CN114070919A

CN114070919A - Card core structure of double-core SIM card

Info

Publication number: CN114070919A
Application number: CN202111348047.3A
Authority: CN
Inventors: 黄策
Original assignee: Individual
Current assignee: Individual
Priority date: 2021-11-15
Filing date: 2021-11-15
Publication date: 2022-02-18
Also published as: WO2023082477A1

Abstract

The invention provides a brand-new card core structure of a double-core SIM card. The card core structure consists of two SIM card cores, and the two SIM card cores are respectively nominal by a main card core and an auxiliary card core. The main card core and the auxiliary card core are connected according to one of the three connection modes provided by the invention, and finally are packaged on the same SIM card. The main card core completes all functions required by the technical specification of the SIM card in service, and the auxiliary card core completes additional functions which cannot be realized due to the limitation of the technical specification of the SIM card in service. The SIM card formed by adopting the double-core SIM card core structure for packaging keeps full compatibility with the packaging technical specification of the in-service SIM card in packaging. The card core structure has the following greatest advantages: 1) under the condition that the SIM card in service is 100 percent in technical specification, the additional functions which cannot be realized due to the limitation of the technical specification of the SIM card in service can be realized. 2) The technical threshold and the economic threshold for developing new functions on the SIM card are greatly reduced.

Description

Card core structure of double-core SIM card

Technical Field

The invention relates to a card core structure of a double-core SIM card.

Background

The SIM card is an electronic component widely used in the world today. The SIM card of a mobile phone and the SIM card of a set-top box (generally named as a digital television smart card) of a television set-top box are two most common SIM cards in daily life. In addition, a bus card and an entrance guard card are also common SIM cards.

The SIM card is convenient and flexible to use and high in safety degree, and is an important technical characteristic. This important technical feature makes the SIM card often play the role of security container expressing the identity ID and key data encryption/decryption during use.

Take the most common mobile phone SIM in daily life as an example.

The SIM card of the mobile phone stores a network ID corresponding to a mobile phone number and core sensitive data required by encryption/decryption of identity indicated during login and registration, and completes the operations of encryption/decryption of related service data and the like in the SIM card. The structure ensures that the processing process of any sensitive data related to the realization of the functions of the SIM card of the mobile phone is completed in the SIM card in the using process of the SIM card of the mobile phone, so that core sensitivity or fragments thereof in any SIM card can not be revealed at the mobile phone end.

When the mobile phone is still in the functional phone era, the SIM card of the mobile phone provides strong guarantee for the data security of the functional mobile phone. When the mobile phone enters the era of the smart phone, along with more and more network applications entering the smart phone, how to ensure the security of the core sensitive data of various network applications entering the smart phone becomes a difficult problem for various mobile phone application suppliers. Countless protection schemes for the core sensitive data are provided for ensuring the data security of the core sensitive data of the network application on each mobile phone, and for mobile phone manufacturers and various large network application providers to exhaust various resources. However, no security protection scheme for the core sensitive data is widely and uniformly used so far.

The main reason for the above phenomena is that the existing mobile phone SIM card related technical specifications impose negative restrictions on adding corresponding resources in the mobile phone SIM card. These negative limitations make it difficult to add additional resources to the existing SIM card to implement a security scheme for core sensitive data of various high security level network applications, while maintaining the various specifications of the existing SIM cards of active mobile phones. If the relevant technical specifications are modified, corresponding resources are added in the SIM card of the mobile phone to realize the check-in of various network application security protection schemes, and the interest game of multiple parties is involved. The result of this game of interest is that all of the challenges of modifying the specifications of the active SIM card to implement the addition of extra resources within the SIM card, eventually culminate in death.

In summary, for all devices using a SIM card as a core security component, how to put core sensitive data of the application into the SIM card used by the device for other applications residing in the device is to first face a strong negative constraint on adding corresponding resources in the SIM card across active SIM card specifications. In other words, the main problems faced by adding more resources within the SIM card to implement other additional functions are: how to break the strong negative constraint of the technical specification of the active SIM card, so that the new SIM card meets all the technical specifications of the active SIM card, and simultaneously, enough resources are added in the new SIM card to realize various additional functions denied by the technical specification of the active SIM card.

