WO2019056957A1

WO2019056957A1 - Data processing and identity authentication methods and systems, and terminal

Info

Publication number: WO2019056957A1
Application number: PCT/CN2018/104763
Authority: WO
Inventors: 杨涛; 姜金龙; 董侃
Original assignee: 阿里巴巴集团控股有限公司
Priority date: 2017-09-19
Filing date: 2018-09-10
Publication date: 2019-03-28
Also published as: CN109525989A; CN109525989B

Abstract

Disclosed in the present application are data processing and identity authentication methods and systems, and a terminal. The data processing method comprises: a terminal acquires an authentication ciphertext, the authentication ciphertext being ciphertext generated on the basis of a first key stored in the SIM card of a terminal; the terminal applies for updated sensitive data from a service server, and sends the authentication ciphertext to a management server via the service server; the terminal receives encrypted data sent by the management server via the service server, the encrypted data being obtained by means of the management server using a second key corresponding to the first key to encrypt sensitive data provided by the service server; and the terminal uses the first key stored in the SIM card to decrypt the encrypted data and stores the decrypted sensitive data.

Description

Data processing, identity authentication method and system, terminal

The present application claims the priority of the Chinese Patent Application No. 201710852631.X filed on Sep. 19, 2017, entitled "Data Processing, Identity Authentication Method and System, Terminal", the entire contents of which are incorporated herein by reference. in.

Technical field

The present application relates to the field of authentication, and in particular, to a data processing, an identity authentication method and system, and a terminal.

Background technique

The traditional Internet of Things (IoT) device security method is to store keys through a plug-in security carrier or directly using a Miro Controller Unit (MCU). However, the external security carrier requires the manufacturer to change the hardware design and increase the cost; the key is directly stored in the MCU, lacking the protection of the secure storage environment, and is easily stolen by the attacker.

Moreover, if a complex network security protocol or carrier line is used to solve security problems, it will bring certain challenges to the cost and deployment of the product.

In response to the above problems, no effective solution has been proposed yet.

Summary of the invention

The embodiment of the present application provides a data processing, an identity authentication method, a system, and a terminal, so as to solve at least the technical problem that the security authentication scheme in the related technology cannot meet the requirements of cost and high security.

According to an aspect of the embodiments of the present application, a data processing system is provided, including: a terminal, configured with a Subscriber Identification Module (SIM) card, where the SIM card stores a first key, The terminal is configured to send the authentication ciphertext generated by the first key to the service server, the service server is configured to provide the sensitive data, and send the sensitive data to the management server, where the management server is configured to The authentication cipher text is authenticated, and after the authentication is passed, the second key corresponding to the first key encrypts the sensitive data; and the encrypted sensitive data is sent to the terminal via the service server, where And the terminal decrypts the encrypted sensitive data by using the first key stored in the SIM card.

According to another aspect of the embodiments of the present application, a terminal is provided, including: a SIM card, configured to store a pre-written first key, where the first key is used to generate an authentication ciphertext; and a processor coupled To the SIM card for storing sensitive data.

According to still another aspect of the embodiments of the present application, another terminal is provided, including: a security module, configured to store a security key; and a processor coupled to the security module for storing sensitive data.

According to still another aspect of the embodiments of the present application, a data processing method is provided, including: a terminal generating authentication information according to a first key in a SIM card; the terminal applying to the service server for acquiring sensitive data, and The service server sends the authentication information to the management server; the terminal receives the encrypted data sent by the management server via the service server, wherein the encrypted data is used by the management server to correspond to the first key The second key is obtained by encrypting the sensitive data provided by the service server; the terminal decrypts the encrypted data according to the first key to obtain the sensitive data.

According to still another aspect of the embodiments of the present application, a storage medium is provided, where the storage medium includes a stored program, wherein, when the program is running, controlling a device where the storage medium is located to execute the data processing method described above .

According to still another aspect of embodiments of the present application, there is also provided a processor for running a program, wherein the program is executed to execute the data processing method described above.

According to still another aspect of the embodiments of the present application, a method for manufacturing a SIM card is provided, including: starting an application on a SIM card of a user identity module; receiving, by the application, a security key delivered by a management server, and storing To the SIM card.

According to still another aspect of the embodiments of the present application, an identity authentication method is provided, including: a management server receiving an authentication ciphertext forwarded by a terminal via a service server, where the authentication ciphertext is based on a SIM card storage in the terminal The first key is generated; the management server authenticates the authentication ciphertext.

According to still another aspect of the embodiments of the present application, a data processing method includes: receiving, by a terminal, encrypted data sent by a management server via a service server, wherein the encrypted data is a second key used by the management server, The sensitive data provided by the service server is encrypted; the second key is a key corresponding to the first key stored in the SIM card of the user identity module in the terminal; A key decrypts the encrypted data and stores the decrypted sensitive data.

