WO2017166362A1 - 一种esim号码的写入方法、安全系统、esim号码服务器及终端 - Google Patents

一种esim号码的写入方法、安全系统、esim号码服务器及终端 Download PDF

Info

Publication number
WO2017166362A1
WO2017166362A1 PCT/CN2016/080827 CN2016080827W WO2017166362A1 WO 2017166362 A1 WO2017166362 A1 WO 2017166362A1 CN 2016080827 W CN2016080827 W CN 2016080827W WO 2017166362 A1 WO2017166362 A1 WO 2017166362A1
Authority
WO
WIPO (PCT)
Prior art keywords
esim number
esim
security system
server
number server
Prior art date
Application number
PCT/CN2016/080827
Other languages
English (en)
French (fr)
Inventor
陈历伟
李如森
Original Assignee
宇龙计算机通信科技(深圳)有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 宇龙计算机通信科技(深圳)有限公司 filed Critical 宇龙计算机通信科技(深圳)有限公司
Publication of WO2017166362A1 publication Critical patent/WO2017166362A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/18—Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/18—Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
    • H04W8/183—Processing at user equipment or user record carrier
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0478—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/12—Setup of transport tunnels
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/18—Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
    • H04W8/20—Transfer of user or subscriber data
    • H04W8/205—Transfer to or from user equipment or user record carrier
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]

