WO2017016058A1

WO2017016058A1 - Virtual card protection method, application processor and terminal, and computer storage medium

Info

Publication number: WO2017016058A1
Application number: PCT/CN2015/090477
Authority: WO
Inventors: 刘川
Original assignee: 中兴通讯股份有限公司
Priority date: 2015-07-24
Filing date: 2015-09-23
Publication date: 2017-02-02
Also published as: CN106375996A; CN106375996B

Abstract

A virtual card protection method, comprising: a virtual SIM card drive program performing authorization and authentication on a virtual SIM card management application program; after the virtual SIM card management application program passes the authorization and authentication, the virtual SIM card drive program storing virtual SIM card information into a storage device according to a storage command issued by the virtual SIM card management application program, wherein the virtual SIM card drive program is located in kernel space of a virtual SIM card protection application processor. Also disclosed are a virtual card protection AP and terminal, and a computer storage medium.

Description

Virtual card protection method, application processor and terminal, computer storage medium

Technical field

The present invention relates to a communication card driving technology, and in particular, to a virtual card protection method, an application processor (AP), a terminal, and a computer storage medium.

Background technique

In the prior art, the subscriber identity (SIM) information is stored on the real SIM card chip, leaving part of the interface for the device platform to read. The SIM card chip can ensure the security of the SIM card information. Most of the SIM card information in the virtual SIM card is stored in the application layer of the AP user space, and the application layer is easily cracked by hackers.

At present, the virtual SIM card produced by Apple has been used for commercial purposes, but Apple has said that the biggest problem with virtual SIM cards is security. In addition, the largest virtual operator in the United States (TraceFone) clearly stated that when implementing the personal protective equipment (PPE) of the traffic management system, how to protect the security of the PPE database is the most critical technical problem that the virtual operator needs to solve. . Similarly, how virtual SIM cards enhance software security is also an important technical issue that needs to be addressed.

Summary of the invention

In view of this, the embodiment of the present invention is to provide a virtual card protection method, an AP, a terminal, and a computer storage medium, which can not only ensure the security of the virtual SIM card information reliably and effectively, but also implement the AP and the virtual SIM card information. Data communication between wireless modems (MODEM).

To achieve the above objective, the technical solution of the embodiment of the present invention is implemented as follows:

The embodiment of the invention provides a virtual card protection method, including:

The virtual SIM card driver authenticates the virtual SIM card management application;

After the virtual SIM card management application is authenticated, the virtual SIM card driver stores the virtual SIM card information in the storage device according to the storage command issued by the virtual SIM card management application;

The virtual SIM card driver is located in a kernel space of the virtual SIM card protection application processor AP.

In the above solution, the method further includes:

The virtual SIM card driver communicates with a wireless modem MODEM.

In the above solution, after the virtual SIM card management application is authenticated, the method further includes:

The virtual SIM card driver queries the virtual SIM card information according to the query command issued by the virtual SIM card management application; or

The virtual SIM card driver deletes the virtual SIM card information according to a delete command issued by the virtual SIM card management application.

In the above solution, the virtual SIM card driver authenticates the virtual SIM card management application as:

The virtual SIM card driver performs authentication and authentication with the virtual SIM card management application through an interface in the form of a device file;

Correspondingly, the virtual SIM card management application delivers the storage command, the query command, and the delete command to the virtual SIM card driver through an interface in the form of the device file.

In the foregoing solution, before the virtual SIM card driver performs authentication and authentication on the virtual SIM card management application, the method further includes:

The virtual SIM card management application sends an authentication connection request to the virtual SIM card driver;

After the authentication connection is successful, the virtual SIM card management application sends the authentication information to the virtual SIM card driver.

The embodiment of the invention further provides a virtual card protection AP, including:

a virtual SIM card driving unit configured to authenticate the virtual SIM card management application by the virtual SIM card driver; after the virtual SIM card management application passes the authentication, the virtual SIM card driver is configured according to the virtual The storage command issued by the SIM card management application stores the virtual SIM card information in the storage device; wherein the virtual SIM card driver is located in the kernel space of the virtual card protection AP;

The virtual SIM card management application unit is configured to deliver the storage command to the virtual SIM card management application.

