WO2017143715A1

WO2017143715A1 - De-personalization method, booting method, and device for terminal

Info

Publication number: WO2017143715A1
Application number: PCT/CN2016/088436
Authority: WO
Inventors: 曾中宏
Original assignee: 中兴通讯股份有限公司
Priority date: 2016-02-23
Filing date: 2016-07-04
Publication date: 2017-08-31
Also published as: CN107105082B; CN107105082A

Abstract

A de-personalization method for a terminal, comprising: acquiring an inputted first de-personalization code; performing, according to the first de-personalization code, computation to obtain first network state information of a communication processor side; acquiring second network state information of an application processor side obtained by the application processor according to the de-personalization code computation, and acquiring a second de-personalization code stored on the application processor side; determining whether the first network state information is consistent with the second network state information, and whether a third de-personalization code stored on the communication processor side is consistent with the second de-personalization code; if the first network state information and the second network state information both indicate a state of de-personalization, and the third de-personalization code is consistent with the second de-personalization code, then passing de-personalization operation; and if the first network state information is not consistent with the second network state information, or the third de-personalization code is not consistent with the second de-personalization code, then failing the de-personalization operation.

Description

Method for unlocking network by terminal, method and device for booting

Technical field

This document relates to, but is not limited to, the field of communication technology, and relates to a method for unlocking a network by a terminal, a method and device for booting.

Background technique

The lock network lock card scheme is based on the 3GPP TS 22.022 Personalisation of Mobile Equipment (ME) protocol. The agreement is briefly described as follows:

3GPP TS22.022 specifies a total of five levels of lock network lock card definition:

The first level: Network, lock network, Mobile Country Code (MCC, Mobile Country Code) + Mobile Network Code (MNC, Mobile Network Code);

The second level: Network subset, lock subnet, International Mobile Subscriber Identification Number (IMSI, International Mobile Subscriber Identification Number) digits (digit) 6 digits and 7 digits + MCC + MNC;

The third level: service provider (SP), lock SP, SIM (Subscriber Identity Module) / USIM (Universal Subscriber Identity Module) card identification file 1 (GID ( Group Identifier) 1) + MCC + MNC;

Level 4: Corporate, Enterprise Lock, Group Identification File 2 (GID2) + SP on SIM/USIM card (GID1 on SIM/USIM card) + MCC+MNC;

Level 5: SIM/USIM, all IMSIs of the lock card (digit8-15 bits of IMSI + digit6 and 7 bits + MCC+MNC of IMSI).

Which level of lock network is supported is currently specified by the operator, and generally supports one of the first three levels, and the corresponding lock network parameters are provided by the operator.

Currently, there are two common types of lock network solutions, one is a hard coded unlockable solution, and the other is based on a communication processor side, that is, an unlockable solution on the CP (Coprocessor) side. Hard coding can not be unlocked Although the cracking is difficult, but the current market in North America has already required legislation to provide users with the ability to unlock under certain conditions, followed by other regional markets. Follow the trend, so this plan will not go into details. Currently the most widely used is based on the communication processor side of the unlockable solution. When the mobile phone locks the network, a string of numbers is randomly generated on the CP side, and the lock network unlock code (NCK)/lock subnet unlock code (NSCK)/lock card represented by the general security algorithm such as the hash algorithm (MD5) is calculated. Unlock code (SPCK), which is a strong encryption security algorithm. The unlock code (NCK/NSCK/SPCK) is generated only once and is a 16-digit decimal number; the unlock code (NCK/NSCK/SPCK) and the IMEI number of the mobile phone are saved in the external database at one time.

Among them, the lock network related parameters that need to be saved in the mobile phone are: a valid MCC, an MNC list, a valid group identification file (GID) list, an NCK/NSCK/SPCK4 calculated by the MD5 algorithm, an unlock flag, and an unlock failure number. These five parameters are all stored in the Secure File System (SFS) when they are shipped. Among them, the number of unsuccessful unlockings is set according to needs, and the number of failures is accumulated, which is not affected by version update, mobile phone restart, and factory reset, ie, the mobile phone upgrade version, or restart, or factory reset, the number of failures will not be reset to 0.

The current mobile phone lock network architecture is shown in Figure 1. The lock network unlocking related process is completed on the communication processor side, and the application processor side provides a user interface input unlock code, and the read lock network state is displayed correspondingly in the user interface.

Among them, based on the mobile phone lock network architecture diagram shown in Figure 1, the boot process is shown in Figure 2. details as follows:

Step 1: The mobile phone first checks whether it is a lock network version, and if it is not a lock network version, it starts normally;

Step 2: If it is a lock network version, check whether the network is permanently locked. If yes, the unlocking fails, the mobile phone permanently locks the network; otherwise, go to step 3;

Step 3: Verify that the MCC/MNC of the card is legal and unlocked. If the MCC/MNC of the card is legal or unlocked, it will be powered on normally; otherwise, the phone enters the lock state.

In addition, based on the mobile phone lock network architecture diagram shown in FIG. 1, the unlocking process is as shown in FIG. 3. details as follows:

Step 1: The lock network unlock code input by the user in the lock network state is displayed in plain text on the interface; after the user enters the lock network unlock code, select the unlock, check whether the unlock code input by the user is correct, and if the security file system (SFS) is correctly unlocked The status is changed to unlocked, and the unlocking is normally turned on;

Step 2: If the unlock code is incorrect, determine if the maximum number of errors has been reached, if it is reached Will enter the permanent lock network, otherwise continue the process of step 1; after the phone is permanently locked, only emergency calls can be made.

In summary, the unlocking process of the currently locked version of the mobile phone is mainly based on the unlockable solution on the modem side, but the unlocking method in the related art is relatively simple, and once the attack is attacked, the mobile phone cannot judge, and the corresponding cannot be made. Defence or remedy, so there are certain security risks.

Summary of the invention

The following is an overview of the topics detailed in this document. This Summary is not intended to limit the scope of the claims.

The embodiment of the invention provides a method for unlocking a network of a terminal, a method and a device for booting, and when the lock network is released, the input unlock code is simultaneously verified on the communication processor side and the application processor side, thereby making the lock The network is more secure and more difficult to crack.

The embodiment of the invention provides a method for a terminal to unlock a network, which includes:

Obtain the first unlock code entered;

Calculating, according to the first unlocking code, first network state information on the communication processor side;

Obtaining second network state information of the application processor side obtained by the application processor according to the first unlock code, and a second unlock code stored by the application processor side;

Determining whether the first network state information is consistent with the second network state information, and whether the third unlock code and the second unlock code stored on the communication processor side are both unlocked states;

If the first network state information and the second network state information are both in an unlocked state, and the third unlocking code is consistent with the second unlocking code, the unlocking succeeds; if the first network state information and The second network state information is not all unlocked, or the third unlock code does not match the second unlock code, and the unlocking fails.