Definitions

  • the present invention relates to the field of communications, and in particular, to a method for writing an ESIM number, a security system, and a terminal.
  • SIM card Subscriber Identity Module
  • ESIM card Subscriber Identity Module
  • the ESIM card is an embedded SIM card that integrates SIM card information into the device chip. Compared with the traditional SIM card, the ESIM card is similar to a virtual SIM card. If an ESIM card device is used, the user is no longer required to purchase. After the device is plugged in, you can select the carrier network and package by directly using software registration or direct purchase. However, the logic of the ESIM card and the SIM card is the same, but it is changed from the external to the embedded, and there is no improvement in security.
  • the ESIM card can be applied to devices such as mobile phones, tablets, routers, etc., as storage user data, authentication methods, and keys, which are the basic components of communication and require security protection.
  • the writing method of the ESIM number is mainly as follows: 1. The ESIM number data is sent from the background server; 2. is transmitted to the mobile terminal through a common network connection; 3. The mobile terminal writes the information to the ESIM through the ordinary system. Device chip. It can be seen from the above process that the method for writing the ESIM number has the following problems: 1. The connection network is initiated by the ordinary system, and the transmission security is not guaranteed; 2.
  • the ESIM number data information is written by the ordinary system to the ESIM chip device, and the data is The risk of hijacking and tampering; 3.
  • the mobile terminal does not have a whitelisting mechanism, there may be illegal server disruption, and there is a risk of malicious writing.
  • the embodiment of the invention provides a method for writing an ESIM number, a security system and a terminal, which can effectively avoid the risks that may exist in each link of the ESIM number writing and improve the security of the ESIM number.
  • the first aspect of the present invention provides a method for writing an ESIM number, which may include:
  • the security system receives the ESIM number write command
  • the security system If the security system queries the ESIM number write command to match the ESIM number server whitelist, the security system sends an ESIM number write request to the corresponding ESIM number server through the virtual private network VPN according to the ESIM number write command;
  • the security system receives the encrypted ESIM number data sent by the ESIM number server based on the ESIM number write request;
  • the security system decrypts the encrypted ESIM number data
  • the security system writes the decrypted ESIM number data to the ESIM device.
  • the security system initiates an ESIM number write to the corresponding ESIM number server through the virtual private network VPN according to the ESIM number write command.
  • the method further includes:
  • the security system queries whether the ESIM number write command matches the ESIM number server white list.
  • the ESIM number server white list is established for the terminal at a target location other than the security system, and the security system is a system established by the terminal.
  • the security system initiates an ESIM number to the corresponding ESIM number server through the virtual private network VPN according to the ESIM number write command.
  • the method further includes:
  • the security system queries whether the ESIM number write command matches the ESIM number server whitelist, and the ESIM number server whitelist is established locally for the security system.
  • the method further includes:
  • the security system sends a security identification message to the ESIM number server through the VPN;
  • the security system is triggered to receive the encrypted ESIM number data sent by the ESIM number server based on the ESIM number write request.
  • the security system receives the ESIM number deletion command
  • the security system determines the first target ESIM number according to the ESIM number deletion command
  • the security system deletes the first target ESIM number from the ESIM device.
  • the security system receives the ESIM number logout instruction
  • the security system sends an ESIM number logout request to the ESIM number server through the VPN according to the ESIM number logout command, so that the ESIM number server cancels the data of the corresponding second target ESIM number according to the ESIM number logout request.
  • a second aspect of the present invention provides a method for writing an ESIM number, which may include:
  • the ESIM number server receives an ESIM number write request sent by the security system through the virtual private network VPN;
  • the ESIM number server transmits the encrypted ESIM number data to the security system via the VPN according to the ESIM number write request.
  • the ESIM number server encrypts the corresponding ESIM number data according to the ESIM number write request to obtain the encrypted ESIM number data.
  • the method also included:
  • the ESIM number server receives the security identification message sent by the security system through the VPN;
  • the ESIM number server verifies the security identification message
  • the ESIM number server is triggered to send the encrypted ESIM number data to the security system via the VPN according to the ESIM number write request.
  • the method further includes:
  • the ESIM number server receives the ESIM number logout request sent by the security system through the VPN;
  • the ESIM number server determines the second target ESIM number according to the ESIM number logout request
  • the ESIM number server logs out the data of the second target ESIM number.
  • a third aspect of the present invention provides a security system, which may include:
  • a first receiving module configured to receive an ESIM number write command
  • the first sending module is configured to: when the security system queries the ESIM number write command to match the ESIM number server whitelist, sends the ESIM number write command received by the first receiving module to the corresponding ESIM number server through the virtual private network VPN. ESIM number write request;
  • a second receiving module configured to receive encrypted ESIM number data sent by the ESIM number server based on an ESIM number write request sent by the first sending module
  • a decryption module configured to decrypt the encrypted ESIM number data received by the second receiving module
  • the writing module is configured to write the ESIM number data decrypted by the decryption module to the ESIM device.
  • the security system further includes:
  • the first query module is configured to query whether the ESIM number write command received by the first receiving module matches the whitelist of the ESIM number server, and the whitelist of the ESIM number server is established by the terminal at a target location other than the security system, and the security system is established by the terminal. A system.
  • the security system method further includes:
  • the second query module is configured to query whether the ESIM number write command received by the first receiving module matches the ESIM number server white list, and the ESIM number server white list is established locally by the security system.
  • the security system also includes:
  • a second sending module configured to send a security identifier message to the ESIM number server by using a VPN
  • the triggering module is configured to: when the ESIM number server verifies that the security identification message sent by the second sending module is successful, triggering the second receiving module to receive the ESIM number server, based on the ESIM number, Request to send encrypted ESIM number data.
  • the security system further includes:
  • a third receiving module configured to receive an ESIM number deletion instruction
  • a determining module configured to determine a first target ESIM number according to an ESIM number deletion instruction received by the third receiving module
  • a deleting module configured to delete, from the ESIM device, the first target ESIM number determined by the determining module.
  • the security system further includes:
  • a fourth receiving module configured to receive an ESIM number logout instruction
  • the third sending module is configured to send an ESIM number logout request to the ESIM number server by using the ESIM number logout command received by the fourth receiving module, so that the ESIM number server cancels the data of the corresponding second target ESIM number according to the ESIM number logout request. .
  • a fourth aspect of the present invention provides an ESIM number server, which may include:
  • a first receiving module configured to receive an ESIM number write request sent by the security system through the virtual private network VPN
  • a sending module configured to send the encrypted ESIM number data to the security system by using the VPN according to the ESIM number write request received by the first receiving module.
  • the ESIM number server further includes:
  • a second receiving module configured to receive a security identifier message sent by the security system through the VPN
  • a verification module configured to verify a security identification message received by the second receiving module
  • the triggering module is configured to: when the verification module verifies that the security identification message is successful, trigger the sending module to send the encrypted ESIM number data to the security system through the VPN according to the ESIM number writing request.
  • the ESIM number server further includes:
  • a third receiving module configured to receive an ESIM number sent by the security system through the VPN
  • a determining module configured to determine a second target ESIM number according to the ESIM number logout request received by the third receiving module
  • the logout module is configured to log out the data of the second target ESIM number determined by the determining module.
  • a fifth aspect of the present invention provides a terminal, a communication bus, an input device, an output device, a memory, and a processor, wherein:
  • the communication bus is configured to implement connection communication between the input device, the output device, the memory, and the processor;
  • the input device is configured to receive an ESIM number write command
  • the output device is configured to send an ESIM number write request to the corresponding ESIM number server through the virtual private network VPN according to the ESIM number write command;
  • the program stores a set of program codes, and the terminal calls the program code stored in the memory to perform the following operations:
  • the input device receives an ESIM number write command
  • the output device sends an ESIM number write to the corresponding ESIM number server through the virtual private network VPN according to the ESIM number write command. request;
  • the input device receives encrypted ESIM number data sent by the ESIM number server based on the ESIM number write request;
  • the processor decrypts the encrypted ESIM number data
  • the output device writes the decrypted ESIM number data to the ESIM device.
  • the processor queries whether the ESIM number write command is The whitelist of the ESIM number server is matched, and the whitelist of the ESIM number server is established by the terminal at the target location.
  • the processor queries whether the ESIM number write command is The ESIM number server whitelist matches, The ESIM number server whitelist is established locally for the terminal.
  • the output device sends a security identifier message to the ESIM number server by using the VPN;
  • the input device receives an ESIM number deletion instruction
  • the processor deletes the first target ESIM number from the ESIM device.
  • the input device receives an ESIM number logout instruction
  • the output device sends an ESIM number logout request to the ESIM number server through the VPN according to the ESIM number logout command, so that the ESIM number server cancels the corresponding second target ESIM number according to the ESIM number logout request. data.
  • the ESIM number write command can be used to send the corresponding ESIM through the virtual private network VPN.
  • the number server sends an ESIM number write request, and can decrypt the encrypted ESIM number data sent by the ESIM number server, and then write the decrypted ESIM number data to the ESIM device.
  • the present embodiment not only has a whitelist mechanism, but also writes the ESIM device through the VPN connection transmission, data encryption, and security system, and establishes a secure write of the three-dimensional security ESIM number data information from the background server, the transmission pipeline, and the terminal.
  • the process of the ESIM device effectively avoids risks such as hijacking, tampering or malicious writing of data that may exist in each link.
  • 1 is an embodiment of a method for writing an ESIM number according to an embodiment of the present invention
  • FIG. 2 is another embodiment of a method for writing an ESIM number according to an embodiment of the present invention.
  • FIG. 3 is another embodiment of a method for writing an ESIM number according to an embodiment of the present invention.
  • FIG. 5 is still another embodiment of a method for writing an ESIM number according to an embodiment of the present invention.
  • FIG. 6 is an embodiment of a security system according to an embodiment of the present invention.
  • FIG. 7 is an embodiment of an ESIM number server according to an embodiment of the present invention.
  • FIG. 8 is a schematic structural diagram of a terminal according to an embodiment of the present invention.
  • the embodiment of the invention provides a method for writing an ESIM number, a security system, an ESIM number server and a terminal, which can effectively avoid the risks that may exist in each link of the ESIM number writing and improve the security of the ESIM number.
  • an embodiment of the method for writing an ESIM number in the embodiment of the present invention includes:
  • the security system receives an ESIM number write command.
  • the terminal includes, but is not limited to, a portable device such as a smart phone or a tablet computer represented by an Android, an IOS, or a Windows system.
  • the terminal can install multiple intelligent operating systems, and can specify one of them as a security system, that is, the security system is a terminal that can write the ESIM number. Operating system. If the terminal is a device with an ESIM card, the user can be more flexible in selecting an operator or a replacement carrier. When the user selects an operator's ESIM number as the communication number, the security system can receive the ESIM number write command.
  • the security system If the security system queries the ESIM number write command to match the ESIM number server whitelist, the security system sends an ESIM number write request to the corresponding ESIM number server through the virtual private network VPN according to the ESIM number write command.
  • the security system After the security system receives the ESIM number write command, if the security system queries the ESIM number write command to match the ESIM number server whitelist, it means that the security system can use the virtual private network VPN to correspond to the ESIM number according to the ESIM number write command.
  • the server sends an ESIM number write request.
  • the whitelist of the ESIM number server in this embodiment is used to filter the illegal server to prevent malicious server from maliciously writing.
  • the ESIM number write command contains the address of the ESIM number server, and the ESIM number server white list also records the address of the ESIM number server. Only the address in the ESIM number write command matches the address recorded in the ESIM number server white list. The security system will perform the corresponding operations.
  • the security system querying the ESIM number write command and the ESIM number server white list matching is described in the foregoing content.
  • the security system may also be combined according to other query methods or If you can use it alone, you can find out whether the ESIM number write command matches the ESIM number server whitelist.
  • the specific query mode is not limited here.
  • the security system receives the encrypted ESIM number data sent by the ESIM number server based on the ESIM number write request.
  • the security system After the security system sends an ESIM number write request to the ESIM number server, the security system can receive the encrypted ESIM number data sent by the ESIM number server based on the ESIM number write request.
  • the security system decrypts the encrypted ESIM number data
  • the security system After the security system receives the encrypted ESIM number data sent by the ESIM number server, the security system can decrypt the encrypted ESIM number data.
  • the security system in order to avoid encrypting the ESIM number data, it is passed through the VPN. The transmission is intercepted, causing malicious leakage or tampering.
  • the encrypted ESIM number data does not carry the corresponding key.
  • the security system receives the encrypted ESIM number data, it can decrypt it by a preset decryption method.
  • the security system is not limited to decrypting the encrypted ESIM number data by using a preset decryption manner, and may be a corresponding mapping relationship, or may be digital decryption, such as obtaining an encrypted password through an encryption operation, as long as The decryption method is saved by the security system, and the decryption operation is performed only by the security system.
  • the security system writes the decrypted ESIM number data to the ESIM device.
  • the decrypted ESIM number data can be written into the ESIM device.
  • the ESIM device in this embodiment may write one or more ESIM number data, such as a dual card dual standby terminal using a SIM card, and when the ESIM number data is written into the ESIM device, the security is performed.
  • the system can set a flag such as a flag for each of the written SEIM numbers to indicate that the ESIM number is from the ESIM device.
  • the ESIM device has permission settings for the operating system installed in the terminal. For a relatively secure system, the terminal has read access only for systems other than the security system.
  • the ESIM number server is used to initiate an ESIM number write request to the ESIM number server by using the ESIM number server whitelist verification, and then the encrypted ESIM number data sent by the ESIM number server is received, and the decrypted ESIM number data is written by the security system.
  • the ESIM device fully avoids the risks that may occur in each link of the ESIM number writing process, and embodies the unique read and write permissions of the security system to the ESIM device, ensuring the security of the ESIM number writing.
  • the terminal in this embodiment may establish a whitelist mechanism, but the location where the security system queries the ESIM number server whitelist may be different, that is, the ESIM number server whitelist may be established by the terminal at a target location other than the security system.
  • the method for writing the ESIM number in the embodiment of the present invention includes:
  • Step 201 in this embodiment is the same as step 101 in the embodiment shown in FIG. 1, and details are not described herein again.
  • the security system queries whether the ESIM number write command matches the ESIM number server white list, if not, proceeds to step 203, and if so, proceeds to step 204;
  • the security system After the security system receives the ESIM number write command, the security system can query the ESIM number. Whether the code write command matches the ESIM number server whitelist.
  • the whitelist of the ESIM number server in this embodiment is established to prevent the disruption of the illegal server.
  • the whitelist of the ESIM number server may be established for the terminal at a target location other than the security system, such as a control system, or may be secure.
  • the system is established locally. As long as the security system can query the whitelist of the ESIM number server, the specific location is not limited here.
  • the security system query ESIM number write command does not match the ESIM number server white list, it indicates that the ESIM number write command has the possibility of corresponding to the illegal server. In order to avoid the illegal server disruption, the security system may not send the ESIM number to the ESIM number server. Write request.
  • the security system sends an ESIM number write request to the corresponding ESIM number server through the virtual private network VPN according to the ESIM number write command.
