WO2013167082A2

WO2013167082A2 - Digital certificate function implementation method for mobile terminal and mobile terminal

Info

Publication number: WO2013167082A2
Application number: PCT/CN2013/080133
Authority: WO
Inventors: 陈颖; 缪海翔; 马少峰
Original assignee: 中兴通讯股份有限公司
Priority date: 2012-11-22
Filing date: 2013-07-25
Publication date: 2013-11-14
Also published as: WO2013167082A3; CN103023642B; CN103023642A

Abstract

Disclosed is a digital certificate function implementation method for a mobile terminal. The method comprises: after the mobile terminal accesses a PC side through a USB interface, the mobile terminal powering on and starting up, and initializing a USB port; and the PC side judging whether a new USB device connection exists, and if yes, mapping the port onto the USB interface, a smart card which stores a digital certificate in the mobile terminal interacting with a PC side drive through a smart card management module, and the PC side drive starting up a digital certificate client. The present invention integrates a digital certificate function in a mobile terminal, thereby greatly facilitating a user in using same.

Description

Method for realizing digital certificate function of mobile terminal and mobile terminal

The present invention relates to the field of communications technologies, and in particular, to a mobile terminal digital certificate function implementation method and a mobile terminal. Background technique

In the process of expanding the wireless network card service, mobile communication operators are developing enterprise users and providing wireless Internet services for enterprise users. It allows users to access the network in any place with signal coverage, access to the intranet, and go through the business without using a fixed office location, through mobile terminals such as mobile phones, wireless network cards, and PADs. It is as convenient and simple to operate through the intranet. However, at the same time, problems have arisen, and the guarantee of information security has become a top priority. Especially when logging in to the corporate network from the Internet, the security risks are very high. Information disclosure, viruses, malicious attacks, etc., can happen. For example, in order to develop users, domestic operators are preparing to launch a specially customized wireless network card (data card) for the government network. Operators require data cards to have common business functions (including Internet access, text messages, etc.). USBKey digital certificate function, when the user accesses the ordinary information of the ordinary website or the government network, identity authentication is not required, but when the government staff or authorized personnel want to log in to the government network for confidential information, identity authentication is required.

In order to ensure the security of wireless communication, the operator user proposes a method of using a digital certificate. However, digital certificates require storage media (such as software, CD-ROM, USBKey, etc.), which means that when users want to use the mobile terminal to securely access the Internet, they need to carry two devices, a wireless Internet device and a digital certificate, and also require The Internet terminal device must have two interfaces at the same time, one is used by the network card, and the other is used for digital certificates. It is inconvenient to carry and use, and the use cost is also increased. To solve the above problems, this article provides a wireless network card and digital certificate. The method of combining books into one.

First, a brief introduction to the background technology related to digital certificates. Digital certificate technology is a general term for encryption technology based on digital certificates. The digital certificate is issued by the Certification Authority (CA), and the CA is an authoritative, fair and trustworthy third party. Its role is crucial.

For the issuance and management of digital certificates, the user must carry the relevant documents to the certificate acceptance point of each place, or go directly to the certificate issuing authority, CA Center, to fill out the application form and conduct identity verification. After the approval, the relevant media with the certificate can be obtained. , IC card or USBKey, etc.) and a password envelope with a password.

Format and storage of digital certificates. Currently, the format of digital certificates is generally based on the X.509V3 international standard, including the serial number of the certificate, the name of the certificate holder, the name of the certificate issuer, the validity period of the certificate, the number of the certificate, and the number of the certificate issuer. Signature, etc. Digital certificates are usually placed on a storage medium as a file. The certificate with the private key is defined by the PKCS# 12 (Public Key Cryptography Standards #12) standard, with pfx as the certificate file suffix. The digital certificate in the cer format has only the public key and no private key.

