WO2021238989A1 - 一种空中下载方法和相关设备 - Google Patents

一种空中下载方法和相关设备 Download PDF

Info

Publication number
WO2021238989A1
WO2021238989A1 PCT/CN2021/096087 CN2021096087W WO2021238989A1 WO 2021238989 A1 WO2021238989 A1 WO 2021238989A1 CN 2021096087 W CN2021096087 W CN 2021096087W WO 2021238989 A1 WO2021238989 A1 WO 2021238989A1
Authority
WO
WIPO (PCT)
Prior art keywords
usim card
parasitic
virtual
virtual parasitic
terminal
Prior art date
Application number
PCT/CN2021/096087
Other languages
English (en)
French (fr)
Inventor
官仕国
刘霞玲
彭羽
邓春梅
曹明
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2021238989A1 publication Critical patent/WO2021238989A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/18—Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
    • H04W8/183—Processing at user equipment or user record carrier
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/40—Security arrangements using identity modules
    • H04W12/42—Security arrangements using identity modules using virtual identity modules
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/16—Discovering, processing access restriction or access information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/18—Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/18—Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
    • H04W8/20—Transfer of user or subscriber data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/18—Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
    • H04W8/20—Transfer of user or subscriber data
    • H04W8/205—Transfer to or from user equipment or user record carrier

