WO2017206250A1 - 终端的备份销毁方法和装置 - Google Patents
终端的备份销毁方法和装置 Download PDFInfo
- Publication number
- WO2017206250A1 WO2017206250A1 PCT/CN2016/087547 CN2016087547W WO2017206250A1 WO 2017206250 A1 WO2017206250 A1 WO 2017206250A1 CN 2016087547 W CN2016087547 W CN 2016087547W WO 2017206250 A1 WO2017206250 A1 WO 2017206250A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- card terminal
- server
- module card
- subscriber identity
- identity module
- Prior art date
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W8/00—Network data management
- H04W8/18—Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W8/00—Network data management
- H04W8/18—Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
- H04W8/183—Processing at user equipment or user record carrier
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6209—Protecting access to data via a platform, e.g. using keys or access control rules to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
Definitions
- Embodiments of the present invention relate to data processing technologies, and in particular, to a backup and destruction method and apparatus for a terminal.
- GSM Global System for Mobile Communication
- eSIM embedded Subscriber Identity Module
- the embodiment of the present invention provides a backup and destruction method and device for an eSIM card terminal, so as to enable the eSIM card terminal user to remotely back up and destroy information stored in the eSIM card terminal.
- an embodiment of the present invention provides a backup and destruction method for a terminal, including:
- the local eSIM card terminal identifies a legal remote backup destruction instruction according to the security check operator
- the local eSIM card terminal uses an information key to encrypt information of the target information stored in the set storage space;
- the local eSIM card terminal sends the encrypted target information to a server for backup, and deletes the target information stored in the storage space.
- the embodiment of the present invention further provides a backup and destruction method for a terminal, including:
- the server identifies a legal remote backup destruction instruction according to at least one security check operator stored locally;
- the server receives the encrypted target information sent by the target eSIM card terminal for storage.
- an embodiment of the present invention provides a backup and destruction device for a terminal, which is applied to an eSIM card terminal, and includes:
- a legal instruction identification module for identifying a legal remote backup destruction instruction according to the security verification operator
- a backup information encryption module configured to encrypt information of the target information stored in the set storage space by using the information key
- the backup destruction module is configured to send the encrypted target information to the server for backup, and delete the target information stored in the storage space.
- the embodiment of the present invention further provides a backup and destruction device for a terminal, which is applied to a server, and includes:
- a legal instruction identification module configured to identify a legal remote backup destruction instruction according to at least one security verification operator stored locally
- a backup destruction instruction sending module configured to send the legal remote backup destruction instruction to the target eSIM card terminal corresponding to the legal remote backup destruction instruction, so that the target eSIM card terminal pairs the target information stored in the storage space Perform backup destruction;
- a backup information storage module configured to receive the encrypted target information sent by the target eSIM card terminal for storage.
- the technical solution of the embodiment of the present invention identifies a legal remote backup destruction instruction according to the security verification operator by using the eSIM card terminal; encrypts the target information stored in the set storage space by using the information key; and encrypts the target
- the technical means for sending information to the server for backup and deleting the target information stored in the storage space, in the process of information interaction between the eSIM card terminal and the server, realizing remote backup and destruction of data stored in the eSIM card terminal The technical effect can further solve the problem of data loss and sensitive data leakage caused by the loss of the user's eSIM card terminal, ensuring information security and reliability in the eSIM card terminal, and further expanding the function of the eSIM card terminal. .
- FIG. 1 is a flowchart of a backup and destruction method of a terminal according to Embodiment 1 of the present invention
- FIG. 2 is a flowchart of a backup and destruction method of a terminal according to Embodiment 2 of the present invention
- FIG. 3 is a flowchart of a backup and destruction method of a terminal according to Embodiment 3 of the present invention.
- FIG. 4 is a flowchart of a backup and destruction method of a terminal according to Embodiment 4 of the present invention.
- FIG. 5 is a flowchart of a backup and destruction method of a terminal according to Embodiment 5 of the present invention.
- FIG. 6 is a flowchart of a backup and destruction method of a terminal according to Embodiment 6 of the present invention.
- FIG. 7 is a flowchart of a backup and destruction method of a terminal according to Embodiment 7 of the present invention.
- Embodiment 8 is a flowchart of a backup and destruction method of a terminal according to Embodiment 8 of the present invention.
- FIG. 9 is a schematic diagram of information interaction in a terminal registration process according to an embodiment of the present invention.
- FIG. 10 is a schematic diagram of information interaction in a terminal identity verification process according to an embodiment of the present invention.
- FIG. 11 is a schematic diagram of information interaction in a remote backup and destruction process of a terminal according to an embodiment of the present invention.
- FIG. 12 is a schematic diagram of information exchange in another remote backup and destruction process of a terminal according to an embodiment of the present invention.
- FIG. 13 is a structural diagram of a backup and destruction device for a terminal according to Embodiment 9 of the present invention.
- FIG. 14 is a structural diagram of a backup and destruction device for a terminal according to Embodiment 10 of the present invention.
- FIG. 1 is a flowchart of a backup and destruction method of a terminal according to Embodiment 1 of the present invention.
- the method in this embodiment is generally applicable to a situation in which a user performs backup and destruction on data stored in an eSIM card terminal by means of remote control.
- the method of this embodiment can be implemented by the backup destruction device of the eSIM card terminal.
- the device may be implemented by software and/or hardware, and may be integrated into the eSIM card terminal device.
- the backup and destruction method of the terminal provided by the embodiment includes:
- the local eSIM card terminal identifies a legal remote backup destruction instruction according to the security check operator.
- a backup and destruction method of the remote eSIM card terminal is proposed.
- the user can send a remote backup destruction command to the lost local eSIM card terminal through the third party eSIM card terminal or server to implement the data stored in the lost local eSIM card terminal.
- the local eSIM card terminal must verify the legality of the received remote backup destruction instruction to prevent the malicious backup deletion instruction from attacking the information of the local eSIM card terminal.
- the local eSIM card terminal identifies the legal remote backup destruction instruction by a locally stored security check operator.
- the local eSIM card terminal can perform certain data processing on the verification information (for example, the device identifier of the local eSIM card terminal or the backup deletion password of the user-defined setting) included in the received remote backup destruction instruction. If the data processing result is consistent with the security check operator, it is determined that the received remote backup destruction instruction is a legal instruction.
- the security check operator may be pre-configured in the local eSIM card terminal before the local eSIM card terminal leaves the factory, or may be dynamically generated and stored in the user when the user registers with the server. In the local eSIM card terminal, this embodiment does not limit this.
- the local eSIM card terminal uses an information key to encrypt information of the target information stored in the set storage space.
- the target information stored in the storage space needs to be set (for example, contact information in the address book, photo information in the image, and The personal information stored in the memo is uploaded to the server for backup.
- the local eSIM card terminal first encrypts the target information using the information key.
- the information key may be pre-configured in the local eSIM card terminal before the local eSIM card terminal leaves the factory, or may be dynamically generated and stored in the local eSIM when the user performs identity verification on the server. In the card terminal, this embodiment does not limit this.
- the information key corresponding to the local eSIM card terminal is stored on the server side, or the information is generated and generated.
- the key method is implemented to enable the user to successfully retrieve the backup destination information on the server side.
- the local eSIM card terminal sends the encrypted target information to a server for backup, and deletes target information stored in the storage space.
- the local eSIM card terminal successfully sends the encrypted target information to the server for backup, for example, after receiving the successful backup response sent by the server, the corresponding deletion is performed.
- the target information stored in the storage space to complete the destruction of the information of the local eSIM card terminal.
- the technical solution of the embodiment of the present invention identifies a legal remote backup destruction instruction according to the security verification operator by using the eSIM card terminal; encrypts the target information stored in the set storage space by using the information key; and encrypts the target
- the technical means for sending information to the server for backup and deleting the target information stored in the storage space, in the process of information interaction between the eSIM card terminal and the server, realizing remote backup and destruction of data stored in the eSIM card terminal Technical effect, and thus To solve the problem of data loss and sensitive data leakage caused by the loss of the user's eSIM card terminal, the information security and reliability in the eSIM card terminal are ensured, and the function of the eSIM card terminal is further expanded.
- FIG. 2 is a flowchart of a backup and destruction method of a terminal according to Embodiment 2 of the present invention.
- the embodiment is optimized based on the foregoing embodiment. Referring to FIG. 2, the method in this embodiment specifically includes:
- the local eSIM card terminal sends a registration request to the server.
- the security check operator is generated.
- the local eSIM card terminal receives the first operation function and the server key returned by the server.
- the first operational function may preferably be a hash function, or a hash function, Hash(*).
- the server can authenticate the legitimate registered terminal by sending the server key to the registered local eSIM card terminal.
- the server key may also be sent to the local eSIM card terminal after being processed by a hash function.
- the local eSIM card terminal performs a calculation on the user identifier and the user password input by the user by using the first operation function to generate an encrypted user identifier and an encrypted user password.
- the user of one eSIM card terminal needs to input the user identifier and the user password corresponding to the eSIM card terminal in advance.
- the local eSIM card terminal in order to prevent the internal attacker on the server side from acquiring the user identifier and the user password, the local eSIM card terminal encrypts the user identifier and the user password by using the first operation function sent by the server, and then sends the identifier to the user. Said server.
- the local eSIM card terminal calculates the security check operator according to the encrypted user identifier, the encrypted user password, the server key, and a standard operation rule agreed with the server.
- the standard operation rule may be an exclusive operation rule that is pre-agreed with the server, such as an exclusive OR operation or an identical operation, and is not limited in this embodiment.
- the HID is an encrypted user identifier generated by the user identifier after being processed by a hash function; the HUK is an encrypted user password generated after the user password is processed by a hash function; Hash (RSK) is a server key; and the hash is an exclusive OR operator.
- the local eSIM card terminal sends the encrypted user identifier, the encrypted user password, and the security check operator to the server, so that the server completes the security check operator. verification.
- the server end receives the encrypted user identifier, the encrypted user password, and the standard operation rule preset in advance with the local eSIM card terminal according to the locally stored server key. Comparing the check operator, if the comparison check operator matches the received security check operator, determining that the registration is successful; if the comparison check operator and the received If the security check operators do not match, it is determined that the registration fails.
- the local eSIM card terminal determines whether the registration success information returned by the server is received: if yes, execute S270; otherwise, determine that the registration fails.
- the local eSIM card terminal stores the security verification operator.
- the local eSIM card terminal identifies a legal remote backup destruction instruction according to the security check operator.
- the local eSIM card terminal uses an information key to encrypt information of the target information stored in the set storage space.
- the local eSIM card terminal sends the encrypted target information to a server for backup, and deletes target information stored in the storage space.
- the technical solution of the embodiment is to further enhance the security of the remote backup and destruction method of the eSIM card terminal, and the operation of registering the eSIM card terminal with the server is added, and only the remotely registered eSIM card terminal is stored for recognizing the remote
- the legal security check operator of the backup destroy command further ensures the security and reliability of the information in the eSIM card terminal.
- FIG. 3 is a flowchart of a backup and destruction method of a terminal according to Embodiment 3 of the present invention.
- the embodiment is optimized based on the foregoing embodiment.
- the method in this embodiment specifically includes:
- the local eSIM card terminal registers with the server, and after the registration is successful, stores the security check operator generated during the registration process.
- the local eSIM card terminal sends the encrypted IMSI through the first operation function according to the IMSI acquisition request sent by the server, and then sends the IMSI to the server.
- IMSI International Mobile Subscriber Identification Number
- the server performs identity verification on the registered eSIM card terminal according to the IMSI of the different eSIM card terminal. Only After the local eSIM card terminal determines to pass the identity verification, an information key for encrypting the data stored in the local eSIM card terminal is generated to further improve the security of the backup destruction method.
- the local eSIM card terminal receives an operation function set returned by the server.
- the operation function set includes: a second operation function, an encryption and decryption function pair, and a random number generation function.
- the second operation function may be a key-related hash operation function, and the function may be represented as HMAC (key, message), and the operation uses a hash algorithm, with a key key and a message message as Enter to generate a message digest as output.
- HMAC key, message
- the encryption/decryption function pair may preferably be an encryption function based on AES (Advanced Encryption Standard), and a decryption function.
- AES Advanced Encryption Standard
- the encryption function may be represented as AES-enc (message, key), which indicates that the message message is symmetrically encrypted using the private key key;
- the decryption function may be represented as AES-dec (message, key), which indicates that the message message is symmetrically decrypted using the private key key.
- AES-dec messages, key
- the random number generating function may specifically be a function for generating a random number (for example, 0 to 100) within a set value range.
- the local eSIM card terminal performs information interaction with the server by using the operation function set, and verifies an identity verification verification operator returned by the server.
- the local eSIM card terminal uses the operation function set to perform information interaction with the server, and the verification of the identity verification verification operator returned by the server may include :
- the local eSIM card terminal generates a first random number using the random number generating function, and sends the first random number to the server;
- the local eSIM card terminal receives the identity verification check operator returned by the server, where the identity verification check operator includes: a hash key to be verified, a second random number, and a message to be decrypted;
- the local eSIM card terminal decrypts the to-be-decrypted message by using a decryption function in the encryption/decryption function pair, and acquires a random key included in the to-be-decrypted message;
- the local eSIM card terminal generates a comparison hash key according to the random key, the first random number, the second random number, the encrypted IMSI, and the second operation function;
- the local eSIM card terminal determines that the comparison hash key matches the to-be-verified hash key, determining that the identity verification verification operator passes verification;
- the local eSIM card terminal sends identity authentication success information to the server.
- the local eSIM card terminal determines whether the identity verification check operator passes the verification: if yes, execute S360; otherwise, determine that the identity verification fails.
- the local eSIM card terminal generates the information key according to the security check operator, the encrypted IMSI, and the standard operation rule.
- the local eSIM card terminal identifies a legal remote backup destruction instruction according to the security check operator.
- the local eSIM card terminal uses an information key to encrypt information of the target information stored in the set storage space.
