Disclosure of Invention
The invention aims to provide a method and a system for processing applications under multi-channel authentication of a SIM card, which are used for solving the defects in the prior art.
The invention provides a method for processing applications under multi-channel authentication of a SIM card, which comprises the following steps:
The service APP sends a SIM card application security request to the multichannel security capability platform;
The multichannel security capability platform carries out service authentication on the SIM card according to the SIM card application security request and generates an authentication result;
The multi-channel security capability platform establishes a security channel mode with the SIM card according to the authentication result, and sends an SSD downloading and installing instruction and key data to the SIM card;
The SIM card installs the security domain to which the card application belongs according to the SSD downloading and installing instruction, and performs key injection according to the key data, and returns an SSD installing result to the multichannel security capability platform after the completion;
And the multichannel security capability platform generates a feedback result according to the SSD installation result and sends the feedback result to the service APP, and the service APP installs the SIM card application of the SIM card according to the feedback result.
In an optional embodiment, the step of performing service authentication and authentication on the SIM card and generating an authentication result by the multi-channel security capability platform according to the SIM card application security request includes:
the multichannel security capability platform acquires corresponding authentication information according to the SIM card application security request, wherein the authentication information comprises SIM card application identifier information, APP installation package name, downloadable card application list and service APP access ID information;
Judging whether the authentication information is the same as preset information or not by the multi-channel security capability platform;
if the authentication information is the same as the preset information, an authentication result of successful authentication is generated.
In an alternative embodiment, the step of establishing a secure channel mode with the SIM card by the multi-channel security capability platform according to the authentication result includes:
The multichannel security capability platform encapsulates the data short message, encrypts the data short message and obtains an encrypted data message;
The multi-channel security capability platform sends the encrypted data message to the SIM card, the SIM card checks the encrypted data message, and after the checking is completed, a security channel mode for information interaction is established with the multi-channel security capability platform.
In an optional embodiment, after the step of verifying the encrypted data packet by the SIM card, the method further includes:
After the SIM card is checked, the https link is pulled up, and a secure channel mode based on https data interaction is established with the multi-channel secure capability platform.
In an optional implementation manner, the multi-channel security capability platform generates a feedback result according to the SSD installation result and sends the feedback result to the service APP, and the service APP installs the SIM card application of the SIM card according to the feedback result, including:
the multi-channel security capability platform generates a feedback result according to the SSD installation result, wherein the feedback result comprises an SSD channel verification instruction and a SIM card application card writing instruction stream;
The multi-channel security capability platform sends SSD channel checking instructions and SIM card application card writing instruction streams to a service APP;
The service APP checks the SSD channel of the SIM card according to the SSD channel checking instruction, and after the check is successful, the service APP performs card writing operation on the SIM card according to the SIM card application card writing instruction stream;
The SIM card generates a completion result according to card writing operation of the machine card instruction, and sends the completion result to the service APP so as to complete the SIM card application installation flow.
In an optional embodiment, in the step of establishing a secure channel mode with the SIM card according to the authentication result, the secure channel mode includes a data sms secure channel mode, a BIP secure channel mode, and a set card secure channel mode.
In an optional implementation manner, the multi-channel security capability platform sends an SSD downloading and installing instruction to the SIM card in a data short message security channel mode or a BIP security channel mode, and sends key data to the SIM card in a scattered injection mode;
And the service APP performs the operations of installing, downloading, updating and initializing functions on the SIM card application through the machine card channel.
The invention also provides an application processing system under the multi-channel authentication of the SIM card, which comprises a service APP, a multi-channel security capability platform and the SIM card;
The service APP is used for sending an SIM card application security request to the multichannel security capability platform;
The multichannel security capability platform is used for carrying out service authentication on the SIM card according to the SIM card application security request and generating an authentication result;
The multi-channel security capability platform is also used for establishing a security channel mode with the SIM card according to the authentication result and sending an SSD downloading and installing instruction and key data to the SIM card;
the SIM card is used for installing the security domain to which the card application belongs according to the SSD downloading and installing instruction, and injecting the key according to the key data, and returning an SSD installing result to the multichannel security capability platform after the completion;
The multi-channel security capability platform is further used for generating a feedback result according to the SSD installation result and sending the feedback result to the service APP, and the service APP is further used for installing the SIM card application of the SIM card according to the feedback result.