Definitions

  • This application relates to the field of wireless communication technology, and in particular to an over-the-air download method and related equipment.
  • SIM subscriber identity module
  • the SIM card is also called a user identification card or a user identification card.
  • the SIM card can be connected to a 2G network or a 3G network, but cannot be connected to a 4G network. This makes it difficult for terminals equipped with SIM cards to migrate to 4G networks.
  • the present application provides an over-the-air download method and related equipment, which can access a new wireless network without replacing the SIM card, thereby improving the flexibility of the user to switch to the network.
  • the over-the-air download method can provide good security by binding the SIM card and the virtual parasitic USIM card.
  • the first aspect provides an over-the-air download method, which is applied to a terminal with a SIM card and a TEE; in this method, the terminal sends a virtual parasitic USIM card application message to the over-the-air download OTA server, and the OTA server applies for the virtual parasitic USIM card
  • the message obtains the virtual parasitic USIM card data and binding identification, and then sends the virtual parasitic USIM card data and binding identification to the terminal; when the SIM card is in place, the terminal activates the virtual parasitic USIM card data and binding identification in the TEE Parasitic USIM card, deactivate the SIM card.
  • the SIM card supports the first wireless network and does not support the second wireless network.
  • the first wireless network and the second wireless network have different communication standards.
  • the first wireless network is a 2G network or a 3G network
  • the second wireless network is 4G.
  • the virtual parasitic USIM card application message carries the identity of the SIM card.
  • the binding identifier is used to identify that the virtual parasitic USIM card and the SIM card have a binding relationship, and the virtual parasitic USIM card and the SIM card correspond to the same MSISDN.
  • the virtual parasitic USIM card is used to access the second wireless network.
  • the user can access the second wireless network through the virtual parasitic USIM card without changing the SIM card. Therefore, a simple and convenient method of network transfer is provided, and the network can be guaranteed by binding the SIM card and the virtual parasitic USIM card Security. In addition, by binding the SIM card and the virtual parasitic USIM card, the user can still use the original operator's network, which can prevent the user from switching to another operator's network.
  • the short message sent by the OTA server is received before sending the virtual parasitic USIM card application message to the OTA server.
  • the short message is used to notify the terminal to apply for a virtual parasitic USIM card. In this way, the user can be reminded through a short message to switch to the network without changing the card, and the user experience can be improved.
  • the first identity authentication request before receiving the virtual parasitic USIM card data and binding identifier sent by the OTA server, the first identity authentication request is sent to the OTA server, and the first identity authentication request carries the SIM card identifier and the first identity authentication request.
  • Security key receiving the first identity authentication result sent by the OTA server, where the first identity authentication result includes the second security key or a failed verification message.
  • the second security key is sent to the OTA server when the BSS determines that the SIM card identity and the first security key are legal, and the failed verification message is when the BSS determines that the SIM card identity and the first security key are illegal Sent to the OTA server.
  • the first identity authentication result is obtained by the BSS according to the identity of the SIM card and the second security key. In this way, it can be judged whether the terminal with the SIM card is legal, so as to prevent the SIM card from being stolen or counterfeited.
  • the terminal after activating the virtual parasitic USIM card, the terminal sends a second identity authentication request to the OTA server, and the second identity authentication request Carrying the virtual parasitic USIM card data, the SIM card identification and the second security key; the OTA server sends the second identity authentication request to the BSS, and the BSS performs the processing according to the virtual parasitic USIM card data, the SIM card identification and the second security key
  • the second identity authentication result is obtained after the authentication, and after the BSS sends the second identity authentication result to the OTA server, the terminal receives the second identity authentication result sent by the OTA server.
  • the terminal after activating the virtual parasitic USIM card, the terminal can be re-identified according to the virtual parasitic USIM card data, the identity of the SIM card, and the second security key to prevent the SIM card or the virtual parasitic USIM card from being stolen, thereby improving over-the-air downloads Security.
  • the terminal sends a location update request to the HSS, and the HSS generates a first location update notification according to the location update request; the terminal sends a second location update notification to the OTA server; the OTA server receives the notification sent by the HSS After the first location update notification and when the second location update notification is received within the set time period, the location update complete message is sent to the terminal; the OTA server receives the first location update notification sent by the HSS and within the set time period When the second location update notification is not received, the virtual parasitic USIM card is deactivated; then the virtual parasitic USIM card abnormality notification is sent to the terminal; the terminal deactivates the virtual parasitic USIM card and activates the SIM card according to the virtual parasitic USIM card abnormality notification.
  • the terminal can send a second location update notification to the OTA server after the location update, and the second location update notification carries the virtual parasitic USIM card data and the SIM card identifier. If the terminal using the virtual parasitic USIM card only has the virtual parasitic USIM card data and does not configure the application to manage the virtual parasitic USIM card, the card theft terminal will not send the second location update notification to the OTA server, so that the OTA server can determine the theft Card terminal, and send a virtual parasitic USIM card exception notification to the legitimate terminal to warn that the virtual parasitic USIM card has been stolen. After the OTA server deactivates the virtual parasitic USIM card, the card stealing terminal cannot use the virtual parasitic USIM card to access the network.
  • the legal terminal can apply to the OTA server for the virtual parasitic USIM card again to access the network.
  • the OTA server can synchronize the deactivation state of the virtual parasitic USIM card to other devices on the network side, such as HSS and BSS.
  • the virtual parasitic USIM card when the virtual parasitic USIM card is abnormal, for example, the virtual parasitic USIM card data stored in the terminal is inconsistent with the virtual parasitic USIM card data stored in the server, or the virtual parasitic USIM card data stored in the terminal is damaged.
  • the terminal sends a detach request to the HSS; receives the detach response sent by the HSS; activates the SIM card according to the detach response; sends a virtual parasitic USIM card deactivation message to the OTA server; receives the virtual parasitic USIM card deactivation response sent by the OTA server;
  • the virtual parasitic USIM card deactivation response sets the virtual parasitic USIM card to the deactivated state.
  • the detach response is used to indicate that the virtual parasitic USIM card is in the detach state.
  • the terminal and network equipment can automatically deactivate the virtual parasitic USIM card.
  • the terminal when the terminal receives the deactivation instruction, it sends a detach request to the HSS; after the HSS generates a detach response according to the detach request, the terminal receives the detach response sent by the HSS; according to the detach
  • the virtual parasitic USIM card deactivation message is sent to the OTA server; the virtual parasitic USIM card deactivation response sent by the OTA server is received; the virtual parasitic USIM card is set to the deactivated state according to the virtual parasitic USIM card deactivation response.
  • the detach response is used to indicate that the virtual parasitic USIM card is in the detach state. In this way, after the user manually enters the deactivation instruction, the terminal and network equipment can deactivate the virtual parasitic USIM card.
  • the virtual parasitic USIM card is activated in the TEE according to the virtual parasitic USIM card data and binding identifier, when the SIM card is not in place, the virtual parasitic USIM card is deactivated.
  • the virtual parasitic USIM card and the SIM card can only be activated when they are in the same terminal, otherwise they cannot be activated, so that the virtual parasitic USIM card cannot be used without the SIM card, thereby improving the security of the virtual parasitic USIM card.
  • the virtual parasitic USIM card is activated in the TEE according to the virtual parasitic USIM card data and binding identifier, when the SIM card is not in place for a period of time longer than a preset period of time, the virtual parasitic USIM card is deleted.
  • the virtual parasitic USIM card and the SIM card can only be activated when they are in the same terminal, otherwise they cannot be activated, so that the virtual parasitic USIM card cannot be used without the SIM card, thereby improving the security of the virtual parasitic USIM card.
  • a service query request is sent to the BSS, and the service query request is used to query whether there is a service to be activated in the BSS;
  • the query result is that there is a service to be activated in the BSS, activate the virtual parasitic USIM card corresponding to the SIM card;
  • the terminal can automatically detect whether a virtual parasitic USIM card corresponding to the SIM card is configured, and automatically activate the virtual parasitic USIM card to access the second wireless network.
  • the second aspect provides an over-the-air download method applied to an OTA server.
  • a virtual parasitic USIM card application message sent by a terminal is received; the virtual parasitic USIM card data and binding identifier are obtained according to the virtual parasitic USIM card application message; The virtual parasitic USIM card data and the binding identification are sent to the terminal, so that the terminal activates the virtual parasitic USIM card according to the virtual parasitic USIM card data and the binding identification terminal.
  • the virtual parasitic USIM card application message carries the identification of the SIM card of the terminal.
  • the binding identifier is used to identify the binding relationship between the virtual parasitic USIM card and the SIM card.
  • the terminal has a SIM card and a TEE.
  • the SIM card supports the first wireless network and does not support the second wireless network.
  • the first wireless network and the second wireless network have different communication standards.
  • the first wireless network is a 2G network or 3G.
  • the second wireless network is a 4G network, a 5G network, or a wireless communication network
  • the OTA server can provide the virtual parasitic USIM card data and binding relationship to the terminal.
  • the terminal activates the virtual parasitic USIM card according to the virtual parasitic USIM card data and the binding identification terminal, so that the user can pass the virtual parasitic USIM without replacing the SIM card
  • the card accesses the second wireless network, so it provides a simple and convenient method for network transfer, and the security of the network transfer can be guaranteed by binding the SIM card and the virtual parasitic USIM card.
  • the user can still use the original operator's network, which can prevent the user from switching to another operator's network.
  • obtaining the virtual parasitic USIM card data and binding identifier according to the virtual parasitic USIM card application message includes: according to the SIM card identifier carried in the virtual parasitic USIM card application message, from a locally stored virtual parasitic USIM card file Obtain the virtual parasitic USIM card data and binding identification in the.
  • the OTA server may receive the interface file sent by the BSS or HSS.
  • the interface file includes but is not limited to the virtual parasitic USIM card data and the binding relationship between the SIM card and the virtual parasitic USIM card. In this way, the OTA server can directly provide the virtual parasitic USIM card data and binding identification to the terminal.
  • obtaining the virtual parasitic USIM card data and binding identifier according to the virtual parasitic USIM card application message includes: sending the virtual parasitic USIM card application message to the BSS; and the BSS obtains the virtual parasitic USIM card application message according to the virtual parasitic USIM card application message. After the parasitic USIM card data and the virtual parasitic USIM card data and the binding identification of the SIM card, the virtual parasitic USIM card data and the binding identification are sent to the OTA server. In this way, the OTA server can obtain the virtual parasitic USIM card data and binding identifier from the BSS.
  • the OTA server sends a short message to the terminal.
  • the short message is used to instruct the terminal to send a virtual parasitic USIM card application message to the OTA server.
  • the first identity authentication request sent by the terminal is received, and the first identity authentication request is sent to the BSS; the BSS performs the process according to the identity of the SIM card and the first security key carried in the first identity authentication request.
  • Authentication is to send the first identity authentication result obtained by the authentication to the OTA server.
  • the OTA server After receiving the first identity authentication result sent by the BSS, the OTA server sends the first identity authentication result to the terminal.
  • the OTA server after the OTA server sends the first identity authentication request to the BSS, when the BSS determines that the terminal is legitimate, the OTA server receives the second security key sent by the BSS, and sends the second security key To the terminal; receive the second identity authentication request sent by the terminal, the second identity authentication request carries the virtual parasitic USIM card data, the identity of the SIM card and the second security key; send the second identity authentication request to the BSS; the BSS according to the virtual Parasitic USIM card data, SIM card identification and second security key are authenticated, and the second identity authentication result obtained by the authentication is sent to the OTA server.
  • the virtual parasitic USIM card deactivation message sent by the terminal is received; the virtual parasitic USIM card deactivation message is sent to the BSS; the virtual parasitic USIM card deactivation complete message sent by the BSS is received; The USIM card deactivation complete message sets the state of the locally stored USIM card to the deactivated state; the virtual parasitic USIM card deactivation complete message is sent to the terminal.
  • the virtual parasitic USIM card receives the first location update notification sent by the HSS; start counting from the moment when the first location update notification sent by the HSS is received; in another possible implementation manner, when the When the second location update notification is not received within the time period, the virtual parasitic USIM card is deactivated; then, the virtual parasitic USIM card abnormality notification is sent to the terminal. When the second location update notification sent by the terminal is received within the set time period, the virtual parasitic USIM card sends a location update completion message to the terminal.
  • the card theft terminal will not send the second location update notification to the OTA server, so that the OTA server can determine the theft Card terminal, and send a virtual parasitic USIM card exception notification to the legitimate terminal to warn that the virtual parasitic USIM card has been stolen.
  • the OTA server deactivates the virtual parasitic USIM card, the card stealing terminal cannot use the virtual parasitic USIM card to access the network.
  • a terminal in a third aspect, includes a receiving module, a processing module, a sending module, a SIM card, and a TEE; the sending module is used to send a virtual parasitic USIM card application message to an OTA server, and the virtual parasitic USIM card application message carries the SIM of the terminal
  • the identification of the card the receiving module is used to receive the virtual parasitic USIM card data and binding identification sent by the OTA server.
  • the virtual parasitic USIM card data is obtained by the OTA server from the business support system BSS.
  • the binding identification is used to identify the virtual parasitic USIM card and
  • the SIM card has a binding relationship.
  • the virtual parasitic USIM card and the SIM card correspond to the same MSISDN; the processing module is used to activate the virtual parasitic USIM card in the TEE according to the virtual parasitic USIM card data and binding identifier when the SIM card is in place.
  • the USIM card is used to access the second wireless network and then deactivate the SIM card.
  • the receiving module is further configured to receive a short message sent by the OTA server before the sending module sends a virtual parasitic USIM card application message to the OTA server.
  • the short message is used to notify the terminal to apply for the virtual parasitic USIM card.
  • the sending module is also used to send a first identity authentication request to the OTA server, the first identity authentication request carries the identity of the SIM card and the first security key; the receiving module is also used to receive OTA The second security key sent by the server or a failed verification message.
  • the second security key is sent to the OTA server when the BSS determines that the SIM card ID and the first security key are valid.
  • the failed verification message is determined by the BSS
  • the identity of the SIM card and the first security key are sent to the OTA server when the identity of the SIM card is illegal.
  • the receiving module is further configured to send a second identity authentication request to the OTA server after receiving the second security key sent by the OTA server, the second identity authentication request carrying virtual parasitic USIM card data , The identity of the SIM card and the second security key; receiving the second identity authentication result sent by the OTA server.
  • the sending module is also used to send a detach request to the home subscriber server HSS when the receiving module receives the deactivation instruction; the receiving module is also used to receive the detach response sent by the HSS, and detach The response is used to indicate that the virtual parasitic USIM card is in the detached state; the processing module is also used to activate the SIM card according to the detach response; the processing module is also used to send a virtual parasitic USIM card deactivation message to the OTA server; the receiving module is also used to receive OTA The virtual parasitic USIM card deactivation response sent by the server; the processing module is also used to set the virtual parasitic USIM card to the deactivated state according to the virtual parasitic USIM card deactivation response.
  • the sending module is also used to send a detach request to the home user server HSS when an abnormality of the virtual parasitic USIM card is detected; the receiving module is also used to receive a detach response sent by the HSS to detach The response is used to indicate that the virtual parasitic USIM card is in the detached state; the processing module is also used to activate the SIM card according to the detach response; the processing module is also used to send a virtual parasitic USIM card deactivation message to the OTA server; the receiving module is also used to receive OTA The virtual parasitic USIM card deactivation response sent by the server; the processing module is also used to set the virtual parasitic USIM card to the deactivated state according to the virtual parasitic USIM card deactivation response.
  • the sending module is also used to send a location update request to the HSS, the location update request is used for the HSS to generate a first location update notification; the sending module is also used to send a second location update notification to the OTA server
  • the receiving module is also used to receive the virtual parasitic USIM card abnormal notification sent by the OTA server.
  • the virtual parasitic USIM card abnormal notification is the OTA server after receiving the first location update notification sent by the HSS and not receiving the second Sent in the case of a location update notification; the processing module is also used to activate the virtual parasitic USIM card and activate the SIM card according to the virtual parasitic USIM card abnormality notification.
  • the receiving module is also used to receive a location update complete message sent by the OTA server.
  • the processing module is also used to deactivate the virtual parasitic USIM when the SIM card is not in place after the processing module activates the virtual parasitic USIM card in the TEE according to the virtual parasitic USIM card data and binding identifier. Card.
  • the processing module is also used for after the processing module activates the virtual parasitic USIM card in the TEE according to the virtual parasitic USIM card data and binding identifier, when the SIM card is not in place for longer than the preset time period , Delete the virtual parasitic USIM card.
  • the sending module is also used to send a service query request to the BSS when the SIM card is in place and there is a virtual parasitic USIM card corresponding to the SIM card, and the service query request is used to query whether it is in the BSS There is a service to be activated; the receiving module is also used to receive the query result; the processing module is also used to activate the virtual parasitic USIM card corresponding to the SIM card when the query result is that there is a service to be activated in the BSS; when the SIM card is in place and not configured When the virtual parasitic USIM card corresponding to the SIM card is triggered, the sending module is triggered to send the virtual parasitic USIM card application message to the OTA server.
  • a fourth aspect provides an OTA server.
  • the OTA server includes a receiving module, a processing module, and a sending module; the receiving module is used to receive a virtual parasitic USIM card application message sent by a terminal, and the virtual parasitic USIM card application message carries the identification of the SIM card of the terminal.
  • the processing module is used to obtain the virtual parasitic USIM card data and binding identification according to the virtual parasitic USIM card application message; the sending module is used to send the virtual parasitic USIM card data and binding identification to the terminal, the virtual parasitic USIM card data and binding identification Used for the terminal to activate the virtual parasitic USIM card.
  • the processing module is specifically configured to obtain the virtual parasitic USIM card data and binding identification from the locally stored virtual parasitic USIM card file according to the SIM card identifier carried in the virtual parasitic USIM card application message.
  • the processing module is specifically configured to send the virtual parasitic USIM card application message to the BSS; receive the virtual parasitic USIM card data and the binding identifier sent by the BSS.
  • the sending module is also used to send a short message to the terminal, and the short message is used to instruct the terminal to send a virtual parasitic USIM card application message to the OTA server.
  • the receiving module is also used to receive the first identity authentication request sent by the terminal, the first identity authentication request carries the identity of the SIM card and the first security key; the sending module is also used to send The first identity authentication request is sent to the BSS; the receiving module is also used to receive the first identity authentication result sent by the BSS. The first identity authentication result is obtained by the BSS according to the identity of the SIM card and the first security key; the sending module also uses Yu sends the first identity authentication result to the terminal.