- the local eSIM card terminal sends the encrypted target information to a server for backup, and deletes target information stored in the storage space.
- the technical solution of the eSIM card terminal is authenticated to the server, and only the identity verification is performed.
- the information key used to encrypt the data stored in the eSIM card terminal is generated in the successful eSIM card terminal, thereby further ensuring information security and reliability in the eSIM card terminal.
- FIG. 4 is a flowchart of a backup and destruction method of a terminal according to Embodiment 4 of the present invention.
- the embodiment is optimized based on the foregoing embodiment. Referring to FIG. 4, the method in this embodiment specifically includes:
- the local eSIM card terminal registers with the server, and after the registration is successful, stores the security check operator generated in the registration process.
- the local eSIM card terminal performs identity verification on the server, and after the identity verification succeeds, generates the information key.
- the local eSIM card terminal identifies the received information: if it is determined that the received remote backup destruction command sent by the server, execute S440; if it is determined that the received remote backup is sent by the third-party eSIM card terminal To destroy the SMS, execute S450.
- the instruction is directly recognized as a legal remote backup destruction instruction; if the local eSIM card terminal receives the third-party eSIM card terminal, If the remote backup destroys the short message, the security check operator is needed to identify the legality of the remote backup destroying the short message.
- the reason for this setting is mainly to consider the usage scenarios of two actual remote backup destruction methods: First, the user sends a target eSIM card to the server using a third-party eSIM card terminal (typically, stolen or needs to be backed up by information)
- the remote backup of the local eSIM card destroys the short message, and the server side identifies the legality of the remote backup destroying the short message, and after the identification is passed, the server directly controls the target eSIM card terminal to complete the corresponding backup.
- Destruction operation the other is that the user sends a remote backup destroy message directly to the target eSIM card terminal by using the third-party eSIM card terminal, by the target
- the eSIM card terminal identifies the legality of the remote backup destroying the short message, and after the identification is passed, the corresponding eSD card terminal directly completes the corresponding backup and destroy operation.
- the remote backup destroying short message includes: a user identifier to be verified, a password of the user to be verified, and a remote backup destruction instruction to be verified.
- the local eSIM card terminal directly identifies the remote backup destruction instruction as a legal remote backup destruction instruction, and executes S480.
- the local eSIM card terminal calculates a to-be-verified operator according to the to-be-verified user identifier, the to-be-verified user password, the server key, and the standard operation rule.
- the to-be-verified operator calculated by the to-be-verified operator is matched with the security verification operator.
- the user ID to be verified is consistent with the actual user ID
- the password of the user to be verified is consistent with the actual user password. Therefore, the remote backup destruction command to be verified is determined to be a legal remote backup destruction instruction.
- the local eSIM card terminal determines whether the to-be-verified operator matches the security verification operator: if yes, execute S470; otherwise, return to execute S430.
- the local eSIM card terminal determines that the remote backup destruction instruction to be verified is a legal remote backup destruction instruction, and executes S480.
- the local eSIM card terminal uses an information key to encrypt information of the target information stored in the set storage space.
- the local eSIM card terminal sends the encrypted target information to a server for backup, and deletes target information stored in the storage space.
- the eSIM card terminal of the technical solution of the embodiment identifies the received information, if it determines that the received information is a remote backup destruction command sent by the server, the remote backup destruction instruction is directly identified as a secure remote backup destruction instruction. If it is determined that the received information is a remote backup destroying short message sent by the third-party eSIM card terminal, the validity of the remote backup destroying the short message needs to be verified locally, and the corresponding secure remote backup destroying instruction is identified, and two different settings are set.
- the secure remote backup destruction instruction identification mechanism can correctly respond to the backup destruction operation by using different processing mechanisms when the backup is initiated for the server or the third-party eSIM card terminal, further improving the technical solution of the present invention and ensuring the eSIM card terminal. Information security and reliability.
- the method further includes: the local eSIM card terminal receiving the sending by the server The local network connection command is opened to open the local network connection; or the local eSIM card terminal opens the local network connection if it determines that it is not currently connected to the network.
- FIG. 5 is a flowchart of a backup and destruction method of a terminal according to Embodiment 5 of the present invention.
- the method in this embodiment is generally applicable to a situation in which a user performs backup and destruction on data stored in an eSIM card terminal by using a remote control manner.
- the method of this embodiment can be implemented by the backup destruction device of the eSIM card terminal.
- the device may be implemented by software and/or hardware, and may be integrated into a server.
- the method for backing up the eSIM card terminal provided by the embodiment includes:
- the server identifies a legal remote backup destruction instruction according to at least one security verification operator stored locally.
- different security check operators are stored in the server for different eSIM card terminals to identify legal remote backup destruction instructions and target eSIM card terminals that need to be controlled by the legal remote backup destruction instructions.
- the security check operator may be sent by the eSIM card terminal to the server after the server establishes a secure network connection with the eSIM card terminal, or the eSIM card terminal may register with the server. Dynamically generated, this embodiment does not limit this.
- S520 The server sends the legal remote backup destruction instruction to the target eSIM card terminal corresponding to the legal remote backup destruction instruction, so that the target eSIM card terminal performs backup and destruction on the target information stored in the set storage space. .
- the server receives the encrypted target information sent by the target eSIM card terminal for storage.
- the server of the technical solution of the embodiment of the present invention identifies a legal remote backup destruction instruction according to the at least one security verification operator stored locally; and sends the legal remote backup destruction to the target eSIM card terminal corresponding to the legal remote backup destruction instruction. And receiving the encrypted target information sent by the target eSIM card terminal for storage, thereby realizing the technical effect of remotely erasing and destroying data stored in the eSIM card terminal, thereby further solving the problem that when the user's eSIM card terminal is lost The problem of data loss and sensitive data leakage ensures the security and reliability of the information in the eSIM card terminal, further expanding the function of the eSIM card terminal.
- FIG. 6 is a flowchart of a backup and destruction method of a terminal according to Embodiment 6 of the present invention.
- the embodiment is optimized based on the foregoing embodiment.
- the technical solution of the embodiment corresponds to the technical solution in the second embodiment. Referring to FIG. 6, the method in this embodiment specifically includes:
- the server sends a first operation function and a server key to the registered eSIM card terminal according to the terminal registration request sent by the registered eSIM card terminal.
- the server receives an encrypted user identifier, an encrypted user password, and a security check operator to be verified returned by the registered eSIM card terminal.
- the server calculates a comparison check operator according to the encrypted user identifier, the encrypted user password, the server key, and a standard operation rule agreed with the registered eSIM card terminal.
- the server determines whether the comparison check operator matches the to-be-verified security check operator: if yes, execute S650, otherwise, determine that the registration fails.
- the server sends registration success information to the registered eSIM card terminal, and stores the to-be-verified security check operator as a security check operator corresponding to the registered eSIM card terminal.
- the server identifies a legal remote backup destruction instruction according to at least one security check operator stored locally.
- the server sends the legal remote backup destruction instruction to the target eSIM card terminal corresponding to the legal remote backup destruction command, so that the target eSIM card terminal performs backup and destruction on the target information stored in the set storage space. .
- the server receives the encrypted target information sent by the target eSIM card terminal for storage.
- the technical solution of the present embodiment increases the operation of registering the eSIM card terminal by the server, and only stores the security school corresponding to the successfully registered eSIM card terminal on the server side. The operator is verified to further ensure information security and reliability in the eSIM card terminal.
- FIG. 7 is a flowchart of a backup and destruction method of a terminal according to Embodiment 7 of the present invention.
- the embodiment is optimized based on the foregoing embodiment.
- the technical solution of the embodiment corresponds to the technical solution of the third embodiment. Referring to FIG. 3, the method in this embodiment specifically includes:
- the server registers the registered eSIM card terminal, and after the registration is successful, stores a security check operator corresponding to the registered eSIM card terminal.
- the server sends an IMSI acquisition request to the registered eSIM card terminal that is successfully registered.
- the server receives the encrypted IMSI returned by the registered eSIM card terminal.
- the server sends an operation function set to the registered eSIM card terminal.
- the operation function set includes: a second operation function, an encryption and decryption function pair, and a random number generation function;
- the server performs information interaction with the registered eSIM card terminal by using the operation function set, and sends an identity verification check operator to the registered eSIM card terminal, so that the registered eSIM card terminal pairs the identity. Verify the verification operator for verification.
- the server uses the operation function set to perform information interaction with the registered eSIM card terminal, and sending the identity verification check operator to the registered eSIM card terminal may include:
- the server generates a second random number according to the random number generating function
- the server generates a hash key to be verified according to the random key, the first random number, the second random number, the encrypted IMSI, and the second operation function;
- the server generates a to-be-decrypted message according to the random key, a security check operator corresponding to the registered eSIM card terminal, and an encryption function in the encryption/decryption function pair;
- the server sends the to-be-verified hash key, the second random number, and the to-be-decrypted message as an identity verification check operator to the registered eSIM card terminal, so that the registered eSIM card terminal pair
- the authentication verification operator performs verification.
- the server determines whether the identity authentication success information returned by the registered eSIM card terminal is received: if yes, execute S770; otherwise, determine identity authentication fails.
- the server generates an information key corresponding to the registered eSIM card terminal according to the security check operator, the encrypted IMSI, and the standard operation rule.
- the server identifies a legal remote backup destruction instruction according to at least one security verification operator stored locally.
- the server sends the legal remote backup destruction instruction to the target eSIM card terminal corresponding to the legal remote backup destruction instruction, so that the target eSIM card terminal performs backup destruction on the target information stored in the set storage space.
- the server receives the encrypted target information sent by the target eSIM card terminal for storage and storage.
- the technical solution of the embodiment increases the operation of the server to perform identity verification on the eSIM card terminal, thereby further ensuring information security and reliability in the eSIM card terminal.
- FIG. 8 is a flowchart of a backup and destruction method of a terminal according to Embodiment 8 of the present invention.
- the embodiment is optimized based on the foregoing embodiment.
- the technical solution of the embodiment corresponds to the technical solution of the fourth embodiment. Referring to FIG. 8, the method in this embodiment specifically includes:
- the server registers the registered eSIM card terminal, and after the registration is successful, stores a security check operator corresponding to the registered eSIM card terminal.
- the server performs identity verification on the registered eSIM card terminal that is successfully registered, and after the identity verification succeeds, generates the information key corresponding to the registered eSIM card terminal.
- the server receives a remote backup and destroys a short message sent by a third-party eSIM card terminal.
- the remote backup destroying short message includes: a user identifier to be verified, a password of the user to be verified, and a remote backup destruction instruction to be verified;
- the server calculates a to-be-verified operator according to the to-be-verified user identifier, the to-be-verified user password, the server key, and the standard operation rule.
- the server determines whether the to-be-verified operator is stored: if yes, execute S860; otherwise, return to execute S830.
- the server sends an online query request to a target eSIM card terminal corresponding to the legal remote backup destruction instruction.
- the server determines whether the target eSIM card terminal normally responds to the online query request: if yes, execute S890; otherwise, execute S8100.
- S890 Send the legal remote backup destruction instruction to the target eSIM card terminal.
- the server receives the encrypted target information sent by the target eSIM card terminal for storage.
- the technical solution of the embodiment implements the technical effect of remotely erasing and destroying data stored in the eSIM card terminal, thereby solving the problem of data loss and sensitive data leakage caused by the loss of the user's eSIM card terminal, and ensuring the problem.
- the information security and reliability in the eSIM card terminal further expands the functions of the eSIM card terminal.
- FIG. 9 is a schematic diagram of information interaction in a terminal registration process according to an embodiment of the present invention, where both sides of the information interaction are an eSIM card terminal and a server.
- the eSIM card terminal When the eSIM card terminal applies to join the server, the eSIM card terminal automatically sends a registration request to the server, and the user needs to input a user ID (ID) and a corresponding user key (UK). Then the server sends the first operation function Hash(*) and the server key hash (RSK) to the eSIM card terminal, and the eSIM card terminal uses Hash(*) to calculate the encrypted user identifier HID, the encrypted user key HUK, and the security check calculation.
- the sub-HRSKu is sent to the server. After receiving the HID, HUK and HRSKu of the user, the server calculates the corresponding comparison check operator HRSKr and determines whether the HRSKr is equal to HRSKu. If the two are equal, the eSIM card is successfully registered, otherwise the registration is successful. failure. As shown in FIG. 9, the detailed steps specifically include:
- Step 1 The eSIM card terminal sends a registration request command to the server, and causes the user to input a user ID and a corresponding user key UK;
- Step 2 The server responds to the registration request of the user, and sends a hash function Hash (*) and Hash (RSK) to the eSIM card terminal;
- Step 5 The server sends a registration success or failure message to the eSIM card terminal.
- FIG. 10 is a schematic diagram of information interaction in a terminal identity verification process according to an embodiment of the present invention.
- the two sides of the information interaction are an eSIM card terminal and a server.
- Step 1 After the eSIM card terminal successfully registers an account, the server sends an IMSI command requesting to obtain the eSIM card to the eSIM card terminal;
- Step 3 The server obtains the eSIM card HMSI, and the key related hash operation HMAC(*,*), The AES encryption and decryption algorithm and the generated random number algorithm are sent to the eSIM card terminal;
- Step 4 The eSIM card terminal generates a random number RN0 by using a random number algorithm and sends it to the server.
- HMAC key-related hash function
- Step 7 If step 6 is established, the eSIM card terminal will send an identity authentication success message to the server, otherwise send an identity authentication failure message, and the process ends.
- FIG. 11 is a schematic diagram of information interaction in a remote backup and destruction process of a terminal according to an embodiment of the present invention; wherein the three parties of information interaction are third-party eSIM card terminals, servers, and eSIM card terminals.
- Figure 11 mainly shows the process of securely backing up and destroying terminal data through a server. The specific steps include:
- Step 1 Enter the IDi and UKi of the eSIM card terminal i (ie, the lost terminal) at the third-party eSIM card terminal j, and generate the HIDi and HUKi using the hash function of the eSIM card terminal j, and delete the HIDi, HUKi, and backup and delete The command is sent to the server.
