Service-oriented trusted execution module and communication method

Abstract

A service-oriented trusted execution module and communication method of the present invention can solve the technical problem that the functions of existing security chips and SIM cards have no intersection and low efficiency. It includes a security chip SOTEM module and a communication module, and the security chip SOTEM module includes an eSIM application module and an eSAM application module; the SOTEM module is connected to the communication module, and the communication module calls the eSIM application function in the SOTEM to implement the operator network access function, and at the same time, the security management function of calling the eSAM application module in the SOTEM module is implemented through the processor in the communication module. The service-oriented trusted execution module of the present invention can minimize the terminal volume while avoiding the situation where the SIM card has poor contact and cannot communicate due to harsh deployment scene environment or vibration, and further improves the stability of the chip. It not only simplifies the production process, but also does not need to connect with eSIM chip manufacturers and security chip manufacturers separately, greatly shortens the product development cycle, and can also more efficiently ensure the security of communication information.

Description

Technical Field

[0001] The present invention relates to the technical field of security chips, and in particular to a service-oriented trusted execution module and a communication method. Background Art

[0002] A security chip is a device that can independently generate keys, encrypt and decrypt. It has an independent processor and storage unit inside, which can safely store keys and feature data. The technology related to security chips is very mature and has been applied in many fields including finance and certificates. Security chips have built-in different cryptographic algorithms, providing data security protection, identity authentication and other functions, providing a strong guarantee for solving security problems.

[0003] ESIM card, or Embedded-SIM, is an embedded SIM card. The concept of eSIM card is to embed the traditional SIM card directly into the device chip, rather than adding it to the device as an independent removable component. Users do not need to insert a physical SIM card, just like the PHS in the early years. This approach will allow users to choose operator packages more flexibly, or change operators at any time without unlocking the device or purchasing a new device. The establishment of a universal eSIM standard in the future will save more mobile device usage costs for ordinary consumers and corporate users, and bring more convenience and security.

[0004] The functions of current security chips and SIM cards do not overlap. Supporting their functions requires at least two chips, which limits the size of the terminal. In addition, it is necessary to connect with the manufacturers of the two chips separately, which also requires a lot of development work. Summary of the invention

[0005] The service-oriented trusted execution module and communication method proposed in the present invention can solve the technical problem that the functions of the existing security chip and SIM card have no overlap and the use efficiency is low.

[0006] To achieve the above object, the present invention adopts the following technical solutions:

[0007] A service-oriented trusted execution module, comprising a security chip SOTEM module and a communication module, wherein the security chip SOTEM module comprises an eSIM application module and an eSAM application module;

[0008] The SOTEM module is connected to the communication module, and the communication module calls the eSIM application function in the SOTEM to implement the operator network access function, and at the same time, the security management function of calling the eSAM application module in the SOTEM module is implemented through the processor in the communication module.

[0009] Furthermore, the SOTEM module is connected to the MCU module to implement the identity authentication, key negotiation, signature / verification, encryption / decryption, and secure storage and security management functions of the MCU module invoking the eSAM application;

[0010] The MCU module and the communication module are connected to each other so that the MCU module sends AT instructions to the communication module to interact with the communication module.

[0011] Furthermore, the eSAM module has identity authentication, key negotiation, signature / verification, encryption / decryption, and secure storage functions, and is used for secure interaction between the device and the backend or between devices;

[0012] The eSIM module complies with GSM and UICC specifications, has single and double authentication, secure storage, and over-the-air download functions, and is used for device networking and remote management;

[0013] The eSAM module and the eSIM module are isolated from each other and do not affect each other. The eSAM provides security protection for keys and data based on security domain isolation and Security Profile rules; the eSIM application manages its files and data based on security authentication.

[0014] On the other hand, the present invention also discloses a service-oriented trusted execution module communication method, comprising the following steps:

[0015] S100, the chip issuer writes the file system of the eSIM application module and the security policy Security Profile and default key parameter Key data allocated to the service in the eSAM application module into the SOTEM module;

[0016] S200, the data preparation provider writes the code resources provided by the operator and the key information updated by the business system into the SOTEM module;

[0017] S300, the communication module accesses the operator to connect to the Internet by calling the authentication function in the eSIM application module in the SOTEM module; the MCU module or the communication module implements the security management function by calling the eSAM application module in the SOTEM to perform encryption and decryption, signature verification and identity authentication.

