WO2016070611A1

WO2016070611A1 - Method for processing data, server and terminal

Info

Publication number: WO2016070611A1
Application number: PCT/CN2015/079971
Authority: WO
Inventors: 李伟
Original assignee: 中兴通讯股份有限公司
Priority date: 2014-11-05
Filing date: 2015-05-27
Publication date: 2016-05-12
Also published as: CN104469736A; CN104469736B

Abstract

Disclosed in the present invention are a method for processing data, a server and a terminal, wherein the method includes a method for processing data, and the method includes: the server acquires first information for uniquely identifying the identity of the terminal; the server generates second information for security authentication of the terminal according to the first information; the server stores the first information and the second information locally, and sends to the terminal a copy of the second information obtained on the basis of the second information; the server performs security authentication by comparing third information and the copy of second information both obtained from the terminal with the first information and the second information stored locally, and when the authentication is passed, issues a permission confirmation and sends to the terminal fourth information for locking network.

Description

Data processing method, server and terminal

Technical field

The present invention relates to communication technologies, and in particular, to a data processing method, a server, and a terminal.

Background technique

In the process of implementing the technical solutions of the embodiments of the present application, at least the following technical problems exist in the related technologies:

The increasing popularity and intelligence of wireless data service terminals, such as smart phones, makes it possible to use a terminal such as a smart phone for a large amount of data processing, with the arrival of 2G/3G and even the 4G era, for today's big data. In the era, data processing can be performed by means of a wireless local area network such as WIFI or a network constructed by a mobile data network provided by various major operators.

A scenario of data processing may be: considering that each operator in order to maintain its own interests, the control requirements of the mobile data networks provided by the operators are also higher and higher, which is mainly reflected in the operators' low competitiveness in order to improve their own competitiveness. Selling or distributing a medium containing specific identification information at a price to provide a uniquely-identified terminal with a special low-cost or subsidized service provided by the operator, and other terminals cannot enjoy the preferential service. There is a need to ensure a security issue, that is, to ensure that the carrier's specific terminal is only allowed to operate under the carrier's network to enjoy this preferential service and prohibit the use of other networks.

At present, in order to ensure security, the prior art is implemented by using different lock network tools corresponding to different operator platforms or corresponding different terminal chips (such as MediaTek or Qualcomm chips), that is, using a plurality of dedicated specific lock network tools. The terminal performs lock network processing to avoid being illegally cracked. Therefore, it is necessary to maintain too many dedicated specific lock network tools. Different platforms or chips need to adopt different lock network policies and parameters for processing, which is inconvenient to manage; After the processing is completed, it has already reached the user's hand. If there is a problem, it needs to be returned to the factory to be re-processed. The cost of returning to the factory for maintenance is high. low efficiency. There are no effective solutions to these problems in the prior art.

Summary of the invention

In view of this, the embodiments of the present invention are intended to provide a data processing method, a server, and a terminal, which at least solve the problems existing in the prior art.

The technical solution of the embodiment of the present invention is implemented as follows:

A data processing method according to an embodiment of the present invention, the method includes:

The server obtains first information for uniquely identifying the identity of the terminal;

The server generates second information for performing security authentication on the terminal according to the first information.

The server locally saves the first information and the second information, and sends a second information copy obtained based on the second information to the terminal;

The server compares the third information and the second information copy acquired by the terminal with the locally saved first information and the second information to perform authentication of the security authentication, and when the authentication succeeds, the license confirmation is issued and sent for The fourth information of the lock network is given to the terminal.

In the above solution, the server locally stores the first information and the second information, including:

The server establishes and saves the first file information related to the first information by using the first information as an index;

The first file information includes at least the second information and the fourth information;

The fourth information is used to perform initial lock network use on the terminal.

In the above solution, the server compares the third information and the second information copy obtained by the terminal with the locally saved first information and the second information to perform authentication of the security authentication, including:

The server acquires a first data processing request, where the first data processing request carries at least the third information and the second information copy submitted by the terminal;

The server parses the first data request to obtain the third information and the second information copy, where the third information is used to uniquely identify the terminal identity;

Comparing the second information copy with the second information, and the third information The same as the first information, the authentication of the security authentication is successful.

Comparing the second information copy with the second information part, performing operations on the second information copy and the second information according to a preset rule, if the operation result is a match, and the third information The same as the first information, the authentication of the security authentication is successful.

In the above solution, when the authentication succeeds, the license confirmation is issued and the fourth information for the lock network is sent to the terminal, including:

After the server successfully authenticates the security authentication of the terminal, the first information is used as the index key information for searching, and the fourth information corresponding to the first information is extracted from the first file information. And sent to the terminal.

In the above solution, the server locally saves the first information and the second information, and sends a second information copy obtained based on the second information to the terminal, and further includes:

Before the server sends the second information copy or at the same time, sending the fifth information for locking the network to the terminal;

The fifth information is used to perform initial lock network use on the terminal.

In the foregoing solution, before the server compares the third information and the second information copy obtained by the terminal with the locally saved first information and the second information to perform authentication of the security authentication, the server further includes:

The server acquires a second data processing request, where the second data processing request carries at least the third information submitted by the terminal, the second information copy, and the updated identification letter interest;

The fourth information is used to perform parameter update after the initial lock network on the terminal.

The server actively initiates a third data processing request, where the third data processing request carries at least the first information, and the identifier information that is requested to be updated;

Receiving, by the terminal, a second information copy obtained based on the second information;

The terminal sends a third information and a second information copy for uniquely identifying the identity of the terminal to the server, requesting authentication for obtaining fourth information for locking the network from the server.

In the above solution, the terminal sends a third information and a second information copy for uniquely identifying the identity of the terminal to the server, including:

When the terminal detects that there is no information for the lock network locally, the terminal encapsulates the third information and the second information copy into a first data processing request and sends the information to the server;

The second information copy is identical to the second information, or

The second copy of information is the same as the second information portion.

