0146]    In Step  208 , it is determined whether a third data block of the APDU data is legitimate, Step  209  is executed if the third data block is legitimate; otherwise, data is error and the operation fails. 
         [0147]    In Embodiment 2, the third data block is a load file data block hash value length+a load file data block hash value. 
         [0148]    The process of determining whether a third data block of the APDU data is legitimate includes determining whether the load file data block hash value length of the third data block of the APDU data is 0x00, where the third data block of the APDU data is illegitimate if the load file data block hash value length of the third data block of the APDU data is 0x00; otherwise, the third data block of the APDU data is legitimate. 
         [0149]    In Step  209 , the load file data block hash value is stored. 
         [0150]    In Step  210 , a fourth data block of the APDU data is processed. 
         [0151]    In Embodiment 2, the fourth data block is: a load parameter domain length+a load parameter domain, the load parameter domain is one TLV structure data block (Tn, Ln, Vn), and Vn is made up of three TLV structure data blocks (Tn′, Ln′, Vn′). In Embodiment 2, Step  210  specifically includes Step  210 - 1  to Step  210 - 7 . 
         [0152]    In Step  210 - 1 , it is determined whether the load parameter domain length is 0x00, Step  211  is executed if the load parameter domain length is 0x00; otherwise, Step  210 - 2  is executed. 
         [0153]    In Step  210 - 2 , it is determined whether Tn is 0xEF, Step  210 - 3  is executed if Tn is 0xEF; otherwise, data is error and the operation fails. 
         [0154]    In Step  210 - 3 ,  1  TLV structure data block of Vn is obtained, it is determined whether Tn′ of the TLV structure data block is legitimate, Step  210 - 4  is executed if the Tn′ of the TLV structure data block is legitimate; otherwise, data is error and the operation fails. 
         [0155]    In Step  210 - 4 , it is determined whether Ln′ of the TLV structure block data is 0x02, Step  210 - 5  is executed if Ln′ of the TLV structure block data is 0x02; otherwise, data is error and the operation fails. 
         [0156]    In Step  210 - 5 , Tn′ of the TLV structure data block is checked, a non-volatile code space limit is obtained and stored according to Vn′ of the TLV structure data block if Tn′ is 0xC6 and Step  210 - 6  is executed, a volatile data space limit is obtained and stored according to Vn′ of the TLV structure data block and Step  210 - 6  is executed if Tn′ is 0xC7; a non-volatile data space limit is obtained and stored according to Vn′ of the TLV structure data block if Tn′ is 0xC8 and Step  210 - 6  is executed. 
         [0157]    In Step  210 - 6 , it is determined whether an unprocessed TLV structure data block exists, Step  210 - 3  is returned to if the unprocessed TLV structure data block exists; otherwise, Step  210 - 7  is executed. 
         [0158]    In Step  210 - 7 , it is determined whether non-volatile storage space and volatile storage space meet the above limit, Step  211  is executed if the non-volatile storage space and volatile storage space meet the above limit; otherwise, the operation condition is not met and the operation fails. 
         [0159]    In Step  211 , it is determined whether a fifth data block of the APDU data is legitimate, Step  212  is executed if the fifth data block of the APDU data is legitimate; otherwise, data is error and the operation fails. 
         [0160]    In Embodiment 2, the fifth data block is a load token length+a load token. 
         [0161]    The process of determining whether a fifth data block of APDU data is legitimate includes: determining whether the load token length in the fifth data block of the APDU is 0x00, where the fifth data block of APDU data is legitimate if the load token length in the fifth data block of the APDU is 0x00; otherwise, the data block of APDU data is illegitimate. 
         [0162]    In Step  212 , a load file structure is created, a load file identification and a load file association security domain identification are filled in the created load file structure, a global block number in the card is initialized and the operation is successful. 
       Embodiment 3 
       [0163]    A method for loading an application in the method for managing applications on the card according to Embodiment 1 is provided according to Embodiment 3. As shown in  FIG. 3 , the method includes Step  301  to Step  310 . 
         [0164]    In Step  301 , it is determined whether a fourth byte of the APDU data equals to the global block number inside the card, Step  302  is executed if the fourth byte equals to the global block number inside the card; otherwise data is error and the operation fails. 
         [0165]    In Step  302 , it is checked whether APDU data contains DAP (Data Authentication Pattern) block information, Step  303  is executed if the APDU data contains DAP block information; otherwise, Step  304  is executed. 
         [0166]    In Step  303 , the DAP block information is verified, Step  304  is executed if the verifying is successful, otherwise, data is error and the operation fails. 
         [0167]    In Step  304 , component data is obtained and stored according to the load file data block in the APDU data and a storage address filled in the load file structure. 
         [0168]    Specifically, the load file is separated into multiple load file data blocks outside the card, each time one load file data block is sealed as one piece of APDU data and send the APDU data to the card; RE sends the APDU data received by the card and send the APDU data to the card content management module, the card content management module processes the load file data block inside every piece of APDU data by taking a component as an unit; the component includes: a Header component, a Directory component, an Applet component, an Import component, etc. 
         [0169]    In Step  305 , a global block number in the card is updated. 
         [0170]    In Embodiment 3, the process of updating the global block number in the card includes adding 1 to the current value of the global block number in the card. 
         [0171]    In Step  306 , it is determined whether the load file data block is the last load file data block of the load file; Step  307  is executed if the load file data block is the last load file data block of the load file; otherwise, the operation is successful. 
         [0172]    In Embodiment 3, the process of determining whether the load file data block is the last load file data block of the load file includes: determining whether the value of a third byte of the APDU data is 0x80, where the load file data block is the last load file data block of the load file if the value of the third byte of the APDU data is 0x80; otherwise, the load file data block is not the last load file block of the load file and the load file has another data block. 
         [0173]    In Step  307 , it is determined whether a load file data block hash value in the card has a value, Step  308  is executed if the load file data block hash value in the card has a value; otherwise, Step  310  is executed. 
         [0174]    In Step  308 , all load file data blocks stored in the card are taken as a whole and a Hash operation is performed on the whole. 
         [0175]    In Step  309 , it is determined whether an operation result equals to the load file data block hash value stored in the card, Step  310  is executed if the operation result equals to the load file data block hash value stored in the card; otherwise, data is error and the operation fails. 
         [0176]    In Step  310 , the executable load file structure stored and submitted and the operation is successful. 
         [0177]    In Embodiment 3, the submitting is writing the data from a buffer to a permanent storage area. 
       Embodiment 4 
       [0178]    A specific method for installing application in the method for managing applications on the card according to Embodiment 1 is provided according to Embodiment 4 of the present disclosure. The data domain part of the APDU data in Embodiment 4 can be considered to be made up of multiple data blocks, each data block is in a LV structure, i.e. a data length+a data; as shown in  FIG. 4 , the method includes Step  401  to Step  419 . 
         [0179]    In Step  401 , it is determined whether a first data block of the APDU data is legitimate, Step  402  is executed if the first data block is legitimate; otherwise, data is error and the operation fails. 
         [0180]    In Embodiment 4, the first data block specifically includes an executable load file identification length+an executable load file identification. 
         [0181]    The process of determining whether the first data block of the APDU data is legitimate includes: determining whether the executable load file identification length in the first data block of APDU data is in a preset range, where the first data block of the APDU data is legitimate if the length is in the preset range; otherwise, the first data block of the APDU data is illegitimate. 
         [0182]    The preset range is from 0x05 to 0x10. 
         [0183]    In Step  402 , it is checked whether a load file structure corresponding to the executable load file identification exists in the card, Step  403  is executed if the load file structure exists in the card; otherwise, the operation condition is not met and the operation fails. 
         [0184]    In Step  403 , it is determined whether a second data block of the APDU data is legitimate, Step  404  is executed if the second data block is legitimate; otherwise, data is error and the operation fails. 
         [0185]    In Embodiment 4, the second data block specifically includes an executable module identification length+an executable module identification. 
         [0186]    The process of determining whether the second data block of the APDU data is legitimate includes: determining whether the executable module identification length in the second data block is in a preset range, where the second data block of the APDU data is legitimate if the length is in the preset range; otherwise, the second data block of the APDU data is illegitimate. 
         [0187]    The preset range is from 0x05 to 0x10. 
         [0188]    In Step  404 , it is checked whether an executable module corresponding to the executable module identification exists in the storage apace corresponding to the storage address in the load file structure, Step  405  is executed if the executable module corresponding to the executable module identification exists in the storage space corresponding to the storage address in the load file structure; otherwise, the operation condition is not met and the operation fails. 
         [0189]    In Step  405 , it is determined whether a third data block of the APDU data is legitimate, Step  406  is executed if the third data block is legitimate; otherwise, data is error and the operation fails. 
         [0190]    In Embodiment 4, the third data block specifically includes an application identification length+an application identification. 
         [0191]    The process of determining whether the third data block of the APDU data is legitimate includes: determining whether the application identification length in the third data block of the APDU data is in a preset range, and checking each byte of the application identification in the third data block of the APDU data, where the third data block is illegitimate if each byte is 0x00, the third data block is legitimate if not all of the bytes are 0x00; the third data block is illegitimate if the application identification length in the third data block of the APDU data is not in the preset range. 
         [0192]    The preset range is from 0x05 to 0x10. 
         [0193]    In Step  406 , it is checked whether an application corresponding to the application identification exists in the card, Step  407  is executed if the application corresponding to the application identification exists in the card and the operation fails if the operation condition is not met. 
         [0194]    In Step  407 , it is determined whether a fourth data block of the APDU data is legitimate, Step  408  is executed if the fourth data block is legitimate; otherwise, data is error and the operation fails. 
         [0195]    In Embodiment 4, the fourth data block specifically includes an application right length+application right. 
         [0196]    The process of determining whether the fourth data block of the APDU data is legitimate includes: determining whether the application right length in the fourth data block of the APDU data is 0x01, where the fourth data block of the APDU data is legitimate if the application right length is 0x01; otherwise the fourth data block of the APDU data is illegitimate. 
         [0197]    In Step  408 , it is determined whether the installed application this time has a default selection right, Step  409  is executed if the installed application this time has the default selection right; otherwise, Step  411  is executed. 
         [0198]    In Embodiment 4, the application installed this time specifically is an application corresponding to the application identification in the third data block; the process of determining whether the application installed this time has a default selection right includes: determining whether the application right in the fourth data block of the APDU is 0x04, where the application installed this time has the default selection right if the application right in the fourth data block of APDU data is 0x04; otherwise, the application installed this time has no default selection right. 
         [0199]    In Step  409 , it is determined whether a third byte of the APDU data is a preset value, where the data is error and the operation fails if the third byte is the preset value; otherwise, Step  410  is executed. 
         [0200]    In Embodiment 4, the preset value is 0x04. 
         [0201]    In Step  410 , it is determined whether the card content management module has a default selection right, Step  413  is executed if the card content management module has the default selection right; otherwise, the operation condition is not met and the operation fails. 
         [0202]    In Embodiment 4, it is determined whether the card content management module has the default selection right depending on the right attribution of the card content management module, and the right attribution of the card content management module is one byte data, which includes b8 b7 b6 b5 b4 b3 b2 b1 in an order from high bit to low bit. 
         [0203]    The process of determining whether the card content management module has a default selection right includes: determining whether b3 of the right attribution of the card content management module is 1, where the card content management module has the default selection right if b3 is 1; otherwise, the card content management module has no default selection right. 
         [0204]    In Step  411 , it is determined whether the application right meets a preset condition, Step  412  is executed if the application right meets a first preset condition or a second preset condition; the operation condition is not met and the operation fails if the application right does not meet the preset condition. 
         [0205]    In Embodiment 4, the process of determining whether the application right meets the preset condition includes: checking the application right, where the application right meets the first preset condition if the first bit, the sixth bit and the seventh bit are 0 and the eighth bit is 1 from the low bit in the application right; the application right meets the second preset condition if not all of the first bit, the sixth bit and the seventh bit are 0 from the low bit in the application right; otherwise, the application right does not meet the preset condition. 
         [0206]    In Step  412 , an install parameter domain in a fifth data block of the APDU data is processed and Step  413  is executed. 
         [0207]    In Embodiment 4, the fifth data block specifically includes an install parameter domain length+an install parameter domain, the install parameter domain is made up of data in a format of one or more TLV structure data blocks (Tn, Ln, Vn), and Vn is made up of zero or more TLV structure data blocks (Tn′, Ln′, Vn′). In Embodiment 4, Step  412  specifically includes Step  412 - 1  to Step  412 - 9 . 