  • step 204 in this embodiment is the same as that described in step 102 in the embodiment shown in FIG. 1, and details are not described herein again.
  • the security system sends a security identifier message to the ESIM number server through the VPN.
  • the security identifier message may be sent to the ESIM number server through the VPN.
  • the security identifier message may indicate to the ESIM number server that the system transmitting the message is a security system, not the terminal security system.
  • the normal system is equivalent to the ESIM number server for further authentication of the security system.
  • the security identification message in this embodiment is an identity identification message of the security system, and the security identification message may be an encryption string preset by the security system, such as 1010, in order to realize the diversity of the encryption string.
  • the security string can be sent to the ESIM number server every time.
  • the security identifier message can be other types, as long as the security system can be identified.
  • step 205 in this embodiment can be performed together with step 204, that is, the ESIM number write request is sent simultaneously for two kinds of information.
  • the security identifier message may be sent by the security system to the ESIM number server in the ESIM number write request, as long as the ESIM number server can further confirm the operation authority of the security system, which is not limited herein.
  • Steps 206 to 208 in this embodiment and step 103 to step in the embodiment shown in FIG. 105 is the same and will not be described here.
  • the different locations of the whitelist establishment of the ESIM number server are described in this embodiment.
  • the security system queries whether the ESIM number write command matches the whitelist of the ESIM number server to filter the interference of the illegal server.
  • the malicious write of the illegal server is avoided, and the sending of the security identification message enables the ESIM number server to authenticate the security system, thereby further avoiding hijacking or tampering of the data by the non-secure system.
  • the terminal in this embodiment can also delete the ESIM number data and cancel the ESIM service, which is specifically described below:
  • FIG. 3 another embodiment of the method for writing an ESIM number in the embodiment of the present invention includes:
  • Steps 301 to 305 of the terminal in this embodiment are the same as steps 01 to 105 in the embodiment shown in FIG. 1, and details are not described herein again.
  • the security system receives an ESIM number deletion instruction.
  • the security system can delete the ESIM number data written in the ESIM device. If the user needs to delete one or more ESIM numbers, the security system can receive the ESIM number deletion command.
  • the security system determines the first target ESIM number according to the ESIM number deletion command.
  • the security system may determine the first target ESIM number according to the ESIM number deletion command.
  • the security system in this embodiment can perform a search in the ESIM device by using the flag bit to determine the corresponding ESIM number deletion command. First target ESIM number.
  • the security system determines the first target ESIM number.
  • the security system may use other methods as long as the first target ESIM number can be determined according to the ESIM deletion command. Yes, the specific way is not limited here.
  • the security system deletes the first target ESIM number from the ESIM device.
  • the first target ESIM number can be deleted from the ESIM device. It can be understood that the security system can rewrite the first target ESIM number from the ESIM number server after deleting the first target ESIM number.
  • the security system in this embodiment can delete only the first mesh in the ESIM device.
  • the ESIM number can also delete all data about the first target ESIM number, which is not limited herein.
  • steps 306 to 308 in this embodiment may be performed before, during or after the steps 301 to 305, as long as the security system has the ESIM number data written in the ESIM device, which is not limited herein.
  • the security system receives the ESIM number cancellation instruction
  • the security system may also log out the ESIM number data written in the ESIM device. If the user needs to log out one or more ESIM numbers, the security system may receive the ESIM number logout command.
  • the security system sends an ESIM number logout request to the ESIM number server through the VPN according to the ESIM number logout command, so that the ESIM number server cancels the data of the corresponding second target ESIM number according to the ESIM number logout request.
  • the security system may send an ESIM number logout request to the ESIM number server through the VPN according to the ESIM number logout command, so that the ESIM number server can cancel the corresponding second target ESIM according to the ESIM number logout request. Number data.
  • the security system may delete the second target ESIM number from the ESIM device, or may not delete it, which is not limited herein.
  • steps 309 to 310 in this embodiment may be performed before, during or after steps 301 to 308, which are not limited herein.
  • the rights of the security system are explained from the perspective of the user needing to delete the ESIM number or cancel the ESIM number, indicating that other systems other than the non-secure system cannot write, delete or log out, write, and write the ESIM number in the ESIM device. Operations such as deletion or logout can only be performed by the security system, which effectively guarantees the read and write permissions of the security system.
  • the method for writing the ESIM number in the embodiment of the present invention is described above from the side of the security system.
  • the method for writing the ESIM number in the embodiment of the present invention is described below from the ESIM number server side.
  • Another embodiment of writing method of ESIM number in the embodiment of the invention include:
  • the ESIM number server receives an ESIM number write request sent by the security system through the virtual private network VPN.
  • the ESIM number server may store data of each ESIM number.
  • the ESIM number server may receive the ESIM number written by the security system through the virtual private network VPN. Into the request.
  • the ESIM number server sends the encrypted ESIM number data to the security system through the VPN according to the ESIM number write request.
  • the ESIM number server may determine the ESIM number data that the security system needs to write according to the ESIM number write request, and may determine the determined ESIM number data by means such as encryption operation. Encryption is performed to obtain encrypted ESIM number data, and the encrypted ESIM number data can be returned to the security system through the VPN.
  • the ESIM number server encrypts the ESIM number data by using an encryption operation
  • other encryption methods such as an ESIM number server customized encryption method, may be used.
  • the encrypted ESIM number data can be obtained, the security of the encrypted ESIM number data in the VPN transmission process can be ensured, and the specific encryption method is not limited herein.
  • the ESIM number writing method is explained from the ESIM number server side.
  • the ESIM number server improves the ESIM number from the three aspects of encrypted transmission, VPN transmission channel, and security system transmission object.
  • the security of writing effectively circumvents the hijacking or tampering of ESIM number data by systems other than non-secure systems.
  • another embodiment of the method for writing an ESIM number in the embodiment of the present invention includes:
  • Step 501 in this embodiment is the same as step 401 in the embodiment shown in FIG. 4, and details are not described herein again.
  • the ESIM number server receives a security identifier message sent by the security system through the VPN.
  • the ESIM number server can receive the security identifier message sent by the security system through the VPN.
  • the security identification message in this embodiment is an identity identification message of the security system, and the security identification message may be an encrypted string preset by the security system, such as 1010.
  • the security system can send different encryption strings to the ESIM number server each time, and the ESIM number server can receive different encryption strings.
  • the security identification message can also be used. It is other types, as long as it can identify the security system, which is not limited here.
  • step 503 the ESIM number server verifies the security identification message, if the verification fails, step 504 is performed, if the verification is successful, step 505 is performed;
  • the ESIM number server may verify the security identification message to determine whether the system that transmits the message to the VPN through the VPN is a security system, that is, an authentication judgment.
  • the ESIM number server can verify the content of the encrypted string according to the corresponding decryption manner.
  • the difference of the security identification information means that the authentication mode of the ESIM number server may be different, which is not limited herein.
  • the ESIM number server may not perform other operations, so that other ordinary systems other than the non-secure system cannot obtain the encrypted ESIM number data. To avoid the risk of trespassing.
  • Step 505 in this embodiment is the same as step 402 in the embodiment shown in FIG. 4, and details are not described herein again.
  • the ESIM number server receives an ESIM number logout request sent by the security system through the VPN.
  • the ESIM number server can receive the ESIM number logout request sent by the security system through the VPN.
  • the ESIM number server determines the second target ESIM number according to the ESIM number logout request.
  • the ESIM number server may determine the second target ESIM number according to the ESIM number logout request.
  • the ESIM number deregistration request in this embodiment may include an identifier corresponding to the second target ESIM number, and the ESIM number server may obtain the identifier of the ESIM number deregistration request, and may determine the first from the locally stored data according to the identifier.
  • Two target ESIM numbers Understandable Yes, in an actual application, the ESIM number server may also determine the second target ESIM number according to the ESIM number logout request, as long as the second target ESIM number corresponding to the ESIM number logout request can be determined, and the specific manner is determined here. Not limited.
  • the ESIM number server logs out the data of the second target ESIM number.
  • the ESIM number server determines the second target ESIM number
  • the locally stored data about the second target ESIM number can be deleted.
  • the second target ESIM number will not exist, and related user usage records, user data, and the like are also logged out.
  • steps 506 to 508 in this embodiment may be performed before, during or after step 501 to step 502, which is not limited herein.
  • the ESIM number server in this embodiment may verify the security identifier message, further authenticate the security system, and may also receive the ESIM number logout request sent by the security system, and cancel the second target ESIM corresponding to the request.
  • the number data makes the security system have the corresponding read and write permissions, avoiding malicious interference from other systems.
  • an embodiment of the security system in the embodiment of the present invention includes:
  • the first receiving module 601 is configured to receive an ESIM number write command.
  • the first query module 602 is configured to query whether the ESIM number write command received by the first receiving module 601 matches the ESIM number server white list, and the ESIM number server white list is established for the terminal at a target location other than the security system, and the security system is the terminal. a system established;
  • the second query module 603 is configured to query whether the ESIM number write command received by the first receiving module 601 matches the ESIM number server white list, and the ESIM number server white list is established locally by the security system;
  • the first sending module 604 is configured to: when the security system queries the ESIM number write command to match the ESIM number server white list, according to the ESIM number write command received by the first receiving module 601, sends the corresponding ESIM number through the virtual private network VPN.
  • the server sends an ESIM number write request;
  • a second sending module 605, configured to send a security identifier message to the ESIM number server by using a VPN
  • the second receiving module 606 is configured to receive the ESIM number server and send the message according to the first sending module 604.
  • the sent ESIM number is written to the encrypted ESIM number data sent by the request;
  • the triggering module 607 is configured to: when the ESIM number server verifies that the security identifier message sent by the second sending module 605 is successful, trigger the second receiving module 606 to receive the encrypted ESIM number data sent by the ESIM number server based on the ESIM number writing request;
  • the decryption module 608 is configured to decrypt the encrypted ESIM number data received by the second receiving module 602.
  • the writing module 609 is configured to write the decrypted ESIM number data of the decryption module 608 to the ESIM device;
  • the third receiving module 610 is configured to receive an ESIM number deletion instruction.
  • a determining module 611 configured to determine, according to an ESIM number deletion instruction received by the third receiving module 610, a first target ESIM number
  • the deleting module 612 is configured to delete the first target ESIM number determined by the determining module 611 from the SEIM device.
  • the fourth receiving module 613 is configured to receive an ESIM number logout instruction
  • the third sending module 614 is configured to send an ESIM number logout request to the ESIM number server by using the ESIM number logout command received by the fourth receiving module 613, so that the ESIM number server cancels the corresponding second target ESIM number according to the ESIM number logout request.
  • the data is configured to send an ESIM number logout request to the ESIM number server by using the ESIM number logout command received by the fourth receiving module 613, so that the ESIM number server cancels the corresponding second target ESIM number according to the ESIM number logout request.
  • the first receiving module 601 can receive an ESIM number write command
  • the first sending module 604 can send an ESIM number write request to the ESIM number server
  • the write module 609 can decrypt the ESIM number data by the decryption module 608.
  • the first query module 602 or the second query module 603 can query whether the ESIM number write command matches the ESIM number server white list
  • the second sending module 605 can also send the security identifier message to the ESIM number server, if the ESIM number server verifies
  • the triggering module 606 can trigger the second receiving module 607 to perform a corresponding operation.
  • the deleting module 612 may also delete the first target ESIM number determined by the determining module 611 by using the ESIM number deletion command received by the third receiving module 610, and the third sending module 614 may also cancel the ESIM number by the fourth receiving module 613.
  • an embodiment of the ESIM number server in the embodiment of the present invention includes:
  • the first receiving module 701 is configured to receive an ESIM number write request sent by the security system through the virtual private network VPN.
  • the second receiving module 702 is configured to receive a security identifier message sent by the security system by using a VPN.
  • the verification module 703 is configured to verify the security identification message received by the second receiving module 702.
  • the sending module 704 is configured to send, by using a VPN, the encrypted ESIM number data to the security system according to the ESIM number write request received by the first receiving module 701;
  • the triggering module 705 is configured to: when the verification module 703 successfully verifies the security identification message, trigger the sending module 704 to send the encrypted ESIM number data to the security system through the VPN;
  • the third receiving module 706 is configured to receive an ESIM number logout request sent by the security system through the VPN.
  • a determining module 707 configured to determine a second target ESIM number according to the ESIM number deregistration request received by the third receiving module 706;
  • the logout module 708 is configured to log out the data of the second target ESIM number determined by the determining module 707.
  • the first receiving module 701 in the ESIM number server can receive the ESIM number writing request sent by the security system, and the sending module 705 can return the corresponding encrypted ESIM number data to the security system through the VPN.
  • the verification module 703 can further verify the security message identifier received by the second receiving module 702, so that the trigger module 704 can trigger the sending module 705 to perform a corresponding operation.
  • the logout module 708 can also deregister the data of the second target ESIM number determined by the determination module 707. This not only ensures the security of the ESIM number data from the ESIM number server side, but also authenticates the security system, so that the security system has the corresponding read and write permissions, avoiding malicious interference of other systems.
  • FIG. 8 is a terminal provided by this embodiment. As shown in FIG. 8, the terminal includes a communication bus 802, an input device 803, an output device 804, a memory 805, and a processor 801, where:
  • the communication bus 802 is configured to implement connection communication between the input device 803, the output device 804, the memory 805, and the processor 801;
  • the input device 803 is configured to receive an ESIM number write command
  • the output device 804 is configured to send an ESIM number write request to the corresponding ESIM number server through the virtual private network VPN according to the ESIM number write command.
  • the memory 805 stores a set of program codes, and the terminal calls the program code stored in the memory for performing the following operations:
  • the input device 803 receives an ESIM number write command
  • the output device 804 sends an ESIM number to the corresponding ESIM number server through the virtual private network VPN according to the ESIM number write command.
  • the input device 803 receives encrypted ESIM number data sent by the ESIM number server based on the ESIM number write request;
  • the processor 801 decrypts the encrypted ESIM number data
  • the output device 804 writes the decrypted ESIM number data to the ESIM device.
  • the processor 801 queries the ESIM number write command. Whether it matches the whitelist of the ESIM number server, the whitelist of the ESIM number server is established for the terminal at the target location.
  • the processor 801 queries the ESIM number write command. Whether it matches the whitelist of the ESIM number server, and the whitelist of the ESIM number server is established locally for the terminal.
  • the output device 804 sends a security identifier to the ESIM number server by using the VPN.
  • the input device 803 If the ESIM number server verifies that the security identification message is successful, triggering the input device 803 to receive the encrypted ESIM number data sent by the ESIM number server based on the ESIM number write request.
  • the input device 803 receives an ESIM number deletion instruction
  • the processor 801 determines a first target ESIM number according to the ESIM number deletion instruction
  • the processor 801 deletes the first target ESIM number from the ESIM device.
  • the input device 803 receives an ESIM number logout instruction
  • the output device 804 sends an ESIM number logout request to the ESIM number server through the VPN according to the ESIM number logout command, so that the ESIM number server cancels the corresponding second target ESIM number according to the ESIM number logout request.
  • the data The data.
  • the disclosed system, apparatus, and method may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium.
  • the medium includes instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