According to still another aspect of the embodiments of the present application, a data processing method is provided, including: a terminal generates authentication information according to a first key in a security module; and the terminal applies to the service server to acquire sensitive data, and The server sends the authentication information to the management server; the terminal receives the encrypted data sent by the management server via the service server, wherein the encrypted data is used by the management server corresponding to the first key The second key is obtained by encrypting the sensitive data provided by the service server; the terminal decrypts the encrypted data according to the first key to obtain the sensitive data.

According to still another aspect of the embodiments of the present application, an identity authentication method is provided, including: a terminal generates authentication information according to a first key in a security module; and the terminal sends the authentication information to a management server via a service server; The management server authenticates the terminal according to the authentication information.

According to still another aspect of the embodiments of the present application, an identity authentication method is provided, including: a management server receiving authentication information forwarded by a terminal via a service server, where the authentication information is a terminal that is stored by the terminal based on a security module in the terminal. A key is generated; the management server authenticates the authentication information.

According to still another aspect of the embodiments of the present application, a data processing method includes: receiving, by a terminal, encrypted data sent by a management server via a service server, wherein the encrypted data is a second key used by the management server, The sensitive data provided by the service server is encrypted; the second key is a key corresponding to the first key stored in the security module in the terminal; and the terminal uses the first key pair The encrypted data is decrypted and the decrypted sensitive data is stored.

In the embodiment of the present application, the SIM card and the management server pre-written with the first key are used to implement the legality authentication and the establishment of the secure channel. Since the first key in the SIM card is pre-written, For example, it is written in the production link of the SIM card, thus ensuring the security of the key in the storage link, and establishing a secure channel based on the authentication message, thereby further enhancing the security of the authentication, thereby solving the related technology. The technical problem of the medium security certification scheme that cannot meet the requirements of cost and high security.

DRAWINGS

The drawings described herein are intended to provide a further understanding of the present application, and are intended to be a part of this application. In the drawing:

1 is a schematic structural diagram of a data processing system according to an embodiment of the present application;

2 is a schematic diagram of a SIM card application process according to an embodiment of the present application;

FIG. 3 is a schematic structural diagram of a terminal according to an embodiment of the present application; FIG.

4 is a schematic structural diagram of another terminal according to an embodiment of the present application;

FIG. 5 is a schematic diagram of a process for establishing a secure channel according to an embodiment of the present application; FIG.

FIG. 6 is a schematic structural diagram of a computer terminal according to an embodiment of the present application; FIG.

FIG. 7 is a schematic flowchart diagram of a data processing method according to an embodiment of the present application; FIG.

FIG. 8 is a schematic flowchart diagram of another identity authentication method according to an embodiment of the present application; FIG.

9 is a schematic flowchart of an identity authentication method according to an embodiment of the present application;

FIG. 10 is a schematic flowchart diagram of another data processing method according to an embodiment of the present application; FIG.

11 is a schematic flow chart of a method for manufacturing a SIM card according to an embodiment of the present application;

FIG. 12 is a schematic flowchart diagram of another data processing method according to an embodiment of the present application; FIG.

FIG. 13 is a schematic flowchart diagram of another identity authentication method according to an embodiment of the present application; FIG.

FIG. 14 is a schematic flowchart diagram of another identity authentication method according to an embodiment of the present application;

FIG. 15 is a schematic flowchart diagram of another data processing method according to an embodiment of the present application.

Detailed ways

The technical solutions in the embodiments of the present application are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present application. It is an embodiment of the present application, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present application without departing from the inventive scope shall fall within the scope of the application.

It should be noted that the terms "first", "second" and the like in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or order. It is to be understood that the data so used may be interchanged where appropriate, so that the embodiments of the present application described herein can be implemented in a sequence other than those illustrated or described herein. In addition, the terms "comprises" and "comprises" and "the" and "the" are intended to cover a non-exclusive inclusion, for example, a process, method, system, product, or device that comprises a series of steps or units is not necessarily limited to Those steps or units may include other steps or units not explicitly listed or inherent to such processes, methods, products or devices.

First, some of the nouns or terms that appear in the process of describing the embodiments of the present application are applicable to the following explanations:

Security chip: The trusted platform module is a device that can independently generate key, encrypt and decrypt. It has an independent processor and storage unit, which can store key and feature data, and provide encryption and security authentication services for the computer.

Security key: Data encrypted with the public key can only be decrypted by the private key. Conversely, the data encrypted with the private key can only be decrypted by the public key.

Sensitive data: refers to all information that is improperly used or unauthorized to be contacted or modified to be harmful to the public interest or to personal privacy enjoyed by individuals.

Example 1

In the related art, when the key is stored, it is often stored by a security carrier or by using an MCU. However, the external security carrier needs to modify the design of the device, which increases the cost, and the key is stored in the MCU and is easily cracked. The storage environment is not secure.

In order to meet the requirements of the manufacturer for the low-cost, easy-to-deploy, and high-security key service, the embodiment of the present application combines the key with the SIM card, and implements the security pre-made key on the SIM card production line that meets the EAL4+ security standard. The non-definable modified key is securely stored on the device side. At the same time, the management server securely stores keys on the cloud platform and provides online key usage services for the devices.

