A method and system for eSIM chip identity authentication

Abstract

The present application discloses a method and system for eSIM chip identity authentication. The method includes: writing the device ID number and code number ICCID into the eSIM chip for backup, and encrypting the device ID number and code number ICCID; reading the eSIM chip ID number, and writing the device ID number and code number ICCID into the memory; when the device is initialized, reading the device ID and code number ICCID from the eSIM chip and the memory for verification; if the ID verification is passed, judging whether the data information of the eSIM chip is consistent with the data information of the memory; if the data information of the eSIM chip is consistent with the data information of the memory, determining that the identity authentication is passed, and information interaction with the main station; if the data information of the eSIM chip is inconsistent with the data information of the memory, determining that the identity authentication fails, and prohibiting information interaction with the main station.

Description

Technical Field

[0001] The present application relates to the field of identity authentication, and in particular to a method and system for eSIM chip identity authentication. Background Art

[0002] The current remote communication SIM cards have poor high / low temperature resistance and cannot achieve the function of remote communication or even get damaged in many extreme environments, so eSIM cards came into being. The concept of eSIM cards is to embed traditional SIM cards directly into the device chip, rather than adding them to the device as an independent removable component, so users do not need to insert a physical SIM card. This approach will allow users to choose operator packages more flexibly, or change operators at any time without unlocking the device or purchasing a new device. The establishment of a universal eSIM standard in the future will save ordinary consumers and corporate users more mobile device usage costs and bring more convenience and security.

[0003] However, there is currently no effective solution to ensure the security and legality of eSIM cards. Summary of the invention

[0004] The embodiments of the present disclosure provide a method and system for eSIM chip identity authentication to at least solve the technical problem of how to ensure the security and legitimacy of the eSIM card in the prior art.

[0005] According to one aspect of an embodiment of the present disclosure, a method for eSIM chip identity authentication is provided, including: writing a device ID number and a code number ICCID into an eSIM chip for backup, and encrypting the device ID number and the code number ICCID; reading the eSIM chip ID number, and writing the device ID number and the code number ICCID into a memory; when the device is initialized, reading the device ID and the code number ICCID from the eSIM chip and the memory respectively for verification; when the ID verification passes, determining whether the data information of the eSIM chip is consistent with the data information of the memory; when the data information of the eSIM chip is consistent with the data information of the memory, determining that the identity authentication is passed, and performing information interaction with a main station; when the data information of the eSIM chip is inconsistent with the data information of the memory, determining that the identity authentication fails, and prohibiting information interaction with the main station.

[0006] According to another aspect of the embodiment of the present disclosure, a system for eSIM chip identity authentication is also provided, including: a write eSIM chip module, used to write the device ID number and code number ICCID into the eSIM chip for backup, and encrypt the device ID number and code number ICCID; a write memory module, used to read the eSIM chip ID number, and write the device ID number and code number ICCID into the memory; a verification ID module, used to read the device ID and code number ICCID from the eSIM chip and the memory for verification when the device is initialized; a data information judgment module, used to judge whether the data information of the eSIM chip is consistent with the data information of the memory when the ID verification is passed; an identity authentication pass module, used to determine that the identity authentication is passed and to interact with the main station when the data information of the eSIM chip is consistent with the data information of the memory; an identity authentication failure module, which determines that the identity authentication fails and prohibits information interaction with the main station when the data information of the eSIM chip is inconsistent with the data information of the memory.

[0007] In the present invention, a method of eSIM chip identity authentication is used to provide service terminals with software and hardware versions, integrity verification of key components and security authentication, helping communication terminals solve the problem of malicious replacement of components, effectively ensuring the legitimacy and security of assets. Through security authentication, data transmission is more secure, and strict control is achieved for devices not connected to the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] The drawings described herein are used to provide a further understanding of the present disclosure and constitute a part of the present application. The illustrative embodiments of the present disclosure and their descriptions are used to explain the present disclosure and do not constitute an improper limitation on the present disclosure. In the drawings:

[0009] Figure 1 It is a flowchart of a method for eSIM chip identity authentication according to an embodiment of the present disclosure;

[0010] Figure 2 It is a schematic diagram of the process of identity authentication between the main control chip and the eSIM according to an embodiment of the present disclosure;

[0011] Figure 3 is a schematic diagram of determining whether data information of an eSIM chip is consistent with data information of a memory according to an embodiment of the present disclosure;

[0012] Figure 4 is a schematic diagram of session key generation according to an embodiment of the present disclosure;

[0013] Figure 5is a schematic diagram of eSIM key generation according to an embodiment of the present disclosure;

[0014] Figure 6 is a schematic diagram of external entity key generation according to an embodiment of the present disclosure;

[0015] Figure 7 It is a schematic diagram of a system for eSIM chip identity authentication according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0016] Now, exemplary embodiments of the present invention are described with reference to the accompanying drawings. However, the present invention can be implemented in many different forms and is not limited to the embodiments described herein. These embodiments are provided to disclose the present invention in detail and completely and to fully convey the scope of the present invention to those skilled in the art. The terms used in the exemplary embodiments shown in the accompanying drawings are not intended to limit the present invention. In the accompanying drawings, the same units / elements are marked with the same reference numerals.