Optionally, the calculating, according to the unlocking code, obtaining the first network state information on the communications processor side, including:

Obtaining a first unlocking hash value by using a hash algorithm according to the unlocking code;

Determining whether the first unlock hash value is consistent with the first hash value stored on the communication processor side;

If the first unlocking hash value is consistent with the first hash value stored by the communications processor side, the first network state information is an unlocked state;

If the first unlock hash value does not match the first hash value stored on the communication processor side, the first network state information is a lock network state.

Optionally, the acquiring, by the application processor, the second network state information of the application processor side obtained according to the unlocking code, and the second unlocking code stored by the application processor side, including:

Receiving an information read message sent by the application processor;

And reading, according to the information read message, the second network state information and the second unlock code after being encrypted, from the storage area allocated by the application processor in a memory of the terminal, where The security key of the storage area is shared by the communication processor.

Optionally, after the obtaining the first network state information on the communication processor side according to the unlocking code, the method further includes:

Encrypting the first network state information and the third unlock code stored on the communication processor side, and storing the encrypted first network state information and the third unlock code in the storage area .

Optionally, after the unlocking is successful, the method further includes:

The first network state information and the third unlock code after the encryption process are read from the storage area and written into the secure document system.

Optionally, after the unlocking fails, the method further includes:

It is determined whether the number of unlocking times reaches a predetermined threshold. If the number of unlocking times reaches a predetermined threshold, the system restarts. If the number of unlocking times does not reach the predetermined threshold, the user is prompted to re-enter the unlocking code.

The embodiment of the invention further provides a method for the terminal to unlock the network, including:

Obtain the first unlock code entered;

Obtaining second network state information of the application processor side according to the first unlock code calculation;

Transmitting the second network state information and the second unlock code stored on the application processor side to the communications processor.

Optionally, the obtaining the second network state information of the application processor side according to the first unlock code calculation comprises:

Obtaining a second unlocking hash value by using a hash algorithm according to the first unlocking code;

Determining whether the second unlock hash value is consistent with the second hash value stored by the application processor side;

If the second unlocking hash value is consistent with the second hash value stored by the application processor side, the second network state information is an unlocked state;

And if the second unlock hash value does not match the second hash value stored by the application processor side, the second network state information is a lock network state.

Optionally, the transmitting the second network state information and the second unlock code stored by the application processor side to the communications processor, including:

Allocating a storage area in a memory of the terminal, wherein the storage area is provided with a security key, and the security key is shared by the communication processor;

Encrypting the second network state information and the second unlock code, and storing the encrypted second network state information and the second unlock code in the storage area;

Sending an information read message to the communication processor, so that the communication processor reads the encrypted network state information and the second unlock code from the storage area.

Optionally, the security key is also shared by the application processor;

After the unlocking is successful, the method further includes:

Reading the second network state information and the second unlock code after the encryption process from the storage area, and writing the second network state information and the second unlock code after the encryption process Write a memory protection area.

The embodiment of the invention further provides a method for booting a terminal, comprising:

After receiving the input power-on command, determining whether the terminal is a fuse;

If not, reading the first network state information stored on the communication processor side of the terminal and the second network state information stored on the application processor side, and determining the first network state information and the Whether the second network status information is in an unlocked state;

If the first network state information and the second network state information are both in an unlocked state, determining whether the third unlocking code stored on the communication processor side of the terminal is consistent with the second unlocking code on the application processor side If the third unlock code is consistent with the second unlock code, the terminal starts to enter the standby interface.

Optionally, the method further includes:

If the first network state information and the second network state information are not both unlocked states, or if the third unlocking code does not match the second unlocking code, the fuse is performed.

Optionally, the method further includes:

If the first network state information and the second network state information are both locked state, determining whether the customer identification module SIM card lock network parameter is consistent with the lock network parameter pre-stored in the terminal;

If the SIM card lock network parameter is inconsistent with the lock network parameter pre-stored in the terminal, the terminal starts and enters a lock network limited service state;

If the SIM card lock network parameter is consistent with the lock network parameter pre-stored in the terminal, the terminal starts and enters a standby interface.

Optionally, the reading the first network state information stored on the communication processor side of the terminal and the second network state information stored on the application processor side includes:

And reading the first network state information stored in the security file system of the terminal, and the second network state information stored in the write-back memory protection zone of the terminal.

The embodiment of the invention further provides an apparatus for unlocking a network of a terminal, comprising:

a first acquiring module, configured to obtain an input first unlocking code;

The first calculating module is configured to calculate, according to the first unlocking code acquired by the first acquiring module, the first network state information obtained on the communication processor side;

a second obtaining module, configured to acquire, obtained by the application processor according to the first unlocking code The second network state information on the application processor side and the second unlock code stored on the application processor side;

a first determining module, configured to determine whether the first network state information is consistent with the second network state information, and whether the third unlocking code and the second unlocking code stored on the communications processor side are both unlocked status;

a determining module, configured to: when the first determining module determines that the first network state information and the second network state information are both unlocked, and the third unlocking code is consistent with the second unlocking code, Determining that the unlocking is successful; when the first determining module determines that the first network state information and the second network state information are not all unlocked states, or the third unlocking code is inconsistent with the second unlocking code, Make sure the unlock failed.

Optionally, the first computing module includes:

a first calculating unit, configured to obtain a first unlocking hash value by using a hash algorithm according to the unlocking code;

a first determining unit, configured to determine whether the first unlocking hash value is consistent with a first hash value stored on the communication processor side; if the first unlocking hash value is stored on the communication processor side If the first hash value is consistent, the first network state information is an unlocked state; if the first unlocked hash value is inconsistent with the first hash value stored by the communications processor side, the first The network status information is the lock network status.

Optionally, the second obtaining module includes:

a receiving unit, configured to receive an information read message sent by the application processor;

a reading unit configured to read, according to the information read message, the second network state information and the second unlocked after being encrypted, from a storage area allocated by the application processor in a memory of the terminal A code, wherein a security key of the storage area is shared by the communication processor.

Optionally, the device further includes:

The encryption module is configured to perform encryption processing on the first network state information and the third unlock code stored on the communication processor side, and save the encrypted first state information and the third unlock code in the In the storage area.

Optionally, the device further includes:

The first writing module is configured to, after the unlocking succeeds, read the encrypted first processed network state information and the third unlocking code from the storage area, and write the security file system.