         [0208]    In Step  412 - 1 , it is determined whether the install parameter domain length is 0x00, Step  413  is executed if the install parameter domain length is 0x00; otherwise, Step  412 - 2  is executed. 
         [0209]    In Step  412 - 2 , one TLV structure data block of the install parameter is obtained, Tn of the TLV structure data block is checked, Step  412 - 3  is executed if Tn is 0xC9, or Step  412 - 4  is executed if Tn is 0xEF; otherwise, the data is error and the operation fails. 
         [0210]    In Step  412 - 3 , Vn of the TLV structure data block is stored and Step  412 - 9  is executed. 
         [0211]    In Step  412 - 4 , one TLV structure data block of Vn of the TLV structure data block is obtained, it is determined whether Tn′ is legitimate, Step  412 - 5  is executed if Tn′ is legitimate; otherwise, data is error and the operation fails. 
         [0212]    In Step  412 - 5 , it is determined whether Ln′ is 0x02, Step  412 - 6  is executed if Ln′ is 0x02; otherwise, data is error and the operation fails. 
         [0213]    In Step  412 - 6 , Tn′ is checked, a volatile data space limit is obtained and stored based on Vn′ if Tn′ is 0xC7, Step  412 - 7  is executed, a non-volatile data space limit is obtained and stored based on Vn′ if Tn′ is 0xC8, and Step  412 - 7  is executed. 
         [0214]    In Step  412 - 7 , it is determined whether an unprocessed TLV structure data block exists in the TLV structure data block, Step  412 - 4  is executed if the unprocessed TLV structure data block exists in the TLV structure data block; otherwise Step  412 - 8  is executed. 
         [0215]    In Step  412 - 8 , it is determined whether the non-volatile storage space and the volatile storage space meets the above limit, Step  412 - 9  is executed if the non-volatile storage space and the volatile storage space meets the above limit; otherwise the operation condition is not met and the operation fails. 
         [0216]    In Step  412 - 9 , it is determined whether an unprocessed TLV structure data block exists in the install parameter domain, Step  412 - 2  is executed if the unprocessed TLV structure data block exists in the install parameter domain; otherwise, Step  413  is executed. 
         [0217]    In Step  413 , it is determined whether a sixth data block of the APDU data is legitimate, Step  414  is executed if the sixth data block is legitimate, otherwise, data is error and the operation fails. 
         [0218]    In Embodiment 4, the sixth data block specifically includes an install token length+an install token. 
         [0219]    The process of determining whether the sixth data block of the APDU data is legitimate includes: determining whether the install token length in the sixth data block of the APDU data is 0x00, where the sixth data block is legitimate if the install token length in the sixth data block of the APDU data is 0x00; otherwise, the sixth data block of the APDU data is illegitimate. 
         [0220]    In Step  414 , an application is registered based on the application identification in the data domain of the APDU data. 
         [0221]    In Embodiment 4, Step  414  specifically includes: creating and storing an example of the executable module corresponding to the executable module identification in the APDU data, uniquely associating the example with the application identification in the APDU data, setting a state of the example to be an initial value, setting a right of the example based on the application right in the APDU data, setting an association security domain of the example to be the association security domain of the executable load file corresponding to the executable load file identification in the APDU data. 
         [0222]    In Step  415 , it is determined whether the third byte of the APDU data equals to a preset value, Step  419  is executed if the third byte equals to the preset value, otherwise, Step  416  is executed. 
         [0223]    In Embodiment 4, the preset value is 0x04. 
         [0224]    In Step  416 , a state of the application installed this time is set to be SELECTABLE (selectable). 
         [0225]    In Embodiment 4, Step  416  specifically is setting the state attribute of the application installed this time to be 0x07. 
         [0226]    In Step  417 , it is determined whether the application installed this time has a default selection right, Step  418  is executed if the application has the default selection right; otherwise, the operation is successful. 
         [0227]    In Step  418 , the application installed this time is set to be a default application and the operation is successful. 
         [0228]    In Step  419 , a state of the application installed this time is set to be INSTALLED (installed) and the operation is successful. 
         [0229]    In Embodiment 4, Step  419  is setting the state attribute of the application installed this time to be 0x03. 
       Embodiment 5 
       [0230]    A specific method for setting application state in the method for managing applications on the card according to Embodiment 1 is provided according to Embodiment 5 of the present disclosure. The data domain of the APDU data can be considered to be made up of multiple data blocks; each data block is in a LV structure, i.e. a data length+a data; as shown in  FIG. 5 , the method includes Step  501  to Step  511 . 
         [0231]    In Step  501 , it is determined whether both a first data block and a second data block of the APDU data are legitimate, Step  502  is executed if both the first data block and the second data block are legitimate; otherwise, data is error and the operation fails. 
         [0232]    In Embodiment 5, the process of determining whether the first data block of the APDU data is legitimate includes: determining whether the first data block of the APDU data is 0x00, where the first data block of the APDU data is legitimate if the first data block is 0x00; otherwise, the first data block of the APDU data is illegitimate. 
         [0233]    The process of determining whether the second data block of the APDU data is legitimate includes: determining whether the second data block of the APDU data is 0x00, where the second data block of the APDU data is legitimate if the second data block is 0x00; otherwise, the second data block of the APDU data is illegitimate. 
         [0234]    In Step  502 , it is determined whether a third data block of the APDU data is legitimate, Step  503  is executed if the third data block is legitimate; otherwise, data is error and the operation fails. 
         [0235]    In Embodiment 5, the third data block specifically includes an application identification length+an application identification. 
         [0236]    The process of determining whether the third data block of the APDU data is legitimate includes: determining whether the application identification length in the third data block of the APDU data is in a preset range, where the third data block of the APDU data is legitimate if the application identification length is in the preset range; otherwise, the third data block of the APDU data is illegitimate. 
         [0237]    The preset range is from 0x05 to 0x10. 
         [0238]    In Step  503 , it is checked whether an application corresponding to the application identification exists in the card, Step  504  is executed if the application corresponding to the application identification exists in the card; otherwise the operation condition is not met and the operation fails. 
         [0239]    In Step  504 , it is determined whether a state of the application corresponding to the application identification is INSTALLED, Step  505  is executed if the state is INSTALLED; otherwise, the operation condition is not met and the operation fails. 
         [0240]    In Step  505 , it is determined whether a fourth data block of the APDU data is legitimate, Step  506  is executed if the fourth data block is legitimate; otherwise, data is error and the operation fails. 
         [0241]    In Embodiment 5, the fourth data block specifically includes an application right length+an application right. 
         [0242]    The process of determining whether the fourth data block of the APDU data is legitimate includes: determining whether the application right length in the fourth data block of the APDU data is 0x01, where the fourth data block is legitimate of the APDU data is legitimate if the application right length is 0x01; otherwise, the fourth data block of the APDU data is illegitimate. 
         [0243]    In Step  506 , it is determined whether the fifth data block of the APDU data is legitimate, Step  507  is executed if the fifth data block is legitimate; otherwise, data is error and the operation fails. 
         [0244]    In Embodiment 5, the fifth data block includes a parameter domain length+a parameter domain. 
         [0245]    The process of determining whether the fifth data block of the APDU data is legitimate includes: determining whether the parameter domain length of the fifth data block of the APDU data is 0x00, where the fifth data block of the APDU data is legitimate if the parameter domain length is 0x00; otherwise, the fifth data block of the APDU data is illegitimate. 
         [0246]    In Step  507 , it is determined whether the sixth data block of the APDU data is legitimate, Step  508  is executed if the sixth data block is legitimate; otherwise, data is error and the operation fails. 
         [0247]    In Embodiment 5, the sixth data block specifically includes a selectable token length+a selectable token. 
         [0248]    The process of determining whether the sixth data block of the APDU data is legitimate includes: determining whether the selectable token length in the sixth data block of the APDU data is 0x00, where the sixth data block of the APDU data is legitimate if the selectable token length is 0x00; otherwise, the sixth data block of the APDU data is illegitimate. 
         [0249]    In Step  508 , a state of the application corresponding to the application identification is set to be SELECTABLE. 
         [0250]    In Embodiment 5, Step  508  specifically is setting the state attribute of the application corresponding to the application identification to be 0x07. 
         [0251]    In Step  509 , it is determined whether the application corresponding to the application identification has a default selection right, Step  510  is executed if the application has the default selection right; otherwise, the operation is successful. 
         [0252]    In Step  510 , it is determined whether the card content management module has a default selection right, Step  511  is executed if the card content management module has the default selection right; otherwise, the operation condition is not met and the operation fails. 
         [0253]    In Embodiment 5, it is determined whether the card content management module has a default selection right depending on the right attribute of the card content management module, and the right attribute of the card content management module is 1 byte data, which includes b8 b7 b6 b5 b4 b3 b2 b1 from a high bit to a low bit. 
         [0254]    The process of determining whether the card content management module has a default selection right includes: determining whether b3 of the right attribute of the card content management module is 1, where the card content management module has the default selection right if b3 is 1; otherwise, the card content management module has no default selection right. 
         [0255]    In Step  511 , the default application is set to be an application corresponding to the application identification, and the operation is successful. 
       Embodiment 6 
       [0256]    A specific method for updating association security domain of an application in the method for managing applications on the card according to Embodiment 1 is provided according to Embodiment 6 of the present disclosure. The data domain of the APDU data can be considered to be made up of multiple data blocks; each data block is in a LV structure, i.e. a data length+a data; as shown in  FIG. 6 , the method includes Step  601  to Step  614 . 
         [0257]    In Step  601 , it is determined whether a first data block of the APDU data is legitimate, Step  602  is executed if the first data block of the APDU data is legitimate; otherwise, data is error and the operation fails. 
         [0258]    In Embodiment 6, the first data block specifically includes a security domain identification length+a security domain identification. 
         [0259]    The process of determining whether the first data block of the APDU data is legitimate includes: determining whether the security domain identification length in the first data block of the APDU data is in a preset range, where the first data block of the APDU data is legitimate if the security domain length in the first data block of the APDU data is in the preset range; otherwise, the first data block of the APDU data is illegitimate. 
         [0260]    The preset range is from 0x05 to 0x10. 
         [0261]    In Step  602 , it is checked whether an application corresponding to the security domain identification exists in the card, Step  603  is executed if the application corresponding to the security domain identification exists in the card; otherwise, the operation condition is not met and the operation fails. 
         [0262]    In Step  603 , it is determined whether the application corresponding to the security domain identification is the card content management module, the operation condition is not met and the operation fails if the application corresponding to the security domain identification is the card content management module; otherwise, Step  604  is executed. 
         [0263]    In Step  604 , it is determined whether a second data block of the APDU data is legitimate, Step  605  is executed if the second data block of the APDU data is legitimate; otherwise, data is error and the operation fails. 
         [0264]    In Embodiment 6, the process of determining whether the second data block of the APDU data is legitimate includes: determining whether the second data block of the APDU data is 0x00, where the second data block of the APDU data is legitimate if the second data block of the APDU data is 0x00; otherwise, the second data block of the APDU data is illegitimate. 
         [0265]    In Step  605 , it is determined whether a state of the application corresponding to the security domain identification is INSTALLED, Step  606  is executed if the state of the application corresponding to the security domain is INSTALLED, otherwise, the operation condition is not met and the operation fails. 
         [0266]    In Step  606 , it is determined whether the third data block of the APDU data is legitimate, Step  607  is executed if the third data block of the APDU data is legitimate; otherwise, data is error and the operation fails. 
         [0267]    In Embodiment 6, the third data block specifically includes an application identification length+an application identification. 
         [0268]    The process of determining whether the third data block of the APDU data is legitimate includes: determining whether the application identification length of the third data block of the APDU data is in a preset range, where the third data block of the APDU data is legitimate if the application identification length of the third data block of the APDU data is in the preset range; otherwise, the third data block of the APDU data is illegitimate. 
         [0269]    The preset range is from 0x05 to 0x10. 
         [0270]    In Step  607 , it is checked whether an application corresponding to the application identification exists in the card, Step  608  is executed if the application corresponding to the application identification exists in the card; otherwise, data is error and the operation fails. 
         [0271]    In Step  608 , it is determined whether the application corresponding to the security domain identification has a security domain right, Step  609  is executed if the application corresponding to the security domain identification has the security domain right; otherwise, the operation condition is not met and the operation fails. 