- the third-party eSIM card terminal j is also pre-server Registered in ;
- Step 3 In the case where the server finds the terminal i in step 2, the server sends a check to the terminal i whether the terminal i is online, and waits for the terminal i to respond;
- Step 4 If the terminal i responds normally, it means that the terminal i network is normal; if the terminal i does not respond or the response times out, it means that the terminal i is not connected to the network, and the server needs to send a short message to the terminal i to open the terminal i network connection. ;
- Step 5 In the case where the terminal i network is normal in step 4, the server sends a data backup and delete command to the terminal i;
- Step 7 The terminal i notifies the server of the backup and deletion success message, and the server notifies the terminal j.
- FIG. 12 is a schematic diagram of information interaction in a remote backup and destruction process of a terminal according to an embodiment of the present invention; wherein the three parties of information interaction are third-party eSIM card terminals, servers, and eSIM cards.
- FIG. 12 mainly shows a process of securely backing up and destroying terminal data by means of a third-party eSIM card terminal short message. The specific steps include:
- Step 1 Enter the IDi and UKi of the eSIM card terminal i (ie, the lost terminal) at the eSIM card terminal j, And using the hash function of the eSIM card terminal j to generate HIDi and HUKi, and sending a data backup and deletion command short message to the terminal i.
- the SMS content is HIDi, HUKi and backup and delete commands;
- Step 3 The terminal i sends a connection server request to the server.
- Step 4 The server responds to the request, and the connection server succeeds or not to notify the terminal j;
- Step 5 After successfully connecting to the server in step 4, the terminal i responds to the data backup and delete command of the short message, and uses the symmetric encryption function AES-enc (message, key) and the information confidentiality of the eSIM card terminal i for the important information M of the terminal i.
- Step 6 The terminal i notifies the server of the secure backup and destruction success message, and the server notifies the terminal j again.
- the user sends the user's HUID and HUK to the server instead of directly sending the user password UK to the server. Therefore, when there is an internal attacker in the server, it cannot obtain the user password UK to ensure the security of the user password information.
- the identity of the eSIM card terminal is authenticated, and the HMAC value (as a verification code) is calculated by using the random numbers RN0, RN1, and the HMSI code, and is put into the message, and the eSIM card terminal passes the verification message.
- the HMAC value is used to judge the correctness of the information, thereby dynamically verifying the identity of the eSIM card terminal and ensuring that the eSIM card terminal is secure;
- the identity legality of the eSIM card terminal when the identity legality of the eSIM card terminal is verified, it will be born.
- the information key is not uploaded to the server and stored only in the secure storage area of the eSIM card, thereby ensuring the security of the information backed up in the cloud.
- FIG. 13 is a schematic structural diagram of a backup and destruction device of a terminal according to Embodiment 9 of the present invention.
- the backup and destruction device of the eSIM card terminal provided in this embodiment is applied to an eSIM card terminal, and the device may specifically include: a legal instruction identification module 131, a backup information encryption module 132, and a backup destruction module 133, where:
- the legal instruction identification module 131 is configured to identify a legal remote backup destruction instruction according to the security verification operator.
- the backup information encryption module 132 is configured to encrypt information of the target information stored in the set storage space by using the information key.
- the backup destruction module 133 is configured to send the encrypted target information to the server for backup, and delete the target information stored in the storage space.
- the technical solution of the embodiment of the present invention identifies a legal remote backup destruction instruction according to the security verification operator by using the eSIM card terminal; encrypts the target information stored in the set storage space by using the information key; and encrypts the target
- the technical means for sending information to the server for backup and deleting the target information stored in the storage space, in the process of information interaction between the eSIM card terminal and the server, realizing remote backup and destruction of data stored in the eSIM card terminal The technical effect can further solve the problem of data loss and sensitive data leakage caused by the loss of the user's eSIM card terminal, ensuring information security and reliability in the eSIM card terminal, and further expanding the function of the eSIM card terminal. .
- the apparatus may further include: a registration module, configured to:
- the server Before the legal remote backup destruction instruction is identified according to the security verification operator, the server is registered, and after the registration is successful, the security verification operator generated in the registration process is stored.
- the registration module may be specifically configured to:
- the apparatus may further include: an identity verification module, configured to: after registering with the server, and after the registration is successful, storing the security check calculation generated in the registration process After the child, the server is authenticated, and after the authentication is successful, the information key is generated.
- an identity verification module configured to: after registering with the server, and after the registration is successful, storing the security check calculation generated in the registration process After the child, the server is authenticated, and after the authentication is successful, the information key is generated.
- the identity verification module may specifically include:
- the encrypted IMSI sending unit is configured to send, according to the IMSI acquisition request sent by the server, the IMSI to the server by using the first operation function to generate an encrypted IMSI, and send the same to the server;
- An operation function set receiving unit configured to receive an operation function set returned by the server, where the operation function set includes: a second operation function, an encryption and decryption function pair, and a random number generation function;
- An information interaction unit configured to perform information interaction with the server by using the operation function set, and verify an authentication verification operator returned by the server;
- a verification success determining unit configured to determine that the identity verification is successful if it is determined that the identity verification verification operator passes the verification
- an information key generating unit configured to generate the information key according to the security check operator, the encrypted IMSI, and the standard operation rule.
- the information interaction unit may be specifically configured to:
- the method includes: a hash key to be verified, a second random number, and a message to be decrypted; decrypting the to-be-decrypted message by using a decryption function in the pair of encryption and decryption functions, and acquiring a random key included in the to-be-decrypted message Generating a comparison hash key according to the random key, the first random number, the second random number, the encrypted IMSI, and the second operation function; if the comparison is determined And matching the hash key with the to-be-verified hash key, determining that the identity verification check operator passes the verification; and sending the identity authentication success information to the server.
- the legal instruction identification module is specifically configured to:
- the remote backup destroying the short message includes: a user identifier to be verified, a password to be verified, and a remote backup destruction command to be verified; according to the user identifier to be verified, Determining a user password, the server key, and the standard operation rule, and calculating a to-be-verified operator; if it is determined that the to-be-verified operator matches the security verification operator, determining the remote backup to be verified
- the destroy command is a legal remote backup destroy command.
- the legal instruction identification module is further configured to: if the remote backup destruction instruction sent by the server is received, directly identify the remote backup destruction instruction as a legal remote backup destruction instruction.
- the device may further include: a network connection unit, configured to:
- the local network connection is opened; or if it is determined that the network is not currently connected, the local network connection is opened. .
- the above product can perform the method provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.
- FIG. 14 is a schematic structural diagram of a backup and destruction device of a terminal according to Embodiment 10 of the present invention.
- the backup and destruction device of the terminal provided in this embodiment is applied to a server, and the device may include: a legal instruction identification module 141, a backup destruction instruction sending module 142, and a backup information storage module 143, where:
- the legal instruction identification module 141 is configured to identify a legal remote backup destruction instruction according to at least one security verification operator stored locally.
- the backup destruction instruction sending module 142 is configured to send the legal remote backup destruction instruction to the target eSIM card terminal corresponding to the legal remote backup destruction instruction, so that the target eSIM card terminal pairs the target stored in the storage space The information is backed up and destroyed.
- the backup information storage module 143 is configured to receive the encrypted target information sent by the target eSIM card terminal for storage and storage.
- the server of the technical solution of the embodiment of the present invention identifies a legal remote backup destruction instruction according to the at least one security verification operator stored locally; and sends the legal remote backup destruction to the target eSIM card terminal corresponding to the legal remote backup destruction instruction. And receiving the encrypted target information sent by the target eSIM card terminal for storage, thereby realizing remote backup of data stored in the eSIM card terminal.
- the technical effect of the destruction can further solve the problem of data loss and sensitive data leakage caused by the loss of the user's eSIM card terminal, ensuring information security and reliability in the eSIM card terminal, and further expanding the eSIM card terminal.
- the device may further include: a registration module, configured to:
- the registration module may be specifically configured to: send a first operation function and a server key to the registered eSIM card terminal according to the terminal registration request sent by the registered eSIM card terminal; and receive the registration An encrypted user identifier returned by the eSIM card terminal, an encrypted user password, and a security check operator to be verified; according to the encrypted user identifier, the encrypted user password, the server key, and an agreement with the registered eSIM card terminal a standard operation rule, calculating a comparison check operator; if it is determined that the comparison check operator matches the to-be-verified security check operator, determining that the registration is successful; transmitting registration success information to the registered eSIM And a card terminal, and storing the to-be-verified security check operator as a security check operator corresponding to the registered eSIM card terminal.
- the device may further include: an identity verification module, configured to: register the registered eSIM card terminal, and after the registration is successful, store a security school corresponding to the registered eSIM card terminal. After the operator is verified, the registered eSIM card terminal that is successfully registered is authenticated, and after the identity verification succeeds, the information key corresponding to the registered eSIM card terminal is generated.
- an identity verification module configured to: register the registered eSIM card terminal, and after the registration is successful, store a security school corresponding to the registered eSIM card terminal. After the operator is verified, the registered eSIM card terminal that is successfully registered is authenticated, and after the identity verification succeeds, the information key corresponding to the registered eSIM card terminal is generated.
- the identity verification module may specifically include:
- An IMSI acquisition request sending unit configured to send an IMSI acquisition request to the registered eSIM card terminal that is successfully registered
- the encrypted IMSI receiving unit is configured to receive the encrypted IMSI returned by the registered eSIM card terminal;
- An operation function set sending unit configured to send an operation function set to the registered eSIM card terminal, where the operation function set includes: a second operation function, an encryption and decryption function pair, and a random number generation function;
- An information interaction unit configured to perform information interaction with the registered eSIM card terminal by using the operation function set, and send an identity verification check operator to the registered eSIM card terminal, so that the registered eSIM card terminal The authentication verification operator is verified;
- An information key generating unit configured to generate, according to the security check operator, the encrypted IMSI, and the standard operation rule, the identity verification success information returned by the registered eSIM card terminal The information key corresponding to the eSIM card terminal.
- the information interaction unit may be specifically configured to: receive a first random number sent by the registered eSIM card terminal; generate a second random number according to the random number generating function; And generating, by the first random number, the second random number, the encrypted IMSI, and the second operation function, a hash key to be verified; and corresponding to the registered eSIM card terminal according to the random key a security check operator and an encryption function in the pair of encryption and decryption functions, generating a message to be decrypted; using the to-be-verified hash key, the second random number, and the to-be-decrypted message as an identity verification check An operator is sent to the registered eSIM card terminal to cause the registered eSIM card terminal to verify the identity verification check operator.
- the legal instruction identification module may be specifically configured to:
- the quasi-operation rule calculates a to-be-verified operator; if it is determined that the to-be-verified operator is stored, it is determined that the to-be-verified remote backup destruction instruction is a legal remote backup destruction instruction.
- the backup destruction instruction sending module may be specifically configured to: send an online query request to the target eSIM card terminal; if it is determined that the target eSIM card terminal normally responds to the online query request, Sending the legal remote backup destruction command to the target eSIM card terminal; if it is determined that the target eSIM card terminal abnormally responds to the online query request, sending a local network connection command to the target eSIM card terminal, The legal remote backup destruction instruction is sent to the target eSIM card terminal.
- the above product can perform the method provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.
- the various modules or steps of the present invention described above can be implemented by the eSIM card terminal and server as described above.
- the embodiments of the present invention may be implemented by a program executable by a computer device, so that they may be stored in a storage device and executed by a processor, and the program may be stored in a computer readable storage medium.
- the above mentioned storage medium may be a read only memory, a magnetic disk or an optical disk, etc.; or they may be separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof may be fabricated as a single integrated circuit module.
