CN114760628B - A kind of railway broadband trunking communication system terminal security access method - Google Patents

Abstract

The invention discloses a terminal security access method of a railway broadband trunking communication system, which adds an encrypted interaction process between a client application and a Micro SD card, as well as a client application, railway broadband trunking communication equipment (MC equipment) and security authentication. The interaction process of the gateway, the client application stores encrypted data with the encrypted Micro SD card through the security authentication gateway and binds them one by one, and accesses the system after the client application and the Micro SD card are authenticated interactively, which protects the user Data security reduces the risk of user information leakage due to the proliferation of client applications or the loss of terminal devices.

Description

A kind of railway broadband trunking communication system terminal security access method

technical field

The present invention relates to the technical field of railway wireless communication, in particular to a terminal security access method of a railway broadband trunking communication system.

Background technique

The railway broadband trunking communication system is developed based on the 3GPP critical service communication (MCX) technology. As a solution for the next generation of railway trunking communications, it provides strong support for the intelligentization and broadbandization of railway communications.

The Chinese patent application "A Multimedia Trunking Communication Method, Device and Terminal" with publication number CN110830927A, and the 2018 paper "MCPTT Terminal Software Design and Implementation" by Beijing Institute of Technology all disclose the 3GPP critical service communication (MCX) system. Terminal access plan.

However, the service and bearer of the railway broadband trunking communication system are separated, and the client usually uses the upper-layer application installation package of the terminal, which can be installed and adapted to different types and models of terminal equipment. Because the application installation package of the client is easy to spread, difficult to supervise, and the railway communication equipment is complex, diverse, and widely distributed, the terminal access solution provided by the 3GPP critical business communication (MCX) system cannot meet the terminal access of the railway broadband trunking communication system. security needs.

The terminal equipment of the railway broadband trunking communication system is widely distributed, difficult to supervise, and easy to be maliciously replaced. There is a risk of illegal terminal access to the system and user data being stolen. Since the railway broadband trunking communication system client is provided in the form of an application installation package, the proliferation of railway broadband trunking communication system clients cannot be controlled, and criminals can easily obtain the application installation package, install and use the railway broadband trunking communication system client. If the user's username and password are leaked in some form, and there is no effective access control strategy, there are risks such as leakage of some important data and sensitive information, and malicious attacks on the system.

SUMMARY OF THE INVENTION

The purpose of the present invention is to provide a terminal security access method of a railway broadband trunking communication system, which can reduce the risk of channel being attacked and system being registered and attacked by false name.

The purpose of this invention is to realize through the following technical solutions:

A terminal security access method of a railway broadband trunking communication system, comprising:

The client application in the terminal device performs interactive authentication with the encrypted Mirco SD card. After the interactive authentication is passed, the client application obtains login authentication information from the encrypted Mirco SD card; wherein the Mirco SD card is a flash memory Card;

The client application obtains the encryption certificate through the security authentication gateway, obtains the user configuration information and the login authentication token from the railway broadband trunking communication equipment through the encryption certificate and the log-in authentication information, and sends the information to the railway broadband trunking communication equipment. Service registration is requested, and after successful registration, the terminal device accesses the railway broadband trunking communication system.

It can be seen from the technical solution provided by the present invention that the encrypted interaction process between the client application and the Micro SD card is added, and the interaction process between the client application, the railway broadband cluster communication device (MC device) and the security authentication gateway is added, The client application stores encrypted data with the encrypted Micro SD card through the security authentication gateway, and authenticates and binds them one by one, and accesses the system after the client application and the Micro SD card are interactively authenticated, which protects the security of user data and reduces the risk of The risk of user information leakage due to the proliferation of client applications or the loss of terminal devices.

Description of drawings

In order to illustrate the technical solutions of the embodiments of the present invention more clearly, the following briefly introduces the accompanying drawings used in the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained from these drawings without any creative effort.

FIG. 1 is a flowchart of a method for securely accessing a terminal of a railway broadband trunking communication system according to an embodiment of the present invention;

2 is a flowchart of the interactive authentication between a client application and an encrypted Mirco SD card provided by an embodiment of the present invention;

3 is a flowchart of a client application accessing an MC device according to an embodiment of the present invention;

FIG. 4 is a schematic diagram of the architecture of a railway broadband trunking communication system provided by an embodiment of the present invention;

FIG. 5 is a working state diagram of a Micro SD card security reading and writing device provided by an embodiment of the present invention for reading and writing a Micro SD card.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present invention.

