Secure data deployment method, apparatus, terminal, server, and storage medium

Abstract

Embodiments of the present application provide a secure data deployment method and device, a terminal, a server and a storage medium, and relate to the technical field of computers; the SIMLock security data is inserted into a Modem image file, and the signature verification mechanism of terminal system security startup is used to guarantee the security and integrity of the SIMLock security data. The method comprises the following steps: in the process of compiling a system installation package, inserting SIMLock security data into a Modem image file of the system installation package; and sending the system installation package to a target mobile terminal, so that the target mobile terminal reads the Modem image file inserted with the SIMLock security data into local running memory for running after starting a local system program.

Description

[Technical Field]

[0001] The present invention relates to the field of computer technology, and in particular to a secure data deployment method, apparatus, terminal, server, and storage medium. [Background Technology]

[0002] SIMLock's SIM card locking function pre-stores encrypted configuration information (such as allowed public land mobile networks and allowed user identity modules) on the terminal. When the user identity module (SIM) is inserted into the terminal, the pre-stored configuration information on the terminal is compared with the data on the SIM card. If the data on the SIM card matches the configuration information, the terminal is allowed to connect to the network.

[0003] Operators use the SIMLock feature to prevent competing operators' SIM cards from being used on their own terminals, thus limiting competition. Therefore, the security of the SIMLock configuration information pre-stored on the terminal is crucial; if this pre-stored configuration information is tampered with, the use of SIM cards on the terminal cannot be restricted. [Summary of the Invention]

[0004] This invention provides a secure data deployment method, apparatus, terminal, server, and storage medium, which inserts SIMLock secure data into a Modem image file and utilizes the signature verification mechanism of the terminal system's secure boot to ensure the security and integrity of the SIMLock secure data.

[0005] In a first aspect, embodiments of the present invention provide a secure data deployment method applied to a server. The method includes: inserting SIMLock security data into the Modem image file of the system installation package during the compilation of a system installation package; sending the system installation package to a target mobile terminal so that after the target mobile terminal starts its local system program, it reads the Modem image file containing the inserted SIMLock security data and runs it in its local memory.

[0006] In the above-mentioned secure data deployment method, during the compilation of the system installation package, the SIMLock secure data is inserted into the Modem image file of the system installation package. Each time the target mobile terminal completes the system installation, it verifies the security and integrity of the Modem image file. After the local system boots up, the verified Modem image file is stored in the running memory. By leveraging the mobile terminal's own signature verification mechanism for the Modem image file, the security and integrity of the SIMLock secure data inserted into the Modem image file are guaranteed.

[0007] In one possible implementation, inserting the SIMLock security data into the Modem image file of the system installation package includes:

[0008] Write the SIMLock security data into a script file that implements the function of inserting data into the Modem image file;

[0009] Run the script file to insert the read SIMLock security data into the Modem image file of the system installation package.

[0010] In one possible implementation, the method further includes:

[0011] An identifier field is set in a first region of the Modem image file; the first region is adjacent to the target storage region pre-allocated to the SIMLock security data in the Modem image file.

[0012] The step of inserting the read SIMLock security data into the Modem image file of the system installation package includes:

[0013] Locate the identification field and use the identification field to locate the target storage area in the Modem image file;

[0014] Insert the SIMLock security data into the target storage area.

[0015] In one possible implementation, the SIMLock software to which the SIMLock security data belongs is configured with a current version number, and the method further includes:

[0016] A second location area adjacent to the first area, or a third location area adjacent to the target storage area, is pre-allocated to store the version number of the SIMlock software to which the SIMLock security data belongs;

[0017] Insert the current version number of the SIMlock software to which the SIMLock security data belongs into the third location area.