To achieve the above objective, the embodiment of the present application provides a data processing system. As shown in FIG. 1, the system includes:

The terminal 10 is provided with a SIM card, and the SIM card stores a first key, and the terminal is configured to send the authentication ciphertext generated based on the first key to the service server;

Optionally, the terminal 10 is structurally included, but not limited to: a SIM card slot, a SIM card is installed in the SIM card slot, and a processor is coupled to the SIM card for storing sensitive data. Wherein, the processor includes but is not limited to a micro control unit (MCU).

In order to ensure the security of the storage environment of the first key, the first key may be written on the production line of the SIM card. For example, as shown in FIG. 2: Step S202, installing an application in a SIM card, wherein the installation process can be performed by a SIM card manufacturer on a secure production line; and in step S204, key data is burned: docking with the cloud platform. The secure writing of the key data is implemented; in step S206, the operator performs the burning of the SIM card number; in step S208, the integration of the SIM card and the terminal is performed: on the side of the terminal manufacturer, the SIM card that writes the key data is used. Integrating hardware and software with the terminal device to form a final product; Step S210: Terminal docking management server: The terminal can be established by using the SIM card integrated with the device by accessing the online server (ie, the management server 14) during use. A secure link from the cloud to the device.

The first key may also be written when the SIM card number is programmed (that is, the first key is written in the operator link); the first key may also be written in the terminal production link. That is, the writing of the first key is implemented in the process of integrating the SIM card into the terminal. The timing at which the first key is written to the SIM card can be flexibly determined according to actual conditions, and is not limited to the above-mentioned writing timing.

In an optional embodiment, the foregoing terminal includes, but is not limited to, a smart mobile terminal, a tablet computer, etc., but is not limited thereto.

The service server 12 is configured to provide sensitive data and send the sensitive data to the management server. The service server is configured to provide specific service data, for example, sharing bicycle-related service data. When the terminal requests service data, the service server will The service data is sent to the management server, and after being encrypted by the management server, the encrypted service data is sent to the terminal, and at this time, the secure transmission of the service data is realized.

In an optional embodiment, the sensitive data may be the user's private information data: the user's communication number, communication record, picture, video, etc.; and may also be user rights information data: login password, payment password, etc., but Not limited to this, the above sensitive data may include: all information that is improperly or unauthorisedly contacted or modified by others, is not conducive to the public interest or is not conducive to the personal privacy rights of the individual according to law.

The management server 14 is configured to authenticate the encrypted ciphertext, and after the authentication is passed, the second key encrypts the sensitive data, wherein the second key corresponds to the first key; The data is transmitted to the terminal via the service server, wherein the terminal decrypts the encrypted sensitive data using the first key stored in the SIM card. Through the above process, it can be seen that the authentication process and the authentication of the encrypted ciphertext are realized by the management server, and the security process of the authentication process and the sensitive data transmission is realized.

In an optional embodiment, the management server 14 may be a server on the network side or a server in the cloud network. Specifically, the one or more management servers 14 may be configured to provide a cloud platform, where the cloud platform is configured to provide the first key and the second key, where the first key and the second key may be the same secret The key, or a key with a corresponding relationship.

Through the processes implemented in the above sections, the establishment of a secure link between the cloud and the device can be achieved. For ease of understanding, the flow of the various components of the above data processing system is described in detail below in conjunction with an alternative embodiment. The processor in the terminal includes an MCU, but is not limited thereto.

As an alternative embodiment of the present application, the structure of the terminal 10 can be as shown in FIG. 3. As shown in FIG. 3, the terminal includes:

a SIM card 30, configured to store a pre-written first key, where the first key is used to generate an authentication ciphertext;

Since the SIM card is the Internet authentication carrier adopted by most devices. By combining the key with the SIM, the security key can be managed without the manufacturer modifying the existing product design or constructing the key system. At the same time, the online server using the key helps the device to perform legality authentication and secure channel establishment.

In addition, it should be noted that, in order to achieve the purpose of helping the device to perform the legality authentication, one or more legality judgment standards may be pre-stored on the online server, and the legality judgment standard may be: the accuracy and security of the device have been determined. One or more keys, specifically, one or more of the above-mentioned keys are set corresponding to the above-mentioned devices, and can be online managed and updated by the online server.

In an optional embodiment, if the key input by the device is consistent with the key for storing the device in the online server, it is determined that the legality authentication of the device is passed; otherwise, the legality authentication of the device is determined to be invalid. .

The processor 32 is coupled to the SIM card 30 for storing sensitive data, wherein the sensitive data is used to decrypt the service data.

Optionally, the processor 32 is configured to send a request for acquiring the authentication ciphertext to the SIM card, where the SIM card is configured to generate an authentication ciphertext based on the first key, and feed back to the processor 32. .