First a description of terms that may be used in this article:

The terms "comprising", "comprising", "containing", "having" or other descriptions with similar meanings should be construed as non-exclusive inclusions. For example: including certain technical characteristic elements (such as raw materials, components, ingredients, carriers, dosage forms, materials, dimensions, parts, components, mechanisms, devices, steps, processes, methods, reaction conditions, processing conditions, parameters, algorithms, signals, data, products or products, etc.), should be construed to include not only certain technical feature elements explicitly listed, but also other technical feature elements known in the art that are not explicitly listed.

The following describes in detail a method for secure terminal access of a railway broadband trunking communication system provided by the present invention. Contents that are not described in detail in the embodiments of the present invention belong to the prior art known to those skilled in the art. If the specific conditions are not indicated in the examples of the present invention, it is carried out according to the conventional conditions in the art or the conditions suggested by the manufacturer.

As shown in Figure 1, a method for secure terminal access of a railway broadband trunking communication system mainly includes the following steps:

Step 1. The client application performs interactive authentication with the encrypted Mirco SD card.

In the embodiment of the present invention, the client application performs interactive authentication with the encrypted Mirco SD card, and after the interactive authentication is passed, the client application obtains login authentication information from the encrypted Mirco SD card; wherein the Mirco SD card is a fast flash memory card.

Step 2. The client application accesses the MC device through the security authentication gateway.

The client application obtains the encryption certificate through the security authentication gateway, obtains the user configuration information and the login authentication token from the railway broadband trunking communication equipment through the encryption certificate and the log-in authentication information, and sends the information to the railway broadband trunking communication equipment. Service registration is requested, and after successful registration, the terminal device accesses the railway broadband trunking communication system.

In the embodiment of the present invention, the terminal equipment is the equipment installed with the client application. In addition to the railway broadband trunking communication equipment mentioned in the present invention, the railway broadband trunking communication system also includes a series of other server equipment. The interaction process between terminal equipment and railway broadband trunking communication equipment is introduced, so other server equipment is not mentioned.

After the above steps are passed, confidentiality and integrity protection can be provided for the trunked voice, trunked data or trunked video communication services between the client application and the MC device. The secure access method can reduce risks such as leakage of user data, illegal access to the system after the identity of the terminal user is disguised, and attacks on the communication channel.

For ease of understanding, preferred implementations of the above steps 1 and 2 are described below.

1. Interactive authentication between client application and encrypted Mirco SD card.

As shown in Figure 2, it shows the flow chart of the interactive authentication between the client application and the encrypted Mirco SD card, which mainly includes the following steps:

Step 11. The client application successfully recognizes the encrypted Micro SD card and obtains an authentication certificate.

After the terminal device is powered on, the client application identifies whether the encrypted Micro SD card is correctly inserted into the terminal device; if the encrypted Micro SD card is correctly inserted, the encrypted Micro SD card authentication and authentication information is read from the encrypted Micro SD card, It is used for the subsequent security authentication gateway to verify the encrypted Micro SD card.

Step 12: The client application transmits the authentication certificate of the encrypted Micro SD card to the security authentication gateway, and receives the authentication certificate replied by the security authentication gateway.

After the client application obtains the encrypted Micro SD card authentication and authentication information, it sends a linked list request to the security authentication gateway according to the routing table. The information in the linked list request includes the encrypted Micro SD card authentication and authentication information. After receiving the linked list request from the client application, the security authentication gateway decrypts the authentication and authentication information of the Micro SD card and verifies the authenticity of the authentication and authentication information. If the authentication verification of the Micro SD card is correct, the encrypted client application authentication certificate corresponding to the information is sent to the client application, indicating that the authentication and authentication information is correct. If there is an error in the authentication and verification of the Micro SD card, the failure information is sent to the client application, and the client application stops subsequent work and displays the failure reason to the end user.

Step 13: The client application writes the authentication certificate to the encrypted Micro SD card for verification.

The client writes the authentication certificate into a designated location in the encrypted Micro SD card, and the encrypted Micro SD card decrypts and verifies the authentication certificate. If the verification of the authentication certificate is successful, the client application and the encrypted Micro SD card have completed the two-way authentication and authentication, and the end user is prompted that the encrypted Micro SD card connection authentication is successful and the subsequent process is continued. If the verification of the authentication certificate fails, the end user will be prompted that the encryption of the Micro SD card has failed and the subsequent process will be stopped.