[0018] In one possible implementation, the SIMlock software to which the SIMLock security data belongs is configured with a current version number, the target mobile terminal is configured with a one-time programmable memory (EFUSE), the one-time programmable memory is configured with a padding field, and the number of bits filled in the padding field is used to represent the version information of the SIMlock software to which the SIMLock security data belongs. The method further includes:

[0019] Read the number of bits that have been filled in the padding field of the EFUSE;

[0020] The step of inserting SIMLock security data into the Modem image file of the system installation package includes:

[0021] When the current version number of the SIMlock software to which the SIMLock security data belongs is greater than the number of bits already filled in the EFUSE padding field, the SIMLock security data is inserted into the Modem image file of the system installation package.

[0022] In one possible implementation, the SIMLock security data includes any one or a combination of the following elements: SIMLock configuration data, a verification public key for verifying the SIMLock configuration data, a public key for verifying the IMEI of the target mobile terminal, and a public key for verifying the tool for writing SIMLock data to the target mobile terminal.

[0023] Secondly, embodiments of the present invention provide a secure data deployment method applied to a mobile terminal, the method comprising:

[0024] The server receives a system installation package sent by the server; wherein, during the compilation of the system installation package, the server inserts the SIMLock security data into the Modem image file of the system installation package;

[0025] Install local system programs by running the system installation package;

[0026] During the startup of the local system program, the security and integrity of the Modem image file containing the SIMLock security data are verified.

[0027] After the local system program starts up, it reads the Modem image file containing the SIMLock security data and runs it locally.

[0028] In one possible implementation, the mobile terminal is equipped with a one-time programmable memory (EFUSE) to install local system programs by running the system installation package, including:

[0029] Run the signing script file corresponding to the Modem image file, and read the private key, public key and public key hash value of the Modem image file from the script file.

[0030] The Modem image file is signed using the private key corresponding to the Modem image file to obtain image file signature data;

[0031] After adding the image file signature data and the public key of the Modem image file to the Modem image file, the corresponding public key hash value of the Modem image file is written to EFUSE.

[0032] Perform security and integrity verification on the Modem image file containing the inserted SIMLock security data, including:

[0033] The public key of the Modem image file is read from the Modem image file, and the public key hash value is calculated and compared with the public key hash value of the corresponding Modem image file read from the EFUSE to determine the validity of the public key of the Modem image file.

[0034] The signature data of the Modem image file is verified using the public key corresponding to the Modem image file.

[0035] Based on the verification results, the Modem image file and the SIMLock security data inserted into the Modem image file have been verified.

[0036] In one possible implementation, the mobile terminal is provided with a one-time programmable memory (EFUSE), which has a padding field; the number of bits already filled in the padding field is used to represent the SIMlock software number to which the SIMLock security data belongs; the adjacent area of ​​the target storage area storing the SIMLock security data in the Modem image file stores the current version number of the SIMlock software to which the SIMLock security data belongs; the method further includes:

[0037] Read the current version number of the SIMlock software to which the SIMLock security data belongs from the adjacent location area;

[0038] When the current version number is greater than the number of bits already filled in the EFUSE padding field, locate the highest non-zero bit of EFUSE;

[0039] The highest non-zero bit of the EFUSE position is moved towards the high-order bit direction of the fill field to obtain the target bit, and the target bit is filled.

[0040] In one possible implementation, the SIMLock security data includes any one or a combination of the following elements: SIMLock configuration data, a verification public key for verifying the SIMLock configuration data, a public key for verifying the IMEI of the target mobile terminal, and a public key for verifying the tool for writing SIMLock data to the target mobile terminal.

[0041] Thirdly, embodiments of the present invention provide a data security deployment device, disposed on a server, the device comprising:

[0042] The first insertion module is used to insert SIMLock security data into the Modem image file of the system installation package during the compilation of the system installation package;

[0043] The storage module is used to send the system installation package to the target mobile terminal, so that the target mobile terminal can read the Modem image file containing the SIMLock security data into its local memory and run it after starting the local system program.