In the above solution, the method further includes:

Receiving, by the terminal, the fourth information after receiving the second information copy, where the fourth information is used to perform initial lock network use on the terminal;

The terminal performs an initial lock network on the medium containing the specified identification information according to the fourth information.

In the above solution, the method further includes:

Receiving, by the terminal, the fifth for locking the network before or at the same time receiving the copy of the second information information;

The terminal performs an initial lock network on the medium containing the specified identification information according to the fifth information.

In the above solution, the method further includes:

When the terminal detects that the lock threshold information needs to be updated according to the second information copy, the terminal encapsulates the third information, the second information copy, and the updated update request information into a second data processing request. Give the server;

Receiving, by the terminal, the fourth information, where the fourth information is further used to perform parameter update after initial locking of the terminal;

The terminal performs a lock network update on the medium containing the specified identification information according to the fourth information.

In the above solution, the method further includes:

Receiving, by the terminal, a third data processing request initiated by the server, where the third data processing request carries at least the first information, and the identifier information that is requested to be updated;

The terminal receives the fourth information after the server is successfully authenticated, and the fourth information is further used to perform parameter update after the initial lock network on the terminal;

A server according to an embodiment of the present invention, the server includes:

a first acquiring unit, configured to acquire first information for uniquely identifying a terminal identity;

An information generating unit, configured to generate second information for performing security authentication on the terminal according to the first information;

a storage unit configured to locally save the first information and the second information;

a first sending unit, configured to send a second information copy obtained based on the second information to the terminal;

The authentication unit is configured to compare the third information and the second information copy obtained from the terminal with the locally saved first information and the second information for authentication of the security authentication, and issue the license when the authentication succeeds Confirming and transmitting the fourth information for the lock network to the terminal.

In the above solution, the storage unit is further configured to establish, by using the first information as an index, first file information related to the first information and save the information;

In the above solution, the authentication unit includes:

The first processing sub-unit is configured to acquire a first data processing request, where the first data processing request carries at least the third information and the second information copy submitted by the terminal;

a parsing subunit configured to parse the first data request to obtain the third information and the second information copy, where the third information is used to uniquely identify the terminal identity;

The comparison subunit is configured to compare that the second information copy is identical to the second information, and the third information is the same as the first information, and the authentication of the security authentication is successful.

In the above solution, the authentication unit further includes:

a parsing subunit configured to parse the first data request by the server to obtain the third information and the second information copy, where the third information is used to uniquely identify the terminal identity;

Comparing the sub-units, configured to compare the second information copy with the second information part, and perform operations on the second information copy and the second information according to a preset rule, if the operation result is a match And the third information is the same as the first information, and the authentication of the security authentication is successful.

In the above solution, the authentication unit further includes:

a license issuance sub-unit configured to authenticate the security authentication of the terminal after the authentication is successful. The first information is used as index key information for searching to extract fourth information corresponding to the first information from the first file information, and is sent to the terminal.

In the above solution, the first sending unit is further configured to send the fifth information for locking the network to the terminal before or at the same time of transmitting the second information copy;

In the above solution, the server further includes:

a second acquiring unit, configured to acquire a second data processing request, where the second data processing request carries at least the third information submitted by the terminal, the second information copy, and the identifier information that is requested to be updated;

The fourth information is further used to perform parameter update after the initial lock network on the terminal.

In the above solution, the server further includes:

a second sending unit, configured to actively initiate a third data processing request, where the third data processing request carries at least the first information, and the identifier information that is requested to be updated;

The first obtaining unit, the information generating unit, the storage unit, the first sending unit, the authentication unit, the first processing subunit, the parsing subunit, and the comparison pair The unit, the license issuance subunit, the second acquisition unit, and the second sending unit may use a central processing unit (CPU), a digital signal processor (DSP, Digital Singnal Processor) when performing processing. ) or programmable logic array (FPGA, Field-Programmable Gate Array) implementation.

A terminal according to an embodiment of the present invention, where the terminal includes:

a first receiving unit, configured to receive a second information copy obtained based on the second information;

And a third sending unit, configured to send a third information and a second information copy for uniquely identifying the identity of the terminal to the server, requesting authentication for acquiring fourth information for locking the network from the server.

In the above solution, the terminal further includes:

The first detecting unit is configured to detect whether there is local information for locking the network, obtain a first detection result, and send the result to the third sending unit;

The third sending unit is further configured to: when the first detection result is that there is no information for locking the network locally, the third information and the second information copy are encapsulated and sent to the first data processing request. Give the server;

The second information copy is identical to the second information, or

The second copy of information is the same as the second information portion.

In the above solution, the terminal further includes:

a second receiving unit, configured to receive the fourth information after receiving the second information copy, where the fourth information is used to perform initial lock network use on the terminal;

The lock network unit is configured to perform an initial lock network on the medium containing the specified identification information according to the fourth information.

In the above solution, the first receiving unit is further configured to receive the fifth information for locking the network before or at the same time receiving the copy of the second information;

The terminal further includes:

The lock network unit is configured to: the terminal performs an initial lock network on the medium containing the specified identification information according to the fifth information.

In the above solution, the terminal further includes:

The second detecting unit is configured to: according to the second information copy detecting whether the effective threshold is reached, the lock network information needs to be updated, and the second detection result is obtained and sent to the third sending unit;

The third sending unit is further configured to: when the second detection result is that the lock network information needs to be updated to reach the effective threshold, the third information, the second information copy, and the update information of the request update are encapsulated into the second The data processing request is sent to the server;

The second receiving unit is further configured to receive the fourth information, where the fourth information is further used to perform parameter update after the initial locking of the terminal;

The lock network unit is further configured to: the terminal performs a lock network update on the medium containing the specified identification information according to the fourth information.