In the embodiment of the present invention, the encrypted information exchanged between the Micro SD card and the security authentication gateway when the identity is activated before use will leave corresponding encryption and decryption information on the Micro SD card and the security gateway (which will be described later). Steps 11 to 13 are the two-way authentication of the encrypted Micro SD card through the client application and the security authentication gateway. The client application will have its own judgment response to the results returned by both parties. The encrypted Micro SD card is also reserved when the identity is activated at this stage. Encryption and decryption information Encrypt and decrypt information.

Step 14: The client application acquires and verifies the IMEI information stored in the terminal device and the encrypted Micro SD card.

After the encrypted Mirco SD card successfully passes the two-way authentication, the client obtains the IMEI (International Mobile Equipment Identity) information from the terminal equipment system, and obtains the pre-stored IMEI information from the encrypted Micro SD card, and then checks and obtains Whether the two IMEI information matches; if the two IMEI information matches, the client application completes the mutual authentication with the encrypted Mirco SD card. If the IMEI information does not match, the end user will be prompted that the encrypted Micro SD card does not match. It is necessary to verify the correct encrypted Micro SD card and stop the subsequent process.

Step 15: The client application obtains the login authentication information stored in the encrypted Micro SD card.

The client application obtains the encrypted login authentication information from the specified location in the encrypted Micro SD card, including the user name and password required to log in to the system. The client application decrypts the login authentication information, and then enters the step of accessing the MC device.

In the embodiment of the present invention, the client application interacts with the encrypted Micro SD card to obtain corresponding encryption and decryption key information, so as to decrypt various encrypted information from the encrypted Micro SD card.

In the embodiment of the present invention, the encrypted Micro SD card can be divided into multiple storage areas as required, and different storage areas store different types of data. The present invention is not limited.

2. Access MC equipment.

After the client application completes and encrypts the mutual authentication of the Micro SD card and obtains the login user name and password, it needs to access the MC device. After that, the user of the terminal device can realize cluster voice communication and cluster data through the client application and the MC device. Communication and trunking video communication services. The process of accessing the MC device by the client application is shown in Figure 3, which mainly includes:

Step 21: The client application obtains a transmission channel encryption certificate from the security authentication gateway.

When the client application exchanges information with the MC device, it needs to encrypt and decrypt the exchanged information. For encryption and decryption, the security authentication gateway needs to provide encryption certificates for different terminal devices. Therefore, the client application needs to send the encryption certificate application information to the security authentication gateway, and the security authentication gateway sends the encryption certificate to the client application and the corresponding railway broadband trunking communication device after parsing and verifying the application encryption certificate information; The encryption certificate includes: user identity information of the terminal device and the validity period of the encryption certificate.

Step 22: The client application initiates service authentication to the MC device, and obtains user configuration information and a login authentication token.

In the embodiment of the present invention, after the client application encapsulates the login authentication information according to a set protocol standard (for example, 3GPP protocol standard), the encapsulated information is encrypted by an encryption certificate, and is directly transmitted to the railway broadband The trunking communication device (that is, the encrypted information does not need to be transmitted through the security authentication gateway), performs user login authentication through the MC device; and receives the result fed back by the railway broadband trunking communication equipment.

In the embodiment of the present invention, the login authentication information is the user name and password obtained before, and they are the user name and password pre-configured in the database before the user's identity is activated. After receiving the encrypted information, the MC device decrypts it through the encryption certificate, and verifies whether the user name and password in the information are correct. If the user name and password in the verification information of the MC device are correct, the encrypted user configuration information and the login authentication token are sent to the client application. Wherein, the user configuration information is the user configuration pre-set in the database by the MC device before the user's identity is activated.

Step 23: Parse and verify the login authentication token, and request service registration.

In the embodiment of the present invention, the client application parses out the user configuration information and the login authentication token through the encrypted certificate, encrypts and stores the user configuration information in the encrypted Micro SD card, and verifies the login authentication token; If the authentication token is correct, the parsed login authentication token is encrypted and sent to the railway broadband trunking communication equipment to request service registration, so that the corresponding terminal user completes the system service registration. After completing the service registration, the client application reads part of the user data generated by the previous service through the encrypted Micro SD card and displays it on the screen of the terminal device. The part of the user data includes: address book, past call records and data services inbox.