Abstract

本发明实施例公开了一种ESIM号码的写入方法，用于提高ESIM号码写入的安全性，避免ESIM号码被恶意劫持或篡改等风险。本发明实施例方法包括：安全系统接收ESIM号码写入指令；若安全系统查询所述ESIM号码写入指令与ESIM号码服务器白名单匹配，则安全系统根据ESIM号码写入指令通过虚拟专用网络VPN向对应的ESIM号码服务器发送ESIM号码写入请求；安全系统接收ESIM号码服务器基于ESIM号码写入请求发送的加密ESIM号码数据；安全系统将加密ESIM号码数据进行解密；安全系统将解密后的ESIM号码数据写入ESIM设备。本发明实施例还提供了一种安全系统、ESIM号码服务器，能够有效规避ESIM号码写入的各个环节中可能存在的风险，提高ESIM号码的安全性。

Description

一种ESIM号码的写入方法、安全系统、ESIM号码服务器及终端
本申请要求于2016年03月31日提交中国专利局，申请号为201610199846.1、发明名称为“一种ESIM号码的写入方法、安全系统、ESIM号码服务器及终端”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及通信领域，尤其涉及一种ESIM号码的写入方法、安全系统以及终端。
背景技术
SIM卡(Sunscriber Identity Module，客户识别模块)，也称为智能卡，在通信网络中，SIM卡不仅是用户身份识别卡，同时也是业务载体。ESIM卡是一种嵌入式SIM卡，能够将SIM卡信息集成到设备芯片上，与传统SIM卡相比，ESIM卡类似于虚拟SIM卡，如果采用ESIM卡的设备，那么就不再需要用户购买设备后自己插卡，而是可以直接采用软件注册或直接购买等类型的方式即可选择运营商网络和套餐。然而，ESIM卡和SIM卡的逻辑是相同的，只不过从外置变成了内嵌，在安全性方面并没有提升。
ESIM卡可以应用于手机、平板电脑、路由器等设备，作为存储用户数据、鉴权方法以及密钥，是通信的基础部件，需要进行安全保护。在现有技术中，ESIM号码的写入方法主要为：1、ESIM号码数据从后台服务器下发；2、通过普通网络连接传输至移动终端；3、移动终端再通过普通系统将信息写入ESIM设备芯片。从上述过程可以看出，该ESIM号码的写入方法存在以下问题：1、连接网络由普通系统发起，传输安全没有保障；2、ESIM号码数据信息由普通系统写入ESIM芯片设备，数据有被劫持和篡改的风险；3、移动终端没有建立白名单机制，可能有非法服务器扰乱，存在恶意写入的风险。
由此可见，如何提高ESIM号码的安全性是一个亟需解决的问题。
发明内容
本发明实施例提供了一种ESIM号码的写入方法、安全系统及终端，能够有效规避ESIM号码写入的各个环节中可能存在的风险，提高ESIM号码的安全性。
有鉴于此，本发明第一方面提供了一种ESIM号码的写入方法，可包括：
安全系统接收ESIM号码写入指令；
若安全系统查询ESIM号码写入指令与ESIM号码服务器白名单匹配，则安全系统根据ESIM号码写入指令通过虚拟专用网络VPN向对应的ESIM号码服务器发送ESIM号码写入请求；
安全系统接收ESIM号码服务器基于ESIM号码写入请求发送的加密ESIM号码数据；
安全系统将加密ESIM号码数据进行解密；
安全系统将解密后的ESIM号码数据写入ESIM设备。
结合本发明实施例的第一方面，在本发明实施例的第一方面的第一种实施方式中，安全系统根据ESIM号码写入指令通过虚拟专用网络VPN向对应的ESIM号码服务器发起ESIM号码写入请求之前，该方法还包括：
安全系统查询ESIM号码写入指令是否与ESIM号码服务器白名单匹配，ESIM号码服务器白名单为终端在安全系统以外的目标位置建立，安全系统为终端建立的一个系统。
结合本发明实施例的第一方面，在本发明实施例的第一方面的第二种实施方式中，在安全系统根据ESIM号码写入指令通过虚拟专用网络VPN向对应的ESIM号码服务器发起ESIM号码写入请求之前，该方法还包括：
安全系统查询ESIM号码写入指令是否与ESIM号码服务器白名单匹配，ESIM号码服务器白名单为安全系统在本地建立。
结合本发明实施例的第一方面，或本发明实施例的第一方面的第一种实施方式或第二种实施方式，在本发明实施例的第一方面的第三种实施方式中，在安全系统接收ESIM号码服务器基于ESIM号码写入请求发送的加密ESIM号码数据之前，该方法还包括：
安全系统通过VPN向ESIM号码服务器发送安全标识消息；
若ESIM号码服务器验证安全标识消息成功，则触发安全系统接收ESIM号码服务器基于ESIM号码写入请求发送的加密ESIM号码数据的步骤。
结合本发明实施例的第一方面，本发明实施例的第一方面的第一种实施方式至第三种实施方式中的任意一种，在本发明实施例的第一方面的第四种实施方式中，该方法还包括：
安全系统接收ESIM号码删除指令；
安全系统根据ESIM号码删除指令确定第一目标ESIM号码；
安全系统从ESIM设备删除第一目标ESIM号码。
结合本发明实施例的第一方面，本发明实施例的第一方面的第一种实施方式至第四种实施方式中的任意一种，在本发明实施例的第一方面的第五种实施方式中，该方法还包括：
安全系统接收ESIM号码注销指令；
安全系统根据ESIM号码注销指令通过VPN向ESIM号码服务器发送ESIM号码注销请求，以使得ESIM号码服务器根据ESIM号码注销请求注销对应的第二目标ESIM号码的数据。
本发明第二方面提供一种ESIM号码的写入方法，可包括：
ESIM号码服务器接收安全系统通过虚拟专用网络VPN发送的ESIM号码写入请求；
ESIM号码服务器根据ESIM号码写入请求通过VPN将加密ESIM号码数据发送至安全系统。
结合本发明实施例的第二方面，在本发明实施例的第二方面的第一种实施方式中，在ESIM号码服务器根据ESIM号码写入请求将对应的ESIM号码数据进行加密得到加密ESIM号码数据之前，该方法还包括：
ESIM号码服务器接收安全系统通过VPN发送的安全标识消息；
ESIM号码服务器对安全标识消息进行验证；
若验证成功，则触发ESIM号码服务器根据ESIM号码写入请求通过VPN将加密ESIM号码数据发送至安全系统的步骤。
结合本发明实施例的第二方面，或本发明实施例的第二方面的第一种实施 方式，在本发明实施例的第二方面的第二种实施方式中，该方法还包括：
ESIM号码服务器接收安全系统通过VPN发送的ESIM号码注销请求；
ESIM号码服务器根据ESIM号码注销请求确定第二目标ESIM号码；
ESIM号码服务器注销第二目标ESIM号码的数据。
本发明第三方面提供一种安全系统，可包括：
第一接收模块，用于接收ESIM号码写入指令；
第一发送模块，用于当安全系统查询ESIM号码写入指令与ESIM号码服务器白名单匹配时，则根据第一接收模块接收的ESIM号码写入指令通过虚拟专用网络VPN向对应的ESIM号码服务器发送ESIM号码写入请求；
第二接收模块，用于接收ESIM号码服务器基于第一发送模块发送的ESIM号码写入请求发送的加密ESIM号码数据；
解密模块，用于将第二接收模块接收的加密ESIM号码数据进行解密；
写入模块，用于将解密模块解密后的ESIM号码数据写入ESIM设备。
结合本发明实施例的第三方面，在本发明实施例的第三方面的第一种实施方式中，该安全系统还包括：
第一查询模块，用于查询第一接收模块接收的ESIM号码写入指令是否与ESIM号码服务器白名单匹配，ESIM号码服务器白名单为终端在安全系统以外的目标位置建立，安全系统为终端建立的一个系统。
结合本发明实施例的第三方面，在本发明实施例的第三方面的第二种实施方式中，该安全系统方法还包括：
第二查询模块，用于查询第一接收模块接收的ESIM号码写入指令是否与ESIM号码服务器白名单匹配，ESIM号码服务器白名单为安全系统在本地建立。
结合本发明实施例的第三方面，或本发明实施例的第三方面的第一种实施方式或第二种实施方式，在本发明实施例的第三方面的第三种实施方式中，该安全系统还包括：
第二发送模块，用于通过VPN向ESIM号码服务器发送安全标识消息；
触发模块，用于当ESIM号码服务器验证第二发送模块发送的安全标识消息成功时，则触发第二接收模块接收ESIM号码服务器基于ESIM号码写入请 求发送的加密ESIM号码数据。
结合本发明实施例的第三方面，本发明实施例的第三方面的第一种实施方式至第三种实施方式中的任意一种，在本发明实施例的第三方面的第四种实施方式中，该安全系统还包括：
第三接收模块，用于接收ESIM号码删除指令；
确定模块，用于根据第三接收模块接收的ESIM号码删除指令确定第一目标ESIM号码；
删除模块，用于从ESIM设备删除确定模块确定的第一目标ESIM号码。
结合本发明实施例的第三方面，本发明实施例的第三方面的第一种实施方式至第四种实施方式中的任意一种，在本发明实施例的第三方面的第五种实施方式中，该安全系统还包括：
第四接收模块，用于接收ESIM号码注销指令；
第三发送模块，用于根据第四接收模块接收的ESIM号码注销指令通过VPN向ESIM号码服务器发送ESIM号码注销请求，以使得ESIM号码服务器根据ESIM号码注销请求注销对应的第二目标ESIM号码的数据。
本发明第四方面提供一种ESIM号码服务器，可包括：
第一接收模块，用于接收安全系统通过虚拟专用网络VPN发送的ESIM号码写入请求；
发送模块，用于根据第一接收模块接收的ESIM号码写入请求通过VPN将加密ESIM号码数据发送至安全系统。
结合本发明实施例的第四方面，在本发明实施例的第四方面的第一种实施方式中，该ESIM号码服务器还包括：
第二接收模块，用于接收安全系统通过VPN发送的安全标识消息；
验证模块，用于对第二接收模块接收的安全标识消息进行验证；
触发模块，用于当验证模块验证安全标识消息成功时，则触发发送模块根据ESIM号码写入请求通过VPN将加密ESIM号码数据发送至安全系统。
结合本发明实施例的第四方面，或本发明实施例的第四方面的第一种实施方式，在本发明实施例的第四方面的第二种实施方式中，该ESIM号码服务器还包括：
第三接收模块，用于接收安全系统通过VPN发送的ESIM号
码注销请求；
确定模块，用于根据第三接收模块接收的ESIM号码注销请求确定第二目标ESIM号码；
注销模块，用于注销确定模块确定的第二目标ESIM号码的数据。
本发明第五方面提供一种终端，通信总线、输入装置、输出装置、存储器以及处理器，其中：
所述通信总线，用于实现所述输入装置、输出装置、存储器以及处理器之间的连接通信；
所述输入装置，用于接收ESIM号码写入指令；
所述输出装置，用于根据所述ESIM号码写入指令通过虚拟专用网络VPN向对应的ESIM号码服务器发送ESIM号码写入请求；
所述存储器中存储一组程序代码，且所述终端调用所述存储器中存储的程序代码，用于执行以下操作：
所述输入装置接收ESIM号码写入指令；
若所述处理器查询所述ESIM号码写入指令与ESIM号码服务器白名单匹配，则所述输出装置根据所述ESIM号码写入指令通过虚拟专用网络VPN向对应的ESIM号码服务器发送ESIM号码写入请求；
所述输入装置接收所述ESIM号码服务器基于所述ESIM号码写入请求发送的加密ESIM号码数据；
所述处理器将所述加密ESIM号码数据进行解密；
所述输出装置将解密后的ESIM号码数据写入ESIM设备。
可选的，在所述输出装置根据所述ESIM号码写入指令通过虚拟专用网络VPN向对应的ESIM号码服务器发起ESIM号码写入请求之前，所述处理器查询所述ESIM号码写入指令是否与所述ESIM号码服务器白名单匹配，所述ESIM号码服务器白名单为终端在目标位置建立。
可选的，在所述输出装置根据所述ESIM号码写入指令通过虚拟专用网络VPN向对应的ESIM号码服务器发起ESIM号码写入请求之前，所述处理器查询所述ESIM号码写入指令是否与所述ESIM号码服务器白名单匹配，所述 ESIM号码服务器白名单为所述终端在本地建立。
可选的，在所述输入装置接收所述ESIM号码服务器基于所述ESIM号码写入请求发送的加密ESIM号码数据之前，所述输出装置通过所述VPN向所述ESIM号码服务器发送安全标识消息；
若所述ESIM号码服务器验证所述安全标识消息成功，则触发所述输入装置接收所述ESIM号码服务器基于所述ESIM号码写入请求发送的加密ESIM号码数据的步骤。
可选的，所述输入装置接收ESIM号码删除指令；
所述处理器根据所述ESIM号码删除指令确定第一目标ESIM号码；
所述处理器从所述ESIM设备删除所述第一目标ESIM号码。
可选的，所述输入装置接收ESIM号码注销指令；
所述输出装置根据所述ESIM号码注销指令通过所述VPN向所述ESIM号码服务器发送ESIM号码注销请求，以使得所述ESIM号码服务器根据所述ESIM号码注销请求注销对应的第二目标ESIM号码的数据。