In the above solution, the second receiving unit is further configured to receive a third data processing request initiated by the server, where the third data processing request carries at least the first information, and the identifier information that is requested to be updated; After the success of the right, the fourth information is received, and the fourth information is further used to perform parameter update after the initial lock network on the terminal;

The lock network unit is further configured to perform a lock network update on the medium containing the specified identification information according to the fourth information.

The first receiving unit, the third sending unit, the first detecting unit, the second receiving unit, the lock net unit, and the second detecting unit may adopt a central processing unit when performing processing (CPU, Central Processing Unit), digital signal processor (DSP, Digital Singnal Processor) or Programmable Array Array (FPGA).

The method of the embodiment of the present invention includes: the server acquires first information for uniquely identifying the identity of the terminal; the server generates second information for performing security authentication on the terminal according to the first information; and the server locally saves the first information and the Transmitting the second information, sending a second information copy obtained based on the second information to the terminal; the server compares the third information and the second information copy acquired from the terminal with the locally saved first information and the second information For the authentication for security authentication, when the authentication succeeds, a license confirmation is issued and the fourth information for the lock network is sent to the terminal.

According to the embodiment of the present invention, since the terminal is remotely managed by the server, the network locking tool is not needed in the scenario of the lock network. Therefore, for a plurality of platforms, multiple chips, etc., a plurality of dedicated specific lock network tools are used to terminate the terminal. The limitation of the lock network processing is achieved, thereby achieving the effect of not requiring maintenance of a dedicated dedicated lock network tool, and improving the convenience of management; and, through such remote management, even if the terminal processing has reached the user's hand, there is a problem. It also does not need to be returned to the factory for re-processing, and can be remotely managed through the server, thus reducing the maintenance of returning to the factory. This also improves processing efficiency.

DRAWINGS

1 is a flowchart of an implementation of a method according to an embodiment of the present invention;

2 is a flowchart of an implementation of another method embodiment of the present invention;

3 is a schematic structural diagram of a server embodiment of the present invention;

4 is a schematic structural diagram of a terminal embodiment of the present invention;

FIG. 5 is a schematic diagram of establishing a file by a production line terminal of an application scenario according to an embodiment of the present invention; FIG.

FIG. 6 is a flow chart of implementing a lock network for applying the file created in FIG. 5.

detailed description

The implementation of the technical solution will be further described in detail below with reference to the accompanying drawings.

The embodiment of the invention provides a data processing method. As shown in FIG. 1 , the method includes:

Step 101: The server acquires first information for uniquely identifying the identity of the terminal.

Here, the first information may be a hardware ID.

Step 102: The server generates second information for performing security authentication on the terminal according to the first information.

Here, the second information may be various certificate information for digital encryption and digital signature.

Step 103: The server locally saves the first information and the second information, and sends a second information copy obtained based on the second information to the terminal.

Here, the second information copy may be identical to the second information; or may be the same as the second information part, for example, the second information copy may include at least the second information, as long as security authentication can be achieved. .

Step 104: The server compares the third information and the second information copy obtained by the terminal with the locally saved first information and the second information to perform authentication of the security authentication, and issues a license confirmation when the authentication succeeds. Sending fourth information for the lock network to the terminal.

Here, the fourth information may be a lock network parameter for locking a SIM card, so that the uniquely-identified terminal provides a preferential service such as a specific low price or subsidy provided by the operator, and other terminals cannot enjoy the same. The preferential service, that is, to ensure that the specific terminal of the operator is only allowed to operate under the network of the operator, to enjoy the preferential service, prohibiting the use of other networks.

With the steps 101-104 of the embodiment of the present invention, for a multi-platform, multi-chip, etc., the limitation of using a plurality of dedicated specific lock network tools to lock the network of the terminal is eliminated, thereby achieving a dedicated lock that does not require excessive maintenance. The effect of the network tool improves the convenience of management; Moreover, through this remote management, even if the terminal has finished processing, it has reached the user's hand, and there is a problem that it does not need to be returned to the factory to be reprocessed, and the remote management can be performed through the server. Reduced the cost of returning to the factory and increased processing efficiency.

In an implementation manner of the first embodiment of the present invention, the server locally saves the first information and the second information, including: the server establishes, by using the first information as an index, a first information related to the first information. And storing the file information; the first file information includes at least the second information and the fourth information.

Here, the fourth information is used for initial lock network use of the terminal.

In an implementation manner of the first embodiment of the present invention, the server compares the third information and the second information copy acquired by the terminal with the locally saved first information and the second information to perform authentication of the security authentication, including :

A1: The server acquires a first data processing request, where the first data processing request carries at least the third information and the second information copy submitted by the terminal.

Here, the first data processing request may be to issue a prototype usage permission request to obtain a lock network parameter for performing subsequent lock network processing, and the permission request may also be referred to as a lock network request.

A2. The server parses the first data request to obtain the third information and the second information copy, where the third information is used to uniquely identify the terminal identity.

Here, the third information is similar to the first information, and is also information of a hardware ID class. As with the first information, it may be different, and the authentication is performed by subsequent authentication.

A3. The second information is identical to the second information, and the third information is the same as the first information, and the authentication of the security authentication is successful.

B1: The server acquires a first data processing request, where the first data processing request carries at least the third information and the second information copy submitted by the terminal.

B2. The server parses the first data request to obtain the third information and the second information copy, where the third information is used to uniquely identify the terminal identity.

Here, the third information is similar to the first information, and is also information of a hardware ID class, which may be the same as or different from the first information, and is authenticated by subsequent authentication.

B3, comparing the second information copy with the second information part, performing operations on the second information copy and the second information according to a preset rule, if the operation result is a match, and the The third information is the same as the first information, and the authentication of the security authentication is successful.