3. Confidentiality and integrity protection of business.

Through the solutions introduced in the first and second parts above, the access of terminal equipment can be realized. After that, services including trunking voice, trunking data and trunking video can be initiated through the client application. In the process of each service, the client application and The information transmitted between the railway broadband trunking communication equipment is encrypted by the encryption certificate provided by the security authentication gateway. After receiving the encrypted data, the client application and the railway broadband trunking communication equipment decrypt the plaintext data that meets the set protocol standard (for example, the 3GPP protocol standard) through the encryption certificate, and complete the communication of various services according to the set protocol standard. When the business process ends, the client application displays part of the user data generated by the service on the screen of the terminal device, the part of the user data includes: address book, past call records and data service inbox; The data is encrypted and synchronized to the encrypted Micro SD card, and all user data includes: address book, past call records, data service inbox, voice recording and video recording.

The above is the main solution of the terminal security access method of the railway broadband trunking communication system provided by the present invention. Figure 4 shows the architecture of the railway broadband trunking communication system. The railway broadband trunking communication system adds a security authentication gateway, a Micro SD card security reading and writing device (not shown in Figure 3) and The number of encrypted Micro SD cards matches the terminal, and the encrypted interaction process with the Micro SD card is added in the client application and the interaction process with the security authentication gateway is added in the client application and MC device (that is, the aforementioned steps 1~ step 2).

Figure 5 shows the working state diagram of the Micro SD card security reading and writing device reading and writing the Micro SD card. As shown in Figure 4, the Micro SD card security read and write device includes a human-computer interaction module and an SD card security write and output module. The encrypted Micro SD card needs to be activated by the Micro SD card security read-write device based on the user identity information and the terminal device before the terminal device is used. The identity activation step includes: inserting the encrypted Mirco SD card into the SD card safe writing output module of the Micro SD card safe reading and writing device, and inputting the information of the terminal device through the human-computer interaction module of the Micro SD card safe reading and writing device. The user identity information and the IMEI information of the terminal device are then interacted with the security authentication gateway to perform data security encryption. After the encryption is completed, the encrypted information is written into the encrypted Micro SD card through the SD card security write output module to complete the identity activation.

In the embodiment of the present invention, the user identity information and IMEI information are mainly encrypted through the security authentication gateway. On the one hand, the encrypted information type can also be adaptively adjusted according to requirements; (for example, step 14 described above), the client application extracts the relevant encrypted information and decrypts it. The encryption and decryption algorithms involved in the security authentication gateway, encrypted Mirco SD card and client applications in this part are all matching algorithms, and they all have the corresponding encryption and decryption key information, which can accurately encrypt and decrypt information; considering that The encryption and decryption algorithms involved in this part can be implemented using conventional algorithms, so they will not be described in detail.

In addition, when the terminal device is used up, take out the encrypted Micro SD card and connect it to the Micro SD card safe reading and writing device; after interacting with the security authentication gateway to decrypt the data, the encrypted Micro SD card can be written to the output module through the SD card safe writing output module. The stored data in the card can be exported or viewed directly through the human-computer interaction module of the Micro SD card security read-write device. The stored data includes: call recording, video recording, receipt information and call records.

The terminal security access method of the railway broadband trunking communication system provided by the embodiment of the present invention can protect the following situations:

1. The communication channel is attacked.

If no protection measures are taken in the channel, the service signaling and user data are completely transmitted in plain text. Once the communication channel is attacked, the entire transmission data is at risk of being destroyed. The terminal security access method provides channel security protection, and the transmission signaling is transmitted in the form of cipher text throughout the whole process, which reduces the risks of user data leakage and signaling tampering caused by the communication channel being attacked.

2. The client application and login username and password are leaked.

If no secure access method is adopted when the client application and login user name and password of the railway broadband trunking communication system are leaked, the user identity will be disguised and then illegally accessed, resulting in unreliable information sources and information theft. The terminal security access method relies on the two-way authentication with the encrypted Micro SD card when starting the client application, which can prevent the normal use of the client application that does not recognize the encrypted Micro SD card, thereby preventing the user identity from being disguised.