从以上技术方案可以看出，本发明实施例具有以下优点：
本实施例中，当安全系统接收ESIM号码写入指令后，若安全系统查询ESIM号码写入指令与ESIM号码服务器白名单匹配，则可以根据ESIM号码写入指令通过虚拟专用网络VPN向对应的ESIM号码服务器发送ESIM号码写入请求，并可以将该ESIM号码服务器发送的加密ESIM号码数据进行解密，再将解密后的ESIM号码数据写入ESIM设备。由此可知，本实施例不仅具有白名单机制，且通过VPN连接传输、数据加密、安全系统独立写入ESIM设备，建立了从后台服务器、传输管道以及终端的立体保障ESIM号码数据信息安全写入ESIM设备的流程，从整体方案上有效规避了各个环节可能存在的数据被劫持、篡改或恶意写入等风险。
附图说明
图1为本发明实施例中ESIM号码的写入方法一个实施例；
图2为本发明实施例中ESIM号码的写入方法另一实施例；
图3为本发明实施例中ESIM号码的写入方法另一实施例；
图4为本发明实施例中ESIM号码的写入方法另一实施例；
图5为本发明实施例中ESIM号码的写入方法另一实施例；
图6为本发明实施例中安全系统一个实施例；
图7为本发明实施例中ESIM号码服务器一个实施例；
图8为本发明实施例中终端的结构示意图。
具体实施方式
本发明实施例提供了一种ESIM号码的写入方法、安全系统、ESIM号码服务器及终端，能够有效规避ESIM号码写入的各个环节中可能存在的风险，提高ESIM号码的安全性。
为了使本技术领域的人员更好地理解本发明方案，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分的实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都应当属于本发明保护的范围。
本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”、“第三”、“第四”等(如果存在)是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
为便于理解，下面对本发明实施例中的具体流程进行描述，请参阅图1，本发明实施例中ESIM号码的写入方法一个实施例包括：
101、安全系统接收ESIM号码写入指令；
本实施例中，终端包括但不限于Android、IOS、Windows系统为代表的智能手机、平板电脑等便携式设备。终端可以安装多个智能操作系统，并可以指定其中一个为安全系统，即该安全系统为终端一个可以进行写入ESIM号码 操作的系统。若该终端为具有ESIM卡的设备，那么可以允许用户更加灵活的选择运营商或更换运营商，当用户选择某个运营商的ESIM号码作为通信号码时，安全系统可以接收ESIM号码写入指令。
102、若安全系统查询ESIM号码写入指令与ESIM号码服务器白名单匹配，则安全系统根据ESIM号码写入指令通过虚拟专用网络VPN向对应的ESIM号码服务器发送ESIM号码写入请求；
当安全系统接收ESIM号码写入指令后，若安全系统查询ESIM号码写入指令与ESIM号码服务器白名单匹配，则意味着安全系统可以根据ESIM号码写入指令通过虚拟专用网络VPN向对应的ESIM号码服务器发送ESIM号码写入请求。
具体的，在实际应用中，本实施例中ESIM号码服务器白名单用于过滤非法服务器，以阻止非法服务器恶意写入。ESIM号码写入指令中包含有ESIM号码服务器的地址，而ESIM号码服务器白名单中也记录有ESIM号码服务器的地址，只有ESIM号码写入指令中的地址与ESIM号码服务器白名单中记录的地址匹配，安全系统才会执行相应的操作。
可以理解的是，本实施例仅以上述内容说明了安全系统查询ESIM号码写入指令与ESIM号码服务器白名单匹配的一个例子，在实际应用中，安全系统也可以根据其它查询的方式进行结合或单独使用，只要能够查询到ESIM号码写入指令与ESIM号码服务器白名单是否匹配即可，具体查询方式此处不做限定。
103、安全系统接收ESIM号码服务器基于ESIM号码写入请求发送的加密ESIM号码数据；
当安全系统向ESIM号码服务器发送ESIM号码写入请求后，安全系统可以接收该ESIM号码服务器基于ESIM号码写入请求发送的加密ESIM号码数据。
104、安全系统将加密ESIM号码数据进行解密；
当安全系统接收ESIM号码服务器发送的加密ESIM号码数据后，安全系统可以将该加密ESIM号码数据进行解密。
可以理解的是，本实施例中，为了避免加密ESIM号码数据在经过VPN 传输的途中被拦截，导致恶意泄露或篡改，该加密ESIM号码数据中不携带相应的密钥，当安全系统接收到加密ESIM号码数据后，可以通过预设的解密方式进行解密。在实际应用中，该安全系统不限于通过何种预设的解密方式对加密ESIM号码数据进行解密，可以是一种对应的映射关系，也可以是数字解密，如通过加密运算获取加密密码，只要解密方式由安全系统保存，且该解密操作只由安全系统执行即可。
105、安全系统将解密后的ESIM号码数据写入ESIM设备。
安全系统将加密ESIM号码数据进行解密后，可以将解密后的ESIM号码数据写入ESIM设备中。
具体的，在实际应用中，本实施例中的ESIM设备可以写入一个或以上的ESIM号码数据，实现诸如使用SIM卡的双卡双待终端，而当ESIM号码数据写入ESIM设备后，安全系统可为每一个写入的SEIM号码设置诸如标志位，表明该ESIM号码来自ESIM设备。此外，ESIM设备对于终端安装的操作系统具有权限设置，相对安全系统来说，终端除安全系统以外的系统只有读取权限。
本实施例中，利用安全系统通过ESIM号码服务器白名单验证向ESIM号码服务器发起ESIM号码写入请求，再接收ESIM号码服务器发送的加密ESIM号码数据，并由安全系统将解密后的ESIM号码数据写入ESIM设备，充分规避了ESIM号码写入过程中各个环节可能出现的风险，体现了安全系统对ESIM设备的唯一读写权限，保证了ESIM号码写入的安全性。
需要说明的是，本实施例中的终端可以建立白名单机制，但安全系统查询ESIM号码服务器白名单的位置可以有所不同，即ESIM号码服务器白名单可以由终端在安全系统以外的目标位置建立，也可以由安全系统在本地建立，具体请参阅图2，本发明实施例中ESIM号码的写入方法另一实施例包括：
本实施例中的步骤201与图1所示实施例中的步骤101相同，此处不再赘述。
202、安全系统查询ESIM号码写入指令是否与ESIM号码服务器白名单匹配，若否，则执行步骤203，若是，则执行步骤204；
当安全系统接收到ESIM号码写入指令后，安全系统可以查询该ESIM号 码写入指令是否与ESIM号码服务器白名单匹配。
可以理解的是，本实施例中ESIM号码服务器白名单的建立是为了防止非法服务器的扰乱，该ESIM号码服务器白名单可以为终端在安全系统以外的目标位置建立，如控制系统，也可以为安全系统在本地建立，只要安全系统能够查询到该ESIM号码服务器白名单即可，具体建立位置此处不做限定。
203、执行其它流程；
若安全系统查询ESIM号码写入指令与ESIM号码服务器白名单不匹配，说明该ESIM号码写入指令存在对应非法服务器的可能，为了避免非法服务器的扰乱，安全系统可以不向ESIM号码服务器发送ESIM号码写入请求。
204、安全系统根据ESIM号码写入指令通过虚拟专用网络VPN向对应的ESIM号码服务器发送ESIM号码写入请求；
本实施例中的步骤204说明的内容与图1所示实施例中的步骤102说明的内容相同，此处不再赘述。
205、安全系统通过VPN向ESIM号码服务器发送安全标识消息；
安全系统向ESIM号码服务器发送ESIM号码写入请求后，可以通过VPN向ESIM号码服务器发送安全标识消息，该安全标识消息可以向ESIM号码服务器说明传输消息的系统为安全系统，而非终端安全系统以外的普通系统，相当于ESIM号码服务器对安全系统进行进一步鉴权。
可以理解的是，在实际应用中，本实施例中的安全标识消息即安全系统的身份识别消息，该安全标识消息可以是安全系统预设的加密串，如1010，为了实现加密串的多样性与安全性，安全系统每一次给ESIM号码服务器发送的加密串都可以不同，在实际应用中，该安全标识消息也可以是其它类型，只要能够标识安全系统即可，具体此处不做限定。
可以理解的是，本实施例中的步骤205可以与步骤204一起执行，即与ESIM号码写入请求为两种信息同时发送。此外，该安全标识消息也可以由安全系统携带在ESIM号码写入请求中发送至ESIM号码服务器，只要能够使得ESIM号码服务器能够进一步确认安全系统的操作权限即可，具体此处不做限定。
本实施例中的步骤206至步骤208与图1所示实施例中的步骤103至步骤 105相同，此处不再赘述。
在上述实施例的基础上，本实施例中说明了ESIM号码服务器白名单建立的不同位置，安全系统查询ESIM号码写入指令与ESIM号码服务器白名单是否匹配的目的在于过滤非法服务器的干扰，可以避免非法服务器的恶意写入，而安全标识消息的发送，可以使得ESIM号码服务器对安全系统进行鉴权，进一步避免非安全系统对数据的劫持或篡改。
可以理解的是，本实施例中的终端还可以删除ESIM号码数据、注销ESIM业务，下面进行具体说明：
具体请参阅图3，本发明实施例中ESIM号码的写入方法另一实施例包括：
本实施例终端的步骤301至步骤305与图1所示实施例中的步骤01至步骤105相同，此处不再赘述。
306、安全系统接收ESIM号码删除指令；
本实施例中，安全系统可以对ESIM设备中写入的ESIM号码数据进行删除，若用户需要删除一个或以上ESIM号码，则安全系统可以接收ESIM号码删除指令。
307、安全系统根据ESIM号码删除指令确定第一目标ESIM号码；
当安全系统接收到ESIM号码删除指令后，安全系统可以根据该ESIM号码删除指令确定第一目标ESIM号码。
具体的，在实际应用中，由于ESIM号码写入ESIM设备时可以设有诸如标志位，那么本实施例中的安全系统可以通过标志位在ESIM设备中进行搜索，确定该ESIM号码删除指令对应的第一目标ESIM号码。
可以理解的是，本实施例仅以上述内容说明了安全系统确定第一目标ESIM号码的方式，在实际应用中，安全系统还可以使用其它方式，只要能够根据ESIM删除指令确定第一目标ESIM号码即可，具体方式此处不做限定。
308、安全系统从ESIM设备删除第一目标ESIM号码；
安全系统确定第一目标ESIM号码后，可以从ESIM设备删除该第一目标ESIM号码。可以理解的是，安全系统在删除第一目标ESIM号码后，可以从ESIM号码服务器再次写入该第一目标ESIM号码。
需要说明的是，本实施例中的安全系统可以在ESIM设备中只删除第一目 标ESIM号码，也可以删除有关第一目标ESIM号码的全部数据，具体此处不做限定。
可以理解的是，本实施例中的步骤306至步骤308可以在步骤301至305之前、之间或之后执行，只要安全系统在ESIM设备有写入ESIM号码数据即可，具体此处不做限定。
309、安全系统接收ESIM号码注销指令；
本实施例中，安全系统也可以对ESIM设备中写入的ESIM号码数据进行注销，若用户需要注销一个或以上ESIM号码，则安全系统可以接收ESIM号码注销指令。
310、安全系统根据ESIM号码注销指令通过VPN向ESIM号码服务器发送ESIM号码注销请求，以使得ESIM号码服务器根据ESIM号码注销请求注销对应的第二目标ESIM号码的数据。
当安全系统接收到ESIM号码注销指令后，安全系统可以根据该ESIM号码注销指令通过VPN向ESIM号码服务器发送ESIM号码注销请求，以使得ESIM号码服务器可以根据ESIM号码注销请求注销对应的第二目标ESIM号码的数据。
需要说明的是，在实际应用中，当安全系统请求ESIM号码服务器注销第二目标ESIM号码的数据之后，意味着该第二目标ESIM号码不可用，其对应的业务也不可再使用，此时，安全系统可以将第二目标ESIM号码从ESIM设备中删除，也可以不删除，具体此处不做限定。
可以理解的是，本实施例中的步骤309至步骤310可以在步骤301至308之前、之间或之后执行，具体此处不做限定。
本实施例中，从用户需要删除ESIM号码或注销ESIM号码的角度阐述了安全系统的权限，说明非安全系统以外的其它系统无法对ESIM设备中ESIM号码进行写入、删除或注销，写入、删除或注销等操作只能由安全系统执行，有效保证了安全系统的读写权限。
上面从安全系统一侧对本发明实施例中的ESIM号码的写入方法进行了描述，下面从ESIM号码服务器一侧对本发明实施例中的ESIM号码的写入方法进行描述，请参阅图4，本发明实施例中ESIM号码的写入方法另一实施例 包括：
401、ESIM号码服务器接收安全系统通过虚拟专用网络VPN发送的ESIM号码写入请求；