Optionally, the device further includes:

The second judging module is configured to determine whether the number of unlocking times reaches a predetermined threshold after the unlocking fails, and restarts if the number of unlocking reaches a predetermined threshold, and prompts the user to re-enter the unlocking code if the number of unlocking does not reach the predetermined threshold.

a third obtaining module, configured to obtain the input first unlocking code;

a second calculating module, configured to calculate, according to the first unlocking code, second network state information on an application processor side;

And a transmission module, configured to transmit the second network state information and the second unlock code stored by the application processor side to the communications processor.

Optionally, the second calculating module includes:

a second calculating unit, configured to obtain a second unlocking hash value by using a hash algorithm according to the first unlocking code;

a second determining unit, configured to determine whether the second unlocking hash value is consistent with a second hash value stored by the application processor side; if the second unlocking hash value is stored by the application processor side If the second hash value is consistent, the second network state information is an unlocked state; if the second unlocked hash value is inconsistent with the second hash value stored by the application processor side, the second The network status information is the lock network status.

Optionally, the transmission module includes:

An allocating unit configured to allocate a storage area in a memory of the terminal, wherein the storage area is provided with a security key, and the security key is shared by the communication processor;

The encryption unit is configured to perform encryption processing on the second network state information and the second unlock code, and store the encrypted second network state information and the second unlock code in the storage area;

And a sending unit, configured to send an information read message to the communication processor, so that the communications processor reads the encrypted second network state information and the second unlock code from the storage area.

Optionally, the device further includes:

After the second write module is set to be unlocked successfully, the second network state information and the second unlock code after the encryption process are read from the storage area, and the encrypted process is performed. The second network status information and the second unlock code are written back to the write memory protection area.

The embodiment of the invention further provides a device for booting a terminal, comprising:

a third determining module, configured to determine whether the terminal is a fuse after receiving a power-on command input by the user;

a fourth determining module, configured to: when the third determining module determines that the terminal is not fused, read first network state information stored on a communication processor side of the terminal and stored on an application processor side And determining, by the network state information, whether the first network state information and the second network state information are both unlocked states;

The fifth determining module is configured to: when the fourth determining module determines that the first network state information and the second network state information are both unlocked, determine that the third device is stored on the communication processor side of the terminal Whether the unlocking code is consistent with the second unlocking code on the application processor side, and if the third unlocking code is consistent with the second unlocking code, the terminal starts to enter the standby interface.

Optionally, the device further includes:

a fuse module, configured to: when the fourth determining module determines that the first network state information is inconsistent with the second network state information, or when the fifth determining module determines the third unlocking code and the When the second unlock code does not match, the fuse is performed.

Optionally, the device further includes:

a sixth judging module, configured to: when the fourth judging module judges that the first network state information and the second network state information are both locked state, determining a SIM card lock network parameter and pre-storing in the terminal Whether the lock network parameters are consistent; if the SIM card lock network parameter is inconsistent with the lock network parameter pre-stored in the terminal, the terminal starts and enters a lock network limited service state; If the SIM card lock network parameter and the lock network parameter pre-stored in the terminal, the terminal starts and enters a standby interface.

Optionally, the fourth determining module implements, in the manner of reading, the first network state information stored on the communication processor side of the terminal and the second network state information stored on the application processor side:

The embodiment of the present invention further provides a computer readable storage medium, where the computer readable storage medium stores computer executable instructions, and when the computer executable instructions are executed, the terminal is applied to the terminal on the communication processor side to unlock the network. Methods.

The embodiment of the present invention further provides a computer readable storage medium, where the computer readable storage medium stores computer executable instructions, and when the computer executable instructions are executed, the terminal is applied to the application processor side to unlock the network. Methods.

The embodiment of the invention further provides a computer readable storage medium, wherein the computer readable storage medium stores computer executable instructions, and the method for implementing booting of the terminal when the computer executable instructions are executed.

The beneficial effects of the embodiments of the present invention are:

In the above solution, when the lock network is released, the input first unlock code is simultaneously verified on the information processor side and the application processor side, and the first network state information on the communication processor side and the application processor side are obtained. And the second network state information and the second network state information are both in an unlocked state, and the third unlocking code stored on the communication processor side is consistent with the second unlocking code stored on the application processor side, and finally The method of unlocking the network is more difficult, so that the method for unlocking the network is more difficult, and the security of the lock network is stronger and the cracking is more difficult.

In addition, when the terminal is powered on, the terminal is not fused, and the first network state information on the communication processor side and the second network state information on the application processor side are consistent, and the third unlock code stored on the communication processor side is When the second unlocking code is consistent, the terminal starts up and enters the standby interface, which prevents the terminal from being maliciously attacked and can still be used, thereby enhancing the security of the terminal. Other aspects will be apparent upon reading and understanding the drawings and detailed description.

DRAWINGS

1 is a lock network architecture diagram of a mobile phone in the related art;

2 is a startup flowchart of a lock network version mobile phone in the related art;

3 is a flow chart of unlocking the network of the lock network version of the mobile phone in the related art;

4 is a flowchart of a method for a terminal to unlock a network according to a first embodiment of the present invention;

FIG. 5 is a flowchart of a method for a terminal to unlock a network according to a second embodiment of the present invention; FIG.

6 is a flowchart of a method for booting a terminal according to a third embodiment of the present invention;

7 is a structural block diagram of an apparatus for unlocking a network of a terminal according to a fourth embodiment of the present invention;

FIG. 8 is a structural block diagram of an apparatus for unlocking a network of a terminal according to a fifth embodiment of the present invention; FIG.

FIG. 9 is a structural block diagram of an apparatus for booting a terminal according to a sixth embodiment of the present invention; FIG.

FIG. 10 is a structural diagram of a lock network of a terminal according to a seventh embodiment of the present invention; FIG.

FIG. 11 is a flowchart of booting based on the lock network architecture shown in FIG. 10;

FIG. 12 is a flow chart of unlocking the network based on the lock network architecture shown in FIG.

detailed description

Exemplary embodiments of the present application will be described below with reference to the drawings. While the exemplary embodiments of the present invention are shown in the drawings, it is understood that the invention may be embodied in a variety of forms and is not limited by the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be more fully understood, and the scope of the application can be fully conveyed to those skilled in the art.

First embodiment

According to an aspect of an embodiment of the present invention, a method for unlocking a network of a terminal is provided, the method calculating, according to the input first unlocking code, obtaining first network state information on a communication processor side; Determining, by the unlocking code, the second network state information on the application processor side, and the second unlocking code stored on the application processor side; determining whether the first network state information is consistent with the second network state information And whether the third unlock code stored on the communication processor side is consistent with the second unlock code; if the first network state information and the second network If the status information is in an unlocked state, and the third unlocking code is consistent with the second unlocking code, the unlocking succeeds; if the first network state information and the second network state information are not both unlocked, alive If the third unlock code does not match the second unlock code, the unlocking fails.