In the above solution, the virtual SIM card driving unit is further configured to communicate with the wireless MODEM by the virtual SIM card driver.

In the above solution, the AP further includes:

a device file unit configured to perform the authentication authentication by the virtual SIM card management application with the virtual SIM card driver through an interface in a device file format; the virtual SIM card management application is in the form of the device file The interface sends the storage command to the virtual SIM card driver;

And a storage drive unit configured to store the storage device by the storage driver.

The embodiment of the invention further provides a virtual card protection terminal, including:

The virtual card protects the AP and is configured to drive the virtual SIM card;

a baseband chip BB configured to communicate with the virtual card protection AP;

A storage device configured to store virtual SIM card information.

In the foregoing solution, the virtual card protection AP includes:

a virtual SIM card driving unit configured to authenticate the virtual SIM card management application by using a virtual SIM card driver; after the virtual SIM card management application passes authentication authentication, The virtual SIM card driver stores the virtual SIM card information in the storage device according to the storage command issued by the virtual SIM card management application; wherein the virtual SIM card driver is located in the kernel space of the virtual card protection AP ;

In the above solution, the BB includes:

A wireless MODEM configured to communicate with the virtual SIM card driver.

The embodiment of the present invention provides a computer storage medium. The computer storage medium provided by the embodiment of the present invention stores a computer program, and the computer program is used to execute the virtual card protection method.

The virtual card protection method, the AP and the terminal, and the computer storage medium provided by the embodiment of the present invention protect the virtual SIM card management application by the virtual SIM card driver of the virtual card protection AP in the virtual card protection terminal; After the virtual SIM card management application is authenticated, the virtual SIM card driver stores the virtual SIM card information in the storage device according to the storage command issued by the virtual SIM card management application; wherein the virtual SIM The card driver is located in the kernel space of the virtual card protection AP. The virtual SIM card driver in the embodiment of the present invention is located in the kernel space of the virtual card protection AP, and the security of the virtual SIM card information is ensured by shielding the impact generated by the virtual SIM card management application.

DRAWINGS

1 is a schematic flowchart of implementing a virtual card protection method according to Embodiment 1 of the present invention;

2 is a layered schematic diagram of a software structure of a virtual card protection terminal according to Embodiments 1 and 3 of the present invention;

3 is a schematic flowchart of implementing communication between a virtual SIM card driver and a virtual SIM card management application according to Embodiment 1 of the present invention;

4 is a virtual card protection AP and a virtual card protection terminal provided by Embodiments 2 and 3 of the present invention; Schematic diagram of the composition.

detailed description

In the embodiment of the present invention, the virtual SIM card driver of the virtual card protection AP in the virtual card protection terminal authenticates the virtual SIM card management application; after the virtual SIM card management application passes the authentication and authentication, The virtual SIM card driver stores the virtual SIM card information in the storage device according to the storage command issued by the virtual SIM card management application; wherein the virtual SIM card driver is located in the kernel space of the virtual card protection AP.

The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

Example 1

1 is a schematic flowchart of implementing a virtual card protection method according to Embodiment 1 of the present invention. As shown in FIG. 1, the method includes:

Step 110: The virtual SIM card driver performs authentication and authentication on the virtual SIM card management application.

In step 110, as shown in FIG. 2, the virtual SIM card driver can communicate with the virtual SIM card management application located in the virtual card protection AP user space to complete the functions of authentication authentication and virtual SIM card information interaction.

Further, as shown in FIG. 2, the virtual SIM card management application works on the application layer of the user space of the virtual card protection AP; the virtual SIM card management application interacts with the virtual SIM card remote management server through the network to obtain the virtual SIM. Card information and upload terminal information.

Specifically, the virtual SIM card management application applies for the virtual SIM card information to the virtual SIM card remote management server, and downloads the virtual SIM card information after the application is passed, wherein the virtual SIM card management application and the virtual SIM card remote management server perform network connection. It is connected by SSL (Secure Sockets Layer) encryption to ensure the security of network data transmission.