As shown in FIG. 3, in an optional embodiment, the terminal may further include: a communication module 34, configured to send the authentication ciphertext to the management server via the service server; wherein the management server is configured to authenticate the foregoing The ciphertext is authenticated, and after the authentication is passed, the sensitive data is encrypted; and the second key corresponding to the first key and the encrypted sensitive data are sent to the terminal by using the service server, where the terminal is The second key is authenticated using the first key stored in the SIM card.

Optionally, the first key previously written by the SIM card is sent by the management server to the SIM card in advance.

As another alternative embodiment of the present application, the embodiment of the present application further provides another terminal. FIG. 4 is a schematic structural diagram of another terminal according to an embodiment of the present application. As shown in FIG. 4, the terminal includes:

The security module 40 is configured to store a security key. Alternatively, the security module may be a security chip or a SIM card with a built-in key.

The processor 42 is coupled to the security module 42 for storing sensitive data, wherein the sensitive data is used to decrypt the service data.

Optionally, as shown in FIG. 4, the terminal may further include a communication module 44, configured to receive the foregoing security key delivered by the management server.

FIG. 5 is a schematic diagram of a process of establishing a secure channel according to an embodiment of the present application. As shown in Figure 5, the process includes the following processing steps:

Step S502, the service server sends an update request to the MCU in the terminal, where the update request is used to request to update the sensitive data in the MCU.

Step S504, the MCU enables the update function of the sensitive data;

Step S506, the MCU sends a request for obtaining the authentication ciphertext to the SIM card;

Step S508, the SIM card returns the authentication ciphertext to the MCU;

Step S510, the MCU uploads the authentication ciphertext to the service server, and applies for updating the sensitive data.

Step S512, the service server generates new sensitive data, and sends the new sensitive data and the authentication ciphertext to the management server, where the new sensitive data and the authentication ciphertext can be sent through separate messages or through a message. Sending, when sending through a message, the above new sensitive data and the authenticated ciphertext can be sent as two parameters of the message. Wherein, when sending new sensitive data and authenticating ciphertext, it may be hashed to obtain a hash value for subsequent authentication;

Step S514, the management server authenticates the authentication ciphertext, and after the authentication is passed, encrypts the received sensitive data to obtain encrypted data.

Step S516, the management server sends the encrypted data to the service server.

Step S518, the service server sends the encrypted data to the MCU;

Step S520, the MCU calls the first key in the SIM card to decrypt the SIM card;

Step S522, the SIM card feeds back the decrypted sensitive data to the MCU;

Step S524, the MCU updates the sensitive data;

Step S526, the MCU turns off the update function;

Step S528, the terminal sends a sensitive data update success message to the service server.

Step S530, the service data uses the sensitive data to encrypt the service data.

Step S532, sending the encrypted service data to the MCU;

Step S534, decrypting the service data.

Based on the above embodiment, the key is combined with the SIM card, and the key is securely pre-made on the SIM card production line where the security standard meets the requirements, and the key is not modified and the key is securely stored on the device side. At the same time, the management server securely stores keys on the cloud and provides online key usage services for the devices. Since the SIM card is originally the Internet authentication carrier used by most devices. The combination of the key and the SIM enables the management of the security key without the manufacturer modifying the existing product design or constructing the key system. At the same time, the online server storing the key can help the device to establish the legality authentication and secure channel.

Example 2

The method embodiment provided in Embodiment 1 of the present application can be executed in a mobile terminal, a computer terminal or the like. FIG. 6 shows a hardware block diagram of a computer terminal (or mobile device) for implementing a data processing method. As shown in FIG. 6, computer terminal 60 may include one or more (shown in the figures 602a, 602b, ..., 602n) processor 602 (processor 602 may include, but is not limited to, a microprocessor MCU or programmable A processing device such as a logic device FPGA, a memory 604 for storing data, and a transmission module 606 for communication functions. In addition, it can also include: display, input/output interface (I/O interface), universal serial bus (USB) port (which can be included as one of the ports of the I/O interface), network interface, power supply And / or camera. It will be understood by those skilled in the art that the structure shown in FIG. 6 is merely illustrative and does not limit the structure of the above electronic device. For example, computer terminal 60 may also include more or fewer components than shown in FIG. 6, or have a different configuration than that shown in FIG.

It should be noted that one or more of the above-described processors 602 and/or other data processing circuits may be referred to herein generally as "data processing circuits." The data processing circuit may be embodied in whole or in part as software, hardware, firmware or any other combination. Moreover, the data processing circuitry can be a single, separate processing module, or incorporated in whole or in part into any of the other components in computer terminal 60 (or mobile device). As referred to in the embodiments of the present application, the data processing circuit is controlled as a processor (e.g., selection of a variable resistance terminal path connected to the interface).