  • the receiving module is further configured to receive a second identity authentication request sent by the terminal when the first identity authentication result includes the second security key, and the second identity authentication request carries a virtual parasitic USIM card data, SIM card identification and second security key; the sending module is also used to send the second identity authentication request to the BSS; the receiving module is also used to receive the second identity authentication result sent by the BSS, the second identity authentication result It is obtained by the BSS according to the virtual parasitic USIM card data, the SIM card identification and the second security key.
  • the receiving module is also used to receive the virtual parasitic USIM card deactivation message sent by the terminal; the sending module is also used to send the virtual parasitic USIM card deactivation message to the BSS; the receiving module is also used to receive The virtual parasitic USIM card deactivation complete message sent by the BSS; the processing module is also used to set the locally stored USIM card status to the deactivated state according to the virtual parasitic USIM card deactivation complete message; the sending module is also used to set the virtual parasitic USIM card The deactivation complete message is sent to the terminal.
  • the receiving module is also used to receive the first location update notification sent by the HSS; the processing module is also used to start timing from the moment when the first location update notification sent by the HSS is received; the sending module also uses When the second location update notification sent by the terminal is not received within the set time period, the virtual parasitic USIM card abnormality notification is sent to the terminal.
  • the sending module is further configured to send a virtual parasitic USIM card sending location update complete message to the terminal when the second location update notification sent by the terminal is received within a set time period.
  • a fifth aspect provides a terminal.
  • the terminal includes a processor and a memory.
  • the memory is used to store program code.
  • the processor calls the program code, the processor can execute the first aspect or the first aspect in the possible implementation manners of the first aspect. A step of.
  • a sixth aspect provides an OTA server.
  • the OTA server includes a processor and a memory.
  • the memory is used to store program code.
  • the processor calls the program code, the processor can execute the second aspect or the possible implementation of the second aspect. Steps performed by the OTA server.
  • a seventh aspect provides a computer-readable storage medium.
  • the computer-readable storage medium stores instructions that, when run on a computer, cause the computer to execute the methods of the above aspects.
  • the eighth aspect provides a computer program product containing instructions, which when run on a computer, causes the computer to execute the methods of the above aspects.
  • a ninth aspect provides a chip system that includes a processor for supporting the terminal to implement the functions involved in the above aspects, for example, sending or processing the data and/or information involved in the above-mentioned over-the-air download method.
  • the chip system further includes a memory, and the memory is used to store program instructions and data necessary for the air download method.
  • the chip system can be composed of chips, and can also include chips and other discrete devices.
  • Figure 1 is a schematic diagram of a wireless communication system to which the aerial download method in this application is applied;
  • FIG. 2 is a schematic diagram of the structure of the terminal in this application.
  • Figure 3 is a signaling interaction diagram of the over-the-air download method in this application.
  • Figure 4 is another signaling interaction diagram of the over-the-air download method in this application.
  • FIG. 5 is a signaling interaction diagram of the identity authentication method in this application.
  • FIG. 6 is another signaling interaction diagram of the identity authentication method in this application.
  • Figure 7 is another signaling interaction diagram of the over-the-air download method in this application.
  • Figure 8 is another signaling interaction diagram of the over-the-air download method in this application.
  • Figure 9 is a signaling interaction diagram of the over-the-air download method in this application.
  • Figure 10 is another structural diagram of the terminal in this application.
  • Figure 11 is a structural diagram of the over-the-air download server in this application.
  • the over-the-air download method of this application can be applied to a wireless communication system.
  • the wireless communication system may include a terminal, an over-the-air (OTA) server, a business support system (BSS), a home subscriber server (HSS), and so on.
  • OTA over-the-air
  • BSS business support system
  • HSS home subscriber server
  • a wireless communication system includes a terminal 10, a first wireless network 20, a second wireless network 30, an OTA server 40, a BSS50 and an HSS60.
  • the terminal 10 has a SIM card and a trusted execution environment (TEE).
  • the SIM card supports the first wireless network and does not support the second wireless network.
  • the first wireless network 20 is a 2G network or a 3G network
  • the second wireless network 30 is a 4G network or a wireless communication network after 4G.
  • the terminal 10 can access the first wireless network 20 by using the SIM card, so that the terminal 10, the OTA server 30, the BSS 50 and the HSS 60 can communicate through the first wireless network 20.
  • TEE is an independent secure operating environment set in the terminal 10.
  • TEE provides a trusted application (TA) secure execution environment, while also ensuring the confidentiality, integrity and access of TA's resources and data. Permissions.
  • TA trusted application
  • each TA is independent of each other and cannot access each other without authorization.
  • the terminal 10 can implement a virtual global subscriber identity module (USIM) by using TEE, that is, write the data of the USIM card into the preset memory of the terminal 10, so as to access the second wireless network by simulating the real USIM card.
  • the terminal 10, the OTA server 40, the BSS 50 and the HSS 60 can communicate through the second wireless network 30.
  • the technology for the terminal 10 to implement the USIM card by using the TEE may be implemented based on the TEE-embedded subscriber identification module (eSIM).
  • the terminal 10 may also include a rich operating system (Rich OS), which may be, but not limited to, an Android operating system, an Apple operating system, or a Windows operating system. Among them, the software and hardware resources that TEE can access are separated from Rich OS.
  • the terminal may also be called a terminal device, a mobile terminal, a wireless communication terminal, a wireless communication device, and so on.
  • the terminal 10 can be, but is not limited to, a mobile phone, a tablet computer, a desktop computer, a smart watch, an Internet of Things device, or a vehicle-mounted computer.
  • the OTA server 40 can remotely manage the SIM card application program and/or the SIM card data in the terminal 10 through the air interface of the wireless communication system. For example, the OTA server 40 and the terminal 10 can dynamically download, delete, and update SIM card applications and data through short messages.
  • BSS50 is used to implement functions such as business processing and billing.
  • HSS60 is used for user authentication and authorization, storage of the physical location of the terminal, etc.
  • the terminal 10 includes a processor 101, a memory 102, a SIM card 103, a receiver 104, and a transmitter 105.
  • the processor 101, The memory 102, the SIM card 103, the receiver 104 and the transmitter 105 are connected by a bus 106.
  • the processor 101 may be a central processing unit (CPU), other general-purpose processors, digital signal processors (digital signal processors, DSP), application specific integrated circuits (ASICs), ready-made Field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc.
  • the general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like.
  • the memory 102 may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory can be read-only memory (ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), and electrically accessible memory. Erase programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • the volatile memory may be random access memory (RAM), which is used as an external cache.
  • RAM random access memory
  • static RAM static random access memory
  • dynamic RAM dynamic RAM
  • DRAM dynamic random access memory
  • synchronous dynamic random access memory synchronous DRAM, SDRAM
  • double data rate synchronous dynamic random access memory double data rate SDRAM, DDR SDRAM
  • enhanced synchronous dynamic random access memory enhanced SDRAM, ESDRAM
  • synchronous connection dynamic random access memory direct rambus RAM, DRRAM
  • direct rambus RAM direct rambus RAM
  • the memory 102 may be (storage unit) integrated in the processor 101 middle. It should be noted that the memory 102 described herein is intended to include, but is not limited to, these and any other suitable types of memory.
  • the receiver 104 is used for receiving information, and the transmitter 105 is used for sending information.
  • the receiver 104 and the transmitter 105 may be independent of each other or integrated.
  • a connected radio frequency unit and antenna are usually used to implement the functions of the receiver 104 and the transmitter 105.
  • the processor 101 can execute the over-the-air download method in the following embodiments.
  • an embodiment of the over-the-air download method includes:
  • Step 301 The OTA server receives the interface file sent by the BSS.
  • the operator can record user account opening information (such as the SIM card identification of the terminal) in the BSS or HSS, and can configure corresponding virtual parasitic USIM card data according to the user account opening information.
  • the BSS or HSS can send an interface file to the OTA server.
  • the interface file includes the data of the virtual parasitic USIM card and the binding relationship between the virtual parasitic USIM card and the SIM card.
  • the binding relationship between the virtual parasitic USIM card and the SIM card can also be referred to as the correspondence between the virtual parasitic USIM card and the SIM card, which is used to indicate that the virtual parasitic USIM card and the SIM card correspond one-to-one.
  • the OTA server can store the virtual parasitic USIM card data and the binding relationship between the virtual parasitic USIM card and the SIM card locally, that is, the locally stored virtual parasitic USIM card file.
  • Step 302 The terminal sends a virtual parasitic USIM card application message to the OTA server, and the virtual parasitic USIM card application message carries the identity of the SIM card.
  • the terminal has a SIM card and a TEE, and the SIM card supports the first wireless network but does not support the second wireless network.
  • the first wireless network is a low-generation wireless network.
  • the first wireless network may be a 2G network or a 3G network
  • the second wireless network may be a 4G network, a 5G network, or a network after 5G.
  • the identity of the SIM card includes an integrated circuit card identity (ICCID) and/or an international mobile subscriber identity (IMSI).
  • ICCID integrated circuit card identity
  • IMSI international mobile subscriber identity
  • Step 303 The OTA server obtains the virtual parasitic USIM card data and binding identifier from the locally stored virtual parasitic USIM card file according to the SIM card identifier.
  • the virtual parasitic USIM card file records the binding relationship between several virtual parasitic USIM cards and SIM cards.
  • the OTA server can determine the virtual parasitic USIM card data and the binding identification corresponding to the identification of the SIM card according to the binding relationship therein.
  • the virtual parasitic USIM card data includes ICCID, IMSI, authentication key OPC, authentication key Ki, public land mobile network (public land mobile network, PLMN) identification, and local public land mobile network (home PLMN, HPLMN) identification. One or more.
  • Step 304 The OTA server sends the virtual parasitic USIM card data and the binding identifier to the terminal.
  • Step 305 When the SIM card is in place, activate the virtual parasitic USIM card in the trusted execution environment TEE according to the virtual parasitic USIM card data and binding identifier.
  • Step 306 Deactivate the SIM card.
  • the terminal can use the virtual parasitic USIM card to access a new wireless network without replacing the SIM card, which improves the flexibility and feasibility of the user's network switching.
  • the security of network transfer can be improved by binding the SIM card and the virtual parasitic USIM card.
  • the user can continue to use the original operator's network, avoiding the user's transfer to another operator's network, which is beneficial for the operator to use the aerial download method of this application to transfer to the network.
  • the above OTA server is pre-configured with the virtual parasitic USIM card file.
  • another embodiment of the over-the-air download method provided by the present application includes:
  • Step 401 The terminal sends a virtual parasitic USIM card application message to the OTA server, and the virtual parasitic USIM card application message carries the identity of the SIM card.
  • the terminal has a SIM card and a TEE, and the SIM card supports the first wireless network but does not support the second wireless network.
  • the first wireless network is a low-generation wireless network.
  • the first wireless network may be a 2G network or a 3G network
  • the second wireless network may be a 4G network, a 5G network, or a network after 5G.
  • the identity of the SIM card includes an integrated circuit card identity (ICCID) and/or an international mobile subscriber identity (IMSI).
  • ICCID integrated circuit card identity
  • IMSI international mobile subscriber identity
  • Step 402 The OTA server sends a virtual parasitic USIM card application message to the BSS.
  • Step 403 The BSS generates a virtual parasitic USIM card according to the virtual parasitic USIM card application message, and binds the virtual parasitic USIM card with the SIM card.
  • the BSS may also send the virtual parasitic USIM card data and the identification of the SIM card to the HSS, and the HSS establishes the binding relationship between the virtual parasitic USIM card and the SIM card.
  • the virtual parasitic USIM card and the SIM card correspond to the same mobile subscriber integrated service digital network number (MSISDN). Take the mobile phone as an example, MSISDN is the mobile phone number assigned by the operator.
  • Step 404 The BSS sends the virtual parasitic USIM card data and binding identifier to the OTA server.
  • the BSS After the BSS binds the virtual parasitic USIM card and the SIM card, it can send the virtual parasitic USIM card data and the binding identifier to the OTA server.
  • the binding identifier is used to identify that the virtual parasitic USIM card and the SIM card have a binding relationship.
  • Step 405 The OTA server sends the virtual parasitic USIM card data and binding identifier to the terminal.
  • the OTA server After receiving the virtual parasitic USIM card data and the binding identifier sent by the BSS, the OTA server sends the virtual parasitic USIM card data and the binding identifier to the terminal.
  • Step 406 When the SIM card is in place, activate the virtual parasitic USIM card in the trusted execution environment TEE according to the virtual parasitic USIM card data and binding identifier.
  • the presence of the SIM card means that the SIM card is correctly inserted into the card slot. If the SIM card is in place, a virtual parasitic USIM card is created in the TEE according to the virtual parasitic USIM card data and binding identifier, and the virtual parasitic USIM card is activated, so that the virtual parasitic USIM card can be used to access the second wireless network to process services.
  • the SIM card If the SIM card is not in place, it indicates that the SIM card has been pulled out, or the SIM card is not correctly inserted into the card slot. Even if the terminal receives the virtual parasitic USIM card data and binding identifier sent by the OTA server, the virtual parasitic USIM card is not activated. Optionally, when the terminal receives the virtual parasitic USIM card data and does not receive the binding identifier, the virtual parasitic USIM card is not activated.
  • Step 407 Deactivate the SIM card.
  • the terminal can use the virtual parasitic USIM card to access a new wireless network without replacing the SIM card, which improves the flexibility and feasibility of the user's network switching.
  • the security of network transfer can be improved by binding the SIM card and the virtual parasitic USIM card.
  • the user can continue to use the original operator's network, avoiding the user's transfer to another operator's network, which is beneficial for the operator to use the aerial download method of this application to transfer to the network.
  • the present application may also execute the method in the following embodiment.
  • the above-mentioned over-the-air download method before sending the virtual parasitic USIM card application message to the OTA server, the above-mentioned over-the-air download method further includes: receiving a short message sent by the OTA server.
  • the OTA server queries which terminals are terminals with a SIM card and a trusted execution environment, and then sends a short message to the terminal with a SIM card and a trusted execution environment.
  • the short message is used to notify the terminal to apply for a virtual parasitic USIM card . In this way, the user can be reminded through a short message to switch to the network without changing the card, and the user experience can be improved.
  • the above-mentioned over-the-air download method further includes: deactivating the virtual parasitic USIM card when the SIM card is not in place .
  • the terminal may also send a virtual parasitic USIM card deactivation message to the network side device to deactivate the virtual parasitic USIM card. For details, see the related description in the embodiment shown in FIG. 7 or the alternative embodiment.
  • the above-mentioned over-the-air download method further includes: when the SIM card is not in place for longer than a preset period of time, Delete the virtual parasitic USIM card.
  • the virtual parasitic USIM card and the SIM card can only be activated when they are in the same terminal, otherwise they cannot be activated, so that the virtual parasitic USIM card cannot be used without the SIM card, thereby improving the security of the virtual parasitic USIM card.
  • the above-mentioned over-the-air download method further includes: when the SIM card is in place and there is a virtual parasitic USIM card corresponding to the SIM card, sending a service query request to the BSS. To query whether there is a service to be activated in the BSS; when the result of the query is that there is a service to be activated in the BSS, activate the virtual parasitic USIM card corresponding to the SIM card; when the SIM card is in place and the virtual parasitic USIM corresponding to the SIM card is not configured When stuck, step 401 is triggered.
  • the terminal can automatically detect whether a virtual parasitic USIM card corresponding to the SIM card is configured, and automatically activate the virtual parasitic USIM card to access the second wireless network.
  • the user can also input instructions to the terminal to initiate a virtual parasitic USIM card application.
  • this application can also perform identity authentication on the SIM card.
  • the identity authentication process can be performed before or after any one of steps 401 to 407, or after the OTA server sends a short message to the terminal.
  • FIG. 5 another embodiment of the over-the-air download method provided by the present application includes:
  • Step 501 The terminal sends a first identity authentication request to the OTA server, where the first identity authentication request carries the identity of the SIM card and the first security key.
  • the first security key can be used on the terminal to encrypt the information carried in the access request.
  • the server receives the access request sent by the terminal, the first security key can be used to decrypt the information carried, such as the identification of the SIM card. Encryption and decryption.
  • Step 502 The OTA server sends the first identity authentication request to the BSS.
  • Step 503 The BSS performs identity authentication according to the identity of the SIM card and the first security key.
  • step 504 is executed; when the identity of the SIM card and the first security key are invalid At that time, step 506 is executed.
  • the BSS performs identity authentication according to the identity of the SIM card and the first security key, and obtains the first identity authentication result.
  • the first identity authentication result may include the second security key and/or a pass verification message.
  • the second security key is different from the first security key.
  • the first identity authentication result is a failed verification message.
  • the BSS and OTA can reject the access of the terminal where the SIM card is located.
  • Step 504 The BSS sends the first identity authentication result including the second security key to the OTA server.
  • Step 505 The OTA server sends the first identity authentication result including the second security key to the terminal.
  • Step 506 The BSS sends a failed verification message to the OTA server.
  • Step 507 The OTA server sends a failed verification message to the terminal.
  • the BSS can perform identity authentication according to the identity of the SIM card and the first security key carried in the identity authentication request, so that it can determine whether the terminal with the SIM card is legal, thereby preventing The SIM card is stolen, or the SIM card is counterfeited.
  • the present application may also perform identity authentication on the virtual parasitic USIM card.
  • identity authentication is a detailed description with an embodiment:
  • FIG. 6 another embodiment of the identity authentication method provided by the present application includes:
  • Step 601 The terminal sends a second identity authentication request to the OTA server.
  • the second identity authentication request carries the virtual parasitic USIM card data, the SIM card identifier, and the second security key.
  • Step 602 The OTA server sends a second identity authentication request to the BSS.
  • Step 603 The BSS performs identity authentication according to the virtual parasitic USIM card data, the identity of the SIM card, and the second security key.
  • the BSS performs identity authentication based on the virtual parasitic USIM card data, the SIM card identity and the second security key, and obtains the second identity authentication result.
  • the second security key is used to encrypt and decrypt the virtual parasitic USIM card and the SIM card.
  • the BSS can determine whether the virtual parasitic USIM card data and the SIM card identifier carried in the second identity authentication request are legal according to the binding relationship between the virtual parasitic USIM card and the SIM card stored locally. Specifically, if the virtual parasitic USIM card and the SIM card corresponding to the virtual parasitic USIM card data and the SIM card identifier carried in the second identity authentication request do not have a binding relationship in the BSS, then the virtual parasitic USIM card data and the SIM card are determined The ID of is illegal; if the virtual parasitic USIM card and SIM card corresponding to the virtual parasitic USIM card data and the SIM card ID carried in the second identity authentication request have a binding relationship in the BSS, determine the virtual parasitic USIM card data and SIM card The logo is legal.
  • the second identity authentication result may include a pass verification message and/or a third security key, and the third security key is different from the second security key. key.
  • the second identity authentication result may include a failed authentication message, and the OTA server and the BSS may deny access to the terminal at this time.
  • Step 604 The BSS sends the second identity authentication result including the third security key to the OTA server.
  • Step 605 The OTA server sends the second identity authentication result including the third security key to the terminal.
  • Step 606 The BSS sends the failed verification message to the OTA server.
  • Step 607 The OTA server sends a failed verification message to the terminal.
  • the BSS can perform identity authentication according to the virtual parasitic USIM card data, the SIM card identifier, and the second security key to prevent the SIM card or the virtual parasitic USIM card from being stolen.