Further, as shown in FIG. 2, the virtual SIM card driver works on the virtual card protection AP. The device driver layer of the kernel space is used to complete the underlying implementation of the secure storage of the virtual SIM card information and provides security protection for the virtual SIM card.

In step 110, the operating system performs some functional definitions on the kernel space in order to protect itself from being destroyed by a normal application, such as: access rights, swap in and out, and priority. In other words, kernel space is only allowed to be accessed by the kernel program, and the application needs to be audited by the kernel if it wants to access the kernel space. Kernel space and user space communicate through system calls, that is, when an application calls the system application programming interface (API), an interrupt is generated. After entering the kernel mode, the API enters the kernel state and exits through the interrupt to return to the user. The calling function of the state.

The virtual SIM driver effectively shields the impact of the virtual SIM card management application through the operating system's own protection mechanism, thereby ensuring the security of the virtual SIM card information.

In step 110, the virtual SIM driver ensures the security of the data interface by authenticating the authentication operation of the virtual SIM card management application. The authentication and authentication may be implemented in a plurality of manners, including using a magic number for authentication, that is, using a complex constant of consensus for authentication credentials.

As shown in FIG. 3, before the virtual SIM card driver authenticates the virtual SIM card management application, the method further includes:

Specifically, as shown in FIG. 3, first, the virtual SIM card management application initiates an authentication connection to the virtual SIM card driver, wherein the authentication connection adopts an open file function (Open) in the system call function; the virtual SIM card management application passes Interface connection request sends an authentication device in the form of a file, wherein sending the connection request using authentication function (the Ioctl) the device I / O channel call management system functions; simultaneously, the connection request carrying the authentication process identifier ( PID, Process ID) and authentication information; after that, the virtual SIM card driver in the kernel space authenticates the connection authentication authority for the virtual SIM card management application. Specifically, the virtual SIM card driver ensures that only one management program is connected according to the process PID, and determines the operation authority of the management application according to the authentication information. If the authentication is successful, step 120 is performed. If the authentication fails, the connection is forcibly closed.

Here, as shown in FIG. 2, the virtual SIM card driver authenticates the virtual SIM card management application as:

The virtual SIM card driver performs the authentication authentication with the virtual SIM card management application through an interface in the form of a device file; correspondingly, the virtual SIM card management application passes through an interface of the device file format The virtual SIM card driver delivers the storage command, the query command, and the delete command. The interface in the form of the device file is located in a file system layer of the virtual card protection AP user space, where the interface in the form of the device file performs data interaction between the virtual SIM card driver and the virtual SIM card management application. Interface. For example, the file path of the interface in the form of the device file is: /dev/simcard.

That is, the virtual SIM card management application interacts with the virtual SIM card driver located in the AP kernel space by the interface in the form of the device file to complete the reading and saving of the virtual SIM card information, wherein the interface in the form of the device file is Virtual SIM card driver implementation. The interface in the form of a device file is an interface provided by the virtual SIM card driver to the virtual card protection AP, and is mainly responsible for receiving and executing an operation command issued by the upper virtual SIM card management application to implement the virtual SIM card management application and the virtual SIM card. Data interaction between drivers.

In addition to communication using the interface of the device file in the form of a virtual SIM card, the virtual SIM card driver and the virtual SIM management application can communicate via a socket (Netlink). Here, Netlink is to implement communication between the user process and the kernel process. The special interprocess communication method.

Step 120: After the virtual SIM card management application passes the authentication, the virtual The SIM card driver stores the virtual SIM card information in the storage device according to the storage command issued by the virtual SIM card management application; wherein the virtual SIM card driver is located in a kernel space of the virtual card protection AP.

In step 120, the virtual SIM card driver can effectively perform the function of virtual SIM card information storage protection. Specifically, as shown in FIG. 2, the storage driver is located at a physical input/output (I/O, Input/Output) layer of a virtual space protection AP core space; the virtual SIM card driver calls the storage driver So that the storage driver drives the storage device. The storage device may be a flash memory.