         [0272]    In Embodiment 6, Step  608  specifically includes: determining whether the most significant bit of the right attribute of the application corresponding to the security domain identification is 1, where the application corresponding to the security domain identification has the security domain right if the most significant bit of the right attribute of the application corresponding to the security domain identification is 1; otherwise, the application corresponding to the security domain identification has no security domain right. 
         [0273]    In Step  609 , it is determined whether a state of the application corresponding to the security domain identification is LOCKED (locked), the operation condition is not met and the operation fails if the state of the application corresponding to the security domain identification is LOCKED; otherwise, Step  610  is executed. 
         [0274]    In Step  610 , it is determined whether a state of the application corresponding to the security domain identification is PERSONALIZED (personalized), Step  611  is executed if the state of the application corresponding to the security domain identification is PERSONALIZED; otherwise, the operation condition is not met and the operation fails. 
         [0275]    In Step  611 , it is determined whether both a fourth data block and a fifth data block of the APDU data is legitimate, Step  612  is executed if both the fourth data block and the fifth data block of the APDU data is legitimate; otherwise, data is error and the operation fails. 
         [0276]    In Embodiment 6, the process of determining whether the fourth data block of the APDU data is legitimate includes: determining whether the fourth data block of the APDU data is 0x00, where the fourth data block of the APDU data is legitimate if the fourth data block of the APDU data is 0x00; otherwise, the fourth data block of the APDU data is illegitimate. 
         [0277]    The process of determining whether the fifth data block of the APDU data is legitimate includes: determining whether the fifth data block of the APDU data is 0x00, where the fifth data block of the APDU data is legitimate if the fifth data block of the APDU data is 0x00; otherwise, the fifth data block of the APDU data is illegitimate. 
         [0278]    In Step  612 , it is determined whether a sixth data block of the APDU data is legitimate, Step  613  is executed if the sixth data block of the APDU data is legitimate; otherwise, data is error and the operation fails. 
         [0279]    In Embodiment 6, the sixth data block specifically includes an extradition Token length+an extradition Token. 
         [0280]    The process of determining whether the sixth data block of the APDU data is legitimate includes: determining whether the extradition token length of the sixth data block of the APDU data is 0x00, where the sixth data block of the APDU data is legitimate if the extradition token length of the sixth data block of the APDU data is 0x00; otherwise, the sixth data block of the APDU data is illegitimate. 
         [0281]    In Step  613 , it is determined whether the application corresponding to the application identification has a security domain right, the operation condition is not met and the operation fails if the application corresponding to the application identification has the security domain right; otherwise, Step  614  is executed. 
         [0282]    In Embodiment 6, Step  613  specifically includes: determining whether the most significant bit of the right attribute of the application corresponding to the application identification is 1, where the application corresponding to the application identification has the security domain right if the most significant bit of right attribute of the application corresponding to the application identification is 1; otherwise, the application corresponding to the application identification has no security domain right. 
         [0283]    In Step  614 , the association security domain of the application corresponding to the application identification is set to be the application corresponding to the security domain identification; and the operation is successful. 
       Embodiment 7 
       [0284]    A specific method for personalizing an application in the method for managing applications on the card according to Embodiment 1 is provided according to Embodiment 7 of the present disclosure; the data domain part of the APDU data in the present embodiment can be considered to be made up of multiple data blocks; each data block is in a LV structure, i.e. a data length+a data; as shown in  FIG. 7 , the method includes Step  701  to Step  706 . 
         [0285]    In Step  701 , it is determined whether both a first data block and a second data block of the APDU data are legitimate, Step  702  is executed if both the first data block and the second data block of the APDU data are legitimate; otherwise, data is error and the operation fails. 
         [0286]    In Embodiment 7, the process of determining whether the first data block of the APDU data is legitimate includes: determining whether the first data block of the APDU data is 0x00, where the first data block of the APDU data is legitimate if the first data block of the APDU data is 0x00; otherwise, the first data block of the APDU data is illegitimate. 
         [0287]    The process of determining whether the second data block of the APDU data is legitimate includes: determining whether the second data block of the APDU data is 0x00, where the second data block of the APDU data is legitimate if the second data block of the APDU data is 0x00; otherwise, the second data block of the APDU data is illegitimate. 
         [0288]    In Step  702 , it is determined whether the third data block of the APDU data is legitimate, Step  703  is executed if the third data block of the APDU data is legitimate; otherwise, data is error and the operation fails. 
         [0289]    In Embodiment 7, the third data block specifically includes an application identification length+an application identification. 
         [0290]    The process of determining whether the third data block of the APDU data is legitimate includes: determining whether the application identification length of the third data block of the APDU data is in a preset range, where the third data block of the APDU data is legitimate if the application identification length of the third data block of the APDU data is in the preset range; otherwise, the third data block of the APDU data is illegitimate. 
         [0291]    The preset range is from 0x05 to 0x10. 
         [0292]    In Step  703 , it is checked whether an application corresponding to the application identification exists in the card, Step  704  is executed if the application corresponding to the application identification exists in the card; otherwise, the operation condition is not met and the operation fails. 
         [0293]    In Step  704 , it is determined whether the association security domain of the application corresponding to the application identification is the card content management module, Step  705  is executed if the association security domain of the application corresponding to the application identification is the card content management module; otherwise, the operation condition is not met and the operation fails. 
         [0294]    In Step  705 , it is determined whether all of the fourth data block, the fifth data block and the sixth data block of the APDU data are legitimate, Step  706  is executed if all of the fourth data block, the fifth data block and the sixth data block of the APDU data are legitimate; otherwise data is error and the operation fails. 
         [0295]    In Embodiment 7, the process of determining whether the fourth data block of the APDU data is legitimate includes: determining whether the fourth data block of the APDU data is 0x00, where the fourth data block of the APDU data is legitimate if the fourth data block of the APDU data is 0x00; otherwise, the fourth data block of the APDU data is illegitimate. 
         [0296]    The process of determining whether the fifth data block of the APDU data is legitimate includes: determining whether the fifth data block of the APDU data is 0x00, where the fifth data block of the APDU data is legitimate if the fifth data block of the APDU data is 0x00; otherwise, the fifth data block of the APDU data is illegitimate. 
         [0297]    The process of determining whether the sixth data block of the APDU data is legitimate includes: determining whether the sixth data block of the APDU data is 0x00, where the fifth data block of the APDU data is legitimate if the sixth data block of the APDU data is 0x00; otherwise, the sixth data block of the APDU data is illegitimate. 
         [0298]    In Step  706 , a state of the application corresponding to the application identification is set to be PERSONLIZED, and the operation is successful. 
       Embodiment 8 
       [0299]    A specific method for deleting an application and executable load file in the method for managing applications on the card according to Embodiment 1 is provided according to Embodiment 8 of the present disclosure. The data domain part of the APDU data in Embodiment 8 can be considered to be made up of multiple data blocks, each data block is in a LV structure, i.e. a data length+a data; as shown in  FIG. 8 , the method includes Step  801  to Step  811 . 
         [0300]    In Step  801 , it is determined whether a first data block of the APDU data is legitimate, Step  802  is executed if the first data block of the APDU data is legitimate; otherwise, data is error and the operation fails. 
         [0301]    In Embodiment 8, the process of determining whether the first data block of the APDU data is legitimate includes: determining whether the first data block of the APDU data is 0x4f, where the first data block of the APDU data is legitimate if the first data block of the APDU data is 0x4f; otherwise, the first data block of the APDU data is illegitimate. 
         [0302]    In Step  802 , it is determined whether a second data block of the APDU data is legitimate, Step  803  is executed if the second data block of the APDU data is legitimate; otherwise data is error and the operation fails. 
         [0303]    In Embodiment 8, the second data block specifically includes a data domain identification length+a data domain identification. 
         [0304]    The process of determining whether the second data block of the APDU data is legitimate includes: determining whether the data domain identification length of the second data block of the APDU data is in a preset range, where the second data block of the APDU data is legitimate if the data domain identification length of the second data block of the APDU data is in the preset range; otherwise, the second data block of the APDU data is illegitimate. 
         [0305]    The preset range is from 0x05 to 0x10. 
         [0306]    In Step  803 , it is checked whether an application corresponding to the data domain identification exists in the card, Step  804  is executed if the application corresponding to the data domain identification exists in the card; otherwise, Step  805  is executed. 
         [0307]    In Step  804 , it is determined whether a fourth byte of the APDU data equals to a preset value, Step  805  is executed if the fourth byte of the APDU data equals to the preset value; otherwise, Step  809  is executed. 
         [0308]    In Embodiment 8, the preset value is 0x80. 
         [0309]    In Step  805 , it is checked whether an executable load file corresponding to the data domain identification exists in the card, Step  806  is executed if the executable load file corresponding to the data domain identification exists in the card; otherwise, the operation condition is not met and the operation fails. 
         [0310]    In Step  806 , it is determined whether a fourth byte of the APDU data equals to a preset value, Step  807  is executed if the fourth byte of the APDU data equals to the preset value; otherwise, Step  808  is executed. 
         [0311]    In Embodiment 8, the preset value is 0x80. 
         [0312]    In Step  807 , the application corresponding to the data domain identification and the executable load file corresponding to the data domain identification is deleted, and the operation is successful. 
         [0313]    In Step  808 , the executable load file corresponding to the data domain identification is deleted, and the operation is successful. 
         [0314]    In Step  809 , it is checked whether the application corresponding to the data domain identification is another application or an association security domain of another executable load file; the operation condition is not met and the operation fails if the application corresponding to the data domain identification is the another application or the association security domain of the another executable load file; otherwise, Step  810  is executed. 
         [0315]    In Step  810 , it is determined whether the application corresponding to the data domain identification is the card content management module, the operation condition is not met and the operation fails if the application corresponding to the data domain identification is the card content management module; otherwise, Step  811  is executed. 
         [0316]    In Step  811 , the application corresponding to the data domain identification is deleted and the operation is successful. 
       Embodiment 9 
       [0317]    It should be noted that, the smart card is called “card” briefly in Embodiment 9. 
         [0318]    A method for implementing card data management is provided according to Embodiment 9 of the present disclosure. As shown in  FIG. 9 , the method includes: executing the following Steps in a case that a first card data management module itself acts as the current first card data management module after APDU (Application Protocol Data Unit) data sent by a RE is received by the first card data management module. 
         [0319]    In Step  901 , INS (instruction code) of the APDU data is checked, Step  1101 -Step  1129  are executed if the INS of the APDU data is 0xE8; Step  902  is executed if the INS of the APDU data is 0xE6; Step  1601  to Step  1625  are executed if the INS of the APDU data is 0xE4; if the INS of the APDU data is other effective value, the APDU data is another effective command of non-content management; a respective operation is performed based on the APDU data; otherwise, the APDU data is an ineffective command and a respective state code is generated and returned. 
         [0320]    Specifically, the other effective value includes: 0xA4, 0x78, 0x7A, 0x82, 0x50, 0xE2, 0xFO, 0xD8, 0xF2 and 0xCA. 
         [0321]    In Step  902 , P1 (a first parameter) of the APDU data is checked, Step  1001  to Step  1028  are executed if P1 is 0x02; Step  1201  to Step  1125  are executed if P1 is 0x04 or 0x0C; Step  1301  to Step  1324  are executed if P1 is 0x08, Step  1401  to Step  1428  are executed if P1 is 0x10; Step  1501  to Step  1517  are executed if P1 is 0x20; otherwise, the APDU data is an ineffective command and a respective state code is generated and returned. 
         [0322]    In the present disclosure, the first card data management module is a special application in the card, which is a proxy of an application provider on the card. 
         [0323]    Preferably, as shown in  FIG. 10 , Step  1001  to Step  1028  are described as follows: 
         [0324]    In Step  1001 , it is determined whether the APDU data is a command head of a legitimate pre-load command, Step  1002  is executed if the APDU data is the command head of the legitimate pre-load command; otherwise, Step  1027  is executed. 
         [0325]    Specifically, in a case that the CLA (instruction type) of the APDU data is 0x80 or 0x84, P2 (a second parameter) is 0x00 and Lc (data domain length) is no less than 0x0A, the APDU data is the command head of the legitimate pre-load command. 
         [0326]    In Step  1002 , it is determined whether the current state of the card is TERMINATED or CARD_LOCKED, Step  1027  is executed if the current state of the card is TERMINATED or CARD_LOCKED; otherwise, Step  1003  is executed. 
         [0327]    Specifically, the state of the card is determined based on the state attribute of the card, the state attribute of the card is one byte data, which includes b8 b7 b6 b5 b4 b3 b2 b1 in an order from high bit to low bit, the state of the card includes OP_READY, INITIALIZED, SECURED, CARD_LOCKED and TERMINATED as shown in the following table: 
         [0000]    
       