Disclosure of Invention

In order to solve the technical specification of the existing in-service SIM card in the industry at present and to add negative constraint on resources required for realizing the newly added function in the SIM card, thereby realizing more additional functions on the new SIM card, the invention provides a brand-new card core structure of the dual-core SIM card. The card core structure is as follows:

the card core structure consists of two SIM card chips and is encapsulated in the same SIM card at the same time. The two SIM card cores are respectively marked by a main card core and an auxiliary card core. All the resources required by the technical specification of the active SIM card are carried and managed on the main card core. The auxiliary card core carries and manages all resources required by the newly added function which cannot be realized because of the limitation of the prior SIM card technical specification. The two SIM card cores are connected in one of the following three connection modes.

Mode 1: bridge connection:

the bridge connection mode is that the secondary card core is provided with at least two data ports, one data port is connected with the data port of the main card core, and the other data port is the data port of the SIM card which is finally packaged. The two data ports both meet the technical specification requirements of all SIM card technical specifications on the SIM card data port. The auxiliary card core does not perform any processing on the data stream which flows through the auxiliary card core and is used for realizing the technical specification function of the existing SIM card, and only performs different port output. And intercepting the data stream which flows in from the data port of the packaged SIM card and is used for realizing the additional function on the auxiliary card core, performing corresponding processing, and outputting from the data port of the packaged SIM card. Data flowing in for realizing additional functions and processed data do not flow into the main card core through the auxiliary card core. The different port output is that for the auxiliary card core, the data flowing in from the A data port is output from the B data port; the data flowing from the B data port is output from the A data port. In the process of input/output, the auxiliary card core does not perform any processing on the data stream.

Mode 2: and (3) doubling connection:

the parallel connection mode is that the data port of the main card core and the data port of the auxiliary card core are connected in parallel, and the main card core and the auxiliary card core have different data addresses respectively. When the CPU outside the encapsulated SIM card performs data operations on the encapsulated SIM card, it needs to perform operations on the data addresses corresponding to the main card core or the auxiliary card core, respectively.

Mode 3: external control connection:

the external control connection mode is that the data port lines of the main card core and the auxiliary card core and the data port lines of the encapsulated SIM card are converged on a branch structure. The distributing structure has at least one switching control line for controlling the SIM card data port line after being packed to be connected with the main card data port line or the auxiliary card data port line in a certain time period.

The SIM card core structure with double cores has the following greatest advantages:

the method has the advantages that: under the condition that the SIM card in service is 100 percent in technical specification, the additional functions which cannot be realized due to the limitation of the technical specification of the SIM card in service can be realized.

The method has the advantages that: the technical threshold and the economic threshold for developing new functions on the SIM card are greatly reduced.

Drawings

FIG. 1: the structure of the SIM card core of the active mobile phone is shown schematically.

FIG. 2: the structure schematic diagram of the bridge-type connected double-core SIM card core of the single data port.

FIG. 3: the structure diagram of the double-core SIM card core of the bridge connection of the double data port.

FIG. 4: the double-core SIM card core structure schematic diagram of the parallel connection of the single data port.

FIG. 5: the double-core SIM card core structure schematic diagram of the parallel connection of the double data ports.

FIG. 6: the structure schematic diagram of the double-core SIM card core of the external control connection of the single data port.

Fig. 7 is a structural diagram of a special card writer for downloading data by a dual-data-port dual-core SIM card.

FIG. 8: the double data port bridge connection is a structural schematic diagram of a double-core SIM card core of an SM1 encryption chip managed by a secondary card core.

Detailed Description

The present invention will be described in detail with reference to specific examples.

In order to make the description more clear and clear, the present embodiment takes the most common SIM card of the mobile phone as an example, and the detailed description is made.

The China mobile phone SIM card must accord with the SIM card basic technical specification issued by China mobile communication group company and is restricted by the specification. The technical specification of SIM card base must meet and be constrained by a number of ISO international standards. The consequence of this constraint is that it ensures the absolute security of the mobile phone SIM card as the mobile communication terminal ID container, and at the same time, it basically completely closes the possibility of adding corresponding resources on the mobile phone SIM card, providing an absolute security information container for other mobile phone applications.