Therefore, the method for unlocking the network of the terminal in the embodiment of the present invention can simultaneously verify the input unlock code on the communication processor side and the application processor side when the lock network is released, thereby making the lock network more secure. Cracking is more difficult.

As shown in FIG. 4, it is a flowchart of a method for unlocking a network of a terminal according to an embodiment of the present invention, and the method is mainly applied to a communication processor side of a terminal. The method includes:

Step S41: Acquire an input first unlock code.

Among them, terminals of different lock network versions have different unlock codes. That is to say, a lock network version terminal has a unique one unlock code. Only when the specific unlock code is input in the terminal can the network be successfully unlocked. Otherwise, enter another incorrect unlock code and the lock will not be successfully released.

For the terminal of the lock network version, if the terminal is in the lock network state, the user needs to input the unlock code to unlock, and then the terminal can be used for communication. If the terminal is in the unlocked state, but the user needs to insert another SIM (Subscriber Identity Module) card, the user also needs to unlock the terminal.

Step S43, calculating, according to the first unlock code, obtaining first network state information on the communication processor side;

For the lock version of the terminal, when the terminal is shipped from the factory, the unlocking network algorithm parameters are saved in the terminal, including hash algorithm parameters (HCK), salt value (salt), iteration number (iteration), and unlock network status flag. (lockflag) and so on. Among them, these unlocking network algorithm parameters are stored in two parts, one of which is stored in the Secure Document System (SFS) and only allows access by the communication processor side; the other is written back to the application processor side of the write-back memory protection area (RPMB). In the case, only application processor side access is allowed.

After the user inputs the unlocking code, on the communication processor side, the first unlocking hash value is calculated by using a hash algorithm according to the unlocking code, and then the calculated first unlocking hash value is compared with the communication processor side. The hash algorithm parameters stored in the SFS, that is, the first hash value, are consistent. If they are consistent, Then, the first network state information on the communication processor side is an unlocked state, and if not, the first network state information is a locked network state. It can be understood that the algorithm used for determining the first network state information is not limited to the hash algorithm, but the algorithm used needs to belong to the unlock network algorithm parameter that is saved when the lock network version terminal is shipped from the factory. The algorithm is consistent.

Step S45: Acquire second network state information of the application processor side obtained by the application processor according to the first unlock code, and a second unlock code stored by the application processor side;

In the method for unlocking the network in the terminal of the embodiment of the present invention, when the user inputs the first unlocking code, the unlocking code is verified on both the communication processor side and the application processor side. Therefore, on the application processor side, the second unlocking hash value is calculated by using the hash algorithm according to the unlocking code, and then the calculated second unlocking hash value is compared with the stored in the RPMB of the application processor side. The second network state information of the application processor side is the unlocked state, and if not, the second network state information is the locked network state.

Wherein, since the salt value and the iteration in the process of performing the hash algorithm on the communication processor side and the application processor side are different, different first unlocked hash values and second unlocked hash values can be obtained.

After the application processor side determines the second network state information according to the obtained unlock code, the second network state information and the second unlock code stored by the application processor side need to be transmitted to the communications processor. Therefore, the application processor side sends an information read message to the communication processor, and after receiving the information read message, the communication processor reads the second network state information and the second unlock code.

In addition, in order to make the information transmission on the communication processor side and the application processor side more secure, the application processor allocates a storage area from the memory of the terminal, and the security key of the storage area is processed only on the communication processor side and the application. Share on the side of the device. Therefore, the first network state information determined by the communication processor and the third unlock code originally stored in the SFS of the communication processor can be encrypted and stored in the storage area. Similarly, the second network state information determined by the application processor and the second unlock code originally stored in the RPMB of the application processor may also be encrypted and stored in the storage area.

Therefore, when the application processor needs to perform data transmission with the communication processor, it can first be encrypted and stored in the storage area, and then the communication processor can read correspondingly from the access area according to the security key it enjoys. The data.

Step S47: determining whether the first network state information is consistent with the second network state information, and whether the third unlock code and the second unlock code stored on the communication processor side are both unlocked states;

For the lock version of the terminal, if the unlock code input by the user is wrong, the first network state information may be inconsistent with the second network state information, or the third unlock code may be inconsistent with the second unlock code, or the first network. The status information and the second network status information are both locked state. At this point, you can also prompt the user to re-enter the unlock code. In addition, it may be further determined whether the number of unlocking times reaches a predetermined threshold. If the predetermined threshold is reached, the user may be prompted to restart the terminal. If the predetermined threshold is not reached, the user is prompted to re-enter the unlocking code.

Step S49, if the first network state information and the second network state information are both in an unlocked state, and the third unlocking code is consistent with the second unlocking code, the unlocking succeeds; if the first network The status information and the second network status information are not all unlocked, or the third unlock code is inconsistent with the second unlock code, and the unlocking fails.

That is to say, only when the first network state information and the second network state information are in an unlocked state, and the third unlocking code is consistent with the second unlocking code, the unlocking can be successfully performed. Otherwise, if the first network state information is inconsistent with the second network state information, or the third unlock code is inconsistent with the second unlock code, or the first network state information is consistent with the second network state information, but the network state is locked, The lock network could not be successfully released.

In addition, after the unlocking is successful, the first network state information and the third unlock code after the encryption process may be further read from the storage area, and written into the SFS, so that the terminal is powered on or released again. Used when the lock network is judged. Among them, this is the only place where it is allowed to rewrite the lock network related parameters in the SFS.

Second embodiment

According to another aspect of the embodiments of the present invention, a method for unlocking a network by a terminal is provided, the method acquiring an input first unlock code, and obtaining a second network state of the application processor side according to the first unlock code calculation And transmitting the second network state information and the second unlock code stored by the application processor side to the communications processor.

The method for unlocking the network in the embodiment of the present invention not only needs to input the user on the side of the communication processor The unlocking code is verified, and the unlocking code input by the user is also required to be verified on the application processor side. Therefore, the method for unlocking the network in the embodiment of the present invention can make the locking network more secure and more difficult to crack.

As shown in FIG. 5, the method is applied to the application processor side, including:

Step S51: Obtain an input first unlock code.

For the terminal of the lock network version, if the terminal is in the lock network state, the user needs to input the unlock code to unlock, and then the terminal can be used for communication. If the terminal is in the unlocked state, but the user needs to insert another SIM card, the user also needs to unlock the terminal. The user can input the unlock code from the user interface on the application processor side.

Step S53: Calculate, according to the unlock code, the second network state information on the application processor side.

For the lock version of the terminal, when the terminal is shipped from the factory, the unlock network algorithm parameters, including HCK, salt value, iteration, and lockflag, are stored in the terminal. Among them, the parameters of the unlocking network algorithm are stored in two parts, one of which is stored in the SFS and only allowed to be accessed by the communication processor side; the other is stored in the RPMB of the application processor side, and only the application processor side is allowed to access.