         
               
               
               
               
               
               
               
               
               
             
           
               
                   
               
               
                 b8 
                 b7 
                 b6 
                 b5 
                 b4 
                 b3 
                 b2 
                 b1 
                 Meaning 
               
               
                   
               
             
             
               
                 0 
                 0 
                 0 
                 0 
                 0 
                 0 
                 0 
                 1 
                 OP_READY 
               
               
                 0 
                 0 
                 0 
                 0 
                 0 
                 1 
                 1 
                 1 
                 INITIALIZED 
               
               
                 0 
                 0 
                 0 
                 0 
                 1 
                 1 
                 1 
                 1 
                 SECURED 
               
               
                 0 
                 1 
                 1 
                 1 
                 1 
                 1 
                 1 
                 1 
                 CARD_LOCKED 
               
               
                 1 
                 1 
                 1 
                 1 
                 1 
                 1 
                 1 
                 1 
                 TERMINATED 
               
               
                   
               
             
          
         
       
     
         [0328]    Further, the position of Step  1001  and Step  1002  can be exchanged as follows: firstly, determining the current state of the card is TERMINATED or CARD_LOCKED, executing Step  1027  if the current state of the card is TERMINATED or CARD_LOCKED; otherwise, determining whether the APDU data is the command head of the legitimate pre-load command, executing Step  1003  if the APDU data is the command head of the legitimate pre-load command; otherwise, executing Step  1027 . 
         [0329]    In Step  1003 , the data domain part of the pre-load command is received to obtain the complete pre-load command. 
         [0330]    In Step  1004 , it is determined whether the state of the current first card data management module is PERSONALIZED, Step  1005  is executed if the current first card data management module is PERSONALIZED; otherwise, Step  1027  is executed. 
         [0331]    Specifically, the first card data management module determines the state of the current first card data management module based on the current state attribute of the first card data management module, the state attribute of the first card data management module is one byte data, which includes b8 b7 b6 b5 b4 b3 b2 b1 in an order from high bit to low bit, and the state of the first card data management module includes INSTALLED, SELECTABLE, PERSONALIZED and LOCKED, as shown in the following table: 
         [0000]    
       
         
               
               
               
               
               
               
               
               
               
             
           
               
                   
               
               
                 b8 
                 b7 
                 b6 
                 b5 
                 b4 
                 b3 
                 b2 
                 b1 
                 Meaning 
               
               
                   
               
             
             
               
                 0 
                 0 
                 0 
                 0 
                 0 
                 0 
                 1 
                 1 
                 INSTALLED 
               
               
                 0 
                 0 
                 0 
                 0 
                 0 
                 1 
                 1 
                 1 
                 SELECTABLE 
               
               
                 0 
                 0 
                 0 
                 0 
                 1 
                 1 
                 1 
                 1 
                 PERSONALIZED 
               
               
                 1 
                 0 
                 0 
                 0 
                 X 
                 X 
                 1 
                 1 
                 LOCKED 
               
               
                   
               
             
          
         
       
     