The implementation of the above A1-A3 is that the second information copy is identical to the second information, and no operation is required, and the implementation of the B1-B3 is that the second information copy is the same as the second information part, and the operation is required. If the operation result is a match, and the third information is the same as the first information, the authentication of the security authentication is successful.

In an implementation manner of the embodiment of the present invention, when the authentication succeeds, a license confirmation is issued and the fourth information for the network is sent to the terminal, including:

After the server successfully authenticates the security authentication of the terminal, extracting, by using the first information as index key information for searching, the first information pair from the first file information. The fourth information should be sent to the terminal.

In an implementation manner of the first embodiment of the present invention, the server locally saves the first information and the second information, and sends a second information copy obtained based on the second information to the terminal, further comprising: sending, by the server The fifth information for the lock network is also sent to the terminal before or at the same time as the second information copy.

Here, the fifth information is used for initial lock network use of the terminal.

In the embodiment of the present invention, for example, a scenario is to initially send only a certificate, that is, if the terminal is a mobile phone, the mobile phone does not have a lock network parameter when it is sold, and then sends a hardware ID to the server to request a lock network parameter. After the authentication succeeds, the server will send the terminal to the terminal; another scenario is to send the certificate and the lock network parameters initially, that is to say, for the terminal to be the mobile phone, the mobile phone has the lock network parameter when it is sold, and then sends the hardware ID to the server. This is done in order to update the lock network parameters. After the authentication is successful, the server will send the updated lock network parameters to the terminal. This is a different remote management of the two server-to-terminal.

In an implementation manner of the embodiment of the present invention, the server compares the third information and the second information copy acquired by the terminal with the locally saved first information and the second information to perform authentication of the security authentication. The method further includes: the server acquiring a second data processing request, where the second data processing request carries at least the third information submitted by the terminal, the second information copy, and identifier information that is requested to be updated.

Here, the fourth information is used to perform parameter update after the initial lock on the terminal.

In an implementation manner of the embodiment of the present invention, the server compares the third information and the second information copy acquired by the terminal with the locally saved first information and the second information to perform authentication of the security authentication. The method further includes: the server actively initiating a third data processing request, where the third data processing request carries at least the first information, and the identifier information that is requested to be updated.

The embodiment of the invention provides a data processing method. As shown in FIG. 2, the method includes:

Step 201: The terminal receives a second information copy obtained based on the second information.

Step 202: The terminal sends a third information and a second information copy for uniquely identifying the identity of the terminal to the server, and requests authentication for obtaining fourth information for locking the network from the server.

In an implementation manner of the embodiment of the present invention, the terminal sends a third information and a second information copy for uniquely identifying the identity of the terminal to the server, including: when the terminal detects that there is no information for the network to be locked locally, The terminal encapsulates the third information and the second information copy into a first data processing request and sends the copy to the server.

Here, the second information copy is identical to the second information, or the second information copy is identical to the second information portion.

In an implementation manner of the embodiment of the present invention, the method further includes:

C1. The terminal receives the fourth information after receiving the second information copy, where the fourth information is used to perform initial lock network use on the terminal.

C2. The terminal performs initial lock network on the medium containing the specified identification information according to the fourth information.

Here, the medium containing the specified identification information may be a SIM card or a USIM card.

A scenario in which the embodiment of the present invention is used is: the terminal finds that there is no lock network data, and can request data such as lock network parameters from an authorized server through the Internet or other connection path. Each operation uses data such as lock network parameters issued by the server, such as a lock network list to determine whether the SIM card inserted by the user is a legitimate card. The server can only write important certificate information on the production line terminal. After the user inserts the SIM card for the first time, the network accesses the authorized server to obtain data such as the lock network parameters. In this case, any shipping prototype can wait. After the sales are given to the user, the network is locked. For the unsold inventory, because the network is not locked, it is not necessary to increase the huge maintenance caused by the re-locking rework caused by the traditional prototype shipment. cost.

D1. The terminal receives the lock for the network before or at the same time receiving the copy of the second information. Fifth message.

D2. The terminal performs initial lock network on the medium containing the specified identification information according to the fifth information.

D3. The terminal, when the second information replica detects that the valid threshold is reached, needs to update the lock network information, and encapsulates the third information, the second information replica, and the identifier information that is requested to be updated into the second data processing request. Sent to the server.

Here, for example, the certificate information can be used for 2 years, and after 2 years, the lock network information needs to be re-applied, and the threshold is 2 years.

D4. The terminal receives the fourth information, where the fourth information is further used to perform parameter update after initial locking of the terminal.

D5. The terminal performs a lock network update on the medium containing the specified identification information according to the fourth information.

In an implementation manner of the first embodiment of the present invention, an application scenario may be: the server issues a certificate at the time of production, and the authorized center locks the network, and then directly delivers the product. In this case, if the rework is re-locked in the later stage, only the need is needed. Erase the important data such as the lock network parameters of the prototype, and then obtain the important parameters for the first time or the lock network information is issued by the authorization center.

It should be noted here that the descriptions of the following server and terminal items are similar to the descriptions of the above method items, and the beneficial effects of the same method items are described without further description. For the server of the present invention For technical details not disclosed in the terminal embodiment, please refer to the description of the method embodiment of the present invention.

A server according to an embodiment of the present invention, as shown in FIG. 3, the server includes:

The first obtaining unit 11 is configured to acquire first information for uniquely identifying the identity of the terminal;

The information generating unit 12 is configured to generate second information for performing security authentication on the terminal according to the first information.

The storage unit 13 is configured to locally save the first information and the second information;

The first sending unit 14 is configured to send a second information copy obtained based on the second information to the terminal;

The authentication unit 15 is configured to compare the third information and the second information copy obtained from the terminal with the locally saved first information and the second information to perform authentication of the security authentication, and issue the authentication when the authentication succeeds. The license confirms and sends the fourth information for the lock to the terminal.