[0044] In one possible implementation, the first insertion module includes:

[0045] The write submodule is used to write the SIMLock security data into a script file that implements the function of inserting data into the Modem image file;

[0046] The execution submodule is used to run the script file and insert the read SIMLock security data into the Modem image file of the system installation package.

[0047] In one possible implementation, the device further includes:

[0048] An identifier setting module is used to set an identifier field in a first region of the Modem image file; the first region is adjacent to a target storage region pre-allocated to the SIMLock security data in the Modem image file.

[0049] The first insertion module includes:

[0050] The lookup submodule is used to look up the identification field and locate the target storage area in the Modem image file based on the identification field.

[0051] The insertion submodule is used to insert SIMLock security data into the target storage area.

[0052] In one possible implementation, the SIMLock software to which the SIMLock security data belongs is configured with a current version number, and the device further includes:

[0053] The second insertion module is used to insert the current version number of the SIMlock software to which the SIMLock security data belongs into the third location area.

[0054] In one possible implementation, the SIMlock software to which the SIMLock security data belongs is configured with a current version number, the target mobile terminal is configured with a one-time programmable memory (EFUSE), the one-time programmable memory is configured with a padding field, and the number of bits filled in the padding field is used to represent the version information of the SIMlock software to which the SIMLock security data belongs, and the device further includes:

[0055] The read module is used to read the number of bits that have been filled in the fill field of the EFUSE.

[0056] The first insertion module is specifically used to insert the SIMLock security data into the Modem image file of the system installation package when the current version number of the SIMlock software to which the SIMLock security data belongs is greater than the number of bits already filled in the padding field of the EFUSE.

[0057] In one possible implementation, the SIMLock security data includes any one or a combination of the following elements: SIMLock configuration data, a verification public key for verifying the SIMLock configuration data, a public key for verifying the IMEI of the target mobile terminal, and a public key for verifying the tool for writing SIMLock data to the target mobile terminal.

[0058] Fourthly, embodiments of the present invention provide a data security deployment device, disposed on a mobile terminal, the device comprising:

[0059] A receiving module is used to receive a system installation package sent by a server; wherein, during the compilation of the system installation package, the server inserts the SIMLock security data into the Modem image file of the system installation package;

[0060] An installation module is used to install local system programs by running the system installation package;

[0061] The verification module is used to perform security and integrity verification on the Modem image file containing the SIMLock security data during the startup of the local system program.

[0062] The startup module is used to read the Modem image file containing the SIMLock security data and run it in the local memory after the local system program has started.

[0063] In one possible implementation, the mobile terminal is equipped with a one-time programmable memory (EFUSE), and the installation module includes:

[0064] The first reading submodule is used to run the signing script file corresponding to the Modem image file, and read the private key, public key and public key hash value corresponding to the Modem image file in the script file;

[0065] The signature submodule is used to sign the Modem image file using the private key corresponding to the Modem image file, and obtain the image file signature data;

[0066] Add a submodule to add the image file signature data and the public key corresponding to the Modem image file to the Modem image file, and then write the hash value of the public key corresponding to the Modem image file into EFUSE;

[0067] The verification module includes:

[0068] The second reading submodule is used to retrieve the public key corresponding to the Modem image file from the Modem image file, calculate the public key hash value, and compare it with the public key hash value of the Modem image file read from the EFUSE to determine the validity of the public key of the Modem image file.

[0069] The verification submodule is used to verify the signature data of the Modem image file using the public key corresponding to the Modem image file.

[0070] The determination submodule is used to determine, based on the signature verification result, whether the Modem image file and the SIMLock security data inserted into the Modem image file have passed verification.