         [0332]    In Step  1005 , it is determined whether the current first data management module has a proxy right, Step  1006  is executed if the current first data management module has the proxy right; otherwise, Step  1027  is executed. 
         [0333]    Specifically, the first card data management module determines whether the current first card data management module has the proxy right based on the right attribute of the current first card data management module, and the right attribute of the first card data management module is one byte data, which includes b8 b7 b6 b5 b4 b3 b2 b1 in an order from high bit to low bit. In a case that both of b8 and b6 are 1, the first card data management module has the proxy right, 
         [0334]    In Step  1006 , it is determined whether the card meets a security condition, Step  1007  is executed if the card meets security condition; otherwise, Step  1027  is executed. 
         [0335]    Specifically, the first card data management module determines whether the card meets the security condition by checking the security flag of the card; the card meets the security condition if the security flag is set; the card does not meet the security condition if the security identification is not set; in a case that a legitimate command in which the value of the INS byte is 0x50 and a legitimate command in which the value of the INS byte is 0x82 are executed correctly by the card, the security flag is set. 
         [0336]    In Step  1007 , the security level of the card is checked, Step  1010  is executed if the security level of the card is at a first level; Step  1008  is executed if the security level of the card is at a second level; or Step  1009  is executed if the security level of the card is at a third level. 
         [0337]    Specifically, the security level of the card is determined based on the legitimate command which is that the value of the INS byte is 0x50 and a legitimate command which is that the value of the INS byte is 0x82 described above. 
         [0338]    Specifically, if the security level of the card is at the first level, the pre-load command is message plain data; if the security level of the card is at the second level, the pre-load command is combination of message plain data and message authentication code (MAC); if the security level of the card is at the third level, the pre-load command is combination of message cipher data and message authentication code. 
         [0339]    In Step  1008 , it is determined whether the pre-load command is complete based on the message plain text and MAC in the pre-load command, Step  1010  is executed if the pre-load command is complete; otherwise, Step  1027  is executed. 
         [0340]    In this case, the process of determining whether the pre-load command is complete based on the message plain text and MAC in the pre-load command includes: decrypting the MAC using a preset session key to obtain a decrypting result, and computing the message plain data according to a preset hash function to obtain a computing result at the same time; determining whether the decrypting result is identical to the computing result, where the pre-load command is complete if the decrypting result is identical to the computing result; otherwise, the pre-load command is not complete. 
         [0341]    In Step  1009 , it is determined whether the pre-load command is complete based on the message cipher data and MAC in the pre-load command, Step  1010  is executed if the pre-load command is complete; otherwise, Step  1027  is executed. 
         [0342]    In this case, the process of determining whether the pre-load command is complete based on the message cipher data and MAC in the pre-load command includes: decrypting the message cipher data to obtain message plain data, decrypting MAC using the preset session key to obtain a decrypting result, and computing the message plain data according to the preset hash function to obtain a computing result at the same time; determining whether the decrypting result is identical to the computing result, where the pre-load command is complete if the decrypting result is identical to the computing result; otherwise, the pre-load command is not complete. 
         [0343]    In Step  1010 , it is determined whether the load file identification length in the pre-load command is in the preset range, Step  1011  is executed if the load file identification length in the pre-load command is in the preset range; otherwise, Step  1027  is executed. 
         [0344]    Specifically, the preset range is from 0x05 to 0x10. 
         [0345]    In Step  1011 , it is determined whether the load file identification in the pre-load command is legitimate, Step  1012  is executed if the load file identification in the pre-load command is legitimate; otherwise, Step  1027  is executed. 
         [0346]    Specifically, the load file identification is illegitimate if each byte of the load file identification is 0x00; otherwise, the load file identification is legitimate. 
         [0347]    In Step  1012 , it is checked whether a load file corresponding to the load file identification exists in the card, Step  1027  is executed if the load file corresponding to the load file identification exists in the card; otherwise, Step  1013  is executed. 
         [0348]    In Step  1013 , it is determined whether a security domain identification length in the pre-load command is in a preset range, Step  1014  is executed if the security domain identification length in the pre-load command is in the preset range; otherwise, Step  1027  is executed. 
         [0349]    Specifically, the preset range is from 0x05 to 0x10. 
         [0350]    In Step  1014 , it is determined whether the security domain identification in the pre-load command is legitimate, Step  1015  is executed if the security domain identification in the pre-load command is legitimate; otherwise, Step  1027  is executed. 
         [0351]    Specifically, the security domain identification is illegitimate if each byte of the security domain identification is 0x00; otherwise, the security domain identification is legitimate. 
         [0352]    In Step  1015 , it is checked whether an application corresponding to the security domain identification in the pre-load command exists in the card, Step  1016  is executed if the application corresponding to the security domain identification in the pre-load command exists in the card; otherwise, Step  1027  is executed. 
         [0353]    In Step  1016 , it is determined whether the application corresponding to the security domain identification in the pre-load command has a security domain right, Step  1017  is executed if the application corresponding to the security domain identification in the pre-load command has the security domain right; otherwise, Step  1027  is executed. 
         [0354]    Specifically, it is determined whether the application corresponding to the security domain identification in the pre-load command has security domain right based on the right attribute of the application; the right attribute of the application is one byte data, which includes b8 b7 b6 b5 b4 b3 b2 b1 in an order from high bit to low bit; the application has a security domain right in a case that b8 is 1. 
         [0355]    In Step  1017 , it is determined whether the application corresponding to the security domain identification in the pre-load command is the current first card data management module, Step  1019  is executed if the application is the current first card data management module; otherwise, Step  1018  is executed. 
         [0356]    In Step  1018 , it is determined whether the state of the application corresponding to the security domain identification in the pre-load command is PERSONALIZED, Step  1019  is executed if the state is PERSONALIZED; otherwise, Step  1027  is executed. 
         [0357]    In Step  1019 , the association security domain of the load file corresponding to the load file identification in the pre-load command is set to be the application corresponding to the security domain identification in the pre-load command. 
         [0358]    In Step  1020 , it is determined whether the load file data block hash value length in the pre-load command is a preset value, Step  1021  is executed if the load file data block hash value length in the pre-load command is the preset value; otherwise, Step  1027  is executed. 
         [0359]    Preferably, the preset value is 0x14 in Embodiment 9. 
         [0360]    In Step  1021 , the load file data block hash value length in the pre-load command is stored and a hash value authentication flag is set. 
         [0361]    In Step  1022 , a load parameter domain in the pre-load command is processed. 
         [0362]    Specifically, the load parameter domain is TLV structure, which is made up of multiple data in format of tag+length+value; different operations are executed based on different tags, for which no more detail is given here. 
         [0363]    In Step  1023 , it is determined whether the load token length in the pre-load command is 0x80, Step  1024  is executed if the load token length in the pre-load command is 0x80; otherwise, STEP  1027  is executed. 
         [0364]    In Step  1024 , the data required for computing a load token is sent to a second card data management module, a computing result returned by the second card data management module is received, it is determined whether the computing result is identical to the load token in the pre-load command, Step  1025  is executed if the computing result is identical to the load token in the pre-load command; otherwise, Step  1027  is executed. 
         [0365]    In this case, the second card data management module is a special application in the card. 
         [0366]    Specifically, the P1, P2, effective data length, load file identification length, load file identification, security domain identification length, security domain identification, load file data block hash value length, load file data block hash value, load parameter domain length and load parameter domain in the pre-load command are sent to the second card data management module; the process that the card issuer authenticates and loads the token is not described in details herein. 
         [0367]    In Step  1025 , a load file structure is created newly and the global block number is initialized. 
         [0368]    Specifically, the global block number is initialized to be 0; the process of newly creating a load file structure includes: creating an object of an executable load file structure in buffer, setting each attribute value of the object to be a default value, the attribute value of the object includes storage addresses of respective load file data block in the buffer and respective attributes of the executable load file; the attribute of the executable load file includes an association security domain identification of the executable load file, etc. which is not described in details herein. 
         [0369]    In Step  1026 , the returned data is set to be 0x00 and Step  1027  is executed. 
         [0370]    In Step  1027 , a respective state code is generated. 
         [0371]    Specifically, the respective state code includes a state code of identification success and a state code of identification error; in this case, different error types corresponded to different state codes. 
         [0372]    In Step  1028 , the set returned data and/or generated state code is returned. 
         [0373]    Preferably, as shown in  FIG. 11 , Step  1101  to Step  1129  are described as follows. 
         [0374]    In Step  1101 , it is determined whether the APDU data is a legitimate command head of the load command, Step  1102  is executed if APDU data is the legitimate command head of the load command; otherwise, Step  1128  is executed. 
         [0375]    Specifically, in a case that the CLA of APDU data is 0x80 or 0x84, P1 is 0x00 or 0x80 and P2 is between 0x00-0xFF, the APDU data is legitimate. 
         [0376]    In Step  1102 , it is determined whether the current state of the card is TERMINATED or CARD_LOCKED, Step  1128  is executed if the current state of the card is TERMINATED or CARD_LOCKED; otherwise, Step  1103  is executed. 
         [0377]    In Step  1103 , the data domain part of the load command is received to obtain a complete load command. 
         [0378]    In Step  1104 , it is determined whether the state of the current first card data management module is PERSONALIZED, Step  1105  is executed if the state of the current first card data management module is PERSONALIZED; otherwise, Step  1128  is executed. 
         [0379]    In Step  1105 , it is determined whether the current first card data management module has a proxy right, Step  1106  is executed if the current first card data management module has the proxy right; otherwise, Step  1128  is executed. 
         [0380]    In Step  1106 , it is determined whether the card meets a security condition, Step  1107  is executed if the card meets security condition; otherwise, Step  1128  is executed. 
         [0381]    In Step  1107 , the security level of the card is checked, Step  1110  is executed if the security level is at the first level; Step  1108  is executed if the security level is at the second level; or Step  1109  is executed if the security level is at the third level. 
         [0382]    Specifically, if the security level of the card is at the first level, the load command is message plain data; if the security level of the card is at the second level, the load command is combination of message plain data and message authentication code; if the security level of the card is at the third level, the load command is combination of message cipher data and message authentication code. 
         [0383]    In Step  1108 , it is determined whether the load command is complete based on the message plain data and MAC in the load command, Step  1110  is executed if the load command is complete; otherwise, Step  1128  is executed. 
         [0384]    In this case, the process of determining whether the load command is complete based on the message plain data and MAC in the load command includes: decrypting the MAC by using a preset session key to obtain a decrypting result, and computing the message plain data according to a preset hash function to obtain a computing result at the same time; determining whether the decrypting result is identical to the computing result, where the load command is complete if the decrypting result is identical to the computing result; otherwise the load command is not complete. 
         [0385]    In Step  1109 , the is determined whether the load command is complete based on the message cipher data and MAC in the load command, Step  1110  is executed if the load command is complete; otherwise, Step  1128  is executed. 
         [0386]    In this case, the process of determining whether the load command is complete based on the message cipher data and MAC in the load command includes: decrypting the MAC by using a preset session key to obtain a decrypting result, and computing the message plain data according to a preset hash function to obtain a computing result at the same time; determining whether the decrypting result is identical to the computing result, where the load command is complete if the decrypting result is identical to the computing result; otherwise, the load command is not complete. 
         [0387]    In Step  1110 , it is determined whether P2 in the load command equals to the global block number, Step  1111  is executed if P2 in the load command equals to the global block number; otherwise, Step  1128  is executed. 
         [0388]    In Step  1111 , it is determined whether the global block number is 0, Step  1112  is executed if the global block number is 0, otherwise, Step  1113  is executed. 
         [0389]    In Step  1112 , the DAP (Data Authentication Pattern) module information in the load command is verified, Step  1113  is executed if the verifying is successful; Step  1128  is executed if the verifying is unsuccessful. 
         [0390]    Specifically, the load file is separated into multiple load file data blocks outside of the card; each load command contains a load file data block; P2 of command equals to the global block number; in a case that the global block number is 0, the load command further contains DAP block information; the DAP block information contains load file data block signature value; the first card data management module verifies the load file data block signature value of the DAP block information based on the application provider DAP computing key stored by the first card data management module. 
         [0391]    In Step  1113 , it is determined whether a hash value verification flag exists in the card, the load file data block in the load command is stored and Step  1114  is executed if the hash value verification flag exists in the card; otherwise, Step  1114  is executed directly; 
         [0392]    In Step  1114 , it is determined whether a stored component which is not submitted exists in the executable load file structure, Step  1118  is executed if the stored component which is not submitted exists in the executable load file structure; otherwise, Step  1115  is executed. 