  • the security of over-the-air downloads can be further improved by updating the security key.
  • the terminal may periodically send an identity authentication request.
  • the identity authentication request carries the virtual parasitic USIM card data, SIM card identification and security key, and the BSS can verify the virtual parasitic USIM card data, SIM card identification and security key. Perform identity authentication, and after obtaining the identity authentication result, a new security key can be generated. In this way, by periodically refreshing the key, the virtual parasitic USIM card can be prevented from being counterfeited, thereby improving the security of the virtual parasitic USIM card.
  • this application can also deactivate the virtual parasitic USIM card to meet the deactivation requirements of the user.
  • This application can also deactivate the virtual parasitic USIM card to meet the deactivation requirements of the user.
  • the over-the-air download method of the present application includes:
  • Step 701 When the terminal satisfies the virtual parasitic USIM card deactivation condition, the terminal sends a detach request to the HSS.
  • the terminal meets the deactivation condition of the virtual parasitic USIM card.
  • an abnormality of the virtual parasitic USIM card for example, the virtual parasitic USIM card data of the terminal is inconsistent with the virtual parasitic USIM card data stored in the server, or the virtual parasitic USIM card stored in the terminal has problems (such as incomplete data or virtual parasitic USIM).
  • USIM card data error it is determined that the terminal meets the virtual parasitic USIM card deactivation condition.
  • Step 702 The HSS sends a detach response to the terminal.
  • the HSS responds to the detach request, sets the virtual parasitic USIM card to the detach state, generates a detach response, and then sends the detach response to the terminal.
  • the detach response is used to indicate that the virtual parasitic USIM card is in the detach state.
  • Step 703 The terminal activates the SIM card according to the detach response.
  • the terminal After receiving the detach response sent by the HSS, the terminal activates the SIM card according to the detach response, so that it can access the first wireless network to process services.
  • Step 704 The terminal sends a virtual parasitic USIM card deactivation message to the OTA server.
  • Step 705 The OTA server sets the virtual parasitic USIM card to a deactivated state according to the virtual parasitic USIM card deactivation message.
  • Step 706 The OTA server sends the virtual parasitic USIM card deactivation response to the terminal.
  • Step 707 The terminal sets the virtual parasitic USIM card to a deactivated state according to the virtual parasitic USIM card deactivation response.
  • the terminal After receiving the virtual parasitic USIM card deactivation response sent by the OTA server, the terminal sets the virtual parasitic USIM card to the deactivated state according to the virtual parasitic USIM card deactivation response.
  • both the terminal and the network side device deactivate the virtual parasitic USIM card, so that the virtual parasitic USIM card is in a deactivated state. At this time, all terminals cannot use the virtual parasitic USIM card to access the network.
  • the OTA server may also send a virtual parasitic USIM card deactivation message to the BSS, and the BSS sets the local virtual parasitic USIM card to a deactivated state according to the virtual parasitic USIM card deactivation message.
  • the BSS can retain the account opening information of the virtual parasitic USIM card.
  • the BSS sends a virtual parasitic USIM card deactivation message to the HSS, and the HSS deletes the binding relationship between the virtual parasitic USIM card and the SIM card according to the virtual parasitic USIM card deactivation message.
  • the present application can also activate the virtual parasitic USIM card again according to actual needs.
  • the following is a detailed introduction with an embodiment:
  • the over-the-air download method of the present application further includes:
  • Step 801 The terminal sends a virtual parasitic USIM card activation request to the OTA server.
  • Step 802 In response to the virtual parasitic USIM card activation request, the OTA server sends the virtual parasitic USIM card activation request to the BSS.
  • Step 803 The BSS sets the local virtual parasitic USIM card to an activated state according to the virtual parasitic USIM card activation request.
  • Step 804 The BSS sends an activation success message to the OTA server.
  • Step 805 The OTA server sends an activation success message to the terminal.
  • Step 806 The terminal deactivates the SIM card according to the activation success message, and sets the virtual parasitic USIM card to the activated state.
  • the terminal After receiving the activation success message sent by the OTA server, the terminal can determine that the BSS has activated the virtual parasitic USIM card according to the activation success message, and then deactivate the SIM card and set the virtual parasitic USIM card to the activated state. In this way, the terminal can initiate an attachment request to the HSS according to the virtual parasitic USIM card to access the second wireless network.
  • the OTA server activates the local virtual parasitic USIM card.
  • the BSS sends a virtual parasitic USIM card activation request to the HSS, and the HSS activates the local virtual parasitic USIM card, and rebinds the virtual parasitic USIM card with its corresponding SIM card.
  • this application also provides a location update notification to prevent the virtual parasitic USIM card from being stolen.
  • the over-the-air download method in this application further includes:
  • Step 901 The terminal sends a location update request to the HSS.
  • the location update request includes the current home location information of the terminal.
  • Step 902 The HSS updates the location of the terminal according to the location update request and generates a first location update notification.
  • the first location update notification generated by the HSS carries virtual parasitic USIM card data.
  • the HSS may also generate the first location update notification according to the registration request.
  • the terminal sends a registration request to the HSS, the registration request includes the current home location information of the terminal; the HSS updates the location of the terminal according to the registration request and generates the first location update notification.
  • Step 903 The HSS sends the first location update notification to the OTA server.
  • Step 904 The terminal sends a second location update notification to the OTA server.
  • the terminal waits for a period of time and then sends a second location update notification to the OTA server.
  • the waiting time can be set according to actual conditions, which is not limited in this application.
  • the HSS updates the location of the terminal according to the location update request, it generates a location update completion notification, and sends the location update completion notification to the terminal.
  • the terminal After receiving the location update completion notification sent by the HSS, the terminal sends a second location update notification to the OTA server.
  • the second location update notification sent by the terminal carries the virtual parasitic USIM card data and the identification of the SIM card.
  • Step 905 The OTA server starts timing after receiving the first location update notification.
  • Step 906 If the second location update notification sent by the terminal is received within the set time period, send a location update complete message to the terminal.
  • Step 907 If the second location update notification sent by the terminal is not received within the set time period, deactivate the virtual parasitic USIM card.
  • a method of deleting the virtual parasitic USIM card stored locally and/or canceling the binding relationship between the virtual parasitic USIM card and the SIM card can also be used.
  • Step 908 The OTA server sends a virtual parasitic USIM card exception notification to the terminal.
  • the set duration can be set according to actual conditions. For example, after the terminal sends a location update request to the HSS, the HSS sends a location update completion notification to the terminal. After receiving the location update completion notification, the terminal sends a second location update notification to the OTA server. In this way, the time when the terminal sends the location update request can be used as the starting time, the time when the terminal receives the location update completion message as the ending time, and the length of time between the starting time and the ending time as the above-mentioned set time length. It is understandable that the setting time length is not limited to the above examples, and the value of this application is not limited.
  • the legitimate terminal can send a location update notification to the OTA server after the location update, and the location update notification carries the virtual parasitic USIM card data and the SIM card identifier.
  • the terminal that stolen the virtual parasitic USIM card may have copied the data of the virtual parasitic USIM card without configuring the application to manage the virtual parasitic USIM card. In this way, the card theft terminal will not send a location update notification to the OTA server because the OTA server has received the data from the HSS.
  • the location update notification and the location update notification sent by the terminal is not received within the set time, so it is determined that the terminal that has not sent the location update notification is the stolen card terminal, and the OTA server deactivates the virtual parasitic USIM card, which can prevent the virtual parasitic USIM card Misappropriated.
  • the terminal deactivates the current virtual parasitic USIM card and activates the SIM card according to the virtual parasitic USIM card abnormality notification.
  • the terminal and the OTA server can deactivate the virtual parasitic USIM, and then access the first wireless network through the SIM card.
  • the OTA server can also send a request to deactivate the virtual parasitic USIM card to the BSS or HSS.
  • the BSS and HSS receive the request to deactivate the virtual parasitic USIM card
  • the BSS and HSS can deactivate the local virtual parasitic USIM card.
  • the legal terminal can also reapply and activate the virtual parasitic USIM card according to the over-the-air download method in the above embodiment.
  • the present application provides a terminal 1000 that can implement the steps executed by the terminal in the over-the-air download method of the above embodiment.
  • the terminal 1000 includes a receiving module 1001, a processing module 1002, a sending module 1003, a SIM card 1004, and a storage module 1005 including TEE; a receiving module 1001, a processing module 1002, a sending module 1003, a SIM card 1004, and a storage module 1005 is connected by bus 1006.
  • the sending module 1003 is used to send a virtual parasitic USIM card application message to the OTA server, and the virtual parasitic USIM card application message carries the identity of the SIM card of the terminal;
  • the receiving module 1001 is used to receive the virtual parasitic USIM card data and the binding identifier sent by the OTA server.
  • the virtual parasitic USIM card data is obtained by the OTA server from the business support system BSS, and the binding identifier is used to identify the virtual parasitic USIM card data and the SIM.
  • the card has a binding relationship, and the virtual parasitic USIM card and the SIM card correspond to the same MSISDN;
  • the processing module 1002 is configured to activate the virtual parasitic USIM card in the TEE according to the virtual parasitic USIM card data and binding identifier when the SIM card is in place, and the virtual parasitic USIM card is used to access the second wireless network;
  • the processing module 1002 is also used to deactivate the SIM card.
  • the receiving module 1001 is also used for receiving a short message sent by the OTA server before the sending module 1003 sends a virtual parasitic USIM card application message to the OTA server.
  • the short message is used to notify the terminal to apply for a virtual parasitic USIM card.
  • the sending module 1003 is further configured to send a first identity authentication request to the OTA server, where the first identity authentication request carries the identity of the SIM card and the first security key;
  • the receiving module 1001 is also used to receive the first identity authentication result sent by the OTA server.
  • the first identity authentication result includes a second security key or a failed verification message.
  • the second security key is used when the BSS determines the identity and the first identity of the SIM card.
  • a security key is sent to the OTA server when the security key is legal, and the failed verification message is sent to the OTA server when the BSS determines that the SIM card identity and the first security key are illegal.
  • the receiving module 1001 is further configured to send a second identity authentication request to the OTA server after the receiving module 1001 receives the second security key sent by the OTA server.
  • the second identity authentication request carries the virtual parasitic USIM card data and the identity of the SIM card. And the second security key;
  • the sending module 1003 is also used to send a detach request to the HSS when the terminal meets the deactivation condition of the virtual parasitic USIM card;
  • the receiving module 1001 is also configured to receive a detach response sent by the HSS, where the detach response is used to indicate that the virtual parasitic USIM card is in a detached state;
  • the processing module 1002 is also used to activate the SIM card according to the detach response;
  • the processing module 1002 is also used to send a virtual parasitic USIM card deactivation message to the OTA server;
  • the receiving module 1001 is also used to receive the virtual parasitic USIM card deactivation response sent by the OTA server;
  • the processing module 1002 is further configured to set the virtual parasitic USIM card to a deactivated state according to the virtual parasitic USIM card deactivation response.
  • the processing module 1002 is further configured to determine that the terminal meets the virtual parasitic USIM card deactivation condition when the receiving module receives the deactivation instruction; or, when the virtual parasitic USIM card is detected to be abnormal, determine that the terminal meets the virtual parasitic USIM card deactivation condition .
  • the sending module 1003 is also used to send a virtual parasitic USIM card activation request to the OTA server after the processing module sets the USIM card to a deactivated state;
  • the receiving module 1001 is also used to receive the activation success message sent by the OTA server;
  • the processing module 1002 is also used for deactivating the SIM card and setting the virtual parasitic USIM card to the activated state according to the activation success message.
  • the sending module 1003 is also used to send a location update request to the HSS, where the location update request is used by the HSS to generate the first location update notification;
  • the sending module 1003 is also used to send a second location update notification to the OTA server;
  • the receiving module 1001 is also used to receive the virtual parasitic USIM card abnormal notification sent by the OTA server.
  • the virtual parasitic USIM card abnormal notification means that the OTA server does not receive the terminal within the set time after receiving the first location update notification sent by the HSS Sent in the case of the second location update notification sent;
  • the processing module 1002 is also used for deactivating the virtual parasitic USIM card and activating the SIM card according to the notification of the virtual parasitic USIM card abnormality.
  • the processing module 1002 is also used to deactivate the virtual parasitic USIM card when the SIM card is not in place after the processing module 1002 activates the virtual parasitic USIM card.
  • the processing module 1002 is further configured to delete the virtual parasitic USIM card when the SIM card is not in place for a period of time exceeding the preset period of time after the processing module uses the USIM card to access the second wireless network.
  • the sending module 1003 is also used to send a service query request to the BSS when the SIM card is in place and there is a virtual parasitic USIM card corresponding to the SIM card, and the service query request is used to query whether there is a service to be activated in the BSS;
  • the receiving module 1001 is also used to receive the query result sent by the BSS;
  • the processing module 1002 is also used for activating the virtual parasitic USIM card corresponding to the SIM card when the query result is that there is a service to be activated in the BSS; when the SIM card is in place and the virtual parasitic USIM card corresponding to the SIM card is not configured, triggering
  • the sending module 1003 sends the virtual parasitic USIM card application message to the OTA server.
  • the first wireless network is a 2G network or a 3G network
  • the second wireless network is a 4G network.
  • the present application provides an OTA server 1100 that can implement the steps executed by the OTA server in the over-the-air download method of the above embodiment.
  • the OTA server 1100 includes a receiving module 1101, a processing module 1102, and a sending module 1103;
  • the receiving module 1101 is configured to receive a virtual parasitic USIM card application message sent by the terminal, where the virtual parasitic USIM card application message carries the identification of the SIM card of the terminal;
  • the processing module 1102 is configured to obtain the virtual parasitic USIM card data and binding identifier according to the virtual parasitic USIM card application message;
  • the sending module 1103 is also used to send the virtual parasitic USIM card data and the binding identification to the terminal, and the virtual parasitic USIM card data and the binding identification are used to activate the virtual parasitic USIM card.
  • the processing module 1102 is specifically configured to obtain the virtual parasitic USIM card data and binding identification from a locally stored virtual parasitic USIM card file according to the SIM card identifier carried in the virtual parasitic USIM card application message.
  • the processing module 1102 is specifically configured to send the virtual parasitic USIM card application message to the BSS; and receive the virtual parasitic USIM card data and the binding identifier sent by the BSS.
  • the processing module 1102 includes a receiving unit and a sending unit.
  • the sending unit is used to send the virtual parasitic USIM card application message to the BSS; the receiving unit is used to receive the virtual parasitic USIM card data and the binding identifier sent by the BSS.
  • the functions of the receiving unit and the sending unit may also be implemented by the receiving module 1101 and the sending module 1103.
  • the sending module 1103 is also used to send a short message to the terminal.
  • the short message is used to instruct the terminal to send a virtual parasitic USIM card application message to the OTA server.
  • the receiving module 1101 is further configured to receive a first identity authentication request sent by the terminal, where the first identity authentication request carries the identity of the SIM card and the first security key;
  • the sending module 1103 is also used to send the first identity authentication request to the BSS;
  • the receiving module 1101 is further configured to receive a first identity authentication result sent by the BSS, where the first identity authentication result is obtained by the BSS according to the identity of the SIM card and the first security key;
  • the sending module 1103 is also used to send the first identity authentication result to the terminal.
  • the receiving module 1101 is further configured to receive a second identity authentication request sent by the terminal when the first identity authentication result includes the second security key, and the second identity authentication request carries the virtual parasitic USIM card data and the identity of the SIM card And the second security key;
  • the sending module 1103 is also used to send the second identity authentication request to the BSS;
  • the receiving module 1101 is further configured to receive a second identity authentication result sent by the BSS, and the second identity authentication result is obtained by the BSS according to the virtual parasitic USIM card data, the SIM card identifier, and the second security key.
  • the receiving module 1101 is also used to receive the virtual parasitic USIM card deactivation message sent by the terminal;
  • the sending module 1103 is also used to send the virtual parasitic USIM card deactivation message to the BSS;
  • the receiving module 1101 is also used to receive the virtual parasitic USIM card deactivation completion message sent by the BSS;
  • the processing module 1102 is further configured to set the state of the locally stored USIM card to the deactivated state according to the virtual parasitic USIM card deactivation complete message;
  • the sending module 1103 is also used to send the virtual parasitic USIM card deactivation complete message to the terminal.
  • the receiving module 1101 is also used to receive a virtual parasitic USIM card activation request sent by the terminal;
  • the sending module 1103 is also used to send the virtual parasitic USIM card activation request to the BSS;
  • the receiving module 1101 is also used to receive the activation success message sent by the BSS;
  • the processing module 1102 is further configured to set the state of the local virtual parasitic USIM card to the activated state according to the activation success message;
  • the sending module 1103 is also used to send an activation success message to the terminal.
  • the receiving module 1101 is further configured to receive the first location update notification sent by the HSS;
  • the processing module 1102 is further configured to start timing from the moment when the first location update notification sent by the HSS is received;
  • the sending module 1103 is also configured to send a virtual parasitic USIM card abnormality notification to the terminal when the second location update notification sent by the terminal is not received within the set time period.
  • This application also provides a computer storage medium, including instructions; when it runs on a computer, it causes the computer to execute the steps performed by the terminal in the over-the-air download method in the above embodiments; or, when it runs on a computer, it causes the computer to Perform the steps performed by the OTA server in the over-the-air download method in the above embodiment; or, when it is running on a computer, cause the computer to execute the steps performed by the BSS in the over-the-air download method in the above embodiment; or, when it is on the computer When running, the computer is made to execute the steps executed by the HSS in the over-the-air download method in the above embodiment.
  • the steps performed by the terminal in this application can be specifically completed by a chip in the terminal, and the chip includes: a processing unit and a communication unit.
  • the processing unit may be a processor, and the communication unit may be, for example, an input/output interface, a pin, or a circuit.
  • the processing unit can execute the computer execution instruction stored in the storage unit, so that the terminal executes the over-the-air download method in any one of the embodiments shown in FIG. 3 to FIG. 8.
  • the storage unit is a storage unit in the chip, such as a register, a cache, etc., and the storage unit may also be a storage unit located outside the chip in the terminal, such as a read-only memory (read-only memory).
  • ROM read only memory
  • RAM random access memory
  • the processor mentioned in any of the above can be a general-purpose central processing unit, a microprocessor, an application specific integrated circuit (ASIC) or one or more integrated circuits used to control the execution of the above-mentioned over-the-air download method Circuit.
  • ASIC application specific integrated circuit
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer instructions may be transmitted from a website, computer, server, or data center. Transmission to another website site, computer, server or data center via wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.).
  • wired such as coaxial cable, optical fiber, digital subscriber line (DSL)
  • wireless such as infrared, wireless, microwave, etc.
  • the computer-readable storage medium may be any available medium that can be stored by a computer or a data storage device such as a server or a data center integrated with one or more available media.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, and a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)).