本实施例中，ESIM号码服务器可以存储有各个ESIM号码的数据，当终端的安全系统需要写入ESIM号码数据至ESIM设备时，ESIM号码服务器可以接收安全系统通过虚拟专用网络VPN发送的ESIM号码写入请求。
402、ESIM号码服务器根据ESIM号码写入请求通过VPN将加密ESIM号码数据发送至安全系统。
ESIM号码服务器接收安全系统发送的ESIM号码写入请求之后，可以根据该ESIM号码写入请求确定需要安全系统需要写入的ESIM号码数据，并可以通过诸如加密运算的方式对该确定的ESIM号码数据进行加密，得到加密ESIM号码数据，再可以通过VPN将加密ESIM号码数据返回至安全系统。
可以理解的是，本实施例中ESIM号码服务器除了上述说明的通过加密运算对ESIM号码数据进行加密之外，在实际应用中，还可以使用其它的加密方式，如ESIM号码服务器自定义的加密方式，只要能够得到加密ESIM号码数据，保证该加密ESIM号码数据在VPN传输过程中的安全性即可，具体加密方式此处不做限定。
本实施例中，从ESIM号码服务器一侧阐述了ESIM号码写入的方法，与现有技术相比，ESIM号码服务器从加密传输、VPN传输通道、安全系统传输对象这三个方面提高了ESIM号码写入的安全性，有效规避了ESIM号码数据被非安全系统以外的系统劫持或篡改。
请参阅图5，本发明实施例中ESIM号码的写入方法另一实施例包括：
本实施例中的步骤501与图4所示实施例中的步骤401相同，此处不再赘述。
502、ESIM号码服务器接收安全系统通过VPN发送的安全标识消息；
本实施例中，ESIM号码服务器可以接收安全系统通过VPN发送的安全标识消息。
可以理解的是，在实际应用中，本实施例中的安全标识消息即安全系统的身份识别消息，该安全标识消息可以是安全系统预设的加密串，如1010，为 了实现加密串的多样性与安全性，安全系统每一次给ESIM号码服务器发送的加密串都可以不同，则ESIM号码服务器可以接收到不同的加密串，在实际应用中，该安全标识消息也可以是其它类型，只要能够标识安全系统即可，具体此处不做限定。
503、ESIM号码服务器对安全标识消息进行验证，若验证失败，则执行步骤504，若验证成功，则执行步骤505；
当ESIM号码服务器接收到安全标识消息后，可以对该安全标识消息进行验证，以判断通过VPN向其传输消息的系统是否为安全系统，即鉴权判断。
具体的，在实际应用中，假设安全系统通过VPN发送的安全标识消息为加密串的类型，那么ESIM号码服务器可以根据对应的解密方式对该加密串的内容进行验证。当然，安全标识信息的不同，意味着ESIM号码服务器的验证方式可以不同，具体此处不做限定。
504、执行其它流程；
若ESIM号码服务器对安全标识消息验证失败，说明通过VPN向其传输消息的系统不为安全系统，则ESIM号码服务器可以不进行其它操作，使得非安全系统以外的其它普通系统无法获取加密ESIM号码数据，避免非法侵入的风险。
本实施例中的步骤505与图4所示实施例中的步骤402相同，此处不再赘述。
506、ESIM号码服务器接收安全系统通过VPN发送的ESIM号码注销请求；
本实施例中，若用户需要注销一个或以上ESIM号码，则ESIM号码服务器可以接收安全系统通过VPN发送的ESIM号码注销请求。
507、ESIM号码服务器根据ESIM号码注销请求确定第二目标ESIM号码；
当ESIM号码服务器接收到ESIM号码注销请求后，可以根据该ESIM号码注销请求确定第二目标ESIM号码。
具体的，本实施例中的ESIM号码注销请求可以包含有对应第二目标ESIM号码的标识，ESIM号码服务器可以获取该ESIM号码注销请求的标识，并可以根据该标识从本地存储的数据中确定第二目标ESIM号码。可以理解的 是，在实际应用中，ESIM号码服务器也可以根据ESIM号码注销请求使用其它方式确定第二目标ESIM号码，只要能够确定该ESIM号码注销请求对应的第二目标ESIM号码即可，具体确定方式此处不做限定。
508、ESIM号码服务器注销第二目标ESIM号码的数据。
ESIM号码服务器确定该第二目标ESIM号码后，可以删除本地存储的有关第二目标ESIM号码的数据。注销之后，该第二目标ESIM号码将不存在，相关的用户使用记录、用户数据等信息也都被注销。
可以理解的是，本实施例中的步骤506至步骤508可以在步骤501至步骤502之前、之间或之后执行，具体此处不做限定。
在上述实施例的基础上，本实施例中ESIM号码服务器可以验证安全标识消息，进一步对安全系统鉴权，也可以接收安全系统发送的ESIM号码注销请求，并注销该请求对应的第二目标ESIM号码的数据，使得安全系统才具有相应的读写权限，避免了其它系统的恶意干扰。
上面对本发明实施例中的ESIM号码的写入方法进行了描述，下面对本发明实施例中的安全系统进行描述，请参阅图6，本发明实施例中安全系统一个实施例包括：
第一接收模块601，用于接收ESIM号码写入指令；
第一查询模块602，用于查询第一接收模块601接收的ESIM号码写入指令是否与ESIM号码服务器白名单匹配，ESIM号码服务器白名单为终端在安全系统以外的目标位置建立，安全系统为终端建立的一个系统；
第二查询模块603，用于查询第一接收模块601接收的ESIM号码写入指令是否与ESIM号码服务器白名单匹配，ESIM号码服务器白名单为安全系统在本地建立；
第一发送模块604，用于当安全系统查询ESIM号码写入指令与ESIM号码服务器白名单匹配时，则根据第一接收模块601接收的ESIM号码写入指令通过虚拟专用网络VPN向对应的ESIM号码服务器发送ESIM号码写入请求；
第二发送模块605，用于通过VPN向ESIM号码服务器发送安全标识消息；
第二接收模块606，用于接收ESIM号码服务器基于第一发送模块604发 送的ESIM号码写入请求发送的加密ESIM号码数据；
触发模块607，用于当ESIM号码服务器验证第二发送模块605发送的安全标识消息成功时，则触发第二接收模块606接收ESIM号码服务器基于ESIM号码写入请求发送的加密ESIM号码数据；
解密模块608，用于将第二接收模块602接收的加密ESIM号码数据进行解密；
写入模块609，用于将解密模块608解密后的ESIM号码数据写入ESIM设备；
第三接收模块610，用于接收ESIM号码删除指令；
确定模块611，用于根据第三接收模块610接收的ESIM号码删除指令确定第一目标ESIM号码；
删除模块612，用于从SEIM设备删除确定模块611确定的第一目标ESIM号码。
第四接收模块613，用于接收ESIM号码注销指令；
第三发送模块614，用于根据第四接收模块613接收的ESIM号码注销指令通过VPN向ESIM号码服务器发送ESIM号码注销请求，以使得ESIM号码服务器根据ESIM号码注销请求注销对应的第二目标ESIM号码的数据。
本实施例中，第一接收模块601可以接收ESIM号码写入指令，第一发送模块604可以向ESIM号码服务器发送ESIM号码写入请求，写入模块609则可以将解密模块608解密的ESIM号码数据写入ESIM设备。其中，第一查询模块602或第二查询模块603可以查询ESIM号码写入指令是否与ESIM号码服务器白名单匹配，第二发送模块605还可以向ESIM号码服务器发送安全标识消息，若ESIM号码服务器验证安全标识消息成功时，触发模块606可以触发第二接收模块607执行相应的操作。此外，删除模块612也可以通过第三接收模块610接收的ESIM号码删除指令删除确定模块611确定的第一目标ESIM号码，第三发送模块614也可以通过第四接收模块613接收的ESIM号码注销指令向ESIM号码服务器发送ESIM号码注销请求。由上可知，通过建立白名单机制、加密传输、安全系统独立写入EISM设备，从各个环节规避ESIM号码写入可能存在的数据被劫持、篡改或恶意写入等风险，同时，ESIM 号码数据的写入、删除、注销等操作只能由安全系统执行，确保了非安全系统以外系统的权限限制。
上面对本发明实施例中的安全系统进行了描述，下面对本发明实施例中的ESIM号码服务器进行描述，请参阅图7，本发明实施例中ESIM号码服务器一个实施例包括：
第一接收模块701，用于接收安全系统通过虚拟专用网络VPN发送的ESIM号码写入请求；
第二接收模块702，用于接收安全系统通过VPN发送的安全标识消息；
验证模块703，用于对第二接收模块702接收的安全标识消息进行验证；
发送模块704，用于根据第一接收模块701接收的ESIM号码写入请求通过VPN将加密ESIM号码数据发送至安全系统；
触发模块705，用于当验证模块703成功验证安全标识消息时，则触发发送模块704通过VPN将加密ESIM号码数据发送至安全系统；
第三接收模块706，用于接收安全系统通过VPN发送的ESIM号码注销请求；
确定模块707，用于根据第三接收模块706接收的ESIM号码注销请求确定第二目标ESIM号码；
注销模块708，用于注销确定模块707确定的第二目标ESIM号码的数据。
本实施例中，ESIM号码服务器中的第一接收模块701可以接收安全系统发送的ESIM号码写入请求，发送模块705可以将对应的加密ESIM号码数据通过VPN返回至安全系统。其中，验证模块703也可以进一步验证第二接收模块702接收的安全消息标识，使得触发模块704可以触发发送模块705执行相应的操作。此外，注销模块708还可以注销确定模块707确定的第二目标ESIM号码的数据。这不仅从ESIM号码服务器一侧确保了ESIM号码数据的安全性，也通过对安全系统的鉴权，使得安全系统才具有相应的读写权限，避免了其它系统的恶意干扰。
请参见图8，图8是本实施例提供的终端，如图8所示，所述终端包括通信总线802、输入装置803、输出装置804、存储器805以及处理器801，其中：
所述通信总线802，用于实现所述输入装置803、输出装置804、存储器805以及处理器801之间的连接通信；
所述输入装置803，用于接收ESIM号码写入指令；
所述输出装置804，用于根据所述ESIM号码写入指令通过虚拟专用网络VPN向对应的ESIM号码服务器发送ESIM号码写入请求；
所述存储器805中存储一组程序代码，且所述终端调用所述存储器中存储的程序代码，用于执行以下操作：
所述输入装置803接收ESIM号码写入指令；
若所述处理器801查询所述ESIM号码写入指令与ESIM号码服务器白名单匹配，则所述输出装置804根据所述ESIM号码写入指令通过虚拟专用网络VPN向对应的ESIM号码服务器发送ESIM号码写入请求；
所述输入装置803接收所述ESIM号码服务器基于所述ESIM号码写入请求发送的加密ESIM号码数据；
所述处理器801将所述加密ESIM号码数据进行解密；
所述输出装置804将解密后的ESIM号码数据写入ESIM设备。
可选的，在所述输出装置804根据所述ESIM号码写入指令通过虚拟专用网络VPN向对应的ESIM号码服务器发起ESIM号码写入请求之前，所述处理器801查询所述ESIM号码写入指令是否与所述ESIM号码服务器白名单匹配，所述ESIM号码服务器白名单为所述终端在目标位置建立。
可选的，在所述输出装置804根据所述ESIM号码写入指令通过虚拟专用网络VPN向对应的ESIM号码服务器发起ESIM号码写入请求之前，所述处理器801查询所述ESIM号码写入指令是否与所述ESIM号码服务器白名单匹配，所述ESIM号码服务器白名单为所述终端在本地建立。
可选的，在所述输入装置803接收所述ESIM号码服务器基于所述ESIM号码写入请求发送的加密ESIM号码数据之前，所述输出装置804通过所述VPN向所述ESIM号码服务器发送安全标识消息；
若所述ESIM号码服务器验证所述安全标识消息成功，则触发所述输入装置803接收所述ESIM号码服务器基于所述ESIM号码写入请求发送的加密ESIM号码数据的步骤。
可选的，所述输入装置803接收ESIM号码删除指令；
所述处理器801根据所述ESIM号码删除指令确定第一目标ESIM号码；
所述处理器801从所述ESIM设备删除所述第一目标ESIM号码。
可选的，所述输入装置803接收ESIM号码注销指令；
所述输出装置804根据所述ESIM号码注销指令通过所述VPN向所述ESIM号码服务器发送ESIM号码注销请求，以使得所述ESIM号码服务器根据所述ESIM号码注销请求注销对应的第二目标ESIM号码的数据。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储 介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，以上实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的精神和范围。