In an implementation manner of the embodiment of the present invention, the storage unit is configured to establish, by using the first information as an index, first file information related to the first information, and save the information;

In an implementation manner of the embodiment of the present invention, the authentication unit includes:

In an implementation manner of the embodiment of the present invention, the authentication unit further includes:

a license issuance sub-unit configured to: after the authentication of the security authentication of the terminal is successful, extract the first information as index key information for searching, and extract, from the first file information, the first information The fourth information is sent to the terminal.

In an implementation manner of the first embodiment of the present invention, the first sending unit is configured to send a fifth information for locking the network to the terminal before or at the same time of transmitting the second information copy;

In an implementation manner of the embodiment of the present invention, the server further includes:

A terminal according to an embodiment of the present invention, as shown in FIG. 4, the terminal includes:

The first receiving unit 21 is configured to receive a second information copy obtained based on the second information;

The third sending unit 22 is configured to send third information and a third identifier for uniquely identifying the identity of the terminal. A copy of the information is sent to the server, requesting authentication for obtaining the fourth information for the lock network from the server.

In an implementation manner of the embodiment of the present invention, the terminal further includes:

The third sending unit is configured to: when the first detection result is that there is no information for the network lock, the third information and the second information copy are encapsulated into the first data processing request and sent to server;

The second information copy is identical to the second information, or

The second copy of information is the same as the second information portion.

In an implementation manner of the first embodiment of the present invention, the first receiving unit is configured to receive, after receiving the second information copy, or the fifth information for locking the network;

The terminal further includes:

The third sending unit is configured to: when the second detection result is that the lock network information needs to be updated when the effective threshold is reached, the third information, the second information copy, and the identifier information that is requested to be updated are encapsulated into the second data. Send the request to the server;

The second receiving unit is configured to receive the fourth information, where the fourth information is further used to perform parameter update after the initial locking of the terminal;

The lock network unit is configured to: the terminal performs a lock network update on the medium containing the specified identification information according to the fourth information.

In an implementation manner of the first embodiment of the present invention, the second receiving unit is configured to receive a third data processing request initiated by the server, where the third data processing request carries at least the first information, and the request is updated. Identification information; after the server is successfully authenticated, the fourth information is received, and the fourth information is further used to update the parameter after the initial lock network of the terminal;

The lock network unit is configured to perform a lock network update on the medium containing the specified identification information according to the fourth information.

The following is described in the description of a specific application scenario:

The application scenario of the embodiment of the present invention is directed to a wireless network-based lock network technology for a wireless data terminal device. In the prior art, each operator has a control requirement for the operator network in order to maintain its interests. Increasingly high, mainly reflected in the operators to sell their infinite number of terminal equipment at low prices in order to improve their competitiveness; the same number of data service terminals in the form of subsidies, the security requirements are also the highest, security is reflected in The operator's terminal is only allowed to operate under the operator's network, and other networks are prohibited. Generally, the control of the network is controlled by important parameters such as MCC/MNC of the SIM card of the mobile phone. Generally, when the data of the operator is written into the terminal device by the operator MCC/MNC data, the user can only use it. The SIM card that matches the terminal device is used, and the SIM card that does not match the MCC/MNC of the competing card is refused to be used for the purpose of protecting the interests of the operator.

The control, protection and maintenance of the SIM card parameter information written by the data terminal are collectively referred to as lock network; in addition to the traditional lock network (compared to MCC, MNC), the lock network usually has a lock subnet (compared to MCC, MNC, 6 digits of IMSI and 7 digits of IMSI), lock company (comparing SIM card MCC, MCC and GID1), etc., such as MCC, MNC, GID1 and other parameters, collectively referred to as lock network Parameters, which are sensitive and are also the focus of protection. The lock network parameters can be written to the data terminal by a tool called a lock network tool.

For terminal manufacturers, customized for different operators, it may be necessary to customize the lock type and lock network differently, but need to maintain a variety of lock network tools, in the production line production, for the delivery of large, short production period of emergency Projects often encounter rework with the wrong tools and bring great economic losses. The latter products of the operators may not all be sold. The inventory prototypes often expect to transfer the remaining inventory products to other regions by re-modifying the lock network parameters. In this way, rework production is also required to increase the post-maintenance cost of the terminal manufacturers. In short, The lock network processing of the lock network tool is too limited by factors such as the platform and the chip, which leads to an increase in the cost of rework and maintenance, and the management and lock network processing efficiency is also very low.

In the application scenario of the present invention, once the wireless data terminal is networked, it is controlled by the network for the server for the lock network authorization (such as the server embodiment 1 and various specific implementation manners described in the foregoing embodiments), thereby The advantages are: it can improve production efficiency, reduce production cost and post-maintenance cost of terminal equipment, and can also uniformly manage all equipments through the server authorized by the lock network, such as remote management such as locking, re-locking or unlocking.

Specifically, the application scenario is directed to the above-mentioned problems of the prior art, and aims to reduce the production and maintenance cost for the terminal manufacturer's lock network related solution, and realize convenient remote management through the server authorized by the lock network. An authorized server can also be called a lock network authorization center server or an authorization center server. The specific name is not limited. As long as the following functions can be implemented through one server, the following is referred to as a server to describe as follows:

1. When the terminal is produced, the server writes the certificate information to the prototype (the certificate information includes the unique hardware ID information of the prototype, and the form thereof may be various, for example, using the root private key of the lock network authorization center server, its hardware ID and some important information. Signature data, etc.), and establish file information (including operator information, product type, shipping area, expecting important information such as MCC/MNC of the lock network, etc.) on the server. As shown in the schematic diagram of the line creation terminal of Figure 5, the file is created.