Abstract

一种空中下载方法包括：向OTA服务器发送携带SIM卡标识的虚拟寄生USIM卡申请消息，再接收OTA服务器发送的虚拟寄生USIM卡数据和绑定标识，其中，绑定标识用于标识虚拟寄生USIM卡与SIM卡具有绑定关系，虚拟寄生USIM卡和SIM卡对应相同的MSISDN；当SIM卡在位时，根据虚拟寄生USIM卡数据和绑定标识在TEE中激活虚拟寄生USIM卡，去激活SIM卡。这样不用更换SIM卡就可以接入新的无线网络，因此便于用户转网，并且通过绑定SIM卡和虚拟寄生USIM卡能够保障转网的安全性。本申请还提供能够实现上述空中下载方法的相关设备。

Description

一种空中下载方法和相关设备
本申请要求于2020年05月29日提交中国专利局、申请号为202010475662.X、申请名称为“一种空中下载方法和相关设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及无线通信技术领域，尤其涉及一种空中下载方法和相关设备。
背景技术
在无线通信终端中，用户身份模块(subscriber identity module，SIM)卡是终端必不可少的组件。SIM卡也称为用户身份识别卡或者用户识别卡。
但是，SIM卡可以接入2G网络或3G网络，但不能接入4G网络。这样导致配置SIM卡的终端难以迁移到4G网络。
发明内容
有鉴于此，本申请提供一种空中下载方法以及相关设备，不用更换SIM卡就可以接入新的无线网络，由此提高了用户转网的灵活性。并且，该空中下载方法通过绑定SIM卡和虚拟寄生USIM卡能够提供良好的安全性。
第一方面提供一种空中下载方法，该空中下载方法应用于具有SIM卡和TEE的终端；在该方法中终端向空中下载OTA服务器发送虚拟寄生USIM卡申请消息，OTA服务器根据虚拟寄生USIM卡申请消息获取虚拟寄生USIM卡数据和绑定标识，然后将虚拟寄生USIM卡数据和绑定标识发送给终端；当SIM卡在位时，终端根据虚拟寄生USIM卡数据和绑定标识在TEE中激活虚拟寄生USIM卡，去激活SIM卡。其中，SIM卡支持第一无线网络且不支持第二无线网络，第一无线网络和第二无线网络具有不同的通信制式，例如第一无线网络为2G网络或3G网络，第二无线网络为4G网络、5G网络或5G以后的无线通信网络。虚拟寄生USIM卡申请消息携带SIM卡的标识。绑定标识用于标识虚拟寄生USIM卡与SIM卡具有绑定关系，虚拟寄生USIM卡和SIM卡对应同一MSISDN。虚拟寄生USIM卡用于接入第二无线网络。
依此实施，用户不更换SIM卡就能够通过虚拟寄生USIM卡接入第二无线网络，因此提供了一种简单方便的转网方法，并且通过绑定SIM卡和虚拟寄生USIM卡能够保障转网的安全性。另外，通过绑定SIM卡和虚拟寄生USIM卡能够使得用户仍然使用原运营商的网络，可以避免用户转换到其他运营商的网络。
在一种可能的实现方式中，在向OTA服务器发送虚拟寄生USIM卡申请消息之前，接收OTA服务器发送的短消息。该短消息用于通知终端申请虚拟寄生USIM卡。这样可以通过短消息提醒用户进行免换卡转网，提高用户体验。
在另一种可能的实现方式中，在接收OTA服务器发送的虚拟寄生USIM卡数据和绑定标识之前，向OTA服务器发送第一身份认证请求，第一身份认证请求携带SIM卡的标识和第 一安全密钥；接收OTA服务器发送的第一身份认证结果，第一身份认证结果包括第二安全密钥或者未通过验证消息。第二安全密钥是当BSS确定SIM卡的标识和第一安全密钥合法的情况下发送给OTA服务器的，未通过验证消息是BSS确定SIM卡的标识和第一安全密钥非法的情况下发送给OTA服务器的。
第一身份认证结果是BSS根据SIM卡的标识和第二安全密钥进行认证得到的。这样可以判断出具有该SIM卡的终端是否合法，从而防止SIM卡被盗用，或者SIM卡被仿冒。
在另一种可能的实现方式中，在第一身份认证结果包括第二安全密钥的情况下，在激活虚拟寄生USIM卡之后，终端向OTA服务器发送第二身份认证请求，第二身份认证请求携带有虚拟寄生USIM卡数据、SIM卡的标识和第二安全密钥；OTA服务器将第二身份认证请求发送给BSS，BSS根据虚拟寄生USIM卡数据、SIM卡的标识和第二安全密钥进行认证得到第二身份认证结果，BSS将第二身份认证结果发送给OTA服务器后，终端接收OTA服务器发送的第二身份认证结果。这样，在激活虚拟寄生USIM卡之后，可以根据虚拟寄生USIM卡数据、SIM卡的标识和第二安全密钥对终端再次进行身份认证，防止SIM卡或者虚拟寄生USIM卡被盗用，从而提高空中下载的安全性。
在另一种可能的实现方式中，终端向HSS发送位置更新请求，HSS根据该位置更新请求生成第一位置更新通知；终端向OTA服务器发送第二位置更新通知；OTA服务器在收到HSS发送的第一位置更新通知之后且在设定时长内收到第二位置更新通知时，将位置更新完成消息发送给终端；OTA服务器在收到HSS发送的第一位置更新通知之后且在设定时长内没有收到第二位置更新通知时，去激活该虚拟寄生USIM卡；然后将虚拟寄生USIM卡异常通知发送给终端；终端根据虚拟寄生USIM卡异常通知，去激活虚拟寄生USIM卡以及激活SIM卡。
依此实施，终端在位置更新后能够向OTA服务器发送第二位置更新通知，第二位置更新通知携带虚拟寄生USIM卡数据和SIM卡的标识。如果盗用虚拟寄生USIM卡的终端仅具有虚拟寄生USIM卡数据而不配置管理虚拟寄生USIM卡的应用程序，那么盗卡终端不会向OTA服务器发送第二位置更新通知，这样OTA服务器能判断出盗卡终端，并向合法终端发送虚拟寄生USIM卡异常通知，以警告该虚拟寄生USIM卡已被盗用。OTA服务器将该虚拟寄生USIM卡去激活后，盗卡终端就无法使用该虚拟寄生USIM卡接入网络。合法终端可以向OTA服务器再次申请虚拟寄生USIM卡以接入网络。另外，OTA服务器可以将该虚拟寄生USIM卡的去激活状态同步至网络侧其他设备，例如HSS和BSS等。
在另一种可能的实现方式中，当虚拟寄生USIM卡异常时，例如终端存储的虚拟寄生USIM卡数据与服务器存储的虚拟寄生USIM卡数据不一致，或者终端存储的虚拟寄生USIM卡数据受损，终端向HSS发送去附着请求；接收HSS发送的去附着响应；根据去附着响应激活SIM卡；向OTA服务器发送虚拟寄生USIM卡去激活消息；接收OTA服务器发送的虚拟寄生USIM卡去激活响应；根据虚拟寄生USIM卡去激活响应将虚拟寄生USIM卡设置为去激活状态。去附着响应用于指示虚拟寄生USIM卡处于去附着状态。在虚拟寄生USIM卡异常的情况下，终端和网络设备可以自动去激活虚拟寄生USIM卡。
在另一种可能的实现方式中，当终端收到去激活指令时，向HSS发送去附着请求；在 HSS根据去附着请求生成去附着响应后，终端接收HSS发送的去附着响应；根据去附着响应激活SIM卡，然后向OTA服务器发送虚拟寄生USIM卡去激活消息；接收OTA服务器发送的虚拟寄生USIM卡去激活响应；根据虚拟寄生USIM卡去激活响应将虚拟寄生USIM卡设置为去激活状态。去附着响应用于指示虚拟寄生USIM卡处于去附着状态。这样，用户手动输入去激活指令后，终端和网络设备可以去激活虚拟寄生USIM卡。
在另一种可能的实现方式中，在根据虚拟寄生USIM卡数据和绑定标识在TEE中激活虚拟寄生USIM卡之后，当SIM卡不在位时，去激活虚拟寄生USIM卡。依此实施，虚拟寄生USIM卡和SIM卡在同一终端时才能激活，否则不能激活，这样使得虚拟寄生USIM卡不能脱离SIM卡使用，从而提高了虚拟寄生USIM卡的安全性。
在另一种可能的实现方式中，在根据虚拟寄生USIM卡数据和绑定标识在TEE中激活虚拟寄生USIM卡之后，当SIM卡不在位的时长超过预设时长时，删除虚拟寄生USIM卡。依此实施，虚拟寄生USIM卡和SIM卡在同一终端时才能激活，否则不能激活，这样使得虚拟寄生USIM卡不能脱离SIM卡使用，从而提高了虚拟寄生USIM卡的安全性。
在另一种可能的实现方式中，当SIM卡在位且存在与SIM卡对应的虚拟寄生USIM卡时，向BSS发送业务查询请求，业务查询请求用于查询在BSS中是否存在待激活业务；当查询结果为在BSS中存在待激活业务时，激活SIM卡对应的虚拟寄生USIM卡；当SIM卡在位且未配置与SIM卡对应的虚拟寄生USIM卡时，触发向OTA服务器发送虚拟寄生USIM卡申请消息的步骤。这样终端可以自动检测是否配置有与SIM卡对应的虚拟寄生USIM卡，以及自动激活虚拟寄生USIM卡接入第二无线网络。
第二方面提供一种应用于OTA服务器的空中下载方法，在该方法中，接收终端发送的虚拟寄生USIM卡申请消息；根据虚拟寄生USIM卡申请消息获取虚拟寄生USIM卡数据和绑定标识；将虚拟寄生USIM卡数据和绑定标识发送给终端，以使得终端根据虚拟寄生USIM卡数据和绑定标识终端激活虚拟寄生USIM卡。虚拟寄生USIM卡申请消息携带终端的SIM卡的标识。绑定标识用于标识虚拟寄生USIM卡和SIM卡的绑定关系。其中，该终端具有SIM卡和TEE，SIM卡支持第一无线网络且不支持第二无线网络，第一无线网络和第二无线网络具有不同的通信制式，例如第一无线网络为2G网络或3G网络，第二无线网络为4G网络、5G网络或5G以后的无线通信网络。
依此实施，OTA服务器可以向终端提供虚拟寄生USIM卡数据和绑定关系，终端根据虚拟寄生USIM卡数据和绑定标识终端激活虚拟寄生USIM卡，这样用户不更换SIM卡就能够通过虚拟寄生USIM卡接入第二无线网络，因此提供了一种简单方便的转网方法，并且通过绑定SIM卡和虚拟寄生USIM卡能够保障转网的安全性。另外，通过绑定SIM卡和虚拟寄生USIM卡能够使得用户仍然使用原运营商的网络，可以避免用户转换到其他运营商的网络。
在一种可能的实现方式中，根据虚拟寄生USIM卡申请消息获取虚拟寄生USIM卡数据和绑定标识包括：根据虚拟寄生USIM卡申请消息携带的SIM卡标识，从本地存储的虚拟寄生USIM卡文件中获取虚拟寄生USIM卡数据和绑定标识。在接收终端发送的虚拟寄生USIM卡申请消息之前，OTA服务器可以接收BSS或HSS发送的接口文件，该接口文件包括但不限于虚拟寄生USIM卡数据、SIM卡与虚拟寄生USIM卡的绑定关系。这样OTA服务器可以 直接向终端提供虚拟寄生USIM卡数据和绑定标识。
在另一种可能的实现方式中，根据虚拟寄生USIM卡申请消息获取虚拟寄生USIM卡数据和绑定标识包括：将虚拟寄生USIM卡申请消息发送给BSS；BSS根据虚拟寄生USIM卡申请消息获取虚拟寄生USIM卡数据和虚拟寄生USIM卡数据与SIM卡的绑定标识后，将虚拟寄生USIM卡数据和绑定标识发送给OTA服务器。这样OTA服务器可以从BSS获取虚拟寄生USIM卡数据和绑定标识。
在另一种可能的实现方式中，OTA服务器向终端发送短消息。短消息用于指示终端向OTA服务器发送虚拟寄生USIM卡申请消息。
在另一种可能的实现方式中，接收终端发送的第一身份认证请求，将第一身份认证请求发送给BSS；BSS根据第一身份认证请求携带的SIM卡的标识和第一安全密钥进行认证，将认证得到的第一身份认证结果发送给OTA服务器，OTA服务器接收BSS发送的第一身份认证结果后，将第一身份认证结果发送给终端。
在另一种可能的实现方式中，在OTA服务器将第一身份认证请求发送给BSS之后，当BSS确定终端合法时，OTA服务器接收BSS发送的第二安全密钥，将第二安全密钥发送给终端；接收终端发送的第二身份认证请求，第二身份认证请求携带有虚拟寄生USIM卡数据、SIM卡的标识和第二安全密钥；将第二身份认证请求发送给BSS；BSS根据虚拟寄生USIM卡数据、SIM卡的标识和第二安全密钥进行认证，将认证得到的第二身份认证结果发送给OTA服务器。
在另一种可能的实现方式中，接收终端发送的虚拟寄生USIM卡去激活消息；将虚拟寄生USIM卡去激活消息发送给BSS；接收BSS发送的虚拟寄生USIM卡去激活完成消息；根据虚拟寄生USIM卡去激活完成消息将本地存储的USIM卡状态设置为去激活状态；将虚拟寄生USIM卡去激活完成消息发送给终端。
在另一种可能的实现方式中，接收HSS发送的第一位置更新通知；从收到HSS发送的第一位置更新通知的时刻开始计时；在另一种可能的实现方式中，当在设定时长内未收到第二位置更新通知时，去激活该虚拟寄生USIM卡；然后向终端发送虚拟寄生USIM卡异常通知。在设定时长内收到终端发送的第二位置更新通知时，向终端发送虚拟寄生USIM卡发送位置更新完成消息。如果盗用虚拟寄生USIM卡的终端仅具有虚拟寄生USIM卡数据而不配置管理虚拟寄生USIM卡的应用程序，那么盗卡终端不会向OTA服务器发送第二位置更新通知，这样OTA服务器能判断出盗卡终端，并向合法终端发送虚拟寄生USIM卡异常通知，以警告该虚拟寄生USIM卡已被盗用。OTA服务器将该虚拟寄生USIM卡去激活后，盗卡终端就无法使用该虚拟寄生USIM卡接入网络。
第三方面提供一种终端，该终端包括接收模块、处理模块、发送模块、SIM卡和TEE；发送模块用于向OTA服务器发送虚拟寄生USIM卡申请消息，虚拟寄生USIM卡申请消息携带终端的SIM卡的标识；接收模块用于接收OTA服务器发送的虚拟寄生USIM卡数据和绑定标识，虚拟寄生USIM卡数据是OTA服务器从业务支撑系统BSS获取的，绑定标识用于标识虚拟寄生USIM卡与SIM卡具有绑定关系，虚拟寄生USIM卡和SIM卡对应同一MSISDN；处理模块用于当SIM卡在位时，根据虚拟寄生USIM卡数据和绑定标识在TEE中激活虚拟寄生 USIM卡，虚拟寄生USIM卡用于接入第二无线网络，然后去激活SIM卡。
在一种可能的实现方式中，接收模块还用于在发送模块向OTA服务器发送虚拟寄生USIM卡申请消息之前，接收OTA服务器发送的短消息，短消息用于通知终端申请虚拟寄生USIM卡。
在另一种可能的实现方式中，发送模块还用于向OTA服务器发送第一身份认证请求，第一身份认证请求携带有SIM卡的标识和第一安全密钥；接收模块还用于接收OTA服务器发送的第二安全密钥或者未通过验证消息，第二安全密钥是当BSS确定SIM卡的标识和第一安全密钥合法的情况下发送给OTA服务器的，未通过验证消息是BSS确定SIM卡的标识和第一安全密钥非法的情况下发送给OTA服务器的。
在另一种可能的实现方式中，接收模块还用于在接收OTA服务器发送的第二安全密钥之后，向OTA服务器发送第二身份认证请求，第二身份认证请求携带有虚拟寄生USIM卡数据、SIM卡的标识和第二安全密钥；接收OTA服务器发送的第二身份认证结果。
在另一种可能的实现方式中，发送模块还用于当接收模块收到去激活指令时，向归属用户服务器HSS发送去附着请求；接收模块还用于接收HSS发送的去附着响应，去附着响应用于指示虚拟寄生USIM卡处于去附着状态；处理模块还用于根据去附着响应激活SIM卡；处理模块还用于向OTA服务器发送虚拟寄生USIM卡去激活消息；接收模块还用于接收OTA服务器发送的虚拟寄生USIM卡去激活响应；处理模块还用于根据虚拟寄生USIM卡去激活响应将虚拟寄生USIM卡设置为去激活状态。
在另一种可能的实现方式中，发送模块还用于当检测到虚拟寄生USIM卡异常时，向归属用户服务器HSS发送去附着请求；接收模块还用于接收HSS发送的去附着响应，去附着响应用于指示虚拟寄生USIM卡处于去附着状态；处理模块还用于根据去附着响应激活SIM卡；处理模块还用于向OTA服务器发送虚拟寄生USIM卡去激活消息；接收模块还用于接收OTA服务器发送的虚拟寄生USIM卡去激活响应；处理模块还用于根据虚拟寄生USIM卡去激活响应将虚拟寄生USIM卡设置为去激活状态。
在另一种可能的实现方式中，发送模块还用于向HSS发送位置更新请求，位置更新请求用于HSS生成第一位置更新通知；发送模块，还用于向OTA服务器发送第二位置更新通知；接收模块还用于接收OTA服务器发送的虚拟寄生USIM卡异常通知，虚拟寄生USIM卡异常通知是OTA服务器在收到HSS发送的第一位置更新通知之后且在设定时长内没有收到第二位置更新通知的情况下发送的；处理模块还用于根据虚拟寄生USIM卡异常通知去激活虚拟寄生USIM卡以及激活SIM卡。可选的，接收模块还用于接收OTA服务器发送的位置更新完成消息。
在另一种可能的实现方式中，处理模块还用于在处理模块根据虚拟寄生USIM卡数据和绑定标识在TEE中激活虚拟寄生USIM卡之后，当SIM卡不在位时，去激活虚拟寄生USIM卡。
在另一种可能的实现方式中，处理模块还用于在处理模块根据虚拟寄生USIM卡数据和绑定标识在TEE中激活虚拟寄生USIM卡之后，当SIM卡不在位的时长超过预设时长时，删除虚拟寄生USIM卡。
在另一种可能的实现方式中，发送模块还用于当SIM卡在位且存在与SIM卡对应的虚拟寄生USIM卡时，向BSS发送业务查询请求，业务查询请求用于查询在BSS中是否存在待激活业务；接收模块还用于接收查询结果；处理模块还用于当查询结果为在BSS中存在待激活业务时，激活SIM卡对应的虚拟寄生USIM卡；当SIM卡在位且未配置与SIM卡对应的虚拟寄生USIM卡时，触发发送模块向OTA服务器发送虚拟寄生USIM卡申请消息的步骤。
对于第三方面的终端执行的步骤和有益效果均可以参考第一方面以及第一方面中各种可能的实现方式中的描述，此处不再一一赘述。
第四方面提供一种OTA服务器，该OTA服务器包括接收模块，处理模块和发送模块；接收模块用于接收终端发送的虚拟寄生USIM卡申请消息，虚拟寄生USIM卡申请消息携带终端的SIM卡的标识；处理模块用于根据虚拟寄生USIM卡申请消息获取虚拟寄生USIM卡数据和绑定标识；发送模块用于将虚拟寄生USIM卡数据和绑定标识发送给终端，虚拟寄生USIM卡数据和绑定标识用于终端激活虚拟寄生USIM卡。
在一种可能的实现方式中，处理模块具体用于根据虚拟寄生USIM卡申请消息携带的SIM卡标识，从本地存储的虚拟寄生USIM卡文件中获取虚拟寄生USIM卡数据和绑定标识。
在另一种可能的实现方式中，处理模块具体用于将虚拟寄生USIM卡申请消息发送给BSS；接收BSS发送的虚拟寄生USIM卡数据和绑定标识。
在另一种可能的实现方式中，发送模块还用于向终端发送短消息，短消息用于指示终端向OTA服务器发送虚拟寄生USIM卡申请消息。
在另一种可能的实现方式中，接收模块还用于接收终端发送的第一身份认证请求，第一身份认证请求携带有SIM卡的标识和第一安全密钥；发送模块，还用于将第一身份认证请求发送给BSS；接收模块还用于接收BSS发送的第一身份认证结果，第一身份认证结果是BSS根据SIM卡的标识和第一安全密钥进行认证所得；发送模块还用于将第一身份认证结果发送给终端。
在另一种可能的实现方式中，接收模块还用于在第一身份认证结果包括第二安全密钥的情况下，接收终端发送的第二身份认证请求，第二身份认证请求携带有虚拟寄生USIM卡数据、SIM卡的标识和第二安全密钥；发送模块还用于将第二身份认证请求发送给BSS；接收模块还用于接收BSS发送的第二身份认证结果，第二身份认证结果是BSS根据虚拟寄生USIM卡数据、SIM卡的标识和第二安全密钥进行认证得到的。