The memory 604 can be used to store software programs and modules of application software, such as program instructions/data storage devices corresponding to the methods in the embodiments of the present application, and the processor 602 executes various programs by running software programs and modules stored in the memory 604. Functional application and data processing, that is, the vulnerability detection method for implementing the above application. Memory 604 can include high speed random access memory and can also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid state memory. In some examples, memory 604 can further include memory remotely located relative to processor 602, which can be connected to computer terminal 60 over a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

Transmission device 606 is for receiving or transmitting data via a network. The network specific examples described above may include a wireless network provided by a communication provider of computer terminal 60. In one example, transmission device 606 includes a Network Interface Controller (NIC) that can be connected to other network devices through a base station to communicate with the Internet. In one example, the transmission device 606 can be a Radio Frequency (RF) module for communicating with the Internet wirelessly.

The display can be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of computer terminal 60 (or mobile device).

FIG. 7 is a schematic flowchart diagram of a data processing method according to an embodiment of the present application. As shown in FIG. 7, the computer terminal includes:

Step S702, the terminal generates authentication information according to the first key in the SIM card.

In an optional embodiment, the first key is a random value generated by the management server and delivered to the terminal.

It should be noted that the foregoing authentication information may be: an authentication ciphertext and an authentication packet.

The timing of writing the first key to the SIM card can be flexibly determined according to actual conditions. For example, to ensure the security of the storage environment of the first key, the first key can be written on the production line of the SIM card. For example, the SIM card is installed with an application that communicates with the management server, and the application receives the first key delivered from the management server and stores it. In this way, the security of the SIM card in the production process is guaranteed. The first key may also be written when the SIM card number is programmed (that is, the first key is written in the operator link); the first key may also be written in the terminal production link. That is, the writing of the first key is implemented in the process of integrating the SIM card into the terminal.

The terminal obtains the authentication information, which may be an active acquisition, for example, a timing acquisition, or may be passively obtained. For example, before the terminal obtains the authentication information, the terminal receives a trigger message from the service server, where the trigger message is used to trigger the terminal to obtain the authentication. information. The above trigger message includes but is not limited to a key update message.

In an optional embodiment, the MCU in the terminal receives the trigger message, and when the trigger message is a key update message, the key update function is started, and the obtaining the authentication information is triggered.

The terminal may obtain the authentication information by: the processor in the terminal sends a request for acquiring the authentication information to the SIM card; and the SIM card feeds back the authentication information to the processor according to the request.

Step S704, the terminal applies to the service server for acquiring sensitive data, and sends the authentication information to the management server via the service server.

It should be noted that when there is no sensitive data in the terminal, the terminal requests the service server to obtain the sensitive data. However, when sensitive data exists in the terminal, the terminal can apply for obtaining sensitive data from the service server. The terminal requests the service server to update the sensitive data.

Step S706, the terminal receives the encrypted data sent by the management server via the service server, wherein the encrypted data is obtained by the management server encrypting the sensitive data provided by the service server by using a second key corresponding to the first key. of;

Step S708, the terminal decrypts the encrypted data according to the first key to obtain sensitive data.

In an optional embodiment, after the terminal decrypts the encrypted data by using the first key stored in the SIM card, and stores the decrypted sensitive data, the terminal receives the service data sent by the service server, where The service data is service data encrypted by using the above sensitive data; the terminal decrypts the service data by using the stored sensitive data. Before the terminal receives the service data sent by the service server, the following implementation process may be performed: the terminal sends a notification message to the service server, where the notification message is used to indicate that the terminal has completed the key update, that is, the service server receives the data. After the above notification message, the service data is sent. Of course, in an optional embodiment, the service server may also determine the timing of sending the service data according to the preset rule. For example, the service server periodically sends the service data according to a preset period.

It should be noted that the preferred embodiment of the present embodiment can be referred to the related description in Embodiment 1, and details are not described herein again.

Example 3

Based on the above system or terminal, according to an embodiment of the present application, an embodiment of a method for identity authentication is also provided. It should be noted that the steps shown in the flowchart of the drawing may be in a computer such as a set of computer executable instructions. The steps are performed in the system, and although the logical order is shown in the flowcharts, in some cases the steps shown or described may be performed in a different order than the ones described herein.

The embodiment of the present application provides a data processing method, as shown in FIG. 8, the method includes:

Step S802, the terminal generates authentication information according to the first key in the SIM card.

Optionally, the first key is a random value generated by the management server and delivered to the terminal.

Optionally, the SIM card may actively generate the foregoing authentication information authentication message, and send the information to the processor, or may be generated in a passive manner. For example, for the latter, the method may be implemented by: The SIM card sends a request for acquiring the above-mentioned authentication ciphertext information; the SIM card feeds back the authentication information to the processor according to the request.

Step S804, the terminal sends the authentication information to the management server via the service server.

Step S806, the management server authenticates the terminal according to the authentication information.

Through the above various processing steps, the authentication of the terminal by the management server can be realized. Since the authentication is performed by using the authentication ciphertext generated by the first key in the terminal, the security of the authentication ciphertext transmission process can be ensured.

It should be noted that, in the preferred embodiment of the present embodiment, reference may be made to the related description in Embodiment 1-2, and details are not described herein again.