After the user inputs the unlock code, on the application processor side, the second unlock hash value is calculated by using the hash algorithm according to the unlock code, and then the calculated second unlock hash value is compared with the application processor side. The hash algorithm parameters stored in the RPMB, that is, the second hash value, are consistent. If they are consistent, the second network state information of the application processor side is the unlocked state. If not, the second network state information is the lock network. status. It can be understood that the specific algorithm used for determining the second network state information is not limited to the hash algorithm, but the algorithm used needs to be locked with the lock network version terminal, and the unlocked network algorithm parameters are saved. The specific algorithm is consistent.

Step S55: The second network state information and the second unlock code stored by the application processor side are transmitted to the communications processor.

Wherein, step S55 includes:

That is, in order to make the information transmission on the communication processor side and the application processor side more secure, the application processor allocates a storage area from the memory of the terminal, and the security key of the storage area is only on the communication processor side and the application. Processor side sharing. Therefore, the second network state information determined by the application processor and the second unlock code originally stored in the RPMB of the application processor may also be encrypted and stored in the storage area. Then, the communication processor can read the second network state information and the second unlock code from the access area according to the security key it enjoys, so that the communication processor performs the subsequent steps of unlocking the network.

In addition, after the unlocking is successful, the second network state information and the second unlock code after the encryption process may be further read from the storage area, and written into the RPMB so that the terminal is powered on or released again. Used when the lock network is judged. Among them, this is the only place to allow the rewriting of the lock network related parameters in the RPMB.

Third embodiment

According to another aspect of the embodiments of the present invention, a method for booting a terminal is also provided. As shown in FIG. 6, the method includes:

Step S61: After receiving the power-on command input by the user, determining whether the terminal is a fuse;

For the lock version of the terminal, when booting, you need to first check whether the SIM LOCK tamper fuse is a fuse. If the fuse is used, the terminal enters the unusable state. The user cannot perform any operation except the shutdown. The security of the use of the terminal.

Step S63, if the terminal is not fused, reading first network state information stored on the communication processor side of the terminal and second network state information stored on the application processor side, and determining the first Whether the network status information and the second network status information are both unlocked states;

The first network shape can be further read only when it is determined in step S61 that the terminal is not fused. State information and second network state information. Because, during the use of the terminal, there is a place to rewrite the first network state information in the SFS of the communication processor side of the terminal in the process of unlocking the network, and a second in the RPMB on the application processor side. The place where the network status information is rewritten. The stored first network state information needs to be read from the SFS of the terminal, and the stored second network state information is read from the RPMB of the terminal. If the read first network state information and the second network state information are both unlocked, step S65 is performed.

However, if the user does not successfully cancel the lock network once the user inputs the wrong unlock code, the first network state information and the second network state information are both locked state when the terminal is powered on. At this time, it is necessary to further determine whether the SIM card lock network parameter in the terminal is consistent with the lock network parameter pre-stored in the terminal, and the SIM card lock network parameter in the terminal and the lock network parameter pre-stored in the terminal are When they are consistent, they start and enter the standby interface. If the SIM card lock network parameters in the terminal are inconsistent with the lock network parameters pre-stored in the terminal, the terminal starts, but only enters the lock network limited service state.

In addition, if the terminal has been maliciously attacked, the first state information and the second unlock state information may be inconsistent, and then the terminal performs a fuse and prompts the user to be unavailable.

Step S65: If the first network state information and the second network state information are both unlocked, determining a third unlocking code stored on a communication processor side of the terminal and a second unlocking on an application processor side Whether the codes are consistent, if they are consistent, the terminal starts to enter the standby interface.

If the third unlock code and the second unlock code are inconsistent if the terminal has been maliciously attacked, the terminal performs a fuse and prompts the user to be unavailable.

Therefore, in the method for starting the terminal of the embodiment of the present invention, the terminal is not fused, and the first network state information on the communication processor side and the second network state information on the application processor side are consistent, and the communication processor side stores When the third unlock code and the second unlock code are consistent, the terminal starts up and enters the standby interface, which prevents the terminal from being maliciously attacked and can still be used, thereby enhancing the security of the terminal.

Fourth embodiment

According to another aspect of the present invention, a device for unlocking a network is provided, which is applied to a communication processor side. As shown in FIG. 7, the device 700 includes:

The first obtaining module 701 is configured to obtain the input first unlocking code;

The first calculating module 702 is configured to be configured according to the first acquired by the first acquiring module 701 Unlocking the code, and calculating the first network state information on the communication processor side;

The second obtaining module 704 is configured to acquire second network state information of the application processor side obtained by the application processor according to the first unlocking code, and a second unlocking code stored by the application processor side;

The first determining module 705 is configured to determine whether the first network state information is consistent with the second network state information, and whether the third unlocking code and the second unlocking code stored on the communications processor side are both Unlocked state;

The determining module 706 is configured to: when the first determining module 705 determines that the first network state information and the second network state information are both unlocked, and the third unlocking code is consistent with the second unlocking code Determining that the unlocking succeeds; when the first determining module determines that the first network state information and the second network state information are not all unlocked states, or the third unlocking code is inconsistent with the second unlocking code When it is determined that the unlocking failed.

Optionally, the first calculating module 702 includes:

The first calculating unit 7021 is configured to obtain a first unlocking hash value by using a hash algorithm according to the unlocking code;

The first determining unit 7022 is configured to determine whether the first unlocking hash value is consistent with the first hash value stored by the communications processor side; if the first unlocking hash value is opposite to the communications processor side If the stored first hash value is consistent, the first network state information is an unlocked state; if the first unlocked hash value does not match the first hash value stored by the communications processor side, the first A network status information is a lock network status.

Optionally, the second obtaining module 704 includes:

The receiving unit 7041 is configured to receive an information read message sent by the application processor;

The reading unit 7042 is configured to read, according to the information read message, the second network state information and the second processed after being encrypted, from a storage area allocated by the application processor in a memory of the terminal An unlock code, wherein a security key of the storage area is shared by the communication processor.

Optionally, the device 700 further includes:

The encryption module 703 is configured to encrypt the first network state information and the third unlock code stored on the communication processor side, and encrypt the processed first network state information and the third The unlock code is saved in the storage area.

Optionally, the device 700 further includes:

The first writing module 707 is configured to read the encrypted first network state information and the third unlocking code from the storage area after the unlocking is successful, and write the third network unlocking code to the secure document system.

Optionally, the device 700 further includes:

The second judging module 708 is configured to determine whether the unlocking number reaches a predetermined threshold after the unlocking fails, and if the unlocking number reaches a predetermined threshold, restarting; if the unlocking number does not reach the predetermined threshold, prompting the user to re-enter the unlocking code .