在另一种可能的实现方式中，接收模块还用于接收终端发送的虚拟寄生USIM卡去激活消息；发送模块还用于将虚拟寄生USIM卡去激活消息发送给BSS；接收模块还用于接收BSS发送的虚拟寄生USIM卡去激活完成消息；处理模块还用于根据虚拟寄生USIM卡去激活完成消息将本地存储的USIM卡状态设置为去激活状态；发送模块，还用于将虚拟寄生USIM卡去激活完成消息发送给终端。
在另一种可能的实现方式中，接收模块还用于接收HSS发送的第一位置更新通知；处理模块还用于从收到HSS发送的第一位置更新通知的时刻开始计时；发送模块还用于在设定时长内未收到终端发送的第二位置更新通知时，向终端发送虚拟寄生USIM卡异常通知。可选的，发送模块还用于在设定时长内收到终端发送的第二位置更新通知时，向终端发送 虚拟寄生USIM卡发送位置更新完成消息。
对于第四方面的OTA服务器执行的步骤和有益效果均可以参考第二方面以及第二方面中各种可能的实现方式中的描述，此处不再一一赘述。
第五方面提供一种终端，该终端包括处理器和存储器，存储器用于存储程序代码，处理器调用该程序代码时，处理器可以执行第一方面或第一方面的可能实现方式中由终端执行的步骤。
第六方面提供一种OTA服务器，该OTA服务器包括处理器和存储器，存储器用于存储程序代码，处理器调用该程序代码时，处理器可以执行第二方面或第二方面的可能实现方式中由OTA服务器执行的步骤。
第七方面提供一种计算机可读存储介质，计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述各方面的方法。
第八方面提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述各方面的方法。
第九方面提供芯片系统，该芯片系统包括处理器，用于支持终端实现上述方面中涉及的功能，例如，发送或处理上述空中下载方法中涉及的数据和/或信息。在一种可能的设计中，所述芯片系统还包括存储器，所述存储器用于保存空中下载方法必要的程序指示和数据。该芯片系统，可以由芯片构成，也可以包括芯片和其他分立器件。
附图说明
图1为本申请中空中下载方法所应用的无线通信系统的一个示意图；
图2为本申请中终端的一个结构示意图；
图3为本申请中空中下载方法的一个信令交互图；
图4为本申请中空中下载方法的另一个信令交互图；
图5为本申请中身份认证方法的一个信令交互图；
图6为本申请中身份认证方法的另一个信令交互图；
图7为本申请中空中下载方法的另一个信令交互图；
图8为本申请中空中下载方法的另一个信令交互图；
图9为本申请中空中下载方法的一个信令交互图；
图10为本申请中终端的另一个结构图；
图11为本申请中空中下载服务器的一个结构图。
具体实施方式
本申请的空中下载方法可应用于无线通信系统。无线通信系统可以包括终端、空中下载(over the air，OTA)服务器、业务支撑系统(business support system，BSS)和归属用户服务器(home subscriber server，HSS)等。可以理解的是，本申请的空中下载方 法可能涉及以上设备中的部分或全部设备，也可能根据实际需要涉及其他设备，本申请不作限定。
参阅图1，一个无线通信系统包括终端10、第一无线网络20、第二无线网络30、OTA服务器40、BSS50和HSS60。
终端10具有SIM卡和可信执行环境(trusted execution environment，TEE)。该SIM卡支持第一无线网络且不支持第二无线网络，第一无线网络20为2G网络或者3G网络，第二无线网络30为4G网络或4G以后的无线通信网络。终端10使用SIM卡可以接入第一无线网络20，这样终端10、OTA服务器30、BSS50和HSS60可以通过第一无线网络20进行通信。
其中，TEE是设置在终端10内的一个独立的安全运行环境，TEE提供了可信应用(trust application，TA)的安全执行环境，同时也保证TA的资源和数据的保密性、完整性和访问权限。在TEE中，每个TA是相互独立的，而且不能在未授权的情况下不能互相访问。
终端10利用TEE可以实现虚拟全球用户识别卡(universal subscriber identity module，USIM)，即将USIM卡的数据写入终端10的预设内存中，这样通过模拟真实的USIM卡接入第二无线网络，这样终端10、OTA服务器40、BSS50和HSS60可以通过第二无线网络30进行通信。其中，终端10利用TEE实现USIM卡的技术可以是基于TEE-嵌入式用户身份识别模块(embedded subscriber identification module，eSIM)实现的。并且，终端10还可以包括富操作系统(Rich OS)，Rich OS可以是但不限于安卓操作系统、苹果操作系统或视窗操作系统等。其中，TEE所能访问的软硬件资源是与Rich OS分离的。终端也可以称为终端设备，移动终端，无线通信终端，无线通信设备等。终端10可以是但不限于手机，平板电脑，台式电脑、智能手表，物联网设备或车载电脑。
OTA服务器40通过无线通信系统的空中接口可以对终端10中SIM卡应用程序和/或SIM卡数据进行远程管理。例如，OTA服务器40和终端10可以通过短消息实现SIM卡应用程序和数据的动态下载、删除与更新。BSS50用于实现业务处理、计费等功能。HSS60用于用户的身份验证和授权、存储终端的物理位置等。
下面以一个实施例对终端10进行详细介绍，参阅图2，在一个可选实施例中，终端10包括处理器101、存储器102、SIM卡103、接收机104和发射机105，处理器101、存储器102、SIM卡103、接收机104和发射机105通过总线106相连接。
处理器101可以是中央处理单元(central processing unit，CPU)，还可以是其他通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现成可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
存储器102可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、 电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic RAM，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DRRAM)。存储器102可以存储Rich OS和TEE。
需要说明的是，当处理器101为通用处理器、DSP、ASIC、FPGA或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件时，存储器102可以(存储单元)集成在处理器101中。应注意，本文描述的存储器102旨在包括但不限于这些和任意其它适合类型的存储器。
接收机104用于接收信息，发射机105用于发送信息。接收机104和发射机105可以是相互独立的，也可以是集成在一起。在移动终端中通常使用相连的射频单元和天线来实现接收机104和发射机105的功能。
本实施例中，通过存储器102存储的程序和指令，处理器101可以执行以下实施例中的空中下载方法。
在目前的TEE-eSIM方法中，通过终端的TEE和eSIM相关技术实现虚拟SIM卡，虚拟SIM卡信息存在TEE区域，终端可以修改虚拟SIM卡信息。该方法尚不成熟，安全性较低，难以被运营商推广。为了提高转网的安全性，本申请提供了物理SIM卡和虚拟寄生USIM卡联合鉴权的方法，下面进行详细介绍。参阅图3，本申请提供的空中下载方法的一个实施例包括：
步骤301、OTA服务器接收BSS发送的接口文件。
本实施例中，运营商在BSS或HSS可以记录用户开户信息(如终端的SIM卡标识)，根据用户开户信息可以配置相应的虚拟寄生USIM卡数据。BSS或HSS可以向OTA服务器发送接口文件，接口文件包括虚拟寄生USIM卡数据，以及虚拟寄生USIM卡与SIM卡的绑定关系。虚拟寄生USIM卡与SIM卡的绑定关系也可称为虚拟寄生USIM卡与SIM卡的对应关系，其用于表示虚拟寄生USIM卡与SIM卡一一对应。OTA服务器收到接口文件后，可以将其中的虚拟寄生USIM卡数据，以及虚拟寄生USIM卡与SIM卡的绑定关系存储在本地，即本地存储的虚拟寄生USIM卡文件。
步骤302、终端向OTA服务器发送虚拟寄生USIM卡申请消息，虚拟寄生USIM卡申请消息携带SIM卡的标识。
终端具有SIM卡和TEE，该SIM卡支持第一无线网络且不支持第二无线网络。与第二无线网络相比，第一无线网络是低代无线网络。例如，第一无线网络可以是2G网络或3G网络，第二无线网络可以是4G网络、5G网络或5G以后的网络。
SIM卡的标识包括集成电路卡识别码(integrate circuit card identity，ICCID)和/或国际移动用户识别码(international mobile subscriber identity，IMSI)。
步骤303、OTA服务器根据SIM卡的标识，从本地存储的虚拟寄生USIM卡文件中获取虚拟寄生USIM卡数据和绑定标识。
虚拟寄生USIM卡文件记录有若干虚拟寄生USIM卡与SIM卡的绑定关系。OTA服务器根据其中的绑定关系可以确定与SIM卡的标识对应的虚拟寄生USIM卡数据和绑定标识。虚拟寄生USIM卡数据包括ICCID，IMSI，鉴权密钥OPC，鉴权密钥Ki，公共陆地移动网(public land mobile network，PLMN)标识，本地公共陆地移动网(home PLMN,HPLMN)标识中的一项或多项。
步骤304、OTA服务器将虚拟寄生USIM卡数据和绑定标识发送给终端。
步骤305、当SIM卡在位时，根据虚拟寄生USIM卡数据和绑定标识在可信执行环境TEE中激活虚拟寄生USIM卡。
步骤306、去激活SIM卡。
本实施例中，终端能够在不更换SIM卡的情况下使用虚拟寄生USIM卡接入新的无线网络，提高了用户转网的灵活性和可行性。
其次，通过绑定SIM卡和虚拟寄生USIM卡能够提高转网的安全性。
再次，通过绑定虚拟寄生USIM卡和SIM卡，用户可以继续使用原运营商的网络，避免了用户转移到其他运营商的网络，有利于运营商采用本申请的空中下载方法进行转网。
以上OTA服务器预先配置有虚拟寄生USIM卡文件，下面对OTA服务器在没有预先配置虚拟寄生USIM卡文件的情况下，激活终端的虚拟寄生USIM卡进行介绍。参阅图4，本申请提供的空中下载方法的另一个实施例包括：
步骤401、终端向OTA服务器发送虚拟寄生USIM卡申请消息，虚拟寄生USIM卡申请消息携带SIM卡的标识。
本实施例中，终端具有SIM卡和TEE，该SIM卡支持第一无线网络且不支持第二无线网络。与第二无线网络相比，第一无线网络是低代无线网络。例如，第一无线网络可以是2G网络或3G网络，第二无线网络可以是4G网络、5G网络或5G以后的网络。
SIM卡的标识包括集成电路卡识别码(integrate circuit card identity，ICCID)和/或国际移动用户识别码(international mobile subscriber identity，IMSI)。
步骤402、OTA服务器向BSS发送虚拟寄生USIM卡申请消息。
步骤403、BSS根据虚拟寄生USIM卡申请消息生成虚拟寄生USIM卡，以及将虚拟寄生USIM卡与SIM卡进行绑定。
需要说明的是，BSS还可以将虚拟寄生USIM卡数据和SIM卡的标识发送给HSS，HSS建立虚拟寄生USIM卡与SIM卡的绑定关系。需要说明的是，该虚拟寄生USIM卡和SIM卡对应相同的移动台综合业务数字网号码(mobile subscriber international integrated service digital network number，MSISDN)。以手机为例，MSISDN即运营商分配的手机号。
步骤404、BSS将虚拟寄生USIM卡数据和绑定标识发送给OTA服务器。
BSS将虚拟寄生USIM卡与SIM卡进行绑定后，可以将虚拟寄生USIM卡数据和绑定标识发送给OTA服务器。绑定标识用于标识虚拟寄生USIM卡与SIM卡具有绑定关系。
步骤405、OTA服务器将虚拟寄生USIM卡数据和绑定标识发送给终端。
OTA服务器接收BSS发送的虚拟寄生USIM卡数据和绑定标识后，将虚拟寄生USIM卡数据和绑定标识发送给终端。
步骤406、当SIM卡在位时，根据虚拟寄生USIM卡数据和绑定标识在可信执行环境TEE中激活虚拟寄生USIM卡。
SIM卡在位是指SIM卡正确插在卡槽上。若SIM卡在位，则根据虚拟寄生USIM卡数据和绑定标识在TEE中创建虚拟寄生USIM卡，以及激活虚拟寄生USIM卡，这样使用虚拟寄生USIM卡就可以接入第二无线网络处理业务。
若SIM卡不在位，表明SIM卡被拔出，或者SIM卡没有正确地插在卡槽上。即使终端收到OTA服务器发送的虚拟寄生USIM卡数据和绑定标识，也不激活虚拟寄生USIM卡。可选的，当终端收到虚拟寄生USIM卡数据且没有收到绑定标识，也不激活虚拟寄生USIM卡。
步骤407、去激活SIM卡。
本实施例中，终端能够在不更换SIM卡的情况下使用虚拟寄生USIM卡接入新的无线网络，提高了用户转网的灵活性和可行性。
其次，通过绑定SIM卡和虚拟寄生USIM卡能够提高转网的安全性。
再次，通过绑定虚拟寄生USIM卡和SIM卡，用户可以继续使用原运营商的网络，避免了用户转移到其他运营商的网络，有利于运营商采用本申请的空中下载方法进行转网。
在图3或图4所示实施例的基础上，本申请还可以执行以下实施例中的方法。
在一个可选实施例中，在向OTA服务器发送虚拟寄生USIM卡申请消息之前，上述空中下载方法还包括：接收OTA服务器发送的短消息。
本实施例中，OTA服务器查询哪些终端是具有SIM卡和可信执行环境的终端，然后向具有SIM卡和可信执行环境的终端发送短消息，该短消息用于通知终端申请虚拟寄生USIM卡。这样可以通过短消息提醒用户进行免换卡转网，提高用户体验。
在另一个可选实施例中，在根据虚拟寄生USIM卡数据和绑定标识在TEE中激活虚拟寄生USIM卡之后，上述空中下载方法还包括：当SIM卡不在位时，去激活虚拟寄生USIM卡。另外，终端还可以向网络侧设备发送虚拟寄生USIM卡去激活消息，以去激活该虚拟寄生USIM卡。详见图7所示实施例或可选实施例中的相关描述。
在另一个可选实施例中，在根据虚拟寄生USIM卡数据和绑定标识在TEE中激活虚拟寄生USIM卡之后，上述空中下载方法还包括：当SIM卡不在位的时长超过预设时长时，删除虚拟寄生USIM卡。
按照上述方法实施，虚拟寄生USIM卡和SIM卡在同一终端时才能激活，否则不能激活，这样使得虚拟寄生USIM卡不能脱离SIM卡使用，从而提高了虚拟寄生USIM卡的安全性。
在另一个可选实施例中，在步骤401之前，上述空中下载方法还包括：当SIM卡在位且存在与SIM卡对应的虚拟寄生USIM卡时，向BSS发送业务查询请求，业务查询请求用于查询在BSS中是否存在待激活业务；当查询结果为在BSS中存在待激活业务时，激活SIM卡对应的虚拟寄生USIM卡；当SIM卡在位且未配置与SIM卡对应的虚拟寄生USIM卡时，触发步骤401。
本实施例中，终端可以自动检测是否配置有与SIM卡对应的虚拟寄生USIM卡，以及自动激活虚拟寄生USIM卡接入第二无线网络。除了自动配置虚拟寄生USIM卡之外，用户还可以向终端输入指令发起虚拟寄生USIM卡申请。
为了提高空中下载的安全性，本申请还可以对SIM卡进行身份认证。该身份认证过程可以在步骤401至步骤407中任一个步骤之前或之后，或者在OTA服务器向终端发送短消息之后执行。下面以一个实施例对该身份认证过程详细说明：
参阅图5，本申请提供的空中下载方法的另一个实施例包括：
步骤501、终端向OTA服务器发送第一身份认证请求，第一身份认证请求携带SIM卡的标识和第一安全密钥。在终端上使用第一安全密钥可以对访问请求携带的信息进行加密，服务器接收终端发送的访问请求后，使用第一安全密钥可以对其携带的信息进行解密，例如对SIM卡的标识进行加解密。
步骤502、OTA服务器将第一身份认证请求发送给BSS。
步骤503、BSS根据SIM卡的标识和第一安全密钥进行身份认证，当SIM卡的标识和第一安全密钥合法时，执行步骤504；当SIM卡的标识和第一安全密钥不合法时，执行步骤506。
BSS根据SIM卡的标识和第一安全密钥进行身份认证，得到第一身份认证结果。当SIM卡的标识和第一安全密钥合法时，第一身份认证结果可以包括第二安全密钥和/或通过验证消息。第二安全密钥不同于第一安全密钥。
当SIM卡的标识和第一安全密钥不合法时，第一身份认证结果为未通过验证消息，此时BSS和OTA可以拒绝该SIM卡所在终端的访问。
步骤504、BSS向OTA服务器发送包括第二安全密钥的第一身份认证结果。
步骤505、OTA服务器向终端发送包括第二安全密钥的第一身份认证结果。
步骤506、BSS向OTA服务器发送未通过验证消息。
步骤507、OTA服务器向终端发送未通过验证消息。
本实施例中，在终端发起身份认证请求之后，BSS可以根据身份认证请求携带的SIM卡的标识和第一安全密钥进行身份认证，这样可以判断出具有该SIM卡的终端是否合法，从而防止SIM卡被盗用，或者SIM卡被仿冒。
在以上实施例或可选实施例的基础上，在激活虚拟寄生USIM卡和获取第二安全密钥之后，为了进一步提高空中下载的安全性，本申请还可以对虚拟寄生USIM卡进行身份认证。下面以一个实施例详细说明：
参阅图6，本申请提供的身份认证方法的另一个实施例包括：
步骤601、终端向OTA服务器发送第二身份认证请求，第二身份认证请求携带有虚拟寄生USIM卡数据、SIM卡的标识和第二安全密钥。
步骤602、OTA服务器向BSS发送第二身份认证请求。
步骤603、BSS根据虚拟寄生USIM卡数据、SIM卡的标识和第二安全密钥进行身份认证。
BSS根据虚拟寄生USIM卡数据、SIM卡的标识和第二安全密钥进行身份认证，得到第 二身份认证结果。第二安全密钥用于对虚拟寄生USIM卡与SIM卡进行加解密。
BSS可以根据本地存储的虚拟寄生USIM卡与SIM卡的绑定关系判断第二身份认证请求携带的虚拟寄生USIM卡数据、SIM卡的标识是否合法。具体的，若第二身份认证请求携带的虚拟寄生USIM卡数据和SIM卡的标识分别对应的虚拟寄生USIM卡和SIM卡在BSS中不具有绑定关系，则确定虚拟寄生USIM卡数据和SIM卡的标识不合法；若第二身份认证请求携带的虚拟寄生USIM卡数据和SIM卡的标识分别对应的虚拟寄生USIM卡和SIM卡在BSS中具有绑定关系，确定虚拟寄生USIM卡数据和SIM卡的标识合法。
当虚拟寄生USIM卡数据、SIM卡的标识和第二安全密钥合法时，第二身份认证结果可以包括通过验证消息和/或第三安全密钥，第三安全密钥不同于第二安全密钥。当虚拟寄生USIM卡数据、SIM卡的标识和第二安全密钥不合法时，第二身份认证结果可以包括未通过验证消息，此时OTA服务器和BSS可以拒绝终端访问。