Claims (24)

  1. 一种ESIM号码的写入方法，其特征在于，包括：
    安全系统接收ESIM号码写入指令；
    若所述安全系统查询所述ESIM号码写入指令与ESIM号码服务器白名单匹配，则所述安全系统根据所述ESIM号码写入指令通过虚拟专用网络VPN向对应的ESIM号码服务器发送ESIM号码写入请求；
    所述安全系统接收所述ESIM号码服务器基于所述ESIM号码写入请求发送的加密ESIM号码数据；
    所述安全系统将所述加密ESIM号码数据进行解密；
    所述安全系统将解密后的ESIM号码数据写入ESIM设备。
  2. 根据权利要求1所述的ESIM号码的写入方法，其特征在于，在所述安全系统根据所述ESIM号码写入指令通过虚拟专用网络VPN向对应的ESIM号码服务器发起ESIM号码写入请求之前，所述方法还包括：
    所述安全系统查询所述ESIM号码写入指令是否与所述ESIM号码服务器白名单匹配，所述ESIM号码服务器白名单为终端在所述安全系统以外的目标位置建立，所述安全系统为所述终端建立的一个系统。
  3. 根据权利要求1所述的ESIM号码的写入方法，其特征在于，在所述安全系统根据所述ESIM号码写入指令通过虚拟专用网络VPN向对应的ESIM号码服务器发起ESIM号码写入请求之前，所述方法还包括：
    所述安全系统查询所述ESIM号码写入指令是否与所述ESIM号码服务器白名单匹配，所述ESIM号码服务器白名单为所述安全系统在本地建立。
  4. 根据权利要求1至3中任一项所述的ESIM号码的写入方法，其特征在于，在所述安全系统接收所述ESIM号码服务器基于所述ESIM号码写入请求发送的加密ESIM号码数据之前，所述方法还包括：
    所述安全系统通过所述VPN向所述ESIM号码服务器发送安全标识消息；
    若所述ESIM号码服务器验证所述安全标识消息成功，则触发所述安全系统接收所述ESIM号码服务器基于所述ESIM号码写入请求发送的加密ESIM号码数据的步骤。
  5. 根据权利要求1至3中任一项所述的ESIM号码的写入方法，其特征在于，所述方法还包括：
    所述安全系统接收ESIM号码删除指令；
    所述安全系统根据所述ESIM号码删除指令确定第一目标ESIM号码；
    所述安全系统从所述ESIM设备删除所述第一目标ESIM号码。
  6. 根据权利要求1至3中任一项所述的ESIM号码的写入方法，其特征在于，所述方法还包括：
    所述安全系统接收ESIM号码注销指令；
    所述安全系统根据所述ESIM号码注销指令通过所述VPN向所述ESIM号码服务器发送ESIM号码注销请求，以使得所述ESIM号码服务器根据所述ESIM号码注销请求注销对应的第二目标ESIM号码的数据。
  7. 一种ESIM号码的写入方法，其特征在于，包括：
    ESIM号码服务器接收安全系统通过虚拟专用网络VPN发送的ESIM号码写入请求；
    所述ESIM号码服务器根据所述ESIM号码写入请求通过所述VPN将加密ESIM号码数据发送至所述安全系统。
  8. 根据权利要求7所述的ESIM号码的写入方法，其特征在于，在所述ESIM号码服务器根据所述ESIM号码写入请求通过所述VPN将加密ESIM号码数据发送至所述安全系统之前，所述方法还包括：
    所述ESIM号码服务器接收所述安全系统通过所述VPN发送的安全标识消息；
    所述ESIM号码服务器对所述安全标识消息进行验证；
    若验证成功，则触发所述ESIM号码服务器根据所述ESIM号码写入请求通过所述VPN将加密ESIM号码数据发送至所述安全系统的步骤。
  9. 根据权利要求7或8所述的ESIM号码的写入方法，其特征在于，所述方法还包括：
    所述ESIM号码服务器接收所述安全系统通过所述VPN发送的ESIM号
    码注销请求；
    所述ESIM号码服务器根据所述ESIM号码注销请求确定第二目标ESIM 号码；
    所述ESIM号码服务器注销所述第二目标ESIM号码的数据。
  10. 一种安全系统，其特征在于，包括：
    第一接收模块，用于接收ESIM号码写入指令；
    第一发送模块，用于当所述安全系统查询所述ESIM号码写入指令与ESIM号码服务器白名单匹配时，则根据所述第一接收模块接收的所述ESIM号码写入指令通过虚拟专用网络VPN向对应的ESIM号码服务器发送ESIM号码写入请求；
    第二接收模块，用于接收所述ESIM号码服务器基于所述第一发送模块发送的所述ESIM号码写入请求发送的加密ESIM号码数据；
    解密模块，用于将所述第二接收模块接收的所述加密ESIM号码数据进行解密；
    写入模块，用于将所述解密模块解密后的ESIM号码数据写入ESIM设备。
  11. 根据权利要求10所述的安全系统，其特征在于，所述安全系统还包括：
    第一查询模块，用于查询所述第一接收模块接收的所述ESIM号码写入指令是否与所述ESIM号码服务器白名单匹配，所述ESIM号码服务器白名单为终端在所述安全系统以外的目标位置建立，所述安全系统为所述终端建立的一个系统。
  12. 根据权利要求10所述的安全系统，其特征在于，所述安全系统方法还包括：
    第二查询模块，用于查询所述第一接收模块接收的所述ESIM号码写入指令是否与所述ESIM号码服务器白名单匹配，所述ESIM号码服务器白名单为所述安全系统在本地建立。
  13. 根据权利要求10至12中任一项所述的安全系统，其特征在于，所述安全系统还包括：
    第二发送模块，用于通过所述VPN向所述ESIM号码服务器发送安全标识消息；
    触发模块，用于当所述ESIM号码服务器验证所述第二发送模块发送的所 述安全标识消息成功时，则触发所述第二接收模块接收所述ESIM号码服务器基于所述ESIM号码写入请求发送的加密ESIM号码数据。
  14. 根据权利要求10至12中任一项所述的安全系统，其特征在于，所述安全系统还包括：
    第三接收模块，用于接收ESIM号码删除指令；
    确定模块，用于根据所述第三接收模块接收的所述ESIM号码删除指令确定第一目标ESIM号码；
    删除模块，用于从所述ESIM设备删除所述确定模块确定的所述第一目标ESIM号码。
  15. 根据权利要求10至12中任一项所述的安全系统，其特征在于，所述安全系统还包括：
    第四接收模块，用于接收ESIM号码注销指令；
    第三发送模块，用于根据所述第四接收模块接收的所述ESIM号码注销指令通过所述VPN向所述ESIM号码服务器发送ESIM号码注销请求，以使得所述ESIM号码服务器根据所述ESIM号码注销请求注销对应的第二目标ESIM号码的数据。
  16. 一种ESIM号码服务器，其特征在于，包括：
    第一接收模块，用于接收安全系统通过虚拟专用网络VPN发送的ESIM号码写入请求；
    发送模块，用于根据所述第一接收模块接收的所述ESIM号码写入请求通过所述VPN将加密ESIM号码数据发送至所述安全系统。
  17. 根据权利要求16所述的ESIM号码服务器，其特征在于，所述ESIM号码服务器还包括：
    第二接收模块，用于接收所述安全系统通过所述VPN发送的安全标识消息；
    验证模块，用于对所述第二接收模块接收的所述安全标识消息进行验证；
    触发模块，用于当所述验证模块验证所述安全标识消息成功时，则触发所述发送模块根据所述ESIM号码写入请求通过所述VPN将所述加密ESIM号码数据发送至所述安全系统。
  18. 根据权利要求16或17所述的ESIM号码服务器，其特征在于，所述ESIM号码服务器还包括：
    第三接收模块，用于接收所述安全系统通过所述VPN发送的ESIM号
    码注销请求；
    确定模块，用于根据所述第三接收模块接收的所述ESIM号码注销请求确定第二目标ESIM号码；
    注销模块，用于注销所述确定模块确定的所述第二目标ESIM号码的数据。
  19. 一种终端，其特征在于，包括通信总线、输入装置、输出装置、存储器以及处理器，其中：
    所述通信总线，用于实现所述输入装置、输出装置、存储器以及处理器之间的连接通信；
    所述输入装置，用于接收ESIM号码写入指令；
    所述输出装置，用于根据所述ESIM号码写入指令通过虚拟专用网络VPN向对应的ESIM号码服务器发送ESIM号码写入请求；
    所述存储器中存储一组程序代码，且所述终端调用所述存储器中存储的程序代码，用于执行以下操作：
    所述输入装置接收ESIM号码写入指令；
    若所述处理器查询所述ESIM号码写入指令与ESIM号码服务器白名单匹配，则所述输出装置根据所述ESIM号码写入指令通过虚拟专用网络VPN向对应的ESIM号码服务器发送ESIM号码写入请求；
    所述输入装置接收所述ESIM号码服务器基于所述ESIM号码写入请求发送的加密ESIM号码数据；
    所述处理器将所述加密ESIM号码数据进行解密；
    所述输出装置将解密后的ESIM号码数据写入ESIM设备。
  20. 根据权利要求19所述的终端，其特征在于，在所述输出装置根据所述ESIM号码写入指令通过虚拟专用网络VPN向对应的ESIM号码服务器发起ESIM号码写入请求之前，所述处理器查询所述ESIM号码写入指令是否与所述ESIM号码服务器白名单匹配，所述ESIM号码服务器白名单为所述终端在目标位置建立。
  21. 根据权利要求19所述的终端，其特征在于，在所述输出装置根据所述ESIM号码写入指令通过虚拟专用网络VPN向对应的ESIM号码服务器发起ESIM号码写入请求之前，所述处理器查询所述ESIM号码写入指令是否与所述ESIM号码服务器白名单匹配，所述ESIM号码服务器白名单为所述终端在本地建立。
  22. 根据权利要求19至21中任一项所述的终端，其特征在于，在所述输入装置接收所述ESIM号码服务器基于所述ESIM号码写入请求发送的加密ESIM号码数据之前，所述输出装置通过所述VPN向所述ESIM号码服务器发送安全标识消息；
    若所述ESIM号码服务器验证所述安全标识消息成功，则触发所述输入装置接收所述ESIM号码服务器基于所述ESIM号码写入请求发送的加密ESIM号码数据的步骤。
  23. 根据权利要求19至21中任一项所述的终端，其特征在于，所述输入装置接收ESIM号码删除指令；
    所述处理器根据所述ESIM号码删除指令确定第一目标ESIM号码；
    所述处理器从所述ESIM设备删除所述第一目标ESIM号码。
  24. 根据权利要求19至21中任一项所述的终端，其特征在于，所述输入装置接收ESIM号码注销指令；
    所述输出装置根据所述ESIM号码注销指令通过所述VPN向所述ESIM号码服务器发送ESIM号码注销请求，以使得所述ESIM号码服务器根据所述ESIM号码注销请求注销对应的第二目标ESIM号码的数据。
PCT/CN2016/080827 2016-03-31 2016-04-29 一种esim号码的写入方法、安全系统、esim号码服务器及终端 WO2017166362A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610199846.1A CN105933886B (zh) 2016-03-31 2016-03-31 一种esim号码的写入方法、安全系统、esim号码服务器及终端
CN201610199846.1 2016-03-31