Here, the virtual SIM card driver can effectively protect the storage device storing the virtual SIM card information, and ensure that any program without the operation authority can access the storage device except the virtual SIM card driver. Specifically, in order to ensure the security of the virtual SIM card information effectively and reliably, the virtual SIM card driver performs special protection on the physical storage area for storing the virtual SIM card information, that is, the storage device. A record of the storage device is not added in the system partition table, and the virtual SIM card driver can directly read and operate the physical storage medium by calling the storage driver, and perform operations such as reading and writing the storage device, thereby implementing the storage device. The uniqueness of the storage interface ensures maximum security of the virtual SIM card information.

As shown in FIG. 3, the virtual SIM card management application initiates authentication authentication and sends authentication information to the virtual SIM card driver. After the authentication is passed, the virtual SIM card driver opens the virtual SIM card operation right to the virtual SIM card management application, and establishes a connection, so that the virtual SIM card management application manages the virtual SIM card. If the authentication fails, the virtual SIM card driver will force the connection to be broken.

Further, as shown in FIG. 3, after the virtual SIM card management application passes the authentication, the method further includes:

The virtual SIM card driver performs a check according to the virtual SIM card management application Inquiring a command to query the virtual SIM card information; or

Specifically, the virtual SIM card driver can quickly execute an operation command issued by the virtual SIM card management application, and complete operations such as storing, querying, and deleting a plurality of virtual SIM card information. In order to achieve this feature, the virtual SIM card driver has simple and effective data processing capabilities, and can quickly and efficiently complete operational commands from the virtual SIM card management application.

As shown in FIG. 3, after the authentication is passed, the virtual SIM card management application sends an operation command through the interface in the form of the device file to implement operations such as querying, storing, and deleting the virtual SIM card information. After receiving the operation command, the underlying virtual SIM card driver performs real-time operation on the virtual SIM card according to the command. When the virtual SIM card management application no longer operates, the connection is broken, wherein the interrupt connection uses a close function (Close) in the system call function.

Further, the method further includes the virtual SIM card driver communicating with a wireless modem (MODEM).

Here, the virtual SIM card driver can communicate with the wireless MODEM to ensure normal operation of the wireless MODEM network registration and data connection.

Specifically, the virtual SIM card driver communicating with the wireless MODEM includes:

The virtual SIM card driver sends the virtual SIM card information to the wireless MODEM according to a preset modem command language (AT, Attention) instruction set;

The wireless MODEM receives the virtual SIM card information, and performs a communication service operation according to the virtual SIM card information.

The virtual SIM card driver has the capability of acquiring virtual SIM card information in response to the wireless MODEM in real time, that is, the virtual SIM card driver has a special service process to complete data interaction with the wireless MODEM. Since the virtual SIM card information is saved on the AP side, therefore, when When the wireless MODEM obtains the SIM card information for the network registration service, data communication is required between the AP and the wireless MODEM.

Take the specific implementation of each mainstream platform as an example, the communication methods that can be adopted are: shared memory driver (SMD, Shared Memory Driver) and AT instruction set. As a general communication method, the AT instruction set can be implemented on most platforms. The AT instruction set is highly adaptable and highly scalable. Specifically, the wireless MODEM and the AP pre-set the AT command format. When the terminal needs to perform the network communication service, the AP sends the virtual SIM card information to the wireless MODEM by using the preset AT command set, where the network communication service includes a voice call. ,Data Connections. After the wireless MODEM obtains the virtual SIM card information, the communication service operation is completed, wherein the communication service operation includes network registration, voice dialing, and the like.

At this point, the process of virtual SIM card protection is complete.

Example 2

4 is a schematic structural diagram of a virtual card protection AP according to Embodiment 2 of the present invention. As shown in FIG. 4, the virtual card protection AP 310 includes:

The virtual SIM card driving unit 220 is configured to perform virtual authentication on the virtual SIM card management application by the virtual SIM card driver; after the virtual SIM card management application passes the authentication, the virtual SIM card driver according to the The storage command issued by the virtual SIM card management application stores the virtual SIM card information in the storage device 330; wherein the virtual SIM card driver is located in the kernel space of the virtual card protection AP 310.