Today, a plurality of mobile phone applications such as social software, internet banking software, taxi-taking software and shopping software are not sufficient. These mobile phone applications with different functions have two common points: 1) these mobile phone applications are all related to the wealth of the mobile phone owner. 2) The core sensitive data of the mobile phone applications are stored on the mobile phone like 'naked ben'. These data, like the 'naked running' core sensitive data, become the stealing target of all hackers and horses. Once the core sensitive data is stolen, it often means that the mobile phone owner's wealth is compromised.

The China moves 5 to 6 years ago to release an SIM card shield, and the technical scheme for storing the core sensitive data of the mobile phone application is constructed by taking the mobile phone SIM card as a core component and utilizing abundant resources on the mobile phone SIM card. For years of commercial promotion, the scheme only has commercial users of the only SIM card shield of the Pufa bank at present.

Two important reasons for this to occur are:

reason 1: because the spare resources in the mobile phone SIM card are limited, the API of one mobile phone end and the mobile phone SIM card form a complete core sensitive data technical scheme-SIM card shield for protecting the mobile phone APP. The mobile phone application adopting the SIM card shield realizes all safety protection functions provided by the SIM card shield, such as certificate downloading, certificate deletion, digital signature/verification, encryption/decryption and the like, by calling the API matched with the SIM card shield. The scheme framework makes the matching component of the SIM card shield, namely the API used with the SIM card shield, become the shortest short board for determining the robustness of the SIM card shield protection scheme.

For a developer to consider whether to use the SIM shield as a protection scheme for their handset application core sensitive data, the following two questions must be faced, answered and evaluated:

problem 1: if the owner of the mobile phone has enough safety consciousness and capability, the mobile phone can be protected from being invaded by virus. The core sensitive data developed by the user and protected by the SIM card shield is not substantially different from the core sensitive data developed by the user and placed on the mobile phone side in the state of "naked running", in terms of security.

From this, a first conclusion can be drawn: for the owner of a mobile application with protection awareness and ability, the protection scheme of the SIM card shield is meaningless!

Problem 2: if the virus breaks the security protection of the mobile phone and successfully enters the mobile phone, the security strength of the API of the SIM card shield is the same as that of the mobile phone application developed by the SIM card shield. Obviously, there is no evidence and there is no evidence that the API of the SIM shield is more secure than the APP of the mobile phone application.

From this, a second conclusion can be drawn: for a mobile phone damaged by virus, the protection scheme of the SIM card shield is meaningless!

In summary, the protection scheme of the SIM shield is not substantially different from the "naked" storage scheme in terms of security.

Reason 2: if a developer of mobile phone applications adopts the SIM card shield as a scheme for storing core sensitive data of mobile phone applications developed by the developer, it means that all the core sensitive data of the mobile phone applications are opened to the SIM card shield. That is, core sensitive data such as an authentication certificate, a digital signature, and an encryption/decryption key, and a processing procedure of the core sensitive data are exposed to the SIM card shield. Precisely, the core sensitive data is partially exposed on the API of the SIM card shield and partially exposed on the SIM card. Thus, a mobile phone application taking the SIM card shield as a core sensitivity protection scheme can be made to have no secret to the SIM card shield.

In summary, only with respect to the technical solution of the SIM shield, since the SIM card is restricted by the specifications of various active SIM cards and cannot be configured with more resources, the security features similar to those of the mobile phone SIM card have been obtained, i.e. all the core data and sensitive data processing processes are completed in the SIM card, which is a very important technical reason for the disadvantage of developing the security protection market of the SIM shield. However, how to bypass or break through the restrictive limitation of various technical specifications on the mobile phone SIM card on adding resources on the mobile phone SIM card becomes a key for finding a mobile phone application core sensitive data protection scheme for realizing a high security level on the SIM card shield.

Fig. 1 is a schematic diagram of a card core structure of an active mobile phone SIM card.

Wherein CLK and I/O in the card core correspond to the packed SIM card pin 3 and pin 7 of the mobile phone respectively

It should be noted that the power supply (VCC-pin 1), ground (GND-pin 5), reset (RST-pin 2), and programming voltage (VPP-pin 6) pins in table one, which are necessary on the active SIM card of the mobile phone, will not appear or be mentioned in the descriptions of fig. 2 to 8 and the following embodiments.

Table one: definition of SIM card pin of mobile phone and technical meaning table.