步骤604、BSS将包括第三安全密钥的第二身份认证结果发送给OTA服务器。
步骤605、OTA服务器将包括第三安全密钥的第二身份认证结果发送给终端。
步骤606、BSS将未通过验证消息发送给OTA服务器。
步骤607、OTA服务器将未通过验证消息发送给终端。
本实施例中，终端向BSS发送身份认证请求后，BSS可以根据虚拟寄生USIM卡数据、SIM卡的标识和第二安全密钥进行身份认证，防止SIM卡或者虚拟寄生USIM卡被盗用。
其次，通过更新安全密钥可以进一步提高空中下载的安全性。
可选的，终端可以周期性发送身份认证请求，该身份认证请求携带虚拟寄生USIM卡数据、SIM卡的标识和安全密钥，BSS可以对虚拟寄生USIM卡数据、SIM卡的标识和安全密钥进行身份认证，在获得身份认证结果之后可以生成新的安全密钥。这样通过周期性刷新密钥，可以防止虚拟寄生USIM卡被仿冒，从而提高虚拟寄生USIM卡的安全性。
在以上实施例或可选实施例的基础上，在激活虚拟寄生USIM卡后，本申请还可以去激活虚拟寄生USIM卡，以满足用户的去激活需求。下面以一个实施例详细介绍：
参阅图7，在另一个可选实施例中，本申请的空中下载方法包括：
步骤701、当终端满足虚拟寄生USIM卡去激活条件时，终端向HSS发送去附着请求。
具体的，当收到用户输入的去激活指令时，确定终端满足虚拟寄生USIM卡去激活条件。或者，当检测到虚拟寄生USIM卡异常时，例如终端的虚拟寄生USIM卡数据与服务器存储的虚拟寄生USIM卡数据不一致，或者终端存储的虚拟寄生USIM卡出现问题(例如数据不完整，或者虚拟寄生USIM卡数据错误)的情况下，确定终端满足虚拟寄生USIM卡去激活条件。
步骤702、HSS将去附着响应发送给终端。
HSS响应去附着请求，将虚拟寄生USIM卡设置为去附着状态，生成去附着响应，然后将去附着响应发送给终端。去附着响应用于指示虚拟寄生USIM卡处于去附着状态。
步骤703、终端根据去附着响应激活SIM卡。
终端接收HSS发送的去附着响应后，根据去附着响应激活SIM卡，这样可以接入第一无线网络处理业务。
步骤704、终端向OTA服务器发送虚拟寄生USIM卡去激活消息。
步骤705、OTA服务器根据虚拟寄生USIM卡去激活消息将虚拟寄生USIM卡设置为去激活状态。
步骤706、OTA服务器将虚拟寄生USIM卡去激活响应发送给终端。
步骤707、终端根据虚拟寄生USIM卡去激活响应将虚拟寄生USIM卡设置为去激活状态。
终端接收OTA服务器发送的虚拟寄生USIM卡去激活响应后，根据虚拟寄生USIM卡去激活响应将虚拟寄生USIM卡设置为去激活状态。
本实施例中，终端和网络侧设备均去激活虚拟寄生USIM卡，使得该虚拟寄生USIM卡处于去激活状态，此时所有终端无法使用该虚拟寄生USIM卡接入网络。
在去激活虚拟寄生USIM卡的过程中，OTA服务器还可以向BSS发送虚拟寄生USIM卡去激活消息，BSS根据虚拟寄生USIM卡去激活消息将本地的虚拟寄生USIM卡设置为去激活状态。并且，BSS可以保留虚拟寄生USIM卡的开户信息。
可选的，BSS向HSS发送虚拟寄生USIM卡去激活消息，HSS根据虚拟寄生USIM卡去激活消息删除虚拟寄生USIM卡与SIM卡的绑定关系。
在以上实施例或可选实施例的基础上，在去激活虚拟寄生USIM卡之后，本申请还可以根据实际需求再次激活虚拟寄生USIM卡。下面以一个实施例详细介绍：
参阅图8，在另一个可选实施例中，本申请的空中下载方法还包括：
步骤801、终端向OTA服务器发送虚拟寄生USIM卡激活请求。
步骤802、OTA服务器响应虚拟寄生USIM卡激活请求，将虚拟寄生USIM卡激活请求发送给BSS。
步骤803、BSS根据虚拟寄生USIM卡激活请求将本地的虚拟寄生USIM卡设置为激活状态。
步骤804、BSS将激活成功消息发送给OTA服务器。
步骤805、OTA服务器将激活成功消息发送给终端。
步骤806、终端根据激活成功消息去激活SIM卡，将虚拟寄生USIM卡设置为激活状态。
终端接收OTA服务器发送的激活成功消息后，根据激活成功消息可以确定BSS已激活虚拟寄生USIM卡，然后去激活SIM卡以及将虚拟寄生USIM卡设置为激活状态。这样终端可以根据虚拟寄生USIM卡向HSS发起附着请求，以接入第二无线网络。
可选的，在收到虚拟寄生USIM卡激活请求之后，OTA服务器激活本地的虚拟寄生USIM卡。另一可选的，BSS将虚拟寄生USIM卡激活请求发送给HSS，HSS激活本地的虚拟寄生USIM卡，并且将虚拟寄生USIM卡与其对应的SIM卡重新绑定。
在以上实施例或可选实施例的基础上，为了提高虚拟寄生USIM卡的安全性，本申请还提供一种位置更新通知来防止虚拟寄生USIM卡被盗。参阅图9，在一个可选实施例中，本申请中的空中下载方法还包括：
步骤901、终端向HSS发送位置更新请求。位置更新请求包括终端的当前归属地信息。
步骤902、HSS根据位置更新请求更新终端的位置以及生成第一位置更新通知。HSS生 成的第一位置更新通知携带虚拟寄生USIM卡数据。
除了根据位置更新请求生成第一位置更新通知之外，HSS还可以根据注册请求生成第一位置更新通知。具体的，终端向HSS发送注册请求，注册请求包括终端的当前归属地信息；HSS根据注册请求更新终端的位置以及生成第一位置更新通知。
步骤903、HSS将第一位置更新通知发送给OTA服务器。
步骤904、终端向OTA服务器发送第二位置更新通知。
具体的，终端向HSS发送位置更新请求之后，终端等待一段时间后向OTA服务器发送第二位置更新通知，等待时长可以根据实际情况进行设置，本申请不作限定。或者，HSS根据位置更新请求更新终端的位置后，生成位置更新完成通知，将位置更新完成通知发送给终端。终端在收到HSS发送的位置更新完成通知后，向OTA服务器发送第二位置更新通知。终端发送的第二位置更新通知携带有虚拟寄生USIM卡数据和SIM卡的标识。
步骤905、OTA服务器从收到第一位置更新通知开始计时。
步骤906、若在设定时长内收到终端发送的第二位置更新通知，将位置更新完成消息发送给终端。
步骤907、若在设定时长内未收到终端发送的第二位置更新通知，去激活虚拟寄生USIM卡。
除了去激活虚拟寄生USIM卡之外，还可以采用删除本地存储的虚拟寄生USIM卡，和/或解除虚拟寄生USIM卡与SIM卡的绑定关系的方法。
步骤908、OTA服务器向终端发送虚拟寄生USIM卡异常通知。
设定时长可以根据实际情况进行设置，例如，终端向HSS发送位置更新请求后，HSS将位置更新完成通知发送给终端。终端在收到位置更新完成通知后，向OTA服务器发送第二位置更新通知。这样可以将终端发送位置更新请求的时刻作为起始时刻，将终端收到位置更新完成消息的时刻作为结束时刻，将该起始时刻到该结束时刻之间的时长作为上述设定时长。可以理解的是，设定时长不限于以上举例，本申请对其取值不作限定。
本实施例中，合法终端在位置更新后能够向OTA服务器发送位置更新通知，位置更新通知携带虚拟寄生USIM卡数据和SIM卡的标识。盗用虚拟寄生USIM卡的终端可能复制了该虚拟寄生USIM卡数据而未配置管理虚拟寄生USIM卡的应用程序，这样盗卡终端不会向OTA服务器发送位置更新通知，由于OTA服务器收到了HSS发送的位置更新通知且在设定时长内未收到终端发送的位置更新通知，因此判断未发送位置更新通知的终端是盗卡终端，OTA服务器去激活该虚拟寄生USIM卡，这样可以防止虚拟寄生USIM卡被盗用。
基于图9所示实施例，在一个可选实施例中，终端根据虚拟寄生USIM卡异常通知去激活当前的虚拟寄生USIM卡，以及激活SIM卡。
本实施例中，在虚拟寄生USIM卡异常的情况下，终端和OTA服务器可以去激活虚拟寄生USIM，然后通过SIM卡接入第一无线网络。
OTA服务器还可以向BSS或HSS发送去激活虚拟寄生USIM卡请求，当BSS和HSS收到去激活虚拟寄生USIM卡的请求时，BSS和HSS可以去激活本地的虚拟寄生USIM卡。去激活异常的虚拟寄生USIM卡之后，合法终端还可以根据以上实施例中的空中下载方法重新申 请虚拟寄生USIM卡并激活。
以上对本申请中的空中下载方法进行了介绍，下面对本申请中用于实现以上空中下载方法的装置进行介绍。
参阅图10，本申请提供一种终端1000能够实现以上实施例的空中下载方法中由终端执行的步骤。在一个实施例中，终端1000包括接收模块1001、处理模块1002、发送模块1003、SIM卡1004和包括TEE的存储模块1005；接收模块1001、处理模块1002、发送模块1003、SIM卡1004和存储模块1005通过总线1006连接。
发送模块1003，用于向OTA服务器发送虚拟寄生USIM卡申请消息，虚拟寄生USIM卡申请消息携带终端的SIM卡的标识；
接收模块1001，用于接收OTA服务器发送的虚拟寄生USIM卡数据和绑定标识，虚拟寄生USIM卡数据是OTA服务器从业务支撑系统BSS获取的，绑定标识用于标识虚拟寄生USIM卡数据与SIM卡具有绑定关系，虚拟寄生USIM卡和SIM卡对应同一MSISDN；
处理模块1002，用于当SIM卡在位时，根据虚拟寄生USIM卡数据和绑定标识在TEE中激活虚拟寄生USIM卡，虚拟寄生USIM卡用于接入第二无线网络；
处理模块1002，还用于去激活SIM卡。
在一个可选实施例中，
接收模块1001，还用于在发送模块1003向OTA服务器发送虚拟寄生USIM卡申请消息之前，接收OTA服务器发送的短消息，短消息用于通知终端申请虚拟寄生USIM卡。
在另一个可选实施例中，
发送模块1003，还用于向OTA服务器发送第一身份认证请求，第一身份认证请求携带有SIM卡的标识和第一安全密钥；
接收模块1001，还用于接收OTA服务器发送的第一身份认证结果，第一身份认证结果包括第二安全密钥或者未通过验证消息，第二安全密钥是当BSS确定SIM卡的标识和第一安全密钥合法的情况下发送给OTA服务器的，未通过验证消息是BSS确定SIM卡的标识和第一安全密钥非法的情况下发送给OTA服务器的。
在另一个可选实施例中，
接收模块1001，还用于在接收模块1001接收OTA服务器发送的第二安全密钥之后，向OTA服务器发送第二身份认证请求，第二身份认证请求携带有虚拟寄生USIM卡数据、SIM卡的标识和第二安全密钥；
接收OTA服务器发送的第二身份认证结果。
在另一个可选实施例中，
发送模块1003，还用于当终端满足虚拟寄生USIM卡去激活条件时，向HSS发送去附着请求；
接收模块1001，还用于接收HSS发送的去附着响应，去附着响应用于指示虚拟寄生USIM卡处于去附着状态；
处理模块1002，还用于根据去附着响应激活SIM卡；
处理模块1002，还用于向OTA服务器发送虚拟寄生USIM卡去激活消息；
接收模块1001，还用于接收OTA服务器发送的虚拟寄生USIM卡去激活响应；
处理模块1002，还用于根据虚拟寄生USIM卡去激活响应将虚拟寄生USIM卡设置为去激活状态。
在另一个可选实施例中，
处理模块1002，还用于当接收模块收到去激活指令时，确定终端满足虚拟寄生USIM卡去激活条件；或者，当检测到虚拟寄生USIM卡异常时，确定终端满足虚拟寄生USIM卡去激活条件。
在另一个可选实施例中，
发送模块1003，还用于在处理模块将USIM卡设置为去激活状态之后，向OTA服务器发送虚拟寄生USIM卡激活请求；
接收模块1001，还用于接收OTA服务器发送的激活成功消息；
处理模块1002，还用于根据激活成功消息去激活SIM卡以及将虚拟寄生USIM卡设置为激活状态。
在另一个可选实施例中，
发送模块1003，还用于向HSS发送位置更新请求，位置更新请求用于HSS生成第一位置更新通知；
发送模块1003，还用于向OTA服务器发送第二位置更新通知；
接收模块1001，还用于接收OTA服务器发送的虚拟寄生USIM卡异常通知，虚拟寄生USIM卡异常通知是OTA服务器在收到HSS发送的第一位置更新通知之后且在设定时长内没有收到终端发送的第二位置更新通知的情况下发送的；
处理模块1002，还用于根据虚拟寄生USIM卡异常通知去激活虚拟寄生USIM卡以及激活SIM卡。
在另一个可选实施例中，
处理模块1002，还用于在处理模块1002激活虚拟寄生USIM卡之后，当SIM卡不在位时，去激活虚拟寄生USIM卡。
在另一个可选实施例中，
处理模块1002，还用于在处理模块使用USIM卡接入第二无线网络之后，当SIM卡不在位的时长超过预设时长时，删除虚拟寄生USIM卡。
在另一个可选实施例中，
发送模块1003，还用于当SIM卡在位且存在与SIM卡对应的虚拟寄生USIM卡时，向BSS发送业务查询请求，业务查询请求用于查询在BSS中是否存在待激活业务；
接收模块1001，还用于接收BSS发送的查询结果；
处理模块1002，还用于当查询结果为在BSS中存在待激活业务时，激活SIM卡对应的虚拟寄生USIM卡；当SIM卡在位且未配置与SIM卡对应的虚拟寄生USIM卡时，触发发送模块1003向OTA服务器发送虚拟寄生USIM卡申请消息的步骤。
在另一个可选实施例中，第一无线网络为2G网络或者3G网络，第二无线网络为4G网络。
对于以上终端中各模块执行的步骤和有益效果均可参考前文方法实施例中的描述，此处不再赘述。
参阅图11，本申请提供一种OTA服务器1100能够实现以上实施例的空中下载方法中由OTA服务器执行的步骤。在一个实施例中，OTA服务器1100包括接收模块1101、处理模块1102和发送模块1103；
接收模块1101，用于接收终端发送的虚拟寄生USIM卡申请消息，虚拟寄生USIM卡申请消息携带终端的SIM卡的标识；
处理模块1102，用于根据虚拟寄生USIM卡申请消息获取虚拟寄生USIM卡数据和绑定标识；
发送模块1103，还用于将虚拟寄生USIM卡数据和绑定标识发送给终端，虚拟寄生USIM卡数据和绑定标识用于激活虚拟寄生USIM卡。
在一个可选实施例中，处理模块1102，具体用于根据虚拟寄生USIM卡申请消息携带的SIM卡标识，从本地存储的虚拟寄生USIM卡文件中获取虚拟寄生USIM卡数据和绑定标识。
在另一个可选实施例中，处理模块1102，具体用于将虚拟寄生USIM卡申请消息发送给BSS；接收BSS发送的虚拟寄生USIM卡数据和绑定标识。具体的，处理模块1102包括接收单元和发送单元，发送单元用于将虚拟寄生USIM卡申请消息发送给BSS；接收单元用于接收BSS发送的虚拟寄生USIM卡数据和绑定标识。可选的，接收单元和发送单元的功能还可以通过接收模块1101和发送模块1103实现。
在另一个可选实施例中，
发送模块1103，还用于向终端发送短消息，短消息用于指示终端向OTA服务器发送虚拟寄生USIM卡申请消息。
在另一个可选实施例中，
接收模块1101，还用于接收终端发送的第一身份认证请求，第一身份认证请求携带有SIM卡的标识和第一安全密钥；
发送模块1103，还用于将第一身份认证请求发送给BSS；
接收模块1101，还用于接收BSS发送的第一身份认证结果，第一身份认证结果是BSS根据SIM卡的标识和第一安全密钥进行认证所得；
发送模块1103，还用于将第一身份认证结果发送给终端。
在另一个可选实施例中，
接收模块1101，还用于在第一身份认证结果包括第二安全密钥的情况下，接收终端发送的第二身份认证请求，第二身份认证请求携带有虚拟寄生USIM卡数据、SIM卡的标识和第二安全密钥；
发送模块1103，还用于将第二身份认证请求发送给BSS；
接收模块1101，还用于接收BSS发送的第二身份认证结果，第二身份认证结果是BSS根据虚拟寄生USIM卡数据、SIM卡的标识和第二安全密钥进行认证得到的。
在另一个可选实施例中，
接收模块1101，还用于接收终端发送的虚拟寄生USIM卡去激活消息；
发送模块1103，还用于将虚拟寄生USIM卡去激活消息发送给BSS；
接收模块1101，还用于接收BSS发送的虚拟寄生USIM卡去激活完成消息；
处理模块1102，还用于根据虚拟寄生USIM卡去激活完成消息将本地存储的USIM卡状态设置为去激活状态；
发送模块1103，还用于将虚拟寄生USIM卡去激活完成消息发送给终端。
在另一个可选实施例中，
接收模块1101，还用于接收终端发送的虚拟寄生USIM卡激活请求；
发送模块1103，还用于将虚拟寄生USIM卡激活请求发送给BSS；
接收模块1101，还用于接收BSS发送的激活成功消息；
处理模块1102，还用于根据激活成功消息将本地的虚拟寄生USIM卡状态设置为激活状态；
发送模块1103，还用于将激活成功消息发送给终端。
在另一个可选实施例中，
接收模块1101，还用于接收HSS发送的第一位置更新通知；
处理模块1102，还用于从收到HSS发送的第一位置更新通知的时刻开始计时；
发送模块1103，还用于当在设定时长内未收到终端发送的第二位置更新通知的情况下，向终端发送虚拟寄生USIM卡异常通知。
对于以上OTA服务器中各模块执行的步骤和有益效果均可参考前文记载的方法实施例中的描述，此处不再赘述。
本申请还提供一种计算机存储介质，包括指令；当其在计算机上运行时，使得计算机执行以上实施例中空中下载方法中由终端执行的步骤；或者，当其在计算机上运行时，使得计算机执行以上实施例中空中下载方法中由OTA服务器执行的步骤；或者，当其在计算机上运行时，使得计算机执行以上实施例中空中下载方法中由BSS执行的步骤；或者，当其在计算机上运行时，使得计算机执行以上实施例中空中下载方法中由HSS执行的步骤。
本申请中的终端执行的步骤具体可以由终端内的芯片完成，该芯片包括：处理单元和通信单元。处理单元可以是处理器，通信单元例如可以是输入/输出接口、管脚或电路等。该处理单元可执行存储单元存储的计算机执行指示，以使终端执行图3至图8所示的任意一个实施例中的空中下载方法。可选地，所述存储单元为所述芯片内的存储单元，如寄存器、缓存等，所述存储单元还可以是所述终端内位于所述芯片外部的存储单元，如只读存储器(read-only memory，ROM)或可存储静态信息和指示的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)等。上述任一处提到的处理器，可以是一个通用中央处理器，微处理器，专用集成电路(application specific integrated circuit，ASIC)或一个或多个用于控制上述空中下载方法的程序执行的集成电路。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。
所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机 程序指令时，全部或部分地产生按照本申请所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存储的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘(solid state disk，SSD))等。
以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例的技术方案的范围。