[0071] In one possible implementation, the mobile terminal is provided with a one-time programmable memory (EFUSE), which has a padding field; the number of bits already filled in the padding field is used to represent the version information of the SIMlock software to which the SIMLock security data belongs; the adjacent area of ​​the target storage area storing the SIMLock security data in the Modem image file stores the current version number of the SIMlock software to which the SIMLock security data belongs; the device further includes:

[0072] The version number reading module is used to read the current version number of the SIMlock software to which the SIMLock security data belongs from the adjacent location area;

[0073] The positioning module is used to locate the highest non-zero bit of EFUSE when the current version number is greater than the number of bits already filled in the EFUSE padding field;

[0074] The filling module is used to move the highest non-zero bit of the EFUSE located by the positioning module in the direction of the high bit of the filling field to obtain the target bit, and fill the target bit.

[0075] In one possible implementation, the SIMLock security data includes any one or a combination of the following elements: SIMLock configuration data, a verification public key for verifying the SIMLock configuration data, a public key for verifying the IMEI of the target mobile terminal, and a public key for verifying the tool for writing SIMLock data to the target mobile terminal.

[0076] Fifthly, embodiments of the present invention provide a server, comprising: at least one processor; and at least one memory communicatively connected to the processor, wherein: the memory stores program instructions executable by the processor, and the processor can execute the method provided in the first aspect by invoking the program instructions.

[0077] In a sixth aspect, embodiments of the present invention provide a mobile terminal, comprising: at least one processor; and at least one memory communicatively connected to the processor, wherein: the memory stores program instructions executable by the processor, and the processor can execute the method provided in the second aspect by invoking the program instructions.

[0078] In a seventh aspect, embodiments of the present invention provide a non-transitory computer-readable storage medium storing computer instructions that cause the computer to perform the method provided in the first aspect.

[0079] Eighthly, embodiments of the present invention provide a non-transitory computer-readable storage medium storing computer instructions that cause the computer to perform the method provided in the second aspect.

[0080] It should be understood that the second to eighth aspects of the embodiments of the present invention are consistent with the technical solutions of the first aspect of the embodiments of the present invention, and the beneficial effects achieved by each aspect and the corresponding feasible implementation are similar, and will not be described again. [Attached Image Description]

[0081] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0082] Figure 1 This is a schematic diagram of the implementation environment of the secure data deployment method in this embodiment of the invention;

[0083] Figure 2 This is a flowchart of the steps of the secure data deployment method proposed in the embodiments of the present invention;

[0084] Figure 3 This is a schematic diagram illustrating the writing of data to a script file according to an embodiment of the present invention;

[0085] Figure 4 This is a schematic diagram illustrating the storage location of the identifier field in a Modem image file, as shown in one example of the present invention.

[0086] Figure 5 This is a schematic diagram showing the storage location of the current version number of the SIMlock software to which the SIMLock security data belongs in the Modem image file, in one example of the present invention.

[0087] Figure 6 This is a schematic diagram showing another storage location of the current version number of the SIMlock software to which the SIMLock security data belongs in the Modem image file, in one example of the present invention.

[0088] Figure 7 This is a flowchart of another secure data deployment method proposed in an embodiment of the present invention;

[0089] Figure 8 This is a schematic diagram of a one-time programmable memory with a fill field in one example of the present invention;

[0090] Figure 9 This is a flowchart illustrating the steps of another secure data deployment method proposed in this embodiment of the invention;

[0091] Figure 10 This is a functional block diagram of the secure data deployment device proposed in the embodiments of the present invention;

[0092] Figure 11 This is a functional block diagram of another secure data deployment device proposed in an embodiment of the present invention;

[0093] Figure 12 This is a schematic diagram of the structure of an electronic terminal device provided in an embodiment of the present invention;

[0094] Figure 13 This is a schematic diagram of the structure of a terminal device provided in one embodiment of this specification.

Detailed Implementation Methods

[0095] To better understand the technical solutions in this specification, the embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0096] It should be understood that the described embodiments are merely some, not all, of the embodiments in this specification. All other embodiments obtained by those skilled in the art based on the embodiments in this specification without inventive effort are within the scope of protection of this specification.