Pin number	Definition of
		1	Power VCC
2	Resetting RST
		3	Clock CLK
4	Do not provide
		5	Ground GND
6	Programming voltage VPP
		7	Data I/O
8	Do not provide

The technical specifications of numerous active mobile phone SIM cards are finally converged into two strong constraints:

strong constraint 1: the development system of the mobile phone SIM card is matched with the hardware resources on the card core of the mobile phone SIM card. In order to drive the increase of hardware resources due to the increase of functions, the development system of the SIM card of the mobile phone needs to be upgraded. And to upgrade the development system of the mobile phone SIM card, the technical specification support of the mobile phone SIM card is required to be obtained. The modification of the relevant specifications for the enterprise interests of an enterprise never occurred in the past in the development of the specifications for the SIM card of a mobile phone.

Strong constraint 2: and (4) packaging specifications of the SIM card of the mobile phone. Any SIM card of the mobile phone which does not conform to the SIM card packaging specification of the mobile phone cannot be used.

The main technical reason for adopting the scheme architecture of 'mobile phone SIM card + mobile phone end API' for the SIM card shield released by China Mobile is that under the constraint of the technical specification of the in-service mobile phone SIM card, too many hardware resources cannot be borne in the mobile phone SIM card core, so that all functions of the mobile phone shield can be completely put into the SIM card. From the results, it is clear that china mobile cannot drive the modification of the relevant specifications of the SIM card of the mobile phone. 5. The method can not be done in 6 years, and can not be done in the same way in the future naturally.

Fig. 2-6 are schematic views of 5 typical connection structures of a main card core and an auxiliary card core of a card core structure of a dual-core SIM card according to the present invention.

In the two schematic diagrams of bridge connection shown in fig. 2 and fig. 3, the secondary core performs no processing on the data stream flowing through the secondary core and having been completed by the primary core, and performs only the output processing of the different ports, that is, the data stream flowing into the secondary core from "CLK 1 and I/O1" and the data stream flowing out from "CLK 2 and I/O2" are not processed by the secondary core; the sub-cores likewise do nothing to realize the data amount flowing from "CLK 2, I/O2" for the function performed by the main core, and let it flow from "CLK 1, I/O1".

"CSab" in fig. 6 is a selection signal of the "branching structure" shown in the figure, and is used to control whether "CLK 2, I/O2" on the "branching structure" is connected to "CLKa, I/Oa" or "CLKb, I/Ob".

In the schematic diagrams of fig. 2-6, the active SIM card core is used as the primary card core, and all hardware resources required for functions that cannot be realized due to the active SIM card specification are configured on the secondary card core. When the SIM card is packaged in the card core structure of the dual-core SIM card shown in fig. 2 to 6, two strong constraints finally converged by numerous mobile phone SIM card specifications can be effectively broken through as long as "CLK 2 and I/O2" in the structure shown in fig. 2 to 6 are ensured to be connected with pin 3 (clock CLK) and pin 7 (data I/O) in table 1 after the SIM card is packaged, and meanwhile, the packaging characteristics and hardware technical characteristics of other pins are ensured to be in line with the relevant technical specifications of the active SIM card.

The dual SIM card core structure shown in fig. 3, 5, and 6 needs to adopt a double-sided encapsulation manner during encapsulation. Wherein pins laid out on the a-side after packaging need to comply with the pin distribution and associated regulations of table 1. The structure has "CLK 3, I/O3, CSab" packaged in B-plane. For a detailed package design, reference may be made to the invention patent "double-sided pin packaged SIM card" (patent application No. 2019103554558).

The design of the security architecture of the structure shown in FIGS. 3 and 5 can be referred to as the SIM card with dual password operation (patent application No. 2017108922044), the SIM card with dual I/O bus (authorization publication No. CN 109347791B)

It should be noted that fig. 2-6 are only 5 typical connection modes among the connection modes of the main card core and the auxiliary card core. Engineers in the art can design more connections than are typical in fig. 2-6, 5, as needed.

Example (b): an overview of implementation of the chinese mobile SIM card shield 2.0 (hereinafter referred to as SIM card shield 2.0).

The SIM card shield 2.0 is realized by the following steps:

step 1: and constructing the SIM card required by the SIM card shield 2.0.