2. After the user registers for the first time, as shown in the flowchart of the lock network implementation of the file created in Figure 5, the prototype request or the server license is issued by the server (that is, important data such as lock network parameters, such important data. Contains the encrypted or signed data of the unique hardware ID or other unique information of the prototype), that is, the user can use it after authorization; when the service life reaches 2 years or a specified number of years, the user can also apply for a server unlock request, and the server can decide whether to request according to the demand. Unlock the user or issue a new certificate.

It should be pointed out here that the function of the server is not limited to the above functions, and may also have functions: for example, the form can only write important certificate information on the production line, and the user joins the server after first inserting the SIM card. Important data such as lock network parameters, in this case, any one of the shipping prototypes can be sold to the user to get the hand and then lock the net. For the unsold inventory prototype, because the net is not locked, it is not necessary to increase the shipment due to the traditional prototype. The net reason for the increase in re-locking network rework brings huge maintenance costs.

The function of the server can also have functions: for example, the form can also be issued at the time of production, and the authorized center locks the network, and then directly delivers the goods. In this case, if the rework is re-locked in the later stage, only the prototype is needed. Important data such as lock network parameters are erased, and then important data such as lock network parameters are obtained online for the first time or important data such as lock network parameters are uniformly issued by the server.

The function of the server can also have functions: for example, the form also includes unified management of the test prototype, such as the test prototype can issue a certificate, assign a management right of the test prototype, can reduce the front or the test staff because of the frequent need to test multiple Projects, while the risk of leaking the lock-net tool required by repeated locks can also reduce or add extra costs due to frequent mailing of prototypes.

As shown in the schematic diagram of the file establishment file of the production line terminal in Fig. 5, it is pointed out how to write important information such as IDs during production line production to establish a file, including the following round-trip messages:

Message 1: During the production process, the production line interacts with the terminal through the lock network tool to obtain the message flow for writing the hardware ID permission. Only if the return is successful, the lock network tool has permission to write data to The terminal cannot obtain this permission for illegal users and cannot write information such as hardware ID.

Message 2: The lock network tool randomly generates a hardware ID, and sends the hardware ID to the terminal. The terminal first checks whether there is a hardware ID. If the hardware ID already exists, the test returns the existing hardware ID to the lock network tool; if the hardware ID does not exist, Then write the hardware ID, and then return the written hardware ID to the lock network tool. This message can also contain other important information and additional information in addition to the hardware ID.

Message 3: The lock network tool is connected to the server for the lock network authorization through the network or other connection mode, or the connection to the server for the lock network authorization is updated after the temporary server is connected. The information for applying for permission includes important identity information such as the ID of the lock network tool, so that the server used for the lock network authorization can determine its identity. Only the authorized lock network tool can apply for the permission of the server for the lock network authorization, which greatly improves the data security.

Message 4: The lock network tool obtains the root public key rPb of the server from the server for the lock network authorization and the unique certificate issued by the server to the terminal, and a pair of random public and private keys Pb and Pi are used for interaction in the data communication process or Encrypted and decrypted.

Message 5: The lock network tool returns the result obtained from the message 4 to the terminal, so that the terminal saves the public and private key and the data information such as the signature, so as to be used for subsequent lock network or re-locking.

Message 6: The lock network tool requests the server for the lock network authorization to create a file for the terminal with the hardware ID "Id".

Subsequently, as shown in the flow chart of the lock network implementation of the file created in FIG. 5, the process of obtaining the important information such as the lock network parameters from the server for the first time, including the following round-trip message:

Message 7: The terminal requests the server for the lock network authorization to lock the network according to its own hardware ID and certificate information and requests to establish a connection. After the server for the lock network authorization verifies the identity of the terminal, the terminal establishes a connection of the terminal. And query the operator information corresponding to the hardware ID from the operator list, and then obtain important data such as the lock network of the prototype from the information.

Message 8: The terminal requests important information such as lock network parameters from the server used for the lock network authorization. Service The device obtains data such as a lock network according to the hardware ID, and then encrypts the data and the hardware ID according to the server root private key, and then sends the information to the terminal. The terminal device verifies and saves the lock network information. When it is found that the lock network information has been saved during the next development, it is no longer necessary to request the server lock network for the lock network authorization. Each operation uses the lock net list issued by the center to determine whether the SIM card inserted by the user is a legal card.

In summary, the server of the application scenario may be used to store the hardware ID of the data terminal, the certificate information, and the necessary carrier information, the communication public and private key, and the lock data parameter information expected by the operator. One or more kinds, and when the terminal is running for the first time, if it is found that there is no lock network data, the lock network data can be requested from the server through the Internet or other connection means. Similarly, the server can also modify the lock parameters or other important parameters of the specified prototype in some cases. The lock network tool of this application scenario is not required, but the lock network tool can be used when writing data to the terminal to create a file. The lock network tool interacts with the server and writes the hardware ID (uniquely identifies the serial number of the device) to The non-erasable partition of the terminal. The terminal of this application scenario writes the hardware ID through the lock network tool during the production line production. When the first run, it can interact with the server and request the lock network parameters from the server. Once the lock network parameters are successful, there is no need to request them later. Similarly, the operator can delete the lock network parameters by instruction, and then request the lock network from the server again, that is, grant the function of relocking the network.

Because the server is not limited to the operation of a certain platform prototype, it can realize unified lock network of multiple platforms, no longer distinguish whether the prototype is Qualcomm platform, MediaTek (MTK) platform, Marvell platform, etc., as long as it meets the requirements. Data transmission mode or interface can be unified management; it is not limited to a specific connection mode, and can be wireless communication mode or direct connection mode supported by any device, as long as it conforms to the specified data transmission mode or interface.