         [0393]    Specifically, the loaded load file data block is processed by taking a component as an unit to obtain the executable load file structure, the component includes: a Header component, a Directory component, an Applet component, an Import component, etc. 
         [0394]    In Step  1115 , it is checked whether the load command contains a component number and a component size, Step  1116  is executed if the load command contains the component number and the component size; otherwise, Step  1128  is executed. 
         [0395]    In Step  1116 , the component number is read, it is determined whether the component number is legitimate, Step  1117  is executed if the component number is legitimate; otherwise, Step  1128  is executed. 
         [0396]    Specifically, except for the component number which is read at the first time, if the component number is successive with the component number read last time, the component number is legitimate; otherwise, the component number is illegitimate. 
         [0397]    In Step  1117 , a respective size of space is allocated based on the size of the component. 
         [0398]    In Step  1118 , the load file data block in the load command is started to be processed. 
         [0399]    In Step  1119 , it is determined whether the current component is processed completely, Step  320  is executed if the current component is processed completely; otherwise, Step  1121  is executed. 
         [0400]    Specifically, the process of determining whether the current component is processed completely includes: determining whether the size of the processed data in the current component is identical to the size of the current component. 
         [0401]    In Step  1120 , the process result of the current component is submitted and Step  1121  is executed. 
         [0402]    In Step  1121 , it is determined whether unprocessed load file data block data exists, Step  1115  is executed if the unprocessed load file data block data exists; otherwise, Step  1122  is executed. 
         [0403]    In Step  1122 , self-increment is performed by the global block number, it is determined whether P1 of the load command is 0x80, Step  1123  is executed if P1 of the load command is 0x80; otherwise, Step  1127  is executed. 
         [0404]    Specifically, the global number is increased by 1. 
         [0405]    In Step  1123 , it is determined whether a hash value verification flag exists in the card, Step  1124  is executed if the hash value verification flag exists in the card; otherwise, Step  1125  is executed. 
         [0406]    In Step  1124 , a hash operation is performed on the stored load file data block, it is determined whether an operation result equals to the load file data block hash value, Step  1125  is executed if the operation result equals to the load file data block hash value; otherwise, Step  1128  is executed. 
         [0407]    In Step  1125 , the executable load file structure is submitted. 
         [0408]    In Step  1126 , the data required for computing a receipt is sent to the second card data management module, the receipt returned by the second card data management module is received, the returned data is set as the receipt, and Step  1128  is executed. 
         [0409]    Specifically, the length, load file identification, length of security domain identification, security domain identification in the load file identification corresponding to the load file data block in the load command are sent to the card provider module. 
         [0410]    In Step  1127 , the returned data is set to be 0x00 and Step  1128  is executed. 
         [0411]    In Step  1128 , a respective state code is generated. 
         [0412]    Specifically, the respective state code includes a state code of identification success and a state code of identification error; in this case, different error types correspond to different state codes. 
         [0413]    In Step  1129 , the set returned data and/or generated state code is returned. 
         [0414]    Specifically, referring to  FIG. 12 , Step  1201  to Step  1235  are described as follows. 
         [0415]    In Step  1201 , it is determined whether the APDU data is a legitimate command head of the install command, Step  1202  is executed if the APDU data is the legitimate command head of install command; otherwise, Step  1234  is executed. 
         [0416]    Specifically, in a case that the CLA of the APDU data is 0x80 or 0x84, P2 is 0x00 and Lc is not less than 0x18, the APDU data is the legitimate command head of the install command. 
         [0417]    In Step  1202 , it is determined whether the current state of the card is TERMINATED or CARD_LOCKED, Step  1234  is executed if the current state of the card is TERMINATED or CARD_LOCKED; otherwise, Step  1203  is executed. 
         [0418]    In Step  1203 , the data domain part of the install command is received to obtain a complete install command. 
         [0419]    In Step  1204 , it is determined whether the state of the current first card data management module is PERSONALIED, Step  1205  is executed if the state of the current first card data management module is PERSONALIED; otherwise, Step  1234  is executed. 
         [0420]    In Step  1205 , it is determined whether the current first card data management module has a proxy right, Step  1206  is executed if the current first card data management module has the proxy right; otherwise, Step  1234  is executed. 
         [0421]    In Step  1206 , it is determined whether the card meets a security condition, Step  1207  is executed if the card meets the security condition; otherwise, Step  1234  is executed. 
         [0422]    In Step  1207 , the security level of the card is checked, Step  1210  is executed if the security level of the card is at the first level; Step  1208  is executed if the security level is at the second level; or Step  1209  is executed if the security level is at the third level; 
         [0423]    Specifically, if the security level of the card is at the first level, the install command is message plain data; if the security level of the card is at the second level, the install command is combination of message plain data and message authentication code; if the security level of the card is at the third level, the install command is combination of message cipher data and message authentication code. 
         [0424]    In Step  1208 , it is determined whether the install command is complete based on the message plain data and MAC in the install command, Step  1210  is executed if the install command is complete; otherwise, Step  1234  is executed. 
         [0425]    In this case, the process of determining whether the install command is complete based on the message plain data and MAC in the install command includes: decrypting the MAC by using a preset session key to obtain a decrypting result, and computing the message plain data according to a preset hash function to obtain a computing result at the same time; determining whether the decrypting result is identical to the computing result, where the load command is complete if the decrypting result is identical to the computing result; otherwise the load command is not complete. 
         [0426]    In Step  1209 , it is determined whether the install command is complete based on the message cipher data and MAC in the install command, Step  1210  is executed if the install command is complete; otherwise, Step  1234  is executed. 
         [0427]    In this case, the process of determining whether the install command is complete based on the message cipher data and MAC in the install command includes: decrypting the message cipher data to obtain message plain data, decrypting the MAC by a preset session key to obtain a decrypting result, and computing the message plain data according to a preset hash function to obtain a computing result at the same time; determining whether the decrypting result is identical to the computing result, where the install command is complete if the decrypting result is identical to the computing result; otherwise, the install command is not complete. 
         [0428]    In Step  1210 , it is determined whether the executable load file identification length in the install command is in the preset range, Step  1211  is executed if the executable load file identification length in the install command is in the preset range; otherwise, Step  1234  is executed. 
         [0429]    Specifically, the preset range is from 0x05 to 0x10. 
         [0430]    In Step  1211 , it is determined whether the executable load file corresponding to the executable load file identification in the install command exists in the card, Step  1212  is executed if the executable load file corresponding to the executable load file identification in the install command exists in the card; otherwise, Step  1234  is executed. 
         [0431]    In Step  1212 , it is determined whether the security domain associated with the executable load file corresponding to the executable load file identification in the install command is the current first card data management module, Step  1213  is executed if the security domain of the executable load file corresponding to the executable load file identification in the install command is the current first card data management module; otherwise, Step  1234  is executed. 
         [0432]    In Step  1213 , it is determined whether the executable module identification length in the install command is in a preset range, Step  1214  is executed if the executable module identification length in the install command is in the preset range, otherwise, Step  1234  is executed. 
         [0433]    Specifically, the preset range is from 0x05 to 0x10. 
         [0434]    In Step  1214 , it is determined whether an executable module corresponding to the executable module identification in the install command exists in the card, Step  1215  is executed if the executable module corresponding to the executable module identification in the install command exists in the card; otherwise, Step  1234  is executed 
         [0435]    In Step  1215 , it is determined whether the application identification length in the install command is in a preset range, Step  1216  is executed if the application identification length in the install command is in the preset range; otherwise, Step  1234  is executed 
         [0436]    Specifically, the preset range is from 0x05 to 0x10. 
         [0437]    In Step  1216 , it is determined whether the application identification in the install command is legitimate, Step  1217  is executed if the application identification in the install command is legitimate; otherwise, Step  1234  is executed. 
         [0438]    Specifically, when each byte of the application identification is 0x00, the application identification is not legitimate; otherwise, the application identification is legitimate; 
         [0439]    In Step  1217 , it is determined whether the application corresponding to the application identification in the install command exists in the card, Step  1234  is executed if the application corresponding to the application identification in the install command exists in the card; otherwise, Step  1218  is executed. 
         [0440]    In Step  1218 , it is determined whether the application right length in the install command is 0x01, Step  1219  is executed if the application right length in the install command is 0x01; otherwise, Step  1234  is executed. 
         [0441]    In Step  1219 , it is determined whether the application right in the install command is 0x04, Step  1220  is executed if the application right in the install command is 0x04, otherwise, Step  1222  is executed. 
         [0442]    In Step  1220 , it is determined whether P1 of the install command is 0x04, Step  1234  is executed if P1 of the install command is 0x04; otherwise, Step  1221  is executed. 
         [0443]    In Step  1221 , it is determined whether the second card data management module has a default selection right, Step  1222  is executed if the second card data management module has the default selection right; otherwise, Step  1234  is executed. 
         [0444]    Specifically, it is determined whether the second card data management module has the default selection right based on the right attribute of the second card data module management module; the right attribute of the second card data management module is one byte data, which includes b8 b7 b6 b5 b4 b3 b2 b1 in an order from high bit to low bit; in a case that b3 is 1, the second card data management module has the default selection right. 
         [0445]    In Step  1222 , it is determined whether all of the first bit, the sixth bit and the seventh bit from the low bit of the application right of the install command are 0, Step  1223  is executed if all of the first bit, the sixth bit and the seventh bit from the low bit of the application right of the install command are 0; otherwise, Step  1224  is executed. 
         [0446]    In Step  1223 , it is determined whether the most significant bit of the application right of the install command is 1, Step  1224  is executed if the most significant bit of the application right of the install command is 1; otherwise, Step  1234  is executed. 
         [0447]    In Step  1224 , the install parameter domain in the install command is processed 
         [0448]    In Step  1225 , it is determined whether the install token length in the install command is 0x80; Step  1226  is executed if the install token length in the install command is 0x80; otherwise, Step  1234  is executed. 
         [0449]    In Step  1226 , the data required for computing installing token is sent to the second card data management module, the computing result returned by the second card data management module is received, it is determined whether the computing result is identical to the installing token in the install command, Step  1227  is executed if the computing result is identical to the installing token in the install command; otherwise, Step  1234  is executed. 
         [0450]    Specifically, the P1, P2, effective data length, executable load file identification length, executable load file identification, executable module identification length, executable module identification, application identification length, application identification, application right length, application right, install parameter domain length and install parameter domain in the install command are sent to the second card data management module. 
         [0451]    In Step  1227 , an application is registered based on the data in the data domain of the install command. 
         [0452]    In Step  1228 , it is determined whether P1 in the install command is 0x04; Step  1232  is executed if P1 in the install command is 0x04; otherwise, Step  1229  is executed. 
         [0453]    In Step  1229 , the state of the application corresponding to the application identification in the install command is set to be SELECTABLE. 
         [0454]    Specifically, Step  1229  includes setting the value of the state attribute of the application corresponding to the application identification in the install command to be 0x07. 
         [0455]    In Step  1230 , it is determined whether the application right in the install command is 0x04, Step  1231  is executed if the application right in the install command is 0x04; otherwise, Step  1233  is executed. 
         [0456]    In Step  1231 , the application corresponding to the application identification in the install command is set to be a default application, and Step  1233  is executed. 
         [0457]    In Step  1232 , the state of the application corresponding to the application identification in the install command is set to be INSTALLED, and Step  1233  is executed. 
         [0458]    Specifically, Step  1232  includes setting the value of the state attribute of the application corresponding to the application identification in the obtained command to be 0x03. 
         [0459]    In Step  1233 , the data required for computing receipt is sent to the second card data management module, the receipt returned by the second card data management module is received, the returned data is set as the receipt, and Step  1234  is executed. 
         [0460]    Specifically, the executable load file identification length, the executable load file identification, the application identification length and the application identification in the install command are sent to the second card data management module. 
         [0461]    In Step  1234 , a respective state code is generated. 
         [0462]    Specifically, the respective state code includes a state code of identification success and a state code of identification error; different types of error correspond to different state codes. 
         [0463]    In Step  1235 , the set returned data and/or generated state code is returned. 
         [0464]    Preferably, as shown in  FIG. 13 , Step  1301  to Step  1324  are described as follows. 