3. The encrypted Micro SD card is lost.

The encrypted Micro SD card stores user login authentication information and user data, but all data is encrypted by an encryption algorithm, and the encryption key is stored in the security authentication gateway, and the stored information cannot be cracked only by encrypting the Micro SD card. Even if the encrypted Micro SD card is lost, the security of user identity and user data is guaranteed.

4. The client application is leaked and the encrypted Micro SD card is lost.

When the user identity is activated on the encrypted Micro SD card, in addition to logging in the user authentication information, the International Mobile Equipment Identity (IMEI) of the terminal device is also burned. After the client application performs two-way authentication with the encrypted Micro SD card, the It is necessary to read the IMEI information in the encrypted Micro SD card and compare it with the IMEI obtained from the terminal device. This prevents user identity from being spoofed.

5. The terminal device with the client application installed and the corresponding encrypted Micro SD card are lost.

When the terminal device installed with the client application and the corresponding encrypted Micro SD card are lost, the user of the terminal device will quickly perceive and report it to the railway broadband trunking communication system administrator, and the system administrator can clear the user's authentication in the security authentication gateway information, thereby preventing the subsequent acquisition of services and user data initiated by the terminal device. Then, modify the user's login password on the MC device to prevent subsequent login operations of the terminal device.

6. Forge the client application, and at the same time the login user name and password are leaked.

Because the protocol standards for trunked voice (MCPTT), trunked data (MCData), and trunked video (MCVideo) quoted by 3GPP are open, attackers can forge client applications through the protocol standards, bypass the interactive authentication process of encrypted Micro SD cards, and pass the leaked Username and password to try to log in directly. The terminal security access method realizes the encryption of the transmitted data through the security authentication gateway, and the plaintext signaling system that meets the 3GPP protocol standard will not respond during the transmission process. A fake client application cannot log into the system or steal relevant user data.

From the description of the above embodiments, those skilled in the art can clearly understand that the above embodiments can be implemented by software or by means of software plus a necessary general hardware platform. Based on this understanding, the technical solutions of the above embodiments may be embodied in the form of software products, and the software products may be stored in a non-volatile storage medium (which may be CD-ROM, U disk, mobile hard disk, etc.), including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute the methods described in various embodiments of the present invention.

The above description is only a preferred embodiment of the present invention, but the protection scope of the present invention is not limited to this. Substitutions should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims (10)

1. A terminal security access method of a railway broadband trunking communication system is characterized by comprising the following steps:

the method comprises the steps that a client application in the terminal equipment carries out interactive authentication with an encrypted Mirco SD card, and when the interactive authentication is passed, the client application acquires login authentication information from the encrypted Mirco SD card; wherein, the Mirco SD card is a flash memory card;

the client application acquires an encryption certificate through a security authentication gateway, acquires user configuration information and a login authentication token from the railway broadband trunking communication equipment through the encryption certificate and the login authentication information, requests service registration from the railway broadband trunking communication equipment, and accesses the terminal equipment to the railway broadband trunking communication system after the service registration is successful.

2. The terminal security access method of the railway broadband trunking communication system of claim 1, wherein after the terminal device is powered on, the step of performing interactive authentication between the client application and the encrypted Mirco SD card comprises:

the encryption Mirco SD card carries out bidirectional authentication and certification with the security certification gateway through client application, when the client successfully passes the bidirectional authentication and certification, the client acquires IMEI information from a terminal equipment system, acquires prestored IMEI information from the encryption Micro SD card, and verifies whether the acquired IMEI information is matched or not; wherein the IMEI represents an international mobile equipment identity; if the two IMEI information are matched, the client application and the encrypted Mirco SD card complete interactive authentication, and the client application acquires encrypted login authentication information from the encrypted Micro SD card, wherein the authentication information comprises the following steps: the username and password required to log in to the system.

3. The terminal security access method of the railway broadband trunking communication system according to claim 2, wherein the step of bidirectional authentication and authentication between the client application and the encrypted Mirco SD card comprises:

after the terminal equipment is started, the client application identifies whether the terminal equipment is correctly inserted into the encrypted Micro SD card; if the encrypted Micro SD card is correctly inserted, reading the encrypted Micro SD card authentication information from the encrypted Micro SD card;

the client application sends a linked list request to a security authentication gateway according to a routing table, wherein information in the linked list request comprises encrypted Micro SD card authentication information, and receives reply information fed back by the security authentication gateway; when the reply information is an authentication certificate, the encrypted Micro SD card authentication information is correct;

and the client writes the authentication certificate into an encrypted Micro SD card, the encrypted Micro SD card verifies the authentication certificate, and if the authentication certificate passes the verification, the security authentication gateway and the encrypted Mirco SD card successfully pass the bidirectional authentication.