[0017] Unless otherwise specified, the terms (including technical terms) used herein have the commonly understood meanings to those skilled in the art. In addition, it is understood that the terms defined in commonly used dictionaries should be understood to have the same meanings as those in the context of the relevant fields, and should not be understood as idealized or overly formal meanings.

[0018] According to a first aspect of this embodiment, a method 100 for eSIM chip identity authentication is provided. Figure 1 As shown, the method 100 includes:

[0019] S102: writing the device ID number and the code number ICCID into the eSIM chip for backup, and encrypting the device ID number and the code number ICCID;

[0020] S104: Read the eSIM chip ID number, and write the device ID number and the code number ICCID into the memory;

[0021] S106: When the device is initialized, the device ID and the code number ICCID are read from the eSIM chip and the memory respectively for verification;

[0022] S108: If the ID verification is passed, determine whether the data information of the eSIM chip is consistent with the data information of the memory;

[0023] S110: When the data information of the eSIM chip is consistent with the data information of the memory, it is determined that the identity authentication is passed, and information is exchanged with the main station;

[0024] S112: When the data information of the eSIM chip is inconsistent with the data information of the memory, it is determined that the identity authentication fails, and information interaction with the main station is prohibited.

[0025] Specifically, refer to Figure 2 As shown, the main control chip can write the device ID and code number ICCID into the eSIM for backup, and encrypt the information. The parameters can only be rewritten through special instructions. At the same time, read the eSIM chip ID number, and then write the device ID, code number ICCID, and eSIM chip ID into the memory to bind them to each other. When the device is initialized, read the device ID, code number ICCID, and eSIM chip ID from the memory and eSIM respectively, and then perform mutual authentication. After the authentication is passed, it is determined that the device has not been abnormally processed before it can be in normal operation.

[0026] Therefore, through an eSIM chip identity authentication method, the business terminal is provided with software and hardware versions, integrity verification and security authentication of key components, helping communication terminals solve the problem of malicious replacement of components, effectively ensuring the legality and security of assets. Through security authentication, data transmission is more secure, and strict control is achieved for devices not connected to the network.

[0027] Optionally, when the device is initialized, the device ID and code number ICCID are read from the eSIM chip and the memory respectively for verification, including: comparing the device ID in the eSIM chip with the device ID in the memory, and comparing the code number ICCID in the eSIM chip with the code number ICCID in the memory to determine the comparison result; when the comparison results are consistent, it is determined that the ID verification is passed; when the comparison results are inconsistent, it is determined that the ID verification has failed.

[0028] Optionally, when the ID verification passes, determining whether the data information of the eSIM chip is consistent with the data information of the memory includes: sending a 16-byte external entity random number to the eSIM chip; receiving the 16-byte eSIM random number, eSIM cryptogram and SEID sent by the eSIM chip; dispersing a static key corresponding to each eSIM according to a pre-set root key and the SEID, encrypting the external entity random number and the eSIM random number according to the static key to obtain a session key; encrypting the external entity random number and the eSIM random number according to the session key to obtain an encryption result; verifying the eSIM cryptogram according to the encryption result; generating an external entity key according to the session key; and sending the external entity key to the eSIM chip for verification.

[0029] refer to Figure 3 As shown, Figure 3 To determine whether the data information in the eSIM chip and the memory is consistent. The external entity sends a 16-byte external entity random number to the eSIM chip. The external entity receives the 16-byte eSIM random number and the eSIM key sent by the eSIM chip. The external entity generates a static key and a session key, verifies the eSIM key, and generates an external entity key. The external entity sends the external entity key to the eSIM chip for verification.

[0030] Optionally, encrypting the external entity random number and the eSIM random number according to the static key to obtain the session key includes: encrypting the session key dispersion factor according to the static key to determine the static key encryption result, the session key dispersion factor includes the 16-byte external entity random number and the 16-byte eSIM random number; taking the last 16 bytes of the static key encryption result as the session key.

[0031] refer to Figure 4 As shown, the static key is encrypted according to the session key dispersion factor to determine the static key encryption result, the session key dispersion factor includes the 16-byte external entity random number and the 16-byte eSIM random number; the last 16 bytes of the static key encryption result are taken as the session key.