The virtual SIM card driving unit 220 is further configured to communicate with the wireless MODEM 321 by the virtual SIM card driver.

The virtual SIM card management application unit 210 is configured to deliver the storage command to the virtual SIM card management application.

Further, the virtual card protection AP 310 further includes:

a device file unit configured to view the virtual SIM card management application through a device file The interface is authenticated with the virtual SIM card driver; the virtual SIM card management application delivers the storage command to the virtual SIM card driver through an interface in the form of the device file.

The storage drive unit 230 is configured to store a driver to drive the storage device 330.

In a practical application, each unit module in the virtual card protection AP may be protected by a virtual card from a central processing unit (CPU), or a digital signal processor (DSP), or a programmable gate array. (FPGA, Field-Programmable Gate Array) implementation.

Example 3

4 is a schematic structural diagram of a virtual card protection terminal according to Embodiment 3 of the present invention. As shown in FIG. 4, the terminal includes:

The virtual card protects the AP 310 and is configured to drive the virtual SIM card.

A baseband chip (BB) 320 is configured to communicate with the virtual card protection AP 310.

The storage device 330 is configured to store virtual SIM card information.

Here, BB320 provides wireless communication function, virtual card protection AP310 is configured as the main function realization; virtual card protection AP310 can be regarded as computer, BB320 can be regarded as virtual card protection AP310 wireless MODEM, wireless MODEM through AT command set and other interfaces Provides calls, short messages, Internet access, and other functions. The AT command set is equivalent to the interface between the computer and the MODEM.

In practical applications, each unit module in the virtual card protection terminal may be protected by a virtual card to protect a central processing unit (CPU), or a digital signal processor (DSP), or a programmable gate array. (FPGA, Field-Programmable Gate Array) implementation.

As shown in FIG. 2, the main implementation of the virtual SIM card function provided in this embodiment is partially located in the virtual The card protects the kernel space on the AP side and is implemented by driving. The virtual SIM card drive unit located on the virtual card protection AP side needs to implement communication with the two parts of the chip. Part of the communication between the virtual SIM card drive unit and the virtual card protects the virtual SIM card management application unit in the AP side user space. Specifically, the virtual SIM card management application unit completes communication with the remote virtual SIM card server, and sends the obtained virtual SIM card information to the virtual SIM card driving unit, and then the virtual SIM card driving unit completes the kernel space. Storage and security protection. The other part is the communication between the virtual SIM card drive unit and the wireless MODEM in the BB. Specifically, the virtual SIM card driving unit provides virtual SIM card information to the wireless MODEM, so that the wireless MODEM completes functions such as network registration, data connection, and the like.

Specifically, referring to FIG. 4, the virtual card protection AP 310 includes:

The virtual SIM card driving unit 220 is configured to perform virtual authentication on the virtual SIM card management application by the virtual SIM card driver; after the virtual SIM card management application passes the authentication, the virtual SIM card driver according to the The storage command issued by the virtual SIM card management application stores the virtual SIM card information in the storage device 330; wherein the virtual SIM card driver is located in the kernel space of the virtual card protection AP 310;

Specifically, the BB320 includes:

The wireless MODEM 321 is configured to communicate with the virtual SIM card driver.

In practical applications, the virtual card protection AP 310, BB320, virtual SIM card management application unit 210, virtual SIM card driving unit 220, and storage drive unit 230 may all be central processing units (CPU, Central Processing Unit) located in any computer device. ), a digital signal processor (DSP), a microprocessor (MPU), or a Field Programmable Gate Array (FPGA); the storage device 330 can be implemented by Flash.