- the invention is not limited to any specific combination of hardware and software.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Databases & Information Systems (AREA)
- Computer Security & Cryptography (AREA)
- Theoretical Computer Science (AREA)
- Health & Medical Sciences (AREA)
- Computer Hardware Design (AREA)
- General Health & Medical Sciences (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Bioethics (AREA)
- Telephone Function (AREA)
- Telephonic Communication Services (AREA)
- Storage Device Security (AREA)
Abstract
本发明实施例公开了一种终端的备份销毁方法和装置,涉及数据处理技术领域。所述方法包括:本机eSIM卡终端根据安全校验算子识别合法远程备份销毁指令;本机eSIM卡终端使用信息密钥,对设定储存空间中存储的目标信息进行信息加密;本机eSIM卡终端将加密后的目标信息发送至服务器进行备份,并删除储存空间中存储的目标信息。本发明的技术方案在eSIM卡终端与服务器之间信息交互过程中,实现了远程对eSIM卡终端中存储的数据进行备份销毁的技术效果,可以解决当用户的eSIM卡终端丢失后,带来的数据丢失和敏感数据泄密的问题,保证了eSIM卡终端中的信息安全性以及可靠性,进一步扩充了eSIM卡终端的功能。
Description
本发明实施例涉及数据处理技术,尤其涉及一种终端的备份销毁方法和装置。
为了促进移动通信设备新形态的设计与发展,加速物联网服务的开发,GSM(Global System for Mobile Communication,全球移动通信系统)协会于2010年成立了一个由全球众多电信运营商组成的工作组,研究开发可以远程激活的嵌入式SIM卡,即eSIM(embeddedSubscriber Identity Module,嵌入式用户识别模块)卡。eSIM卡的概念就是将传统SIM卡直接嵌入到设备芯片上,而不是作为独立的可移除零部件加入设备中。
随着移动互联网的高速发展,使用智能移动终端设备人群规模越来越庞大。保护智能移动终端设备数据的安全,也越发重要。特别当用户丢失了智能移动终端设备的时候,如何防止数据丢失和敏感数据泄密成为一个亟需解决的问题。
发明内容
有鉴于此,本发明实施例提供一种eSIM卡终端的备份销毁方法和装置,以实现eSIM卡终端用户对eSIM卡终端中存储的信息进行远程的备份和销毁。
第一方面,本发明实施例提供了一种终端的备份销毁方法,包括:
本机eSIM卡终端根据安全校验算子识别合法远程备份销毁指令;
所述本机eSIM卡终端使用信息密钥,对设定储存空间中存储的目标信息进行信息加密;
所述本机eSIM卡终端将加密后的所述目标信息发送至服务器进行备份,并删除所述储存空间中存储的目标信息。
第二方面,本发明实施例还提供了一种终端的备份销毁方法,包括:
服务器根据本地存储的至少一个安全校验算子,识别合法远程备份销毁指令;
所述服务器向与所述合法远程备份销毁指令对应的目标eSIM卡终端发送所述合法远程备份销毁指令,以使所述目标eSIM卡终端对设定存储空间中存储的目标信息进行备份销毁;
所述服务器接收所述目标eSIM卡终端发送的加密后的所述目标信息进行存储。
第三方面,本发明实施例提供了一种终端的备份销毁装置,应用于eSIM卡终端,包括:
合法指令识别模块,用于根据安全校验算子识别合法远程备份销毁指令;
备份信息加密模块,用于使用信息密钥,对设定储存空间中存储的目标信息进行信息加密;
备份销毁模块,用于将加密后的所述目标信息发送至服务器进行备份,并删除所述储存空间中存储的目标信息。
第四方面,本发明实施例还提供了一种终端的备份销毁装置,应用于服务器,包括:
合法指令识别模块,用于根据本地存储的至少一个安全校验算子,识别合法远程备份销毁指令;
备份销毁指令发送模块,用于向与所述合法远程备份销毁指令对应的目标eSIM卡终端发送所述合法远程备份销毁指令,以使所述目标eSIM卡终端对设定存储空间中存储的目标信息进行备份销毁;
备份信息存储模块,用于接收所述目标eSIM卡终端发送的加密后的所述目标信息进行存储。
本发明实施例的技术方案通过eSIM卡终端根据安全校验算子识别合法远程备份销毁指令;使用信息密钥,对设定储存空间中存储的目标信息进行信息加密;将加密后的所述目标信息发送至服务器进行备份,并删除所述储存空间中存储的目标信息的技术手段,在eSIM卡终端与服务器之间的信息交互过程中,实现了远程对eSIM卡终端中存储的数据进行备份销毁的技术效果,进而可以解决当用户的eSIM卡终端丢失后,带来的数据丢失和敏感数据泄密的问题,保证了eSIM卡终端中的信息安全性以及可靠性,进一步扩充了eSIM卡终端的功能。
图1为本发明实施例一提供的一种终端的备份销毁方法的流程图;
图2为本发明实施例二提供的一种终端的备份销毁方法的流程图;
图3为本发明实施例三提供的一种终端的备份销毁方法的流程图;
图4为本发明实施例四提供的一种终端的备份销毁方法的流程图;
图5为本发明实施例五提供的一种终端的备份销毁方法的流程图;
图6为本发明实施例六提供的一种终端的备份销毁方法的流程图;
图7为本发明实施例七提供的一种终端的备份销毁方法的流程图;
图8为本发明实施例八提供的一种终端的备份销毁方法的流程图;
图9为本发明实施例所适用的一种终端注册过程中的信息交互示意图;
图10为本发明实施例所适用的一种终端身份验证过程中的信息交互示意图;
图11为本发明实施例所适用的一种终端远程备份销毁过程中的信息交互示意图;
图12为本发明实施例所适用的另一种终端远程备份销毁过程中的信息交互示意图;
图13为本发明实施例九提供的一种终端的备份销毁装置的结构图;
图14为本发明实施例十提供的一种终端的备份销毁装置的结构图。
为了使本发明的目的、技术方案和优点更加清楚,下面结合附图对本发明具体实施例作进一步的详细描述。可以理解的是,此处所描述的具体实施例仅仅用于解释本发明,而非对本发明的限定。
实施例一
图1为本发明实施例一提供的一种终端的备份销毁方法的流程图,本实施例的方法一般可适用于用户通过远程控制的方式对eSIM卡终端中存储的数据进行备份销毁的情形。本实施例的方法可以由eSIM卡终端的备份销毁装置来执
行,该装置可以由软件和/或硬件的方式实现,并一般可集成于eSIM卡终端设备中,参考图1,本实施例提供的终端的备份销毁方法具体包括:
S110、本机eSIM卡终端根据安全校验算子识别合法远程备份销毁指令。
在本实施例中,为了解决现有技术中的当用户的eSIM卡终端丢失后,带来的数据丢失和敏感数据泄密的问题,提出了一种远程eSIM卡终端的备份销毁方法。一旦用户的本机eSIM卡终端丢失,用户可以通过第三方eSIM卡终端或者服务器向丢失的所述本机eSIM卡终端发送远程备份销毁指令,以实现对丢失的本机eSIM卡终端中存储的数据进行云端备份,以防止数据的丢失;以及对该本机eSIM卡终端中存储的数据进行本地销毁,以防止敏感数据的泄密。
可以理解的是,本机eSIM卡终端必须要对所接收的远程备份销毁指令的合法性进行验证,以防止恶意的备份销毁指令对本机eSIM卡终端的信息攻击。
在本实施例中,本机eSIM卡终端通过本地存储的安全校验算子识别合法远程备份销毁指令。典型的,本机eSIM卡终端可以对接收到的远程备份销毁指令中包括的验证信息(例如,本机eSIM卡终端的设备标识或者用户自定义设置的备份删除密码等)进行一定的数据处理,若数据处理结果与所述安全校验算子相符合,则确定接收到的远程备份销毁指令为合法指令。
可选的,所述安全校验算子可以在本机eSIM卡终端出厂前,预先配置于所述本机eSIM卡终端中,也可以在用户向服务器进行用户注册时,动态生成并存储于所述本机eSIM卡终端中,本实施例对此并不进行限制。
S120、所述本机eSIM卡终端使用信息密钥,对设定储存空间中存储的目标信息进行信息加密。
在本实施例中,若本机eSIM卡终端确定接收到了合法远程备份销毁指令,则需要将设定储存空间中存储的目标信息(例如,通讯录中的联系人信息、图片中的照片信息以及备忘录中存储的个人信息等)上传至服务器进行备份,其中,为了保证上传的所述目标信息的安全性,本机eSIM卡终端首先使用信息密钥,对所述目标信息进行加密。
其中,所述信息密钥可以在本机eSIM卡终端出厂前,预先配置于所述本机eSIM卡终端中,也可以在用户向服务器进行身份验证时,动态生成并存储于所述本机eSIM卡终端中,本实施例对此并不进行限制。
可以理解的是,为了使得用户能够在服务器端成功解密所述目标信息,可选的,在服务器端对应存储与所述本机eSIM卡终端对应的所述信息密钥,或者存储生成所述信息密钥的方法,以实现用户能够在服务器端顺利找回备份目标信息。
S130、所述本机eSIM卡终端将加密后的所述目标信息发送至服务器进行备份,并删除所述储存空间中存储的目标信息。
在本实施例中,所述本机eSIM卡终端在成功将加密后的所述目标信息发送至服务器进行备份后,例如,收到所述服务器发送的成功备份响应,则会对应的删除所述储存空间中存储的目标信息,以完成对本机eSIM卡终端的信息销毁。
本发明实施例的技术方案通过eSIM卡终端根据安全校验算子识别合法远程备份销毁指令;使用信息密钥,对设定储存空间中存储的目标信息进行信息加密;将加密后的所述目标信息发送至服务器进行备份,并删除所述储存空间中存储的目标信息的技术手段,在eSIM卡终端与服务器之间的信息交互过程中,实现了远程对eSIM卡终端中存储的数据进行备份销毁的技术效果,进而可
以解决当用户的eSIM卡终端丢失后,带来的数据丢失和敏感数据泄密的问题,保证了eSIM卡终端中的信息安全性以及可靠性,进一步扩充了eSIM卡终端的功能。
实施例二
图2为本发明实施例二提供的一种终端的备份销毁方法的流程图,本实施例以上述实施例为基础进行优化。参考图2,本实施例的方法具体包括:
S210、所述本机eSIM卡终端向所述服务器发送注册请求。
在本实施例中,在所述本机eSIM卡终端向所述服务器进行成功注册后,生成所述安全校验算子。
S220、所述本机eSIM卡终端接收所述服务器返回的第一运算函数以及服务器密钥。
在本实施例中,所述第一运算函数优选可以为哈希函数,或者散列函数,Hash(*)。服务器通过将服务器密钥发给注册的本机eSIM卡终端的方式,可以对合法的注册终端进行验证。
典型的,为了防止密钥的泄露,所述服务器密钥也可以在经过哈希函数进行处理后,发送至所述本机eSIM卡终端。
S230、所述本机eSIM卡终端将用户输入的用户标识以及用户密码通过所述第一运算函数进行运算,生成加密用户标识以及加密用户密码。
在本实施例中,一个eSIM卡终端的用户为了向服务器进行注册,需要预先输入与eSIM卡终端对应的用户标识以及用户密码。
在本实施例中,为了防止服务器端的内部攻击者获取该用户标识以及用户密码,本机eSIM卡终端使用服务器发送的第一运算函数对所述用户标识以及用户密码进行加密后,再发送至所述服务器。
S240、所述本机eSIM卡终端根据所述加密用户标识、所述加密用户密码、所述服务器密钥,以及与所述服务器约定的标准运算规则,计算所述安全校验算子。
在本实施例中,所述标准运算规则可以为“异或运算”或者“同或运算”等与所述服务器预先约定好的运算规则,本实施例对此并不进行限制。
在本实施例的一个优选的实施方式中,安全校验算子HRSKu的计算公式可以为:HRSKu=HID⊕HUK⊕Hash(RSK);
其中,HID为用户标识经过哈希函数处理后生成的加密用户标识;HUK为用户密码经过哈希函数处理后生成的加密用户密码;Hash(RSK)为服务器密钥;⊕为异或运算符。
S250、所述本机eSIM卡终端将所述加密用户标识、所述加密用户密码以及所述安全校验算子发送至所述服务器,以使所述服务器完成对所述安全校验算子的验证。
在本实施例中,服务器端根据本地存储的服务器密钥,接收到的所述加密用户标识、所述加密用户密码,以及与所述本机eSIM卡终端预先预定的所述标准运算规则本地生成比对校验算子,若所述比对校验算子与接收到的所述安全校验算子相匹配,则确定通过注册成功;若所述比对校验算子与接收到的所述安全校验算子不相匹配,则确定通过注册失败。
S260、所述本机eSIM卡终端判断是否接收到所述服务器返回的注册成功信息:若是,执行S270;否则,确定注册失败。
S270、所述本机eSIM卡终端对所述安全校验算子进行存储。
S280、所述本机eSIM卡终端根据安全校验算子识别合法远程备份销毁指令。
S290、所述本机eSIM卡终端使用信息密钥,对设定储存空间中存储的目标信息进行信息加密。
S2100、所述本机eSIM卡终端将加密后的所述目标信息发送至服务器进行备份,并删除所述储存空间中存储的目标信息。
本实施例的技术方案为了进一步加强eSIM卡终端远程备份销毁方法的安全性,增加了eSIM卡终端向所述服务器进行注册的操作,并只会在注册成功的eSIM卡终端中存储用于识别远程备份销毁指令的合法安全校验算子,进一步保证了eSIM卡终端中的信息安全性以及可靠性。
实施例三
图3为本发明实施例三提供的一种终端的备份销毁方法的流程图,本实施例以上述实施例为基础进行优化。参考图3,本实施例的方法具体包括:
S310、本机eSIM卡终端向所述服务器进行注册,并在注册成功后,存储在注册过程中生成的所述安全校验算子。
S320、所述本机eSIM卡终端根据所述服务器发送的IMSI获取请求,将所述IMSI通过所述第一运算函数生成加密IMSI后,发送至所述服务器。
IMSI(International Mobile Subscriber Identification Number,国际移动用户识别码)是用来唯一区分不同eSIM卡终端的标识信息。在本实施例中,服务器根据不同eSIM卡终端的IMSI,对完成注册的eSIM卡终端进行身份验证。只有
本机eSIM卡终端确定通过身份验证后,才会生成用于对本机eSIM卡终端中存储的数据进行加密的信息密钥,以进一步提高备份销毁方法的安全性。
S330、所述本机eSIM卡终端接收所述服务器返回的操作函数集。
其中,所述操作函数集包括:第二运算函数、加密解密函数对以及随机数生成函数。