         [0465]    In Step  1301 , it is determined whether the APDU data is a legitimate command head of the selectable command, Step  1302  is executed if the APDU data is the legitimate command head of the selectable command; otherwise, Step  1323  is executed. 
         [0466]    Specifically, in a case that the CLA of the APDU data is 0x80 or 0x84, P2 is 0x00 and Lc is no less than 0x0C, the APDU data is the legitimate command head of the selectable command. 
         [0467]    In Step  1302 , it is determined whether the current state of the card is TERMANATED or CARD_LOCKED, Step  1323  is executed if the current state of the card is TERMANATED or CARD_LOCKED; otherwise, Step  1303  is executed. 
         [0468]    In Step  1303 , a data domain part of the selectable command is received to obtain a complete selectable command. 
         [0469]    In Step  1304 , it is determined whether the current first card data management module is PERSONALIZED, Step  1305  is executed if the current first card data management module is PERSONALIZED; otherwise, Step  1323  is executed. 
         [0470]    In Step  1305 , it is determined whether the current first card data management module has a proxy right, Step  1306  is executed if the current first card data management module has the proxy right; otherwise, Step  1323  is executed. 
         [0471]    In Step  1306 , it is determined whether the card meets a security condition, Step  1307  is executed if the card meets the security condition; otherwise, Step  1323  is executed. 
         [0472]    In Step  1307 , the security level of the card is checked, Step  1310  is executed if the security level is at the first level; Step  1308  is executed if the security level is at the second level; or Step  1309  is executed if the security level is at the third level. 
         [0473]    Specifically, if the security level of the card is at the first level, the selectable command is message plain data; if the security level of the card is at the second level, the selectable command is combination of message plain data and message authentication code; if the security level of the card is at the third level, the selectable command is combination of message cipher data and message authentication code. 
         [0474]    In Step  1308 , it is determined whether the selectable command is complete based on the message plain data and MAC in the selectable command, Step  1310  is executed if the selectable command is complete; otherwise, Step  1323  is executed. 
         [0475]    The process of determining whether the selectable command is complete based on the message plain data and MAC in the selectable command includes: decrypting the MAC by using a preset session key to obtain a decrypting result, computing the message plain data to obtain a computing result by using a preset hash function at the same time and determining whether the decrypting result is identical to the computing result, where the selectable command is complete if the decrypting result is identical to the computing result; otherwise, the selectable command is not complete. 
         [0476]    In Step  1309 , it is determined whether the selectable command is complete based on the message cipher data and MAC in the selectable command, Step  1310  is executed if the selectable command is complete; otherwise, Step  1323  is executed. 
         [0477]    The process of determining whether the selectable command is complete based on the message cipher data and MAC in the selectable command includes: decrypting the message cipher data to obtain message plain data, decrypting the MAC by using a preset session key to obtain a decrypting result, computing the message plain data to obtain a computing result by using a preset hash function at the same time and determining whether the decrypting result is identical to the computing result, where the selectable command is complete if the decrypting result is identical to the computing result; otherwise, the selectable command is not complete. 
         [0478]    In Step  1310 , it is determined whether the first two byte data in the data domain of the selectable command are 0, Step  1311  is executed if both the first two byte data are 0x00; otherwise, Step  1323  is executed. 
         [0479]    In Step  1311 , it is determined whether the application identification length in the selectable command is in a preset range, Step  1312  is executed if the application identification length in the selectable command is in the preset range; otherwise, Step  1323  is executed. 
         [0480]    Specifically, the preset range is from 0x05 to 0x10. 
         [0481]    In Step  1312 , it is determined whether an application corresponding to the application identification in the selectable command exists in the card, Step  1313  is executed if the application corresponding to the application identification in the selectable command exists in the card; otherwise, Step  1323  is executed. 
         [0482]    In Step  1313 , it is determined whether the state of the application corresponding to the application identification in the selectable command is INSTALLED, Step  1314  is executed if the state of the application corresponding to the application identification in the selectable command is INSTALLED; otherwise, Step  1323  is executed. 
         [0483]    In Step  1314 , it is determined whether the application right length in the selectable command is 0x00, Step  1315  is executed if the application right length in the selectable command is 0x00; otherwise, Step  1323  is executed. 
         [0484]    In Step  1315 , it is determined whether the byte data behind the application right in the selectable command is 0x00, Step  1316  is executed if the byte data behind the application right in the selectable command is 0x00; otherwise, Step  1323  is executed. 
         [0485]    In Step  1316 , it is determined whether the install token length in the selectable command is 0x80, Step  1317  is executed if the install token length in the selectable command is 0x80; otherwise, Step  1323  is executed. 
         [0486]    In Step  1317 , the data required for computing the install token is sent to the second card data management module, the computing result returned by the second card data management module is received, it is determined whether the computing result is identical to the install token in the selectable command, Step  1318  is executed if the computing result is identical to the install token in the selectable command; otherwise, Step  1323  is executed. 
         [0487]    Specifically, the P1, P2, effective data length, executable load file identification length, 0x00, 0x00, application identification length, application identification, application right length, application right and 0x00 in the selectable command are sent to the second card data management module. 
         [0488]    In Step  1318 , the state of the application corresponding to the application identification in the selectable command is set to be SELECTABLE. 
         [0489]    Specifically, Step  1318  includes setting the value of the state attribute of the application corresponding to the application identification in the selectable command to be 0x07. 
         [0490]    In Step  1319 , it is determined whether P1 in the selectable command is 0x04, Step  1320  is executed if P1 is 0x04; otherwise, Step  1322  is executed. 
         [0491]    In Step  1320 , it is determined whether the second card data management module has a default selection right, Step  1321  is executed if the second card data management module has the default selection right; otherwise, Step  1323  is executed. 
         [0492]    In Step  1321 , the application corresponding to the application identification in the selectable command is set to be a default application and Step  1322  is executed. 
         [0493]    In Step  1322 , the returned data is set to be 0x00 and Step  1323  is executed. 
         [0494]    In Step  1323 , a respective state code is generated. 
         [0495]    Specifically, the respective state code includes a state code of identification success and a state code of identification error; in this case, different error types correspond to different state codes. 
         [0496]    In Step  1324 , the set returned data and/or generated state code is returned. 
         [0497]    Preferably, as shown in  FIG. 4 , Step  1401  to Step  1428  are described as follows. 
         [0498]    In Step  1401 , it is determined whether the APDU data is a legitimate command head of the extradition command, Step  1402  is executed if the APDU data is the legitimate command head of extradition command; otherwise, Step  1427  is executed. 
         [0499]    Specifically, in a case that a CLA of the APDU data is 0x80 or 0x84, P2 is 0x00 and Lc is no less than 0x10, the APDU data is the legitimate command head of the extradition command. 
         [0500]    In Step  1402 , it is determined whether the current state of the card is TERMANATED or CARD_LOCKED, Step  1427  is executed if the current state of the card is TERMANATED or CARD_LOCKED; otherwise, Step  1403  is executed. 
         [0501]    In Step  1403 , the data domain part of the extradition command is received to obtain a complete extradition command. 
         [0502]    In Step  1404 , it is determined whether the state of the current first card data management module is PERSONALIZED, Step  1405  is executed if the state of the current first card data management module is PERSONALIZED; otherwise, Step  1427  is executed. 
         [0503]    In Step  1405 , it is determined whether the current first card data management module has a proxy right, Step  1406  is executed if the current first card data management module has the proxy right; otherwise, Step  1427  is executed. 
         [0504]    In Step  1406 , it is determined whether the card meets a security condition, Step  1407  is executed if the card meets the security condition; otherwise, Step  1427  is executed. 
         [0505]    In Step  1407 , the security level of the card is checked, Step  1410  is executed if the security level is at the first level; Step  1408  is executed if the security level is at the second level; or Step  1409  is executed if the security level is at the third level. 
         [0506]    Specifically, if the security level of the card is at the first level, the extradition command is message plain data; if the security level of the card is at the second level, the extradition command is combination of message plain data and message authentication code; if the security level of the card is at the third level, the extradition command is combination of message cipher data and message authentication code. 
         [0507]    In Step  1408 , it is determined whether the extradition command is complete based on the message plain data and MAC in the extradition command, Step  1410  is executed if the extradition command is complete; otherwise, Step  1427  is executed. 
         [0508]    The process of determining whether the extradition command is complete based on the message plain data and MAC in the extradition command includes: decrypting the MAC by using a preset session key to obtain a decrypting result, and computing the message plain data according to a preset hash function to obtain a computing result at the same time; determining whether the decrypting result is identical to the computing result, where the extradition command is complete if the decrypting result is identical to the computing result; otherwise the extradition command is not complete. 
         [0509]    In Step  1409 , it is determined whether the extradition command is complete based on the message cipher data and MAC in the extradition command; Step  1410  is executed if the extradition command is complete; otherwise, Step  1427  is executed. 
         [0510]    In this case, the process of determining whether the extradition command is complete based on the message cipher data and MAC in the selectable command includes: decrypting the message cipher data to obtain message plain data, decrypting the MAC by using a preset session key to obtain a decrypting result, computing the message plain data to obtain a computing result by using a preset hash function at the same time and determining whether the decrypting result is identical to the computing result, where the extradition command is complete if the decrypting result is identical to the computing result; otherwise, the extradition command is not complete. 
         [0511]    In Step  1410 , it is determined whether the security domain identification length in the extradition command is in a preset range, Step  1411  is executed if the security domain identification length in the extradition command is in the preset range, otherwise, Step  1427  is executed. 
         [0512]    Specifically, the preset range is from 0x05 to 0x10. 
         [0513]    In Step  1411 , it is determined whether the application corresponding to the security domain identification in the extradition command exists in the card, Step  1412  is executed if the application corresponding to the security domain identification in the extradition command exists in the card; otherwise, Step  1427  is executed. 
         [0514]    In Step  1412 , it is determined the application corresponding to the security domain identification in the extradition command is current card provider module, Step  1427  is executed if the application corresponding to the security domain identification in the extradition command is current card provider module; otherwise, Step  1413  is executed. 
         [0515]    In Step  1413 , it is determined whether one byte data behind the security domain identification in the extradition command is 0x00, Step  1414  is executed if the one byte data behind the security domain identification in the extradition command is 0x00; otherwise, Step  1427  is executed. 
         [0516]    In Step  1414 , it is determined whether the state of the application corresponding to the security domain identification in the extradition command is INSTALLED; Step  1415  is executed if the state of the application corresponding to the security domain identification in the extradition command is INSTALLED; otherwise, Step  1427  is executed. 
         [0517]    In Step  1415 , it is determined whether the application identification length in the extradition command is in a preset range, Step  1416  is executed if the application identification length in the extradition command is in the preset range, otherwise, Step  1427  is executed. 
         [0518]    Specifically, the preset range is from 0x05 to 0x10. 
         [0519]    In Step  1416 , it is determined whether the application corresponding to the application identification in the extradition command exists in the card, Step  1417  is executed if the application corresponding to the application identification in the extradition command exists in the card; otherwise, Step  1427  is executed. 
         [0520]    In Step  1417 , it is determined whether the security domain associated with the application corresponding to the application identification in the extradition command is the current first card data management module, Step  1418  is executed if the security domain is the current card data management module; otherwise, Step  1427  is executed. 
         [0521]    In Step  1418 , it is determined whether the application corresponding to the security domain identification in the extradition command has a security domain right, Step  1419  is executed if the application corresponding to the security domain identification in the extradition command has the security domain right; otherwise, Step  1427  is executed. 
         [0522]    In Step  1419 , it is determined whether the state of the application corresponding to the security domain identification in the extradition command is LOCKED, Step  1427  is executed if the state of the application is LOCKED; otherwise, Step  1420  is executed. 
         [0523]    In Step  1420 , it is determined whether the state of the application corresponding to the security domain identification in the extradition command is PERSONALIZED, Step  1421  is executed if the state of the application is PERSONALIZED; otherwise, Step  1427  is executed. 
         [0524]    In Step  1421 , it is determined whether two byte data behind the application identification in the extradition command are 0x00, Step  1422  is executed if two byte data behind the application identification in the extradition command are 0x00; otherwise, Step  1427  is executed. 
         [0525]    In Step  1422 , it is determined whether the extradition token length in the extradition command is 0x80, Step  1423  is executed if the extradition token length in the extradition command is 0x80; otherwise, Step  1427  is executed. 
         [0526]    In Step  1423 , the data required for computing an extradition token is sent to the second card data management module, a computing result returned by the second card data management module is received, it is determined whether the computing result is identical to the extradition token in the extradition command, Step  1424  is executed if the computing result is identical to the extradition token in the extradition command; otherwise, Step  1427  is executed. 