[0018] It can be seen from the above technical solution that the present invention is a security module embedded in an IoT device, which supports one-way and two-way authentication, identity authentication, key negotiation, signature / verification, encryption / decryption, secure storage and other functions, and can be remotely managed through air download. This security module not only realizes the file management and authentication functions of eSIM, but also can flexibly access operators through air card writing; it also supports security management functions based on the national secret identification algorithm, and can realize the secure storage and transmission of application information. It is particularly suitable for the security management of a large number of terminal devices in the IoT environment. The two-in-one function of SOTEM provides a safe and convenient solution for the rapid implementation and promotion of IoT applications. Terminal manufacturers can realize remotely configurable eSIM and terminal security management by purchasing a chip, which effectively reduces costs, simplifies the production process, and does not need to connect to eSIM chip manufacturers and security chip manufacturers separately, greatly shortening the new product development cycle.

[0019] The service-oriented trusted execution module of the present invention can minimize the size of the terminal while avoiding the situation where the SIM card has poor contact and cannot communicate due to harsh deployment environment or vibration, further improving the stability of the chip. It not only simplifies the production process, but also eliminates the need to connect with eSIM chip manufacturers and security chip manufacturers separately, greatly shortening the product development cycle, and more efficiently ensuring the security of communication information. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 It is a structural block diagram of the present invention;

[0021] Figure 2 It is a state structure diagram of the present invention in combination with MCU;

[0022] Figure 3 It is a logical structure diagram of the security chip of the present invention;

[0023] Figure 4 This is the implementation method of the ESIM and ESAM invoking different communication interfaces in the embodiment of the present invention;

[0024] Figure 5 This is the implementation method of the ESIM and ESAM invoking the same communication interface in the embodiment of the present invention;

[0025] Figure 6 It is a flow chart of the communication method of the present invention. DETAILED DESCRIPTION

[0026] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments.

[0027] like Figure 1-Figure 3 As shown, the service-oriented trusted execution module described in this embodiment includes:

[0028] A security chip SOTEM module and a communication module, wherein the security chip SOTEM module includes an eSIM application module and an eSAM application module;

[0029] The SOTEM module is connected to the communication module through the 7816 interface. The communication module calls the eSIM application function in the SOTEM to implement the operator network access function, and at the same time, the processor in the communication module implements the security management function of calling the eSAM application module in the SOTEM module.

[0030] The SOTEM module is also connected to the MCU module through the SPI interface to implement the functions of identity authentication, key negotiation, signature / verification, encryption / decryption, and secure storage and security management in the eSAM application called by the MCU module;

[0031] The MCU module and the communication module are connected via a UART interface so that the MCU module sends AT commands to the communication module to interact with the communication module.

[0032] Among them, all keys in the security chip SOTEM are stored inside the security chip and cannot be read out. They can only be used inside the security chip. All key-related information can only be obtained by the security chip, and the communication module and MCU cannot obtain it. SOTEM contains two applications: eSAM and eSIM. eSAM has functions such as identity authentication, key negotiation, signature / verification, encryption / decryption, and secure storage, and is used for secure interaction between devices and background or between devices. eSIM complies with GSM and UICC specifications, and has functions such as one-way and two-way authentication, secure storage, and over-the-air download, and is used for device networking and remote management. The two applications are isolated from each other and do not affect each other. Among them, eSAM provides security protection for keys and data based on security domain isolation and Security Profile rules; the eSIM application manages its files and data based on secure authentication.

[0033] It can be understood as:

[0034] The eSAM module has identity authentication, key negotiation, signature / verification, encryption / decryption, and secure storage functions, and is used for secure interaction between devices and the backend or between devices;

[0035] The eSIM module complies with GSM and UICC specifications, has single and double authentication, secure storage, and over-the-air download functions, and is used for device networking and remote management;

[0036] The eSAM module and the eSIM module are isolated from each other and do not affect each other. The eSAM provides security protection for keys and data based on security domain isolation and Security Profile rules; the eSIM application manages its files and data based on security authentication.

[0037] On the other hand, this embodiment also discloses a service-oriented trusted execution module communication method, comprising the following steps:

[0038] S100, the chip issuer writes the file system of the eSIM application module and the security policy Security Profile and default key parameter Key data allocated to the service in the eSAM application module into the SOTEM module;

[0039] S200, the data preparation provider writes the code resources provided by the operator and the key information updated by the business system into the SOTEM module;

[0040] S300, the communication module accesses the operator to connect to the Internet by calling the authentication function in the eSIM application module in the SOTEM module; the MCU module or the communication module implements the security management function by calling the eSAM application module in the SOTEM to perform encryption and decryption, signature verification and identity authentication.

[0041] The specific application of this example is described in detail below with reference to the accompanying drawings:

[0042] Figure 4 :

[0043] 1. After the terminal device goes online, the security platform encapsulates the ciphertext data of the code resources into the MsgPack data packet and sends it to the terminal through the network.