It can be seen that, by using the embodiment of the present invention and its application scenario, the terminal is remotely managed by the server for the lock network authorization, such as the lock network processing, and the terminal file is established by the prototype before the lock network processing, and the subsequent use is performed. The file is locked and processed, and this is done on the terminal device. The method of remote maintenance not only reduces the risk of using the wrong lock network tool on the production line, but also reduces the after-sales maintenance cost. For the action of relocking the net, it is not necessary to return to the factory for maintenance, which greatly reduces the after-sales maintenance cost.

The integrated modules described in the embodiments of the present invention may also be stored in a computer readable storage medium if they are implemented in the form of software functional modules and sold or used as separate products. Based on such understanding, the technical solution of the embodiments of the present invention may be embodied in the form of a software product in essence or in the form of a software product stored in a storage medium, including a plurality of instructions. A computer device (which may be a personal computer, server, or network device, etc.) is caused to perform all or part of the methods described in various embodiments of the present invention. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. . Thus, embodiments of the invention are not limited to any specific combination of hardware and software.

Correspondingly, the embodiment of the present invention further provides a computer storage medium, wherein a computer program is stored, and the computer program is used to execute the data processing method of the embodiment of the present invention.

The above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention.

Industrial applicability

According to the embodiment of the present invention, since the terminal is remotely managed by the server, the network locking tool is not needed in the scenario of the lock network. Therefore, for a plurality of platforms, multiple chips, etc., a plurality of dedicated specific lock network tools are used to terminate the terminal. The limitation of the lock network processing is achieved, thereby achieving the effect of not requiring maintenance of a dedicated dedicated lock network tool, and improving the convenience of management; and, through such remote management, even if the terminal processing has reached the user's hand, there is a problem. It also does not need to be returned to the factory for reprocessing. It can be remotely managed through the server, which reduces the cost of returning to the factory and improves the processing efficiency.

Claims

A data processing method, the method comprising:

The server obtains first information for uniquely identifying the identity of the terminal;

The server generates second information for performing security authentication on the terminal according to the first information.

The server locally saves the first information and the second information, and sends a second information copy obtained based on the second information to the terminal;

The server compares the third information and the second information copy acquired by the terminal with the locally saved first information and the second information to perform authentication of the security authentication, and when the authentication succeeds, the license confirmation is issued and sent for The fourth information of the lock network is given to the terminal.
The method of claim 1, wherein the server locally saving the first information and the second information comprises:

The server establishes and saves the first file information related to the first information by using the first information as an index;

The first file information includes at least the second information and the fourth information;

The fourth information is used to perform initial lock network use on the terminal.
The method according to claim 2, wherein the server compares the third information and the second information copy acquired from the terminal with the locally saved first information and the second information for authentication of the security authentication, include:

The server acquires a first data processing request, where the first data processing request carries at least the third information and the second information copy submitted by the terminal;

The server parses the first data request to obtain the third information and the second information copy, where the third information is used to uniquely identify the terminal identity;

If the second information copy is identical to the second information, and the third information is the same as the first information, the authentication of the security authentication is successful.
The method of claim 2, wherein the server obtains the number from the terminal The third information and the second information copy are compared with the locally saved first information and the second information for authentication of the security authentication, including:

The server acquires a first data processing request, where the first data processing request carries at least the third information and the second information copy submitted by the terminal;

The server parses the first data request to obtain the third information and the second information copy, where the third information is used to uniquely identify the terminal identity;

Comparing the second information copy with the second information part, performing operations on the second information copy and the second information according to a preset rule, if the operation result is a match, and the third information The same as the first information, the authentication of the security authentication is successful.
The method according to claim 3 or 4, wherein, when the authentication succeeds, a license confirmation is issued and the fourth information for the lock network is sent to the terminal, including:

After the server successfully authenticates the security authentication of the terminal, the first information is used as the index key information for searching, and the fourth information corresponding to the first information is extracted from the first file information. And sent to the terminal.
The method of claim 1, wherein the server locally saves the first information and the second information, and sends a second copy of the information obtained based on the second information to the terminal, further comprising:

Before the server sends the second information copy or at the same time, sending the fifth information for locking the network to the terminal;

The fifth information is used to perform initial lock network use on the terminal.
The method according to claim 6, wherein said server compares the third information and the second information copy acquired from said terminal with locally saved first information and second information for security authentication Before the right, it also includes:

The server acquires a second data processing request, where the second data processing request carries at least the third information submitted by the terminal, the second information copy, and the updated identification letter interest;

The fourth information is used to perform parameter update after the initial lock network on the terminal.
The method according to claim 6, wherein said server compares the third information and the second information copy acquired from said terminal with locally saved first information and second information for security authentication Before the right, it also includes:

The server actively initiates a third data processing request, where the third data processing request carries at least the first information, and the identifier information that is requested to be updated;

The fourth information is used to perform parameter update after the initial lock network on the terminal.
A data processing method, the method comprising:

Receiving, by the terminal, a second information copy obtained based on the second information;

The terminal sends a third information and a second information copy for uniquely identifying the identity of the terminal to the server, requesting authentication for obtaining fourth information for locking the network from the server.
The method according to claim 9, wherein the terminal sends a third information and a second information copy for uniquely identifying the identity of the terminal to the server, including:

When the terminal detects that there is no information for the lock network locally, the terminal encapsulates the third information and the second information copy into a first data processing request and sends the information to the server;

The second information copy is identical to the second information, or

The second copy of information is the same as the second information portion.
The method of claim 9 or 10, wherein the method further comprises:

Receiving, by the terminal, the fourth information after receiving the second information copy, where the fourth information is used to perform initial lock network use on the terminal;

The terminal performs an initial lock network on the medium containing the specified identification information according to the fourth information.
The method of claim 9 wherein the method further comprises:

Receiving, by the terminal, the fifth for locking the network before or at the same time receiving the copy of the second information information;

The terminal performs an initial lock network on the medium containing the specified identification information according to the fifth information.
The method of claim 12, wherein the method further comprises:

When the terminal detects that the lock threshold information needs to be updated according to the second information copy, the terminal encapsulates the third information, the second information copy, and the updated update request information into a second data processing request. Give the server;

Receiving, by the terminal, the fourth information, where the fourth information is further used to perform parameter update after initial locking of the terminal;

The terminal performs a lock network update on the medium containing the specified identification information according to the fourth information.
The method of claim 12, wherein the method further comprises:

Receiving, by the terminal, a third data processing request initiated by the server, where the third data processing request carries at least the first information, and the identifier information that is requested to be updated;

The terminal receives the fourth information after the server is successfully authenticated, and the fourth information is further used to perform parameter update after the initial lock network on the terminal;

The terminal performs a lock network update on the medium containing the specified identification information according to the fourth information.
A server, the server comprising:

a first acquiring unit, configured to acquire first information for uniquely identifying a terminal identity;

An information generating unit, configured to generate second information for performing security authentication on the terminal according to the first information;

a storage unit configured to locally save the first information and the second information;

a first sending unit, configured to send a second information copy obtained based on the second information to the terminal;

The authentication unit is configured to compare the third information and the second information copy obtained from the terminal with the locally saved first information and the second information for authentication of the security authentication, and issue the license when the authentication succeeds Confirming and transmitting the fourth information for the lock network to the terminal.
The server according to claim 15, wherein the storage unit is further configured to establish and save the first file information related to the first information by using the first information as an index;

The first file information includes at least the second information and the fourth information;

The fourth information is used to perform initial lock network use on the terminal.
The server according to claim 16, wherein the authentication unit further comprises:

The first processing sub-unit is configured to acquire a first data processing request, where the first data processing request carries at least the third information and the second information copy submitted by the terminal;

a parsing subunit configured to parse the first data request to obtain the third information and the second information copy, where the third information is used to uniquely identify the terminal identity;

The comparison subunit is configured to compare that the second information copy is identical to the second information, and the third information is the same as the first information, and the authentication of the security authentication is successful.
The server according to claim 16, wherein the authentication unit further comprises:

The first processing sub-unit is configured to acquire a first data processing request, where the first data processing request carries at least the third information and the second information copy submitted by the terminal;

a parsing subunit configured to parse the first data request by the server to obtain the third information and the second information copy, where the third information is used to uniquely identify the terminal identity;

Comparing the sub-units, configured to compare the second information copy with the second information part, and perform operations on the second information copy and the second information according to a preset rule, if the operation result is a match And the third information is the same as the first information, and the authentication of the security authentication is successful.
The server according to claim 17 or 18, wherein the authentication unit further comprises:

a license issuance sub-unit configured to: after the authentication of the security authentication of the terminal is successful, extract the first information as index key information for searching, and extract, from the first file information, the first information The fourth information is sent to the terminal.
The server according to claim 15, wherein the first sending unit is further configured to send a fifth information for locking the network to the terminal before or at the same time of transmitting the second information copy;

The fifth information is used to perform initial lock network use on the terminal.
The server of claim 20, wherein the server further comprises:

a second acquiring unit, configured to acquire a second data processing request, where the second data processing request carries at least the third information submitted by the terminal, the second information copy, and the identifier information that is requested to be updated;

The fourth information is further used to perform parameter update after the initial lock network on the terminal.
The server of claim 20, wherein the server further comprises:

a second sending unit, configured to actively initiate a third data processing request, where the third data processing request carries at least the first information, and the identifier information that is requested to be updated;

The fourth information is further used to perform parameter update after the initial lock network on the terminal.
A terminal, the terminal comprising:

a first receiving unit, configured to receive a second information copy obtained based on the second information;

And a third sending unit, configured to send a third information and a second information copy for uniquely identifying the identity of the terminal to the server, requesting authentication for acquiring fourth information for locking the network from the server.
The terminal of claim 23, wherein the terminal further comprises:

The first detecting unit is configured to detect whether there is local information for locking the network, obtain a first detection result, and send the result to the third sending unit;

The third sending unit is further configured to: when the first detection result is that there is no information for the network lock, the third information and the second information copy are encapsulated into the first data processing request. Request to send to the server;

The second information copy is identical to the second information, or

The second copy of information is the same as the second information portion.
The terminal according to claim 23 or 24, wherein the terminal further comprises:

a second receiving unit, configured to receive the fourth information after receiving the second information copy, where the fourth information is used to perform initial lock network use on the terminal;

The lock network unit is configured to perform an initial lock network on the medium containing the specified identification information according to the fourth information.
The terminal according to claim 23, wherein the first receiving unit is further configured to receive the fifth information for locking the network before or at the same time receiving the copy of the second information;

The terminal further includes:

The lock network unit is configured to: the terminal performs an initial lock network on the medium containing the specified identification information according to the fifth information.
The terminal of claim 26, wherein the terminal further comprises:

The second detecting unit is configured to: according to the second information copy detecting whether the effective threshold is reached, the lock network information needs to be updated, and the second detection result is obtained and sent to the third sending unit;

The third sending unit is further configured to: when the second detection result is that the lock network information needs to be updated to reach the effective threshold, the third information, the second information copy, and the update information of the request update are encapsulated into the second The data processing request is sent to the server;

The second receiving unit is further configured to receive the fourth information, where the fourth information is further used to perform parameter update after the initial locking of the terminal;

The lock network unit is further configured to: the terminal performs a lock network update on the medium containing the specified identification information according to the fourth information.
The terminal according to claim 26, wherein the second receiving unit is further configured to receive a third data processing request initiated by the server, and the third data processing request is The first information is requested to be updated, and the updated information is requested to be updated; after the server is successfully authenticated, the fourth information is received, and the fourth information is further used to update the parameter after the initial lock network is performed on the terminal;

The lock network unit is further configured to perform a lock network update on the medium containing the specified identification information according to the fourth information.