[0097] The terminology used in the embodiments of this invention is for the purpose of describing particular embodiments only and is not intended to be limiting of this specification. The singular forms “a,” “the,” and “the” as used in the embodiments of this invention and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise.

[0098] Existing technologies guarantee the security of SIMLock configuration data by storing the SIMLock configuration data, such as the public land mobile networks allowed to be accessed and the user identification modules allowed to be accessed, as well as the verification public key for verifying the signature of the SIMLock configuration data and the signature of the SIMLock configuration data, in non-volatile memory (NV). The public key digest obtained by hashing the verification public key for verifying the signature of the SIMLock configuration data is stored in a one-time programmable memory (EFUSE). Due to the circuit breaker mechanism of EFUSE, the filled positions in EFUSE cannot be erased, so the public key digest written to EFUSE cannot be modified.

[0099] When a SIM card is inserted into the mobile terminal, a hash value is calculated for the verification public key stored in the NV, and the public key digest stored in EFUSE is compared to verify the security of the public key. Then, the verified public key is used to verify the signature of the SIMLock configuration data stored in the NV. The signature of the SIMLock configuration data stored in the NV is obtained by signing the SIMLock configuration data with the private key corresponding to the verification public key before setting up the terminal's SIMLock function module. The verification result ensures the security and integrity of the SIMLock configuration data. Only the verified SIMLock configuration data can be further compared with the data on the SIM card, such as whether the SIMLock configuration data matches the SIM card's local public terrestrial mobile network.

[0100] EFUSE is a scarce resource. The SIMLock functional module is only allocated one EFUSE Block for use, and data can only be written to it once, which limits the functionality of the SIMLock software. For example, the initial public key verification is not compatible with the updated SIMLock functional module. The EFUSE Block has a limited number of padding bits, and only 32 bits can be written. It is impossible to store the entire hash value of the public key digest in the EFUSE Block, resulting in a high probability of collision.

[0101] In view of the above problems, this invention proposes a secure data deployment method, device, terminal, server, and storage medium, which realizes the secure deployment of SIMLOCK with configurable important data. The important data may include: SIMLock configuration data (configuration data of five network locks, SIMLock module version control switch, version information data, etc.), and public keys used for tool authentication, data verification and encryption, etc., to ensure the security of SIMLock configuration data and flexibly update the verification public key for verifying the signature of SIMLock configuration data.

[0102] Figure 1 This is a schematic diagram of the implementation environment for the secure data deployment method in this embodiment of the invention. As shown in Figure 1, the implementation environment may include a server 110 and at least one mobile terminal 120. The server 110 may be a computer or a compiler, etc. The mobile terminal 120 may be a smartphone, a computer, a wearable device, etc.

[0103] The server 110 and the mobile terminal 120 can establish a connection through a wireless network or a wired network. The server 110 can write system software, application software, etc. into the mobile terminal 120 through interface calls.

[0104] Figure 2 This is a flowchart illustrating the steps of a secure data deployment method proposed in this invention. The method applies to a server, which is a computer device equipped with a compilation unit for data written to a mobile terminal. The data written to the mobile terminal includes system installation packages, software installation packages, etc. The server can connect to or communicate with the mobile terminal. While high-level languages ​​such as C and C++ are typically used to write the source code, computers can only run binary machine language. The server uses a compilation unit to compile the source code, generating binary machine language that can be run by the computer.

[0105] like Figure 1 As shown, the steps include:

[0106] Step S11: During the compilation of the system installation package, insert the SIMLock security data into the Modem image file of the system installation package.

[0107] The object file generated by compiling and linking source code is called an image file. A modem image file is a single file generated by compiling a series of files responsible for handling related communication protocols according to a certain format. In this embodiment of the invention, modem should not be confused with modem.

[0108] SIMLock security data includes a verification public key used to verify the signature of SIMLock configuration data.