可选的,所述第二运算函数可以为密钥相关的哈希运算函数,该函数可以表示为HMAC(key,message),其运算利用哈希算法,以一个密钥key和一个消息message为输入,生成一个消息摘要作为输出。
所述加密解密函数对优选可以为基于AES(Advanced Encryption Standard,高级加密标准)的加密函数,以及解密函数。
其中,所述加密函数可以表示为AES-enc(message,key),其表示使用私钥key对消息message进行对称加密操作;
所述解密函数可以表示为AES-dec(message,key),其表示使用私钥key对消息message进行对称解密操作函数。
所述随机数生成函数具体可以为用于生成设定数值范围内的随机数(例如,0~100)的函数。
S340、所述本机eSIM卡终端使用所述操作函数集与所述服务器进行信息交互,并对所述服务器返回的身份验证校验算子进行验证。
在本实施例的一个优选的实施方式中,所述本机eSIM卡终端使用所述操作函数集与所述服务器进行信息交互,并对所述服务器返回的身份验证校验算子进行验证可以包括:
所述本机eSIM卡终端使用所述随机数生成函数生成第一随机数,并将所述第一随机数发送至所述服务器;
所述本机eSIM卡终端接收所述服务器返回的身份验证校验算子;其中,所述身份验证校验算子包括:待验证哈希密钥、第二随机数以及待解密消息;
所述本机eSIM卡终端使用所述加密解密函数对中的解密函数对所述待解密消息进行解密,获取所述待解密消息中包括的随机密钥;
所述本机eSIM卡终端根据所述随机密钥、所述第一随机数、所述第二随机数、所述加密IMSI,以及所述第二运算函数,生成比对哈希密钥;
所述本机eSIM卡终端若确定所述比对哈希密钥与所述待验证哈希密钥相匹配,则确定所述身份验证校验算子通过验证;
所述本机eSIM卡终端向所述服务器发送身份认证成功信息。
S350、所述本机eSIM卡终端确定所述身份验证校验算子是否通过验证:若是,执行S360;否则,确定身份验证失败。
S360、所述本机eSIM卡终端根据所述安全校验算子、所述加密IMSI以及所述标准运算规则,生成所述信息密钥。
S370、所述本机eSIM卡终端根据安全校验算子识别合法远程备份销毁指令。
S380、所述本机eSIM卡终端使用信息密钥,对设定储存空间中存储的目标信息进行信息加密。
S390、所述本机eSIM卡终端将加密后的所述目标信息发送至服务器进行备份,并删除所述储存空间中存储的目标信息。
本实施例的技术方案为了进一步加强eSIM卡终端远程备份销毁方法的安全性,增加了eSIM卡终端向所述服务器进行身份验证的操作,并只会在身份验
证成功的eSIM卡终端中生成用于对eSIM卡终端中存储的数据进行加密的信息密钥,进一步保证了eSIM卡终端中的信息安全性以及可靠性。
实施例四
图4为本发明实施例四提供的一种终端的备份销毁方法的流程图,本实施例以上述实施例为基础进行优化。参考图4,本实施例的方法具体包括:
S410、本机eSIM卡终端向所述服务器进行注册,并在注册成功后,存储在注册过程中生成的所述安全校验算子。
S420、所述本机eSIM卡终端向所述服务器进行身份验证,并在身份验证成功后,生成所述信息密钥。
S430、所述本机eSIM卡终端对接收到的信息进行识别:若确定接收到的为服务器发送的远程备份销毁指令,则执行S440;若确定接收到的为第三方eSIM卡终端发送的远程备份销毁短信,则执行S450。
在本实施例中,若本机eSIM卡终端接收到服务器发送的远程备份销毁指令,则直接将该指令识别为合法远程备份销毁指令;若本机eSIM卡终端接收到第三方eSIM卡终端发送的远程备份销毁短信,则需要使用安全校验算子对所述远程备份销毁短信的合法性进行识别。
这样设置的原因是主要考虑到两种实际的远程备份销毁方法的使用场景:一是用户使用第三方eSIM卡终端向服务器发送对目标eSIM卡(典型的,被盗的或者说需要进行信息备份删除的所述本机eSIM卡)终端的远程备份销毁短信,由服务器端对该远程备份销毁短信的合法性进行识别,并在识别通过后,由服务器直接控制所述目标eSIM卡终端完成相应的备份销毁操作;另一种是用户使用第三方eSIM卡终端直接向目标eSIM卡终端发送远程备份销毁短信,由目标
eSIM卡终端识别该远程备份销毁短信的合法性,并在识别通过后,直接由目标eSIM卡终端完成相应的备份销毁操作。
其中,所述远程备份销毁短信包括:待验证用户标识、待验证用户密码以及待验证远程备份销毁指令。
S440、所述本机eSIM卡终端直接将所述远程备份销毁指令识别为合法远程备份销毁指令,执行S480。
S450、所述本机eSIM卡终端根据所述待验证用户标识、所述待验证用户密码、所述服务器密钥以及所述标准运算规则,计算待验证算子。
若通过所述待验证用户标识、所述待验证用户密码、所述服务器密钥以及所述标准运算规则,计算待验证算子计算得到的待验证算子与所述安全校验算子相匹配,则说明所述待验证用户标识与实际的用户标识相一致,所述待验证用户密码与实际的用户密码相一致,因此,可以确定该待验证远程备份销毁指令为合法远程备份销毁指令。
S460、所述本机eSIM卡终端确定所述待验证算子是否与所述安全校验算子相匹配:若是,执行S470;否则,返回执行S430。
S470、所述本机eSIM卡终端确定所述待验证远程备份销毁指令为合法远程备份销毁指令,执行S480。
S480、所述本机eSIM卡终端使用信息密钥,对设定储存空间中存储的目标信息进行信息加密。
S490、所述本机eSIM卡终端将加密后的所述目标信息发送至服务器进行备份,并删除所述储存空间中存储的目标信息。
本实施例的技术方案的eSIM卡终端在对接收到的信息进行识别时,若确定接收到的信息为服务器发送的远程备份销毁指令,则直接将该远程备份销毁指令识别为安全远程备份销毁指令;若确定接收到的信息为第三方eSIM卡终端发送的远程备份销毁短信,则需要本地对该远程备份销毁短信的合法性进行验证,识别出对应的安全远程备份销毁指令,通过设置两种不同的安全远程备份销毁指令识别机制,可以在针对服务器或者第三方eSIM卡终端发起的备份销毁时,采取不同的处理机制正确响应备份销毁操作,进一步完善了本发明的技术方案,保证了eSIM卡终端中的信息安全性以及可靠性。
在上述各实施例的基础上,所述本机eSIM卡终端将加密后的所述目标信息发送至服务器进行备份之前,还可以包括:所述本机eSIM卡终端若接收到所述服务器发送的打开本地网络连接指令,则打开本地网络连接;或者所述本机eSIM卡终端若确定自身当前未连接网络,则打开本地网络连接。
这样设置的好处是:考虑到用户的本机eSIM卡终端一旦发生丢失,其有很大的可能性会被人恶意关机或者断网,这样本机eSIM卡终端则无法将加密后的所述目标信息发送至服务器进行备份,在本优选实施方式中,服务器端或者需要进行信息备份删除的目标eSIM卡终端在识别出安全远程备份销毁指令后,若确定当前无法连接网络,则会通过一定的机制打开eSIM卡终端的本地网络连接,以实现对加密后的所述目标信息的成功备份。
实施例五
图5为本发明实施例五提供的一种终端的备份销毁方法的流程图,本实施例的方法一般可适用于用户通过远程控制的方式对eSIM卡终端中存储的数据进行备份销毁的情形。本实施例的方法可以由eSIM卡终端的备份销毁装置来执
行,该装置可以由软件和/或硬件的方式实现,并一般可集成于服务器中,参考图5,本实施例提供的eSIM卡终端的备份销毁方法具体包括:
S510、服务器根据本地存储的至少一个安全校验算子,识别合法远程备份销毁指令。
在本实施例中,在服务器中针对不同的eSIM卡终端,存储不同的安全校验算子,以识别合法远程备份销毁指令,以及所述合法远程备份销毁指令所需要控制的目标eSIM卡终端。
其中,所述安全校验算子可以是服务器在与eSIM卡终端建立安全的网络连接后,由所述eSIM卡终端发送给所述服务器的,也可以是eSIM卡终端在向服务器进行注册过程中动态生成的,本实施例对此并不进行限制。
S520、所述服务器向与所述合法远程备份销毁指令对应的目标eSIM卡终端发送所述合法远程备份销毁指令,以使所述目标eSIM卡终端对设定存储空间中存储的目标信息进行备份销毁。
S530、所述服务器接收所述目标eSIM卡终端发送的加密后的所述目标信息进行存储。
本发明实施例的技术方案的服务器根据本地存储的至少一个安全校验算子,识别合法远程备份销毁指令;向与所述合法远程备份销毁指令对应的目标eSIM卡终端发送所述合法远程备份销毁指令;接收所述目标eSIM卡终端发送的加密后的所述目标信息进行存储,实现了远程对eSIM卡终端中存储的数据进行备份销毁的技术效果,进而可以解决当用户的eSIM卡终端丢失后,带来的数据丢失和敏感数据泄密的问题,保证了eSIM卡终端中的信息安全性以及可靠性,进一步扩充了eSIM卡终端的功能。
实施例六
图6为本发明实施例六提供的一种终端的备份销毁方法的流程图,本实施例以上述实施例为基础进行优化。其中,本实施例的技术方案与实施例二中的技术方案相对应。参考图6,本实施例的方法具体包括:
S610、所述服务器根据注册eSIM卡终端发送的终端注册请求,向所述注册eSIM卡终端发送第一运算函数以及服务器密钥。
S620、所述服务器接收所述注册eSIM卡终端返回的加密用户标识、加密用户密码以及待验证安全校验算子。
S630、所述服务器根据所述加密用户标识、所述加密用户密码、所述服务器密钥,以及与所述注册eSIM卡终端约定的标准运算规则,计算比对校验算子。
S640、所述服务器确定所述比对校验算子是否与所述待验证安全校验算子相匹配:若是,执行S650、否则,确定注册失败。
S650、所述服务器将注册成功信息发送至所述注册eSIM卡终端,并将所述待验证安全校验算子作为与所述注册eSIM卡终端对应的安全校验算子进行存储。
S660、服务器根据本地存储的至少一个安全校验算子,识别合法远程备份销毁指令。
S670、所述服务器向与所述合法远程备份销毁指令对应的目标eSIM卡终端发送所述合法远程备份销毁指令,以使所述目标eSIM卡终端对设定存储空间中存储的目标信息进行备份销毁。
S680、所述服务器接收所述目标eSIM卡终端发送的加密后的所述目标信息进行存储。
本实施例的技术方案为了进一步加强eSIM卡终端远程备份销毁方法的安全性,增加了服务器对eSIM卡终端进行注册的操作,并只会在服务器端存储与注册成功的eSIM卡终端对应的安全校验算子,进一步保证了eSIM卡终端中的信息安全性以及可靠性。
实施例七
图7为本发明实施例七提供的一种终端的备份销毁方法的流程图,本实施例以上述实施例为基础进行优化。其中,本实施例的技术方案与实施例三的技术方案相对应。参考图3,本实施例的方法具体包括:
S710、所述服务器对注册eSIM卡终端进行注册,并在注册成功后,存储与所述注册eSIM卡终端对应的安全校验算子。
S720、所述服务器向注册成功的注册eSIM卡终端发送IMSI获取请求。
S730、所述服务器接收所述注册eSIM卡终端返回的加密IMSI。
S740、所述服务器向所述注册eSIM卡终端发送操作函数集。
其中,所述操作函数集包括:第二运算函数、加密解密函数对以及随机数生成函数;
S750、所述服务器使用所述操作函数集与所述注册eSIM卡终端进行信息交互,并向所述注册eSIM卡终端发送身份验证校验算子,以使所述注册eSIM卡终端对所述身份验证校验算子进行验证。
在本实施例的一个优选的实施方式中,所述服务器使用所述操作函数集与所述注册eSIM卡终端进行信息交互,并向所述注册eSIM卡终端发送身份验证校验算子可以包括:
所述服务器接收所述注册eSIM卡终端发送的第一随机数;
所述服务器根据所述随机数生成函数生成第二随机数;
所述服务器根据随机密钥、所述第一随机数、所述第二随机数、所述加密IMSI以及所述第二运算函数,生成待验证哈希密钥;
所述服务器根据所述随机密钥、与所述注册eSIM卡终端对应的安全校验算子以及所述加密解密函数对中的加密函数,生成待解密消息;
所述服务器将所述待验证哈希密钥、所述第二随机数以及所述待解密消息作为身份验证校验算子发送至所述注册eSIM卡终端,以使所述注册eSIM卡终端对所述身份验证校验算子进行验证。
S760、所述服务器判断是否接收到所述注册eSIM卡终端返回的身份认证成功信息:若是,执行S770;否则,确定身份认证失败。
S770、所述服务器根据所述安全校验算子、所述加密IMSI以及所述标准运算规则,生成与所述注册eSIM卡终端对应的信息密钥。
S780、所述服务器根据本地存储的至少一个安全校验算子,识别合法远程备份销毁指令。
S790、所述服务器向与所述合法远程备份销毁指令对应的目标eSIM卡终端发送所述合法远程备份销毁指令,以使所述目标eSIM卡终端对设定存储空间中存储的目标信息进行备份销毁。
S7100、所述服务器接收所述目标eSIM卡终端发送的加密后的所述目标信息进行存储存储。
本实施例的技术方案为了进一步加强eSIM卡终端远程备份销毁方法的安全性,增加了服务器对eSIM卡终端进行身份验证的操作,进一步保证了eSIM卡终端中的信息安全性以及可靠性。
实施例八
图8为本发明实施例八提供的一种终端的备份销毁方法的流程图,本实施例以上述实施例为基础进行优化。其中,本实施例的技术方案与实施例四的技术方案相对应。参考图8,本实施例的方法具体包括:
S810、所述服务器对注册eSIM卡终端进行注册,并在注册成功后,存储与所述注册eSIM卡终端对应的安全校验算子。
S820、所述服务器对注册成功的所述注册eSIM卡终端进行身份验证,并在身份验证成功后,生成与所述注册eSIM卡终端对应的所述信息密钥。
S830、所述服务器接收第三方eSIM卡终端发送的远程备份销毁短信。
其中,所述远程备份销毁短信包括:待验证用户标识、待验证用户密码以及待验证远程备份销毁指令;
S840、所述服务器根据所述待验证用户标识、所述待验证用户密码、所述服务器密钥以及所述标准运算规则,计算待验证算子;
S850、所述服务器确定是否存储有所述待验证算子:若是,执行S860;否则,返回执行S830。
S860、确定所述待验证远程备份销毁指令为合法远程备份销毁指令。
S870、所述服务器向与所述合法远程备份销毁指令对应的目标eSIM卡终端发送在线查询请求。
S880、所述服务器判断所述目标eSIM卡终端是否正常响应所述在线查询请求:若是,执行S890;否则,执行S8100。
S890、将所述合法远程备份销毁指令发送至所述目标eSIM卡终端;
S8100、向所述目标eSIM卡终端发送打开本地网络连接指令后,将所述合法远程备份销毁指令发送至所述目标eSIM卡终端。
S8110、所述服务器接收所述目标eSIM卡终端发送的加密后的所述目标信息进行存储。
本实施例的技术方案实现了远程对eSIM卡终端中存储的数据进行备份销毁的技术效果,进而可以解决当用户的eSIM卡终端丢失后,带来的数据丢失和敏感数据泄密的问题,保证了eSIM卡终端中的信息安全性以及可靠性,进一步扩充了eSIM卡终端的功能。