The application of digital certificates, according to the application perspective, digital certificates can be divided into: server certificates, email certificates and client certificates. In this paper, only the implementation of client certificates is involved. Client certificates are primarily used for authentication and electronic signatures. The client certificate is stored in a dedicated storage medium, such as an IC card or a Key, and USBKey is the most common storage medium. The certificate in the storage medium cannot be exported or copied, and the storage medium needs to be input with the protection password of the storage medium. When using this certificate, it is necessary to physically obtain its storage medium, and it is necessary to know the protection password of the storage medium, which is also called two-factor authentication. This type of authentication is one of the most secure authentication methods on the Internet. The process of using the digital certificate is as follows: When using a digital certificate for identity authentication, it will randomly generate a 128-bit identity code, and each digital certificate can generate a digital number corresponding to each other, which is impossible to ensure the confidentiality of data transmission. Sex, which is equivalent to generating a complex password. Summary of the invention

The purpose of the embodiments of the present invention is to provide a mobile terminal digital certificate function implementation method and a mobile terminal integrating the digital certificate function.

The embodiment of the present invention provides a method for implementing a digital certificate function of a mobile terminal, where the method includes: after the mobile terminal accesses a PC through a USB interface, the mobile terminal is powered on, initializes a USB port, and the PC determines Whether there is a new USB device connection, if there is a new device, the port is mapped to the USB interface, and the smart card storing the digital certificate in the mobile terminal interacts with the PC side through the smart card management module, and the PC side driver starts the digital certificate. The client is running.

Preferably, the smart card storing the digital certificate interacts with the smart card management module through the IS07816 protocol.

Preferably, the smart card management module initiates a transparent transmission interaction through the MCSP/PKCS11 protocol through the board side driver of the mobile terminal and the digital certificate PC side driver of the PC side, and starts the digital certificate client.

Preferably, the smart card is a UICC, and the port includes an AT port, a Modem port, and a standard USB device interface.

Preferably, the digital certificate client initiates a digital certificate operation by operating a command MCSP/PKCS11 data packet.

In addition, the embodiment of the present invention further provides a mobile terminal, where the mobile terminal includes a smart card, a smart card management module, and a board side driver;

The smart card stores a digital certificate;

The smart card management module implements operation on the smart card digital certificate, and the smart card management module and the smart card communicate through a standard protocol;

The board side driver interacts with the digital certificate PC side driver through a protocol to start the digital certificate client.

Preferably, the smart card storing the digital certificate is managed by the IS07816 protocol and the smart card. Module interaction.

Preferably, the smart card management module starts the digital certificate client by using a board side driver of the mobile terminal and a digital certificate pc side driving interaction on the PC side.

Preferably, the smart card is a UICC card.

In summary, the embodiment of the present invention has the following beneficial effects:

Compared with the prior art, with the method and the mobile terminal according to the embodiment of the present invention, the mobile terminal has a digital certificate function, and it is unnecessary to add a new digital certificate device, which is greatly convenient for the user to use. DRAWINGS

1 is a schematic diagram showing the composition of a digital certificate for implementing a wireless internet data card according to an embodiment of the present invention; FIG. 2 is a schematic diagram showing the composition of a digital certificate implemented by the mobile phone according to an embodiment of the present invention;

3 is a schematic diagram showing the composition of a digital certificate implemented by a PAD according to an embodiment of the present invention;

4 is a schematic flowchart of a method for implementing data channel creation between a digital certificate client and a mobile communication terminal according to an embodiment of the present invention;

FIG. 5 is a schematic diagram of an implementation process of a digital certificate operation process according to an embodiment of the present invention. detailed description

Embodiments of the present invention provide a method for implementing a digital certificate function of a mobile terminal and a mobile communication terminal having a digital certificate function. The core idea of the embodiment of the present invention is implemented by using a software method without performing hardware modification of the mobile communication terminal device. The method described in this paper involves the following key issues: How to store digital certificates on a mobile terminal, how to read and write digital certificates stored on mobile terminals, and how digital certificates are applied on mobile terminals.