[0032] Optionally, generating an external entity key according to the session key includes: encrypting the 16-byte external entity random number, the 16-byte card random number and the 16-byte 80 padding according to the session key to determine the session key encryption result; taking the last 16 bytes of the session key encryption result as the eSIM key.

[0033] refer to Figure 5 Shown and Figure 6 As shown, according to the session key, the 16-byte external entity random number, the 16-byte card random number and the 16-byte 80 padding are encrypted to determine the session key encryption result; the last 16 bytes of the session key encryption result are taken as the eSIM key or the external entity key.

[0034] Therefore, through an eSIM chip identity authentication method, the business terminal is provided with software and hardware versions, integrity verification and security authentication of key components, helping communication terminals solve the problem of malicious replacement of components, effectively ensuring the legality and security of assets. Through security authentication, data transmission is more secure, and strict control is achieved for devices not connected to the network.

[0035] According to another aspect of the present application, a system 700 for eSIM chip identity authentication is also included. Figure 7As shown, the system 700 includes: a write eSIM chip module 710, which is used to write the device ID number and the code number ICCID into the eSIM chip for backup, and encrypt the device ID number and the code number ICCID; a write memory module 720, which is used to read the eSIM chip ID number and write the device ID number and the code number ICCID into the memory; a verification ID module 730, which is used to read the device ID and the code number ICCID from the eSIM chip and the memory for verification when the device is initialized; a data information judgment module 740, which is used to judge whether the data information of the eSIM chip is consistent with the data information of the memory when the ID verification is passed; an identity authentication module 750, which is used to determine that the identity authentication is passed when the data information of the eSIM chip is consistent with the data information of the memory, and to interact with the main station; an identity authentication failure module 760, which determines that the identity authentication fails when the data information of the eSIM chip is inconsistent with the data information of the memory, and prohibits information interaction with the main station.

[0036] Optionally, the verification ID module 730 includes: comparing the device ID in the eSIM chip with the device ID in the memory, comparing the code number ICCID in the eSIM chip with the code number ICCID in the memory, and determining the comparison result; when the comparison results are consistent, it is determined that the ID verification is passed; when the comparison results are inconsistent, it is determined that the ID verification has failed.

[0037] Optionally, the data information judgment module includes: a sending external entity random number submodule, used to send a 16-byte external entity random number to the eSIM chip; a receiving eSIM key submodule, used to receive the 16-byte eSIM random number, eSIM cryptogram and SEID sent by the eSIM chip; a obtaining session key submodule, used to disperse the static key corresponding to each eSIM according to the preset root key and the SEID, and encrypt the external entity random number and the eSIM random number according to the static key to obtain the session key; an obtaining encryption result submodule, used to encrypt the external entity random number and the eSIM random number according to the session key to obtain an encryption result; a verifying eSIM cryptogram submodule, used to verify the eSIM cryptogram according to the encryption result; a generating external entity key submodule, used to generate an external entity key according to the session key; and a verifying external entity key submodule, used to send the external entity key to the eSIM chip for verification.

[0038] Optionally, a key submodule is obtained, including: a static key encryption unit, used to encrypt a session key dispersion factor according to the static key, and determine a static key encryption result, wherein the session key dispersion factor includes the 16-byte external entity random number and the 16-byte eSIM random number; and a session key determination unit, used to take the last 16 bytes of the static key encryption result as the session key.

[0039] Optionally, the external entity key submodule is generated, including: a session key encryption unit, used to encrypt the 16-byte external entity random number, the 16-byte card random number and the 16-byte 80 padding according to the session key, and determine the session key encryption result; and an eSIM key determination unit, used to take the last 16 bytes of the session key encryption result as the eSIM key.

[0040] A system 700 for eSIM chip identity authentication according to an embodiment of the present invention corresponds to a method 100 for eSIM chip identity authentication according to another embodiment of the present invention, and will not be described in detail herein.

[0041] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code. The scheme in the embodiments of the present application can be implemented in various computer languages, for example, object-oriented programming language Java and literal scripting language JavaScript, etc.

[0042] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0043] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0044] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0045] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0046] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for eSIM chip identity authentication, characterized in that: include: Write the device ID number and the code number ICCID into the eSIM chip for backup, and encrypt the device ID number and the code number ICCID; Read the eSIM chip ID number, and write the device ID number and code number ICCID into the memory; When the device is initialized, the device ID and the code number ICCID are read from the eSIM chip and the memory for verification; If the ID verification is passed, determine whether the data information of the eSIM chip is consistent with the data information of the memory; When the data information of the eSIM chip is consistent with the data information of the memory, it is determined that the identity authentication is passed, and information interaction is performed with the main station; When the data information of the eSIM chip is inconsistent with the data information of the memory, it is determined that the identity authentication fails and the information interaction with the main station is prohibited.