And (3) the SIM card required by the SIM card shield 2.0, planning the required resources on the secondary card core according to the requirement, and constructing the card core structure of the dual-core SIM card according to the structure of figures 2-6 or the structure of the upgrade version of figures 2-6. The constructed SIM card core is packaged in a SIM card. The packaged SIM card has two packaging modes of single-sided packaging and double-sided packaging.

Wherein the structure shown in fig. 2 and 4 is packaged in a conventional single-sided package.

The SIM card with the structure shown in fig. 3, 5, and 6 needs to adopt the packaging method of the invention patent "double-sided pin packaged SIM card" (patent application number: 2019103554558) to perform pin planning and packaging, so as to ensure that the a side of the double-sided packaged SIM card completely meets the in-service SIM card packaging specification.

Step 2: and (3) constructing a basic security mechanism of the mobile phone shield 2.0.

In order to ensure that the downloading process of the core sensitive data of the mobile phone application is completed under the absolute control of mobile phone owners and mobile phone application providers, and sufficient security isolation is established between the core sensitive data of each mobile phone application in the SIM card, the dual-password architecture and the security control mechanism thereof described in the invention patent of the SIM card with dual-password operation (patent application No. 2017108922044) can be adopted.

The security control mechanism of the dual-data port SIM card of fig. 3 and 5 can also be designed with reference to dual I/O bus SIM card (authorization notice number: CN 109347791B).

In contrast, the dual data port SIM card has higher security strength than the single data port SIM card. The SIM card with the security mechanism built based on the SIM card with double password operation (patent application number 2017108922044) and the SIM card with double I/O buses (authorization notice number: CN 109347791B) can realize the same security strength as the active SIM card. The double-data-port SIM card provides technical possibility for completely avoiding security holes on an operating system and an application system which are inevitably existed on the mobile phone. For a specific method, see "information terminal with two keyboards" (authorization notice number: CN 112668014B).

Compared with the single data port SIM card, the double data port SIM card has the greatest difference in safety characteristic that the operating environment for downloading data to the double data port SIM card is absolutely separated from the using environment. In other words, in the usage environment of the dual-data-port SIM card (in the mobile phone), the technical conditions for downloading data cannot be achieved anyway. Even if a mobile phone or an information terminal such as an information terminal with two keyboards (authorized bulletin number: CN 112668014B) appears in the future, the downloading condition of the mobile phone or the information terminal can be destroyed by sticking a piece of adhesive tape paper on the surface B of the mobile phone or the information terminal, so that the process of downloading data into the SIM with the double data ports is ensured to be under the absolute control of the mobile phone or the information terminal owner. These security features are single data port SIM cards and cannot be implemented anyway.

In summary, the security strength and future developable space of the dual-data-port SIM card (corresponding to the structures in fig. 3 and 5) are better than those of the single-data-port SIM card (corresponding to the structures in fig. 2, 4 and 6).

And step 3: construction of data interface and auxiliary tool

And constructing a corresponding data interface according to the card core structure of the dual-core SIM card and the resources on the auxiliary card core. For the dual-data-port SIM card with the structure shown in fig. 3 and 5, a card writer needs to be constructed for completing the downloading of parameters required for the functions of the dual-data-port SIM card by the secondary card core. Fig. 7 is a schematic structural diagram of a card writer for downloading data by a dual-data-port SIM card.

In the process of constructing the data interface, it should be noted that the data interface constructed for implementing the function on the secondary card core cannot be repeated or crossed with the data interface for implementing the function on the primary card core.

Through the three steps, the 'SIM card shield 2.0' taking the SIM card with the card core structure of the dual-core SIM card as a core component can be realized.

Compared with the SIM card shield 1.0, the SIM card shield 2.0 has the following advantages:

the method has the advantages that: the SIM card shield 2.0 can completely avoid the constraint of 'SIM card basic technical specification' on realizing additional functions on the SIM card.

The method has the advantages that: because the SIM card shield 1.0 is limited by the resources in the SIM card, the security processes of encryption/decryption, verification, signature and the like in the SIM card shield 1.0 cannot be completely realized, and the SIM card internalization of core sensitive and sensitive data processing is realized on the SIM card shield 2.0. Therefore, the core sensitive data of the mobile phone application is 'no trace when water passes' at the mobile phone end in the real sense. The mobile phone application protected by the SIM card shield 2.0 does not see any core sensitivity or fragments thereof at the mobile phone end. The characteristic enables all the number stealing viruses which steal the core sensitive data or fragments of the core sensitive data of the mobile phone end applied to the mobile phone to be stolen without stealing, and the operation is always carried out.