Example 4

The embodiment of the present application further provides another data processing method, as shown in FIG. 9, the method includes:

Step S902, the management server receives the authentication information that the terminal forwards via the service server, where the authentication information is generated by the terminal based on the first key stored in the SIM card in the terminal;

Optionally, before the management server receives the authentication information forwarded by the terminal via the service server, the management server sends the first key to the SIM card of the terminal.

In order to ensure the security of the storage environment of the first key, the first key may be written on the production line of the SIM card. For example, the SIM card manufacturer installs an application on the SIM on the security production line, receives the first key and stores it through the application; the first key can also be written when the SIM card number is burned (ie, at the operator) The link completes the writing of the first key; the first key may also write the first key in the production process of the terminal, that is, the first key is written during the integration of the SIM card into the terminal. The timing at which the first key is written to the SIM card can be flexibly determined according to actual conditions, and is not limited to the above-mentioned writing timing.

Step S904, the management server authenticates the above authentication information. Optionally, when the authentication is passed, it is confirmed that the terminal is legal.

Example 5

The embodiment of the present application provides a data processing method, as shown in FIG. 10, the method includes:

Step S1002: The terminal receives the encrypted data sent by the management server via the service server, wherein the encrypted data is obtained by using the second key by the management server to encrypt the sensitive data provided by the service server; the second key is the foregoing The key corresponding to the first key stored in the SIM card in the terminal.

In an optional embodiment, the first key and the second key may be the same key or a corresponding key.

Step S1004: The terminal decrypts the encrypted data by using the first key, and stores the decrypted sensitive data.

Example 6

This embodiment further provides a method for producing a SIM card. As shown in FIG. 11, the method includes:

Step S1102, starting an application on the SIM card of the user identity module;

In step S1104, the security key issued by the management server is received by the application and stored in the SIM card.

In an optional embodiment, the foregoing management server may be a server on the network side or a server in the cloud network. Specifically, the one or more management servers may be configured to provide a cloud platform, where the cloud platform is configured to provide the first key and the second key, where the first key and the second key may be the same key Or a key with a corresponding relationship.

Example 7

This embodiment further provides a data processing method. As shown in FIG. 12, the method includes:

Step S1202: The terminal generates authentication information according to the first key in the security module.

In an optional embodiment, the security module may be, but not limited to, a SIM card, and the first key is a random value generated by the management server and delivered to the terminal.

Step S1204: The terminal applies to the service server for acquiring sensitive data, and sends the authentication information to the management server via the service server.

Step S1206: The terminal receives the encrypted data sent by the management server via the service server, where the encrypted data is obtained by the management server encrypting the sensitive data provided by the service server by using the second key corresponding to the first key;

Step S1208: The terminal decrypts the encrypted data according to the first key to obtain sensitive data.

Example 8

This embodiment further provides an identity authentication method. As shown in FIG. 13, the method includes:

Step S1302: The terminal generates authentication information according to the first key in the security module.

In an alternative embodiment, the security module described above may be, but is not limited to, a SIM card.

Optionally, the SIM card may actively generate the foregoing authentication information, and send the information to the processor, or may be generated in a passive manner. For example, for the latter, the method may be implemented by: sending, by the processor in the terminal, the SIM card to the SIM card. a request for acquiring the above authentication information; the SIM card feeding back the authentication information to the processor according to the request.

Step S1304, the terminal sends the authentication information to the management server via the service server;

In step S1306, the management server authenticates the terminal according to the authentication information.

Example 9

This embodiment further provides an identity authentication method. As shown in FIG. 14, the method includes:

In step S1402, the management server receives the authentication information that the terminal forwards via the service server, where the authentication information is generated by the terminal based on the first key stored by the security module in the terminal;

In step S1404, the management server authenticates the authentication information. Optionally, where the authentication is passed, the terminal is confirmed to be legal.

Example 10

This embodiment further provides a data processing method, as shown in FIG. 15, the method includes:

Step S1502: The terminal receives the encrypted data sent by the management server via the service server, where the encrypted data is obtained by the management server using the second key to encrypt the sensitive data provided by the service server; the second key is the security module in the terminal. a key corresponding to the first key stored therein;

In step S1504, the terminal decrypts the encrypted data by using the first key, and stores the decrypted sensitive data.

It should be noted that, for the foregoing method embodiments, for the sake of simple description, they are all expressed as a series of action combinations, but those skilled in the art should understand that the present application is not limited by the described action sequence. Because certain steps may be performed in other sequences or concurrently in accordance with the present application. In the following, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation. Based on such understanding, the technical solution of the present application, which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk, The optical disc includes a number of instructions for causing a terminal device (which may be a cell phone, a computer, a server, or a network device, etc.) to perform the methods of various embodiments of the present application.

A person of ordinary skill in the art may understand that all or part of the steps of the foregoing embodiments may be completed by a program to instruct terminal device related hardware, and the program may be stored in a computer readable storage medium, and the storage medium may be Including: flash disk, read-only memory (ROM), random access memory (RAM), disk or optical disk.