2. The method according to claim 1, characterized in that When the device is initialized, the device ID and the code number ICCID are read from the eSIM chip and the memory for verification, including: Compare the device ID in the eSIM chip with the device ID in the memory, and compare the code number ICCID in the eSIM chip with the code number ICCID in the memory to determine the comparison result; When the comparison results are consistent, it is determined that the ID verification is passed; When the comparison results are inconsistent, it is determined that the ID verification has failed.

3. The method according to claim 1, characterized in that When the ID verification is passed, determining whether the data information of the eSIM chip is consistent with the data information of the memory includes: Sending a 16-byte external entity random number to the eSIM chip; Receive a 16-byte eSIM random number, an eSIM key, and a SEID sent by the eSIM chip; Distribute a static key corresponding to each eSIM according to the preset root key and the SEID, and encrypt the external entity random number and the eSIM random number according to the static key to obtain a session key; Encrypting the external entity random number and the eSIM random number according to the session key to obtain an encryption result; Verifying the eSIM key according to the encryption result; generating an external entity key based on the session key; The external entity key is sent to the eSIM chip for verification.

4. The method according to claim 3, characterized in that Encrypting the external entity random number and the eSIM random number according to the static key to obtain a session key includes: encrypting a session key dispersion factor according to the static key to determine a static key encryption result, wherein the session key dispersion factor includes the 16-byte external entity random number and the 16-byte eSIM random number; The last 16 bytes of the static key encryption result are taken as the session key.

5. The method according to claim 4, characterized in that Generating an external entity key according to the session key, including: According to the session key, encrypt the 16-byte external entity random number, the 16-byte eSIM random number, and the 16-byte 80 padding to determine the session key encryption result; The last 16 bytes of the session key encryption result are taken as the external entity key.

6. A system for eSIM chip identity authentication, characterized in that: include: The eSIM chip writing module is used to write the device ID number and the code number ICCID into the eSIM chip for backup, and encrypt the device ID number and the code number ICCID; A write memory module is used to read the eSIM chip ID number and write the device ID number and the code number ICCID into the memory; A verification ID module, used to read the device ID and the code number ICCID from the eSIM chip and the memory for verification when the device is initialized; A data information determination module, used to determine whether the data information of the eSIM chip is consistent with the data information of the memory when the ID verification is passed; An identity authentication module is used to determine that the identity authentication is passed when the data information of the eSIM chip is consistent with the data information of the memory, and to perform information interaction with the main station; The identity authentication failure module determines that the identity authentication fails and prohibits information interaction with the main station when the data information of the eSIM chip is inconsistent with the data information of the memory.

7. The system according to claim 6, characterized in that Verify ID module, including: Compare the device ID in the eSIM chip with the device ID in the memory, and compare the code number ICCID in the eSIM chip with the code number ICCID in the memory to determine the comparison result; When the comparison results are consistent, it is determined that the ID verification is passed; When the comparison results are inconsistent, it is determined that the ID verification has failed.

8. The system according to claim 6, characterized in that The judgment data information module includes: The external entity random number sending submodule is used to send a 16-byte external entity random number to the eSIM chip; An eSIM key receiving submodule is used to receive a 16-byte eSIM random number, an eSIM key and a SEID sent by the eSIM chip; A session key obtaining submodule is used to disperse a static key corresponding to each eSIM according to a preset root key and the SEID, and to encrypt an external entity random number and an eSIM random number according to the static key to obtain a session key; An encryption result obtaining submodule is used to encrypt the external entity random number and the eSIM random number according to the session key to obtain an encryption result; An eSIM key verification submodule, used to verify the eSIM key according to the encryption result; An external entity key generation submodule, used for generating an external entity key according to the session key; The external entity key verification submodule is used to send the external entity key to the eSIM chip for verification.

9. The system according to claim 8, characterized in that Get the session key submodule, including: a static key encryption unit, configured to encrypt a session key dispersion factor according to the static key and determine a static key encryption result, wherein the session key dispersion factor includes the 16-byte external entity random number and the 16-byte eSIM random number; A session key unit is determined, which is used to take the last 16 bytes of the static key encryption result as the session key.

10. The system according to claim 9, characterized in that Generate external entity key submodule, including: A session key encryption unit, used to encrypt the 16-byte external entity random number, the 16-byte card random number and the 16-byte 80 padding according to the session key to determine the session key encryption result; An eSIM key unit is determined, which is used to take the last 16 bytes of the session key encryption result as the external entity key.

Images