4. The terminal secure access method of the railway broadband trunking communication system of claim 1, wherein the client application obtaining the encryption certificate through the secure authentication gateway comprises:

the client application sends information of applying for an encrypted certificate to the security authentication gateway, and the security authentication gateway analyzes and verifies the information of applying for the encrypted certificate and then respectively sends the encrypted certificate to the client application and corresponding railway broadband trunking communication equipment; the encryption certificate includes: user identity information of the terminal equipment and the validity duration of the encryption certificate.

5. The terminal security access method of the railway broadband trunking communication system of claim 1, wherein the obtaining of the user configuration information and the login authentication token from the railway broadband trunking communication device through the encryption certificate and the login authentication information comprises:

after the client application packages the login authentication information according to a set protocol standard, the packaged information is encrypted through an encryption certificate and is transmitted to the railway broadband trunking communication equipment;

receiving a result fed back by the railway broadband trunking communication equipment; if the login authentication information is correct, the result fed back contains the encrypted user configuration information of the terminal equipment and the login authentication token.

6. The terminal security access method of the railway broadband trunking communication system of claim 1, wherein the requesting service registration from the railway broadband trunking communication device comprises:

the client application analyzes user configuration information and a login authentication token through an encryption certificate, encrypts and stores the user configuration information into an encrypted Micro SD card, and verifies the login authentication token; and if the login authentication token is correct, encrypting the analyzed login authentication token and then sending the encrypted login authentication token to the railway broadband trunking communication equipment for requesting service registration so that the corresponding terminal user completes the service registration of the system.

7. The terminal secure access method of the railway broadband trunking communication system of claim 1 or 6, wherein after the service registration is completed, the client application reads a part of user data generated by a previous service through the encrypted Micro SD card and displays the part of user data on a terminal device screen, wherein the part of user data comprises: address book, past call log, and data service inbox.

8. The terminal security access method of the railway broadband trunking communication system according to claim 1 or 6, wherein after the service registration is completed, the client application can initiate services including trunking voice, trunking data and trunking video, and in each service process, information transmitted between the client application and the railway broadband trunking communication device is encrypted by an encryption certificate provided by the security authentication gateway;

after the client application and the railway broadband trunking communication equipment receive the encrypted data, clear text data meeting the set protocol standard is decrypted through the encrypted certificate, and communication of each service is completed according to the set protocol standard;

after the service flow is finished, the client application displays part of user data generated by the service on a screen of the terminal equipment, wherein the part of user data comprises: an address book, a past call record and a data service inbox; and encrypting and synchronizing all user data generated by the service into the encrypted Micro SD card, wherein the all user data comprises: address book, past call log, data service inbox, voice recording, and video recording.

9. The terminal security access method of the railway broadband trunking communication system of claim 1, further comprising: the identity activation is carried out on the encrypted Mirco SD card in advance through a Micro SD card safety read-write device, and the method comprises the following steps:

inserting the encrypted Mirco SD card into an SD card secure write-in output module of the Micro SD card secure read-write equipment, and inputting user identity information of the terminal equipment and IMEI information of the terminal equipment through a man-machine interaction module of the Micro SD card secure read-write equipment, wherein the IMEI represents an international mobile equipment identification code;

and then, data security encryption is carried out by interaction with the security authentication gateway, after encryption is finished, the encrypted information is written into the encrypted Micro SD card through the SD card security write-in output module, and identity activation is finished.

10. The terminal security access method for the railway broadband trunking communication system according to claim 9, further comprising: after the terminal equipment is used, taking out the encrypted Micro SD card and accessing the encrypted Micro SD card to the Micro SD card safety read-write equipment; after data decryption is carried out by interaction with the security authentication gateway, the storage data in the encrypted Micro SD card can be exported through the SD card security write-in output module or directly checked through the man-machine interaction module of the Micro SD card security read-write equipment, and the storage data comprises: call recording, video recording, receiving information and call recording.

Images