在了更加清楚、明白的描述本发明的技术方案,将本发明各实施例的具体应用场景进行简单介绍。
其中,在图9中示出了本发明实施例所适用的一种终端注册过程中的信息交互示意图,其中,信息交互的双方为eSIM卡终端和服务器。
在注册过程中:当eSIM卡终端申请加入服务器时,eSIM卡终端会自动向服务器发送注册请求,用户需要输入一个用户标识(ID)和对应的用户密钥(UK)。然后服务器会发送第一运算函数Hash(*)和服务器密钥Hash(RSK)给eSIM卡终端,eSIM卡终端使用Hash(*)计算出加密用户标识HID、加密用户密钥HUK和安全校验算子HRSKu发送给服务器,服务器接收到用户的HID、HUK和HRSKu后,计算出相应的比对校验算子HRSKr并判断HRSKr是否等于HRSKu,若两者相等,就表示eSIM卡注册成功,否则注册失败。如图9所示,其详细步骤具体包括:
步骤1:eSIM卡终端向服务器发送注册请求命令,并让用户输入一个用户ID和对应的用户密钥UK;
步骤2:服务器响应用户的注册请求,并发送哈希函数Hash(*)和Hash(RSK)给eSIM卡终端;
步骤3:eSIM卡终端使用哈希函数Hash(*)计算出HID=Hash(ID)、HUK=Hash(UK)和HRSKu=HID⊕HUK⊕Hash(RSK),并发送给服务器;
步骤4:服务器接收到用户的HID、HUK和HRSKu后,计算出HRSKr=HID⊕HUK⊕Hash(RSK),并判断HRSKr是否等于HRSKu,若两者相等,则表示eSIM卡注册成功,否则注册失败;
步骤5:服务器会向eSIM卡终端发送注册成功或失败消息。
在图10中示出了本发明实施例所适用的一种终端身份验证过程中的信息交互示意图,其中,信息交互的双方为eSIM卡终端和服务器。
在身份认证过程:服务器会向eSIM卡终端发送请求获取eSIM卡的IMSI的命令。eSIM卡终端响应服务器请求,使用第一运算函数Hash(*)计算出与IMSI对应的加密IMSI,即:HMSI,并把HMSI发送给服务器。然后,服务器将与密钥相关的哈希运算、AES加解密算法和产生随机数算法发送给eSIM卡终端。之后,服务器将计算出HKr发送给eSIM卡终端。最后eSIM卡终端解密和计算出HKu,并判断HKu是否等于HKr,若两者相等,则验证eSIM卡是合法身份,并生成信息密钥SKT,否则结束该过程。如图9所示,其详细步骤具体包括:
步骤1:当eSIM卡终端成功注册一个账号后,服务器会向eSIM卡终端发送请求获取eSIM卡的IMSI命令;
步骤2:eSIM卡终端响应服务器请求,并使用哈希函数Hash(*)计算出HMSI=Hash(IMSI),并把HMSI发送给服务器;
步骤3:服务器获得eSIM卡HMSI,将密钥相关的哈希运算HMAC(*,*)、
AES加解密算法和产生随机数算法发送给eSIM卡终端;
步骤4:eSIM卡终端使用产生随机数算法生成一个随机数RN0,并发送给服务器;
步骤5:服务器也生成随机数RN1和随机密钥KR,并使用密钥相关的哈希运算函数HMAC(key,message)计算出待验证哈希密钥HKr=HMAC(KR,RN0⊕HMSI⊕RN1);使用对称加密函数AES-enc(message,key)和服务器端存储的安全校验算子HRSKr计算出待解密消息SKR=AES-enc(KR,HRSKr),最后将HKr、RN1和SKR发送给eSIM卡终端;
步骤6:eSIM卡终端使用对称解密函数AES-dec(message,key)和eSIM卡终端的安全校验算子HRSKu解密出KR=AES-dec(SKR,HRSKu);使用密钥相关的哈希运算函数HMAC(key,message)计算出HKu=HMAC(KR,RN0⊕HMSI⊕RN1),最后判断HKu是否等于HKr,若相等,就验证eSIM卡是合法身份,并生成信息密钥SKT=HRSKr⊕HMSI,否则结束该步骤;
步骤7:若步骤6成立,eSIM卡终端就会向服务器发送身份认证成功消息,否则发送身份认证失败消息,并结束该流程。
图11为本发明实施例所适用的一种终端远程备份销毁过程中的信息交互示意图;其中,信息交互的三方为第三方eSIM卡终端、服务器和eSIM卡终端。图11主要示出了通过服务器方式安全备份与销毁终端数据的过程。其具体步骤包括:
步骤1:在第三方eSIM卡终端j输入eSIM卡终端i(即丢失的终端)的IDi和UKi,且使用eSIM卡终端j的哈希函数生成HIDi和HUKi,并将HIDi、HUKi和备份与删除命令发送给服务器。其中,第三方eSIM卡终端j也预先在服务器
中进行了注册;
步骤2:服务器计算出HRSKi=HIDi⊕HBKi⊕Hash(RSK),并在服务器数据库中查找与HRSKi相等的终端,若找到该终端i,就解析和执行终端j发过来的命令;若没有找到,提示第三方eSIM卡终端j没有找到该终端i;
步骤3:在步骤2服务器找到终端i的情况下,服务器向终端i发送检测终端i是否在线命令,并等待终端i响应;
步骤4:若终端i正常响应,就表示此时终端i网络是正常的;若终端i无响应或响应超时,就表示终端i没有连接网络,服务器需要向终端i发送打开终端i网络连接的短信;
步骤5:在步骤4终端i网络正常的情况下,服务器向终端i发送数据备份和删除命令;
步骤6:终端i响应服务器的数据备份和删除命令,并对终端i的重要信息M使用对称加密函数AES-enc(message,key)和eSIM卡终端i的信息密钥SKT计算出加密备份文件KM=AES-dec(M,SKT),当终端i加密完成后,将加密数据备份到用户的云端,并删除本地的重要信息;
步骤7:终端i将备份和删除成功消息通知给服务器,服务器在通知给终端j。
图12为本发明实施例所适用的一种终端远程备份销毁过程中的信息交互示意图;其中,信息交互的三方为第三方eSIM卡终端、服务器和eSIM卡。图12主要示出了通过第三方eSIM卡终端短信的方式实现的安全备份与销毁终端数据的过程。其具体步骤包括:
步骤1:在eSIM卡终端j输入eSIM卡终端i(即丢失的终端)的IDi和UKi,
且使用eSIM卡终端j的哈希函数生成HIDi和HUKi,对终端i发送数据备份与删除命令短信。短信内容为HIDi、HUKi和备份与删除命令;
步骤2:终端i收到该短信后,计算出HRSKi=HIDi⊕HBKi⊕Hash(RSK),判断HRSKu是否等于HRSKi,并删除该短信,若相等,该短信是有效的,打开网络连接服务器,否则该短信是无效的;
步骤3:终端i向服务器发送连接服务器请求;
步骤4:服务器响应该请求,连接服务器成功与否都会通知终端j;
步骤5:在步骤4成功连接服务器后,终端i响应短信的数据备份和删除命令,并对终端i的重要信息M使用对称加密函数AES-enc(message,key)和eSIM卡终端i的信息密钥SKT计算出加密备份文件KM=AES-dec(M,SKT),当终端i加密完成后,将加密数据安全备份到用户的云端,并删除本地的重要信息;
步骤6:终端i将安全备份和销毁成功消息通知给服务器,服务器再通知给终端j。
对本发明实施例方法的安全性进行分析:
在本发明实施例的注册阶段,用户是发送用户的HUID和HUK给服务器,而不是直接发送用户密码UK给服务器。所以当服务器中存在内部攻击者,其也无法获取用户密码UK,保证用户密码信息的安全性;
在本发明实施例的方法中,认证eSIM卡终端身份合法性,是通过随机数RN0、RN1以及HMSI码来计算HMAC值(作为验证码),将其放入消息中,eSIM卡终端通过验证消息的HMAC值来判断信息的正确性,从而动态验证eSIM卡终端身份合法性,保证eSIM卡终端是安全的;
在本发明实施例的方法中,当eSIM卡终端身份合法性通过验证后,才会生
成信息密钥,该信息密钥不会上传到服务器,只存储在eSIM卡的安全存储区域中,从而保证备份在云端中的信息的安全性。
实施例九
图13为本发明实施例九提供的一种终端的备份销毁装置的结构示意图。参考图13,本实施例提供的eSIM卡终端的备份销毁装置,应用于eSIM卡终端,所述装置具体可以包括:合法指令识别模块131、备份信息加密模块132以及备份销毁模块133,其中:
合法指令识别模块131,用于根据安全校验算子识别合法远程备份销毁指令。
备份信息加密模块132,用于使用信息密钥,对设定储存空间中存储的目标信息进行信息加密。
备份销毁模块133,用于将加密后的所述目标信息发送至服务器进行备份,并删除所述储存空间中存储的目标信息。
本发明实施例的技术方案通过eSIM卡终端根据安全校验算子识别合法远程备份销毁指令;使用信息密钥,对设定储存空间中存储的目标信息进行信息加密;将加密后的所述目标信息发送至服务器进行备份,并删除所述储存空间中存储的目标信息的技术手段,在eSIM卡终端与服务器之间的信息交互过程中,实现了远程对eSIM卡终端中存储的数据进行备份销毁的技术效果,进而可以解决当用户的eSIM卡终端丢失后,带来的数据丢失和敏感数据泄密的问题,保证了eSIM卡终端中的信息安全性以及可靠性,进一步扩充了eSIM卡终端的功能。
在上述各实施例的基础上,所述装置还可以包括,注册模块,用于:
在根据安全校验算子识别合法远程备份销毁指令之前,向所述服务器进行注册,并在注册成功后,存储在注册过程中生成的所述安全校验算子。
在上述各实施例的基础上,所述注册模块具体可以用于:
向所述服务器发送终端注册请求;接收所述服务器返回的第一运算函数以及服务器密钥;将用户输入的用户标识以及用户密码通过所述第一运算函数进行运算,生成加密用户标识以及加密用户密码;根据所述加密用户标识、所述加密用户密码、所述服务器密钥,以及与所述服务器约定的标准运算规则,计算所述安全校验算子;将所述加密用户标识、所述加密用户密码以及所述安全校验算子发送至所述服务器,以使所述服务器完成对所述安全校验算子的验证;若接收到所述服务器返回的注册成功信息,则对所述安全校验算子进行存储。
在上述各实施例的基础上,所述装置还可以包括,身份验证模块,用于:在向所述服务器进行注册,并在注册成功后,存储在注册过程中生成的所述安全校验算子之后,向所述服务器进行身份验证,并在身份验证成功后,生成所述信息密钥。
在上述各实施例的基础上,所述身份验证模块具体可以包括:
加密IMSI发送单元,用于根据所述服务器发送的IMSI获取请求,将所述IMSI通过所述第一运算函数生成加密IMSI后,发送至所述服务器;
操作函数集接收单元,用于接收所述服务器返回的操作函数集,其中,所述操作函数集包括:第二运算函数、加密解密函数对以及随机数生成函数;
信息交互单元,用于使用所述操作函数集与所述服务器进行信息交互,并对所述服务器返回的身份验证校验算子进行验证;
验证成功确定单元,用于若确定所述身份验证校验算子通过验证,则确定身份验证成功;
信息密钥生成单元,用于根据所述安全校验算子、所述加密IMSI以及所述标准运算规则,生成所述信息密钥。
在上述各实施例的基础上,信息交互单元具体可以用于:
使用所述随机数生成函数生成第一随机数,并将所述第一随机数发送至所述服务器;接收所述服务器返回的身份验证校验算子;其中,所述身份验证校验算子包括:待验证哈希密钥、第二随机数以及待解密消息;使用所述加密解密函数对中的解密函数对所述待解密消息进行解密,获取所述待解密消息中包括的随机密钥;根据所述随机密钥、所述第一随机数、所述第二随机数、所述加密IMSI,以及所述第二运算函数,生成比对哈希密钥;若确定所述比对哈希密钥与所述待验证哈希密钥相匹配,则确定所述身份验证校验算子通过验证;向所述服务器发送身份认证成功信息。
在上述各实施例的基础上,合法指令识别模块具体用于:
接收第三方eSIM卡终端发送的远程备份销毁短信,其中,所述远程备份销毁短信包括:待验证用户标识、待验证用户密码以及待验证远程备份销毁指令;根据所述待验证用户标识、所述待验证用户密码、所述服务器密钥以及所述标准运算规则,计算待验证算子;若确定所述待验证算子与所述安全校验算子相匹配,则确定所述待验证远程备份销毁指令为合法远程备份销毁指令。
在上述各实施例的基础上,合法指令识别模块具体还用于:若接收到所述服务器发送的远程备份销毁指令,则直接将所述远程备份销毁指令识别为合法远程备份销毁指令。
在上述各实施例的基础上,所述装置还可以包括:网络连接单元,用于:
在将加密后的所述目标信息发送至服务器进行备份之前,若接收到所述服务器发送的打开本地网络连接指令,则打开本地网络连接;或者若确定自身当前未连接网络,则打开本地网络连接。
上述产品可执行本发明任意实施例所提供的方法,具备执行方法相应的功能模块和有益效果。
实施例十
图14为本发明实施例十提供的一种终端的备份销毁装置的结构示意图。参考图14,本实施例提供的终端的备份销毁装置,应用于服务器,所述装置具体可以包括:合法指令识别模块141、备份销毁指令发送模块142以及备份信息存储模块143,其中:
合法指令识别模块141,用于根据本地存储的至少一个安全校验算子,识别合法远程备份销毁指令。
备份销毁指令发送模块142,用于向与所述合法远程备份销毁指令对应的目标eSIM卡终端发送所述合法远程备份销毁指令,以使所述目标eSIM卡终端对设定存储空间中存储的目标信息进行备份销毁。
备份信息存储模块143,用于接收所述目标eSIM卡终端发送的加密后的所述目标信息进行存储存储。
本发明实施例的技术方案的服务器根据本地存储的至少一个安全校验算子,识别合法远程备份销毁指令;向与所述合法远程备份销毁指令对应的目标eSIM卡终端发送所述合法远程备份销毁指令;接收所述目标eSIM卡终端发送的加密后的所述目标信息进行存储,实现了远程对eSIM卡终端中存储的数据进行备份
销毁的技术效果,进而可以解决当用户的eSIM卡终端丢失后,带来的数据丢失和敏感数据泄密的问题,保证了eSIM卡终端中的信息安全性以及可靠性,进一步扩充了eSIM卡终端的功能。
在上述各实施例的基础上,所述装置还可以包括:注册模块,用于:
在根据本地存储的至少一个安全校验算子,识别合法远程备份销毁指令之前对注册eSIM卡终端进行注册,并在注册成功后,存储与所述注册eSIM卡终端对应的安全校验算子。
在上述各实施例的基础上,所述注册模块具体可以用于:根据注册eSIM卡终端发送的终端注册请求,向所述注册eSIM卡终端发送第一运算函数以及服务器密钥;接收所述注册eSIM卡终端返回的加密用户标识、加密用户密码以及待验证安全校验算子;根据所述加密用户标识、所述加密用户密码、所述服务器密钥,以及与所述注册eSIM卡终端约定的标准运算规则,计算比对校验算子;若确定所述比对校验算子与所述待验证安全校验算子相匹配,则确定注册成功;将注册成功信息发送至所述注册eSIM卡终端,并将所述待验证安全校验算子作为与所述注册eSIM卡终端对应的安全校验算子进行存储。