The storage of digital certificates. Common digital certificate storage media are in a disk, IC card or USBKey. Throughout the mobile communication terminal device, a component that can be used to store a digital storage medium and is indispensable for the terminal device is not a UICC. The UICC is a removable smart card used to store information such as operator subscription information, authentication keys, phone books, and short messages. The UICC can include a variety of logical applications, such as a Subscriber Identity Module (SIM), a Universal Subscriber Identity Module (USIM), and an IP Multimedia Service Identity Module (ISIM). The UICC digital certificate is very similar to the USBKEY digital certificate. The main difference is the difference in the external hardware interface. The hardware interface of the USBKEY is a USB port, and the hardware interface of the UICC is a UICC-terminal interface. In order to realize the digital certificate function, in addition to providing the storage space of the digital certificate, UICC also needs to have the RSA hardware coprocessor to support the asymmetric algorithm encryption function.

The production and distribution of such special digital certificates differs from the production of ordinary digital certificates by the following points:

The mobile service operator first needs to create a special UICC card for the designated group users. In addition to storing information about the telecommunication service, the card can also provide security services such as RSA algorithm, identity authentication, data addition and decryption, and provide Digital certificate storage space.

The enterprise where the group user is located shall apply for a digital certificate for each customer. After the certification center CA has produced the digital certificate, the digital certificate is stored in the UICC card;

The operator issues a mobile communication terminal to the group customer, and a mobile communication terminal with a digital certificate. Reading and application of digital certificates. The operation of the digital certificate is realized by encrypting the device management interface, and is used for managing the encryption device in the form of hardware or software, realizing data encryption, decryption, digital signature, verification and data digest (ie HASH), Fig. 1 - Fig. 3 It is the implementation framework of the encryption device interface in this solution. There are currently two common encryption device management interfaces, one is the PKCS#11 standard interface, and the other is the CSP (Cryptographic Service Provider) standard interface developed by Microsoft. The digital certificate on the mobile communication terminal should be used normally, and the following contents need to be implemented: The digital certificate client (PC/AP side application) remains unchanged; Provides mobile communication terminal device drivers, including PC side drivers and board side drivers. The operations of the digital certificate client (PC/AP side application) on the digital certificate are implemented by the MCSP protocol or the PKCS11 protocol, and the operations are transparently transmitted to the board side driver through the PC side driver.

The UICC management module needs to implement the operation of the UICC digital certificate. The UICC management module communicates with the UICC through the IS07816 standard protocol. The MCSP protocol or PKCS 11 protocol packet passed between the two is first packaged into the IS07816 standard package and then transmitted.

Please refer to Figure 1 - Figure 3, where Figure 1, Figure 2, Figure 3 are the wireless data card, mobile phone, PAD connection.

Please refer to FIG. 1 for a design scheme of a wireless internet data card having a digital certificate function, and the wireless internet data card includes a board side driver, a UICC management module, and a UICC digital certificate. The UICC management module and the UICC digital certificate interact through the IS07816 protocol. The PC side includes a digital certificate PC side driver and a digital certificate client. The digital certificate PC side driver and the digital certificate client interact through the MCSP protocol.

Please refer to FIG. 2, which is a design scheme of a mobile phone having a digital certificate function, and the mobile phone includes a mobile digital certificate client, a UICC management module, and a UICC digital certificate. The UICC management module and the UICC digital certificate are exchanged through the IS07816 protocol, and the UICC management module and the mobile digital certificate client interact through the PKCS 11 protocol.

Please refer to FIG. 3, which is a design scheme of the PAD having a digital certificate function, and the PAD includes an AP side and a wireless network module. The AP side includes a digital certificate AP side driver and a digital certificate client. The digital certificate AP side driver and the digital certificate client interact through the MCSP protocol. The wireless internet module includes a board side driver, a UICC management module, and a UICC digital certificate. The UICC management module and the UICC digital certificate are exchanged through the IS07816 protocol. The board side driver and the digital certificate AP side driver interact through the MCSP/PKCS11 protocol.