Example 11

Embodiments of the present application also provide a storage medium. Optionally, in this embodiment, the foregoing storage medium may be used to save the program code executed by the data processing method provided in Embodiment 2 above.

Optionally, in this embodiment, the foregoing storage medium may be located in any one of the computer terminal groups in the computer network, or in any one of the mobile terminal groups.

In this embodiment, the storage medium is configured to store program code for performing the following steps: the terminal acquires the authentication ciphertext, wherein the authentication ciphertext is a ciphertext generated based on the first key stored by the SIM card in the terminal; The terminal applies for updating the sensitive data to the service server, and sends the encrypted ciphertext to the management server via the service server; the terminal receives the encrypted data sent by the management server via the service server, where the encrypted data is used by the management server. The second key corresponding to the first key is obtained by encrypting the sensitive data provided by the service server; the terminal decrypts the encrypted data by using the first key stored in the SIM card, and stores the decrypted sensitive data. .

Optionally, in this embodiment, the storage medium is configured to store program code for performing the following steps: before the terminal acquires the authentication ciphertext, the terminal receives a trigger message from the service server, where the trigger message is used to trigger The terminal acquires the above authentication ciphertext.

Optionally, in this embodiment, the storage medium is configured to store program code for performing the following steps: the MCU in the terminal receives the trigger message, and when the trigger message is a key update message, the key update function is enabled. And triggering the acquisition of the above authentication ciphertext.

Example 12

An embodiment of the present application also provides a processor. Optionally, in this embodiment, the foregoing processor may be used to execute program code that implements the data processing method provided in Embodiment 2 above.

Optionally, in this embodiment, the processor may be located in any one of the computer terminal groups in the computer network, or in any one of the mobile terminal groups.

In this embodiment, the processor is configured to execute the following steps: the terminal acquires the authentication ciphertext, wherein the authentication ciphertext is a ciphertext generated based on the first key stored in the SIM card in the terminal; The server applies for updating the sensitive data, and sends the encrypted ciphertext to the management server via the service server; the terminal receives the encrypted data sent by the management server via the service server, wherein the encrypted data is used by the management server and the first secret The second key corresponding to the key is obtained by encrypting the sensitive data provided by the service server; the terminal decrypts the encrypted data by using the first key stored in the SIM card, and stores the decrypted sensitive data.

Optionally, in this embodiment, the processor is configured to execute the following steps: before the terminal obtains the authentication ciphertext, the terminal receives a trigger message from the service server, where the trigger message is used to trigger the terminal to acquire The above authentication ciphertext.

Optionally, in this embodiment, the processor is configured to execute the following steps: the MCU in the terminal receives the trigger message, and when the trigger message is a key update message, the key update function is enabled, and the trigger is triggered. Obtain the above authentication ciphertext.

The serial numbers of the embodiments of the present application are merely for the description, and do not represent the advantages and disadvantages of the embodiments.

In the above-mentioned embodiments of the present application, the descriptions of the various embodiments are different, and the parts that are not detailed in a certain embodiment can be referred to the related descriptions of other embodiments.

In the several embodiments provided by the present application, it should be understood that the disclosed technical contents may be implemented in other manners. The device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner. For example, multiple units or components may be combined or may be Integrate into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, unit or module, and may be electrical or otherwise.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application, in essence or the contribution to the prior art, or all or part of the technical solution may be embodied in the form of a software product stored in a storage medium. A number of instructions are included to cause a computer device (which may be a personal computer, server or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present application. The foregoing storage medium includes: a U disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a removable hard disk, a magnetic disk, or an optical disk, and the like. .

The above description is only a preferred embodiment of the present application, and it should be noted that those skilled in the art can also make several improvements and retouchings without departing from the principles of the present application. It should be considered as the scope of protection of this application.

Claims

A data processing system, comprising:

The terminal is provided with a user identity module SIM card, the SIM card stores a first key, and the terminal is configured to send the authentication ciphertext generated based on the first key to the service server;

a service server for providing sensitive data and transmitting the sensitive data to a management server;

The management server is configured to authenticate the authentication ciphertext, and after the authentication is passed, the second key corresponding to the first key encrypts the sensitive data; and the encrypted sensitive data is used to The service server sends the terminal to the terminal, wherein the terminal decrypts the encrypted sensitive data by using the first key stored in the SIM card.
The system according to claim 1, wherein the management server is further configured to generate a random value and send the random value as the first key to the terminal.
A terminal, comprising:

a user identity module SIM card, configured to store a pre-written first key, where the first key is used to generate an authentication ciphertext;