在上述各实施例的基础上,所述装置还可以包括:身份验证模块,用于:在对注册eSIM卡终端进行注册,并在注册成功后,存储与所述注册eSIM卡终端对应的安全校验算子之后,对注册成功的所述注册eSIM卡终端进行身份验证,并在身份验证成功后,生成与所述注册eSIM卡终端对应的所述信息密钥。
在上述各实施例的基础上,所述身份验证模块可以具体包括:
IMSI获取请求发送单元,用于向注册成功的注册eSIM卡终端发送IMSI获取请求;
加密IMSI接收单元,用于接收所述注册eSIM卡终端返回的加密IMSI;
操作函数集发送单元,用于向所述注册eSIM卡终端发送操作函数集,其中,所述操作函数集包括:第二运算函数、加密解密函数对以及随机数生成函数;
信息交互单元,用于使用所述操作函数集与所述注册eSIM卡终端进行信息交互,并向所述注册eSIM卡终端发送身份验证校验算子,以使所述注册eSIM卡终端对所述身份验证校验算子进行验证;
信息密钥生成单元,用于若接收到所述注册eSIM卡终端返回的身份认证成功信息,则根据所述安全校验算子、所述加密IMSI以及所述标准运算规则,生成与所述注册eSIM卡终端对应的信息密钥。
在上述各实施例的基础上,所述信息交互单元具体可以用于:接收所述注册eSIM卡终端发送的第一随机数;根据所述随机数生成函数生成第二随机数;根据随机密钥、所述第一随机数、所述第二随机数、所述加密IMSI以及所述第二运算函数,生成待验证哈希密钥;根据所述随机密钥、与所述注册eSIM卡终端对应的安全校验算子以及所述加密解密函数对中的加密函数,生成待解密消息;将所述待验证哈希密钥、所述第二随机数以及所述待解密消息作为身份验证校验算子发送至所述注册eSIM卡终端,以使所述注册eSIM卡终端对所述身份验证校验算子进行验证。
在上述各实施例的基础上,合法指令识别模块具体可以用于:
接收第三方eSIM卡终端发送的远程备份销毁短信,其中,所述远程备份销毁短信包括:待验证用户标识、待验证用户密码以及待验证远程备份销毁指令;根据所述待验证用户标识、所述待验证用户密码、所述服务器密钥以及所述标
准运算规则,计算待验证算子;若确定存储有所述待验证算子,则确定所述待验证远程备份销毁指令为合法远程备份销毁指令。
在上述各实施例的基础上,所述备份销毁指令发送模块具体可以用于:向所述目标eSIM卡终端发送在线查询请求;若确定所述目标eSIM卡终端正常响应所述在线查询请求,则将所述合法远程备份销毁指令发送至所述目标eSIM卡终端;若确定所述目标eSIM卡终端异常响应所述在线查询请求,则向所述目标eSIM卡终端发送打开本地网络连接指令后,将所述合法远程备份销毁指令发送至所述目标eSIM卡终端。
上述产品可执行本发明任意实施例所提供的方法,具备执行方法相应的功能模块和有益效果。
显然,本领域技术人员应该明白,上述的本发明的各模块或各步骤可以通过如上所述的eSIM卡终端以及服务器来实施。可选地,本发明实施例可以用计算机装置可执行的程序来实现,从而可以将它们存储在存储装置中由处理器来执行,所述的程序可以存储于一种计算机可读存储介质中,上述提到的存储介质可以是只读存储器,磁盘或光盘等;或者将它们分别制作成各个集成电路模块,或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样,本发明不限制于任何特定的硬件和软件的结合。
以上所述仅为本发明的优选实施例,并不用于限制本发明,对于本领域技术人员而言,本发明可以有各种改动和变化。凡在本发明的精神和原理之内所作的任何修改、等同替换、改进等,均应包含在本发明的保护范围之内。
Claims (19)
- 一种终端的备份销毁方法,其特征在于,包括:本机嵌入式用户识别模块卡终端根据安全校验算子识别合法远程备份销毁指令;所述本机嵌入式用户识别模块卡终端使用信息密钥,对设定储存空间中存储的目标信息进行信息加密;所述本机嵌入式用户识别模块卡终端将加密后的所述目标信息发送至服务器进行备份,并删除所述储存空间中存储的目标信息。
- 根据权利要求1所述的方法,其特征在于,在所述本机嵌入式用户识别模块卡终端根据安全校验算子识别合法远程备份销毁指令之前,还包括:所述本机嵌入式用户识别模块卡终端向所述服务器进行注册,并在注册成功后,存储在注册过程中生成的所述安全校验算子。
- 根据权利要求2所述的方法,其特征在于,所述本机嵌入式用户识别模块卡终端向所述服务器进行注册,并在注册成功后,存储在注册过程中生成的所述安全校验算子具体包括:所述本机嵌入式用户识别模块卡终端向所述服务器发送终端注册请求;所述本机嵌入式用户识别模块卡终端接收所述服务器返回的第一运算函数以及服务器密钥;所述本机嵌入式用户识别模块卡终端将用户输入的用户标识以及用户密码通过所述第一运算函数进行运算,生成加密用户标识以及加密用户密码;所述本机嵌入式用户识别模块卡终端根据所述加密用户标识、所述加密用户密码、所述服务器密钥,以及与所述服务器约定的标准运算规则,计算所述安全校验算子;所述本机嵌入式用户识别模块卡终端将所述加密用户标识、所述加密用户密码以及所述安全校验算子发送至所述服务器,以使所述服务器完成对所述安全校验算子的验证;所述本机嵌入式用户识别模块卡终端若接收到所述服务器返回的注册成功信息,则对所述安全校验算子进行存储。
- 根据权利要求3所述的方法,其特征在于,在所述本机嵌入式用户识别模块卡终端向所述服务器进行注册,并在注册成功后,存储在注册过程中生成的所述安全校验算子之后,还包括:所述本机嵌入式用户识别模块卡终端向所述服务器进行身份验证,并在身份验证成功后,生成所述信息密钥。
- 根据权利要求4所述的方法,其特征在于,所述本机嵌入式用户识别模块卡终端向所述服务器进行身份验证,并在身份验证成功后,生成所述信息密钥具体包括:所述本机嵌入式用户识别模块卡终端根据所述服务器发送的国际移动用户识别码获取请求,将所述国际移动用户识别码通过所述第一运算函数生成加密国际移动用户识别码后,发送至所述服务器;所述本机嵌入式用户识别模块卡终端接收所述服务器返回的操作函数集,其中,所述操作函数集包括:第二运算函数、加密解密函数对以及随机数生成函数;所述本机嵌入式用户识别模块卡终端使用所述操作函数集与所述服务器进行信息交互,并对所述服务器返回的身份验证校验算子进行验证;所述本机嵌入式用户识别模块卡终端若确定所述身份验证校验算子通过验证,则确定身份验证成功;所述本机嵌入式用户识别模块卡终端根据所述安全校验算子、所述加密国际移动用户识别码以及所述标准运算规则,生成所述信息密钥。
- 根据权利要求5所述的方法,其特征在于,所述本机嵌入式用户识别模块卡终端使用所述操作函数集与所述服务器进行信息交互,并对所述服务器返回的身份验证校验算子进行验证具体包括:所述本机嵌入式用户识别模块卡终端使用所述随机数生成函数生成第一随机数,并将所述第一随机数发送至所述服务器;所述本机嵌入式用户识别模块卡终端接收所述服务器返回的身份验证校验算子;其中,所述身份验证校验算子包括:待验证哈希密钥、第二随机数以及待解密消息;所述本机嵌入式用户识别模块卡终端使用所述加密解密函数对中的解密函数对所述待解密消息进行解密,获取所述待解密消息中包括的随机密钥;所述本机嵌入式用户识别模块卡终端根据所述随机密钥、所述第一随机数、所述第二随机数、所述加密国际移动用户识别码,以及所述第二运算函数,生成比对哈希密钥;所述本机嵌入式用户识别模块卡终端若确定所述比对哈希密钥与所述待验证哈希密钥相匹配,则确定所述身份验证校验算子通过验证;所述本机嵌入式用户识别模块卡终端向所述服务器发送身份认证成功信息。
- 根据权利要求6所述的方法,其特征在于,所述本机嵌入式用户识别模块卡终端根据安全校验算子识别合法远程备份销毁指令包括:所述本机嵌入式用户识别模块卡终端接收第三方嵌入式用户识别模块卡终端发送的远程备份销毁短信,其中,所述远程备份销毁短信包括:待验证用户标识、待验证用户密码以及待验证远程备份销毁指令;所述本机嵌入式用户识别模块卡终端根据所述待验证用户标识、所述待验证用户密码、所述服务器密钥以及所述标准运算规则,计算待验证算子;所述本机嵌入式用户识别模块卡终端若确定所述待验证算子与所述安全校验算子相匹配,则确定所述待验证远程备份销毁指令为合法远程备份销毁指令。
- 根据权利要求7所述的方法,其特征在于,还包括:所述本机嵌入式用户识别模块卡终端若接收到所述服务器发送的远程备份销毁指令,则直接将所述远程备份销毁指令识别为合法远程备份销毁指令。
- 根据权利要求1-8任一项所述的方法,其特征在于,在所述本机嵌入式用户识别模块卡终端将加密后的所述目标信息发送至服务器进行备份之前,还包括:所述本机嵌入式用户识别模块卡终端若接收到所述服务器发送的打开本地网络连接指令,则打开本地网络连接;或者所述本机嵌入式用户识别模块卡终端若确定自身当前未连接网络,则打开本地网络连接。
- 一种终端的备份销毁方法,其特征在于,包括:服务器根据本地存储的至少一个安全校验算子,识别合法远程备份销毁指令;所述服务器向与所述合法远程备份销毁指令对应的目标嵌入式用户识别模块卡终端发送所述合法远程备份销毁指令,以使所述目标嵌入式用户识别模块卡终端对设定存储空间中存储的目标信息进行备份销毁;所述服务器接收所述目标嵌入式用户识别模块卡终端发送的加密后的所述目标信息进行存储。
- 根据权利要求10所述的方法,其特征在于,在所述服务器根据本地存储的至少一个安全校验算子,识别合法远程备份销毁指令之前,还包括:所述服务器对注册嵌入式用户识别模块卡终端进行注册,并在注册成功后,存储与所述注册嵌入式用户识别模块卡终端对应的安全校验算子。
- 根据权利要求11所述的方法,其特征在于,所述服务器对注册嵌入式用户识别模块卡终端进行注册,并在注册成功后,存储与所述注册嵌入式用户识别模块卡终端对应的安全校验算子具体包括:所述服务器根据注册嵌入式用户识别模块卡终端发送的终端注册请求,向所述注册嵌入式用户识别模块卡终端发送第一运算函数以及服务器密钥;所述服务器接收所述注册嵌入式用户识别模块卡终端返回的加密用户标识、加密用户密码以及待验证安全校验算子;所述服务器根据所述加密用户标识、所述加密用户密码、所述服务器密钥,以及与所述注册嵌入式用户识别模块卡终端约定的标准运算规则,计算比对校验算子;所述服务器若确定所述比对校验算子与所述待验证安全校验算子相匹配,则确定注册成功;所述服务器将注册成功信息发送至所述注册嵌入式用户识别模块卡终端,并将所述待验证安全校验算子作为与所述注册嵌入式用户识别模块卡终端对应的安全校验算子进行存储。
- 根据权利要求12所述的方法,其特征在于,在所述服务器对注册嵌入式用户识别模块卡终端进行注册,并在注册成功后,存储与所述注册嵌入式用户识别模块卡终端对应的安全校验算子之后,还包括:所述服务器对注册成功的所述注册嵌入式用户识别模块卡终端进行身份验证,并在身份验证成功后,生成与所述注册嵌入式用户识别模块卡终端对应的所述信息密钥。
- 根据权利要求13所述的方法,其特征在于,所述服务器对注册成功的所述注册嵌入式用户识别模块卡终端进行身份验证,并在身份验证成功后,生成与所述注册嵌入式用户识别模块卡终端对应的所述信息密钥具体包括:所述服务器向注册成功的注册嵌入式用户识别模块卡终端发送国际移动用户识别码获取请求;所述服务器接收所述注册嵌入式用户识别模块卡终端返回的加密国际移动用户识别码;所述服务器向所述注册嵌入式用户识别模块卡终端发送操作函数集,其中,所述操作函数集包括:第二运算函数、加密解密函数对以及随机数生成函数;所述服务器使用所述操作函数集与所述注册嵌入式用户识别模块卡终端进行信息交互,并向所述注册嵌入式用户识别模块卡终端发送身份验证校验算子,以使所述注册嵌入式用户识别模块卡终端对所述身份验证校验算子进行验证;所述服务器若接收到所述注册嵌入式用户识别模块卡终端返回的身份认证成功信息,则根据所述安全校验算子、所述加密国际移动用户识别码以及所述标准运算规则,生成与所述注册嵌入式用户识别模块卡终端对应的信息密钥。
- 根据权利要求14所述的方法,其特征在于,所述服务器使用所述操作函数集与所述注册嵌入式用户识别模块卡终端进行信息交互,并向所述注册嵌入式用户识别模块卡终端发送身份验证校验算子具体包括:所述服务器接收所述注册嵌入式用户识别模块卡终端发送的第一随机数;所述服务器根据所述随机数生成函数生成第二随机数;所述服务器根据随机密钥、所述第一随机数、所述第二随机数、所述加密国际移动用户识别码以及所述第二运算函数,生成待验证哈希密钥;所述服务器根据所述随机密钥、与所述注册嵌入式用户识别模块卡终端对应的安全校验算子以及所述加密解密函数对中的加密函数,生成待解密消息;所述服务器将所述待验证哈希密钥、所述第二随机数以及所述待解密消息作为身份验证校验算子发送至所述注册嵌入式用户识别模块卡终端,以使所述注册嵌入式用户识别模块卡终端对所述身份验证校验算子进行验证。
- 根据权利要求15所述的方法,其特征在于,所述服务器根据本地存储的至少一个安全校验算子,识别合法远程备份销毁指令包括:所述服务器接收第三方嵌入式用户识别模块卡终端发送的远程备份销毁短信,其中,所述远程备份销毁短信包括:待验证用户标识、待验证用户密码以及待验证远程备份销毁指令;所述服务器根据所述待验证用户标识、所述待验证用户密码、所述服务器密钥以及所述标准运算规则,计算待验证算子;所述服务器若确定存储有所述待验证算子,则确定所述待验证远程备份销毁指令为合法远程备份销毁指令。
- 根据权利要求16所述的方法,其特征在于,所述服务器向与所述合法远程备份销毁指令对应的目标嵌入式用户识别模块卡终端发送所述合法远程备份销毁指令包括:所述服务器向所述目标嵌入式用户识别模块卡终端发送在线查询请求;所述服务器若确定所述目标嵌入式用户识别模块卡终端正常响应所述在线查询请求,则将所述合法远程备份销毁指令发送至所述目标嵌入式用户识别模块卡终端;所述服务器若确定所述目标嵌入式用户识别模块卡终端异常响应所述在线查询请求,则向所述目标嵌入式用户识别模块卡终端发送打开本地网络连接指令后,将所述合法远程备份销毁指令发送至所述目标嵌入式用户识别模块卡终端。
- 一种终端的备份销毁装置,应用于嵌入式用户识别模块卡终端,其特征在于,包括:合法指令识别模块,用于根据安全校验算子识别合法远程备份销毁指令;备份信息加密模块,用于使用信息密钥,对设定储存空间中存储的目标信息进行信息加密;备份销毁模块,用于将加密后的所述目标信息发送至服务器进行备份,并删除所述储存空间中存储的目标信息。
- 一种终端的备份销毁装置,应用于服务器,其特征在于,包括:合法指令识别模块,用于根据本地存储的至少一个安全校验算子,识别合法远程备份销毁指令;备份销毁指令发送模块,用于向与所述合法远程备份销毁指令对应的目标嵌入式用户识别模块卡终端发送所述合法远程备份销毁指令,以使所述目标嵌入式用户识别模块卡终端对设定存储空间中存储的目标信息进行备份销毁;备份信息存储模块,用于接收所述目标嵌入式用户识别模块卡终端发送的加密后的所述目标信息进行存储。