In an optional embodiment, the multi-channel security capability platform is configured to obtain corresponding authentication information according to the SIM card application security request, where the authentication information includes SIM card application identifier information, an APP installation package name, a downloadable card application list, and service APP access ID information;
the multi-channel security capability platform is also used for judging whether the authentication information is the same as the preset information;
if the authentication information is the same as the preset information, an authentication result of successful authentication is generated.
In an alternative embodiment, the multi-channel security capability platform is used for packaging the data short message and encrypting the data short message to obtain an encrypted data message;
the multi-channel security capability platform is also used for sending the encrypted data message to the SIM card, the SIM card verifies the encrypted data message, and after the verification is completed, a security channel mode for information interaction is established with the multi-channel security capability platform.
The embodiment of the invention has the following advantages:
According to the method and the system for processing the application under the multi-channel authentication of the SIM card, when the third party service APP is in butt joint, the multi-channel security capability platform is used for carrying out service authentication on the SIM card and generating the authentication result, so that a security channel mode can be established with the SIM card according to the authentication result, the installation of the SSD of the security domain to which the card application belongs and the injection of the secret key are realized, and then the service APP is installed according to the application of the SIM card to the SIM card.
Detailed Description
It should be noted that, without conflict, the embodiments of the present application and features of the embodiments may be combined with each other. The application will be described in detail below with reference to the drawings in connection with embodiments.
Referring to fig. 1 and 2, the present invention provides a method for processing applications under multi-channel authentication of a SIM card, where the method includes:
s1, a service APP sends an SIM card application security request to a multichannel security capability platform;
s2, the multi-channel security capability platform carries out service authentication on the SIM card according to the SIM card application security request and generates an authentication result;
s3, the multi-channel security capability platform establishes a security channel mode with the SIM card according to the authentication result, and sends an SSD downloading and installing instruction and key data to the SIM card;
S4, the SIM card installs the security domain to which the card application belongs according to the SSD downloading and installing instruction, and performs key injection according to the key data, and after the key injection is completed, an SSD installing result is returned to the multi-channel security capability platform;
S5, the multichannel security capability platform generates a feedback result according to the SSD installation result and sends the feedback result to the service APP, and the service APP installs the SIM card application of the SIM card according to the feedback result.
The multi-channel security capability platform belongs to an operator module, and further comprises a gateway and a SIM card, wherein the multi-channel security capability platform has security authentication capability for a third party service APP, the gateway provides an infrastructure for the operator to provide a short message access number and network access, the third party service APP is a service partner and realizes own service based on the SIM card as a security module, the SIM card is the operator SIM card, the security authentication is carried out by EAL4+ (including) and has the capability of resisting physical attacks, the security space such as multiple SSDs and multiple applications is supported in the card, the security module capability is provided, and the key data is a service key. When the third party service APP is in butt joint, the invention carries out service authentication on the SIM card through the multi-channel security capability platform and generates an authentication result, thus, a security channel mode can be established between the gateway and the SIM card according to the authentication result, the installation of the security domain SSD to which the card application belongs and the injection of the secret key are realized, and then the service APP is installed according to the application of the SIM card to the SIM card. The service APP initiates the installation/downloading of the SSD and the service key injection through the invocation of the multichannel security capability platform, so that the effect that the SSD Shang Yuzhi SSD is not needed is achieved, namely, the multichannel security capability platform is free of SSD installation mode and service key injection, the step that the service key and the disperse algorithm rule need to be preset to the SIM card manufacturer is avoided, the step that the service initial key needs to be transmitted to the SIM card manufacturer in the traditional mode is reduced, the service safety is guaranteed, the risk of exposing the initial key and the disperse rule is reduced, and the access and the use of the side of the service APP are more convenient.
In one embodiment, the step S2 of the multi-channel security capability platform performing service authentication and authentication on the SIM card according to the SIM card application security request and generating an authentication result includes:
s21, the multichannel security capability platform acquires corresponding authentication information according to the SIM card application security request, wherein the authentication information comprises SIM card application identifier information, APP installation package names, downloadable card application lists and service APP access ID information;
s22, the multichannel security capability platform judges whether the authentication information is the same as preset information;
s23, if the authentication information is the same as the preset information, generating an authentication result of successful authentication.