The method has the advantages that: the SIM card shield 2.0 constructed based on the structures of fig. 3 and fig. 5 can completely separate the core sensitive data downloading environment of the SIM card shield 2.0 from the usage environment of the SIM card shield 2.0. The separation technology completely prevents the deceptive installation caused by virus attack. This advantage is not present in any current security defense schemes that are implemented without the aid of external hardware conditions.

The advantages are that: the mobile phone application protected by the SIM card shield 2.0 constructed on the basis of the structure of the figure 3 or the figure 5 realizes the perfect hard binding of the mobile phone application account and the mobile phone number, so that the account of the mobile phone application protected by the SIM card shield 2.0 is hijacked into history.

The advantages are that: the construction of the SIM card shield 2.0 can derive various versions that can meet various security requirements by replacing the secondary card core. Thereby breaking the ceiling of the actual SIM card function development caused by the technical specification of the SIM card in service. The technical threshold and the development cost threshold for developing various personalized additional functions on the SIM card of the mobile phone are greatly reduced.

For example. In china, the state-legal cryptographic algorithms are SM1, SM2, SM3, SM4, where the SM1 cryptographic algorithm exists in the form of cryptographic chips. In other words, the application of the SM1 encryption algorithm, which is subject to the national legal security act, must contain SM1 encryption chips in all terminals in its entire system. Because the SIM card core of the single-core structure in service cannot be loaded with the SM1 encryption chip, the SIM card shield 1.0 cannot be used for the application of the mobile phone which is limited by the national legal security law and needs to use the SM1 encryption algorithm. The SIM card shield 2.0 does not have this obstacle. Fig. 8 is a schematic diagram of a dual-core SIM card structure for managing SM1 encryption algorithm chips by a secondary card core. The SIM card shield 2.0 formed by the structure can easily cover all mobile phone applications which are limited by the national security law and need to adopt the SIM1 encryption algorithm.

Claims

1. The utility model provides a card core structure of two core SIM cards which characterized in that: the card core structure consists of two SIM card chips and is encapsulated in the same SIM card at the same time; the two SIM card cores are respectively nominal by a main card core and an auxiliary card core; all resources required for realizing the technical specification of the SIM card in service are carried and managed on the main card core; the auxiliary card core carries and manages all resources required by additional functions which cannot be realized due to the limitation of the technical specification of the active SIM card; the main card core and the auxiliary card core are connected in one of the following three connection modes: mode 1: bridge connection; mode 2: doubling and connecting; mode 3: external control connection; the three connection modes are characterized in that:

bridge connection: the bridge connection is technically characterized in that the auxiliary card core is provided with at least two data ports, one data port is connected with the data port of the main card core, and the other data port is the data port of the SIM card which is finally packaged; the two data ports both meet the technical specification requirements of all SIM card technical specifications on the SIM card data ports; the auxiliary card core does not perform any processing on the data stream which flows through the auxiliary card core and is used for realizing the technical specification function of the in-service SIM card, and only performs different port output; intercepting the data stream input from the data port of the SIM card after encapsulation to realize additional functions on the auxiliary card core, and outputting the data stream from the data port of the SIM card after encapsulation after corresponding processing; data input for realizing additional functions and processed data can not be input into the main card core through the auxiliary card core;

doubling and connecting; the parallel connection is technically characterized in that a data port of a main card core and a data port of an auxiliary card core are connected in parallel, and the main card core and the auxiliary card core have different data addresses respectively; when a CPU outside the packaged SIM card performs data operation on the packaged SIM card, the CPU needs to respectively perform data operation on data addresses corresponding to a main card core or an auxiliary card core;

external control connection; the external control connection is technically characterized in that the data port lines of the main card core and the auxiliary card core and the data port lines of the encapsulated SIM card are converged on a branch structure; the distributing structure has at least one switching control line for controlling the data port line of the SIM card after being packaged, and the switching control line is connected with the data port line of the main card core or the data port line of the auxiliary card core.