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201610381669.9A CN106060796B (zh) | 2016-06-01 | 2016-06-01 | 终端的备份销毁方法和装置 |
CN201610381669.9 | 2016-06-01 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2017206250A1 true WO2017206250A1 (zh) | 2017-12-07 |
Family
ID=57171775
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2016/087547 WO2017206250A1 (zh) | 2016-06-01 | 2016-06-29 | 终端的备份销毁方法和装置 |
Country Status (2)
Country | Link |
---|---|
CN (1) | CN106060796B (zh) |
WO (1) | WO2017206250A1 (zh) |
Cited By (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN110972136A (zh) * | 2018-09-29 | 2020-04-07 | 上海灵慧软件科技有限公司 | 物联网安全通信模组、终端、安全控制系统及认证方法 |
CN111385258A (zh) * | 2018-12-28 | 2020-07-07 | 广州市百果园信息技术有限公司 | 一种数据通信的方法、装置、客户端、服务器和存储介质 |
CN111460479A (zh) * | 2020-03-31 | 2020-07-28 | 广东培正学院 | 图库加密管理系统 |
CN113163392A (zh) * | 2021-03-17 | 2021-07-23 | 维沃移动通信有限公司 | 用户身份数据文件的删除方法及装置 |
CN116432199A (zh) * | 2023-03-03 | 2023-07-14 | 安超云软件有限公司 | 云平台远程数据备份方法及其恢复方法、电子设备 |
Families Citing this family (12)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN106535159B (zh) * | 2016-11-07 | 2020-03-17 | 宇龙计算机通信科技(深圳)有限公司 | 用户身份识别卡及其远程销毁方法、系统和设备 |
CN107194291A (zh) * | 2017-05-16 | 2017-09-22 | 努比亚技术有限公司 | 移动终端防盗方法、移动终端及计算机可读存储介质 |
CN107483547B (zh) * | 2017-07-20 | 2020-10-30 | 北京珠穆朗玛移动通信有限公司 | 用户终端的防丢失方法、服务器、移动终端及存储介质 |
CN108668260B (zh) * | 2018-04-17 | 2021-12-24 | 北京华大智宝电子系统有限公司 | 一种sim卡数据自毁方法、sim卡、装置及服务器 |
CN108650624A (zh) * | 2018-05-15 | 2018-10-12 | 珠海格力电器股份有限公司 | 一种终端防盗方法及终端 |
CN109949478B (zh) * | 2019-03-21 | 2021-09-21 | 深圳神盾卫民警用设备有限公司 | 卡证销毁方法、卡证销毁设备以及可读存储介质 |
CN110049487A (zh) * | 2019-03-27 | 2019-07-23 | 山东超越数控电子股份有限公司 | 一种基于北斗的高安全加密存储远程销毁管理系统及其工作方法 |
CN110781504A (zh) * | 2019-09-27 | 2020-02-11 | 深圳市大拿科技有限公司 | 数据保护方法及相关设备 |
CN111756718B (zh) * | 2020-06-15 | 2022-09-30 | 深信服科技股份有限公司 | 终端及访问方法、系统、服务器和计算机可读存储介质 |
CN113158201A (zh) * | 2021-02-26 | 2021-07-23 | 云码智能(海南)科技有限公司 | 信息的安全备份方法及装置 |
CN113176860B (zh) * | 2021-05-24 | 2023-09-22 | 的卢技术有限公司 | 基于云计算的数据销毁与恢复装置及方法 |
CN115952552B (zh) * | 2023-03-15 | 2023-05-12 | 北京和升达信息安全技术有限公司 | 远程数据销毁方法、系统及设备 |
Citations (7)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN1992587A (zh) * | 2005-12-29 | 2007-07-04 | 摩托罗拉公司 | 基于身份的加密系统 |
US20070281664A1 (en) * | 2004-11-17 | 2007-12-06 | Takashi Kaneko | Portable wireless terminal and its security system |
US20070294529A1 (en) * | 2006-06-20 | 2007-12-20 | Avaya Technology Llc | Method and apparatus for data protection for mobile devices |
CN101803415A (zh) * | 2007-09-18 | 2010-08-11 | 高通股份有限公司 | 用于为移动手持机创建远程激活的安全备份服务的方法和设备 |
US7965998B2 (en) * | 2006-04-21 | 2011-06-21 | Alcatel-Lucent Usa Inc. | Network support for handset data protection |
CN104540123A (zh) * | 2015-01-07 | 2015-04-22 | 福州北卡信息科技有限公司 | 移动终端重要数据加密备份与安全删除的方法及系统 |
CN105306430A (zh) * | 2014-07-22 | 2016-02-03 | 诺基亚技术有限公司 | 用于提供匿名通信会话的方法和装置 |
-
2016
- 2016-06-01 CN CN201610381669.9A patent/CN106060796B/zh active Active
- 2016-06-29 WO PCT/CN2016/087547 patent/WO2017206250A1/zh active Application Filing
Patent Citations (7)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20070281664A1 (en) * | 2004-11-17 | 2007-12-06 | Takashi Kaneko | Portable wireless terminal and its security system |
CN1992587A (zh) * | 2005-12-29 | 2007-07-04 | 摩托罗拉公司 | 基于身份的加密系统 |
US7965998B2 (en) * | 2006-04-21 | 2011-06-21 | Alcatel-Lucent Usa Inc. | Network support for handset data protection |
US20070294529A1 (en) * | 2006-06-20 | 2007-12-20 | Avaya Technology Llc | Method and apparatus for data protection for mobile devices |
CN101803415A (zh) * | 2007-09-18 | 2010-08-11 | 高通股份有限公司 | 用于为移动手持机创建远程激活的安全备份服务的方法和设备 |
CN105306430A (zh) * | 2014-07-22 | 2016-02-03 | 诺基亚技术有限公司 | 用于提供匿名通信会话的方法和装置 |
CN104540123A (zh) * | 2015-01-07 | 2015-04-22 | 福州北卡信息科技有限公司 | 移动终端重要数据加密备份与安全删除的方法及系统 |
Cited By (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN110972136A (zh) * | 2018-09-29 | 2020-04-07 | 上海灵慧软件科技有限公司 | 物联网安全通信模组、终端、安全控制系统及认证方法 |
CN111385258A (zh) * | 2018-12-28 | 2020-07-07 | 广州市百果园信息技术有限公司 | 一种数据通信的方法、装置、客户端、服务器和存储介质 |
CN111460479A (zh) * | 2020-03-31 | 2020-07-28 | 广东培正学院 | 图库加密管理系统 |
CN111460479B (zh) * | 2020-03-31 | 2023-02-14 | 广东培正学院 | 图库加密管理系统 |
CN113163392A (zh) * | 2021-03-17 | 2021-07-23 | 维沃移动通信有限公司 | 用户身份数据文件的删除方法及装置 |
CN116432199A (zh) * | 2023-03-03 | 2023-07-14 | 安超云软件有限公司 | 云平台远程数据备份方法及其恢复方法、电子设备 |
Also Published As
Publication number | Publication date |
---|---|
CN106060796B (zh) | 2018-12-25 |
CN106060796A (zh) | 2016-10-26 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
WO2017206250A1 (zh) | 终端的备份销毁方法和装置 | |
KR102307665B1 (ko) | 신원 인증 | |
US20220191016A1 (en) | Methods, apparatuses, and computer program products for frictionless electronic signature management | |
ES2818199T3 (es) | Método de verificación de seguridad con base en una característica biométrica, un terminal de cliente y un servidor | |
KR101888903B1 (ko) | 키를 이전시키기 위한 방법 및 장치 | |
US8086868B2 (en) | Data communication method and system | |
KR20170043520A (ko) | 비대칭 암호화를 이용하여 otp를 구현하기 위한 시스템 및 방법 | |
WO2020173332A1 (zh) | 基于可信执行环境的应用激活方法及装置 | |
KR101520722B1 (ko) | 사용자 인증 방법, 서버 및 사용자 단말 | |
EP3206329B1 (en) | Security check method, device, terminal and server | |
US11405202B2 (en) | Key processing method and apparatus | |
JP7309261B2 (ja) | 生体決済機器の認証方法、生体決済機器の認証装置、コンピュータ機器、及びコンピュータプログラム | |
WO2014015759A1 (zh) | 一种终端身份验证和服务鉴权的方法、系统和终端 | |
CN111954211A (zh) | 一种移动终端新型认证密钥协商系统 | |
US9977907B2 (en) | Encryption processing method and device for application, and terminal | |
KR102252731B1 (ko) | 소프트웨어 인증장치를 위한 키 관리 방법 및 장치 | |
KR101835718B1 (ko) | 이종 기기 사이의 근거리 무선 통신을 이용한 모바일 인증 방법 | |
KR102332037B1 (ko) | Scada 제어망에서 강화된 운용자 인증 시스템 및 방법 | |
CN106603237B (zh) | 一种安全支付方法及装置 | |
WO2017020449A1 (zh) | 一种指纹读取方法及用户设备 | |
WO2019153751A1 (zh) | 一种终端的认证方法和装置 | |
KR101490638B1 (ko) | 스마트 카드 인증 방법, 이를 실행하는 서버 및 이를 실행하는 시스템 | |
KR20140007628A (ko) | 모바일 계좌이체 검증처리 방법 | |
KR102648908B1 (ko) | 사용자 인증 시스템 및 방법 | |
TWI778319B (zh) | 跨平台授權存取資源方法及授權存取系統 |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 16903632 Country of ref document: EP Kind code of ref document: A1 |
|
122 | Ep: pct application non-entry in european phase |
Ref document number: 16903632 Country of ref document: EP Kind code of ref document: A1 |