Fifth embodiment

According to another aspect of the present invention, a device for unlocking a network is provided, which is applied to an application processor side. As shown in FIG. 8, the device 800 includes:

The third obtaining module 801 is configured to obtain the input first unlocking code;

The second calculating module 802 is configured to obtain second network state information of the application processor side according to the first unlocking code calculation;

The transmission module 803 is configured to transmit the second network state information and the second unlock code stored by the application processor side to the communications processor.

Optionally, the second calculating module 802 includes:

The second calculating unit 8021 is configured to obtain a second unlocking hash value by using a hash algorithm according to the first unlocking code;

The second determining unit 8022 is configured to determine whether the second unlocking hash value is consistent with the second hash value stored by the application processor side; if the second unlocking hash value is opposite to the application processor side If the stored second hash value is consistent, the second network state information is an unlocked state; if the second unlocked hash value does not match the second hash value stored by the application processor side, the first The second network status information is a lock network status.

Optionally, the transmission module 803 includes:

The allocating unit 8031 is configured to allocate a storage area in a memory of the terminal, wherein the storage area is provided with a security key, and the security key is shared by the communication processor;

The encryption unit 8032 is configured to perform encryption processing on the second network state information and the second unlock code, and store the encrypted second network state information and the second unlock code in the storage area. ;

The sending unit 8033 is configured to send an information read message to the communications processor, so that the communications processor reads the second network state information and the second unlocking code after the encryption process from the storage area. .

Optionally, the device 800 further includes:

The second writing module 804 is configured to read the encrypted second network state information and the second unlocking code from the storage area after the unlocking is successful, and the encrypted processing The second network state information and the second unlock code are written back to the write memory protection area.

Sixth embodiment

According to another aspect of the embodiments of the present invention, there is also provided a device for booting a terminal. As shown in FIG. 9, the device 900 includes:

The third determining module 901 is configured to determine, after receiving the power-on command input by the user, whether the terminal is a fuse;

The fourth determining module 902 is configured to: when the third determining module 901 determines that the terminal is not fused, read the first network state information stored on the communication processor side of the terminal and stored on the application processor side. Determining, by the second network state information, whether the first network state information and the second network state information are both unlocked states;

The fifth judging module 903 is configured to: when the fourth judging module 902 determines that the first network state information and the second network state information are both unlocked, determine that the communication processor side is stored on the terminal Whether the third unlocking code is consistent with the second unlocking code on the application processor side, and if the third unlocking code is consistent with the second unlocking code, the terminal starts to enter the standby interface.

Optionally, the device 900 further includes:

The fuse module 904 is configured to: when the fourth determining module 902 determines that the first network state information is inconsistent with the second network state information, or when the fifth determining module 903 determines the third unlocking code When the second unlock code does not coincide with the fuse, the fuse is performed.

Optionally, the device 900 further includes:

The sixth judging module 905 is configured to: when the fourth judging module 902 determines that the first network state information and the second network state information are both locked state, determine the SIM card lock network parameters and pre-stored in the Whether the lock network parameters in the terminal are consistent; if the SIM card lock network parameter is inconsistent with the lock network parameter pre-stored in the terminal, the terminal starts and enters a lock network limited service state; if the SIM The card lock network parameter is consistent with the lock network parameter pre-stored in the terminal, and the terminal starts and enters a standby interface.

Optionally, the fourth determining module 902 implements, in the manner of reading, the first network state information stored on the communication processor side of the terminal and the second network state information stored on the application processor side:

Seventh embodiment

As shown in FIG. 10, it is a lock network architecture diagram of a terminal according to an embodiment of the present invention.

Wherein, the communication processor side in the figure includes:

The SIM LOCK Engine is configured to handle the related unlocking operation on the communication processor side and execute the main process of the lock network unlocking operation;

A multi-mode universal card driver interface (MMGSDI task), configured to obtain a SIM card message and provide the lock network engine;

SIM card driver (UIM/SIM drivers), set to drive the SIM card;

Secure File System (SFS), set to store lock network related parameters, and provides an application programming (API) interface, where the data stored in the SFS is encrypted storage.

The application processor side includes:

The system user interface (Android UI) is set to provide an unlock code input interface, displaying the lock network status, prompting an unlock error;

Wireless Interface Layer Driver (RILD) as a wireless protocol interface between the system user interface and the communication processor;

SIM Lock app, running in the Trust Zone, executing the application A key verification algorithm on the processor side, such as PBKDF2, checks whether the unlock code input by the user is correct, and allocates a storage area (Secure Channel) for data transmission between the communication processor and the application processor in the memory, wherein The Secure Channel can only be accessed by the Trust Zone and the communication processor, accessed by the chip xPU, and the transmitted data is encrypted data, and the key is only shared between the communication processor and the Trust Zone;

Write back the memory protection area (RPMB), set to store the lock network related parameters;

The main function of the SIM LOCK Service is that after the communication processor writes the encrypted data to the Secure Channel, the SIM LOCK Service receives the notification message, and the SIM LOCK Service sends a notification message to notify the Trust Zone to read the relevant data from the Secure Channel. Similarly, when the Trust Zone writes encrypted data to the Secure Channel, it notifies the SIM LOCK Service to send a notification notification message to the communication processor.

Based on the lock network architecture diagram of the terminal shown in FIG. 10, the boot process of the terminal is as shown in FIG. include:

Step S1001, determining whether the terminal is tampering with the fuse, if the terminal is tamper with the fuse, then step S1006; if the terminal has not tamper with the fuse, then step S1002;

Step S1002: determining whether the state of the application processor side and the communication processor side are the same, and if the state of the application processor side and the communication processor side do not match, step S1005 is performed; if the application processor side is consistent with the state of the communication processor side , step S1003 is performed;

Step S1003, determining whether it is an unlocked state or a locked network state; if the application processor side and the communication processor side are both locked state, step S1004 is performed; if the application processor side and the communication processor side are both unlocked, executing Step S1008;

Step S1004, determining whether the lock network parameters and SIM card parameters are consistent, if the lock network parameters and SIM card parameters, then step S1008; if the lock network parameters and SIM card parameters are inconsistent, then step S1007;

Step S1005, the fuse, and then the terminal enters an unusable state;

In step S1006, the terminal enters an unusable state.

Step S1007, the lock network limited service state.

Step S1008, starting normally.