Publications (1)

Publication Number Publication Date
WO2017166362A1 true WO2017166362A1 (zh) 2017-10-05

Family

ID=56840364

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/080827 WO2017166362A1 (zh) 2016-03-31 2016-04-29 一种esim号码的写入方法、安全系统、esim号码服务器及终端

Country Status (2)

Country Link
CN (1) CN105933886B (zh)
WO (1) WO2017166362A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112770315A (zh) * 2020-12-22 2021-05-07 国网浙江省电力有限公司绍兴供电公司 一种电力无线异构网络的码号资源管理方法及装置

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106484796B (zh) * 2016-09-22 2022-12-20 宇龙计算机通信科技(深圳)有限公司 文件管理方法、文件管理装置及移动终端
CN109660579B (zh) * 2017-10-11 2022-02-25 阿里巴巴集团控股有限公司 数据处理方法、系统及电子设备
CN109286927B (zh) * 2018-10-11 2021-07-20 中国联合网络通信集团有限公司 一种eSIM模组数据安全的保护方法及装置
CN110798827B (zh) * 2019-10-29 2022-04-29 恒宝股份有限公司 一种eSIM卡及其初始化方法
CN114745710B (zh) * 2022-04-13 2023-04-18 中国联合网络通信集团有限公司 一种空域准入方法、装置及系统
CN115150813B (zh) * 2022-09-05 2023-01-20 北京智芯半导体科技有限公司 eSIM卡码号写入方法、写入装置、通信系统和服务器

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102484786A (zh) * 2009-06-08 2012-05-30 高通股份有限公司 用于在移动装置上执行多阶段虚拟sim供应和设置的方法和系统
CN103916844A (zh) * 2012-12-31 2014-07-09 华为技术有限公司 客户识别模块卡开通方法及虚拟客户识别模块卡服务器
CN104185176A (zh) * 2014-08-28 2014-12-03 中国联合网络通信集团有限公司 一种物联网虚拟用户识别模块卡远程初始化方法及系统
CN104509142A (zh) * 2014-04-18 2015-04-08 华为技术有限公司 虚拟用户标识模块数据的分发方法、装置与系统
CN105142134A (zh) * 2015-06-30 2015-12-09 宇龙计算机通信科技(深圳)有限公司 参数获取以及参数传输方法和装置
EP2975872A1 (en) * 2014-07-19 2016-01-20 Samsung Electronics Co., Ltd Embedded sim provisioning

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102469094A (zh) * 2010-11-19 2012-05-23 中国电信股份有限公司 远程写卡方法、服务器及系统
CN103795860A (zh) * 2014-01-22 2014-05-14 周哲明 一种双系统智能手机和带有通信功能的手机外套
CN104216777B (zh) * 2014-08-29 2017-09-08 宇龙计算机通信科技(深圳)有限公司 双系统电子装置及终端
CN105261130B (zh) * 2015-11-18 2018-11-20 北京微智全景信息技术有限公司 一种智能pos终端

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102484786A (zh) * 2009-06-08 2012-05-30 高通股份有限公司 用于在移动装置上执行多阶段虚拟sim供应和设置的方法和系统
CN103916844A (zh) * 2012-12-31 2014-07-09 华为技术有限公司 客户识别模块卡开通方法及虚拟客户识别模块卡服务器
CN104509142A (zh) * 2014-04-18 2015-04-08 华为技术有限公司 虚拟用户标识模块数据的分发方法、装置与系统
EP2975872A1 (en) * 2014-07-19 2016-01-20 Samsung Electronics Co., Ltd Embedded sim provisioning
CN104185176A (zh) * 2014-08-28 2014-12-03 中国联合网络通信集团有限公司 一种物联网虚拟用户识别模块卡远程初始化方法及系统
CN105142134A (zh) * 2015-06-30 2015-12-09 宇龙计算机通信科技(深圳)有限公司 参数获取以及参数传输方法和装置

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112770315A (zh) * 2020-12-22 2021-05-07 国网浙江省电力有限公司绍兴供电公司 一种电力无线异构网络的码号资源管理方法及装置
CN112770315B (zh) * 2020-12-22 2022-05-27 国网浙江省电力有限公司绍兴供电公司 一种电力无线异构网络的码号资源管理方法及装置

Also Published As

Publication number Publication date
CN105933886A (zh) 2016-09-07
CN105933886B (zh) 2020-04-07

Similar Documents

Publication Publication Date Title
US10666440B2 (en) Authentication method, device, server, and system, and storage medium
WO2017166362A1 (zh) 一种esim号码的写入方法、安全系统、esim号码服务器及终端
KR101719381B1 (ko) 저장 장치의 원격 액세스 제어
TWI475899B (zh) 用以儲存電子存取用戶之設備及方法
WO2020093214A1 (zh) 一种应用程序登录方法、应用程序登录装置及移动终端
US9225696B2 (en) Method for different users to securely access their respective partitioned data in an electronic apparatus
CN106575342B (zh) 包括关系数据库的内核程序、以及用于执行所述程序的方法和装置
CN112513857A (zh) 可信执行环境中的个性化密码安全访问控制
US9721071B2 (en) Binding of cryptographic content using unique device characteristics with server heuristics
WO2015180691A1 (zh) 验证信息的密钥协商方法及装置
WO2016045189A1 (zh) 一种双系统终端的数据读写方法及双系统终端
EP3355231B1 (en) Mobile data storage device with access control functionality
WO2020186457A1 (zh) 网络摄像机的认证方法和装置
WO2015117523A1 (zh) 访问控制方法及装置
US20230289089A1 (en) Multiple authorization requests from a data storage device
WO2023155696A1 (zh) 数据库的操作方法、系统、存储介质以及计算机终端
KR101473656B1 (ko) 모바일 데이터 보안 장치 및 방법
KR101711024B1 (ko) 부정조작방지 장치 접근 방법 및 그 방법을 채용한 단말 장치
WO2015131585A1 (zh) 一种保证sd卡安全的方法和装置
JP4480478B2 (ja) アクセスポイントおよび外部記憶装置を含むシステム、アクセスポイント、無線ｌａｎ接続方法、無線ｌａｎ接続プログラムを記録した媒体および無線ｌａｎシステム
US11784978B2 (en) Method for establishing remote work environment to ensure security of remote work user terminal and apparatus using the same
US11340801B2 (en) Data protection method and electronic device implementing data protection method
US20230291579A1 (en) Cryptographic keys for authorization requests from a data storage device
KR102086082B1 (ko) 웨어러블 단말을 이용한 레거시 시스템의 자동 로그인 방법 및 시스템
KR102005534B1 (ko) 스마트 기기 기반의 원격 접근 제어 및 멀티 팩터 인증 시스템

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16896140

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 16896140

Country of ref document: EP

Kind code of ref document: A1