The apparatus for tracking the service signaling according to the embodiment of the present invention may also be stored in a computer readable storage medium if it is implemented in the form of a software function module and sold or used as a separate product. Based on such understanding, the technical solution of the embodiments of the present invention may be embodied in the form of a software product in essence or in the form of a software product stored in a storage medium, including a plurality of instructions. A computer device (which may be a personal computer, server, or network device, etc.) is caused to perform all or part of the methods described in various embodiments of the present invention. The foregoing storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read only memory (ROM), a magnetic disk, or an optical disk. Thus, embodiments of the invention are not limited to any specific combination of hardware and software.

Correspondingly, an embodiment of the present invention further provides a computer storage medium, wherein a computer program is stored, and the computer program is used to execute the virtual card protection method of the embodiment of the present invention.

The above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention.

Claims

A virtual card protection method, the method comprising:

The virtual user identity SIM card driver authenticates the virtual SIM card management application;

After the virtual SIM card management application is authenticated, the virtual SIM card driver stores the virtual SIM card information in the storage device according to the storage command issued by the virtual SIM card management application;

The virtual SIM card driver is located in a kernel space of the virtual card protection application processor AP.
The method of claim 1 wherein the method further comprises:

The virtual SIM card driver communicates with a wireless modem MODEM.
The method of claim 1, wherein after the virtual SIM card management application is authenticated, the method further comprises:

The virtual SIM card driver queries the virtual SIM card information according to the query command issued by the virtual SIM card management application; or

The virtual SIM card driver deletes the virtual SIM card information according to a delete command issued by the virtual SIM card management application.
The method of claim 3, wherein the virtual SIM card driver authenticates the virtual SIM card management application as:

The virtual SIM card driver performs authentication and authentication with the virtual SIM card management application through an interface in the form of a device file;

Correspondingly, the virtual SIM card management application delivers the storage command, the query command, and the delete command to the virtual SIM card driver through an interface in the form of the device file.
The method according to any one of claims 1 to 4, wherein the virtual SIM card drive Before the program authenticates the virtual SIM card management application, the method further includes:

The virtual SIM card management application sends an authentication connection request to the virtual SIM card driver;

After the authentication connection is successful, the virtual SIM card management application sends the authentication information to the virtual SIM card driver.
A virtual card protects an AP, and the AP includes:

a virtual SIM card driving unit configured to authenticate the virtual SIM card management application by the virtual SIM card driver; after the virtual SIM card management application passes the authentication, the virtual SIM card driver is configured according to the virtual The storage command issued by the SIM card management application stores the virtual SIM card information in the storage device; wherein the virtual SIM card driver is located in the kernel space of the virtual card protection AP;

The virtual SIM card management application unit is configured to deliver the storage command to the virtual SIM card management application.
The AP of claim 6, wherein the virtual SIM card driving unit is further configured to communicate with the wireless MODEM by the virtual SIM card driver.
The AP according to claim 6 or 7, wherein the AP further comprises:

a device file unit configured to perform the authentication authentication by the virtual SIM card management application with the virtual SIM card driver through an interface in a device file format; the virtual SIM card management application is in the form of the device file The interface sends the storage command to the virtual SIM card driver;

And a storage drive unit configured to store the storage device by the storage driver.
A virtual card protection terminal, the terminal includes:

The virtual card protects the AP and is configured to drive the virtual SIM card;

a baseband chip BB configured to communicate with the virtual card protection AP;

A storage device configured to store virtual SIM card information.
The terminal of claim 9, wherein the virtual card protection AP comprises:

a virtual SIM card driving unit configured to authenticate the virtual SIM card management application by the virtual SIM card driver; after the virtual SIM card management application passes the authentication, the virtual SIM card driver is configured according to the virtual The storage command issued by the SIM card management application stores the virtual SIM card information in the storage device; wherein the virtual SIM card driver is located in the kernel space of the virtual card protection AP;

The virtual SIM card management application unit is configured to deliver the storage command to the virtual SIM card management application.
The terminal of claim 10, wherein the BB comprises:

A wireless MODEM configured to communicate with the virtual SIM card driver.
A computer storage medium having stored therein computer executable instructions configured to perform the virtual card protection method of any of claims 1-5.