Based on the lock network architecture diagram of the terminal shown in FIG. 10, the unlocking process of the terminal is as shown in FIG. 12. include:

After the user inputs the unlock code in the upper layer system, the upper layer system transmits the unlock code to the application processor side and the communication processor side respectively, and the communication processor side and the application processor side respectively perform hash calculation;

Wherein, on the communication processor side, the first unlocked hash value (HCK1) is calculated, and then compared with the first hash value stored in the SFS, if the first unlocked hash value and the first hash stored in the SFS If the values are consistent, the first network state information (lockstate1) is (unlocked state) unlocked; if the first unlocked hash value is inconsistent with the first hash value stored in the SFS, the first network state information is (locked network state) Locked; writes the third unlock code (CK3) data in lockstate1 and SFS to the secure channel.

On the application processor side, the second unlock hash value (HCK2) is calculated and then compared with the second hash value stored in the RPMB if the second unlock hash value is consistent with the second hash value stored in the RPMB. The second network state information (lockstate2) is unlocked; if the second unlocking hash value is inconsistent with the second hash value stored in the RPMB, the second network state information is locked; the second unlock in the lockstate2 and the RPMB The code (CK2) data is written to the secure channel.

When the communication processor side receives the application processor side write data notification, it checks whether lockstate1 and lockstate2 and CK3 and CK2 are consistent. If both lockstate1 and lockstate2 are unlocked, and CK3 and CK2 are caused, the unlocking succeeds. Lockstate1 is written to the SFS and secure channel along with the third unlock code (CK3). The Trust Zone is notified by the SIM LOCK Service, and the Trust Zone is written to the RPMB. If lockstate1 and lockstate2 are not unlocked, and the live CK3 and CK2 are inconsistent, the unlock is judged. Whether the number of times of recognition reaches a predetermined threshold, if the number of times of unlocking recognition does not reach a predetermined threshold, the user is prompted to re-enter; if the number of times of unlocking recognition reaches a predetermined threshold, the terminal restarts.

In summary, the lock network system of the terminal of the embodiment includes two parts, an application processor side and a communication processor side. When the lock network is released, the input unlock code is simultaneously performed on the communication processor side and the application processor side. Verification, which makes the lock network more secure and more difficult to crack.

One of ordinary skill in the art will appreciate that all or a portion of the above steps may be performed by a program to instruct related hardware, such as a processor, which may be stored in a computer readable storage medium, such as a read only memory, disk or optical disk. Wait. Alternatively, all or part of the steps of the above embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module/unit in the above embodiment may be implemented in the form of hardware, for example, by implementing an integrated circuit to implement its corresponding function, or may be implemented in the form of a software function module, for example, executing a program stored in the memory by a processor. / instruction to achieve its corresponding function. This application is not limited to any specific combination of hardware and software. A person skilled in the art should understand that the technical solutions of the present application can be modified or equivalent, without departing from the spirit and scope of the technical solutions of the present application, and should be included in the scope of the claims of the present application.

Industrial applicability

The above technical solution makes the lock network more secure and more difficult to crack.

Claims

A method for a terminal to unlock a network includes:

Obtain the first unlock code entered;

Calculating, according to the first unlocking code, first network state information on the communication processor side;

Obtaining second network state information of the application processor side obtained by the application processor according to the first unlock code, and a second unlock code stored by the application processor side;

Determining whether the first network state information and the second network state information are both in an unlocked state, and whether the third unlocking code stored on the communications processor side is consistent with the second unlocking code;

If the first network state information and the second network state information are both in an unlocked state, and the third unlocking code is consistent with the second unlocking code, the unlocking succeeds; if the first network state information and The second network state information is not all unlocked, or the third unlock code does not match the second unlock code, and the unlocking fails.
The method of claim 1, wherein the calculating the first network state information on the communication processor side according to the first unlock code comprises:

Obtaining a first unlocking hash value by using a hash algorithm according to the unlocking code;

Determining whether the first unlock hash value is consistent with the first hash value stored on the communication processor side;

If the first unlocking hash value is consistent with the first hash value stored by the communications processor side, the first network state information is an unlocked state;

If the first unlock hash value does not match the first hash value stored on the communication processor side, the first network state information is a lock network state.
The method of claim 1, wherein the acquisition application processor calculates the obtained second network state information of the application processor side according to the unlock code, and the second unlocking stored by the application processor side. Code, including:

Receiving an information read message sent by the application processor;

The second network state information and the second unlock code after the encryption process are read from the storage area allocated by the application processor in the memory of the terminal, according to the information read message, where The security key of the storage area is shared by the communication processor.
The method of claim 3, after the obtaining the first network state information on the communication processor side according to the unlocking code, the method further comprises:

Encrypting the first network state information and the third unlock code stored on the communication processor side, and storing the encrypted first network state information and the third unlock code in the storage area .
The method of claim 4, after the unlocking is successful, the method further comprises:

The first network state information and the third unlock code after the encryption process are read from the storage area and written into the secure document system.
The method of claim 1, after the unlocking fails, the method further comprises:

It is determined whether the number of unlocking times reaches a predetermined threshold. If the number of unlocking times reaches a predetermined threshold, the system restarts. If the number of unlocking times does not reach the predetermined threshold, the user is prompted to re-enter the unlocking code.
A method for a terminal to unlock a network includes:

Obtain the first unlock code entered;

Obtaining second network state information of the application processor side according to the first unlock code calculation;

Transmitting the second network state information and the second unlock code stored on the application processor side to the communications processor.
The method of claim 7, the calculating the second network state information of the application processor side according to the first unlock code, comprising:

Obtaining a second unlocking hash value by using a hash algorithm according to the first unlocking code;

Determining whether the second unlock hash value is consistent with the second hash value stored by the application processor side;

If the second unlocking hash value is consistent with the second hash value stored by the application processor side, the second network state information is an unlocked state;

And if the second unlock hash value does not match the second hash value stored by the application processor side, the second network state information is a lock network state.
The method of claim 8 wherein said said second network status information and The second unlock code stored on the application processor side is transmitted to the communications processor, and includes:

Allocating a storage area in a memory of the terminal, wherein the storage area is provided with a security key, and the security key is shared by the communication processor;

Encrypting the second network state information and the second unlock code, and storing the encrypted second network state information and the second unlock code in the storage area;

Sending an information read message to the communication processor, so that the communication processor reads the encrypted network state information and the second unlock code from the storage area.
The method of claim 9 wherein said security key is further shared by said application processor;

After the unlocking is successful, the method further includes:

Reading the second network state information and the second unlock code after the encryption process from the storage area, and writing the second network state information and the second unlock code after the encryption process Write a memory protection area.
A method for booting a terminal, comprising:

After receiving the input power-on command, determining whether the terminal is a fuse;

If not, reading the first network state information stored on the communication processor side of the terminal and the second network state information stored on the application processor side, and determining the first network state information and the Whether the second network status information is in an unlocked state;