[0109] After the server compiles the system installation package, the Modem image file within the resulting system installation package contains SIMLock security data. The server then sends the system installation package to the target mobile terminal. The target mobile terminal runs the system installation package containing the Modem image file with inserted SIMLock security data and installs the local system program. After the target mobile terminal completes the installation of the local system program, it utilizes the mobile terminal's existing mechanism for signing and verifying the Modem image file. Every time the local system program is launched, the Modem image file is signed and verified. Since the SIMLock security data is in the Modem image file, the Modem image file passes the security and integrity verification, confirming that the Modem image file has not been tampered with, and the SIMLock security data has also not been tampered with.

[0110] After the target mobile terminal's local system program starts, it reads the Modem image file and runs it in the local memory. Relying on the memory firewall set up by the system itself, it protects the Modem image file and the SIMLock security data in the Modem image file.

[0111] Step S12: Send the system installation package to the target mobile terminal so that after the target mobile terminal starts the local system program, it reads the Modem image file containing the SIMLock security data into its local running memory and runs it.

[0112] In one implementation of this invention, SIMLock configuration data, such as allowed public land mobile networks, allowed user identification modules, signatures of allowed public land mobile networks, and signatures of allowed user identification modules, can be stored in the NV. When a SIM card is inserted, the verification public key for signing and verifying the SIMLock configuration data is extracted from the Modem image file. The signatures of allowed public land mobile networks and allowed user identification modules are decrypted, and the decryption result is compared with the hash value of allowed public land mobile networks, or / and the decryption result is compared with the hash value of allowed user identification modules, thereby verifying the SIMLock configuration data.

[0113] Because the Modem image file is verified every time the target mobile terminal boots up, and it runs in the target mobile terminal's local memory during the system startup phase, the verification public key used to decrypt the SIMLock configuration data is secure and complete, thus ensuring the security of the SIMLock configuration data. Furthermore, the Modem image file has more storage resources than EFUSE, and the SIMLock security data inserted into it can be flexibly configured without restricting the updating of the verification public key. The Modem image file can store other SIMLock security data besides the verification public key, protecting other SIMLock security data.

[0114] One embodiment of this invention proposes a method for inserting SIMLock security data into a modem image file of a system installation package. A certain number of sections can be reserved in the modem image file. The image file is composed of sections, which are a compiler linking attribute used to group global symbols (variables) and specify their storage addresses. During the compilation and linking process, linker scripts, such as linker scripts or LSPs, are used to control the layout of each section within the image file in the memory address space.

[0115] One way to reserve a certain section in the Modem image file is to add an 8KB "SIMLOCK_PUBLIC_AREA" section to specify the storage address of the "verification public key for decrypting SIMLock configuration data".

[0116] Step S21: Write the SIMLock security data into a script file that implements the function of inserting data into the Modem image file.

[0117] By writing an insertion tool, the function of inserting data into a Modem image file can be realized. Figure 3 This is a schematic diagram illustrating the writing of data to a script file according to an embodiment of the present invention, such as... Figure 3As shown, in one example of the present invention, the public key insertion tool—InsertKey—is implemented using the Python scripting language. The script file of the insertion tool—InsertKey—is a script file that implements the function of inserting data into the Modem image file. After implementing the public key insertion tool—InsertKey, create a folder at the same level as InsertKey: the insertion tool script folder Simlock_Keys. Under the insertion tool script folder Simlock_Keys, create the following subfolders in sequence: First authentication public key folder AuthStartKey, Second authentication public key folder AuthEndKey, IMEI data processing public key folder ImeiKey, SIMLock data processing public key folder SimlockKey, and Reserved key folder ReservedKey. The five subfolders AuthStartKey, AuthEndKey, ImeiKey, SimlockKey, and ReservedKey respectively store the first authentication public key (such as the verification public key used to verify the SIMLock data), the second authentication public key (such as the verification public key used to verify the SIMLock data), the IMEI data processing public key (such as the public key used to verify the IMEI of the target mobile terminal), the SIMLock data processing public key (such as the public key used to verify the tool that writes SIMLock data to the target mobile terminal), and the reserved key.