As shown in FIG. 4, the implementation method of the data channel creation between the digital certificate client and the mobile communication terminal is as follows: Step 101: Determine whether it is a mobile terminal, if yes, the process ends, if not, then proceeds to step 102;

If the mobile communication terminal device is a mobile phone terminal, the digital certificate client and the UICC management module are all on the same mobile phone platform, and can directly communicate, and the USB interface driver is not required to perform the transfer.

Step 102: The hardware connection between the PC/AP side and the mobile communication terminal adopts a USB interface; the terminal device is a wireless network card or a PAD other than the mobile phone, and the connection between the PC/AP side and the mobile communication terminal is USB. interface.

Step 103: judging whether the initialization USB interface is normal, if it is normal, then proceeds to step 104, if not, then proceeds to step 106;

After the mobile communication terminal device is connected to the PC through the USB interface, the device first powers on, and then initializes the USB port. The PC determines if there is a new USB device connection. If there is a new device to access, go to step 104; otherwise, no new USB device is connected, go to step 106;

Step 104: Map the AT port, the Modem port, and the standard USB device port to the USB port; the board side driver performs an enumeration (Enumerate) operation, and maps the AT port, the Modem port, and the standard USB device interface service to the USB port. In addition to the AT port and Modem port, the board-side driver of the mobile communication terminal device needs to support the standard USB device interface in order to implement the digital certificate function. The AT port and Modem port are used for the general functions of the mobile terminal device (online, short message, phone book, etc.), and the standard USB interface is used for the digital certificate function. Standard USB device driver, provided by the operating system. Using a standard USB device driver, the PC-side digital certificate client can be guaranteed to support both the ordinary USBKey digital certificate and the digital certificate on the mobile terminal device without any modification.

Step 105: Determine whether the port mapping is successful, if successful, then proceeds to step 107, if not, then proceeds to step 106;

Step 106: The data channel creation failed.

Step 107: The data channel is created successfully. As shown in FIG. 5, it is a schematic flowchart of the implementation process of the digital certificate operation process in the embodiment of the present invention, and the specific implementation steps are as follows:

Step 201: The digital certificate client initiates a digital certificate operation, and the operation command is an MCSP/PKCS11 data packet;

The digital certificate client initiates a digital certificate related operation, and the operation between the digital certificate client and the ordinary USBKey type digital certificate is performed by the MCSP/PKCS11 protocol, so the operation command is the MCSP/PKCS 11 data packet.

Step 202: Determine whether the terminal is a mobile phone, if yes, go to step 206, if not, go to step 203;

Step 203: The PC/AP side driver and the board side driver transparently transmit the MCSP/PKCS11 protocol; Step 204: The PC/AP side driver packages the MCSP/PKCS11 protocol data packet to the USB data packet, and then sends the data packet to the mobile communication terminal device;

In order to ensure that the original digital certificate client is not modified, the PC/AP side driver and the board side driver will transparently transmit the MCSP/PKCS11 protocol;

After receiving the MCSP/PKCS 11 protocol data packet addressed to the mobile communication terminal device, the PC/AP side driver packages the data packet directly into the USB format and then sends it to the mobile communication terminal device. The package format is as follows:

MCSP/PKCS 11 data

^ V ~

USB data packet header USB data packet body Step 205: The board side driver receives the USB packet, takes out the MCSP/PKCS 11 protocol data packet, and forwards it to the UICC management module;

The board side driver of the mobile communication terminal device receives the USB data packet from the standard USB device interface, removes the USB packet header, and extracts the MCSP/PKCS 11 protocol data packet from the package body, and forwards it to the UICC management module; Step 206: After receiving the MCSP/PKCS1 protocol data packet, the UICC management module packages the IS07816 standard data packet and forwards it to the UICC.