As described in the above steps S21-S23, the function of identifying and selecting a specific application program can be verified by the SIM card application identifier information, and the terminal devices such as the multi-channel security capability platform and the service APP can accurately find and operate the specific application on the SIM card by the SIM card application identifier information. In addition, the SIM card application identifier information also relates to data interaction between the SIM card and the multichannel security capability platform and service APP, and has important significance for maintaining the continuity and stability of communication. By checking the information of the APP installation package name, the downloadable card application list and the service APP access ID information, only legal users can be ensured to access the network, thereby protecting the security of the network and the privacy of the users. A
In one embodiment, the step S3 of establishing a secure channel mode with the SIM card by the multi-channel security capability platform according to the authentication result includes:
S31, the multichannel security capability platform encapsulates the data short message, encrypts the data short message and obtains an encrypted data message;
s32, the multi-channel security capability platform sends the encrypted data message to the SIM card, the SIM card verifies the encrypted data message, and after verification is completed, a security channel mode for information interaction is established with the multi-channel security capability platform.
And (3) packaging the GSM 0348 format data short message by the multichannel security capability platform, and completing the establishment of a security channel mode by adopting the encrypted message and carrying out data verification on the gateway and the SIM card by the multichannel security capability platform as described in the steps S31-S32.
In one embodiment, after the step S32 of verifying the encrypted data packet by the SIM card, the method further includes:
s321, after the SIM card is checked, the https link is pulled up, and a secure channel mode based on https data interaction is established with the multi-channel secure capability platform.
As described in the above step S321, the security channel mode may also be established by means of BIP (Bearer Independent Protocol ), specifically, the BIP security channel mode is a concept in the field of communication technology, and relates to communication management between the SIM card (subscriber identity module) and the user terminal (multi-channel security capability platform, service APP). BIP secure channel mode status management methods involve receiving and responding to commands and messages related to BIP channel status to ensure efficient management and maintenance of the channel, including receiving a first channel status management command sent by a UICC (Universal Integrated Circuit Card, i.e., universal integrated circuit card), and then sending a channel status response message to the UICC containing the current BIP channel status. After sending the channel state response message, the method further provides for sending a channel state event download command to the UICC containing the BIP channel state acquired at the current state provision period every predetermined state provision period. The method aims to solve the problem of low BIP channel maintenance efficiency and simplify BIP channel state management flow, in the embodiment, a multi-channel security capability platform firstly packages GSM0348 format data short messages, adopts encrypted messages, and after data verification is carried out between a gateway and a SIM card, https links are pulled up, a security channel mode based on a BIP mode is established with the multi-channel security capability platform, and data interaction can be completed in a https mode subsequently.
In one embodiment, the step S5 of generating, by the multi-channel security capability platform according to the SSD installation result, a feedback result and sending the feedback result to the service APP, where the service APP installs the SIM card application of the SIM card according to the feedback result includes:
s51, the multi-channel security capability platform generates a feedback result according to an SSD installation result, wherein the feedback result comprises an SSD channel verification instruction and an SIM card application card writing instruction stream;
S52, the multi-channel security capability platform sends SSD channel verification instructions and SIM card application card writing instruction streams to a service APP;
s53, the service APP checks the SSD channel of the SIM card according to the SSD channel checking instruction, and after the check is successful, the service APP performs card writing operation on the SIM card according to the SIM card application card writing instruction stream;
S54, the SIM card generates a completion result according to card writing operation of the machine card instruction, and the completion result is sent to the service APP so as to complete the SIM card application installation flow.
As described in the above steps S51-S54, when installing the SIM card application, the SIM card application is installed in the security domain SSD to which the card application belongs, and when the service APP interacts with the SIM card, the key verification needs to be performed through the security domain SSD to which the card application belongs, so that it can be ensured that the SIM card application of the third party service APP is safe and independent and cannot be accessed by other APPs.
In one embodiment, in the step of establishing a secure channel mode with the SIM card according to the authentication result, the secure channel mode includes a data sms secure channel mode, a BIP secure channel mode, and a set-card secure channel mode.