If the first network state information and the second network state information are both in an unlocked state, determining whether the third unlocking code stored on the communication processor side of the terminal is consistent with the second unlocking code on the application processor side If the third unlock code is consistent with the second unlock code, the terminal starts to enter the standby interface.
The method of claim 11 further comprising:

If the first network state information and the second network state information are not both unlocked states, or if the third unlocking code does not match the second unlocking code, the fuse is performed.
The method of claim 11 further comprising:

If the first network state information and the second network state information are both locked state, then Whether the SIM card lock network parameter of the customer identification module is consistent with the lock network parameter pre-stored in the terminal;

If the SIM card lock network parameter is inconsistent with the lock network parameter pre-stored in the terminal, the terminal starts and enters a lock network limited service state;

If the SIM card lock network parameter is consistent with the lock network parameter pre-stored in the terminal, the terminal starts and enters a standby interface.
The method of claim 11, wherein the reading the first network state information stored on the communication processor side of the terminal and the second network state information stored on the application processor side comprises:

And reading the first network state information stored in the security file system of the terminal, and the second network state information stored in the write-back memory protection zone of the terminal.
A device for unlocking a network of a terminal, comprising:

a first acquiring module, configured to obtain an input first unlocking code;

The first calculating module is configured to calculate, according to the first unlocking code acquired by the first acquiring module, the first network state information obtained on the communication processor side;

a second acquiring module, configured to acquire second network state information of the application processor side obtained by the application processor according to the first unlocking code, and a second unlocking code stored by the application processor side;

a first determining module, configured to determine whether the first network state information is consistent with the second network state information, and whether the third unlocking code and the second unlocking code stored on the communications processor side are both unlocked status;

a determining module, configured to: when the first determining module determines that the first network state information and the second network state information are both unlocked, and the third unlocking code is consistent with the second unlocking code, Determining that the unlocking is successful; when the first determining module determines that the first network state information and the second network state information are not all unlocked states, or the third unlocking code is inconsistent with the second unlocking code, Make sure the unlock failed.
The apparatus of claim 15 wherein said first computing module comprises:

a first calculating unit, configured to obtain a first unlocking by using a hash algorithm according to the unlocking code Greek value

a first determining unit, configured to determine whether the first unlocking hash value is consistent with a first hash value stored on the communication processor side; if the first unlocking hash value is stored on the communication processor side If the first hash value is consistent, the first network state information is an unlocked state; if the first unlocked hash value is inconsistent with the first hash value stored by the communications processor side, the first The network status information is the lock network status.
The apparatus of claim 15, wherein the second acquisition module comprises:

a receiving unit, configured to receive an information read message sent by the application processor;

a reading unit configured to read, according to the information read message, the second network state information and the second unlocked after being encrypted, from a storage area allocated by the application processor in a memory of the terminal A code, wherein a security key of the storage area is shared by the communication processor.
The apparatus of claim 17 further comprising:

The encryption module is configured to perform encryption processing on the first network state information and the third unlock code stored on the communication processor side, and save the encrypted first state information and the third unlock code in the In the storage area.
The device of claim 18, the device further comprising:

The first writing module is configured to, after the unlocking succeeds, read the encrypted first processed network state information and the third unlocking code from the storage area, and write the security file system.
The device of claim 15 further comprising:

The second judging module is configured to determine whether the number of unlocking times reaches a predetermined threshold after the unlocking fails, and restarts if the number of unlocking reaches a predetermined threshold, and prompts the user to re-enter the unlocking code if the number of unlocking does not reach the predetermined threshold.
A device for unlocking a network of a terminal, comprising:

a third obtaining module, configured to obtain the input first unlocking code;

a second calculating module, configured to calculate, according to the first unlocking code, second network state information on an application processor side;

a transmission module configured to store the second network state information and the application processor side The second unlock code is transmitted to the communication processor.
The apparatus of claim 21 wherein said second computing module comprises:

a second calculating unit, configured to obtain a second unlocking hash value by using a hash algorithm according to the first unlocking code;

a second determining unit, configured to determine whether the second unlocking hash value is consistent with a second hash value stored by the application processor side; if the second unlocking hash value is stored by the application processor side If the second hash value is consistent, the second network state information is an unlocked state; if the second unlocked hash value is inconsistent with the second hash value stored by the application processor side, the second The network status information is the lock network status.
The apparatus of claim 22 wherein said transmission module comprises:

An allocating unit configured to allocate a storage area in a memory of the terminal, wherein the storage area is provided with a security key, and the security key is shared by the communication processor;

The encryption unit is configured to perform encryption processing on the second network state information and the second unlock code, and store the encrypted second network state information and the second unlock code in the storage area;

And a sending unit, configured to send an information read message to the communication processor, so that the communications processor reads the encrypted second network state information and the second unlock code from the storage area.
The device of claim 23, the device further comprising:

After the second write module is set to be unlocked successfully, the second network state information and the second unlock code after the encryption process are read from the storage area, and the encrypted process is performed. The second network status information and the second unlock code are written back to the write memory protection area.
A device for booting a terminal, comprising:

a third determining module, configured to determine whether the terminal is a fuse after receiving a power-on command input by the user;

a fourth determining module, configured to: when the third determining module determines that the terminal is not fused, read first network state information stored on a communication processor side of the terminal and stored on an application processor side Two network status information, and determining the first network status information and the second network status Whether the information is unlocked;

The fifth determining module is configured to: when the fourth determining module determines that the first network state information and the second network state information are both unlocked, determine that the third device is stored on the communication processor side of the terminal Whether the unlocking code is consistent with the second unlocking code on the application processor side, and if the third unlocking code is consistent with the second unlocking code, the terminal starts to enter the standby interface.
The apparatus of claim 25, the apparatus further comprising:

a fuse module, configured to: when the fourth determining module determines that the first network state information is inconsistent with the second network state information, or when the fifth determining module determines the third unlocking code and the When the second unlock code does not match, the fuse is performed.
The apparatus of claim 25, the apparatus further comprising:

The sixth judging module is configured to: when the fourth judging module judges that the first network state information and the second network state information are both locked state, determining that the customer identification module SIM card lock network parameter is pre-stored in Whether the lock network parameters in the terminal are consistent; if the SIM card lock network parameter is inconsistent with the lock network parameter pre-stored in the terminal, the terminal starts and enters a lock network limited service state; The SIM card lock network parameter and the lock network parameter pre-stored in the terminal, the terminal starts and enters a standby interface.
The apparatus according to claim 25, wherein said fourth judging module realizes, in said manner, said reading of first network state information stored on a communication processor side of said terminal and stored on an application processor side Second network status information:

And reading the first network state information stored in the security file system of the terminal, and the second network state information stored in the write-back memory protection zone of the terminal.