After receiving the MCSP/PKCS1 data packet, the UICC management module does not process the data, and directly packages it according to the IS07816 standard format and sends it to the UICC. The package format is as follows:

CLA INS PI P2 Lc Data Le

J

IS07816 protocol packet header IS07816 protocol packet body

The package body is defined as follows:

Step 207: The UICC extracts the MCSP/PKCS11 data packet from the IS07816 standard data packet, and performs corresponding operations according to the content of the package;

The UICC processes the received IS07816 data packet, and extracts the MCSP/PKCS 11 data packet from it, and the UICC performs the corresponding operation according to the specific content of the MCSP/PKCS1 l data packet;

Step 208: The UICC returns an operation response result, and the operation result is an MCSP/PKCS1 l data packet. Step 209: The UICC packages the MCSP/PKCS11 data packet into the IS07816 data packet, and then returns it to the UICC management module.

The format of the response packet is as follows:

Data SW1 SW2

IS07816 response packet data field Reply packet status word

The data field is optional. The response packet consists of at least one status word. The status word indicates the processing status of the command, that is, whether the command is executed correctly. If it is not executed correctly, the reason is.

SW1 : indicates the command processing status; SW2: indicates the command processing limit;

Step 210: Determine whether it is a mobile terminal, if the mobile communication terminal device is a mobile phone terminal, go to step 214, otherwise the terminal device is a wireless internet data card and a PAD, go to step 211;

Step 211: The UICC management module extracts the MCSP/PKCS 11 data packet from the IS07816 data packet and transmits the data packet to the board side driver.

Step 212: The board side driver drives the MCSP/PKCS11 data packet into the USB data packet, and sends it to the PC/AP side through the standard USB device interface;

Step 213: After receiving the USB data packet, the PC/AP side driver extracts the MCSP/PKCS11 data packet from the driver, and transmits the data packet to the digital certificate client.

Step 214: The digital certificate client analyzes the MCSP/PKCS11 data packet, and performs corresponding operations according to the response result of the UICC;

The digital certificate operation process is completed.

The above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention. Industrial Applicability Compared with the prior art, the embodiment of the present invention combines a wireless network card and a digital certificate into one, so that the mobile terminal has a digital certificate function, and the integrated digital certificate function is shifted. The mobile terminal, therefore, the invention can eliminate the need to add a new digital certificate device, which is greatly convenient for the user to use.

Claims

Claim

A method for implementing a digital certificate function of a mobile terminal, the method comprising: after the mobile terminal accesses the PC side through a USB interface, the mobile terminal is powered on, initializes a USB port, and the PC side determines whether there is a new USB The device is connected, and if there is a new device, the port is mapped to the USB interface, and the smart card storing the digital certificate in the mobile terminal interacts with the PC side through the smart card management module, and the PC side driver starts the digital certificate client to run.

2. The method according to claim 1, wherein the smart card storing the digital certificate interacts with the smart card management module through the IS07816 protocol.

3. The method according to claim 1, wherein the smart card management module interacts with the PC side driver through a board side drive of the mobile terminal and a digital certificate on the PC side, and passes

The MCSP/PKCS11 protocol performs transparent transmission and starts the digital certificate client.

4. The method according to claim 3, wherein the smart card is a UICC, and the port comprises an AT port, a Modem port, and a standard USB device interface.

5. The method of claim 1, wherein the digital certificate client initiates a digital certificate operation by operating a command MCSP/PKCS11 data packet.

6. A mobile terminal, the mobile terminal comprising a smart card, a smart card management module, and a board side driver;

The smart card is configured to store a digital certificate;

The smart card management module is configured to implement operation on a smart card digital certificate, and the smart card management module and the smart card communicate through a standard protocol;

The board side driver is configured to interact with the digital certificate PC side driver through a protocol to start the digital certificate client.

The mobile terminal according to claim 6, wherein the smart card is configured to interact with the smart card management module through the IS07816 protocol.

The mobile terminal according to claim 6, wherein the smart card management module is configured to start a digital certificate client by interacting with a PC side driver through a board side driver of the mobile terminal and a digital certificate on the PC side.

9. The mobile terminal of claim 6, wherein the smart card is a UICC card.

10. The mobile terminal of claim 6, wherein the mobile terminal comprises: the digital certificate client configured to initiate a digital certificate operation by operating a command MCSP/PKCS11 data packet.