         [0527]    Specifically, the P1, P2, effective data length, effective data length, security domain identification length, security domain identification, 0x00, application identification length, 0x00 and 0x00 in the extradition command are sent to the second card data management module. 
         [0528]    In Step  1424 , it is determined whether the application corresponding to the application identification in the extradition command has a security domain right, Step  1427  is executed if the application corresponding to the application identification in the extradition command has the security domain right; otherwise, Step  1425  is executed. 
         [0529]    In Step  1425 , the security domain associated with the application corresponding to the application identification in the extradition command is modified to be the application corresponding to the security domain identification in the extradition command. 
         [0530]    In Step  1426 , the data required for computing a receipt is sent to the second card data management module, the receipt returned by the second card data management module is received, the returned data is set as the receipt and Step  1427  is executed. 
         [0531]    Specifically, the application identification length, application identification, original security domain identification length, new security domain length and new security domain identification of the current extradition application are sent to the second card data management module; the original security domain identification is a security domain identification of the security domain associated with the current extradition application before the extradition; and the new security domain identification is a security domain identification of the security domain to-be associated with the current extradition application after the extradition. 
         [0532]    In Step  1427 , a respective state code is generated. 
         [0533]    Specifically, the respective state code includes a state code of identification success and a state code of identification error; different error types correspond to different state codes. 
         [0534]    In Step  1428 , the set returned data and/or generated state code is returned. 
         [0535]    Preferably, shown in  FIG. 15 , Step  1501  to Step  1517  are described as follows: 
         [0536]    In Step  1501 , it is determined whether the APDU data is a legitimate command head of the personalized command, Step  1502  is executed if the APDU data is the legitimate command head of the personalized command; otherwise, Step  1516  is executed. 
         [0537]    Specifically, in a case that the CLA of the APDU data is 0x80 or 0x84, P2 is 0x00 and Lc is no less than 0x0B, the APDU data is the legitimate command head of personalized command. 
         [0538]    In Step  1502 , it is determined whether the current state is TERMANATED or CARD_LOCKED, Step  1516  is executed if the current state is TERMANATED or CARD_LOCKED; otherwise, Step  1503  is executed. 
         [0539]    In Step  1503 , a data domain part of the personalized command is received to obtain a complete personalized command. 
         [0540]    In Step  1504 , it is determined whether the state of the current first card data management module is PERSONALIZED, Step  1505  is executed if the state of the current first card data management module is PERSONALIZED; otherwise, Step  1516  is executed. 
         [0541]    In Step  1505 , it is determined whether the card meets a security condition, Step  1506  is executed if the card meets the security condition; otherwise, Step  1516  is executed. 
         [0542]    In Step  1506 , the security level of the card is checked, if the security level is at the first level, Step  1509  is executed; Step  1507  is executed if the security level is at the second level; or Step  1508  is executed if the security level is at the third level. 
         [0543]    Specifically, if the security level of the card is at the first level, the personalized command is message plain data; if the security level of the card is at the second level, the personalized command is combination of message plain data and message authentication code; if the security level of the card is at the third level, the personalized command is combination of message cipher data and message authentication code. 
         [0544]    In Step  1507 , it is determined whether the personalized command is complete based on the message plain data and MAC in the personalized command, Step  1509  is executed if the personalized command is complete; otherwise, Step  1516  is executed. 
         [0545]    The process of determining whether the personalized command is complete based on the message plain data and MAC includes: decrypting MAC by using preset session key to obtain a decrypting result, computing the message plain data according to a preset hash function to obtain a computing result, determining whether the decrypting result is identical to the computing result, where the personalized command is complete if the decrypting result is identical to the computing result; otherwise the personalized command is not complete. 
         [0546]    In Step  1508 , it is determined whether the personalized command is complete based on the message cipher data and MAC in the personalized command, Step  1509  is executed if the personalized command is complete; otherwise, Step  1516  is executed. 
         [0547]    The process of determining whether the personalized command is complete based on the message cipher data and MAC in the personalized command includes: decrypting the message cipher data to obtain message plain data, decrypting MAC by using the preset session key to obtain a decrypting result, computing the message plain data according to the preset hash function to obtain a computing result, determining whether the decrypting result is identical to the computing result, where the personalized command is complete if the decrypting result is identical to the computing result; otherwise the personalized command is not complete. 
         [0548]    In Step  1509 , it is determined whether the first two byte data front the data domain in the personalized command are 0x00, Step  1510  is executed if the first two byte data front the data domain in the personalized command are 0x00; otherwise, Step  1516  is executed. 
         [0549]    In Step  1510 , it is determined whether the application identification length in the personalized command is in a preset range, Step  1511  is executed if the application identification length in the personalized command is in the preset range, otherwise, Step  1516  is executed. 
         [0550]    Specifically, the preset range is from 0x05 to 0x10. 
         [0551]    In Step  1511 , it is determined whether an application corresponding to the application identification exists in the personalized command, Step  1512  is executed if the application corresponding to the application identification exists in the personalized command; otherwise, Step  1516  is executed. 
         [0552]    In Step  1512 , it is determined whether the security domain associated with the application corresponding to the application identification in the personalized command is the current first card data management module, Step  1513  is executed if the security domain associated with the application corresponding to the application identification in the personalized command is the current first card data management module, otherwise, Step  1516  is executed. 
         [0553]    In Step  1513 , it is determined whether all of the last three byte data in the personalized command are 0x00; Step  1514  is executed if all of the last three byte data in the personalized command are 0x00; otherwise, Step  1516  is executed. 
         [0554]    In Step  1514 , the state of the application corresponding to the application identification in the personalized command is set to be PERSONLIZED. 
         [0555]    In Step  1515 , the returned data is set to be 0x00. 
         [0556]    In Step  1516 , a respective state code is generated. 
         [0557]    Specifically, the respective state code includes a state code of identification success and a state code of identification error; different error types correspond to different state codes. 
         [0558]    In Step  1517 , the set returned data and/or generated state code is returned. 
         [0559]    Preferably, as shown in  FIG. 16 , Step  1601  to Step  1625  are described as follows. 
         [0560]    In Step  1601 , it is determined whether the APDU data is a legitimate command head of a Delete command, Step  1602  is executed if the APDU data is the legitimate command head of Delete command; otherwise, Step  1624  is executed. 
         [0561]    Specifically, in a case that the CLA of the APDU data is 0x80 or 0x84 and P1 is 0x00, the APDU data is the legitimated command head of Delete command. 
         [0562]    In Step  1602 , it is determined whether the current state of the card is TERMANATED or CARD_LOCKED, Step  1624  is executed if the current state of the card is TERMANATED or CARD_LOCKED; otherwise, Step  1603  is executed. 
         [0563]    In Step  1603 , the data domain part of the Delete command is received to obtain a complete Delete command. 
         [0564]    In Step  1604 , it is determined whether the state of the current first card data management module is PERSONALIED, Step  1605  is executed if the state of the current first card data management module is PERSONALIED; otherwise, Step  1624  is executed. 
         [0565]    In Step  1605 , it is determined whether the current first card data management module has a proxy right, Step  1606  is executed if the current first card data management module has the proxy right; otherwise, Step  1624  is executed. 
         [0566]    In Step  1606 , it is determined whether the card meets a security condition, Step  1607  is executed if the card meets the security condition; otherwise, Step  1624  is executed. 
         [0567]    In Step  1607 , the security level of the card is checked; Step  1610  is executed if the security level is at the first level, Step  1608  is executed if the security level is at the second level, or Step  1609  is executed if the security level is at the third level. 
         [0568]    Specifically, if the security level of the card is at the first level, the Delete command is message plain data, if the security level is at the second level, the Delete command is combination of message plain data and message authentication code, if the security level is at the third level, the Delete command is combination of message cipher data and message authentication code. 
         [0569]    In Step  1608 , it is determined whether the Delete command is complete based on the message plain data and MAC in the Delete command, Step  1610  is executed if the Delete command is complete; otherwise, Step  1624  is executed. 
         [0570]    The process of determining whether the Delete command is complete based on the message plain data and MAC in the Delete command includes: decrypting MAC by a preset session key to obtain a decrypting result, computing the message plain data according to a preset hash function to obtain a computing result, determining whether the decrypting result is identical to the computing result, where the Delete command is complete if the decrypting result is identical to the computing result, otherwise, the Delete command is not complete. 
         [0571]    In Step  1609 , it is determined whether the Delete command is complete based on the message cipher data and MAC in the Delete command, Step  1610  is executed if the Delete command is complete; otherwise, Step  1624  is executed. 
         [0572]    The process of determining whether the Delete command is complete based on the message cipher data and MAC in the Delete command includes: decrypting the message cipher data to obtain message plain data, decrypting MAC by using a preset session key to obtain a decrypting result, computing the message plain data according to a preset hash function to obtain a computing result, determining whether the decrypting result is identical to the computing result, where the Delete command is complete if the decrypting result is identical to the computing result; otherwise the Delete command is not complete. 
         [0573]    In Step  1610 , it is determined whether the first byte data in the data domain of the Delete command is 0x4f, Step  1611  is executed if the first byte data is 0x4f; otherwise, Step  1624  is executed. 
         [0574]    In Step  1611 , it is determined whether the data domain identification length in the Delete command is in a preset range, Step  1612  is executed if the data domain identification length in the Delete command is in the preset range; otherwise, Step  1624  is executed. 
         [0575]    Specifically, the preset range is from 0x05 to 0x10. 
         [0576]    In Step  1612 , it is determined whether an application corresponding to the data domain identification in the Delete command exists in the card, Step  1613  is executed if the application corresponding to the data domain identification in the Delete command exists in the card; otherwise, Step  1614  is executed. 
         [0577]    In Step  1613 , it is determined whether P2 in the Delete command is 0x80, Step  1614  is executed if P2 in the Delete command is 0x80; otherwise, Step  1619  is executed. 
         [0578]    In Step  1614 , it is determined whether an executable file corresponding to the data domain identification in the Delete command exists in the card, Step  1615  is executed if the executable file corresponding to the data domain identification in the Delete command exists in the card, otherwise, Step  1624  is executed. 
         [0579]    In Step  1615 , it is determined whether the security domain associated with the executable file corresponding to the data domain identification in the Delete command is the current first card data management module, Step  1616  is executed if the security domain associated with the executable file corresponding to the data domain identification in the Delete command is the current first card data management module; otherwise, Step  1624  is executed. 
         [0580]    In Step  1616 , it is determined whether P2 in the Delete command is 0x80, Step  1617  is executed if P2 in the Delete command is 0x80; otherwise, Step  1618  is executed. 
         [0581]    In Step  1617 , the executable file corresponding to the data domain identification in the Delete command and all applications corresponding to the executable file are deleted, and Step  1623  is executed. 
         [0582]    In Step  1618 , the executable file corresponding to the data domain identification in the Delete command are deleted, and Step  1623  is executed. 
         [0583]    In Step  1619 , it is determined whether the application corresponding to the data domain identification in the Delete command is another application or the security domain associated with another executable file, Step  1624  is executed if the application corresponding to the data domain identification in the Delete command is another application or the security domain associated with another executable file, otherwise, Step  1620  is executed. 
         [0584]    In Step  1620 , it is determined whether the application corresponding to the data domain identification in the Delete command is the current first card data management module, Step  1624  is executed if the application is the current first card data management module, otherwise, Step  1621  is executed. 
         [0585]    In Step  1621 , it is determined whether the security domain associated with the application corresponding to the data domain identification in the Delete command is the current first card data management module, Step  1622  is executed if the security domain is the current first card data management module; otherwise, Step  1624  is executed. 
         [0586]    In Step  1622 , the application corresponding to the data domain identification in the Delete command is deleted. 
         [0587]    In Step  1623 , the data required for computing a receipt is sent to the second card data management module and the receipt returned by the second card data management module is received, the returned data is set as the receipt and Step  1624  is executed. 
         [0588]    Specifically, the data domain identification length in the Delete command and the data domain identification are sent to the second card data management module. 
         [0589]    In Step  1624 , a respective state code is generated. 
         [0590]    Specifically, the respective state code includes a state code of identification success and a state code of identification error; different error types correspond to different state codes. 
         [0591]    In Step  1625 , the set returned data and/or generated state code is returned. 
         [0592]    The described embodiments are only preferred embodiments of the disclosure and the embodiments are not intended to limit the disclosure. Any alteration or change easily obtained by those skilled in the art based on the disclosure should fall in the scope of protection of the disclosure.