Claims (27)

  1. 一种空中下载方法，其特征在于，所述方法应用于具有用户身份识别模块SIM卡和可信执行环境TEE的终端，所述SIM卡支持第一无线网络且不支持第二无线网络；所述方法包括：
    向空中下载OTA服务器发送虚拟寄生全球用户身份识别模块USIM卡申请消息，所述虚拟寄生USIM卡申请消息携带所述SIM卡的标识；
    接收所述OTA服务器发送的虚拟寄生USIM卡数据和绑定标识，所述虚拟寄生USIM卡数据对应的虚拟寄生USIM卡与所述SIM卡对应同一移动台综合业务数字网号码；
    当所述SIM卡在位时，根据所述虚拟寄生USIM卡数据和所述绑定标识在所述TEE中激活虚拟寄生USIM卡，所述虚拟寄生USIM卡用于接入所述第二无线网络；
    去激活所述SIM卡。
  2. 根据权利要求1所述的方法，其特征在于，在所述向所述OTA服务器发送虚拟寄生USIM卡申请消息之前，所述方法还包括：
    接收所述OTA服务器发送的短消息，所述短消息用于通知所述终端申请虚拟寄生USIM卡。
  3. 根据权利要求1所述的方法，其特征在于，在所述接收所述OTA服务器发送的虚拟寄生USIM卡数据和绑定标识之前，所述方法还包括：
    向所述OTA服务器发送第一身份认证请求，所述第一身份认证请求携带SIM卡的标识和第一安全密钥；
    接收所述OTA服务器发送的第一身份认证结果，所述第一身份认证结果包括第二安全密钥或者未通过验证消息。
  4. 根据权利要求3所述的方法，其特征在于，在所述接收所述OTA服务器发送的第一身份认证结果之后，所述方法还包括：
    当所述第一身份认证结果包括所述第二安全密钥时，向所述OTA服务器发送第二身份认证请求，所述第二身份认证请求携带有虚拟寄生USIM卡数据、所述SIM卡的标识和所述第二安全密钥；
    接收所述OTA服务器发送的第二身份认证结果，所述第二身份认证结果是所述BSS根据所述虚拟寄生USIM卡数据、SIM卡的标识和第二安全密钥对所述终端进行认证所得。
  5. 根据权利要求1至4中任一项所述的方法，其特征在于，在所述根据所述虚拟寄生USIM卡数据和所述绑定标识在所述TEE中激活虚拟寄生USIM卡之后，所述方法还包括：
    向HSS发送位置更新请求，所述位置更新请求用于所述HSS生成第一位置更新通知；
    向所述OTA服务器发送第二位置更新通知；
    接收所述OTA服务器发送的虚拟寄生USIM卡异常通知，所述虚拟寄生USIM卡异常通知是所述OTA服务器在收到所述第一位置更新通知之后且在设定时长内没有收到所述第二位置更新通知时发送的；
    根据所述虚拟寄生USIM卡异常通知去激活所述虚拟寄生USIM卡以及激活所述SIM卡。
  6. 根据权利要求1至4中任一项所述的方法，其特征在于，在所述根据所述虚拟寄生 USIM卡数据和所述绑定标识在所述TEE中激活虚拟寄生USIM卡之后，所述方法还包括：
    当所述SIM卡不在位时，去激活所述虚拟寄生USIM卡；或者，
    当所述SIM卡不在位的时长超过预设时长时，删除所述虚拟寄生USIM卡。
  7. 一种空中下载方法，其特征在于，所述方法应用于OTA服务器，所述方法包括：
    接收终端发送的虚拟寄生全球用户身份识别模块USIM卡申请消息，所述虚拟寄生USIM卡申请消息携带终端的SIM卡标识，所述终端具有SIM卡和可信执行环境，所述SIM卡支持第一无线网络且不支持第二无线网络；
    根据所述虚拟寄生USIM卡申请消息获取虚拟寄生USIM卡数据和绑定标识；
    将所述虚拟寄生USIM卡数据和绑定标识发送给所述终端，所述虚拟寄生USIM卡数据和绑定标识用于激活虚拟寄生USIM卡。
  8. 根据权利要求7所述的方法，其特征在于，所述根据所述虚拟寄生USIM卡申请消息获取虚拟寄生USIM卡数据和绑定标识包括：
    根据所述虚拟寄生USIM卡申请消息携带的SIM卡标识，从本地存储的虚拟寄生USIM卡文件中获取虚拟寄生USIM卡数据和绑定标识。
  9. 根据权利要求7所述的方法，其特征在于，所述根据所述虚拟寄生USIM卡申请消息获取虚拟寄生USIM卡数据和绑定标识包括：
    将所述虚拟寄生USIM卡申请消息发送给BSS；
    接收所述BSS发送的虚拟寄生USIM卡数据和绑定标识。
  10. 根据权利要求7所述的方法，其特征在于，在所述接收终端发送的虚拟寄生全球用户身份识别模块USIM卡申请消息之前，所述方法还包括：
    向所述终端发送短消息，所述短消息用于指示所述终端向所述OTA服务器发送所述虚拟寄生USIM卡申请消息。
  11. 根据权利要求7所述的方法，其特征在于，所述方法还包括：
    接收所述终端发送的第一身份认证请求，所述第一身份认证请求携带有SIM卡的标识和第一安全密钥；
    将所述第一身份认证请求发送给所述BSS；
    接收所述BSS发送的第一身份认证结果，所述第一身份认证结果是所述BSS根据所述SIM卡的标识和所述第一安全密钥进行认证所得；
    将所述第一身份认证结果发送给所述终端。
  12. 根据权利要求11所述的方法，其特征在于，所述第一身份认证结果包括第二安全密钥；
    在所述将所述第一身份认证结果发送给所述终端之后，所述方法还包括：
    接收所述终端发送的第二身份认证请求，所述第二身份认证请求携带有虚拟寄生USIM卡数据、所述SIM卡的标识和所述第二安全密钥；
    将所述第二身份认证请求发送给所述BSS；
    接收所述BSS发送的第二身份认证结果，所述第二身份认证结果是所述BSS根据所述虚拟寄生USIM卡数据、SIM卡的标识和第二安全密钥进行认证得到的。
  13. 根据权利要求7至12中任一项所述的方法，其特征在于，所述方法还包括：
    接收所述HSS发送的第一位置更新通知；
    从收到所述第一位置更新通知的时刻开始计时；
    在设定时长内收到所述终端发送的第二位置更新通知时，向所述终端发送虚拟寄生USIM卡发送位置更新完成消息；
    在所述设定时长内未收到所述第二位置更新通知时，去激活所述虚拟寄生USIM卡；
    向所述终端发送虚拟寄生USIM卡异常通知。
  14. 一种终端，其特征在于，包括：
    接收模块、处理模块、发送模块、用户身份识别模块SIM卡和包括可信执行环境TEE的存储模块；
    所述发送模块，用于向空中下载OTA服务器发送虚拟寄生全球用户身份识别模块USIM卡申请消息，所述虚拟寄生USIM卡申请消息携带终端的SIM卡的标识；
    所述接收模块，用于接收所述OTA服务器发送的虚拟寄生USIM卡数据和绑定标识，所述虚拟寄生USIM卡数据对应的虚拟寄生USIM卡与所述SIM卡对应同一移动台综合业务数字网号码；
    所述处理模块，用于当所述SIM卡在位时，根据所述虚拟寄生USIM卡数据和所述绑定标识在所述TEE中激活所述虚拟寄生USIM卡，所述虚拟寄生USIM卡用于接入所述第二无线网络；
    所述处理模块，还用于去激活所述SIM卡。
  15. 根据权利要求14所述的终端，其特征在于，
    所述接收模块，还用于在所述发送模块向所述OTA服务器发送虚拟寄生USIM卡申请消息之前，接收所述OTA服务器发送的短消息，所述短消息用于通知所述终端申请虚拟寄生USIM卡。
  16. 根据权利要求14所述的终端，其特征在于，
    所述发送模块，还用于向所述OTA服务器发送第一身份认证请求，所述第一身份认证请求携带有SIM卡的标识和第一安全密钥；
    所述接收模块，还用于接收所述OTA服务器发送的第一身份认证结果，所述第一身份认证结果包括第二安全密钥或者未通过验证消息。
  17. 根据权利要求16所述的终端，其特征在于，
    所述接收模块，还用于在所述接收所述OTA服务器发送的第二安全密钥之后，向所述OTA服务器发送第二身份认证请求，所述第二身份认证请求携带有虚拟寄生USIM卡数据、所述SIM卡的标识和所述第二安全密钥；
    接收所述OTA服务器发送的第二身份认证结果。
  18. 根据权利要求14至17中任一项所述的终端，其特征在于，
    所述发送模块，还用于向HSS发送位置更新请求，所述位置更新请求用于所述HSS生成第一位置更新通知；
    所述发送模块，还用于向OTA服务器发送第二位置更新通知；
    所述接收模块，还用于接收所述OTA服务器发送的虚拟寄生USIM卡异常通知，所述虚拟寄生USIM卡异常通知是所述OTA服务器在收到所述第一位置更新通知之后且在设定时长内没有收到所述第二位置更新通知时发送的；
    所述处理模块，还用于根据所述虚拟寄生USIM卡异常通知去激活所述虚拟寄生USIM卡以及激活所述SIM卡。
  19. 根据权利要求14至17中任一项所述的终端，其特征在于，
    所述处理模块，还用于当所述SIM卡不在位时，去激活所述虚拟寄生USIM卡；或用于当所述SIM卡不在位的时长超过预设时长时，删除所述虚拟寄生USIM卡。
  20. 一种空中下载OTA服务器，其特征在于，包括：
    接收模块，用于接收终端发送的虚拟寄生全球用户身份识别模块USIM卡申请消息，所述虚拟寄生USIM卡申请消息携带终端的SIM卡的标识；
    处理模块，用于根据所述虚拟寄生USIM卡申请消息获取虚拟寄生USIM卡数据和绑定标识；
    发送模块，用于将所述虚拟寄生USIM卡数据和绑定标识发送给所述终端，所述虚拟寄生USIM卡数据和绑定标识用于激活虚拟寄生USIM卡。
  21. 根据权利要求20所述的OTA服务器，其特征在于，
    所述处理模块，具体用于根据所述虚拟寄生USIM卡申请消息携带的SIM卡标识，从本地存储的虚拟寄生USIM卡文件中获取虚拟寄生USIM卡数据和绑定标识。
  22. 根据权利要求20所述的OTA服务器，其特征在于，
    所述处理模块具体用于将所述虚拟寄生USIM卡申请消息发送给BSS；接收所述BSS发送的虚拟寄生USIM卡数据和绑定标识。
  23. 根据权利要求20所述的OTA服务器，其特征在于，
    所述发送模块，还用于向所述终端发送短消息，所述短消息用于指示所述终端发送所述虚拟寄生USIM卡申请消息。
  24. 根据权利要求20所述的OTA服务器，其特征在于，
    所述接收模块，还用于接收所述终端发送的第一身份认证请求，所述第一身份认证请求携带有SIM卡的标识和第一安全密钥；
    所述发送模块，还用于将所述第一身份认证请求发送给所述BSS；
    所述接收模块，还用于接收所述BSS发送的第一身份认证结果，所述第一身份认证结果是所述BSS根据所述SIM卡的标识和所述第一安全密钥进行认证所得；
    所述发送模块，还用于将所述第一身份认证结果发送给所述终端。
  25. 根据权利要求24所述的OTA服务器，其特征在于，
    所述接收模块，还用于在所述第一身份认证结果包括第二安全密钥的情况下，接收所述终端发送的第二身份认证请求，所述第二身份认证请求携带有虚拟寄生USIM卡数据、所述SIM卡的标识和所述第二安全密钥；
    所述发送模块，还用于将所述第二身份认证请求发送给所述BSS；
    所述接收模块，还用于接收所述BSS发送的第二身份认证结果，所述第二身份认证结 果是所述BSS根据所述虚拟寄生USIM卡数据、SIM卡的标识和第二安全密钥进行认证所得。
  26. 根据权利要求20至25中任一项所述的OTA服务器，其特征在于，
    所述接收模块，还用于接收所述HSS发送的第一位置更新通知；
    所述处理模块，还用于从收到所述第一位置更新通知的时刻开始计时；
    所述发送模块，还用于在设定时长内收到所述终端发送的第二位置更新通知时，去激活所述虚拟寄生USIM卡；
    所述发送模块，还用于向所述终端发送虚拟寄生USIM卡异常通知。
  27. 一种计算机存储介质，包括指令，其特征在于，当其在计算机上运行时，使得计算机执行如权利要求1至13中任意一项所述的空中下载方法。
PCT/CN2021/096087 2020-05-29 2021-05-26 一种空中下载方法和相关设备 WO2021238989A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010475662.X 2020-05-29
CN202010475662.XA CN113747419B (zh) 2020-05-29 2020-05-29 一种空中下载方法和相关设备

Publications (1)

Publication Number Publication Date
WO2021238989A1 true WO2021238989A1 (zh) 2021-12-02

Family

ID=78724648

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/096087 WO2021238989A1 (zh) 2020-05-29 2021-05-26 一种空中下载方法和相关设备

Country Status (2)

Country Link
CN (1) CN113747419B (zh)
WO (1) WO2021238989A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103916844A (zh) * 2012-12-31 2014-07-09 华为技术有限公司 客户识别模块卡开通方法及虚拟客户识别模块卡服务器
US20160286399A1 (en) * 2009-03-31 2016-09-29 Microsoft Technology Licensing, Llc Subscriber identity module (sim) for mobile stations
CN106332030A (zh) * 2016-08-18 2017-01-11 努比亚技术有限公司 一种基于虚拟卡的通信方法及装置
CN107690135A (zh) * 2017-09-30 2018-02-13 联想(北京)有限公司 一种智能卡控制方法及电子设备

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103813303B (zh) * 2012-11-12 2018-02-23 中国移动通信集团公司 一种eSIM卡更新签约关系的方法、系统及相应设备
US10264449B2 (en) * 2015-10-19 2019-04-16 Hfi Innovation Inc. Method of SIM-less subscription mechanism for mobile cellular networks
US11282056B2 (en) * 2016-04-20 2022-03-22 Thales Dis Usa, Inc. Method, servers and system for downloading an updated profile
KR102484367B1 (ko) * 2016-09-09 2023-01-04 삼성전자주식회사 UICC와 eUICC의 제어 방법 및 시스템
CN109474650B (zh) * 2017-09-08 2021-04-20 中国移动通信有限公司研究院 一种配置文件下载方法及终端
CN110225487B (zh) * 2018-03-02 2020-12-15 华为技术有限公司 Profile生成、获取方法及相关设备和存储介质
US10567952B1 (en) * 2018-11-27 2020-02-18 T-Mobile Usa, Inc. ESIM subsidy and operational management

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160286399A1 (en) * 2009-03-31 2016-09-29 Microsoft Technology Licensing, Llc Subscriber identity module (sim) for mobile stations
CN103916844A (zh) * 2012-12-31 2014-07-09 华为技术有限公司 客户识别模块卡开通方法及虚拟客户识别模块卡服务器
CN106332030A (zh) * 2016-08-18 2017-01-11 努比亚技术有限公司 一种基于虚拟卡的通信方法及装置
CN107690135A (zh) * 2017-09-30 2018-02-13 联想(北京)有限公司 一种智能卡控制方法及电子设备

Also Published As

Publication number Publication date
CN113747419B (zh) 2023-04-07
CN113747419A (zh) 2021-12-03

Similar Documents

Publication Publication Date Title
US10349267B1 (en) Systems and methods for transferring SIM profiles between eUICC devices
US10911939B2 (en) Embedded universal integrated circuit card profile management method and apparatus
US9788209B2 (en) Apparatus and methods for controlling distribution of electronic access clients
EP3122080B1 (en) Method for distributing virtual user identification data, method for acquiring virtual user identification data, and device
US9112905B2 (en) Authentication of access terminal identities in roaming networks
JP5834150B2 (ja) ネットワーク支援の不正検出装置及び方法
US20080293397A1 (en) Method for Disabling a Mobile Device
WO2020078425A1 (zh) 网络接入方法、终端及计算机存储介质
WO2017041299A1 (zh) 一种SIM卡向eUICC迁移的方法、设备及系统
WO2018000834A1 (zh) 一种wifi热点信息修改方法及装置
US20100062808A1 (en) Universal integrated circuit card having a virtual subscriber identity module functionality
US20090253409A1 (en) Method of Authenticating Home Operator for Over-the-Air Provisioning of a Wireless Device
US8260885B2 (en) Method and system for bootstrap of a device
KR20160120598A (ko) 무선 통신 시스템에서 단말에 프로파일을 다운로드 하는 방법 및 장치
KR102017442B1 (ko) 이동 단말기 상에 가입자 정보를 제공하기 위한 방법 및 장치들
JP2013522989A (ja) アクセス端末識別情報の認証の円滑化
JP2013529019A (ja) 無線ネットワーク認証装置及び方法
KR20130132290A (ko) 이동통신사업자 정보 제공 방법 및 이를 수행하는 장치
WO2019041166A1 (zh) 更新固件的方法及相关装置
KR20070108364A (ko) 이동국에서의 방법, 네트워크 요소에서의 방법, 이동국, 인증 시스템, 네트워크 요소 및 컴퓨터 판독 가능한 기록 매체
WO2020029754A1 (zh) 一种签约信息配置方法及通信设备
US10291613B1 (en) Mobile device authentication
US10588018B2 (en) Enhanced security for electronic devices
US10820265B2 (en) IoT device connectivity provisioning
WO2018171092A1 (zh) 权限更新方法和终端设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21811786

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21811786

Country of ref document: EP

Kind code of ref document: A1