The multichannel security capability platform also comprises a security authentication processing module used for performing security authentication processing on the SIM card, an instruction packaging module used for packaging and issuing a card writing instruction stream and a data short message applied to the SIM card and judging a result of a response message returned by the SIM card, and a service authentication module used for performing authentication processing on access of a third party service APP, wherein the authentication processing module comprises an application AID, application data, an initial key, a dispersion algorithm and the like.
In one embodiment, the multi-channel security capability platform sends an SSD download installation instruction to the SIM card via the gateway in a data short message security channel mode or a BIP security channel mode, and sends key data to the SIM card in a decentralized injection manner, where the key data is decentralized injected into the SIM card.
And the service APP performs the operations of installing, downloading, updating and initializing functions on the SIM card application through the machine card channel.
The invention also provides an application processing system under the multi-channel authentication of the SIM card, which comprises a service APP, a multi-channel security capability platform and the SIM card, wherein the multi-channel security capability platform and the SIM card interact information;
The service APP is used for sending an SIM card application security request to the multichannel security capability platform;
The multichannel security capability platform is used for carrying out service authentication on the SIM card according to the SIM card application security request and generating an authentication result;
The multi-channel security capability platform is also used for establishing a security channel mode with the SIM card according to the authentication result and sending an SSD downloading and installing instruction and key data to the SIM card;
the SIM card is used for installing the security domain to which the card application belongs according to the SSD downloading and installing instruction, and injecting the key according to the key data, and returning an SSD installing result to the multichannel security capability platform after the completion;
The multi-channel security capability platform is further used for generating a feedback result according to the SSD installation result and sending the feedback result to the service APP, and the service APP is further used for installing the SIM card application of the SIM card according to the feedback result.
In one embodiment, the multi-channel security capability platform is configured to obtain corresponding authentication information according to the SIM card application security request, where the authentication information includes SIM card application identifier information, an APP installation package name, a downloadable card application list, and service APP access ID information;
the multi-channel security capability platform is also used for judging whether the authentication information is the same as the preset information;
if the authentication information is the same as the preset information, an authentication result of successful authentication is generated.
In one embodiment, the multi-channel security capability platform is used for packaging the data short message and encrypting the data short message to obtain an encrypted data message;
the multi-channel security capability platform is also used for sending the encrypted data message to the SIM card, the SIM card verifies the encrypted data message, and after the verification is completed, a security channel mode for information interaction is established with the multi-channel security capability platform.
It should be noted that the foregoing detailed description is exemplary and is intended to provide further explanation of the application. Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs.
It is noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of exemplary embodiments according to the present application. As used herein, the singular is intended to include the plural unless the context clearly indicates otherwise. Furthermore, it will be further understood that the terms "comprises" and/or "comprising," when used in this specification, specify the presence of stated features, steps, operations, devices, components, and/or groups thereof.
It should be noted that the terms "first," "second," and the like in the description and the claims of the present application and the above figures are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the terms so used are interchangeable under appropriate circumstances such that the embodiments of the application described herein are capable of operation in sequences other than those illustrated or otherwise described herein.
Furthermore, the terms "comprise" and "have," as well as any variations thereof, are intended to cover a non-exclusive inclusion. For example, a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those elements but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.
Spatially relative terms, such as "above," "upper" and "upper surface," "above" and the like, may be used herein for ease of description to describe one device or feature's spatial relationship to another device or feature as illustrated in the figures. It will be understood that the spatially relative terms are intended to encompass different orientations in use or operation in addition to the orientation depicted in the figures. For example, if the device in the figures is turned over, elements described as "above" or "over" other devices or structures would then be oriented "below" or "beneath" the other devices or structures. Thus, the process is carried out, the exemplary term "above" may be included. Upper and lower. Two orientations below. The device may also be positioned in other different ways, such as rotated 90 degrees or at other orientations, and the spatially relative descriptors used herein interpreted accordingly.
In the above detailed description, reference is made to the accompanying drawings, which form a part hereof. In the drawings, like numerals typically identify like components unless context indicates otherwise. The illustrated embodiments described in the detailed description, drawings, and claims are not meant to be limiting. Other embodiments may be utilized, and other changes may be made, without departing from the spirit or scope of the subject matter presented herein.
The above description is only of the preferred embodiments of the present invention and is not intended to limit the present invention, but various modifications and variations can be made to the present invention by those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.