[0044] 2. The MsgPack data completes the MsgPack unpacking operation in the MCU, and then the MCU sends the data to the SOTEM through the SPI interface.

[0045] 3. SOTEM distinguishes in which application the data is operated based on the data's ins.

[0046] Figure 5 :

[0047] 1. After the terminal device goes online, the security platform encapsulates the ciphertext data of the code resources into the MsgPack data packet and sends it to the terminal through the network.

[0048] 2. The processor inside the communication module completes the MsgPack unpacking operation and then sends the data to the SOTEM through the 7816 interface.

[0049] 3. SOTEM verifies and decrypts the data and writes the code resource data into the ESIM application specific file.

[0050] The processor inside the communication module provides many resources and pins for connecting to Bluetooth, NFC and other devices.

[0051] Devices with near-field communication and Internet access can access the security platform and obtain the encrypted data of code resources, and also have the function of near-field communication with terminal devices.

[0052] like Figure 6 As shown in the figure, the overall communication process of the module is as follows:

[0053] After the terminal device goes online, the security platform encapsulates the ciphertext data of the code resources into the MsgPack data packet and sends it to the terminal through the network.

[0054] The terminal NB-IoT module sends the data to the MCU. The MCU unpacks the MsgPack package and sends the data to the SO-ESAM through the SPI interface. (Or the processor inside the communication module completes the MsgPack unpacking operation and then sends the data to the security chip through the 7816 interface.)

[0055] The security chip verifies and decrypts the data and writes the code resource data into the ESIM application specific file.

[0056] After the security chip operation is completed, the terminal sends data to the security platform to notify that the code resource update has been completed.

[0057] If the security platform does not receive the notification reported by the terminal, it can actively send out data queries.

[0058] After the security platform determines that the security chip code resources are updated successfully, the MCU controls the communication module to restart. The communication module starts and uses the new code resources to connect to the base station, authenticate, and connect to the network.

[0059] If the security platform finds that the update code number resource has failed, the updated data packet can be re-issued.

[0060] In summary, the service-oriented trusted execution module of this embodiment integrates two applications on the same security chip, where SO-ESAM is responsible for security and eSIM is responsible for communication. The integrated chip supports one-way and two-way authentication, identity authentication, key negotiation, signature / verification, encryption / decryption, secure storage and other functions, and can remotely manage SOTEM through over-the-air download.

[0061] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A service-oriented trusted execution module, comprising a security chip SOTEM module and a communication module, characterized in that: The security chip SOTEM module includes an eSIM application module and an eSAM application module; The SOTEM module is connected to the communication module, and the communication module calls the eSIM application function in the SOTEM to implement the operator network access function, and at the same time, the processor in the communication module implements the security management function of calling the eSAM application module in the SOTEM module; The eSAM module has identity authentication, key negotiation, signature / verification, encryption / decryption, and secure storage functions, and is used for secure interaction between devices and the backend or between devices; The eSIM module complies with GSM and UICC specifications, has one-way and two-way authentication, secure storage, and over-the-air download functions, and is used for device networking and remote management; The eSAM module and the eSIM module are isolated from each other and do not affect each other. The eSAM provides security protection for keys and data based on security domain isolation and Security Profile rules; the eSIM application manages its files and data based on security authentication.

2. The service-oriented trusted execution module according to claim 1, characterized in that: It also includes the SOTEM module being connected to the MCU module to implement the functions of identity authentication, key negotiation, signature / verification, encryption / decryption, and secure storage and security management in the eSAM application called by the MCU module; The MCU module and the communication module are connected to each other so that the MCU module sends AT instructions to the communication module to interact with the communication module.

3. The service-oriented trusted execution module according to claim 1, characterized in that: The SOTEM module is connected to the communication module via a 7816 interface.

4. The service-oriented trusted execution module according to claim 2, characterized in that: The SOTEM module is connected to the MCU module via the SPI interface.

5. The service-oriented trusted execution module according to claim 2, characterized in that: The MCU module and the communication module are connected via a UART interface.

6. The service-oriented trusted execution module communication method according to any one of claims 1 to 5, characterized in that: The following steps are involved: S100, the chip issuer writes the file system of the eSIM application module and the security policy Security Profile and default key parameter Key data allocated to the service in the eSAM application module into the SOTEM module; S200, the data preparation provider writes the code resources provided by the operator and the key information updated by the business system into the SOTEM module; S300, the communication module accesses the operator to connect to the Internet by calling the authentication function in the eSIM application module in the SOTEM module; the MCU module or the communication module implements the security management function by calling the eSAM application module in the SOTEM to perform encryption and decryption, signature verification and identity authentication.

Images