The processor is coupled to the SIM card for storing sensitive data.
The terminal according to claim 3, wherein the processor is configured to send a request for acquiring the authentication ciphertext to the SIM card, and the SIM card is configured to be based on the first secret The key generates an authentication ciphertext and feeds back to the processor.
The terminal according to claim 4, wherein the terminal further comprises:

a communication module, configured to send the authentication ciphertext to the management server via the service server, and receive encrypted data sent by the management server via the service server, where the encrypted data is used by the management server to correspond to the first password The second key is obtained by encrypting the sensitive data;

The processor, by calling the first key stored in the SIM card, decrypts the encrypted data.
The terminal according to claim 5, wherein the first key pre-written by the SIM card is pre-sent to the SIM card by the management server during the production process of the SIM card.
A data processing method, comprising:

The terminal generates authentication information according to the first key in the SIM card;

The terminal applies for acquiring sensitive data to the service server, and sends the authentication information to the management server via the service server;

Receiving, by the terminal, the encrypted data sent by the management server via the service server, wherein the encrypted data is provided by the management server to the service server by using a second key corresponding to the first key Sensitive data is encrypted;

The terminal decrypts the encrypted data according to the first key to obtain the sensitive data.
The method according to claim 7, wherein the first key is a random value generated by the management server and delivered to the terminal.
The method according to claim 7, wherein before the terminal generates the authentication information according to the first key in the SIM card, the method further includes:

The terminal receives a trigger message from the service server, where the trigger message is used to trigger the terminal to acquire the authentication information.
The method according to claim 7, wherein the generating the authentication information by the terminal according to the first key in the SIM card comprises:

The processor in the terminal sends a request for acquiring the authentication information to the SIM card;

The SIM card feeds back the authentication information to the processor according to the request.
The method according to claim 7, wherein said terminal decrypts said encrypted data using said first key stored in said SIM card, and stores said decrypted said sensitive data, said method Also includes:

Receiving, by the terminal, service data sent by the service server, where the service data is service data encrypted by using the sensitive data;

The terminal decrypts the service data using the stored sensitive data.
The method according to claim 11, wherein before the receiving the service data sent by the service server, the method further includes:

The terminal sends a notification message to the service server, where the notification message is used to indicate that the terminal has completed the key update.
A storage medium, characterized in that the storage medium comprises a stored program, wherein the device in which the storage medium is located is controlled to execute the data processing method according to any one of claims 7 to 12 while the program is running.
A processor, wherein the processor is configured to execute a program, wherein the program is executed to execute the data processing method according to any one of claims 7 to 12.
A method for producing a SIM card, comprising:

Launching an application on the SIM card of the subscriber identity module;

The security key delivered by the management server is received by the application and stored in the SIM card.
An identity authentication method, comprising:

The terminal generates authentication information according to the first key in the SIM card;

Transmitting, by the terminal, the authentication information to a management server via a service server;

The management server authenticates the terminal according to the authentication information.
The method according to claim 16, wherein the first key is a random value generated by the management server and delivered to the terminal.
The method according to claim 16, wherein the terminal generates the authentication information according to the first key in the SIM card, including:

The processor in the terminal sends a request for acquiring the authentication information to the SIM card;

The SIM card feeds back the authentication information to the processor according to the request.
An identity authentication method, comprising:

The management server receives the authentication ciphertext forwarded by the terminal via the service server, where the authentication information is generated by the terminal based on the first key stored in the SIM card in the terminal;

The management server authenticates the authentication information.
The method according to claim 19, wherein before the management server receives the authentication information that is forwarded by the terminal via the service server, the method further includes:

The management server sends the first key to a SIM card of the terminal.
A data processing method, comprising:

The terminal receives the encrypted data sent by the management server via the service server, wherein the encrypted data is obtained by using the second key by the management server to encrypt the sensitive data provided by the service server; the second key is a key corresponding to the first key stored in the SIM card of the user identity module in the terminal;

The terminal decrypts the encrypted data using the first key, and stores the decrypted sensitive data.
A data processing method, comprising:

The terminal generates the authentication information according to the first key in the security module;

The terminal applies for acquiring sensitive data to the service server, and sends the authentication information to the management server via the service server;

Receiving, by the terminal, the encrypted data sent by the management server via the service server, wherein the encrypted data is provided by the management server to the service server by using a second key corresponding to the first key Sensitive data is encrypted;

The terminal decrypts the encrypted data according to the first key to obtain the sensitive data.
An identity authentication method, comprising:

The terminal generates the authentication information according to the first key in the security module;

Transmitting, by the terminal, the authentication information to a management server via a service server;

The management server authenticates the terminal according to the authentication information.
An identity authentication method, comprising:

The management server receives the authentication information that is forwarded by the terminal via the service server, where the authentication information is generated by the terminal based on the first key stored by the security module in the terminal;

The management server authenticates the authentication information.
A data processing method, comprising:

The terminal receives the encrypted data sent by the management server via the service server, wherein the encrypted data is obtained by using the second key by the management server to encrypt the sensitive data provided by the service server; the second key is a key corresponding to the first key stored in the security module in the terminal;

The terminal decrypts the encrypted data using the first key, and stores the decrypted sensitive data.