[0118] Step S22: Run the script file to insert the read SIMLock security data into the Modem image file of the system installation package.

[0119] During the installation of the target mobile terminal running the system installation package, a script file is executed to insert data into the Modem image file. During the installation of the system program, the insertion of SIMLock security data into the Modem image file is completed automatically.

[0120] During the compilation of the system installation package, the server runs a script file, reads the SIMLock security data, and inserts the SIMLock security data into the reserved section in the Modem image file. Once the target mobile terminal completes its system startup, it reads the Modem image file and the SIMLock security data inserted into it from the specified storage address in the section and runs it in the corresponding local memory.

[0121] Compared to the limited storage resources of EFUSE Block, the use of sections reserved in the Modem image file to specify the secure data storage address for SIMLock provides a wider range of available storage addresses. Therefore, this embodiment of the invention further proposes that the SIMLock secure data may include any one or a combination of the following elements: SIMLock configuration data, a verification public key for verifying the SIMLock configuration data, a public key for verifying the IMEI of the target mobile terminal, and a public key for verifying the tool used to write SIMLOCK data to the target mobile terminal.

[0122] SIMLock configuration data includes a SIMLock network list, which is a list of public terrestrial mobile networks that are allowed to access. In one example, operator A allows its deployed mobile terminals to access public terrestrial mobile networks 46000, 46002, and 46007. The SIMLock network list is: 46000, 46002, and 46007.

[0123] This invention stores the SIMLock configuration data in a Modem image file and utilizes the signature verification mechanism of the target mobile terminal system's secure boot to ensure the security and integrity of the SIMLock configuration data stored in the Modem image file. This solves the risk of tampering that exists in existing technologies that store SIMLock configuration data in NV.

[0124] In this embodiment of the invention, the public key used to verify the IMEI of the target mobile terminal and the public key used to verify the tool for writing SIMLock data to the target mobile terminal can also be stored in the Modem image file. The security and integrity of the public key used to verify the IMEI of the target mobile terminal and the public key used to verify the tool for writing SIMLock data to the target mobile terminal can be guaranteed through the signature verification mechanism of the secure boot of the target mobile terminal system.

[0125] Verifying the target mobile terminal's IMEI (International Mobile Equipment Identity) means inserting the SIM card into the target mobile terminal, reading the IMEI data signature and IMEI data written during deployment from the NV, and using the public key of the target mobile terminal's IMEI verification to verify the IMEI data signature, thus completing the verification of the IMEI's security and integrity.

[0126] The tool for writing SIMLock data to the target mobile terminal refers to the existing tool for writing SIMLock configuration data to the NV (Virtual Mobile Terminal). In the prior art, before using the "tool for writing SIMLock data to the target mobile terminal," the server authenticates the tool on the current terminal, i.e., encrypting the data (random number or other verification data) sent by the mobile terminal using a private key. During the process of writing SIMLock data using the "tool for writing SIMLock data to the target mobile terminal," the target mobile terminal uses its public key to decrypt and verify the encrypted data, confirming that the tool is secure and allowing data writing. In this embodiment of the invention, the public key used to verify the tool for writing SIMLock data to the target mobile terminal is inserted into the Modem image file, providing a basis for subsequent verification of the tool's authentication legitimacy.

[0127] Due to limitations in EFUSE's storage resources, in the prior art, the public key used to verify the signature of the SIMLock network list, the public key used to verify the IMEI of the target mobile terminal, and the public key used to verify the tool for writing SIMLock data to the target mobile terminal (tool authentication) are all set to a single public key.

[0128] One example of this invention for inserting the aforementioned data "SIMLock configuration data, a verification public key for verifying the SIMLock configuration data, a public key for verifying the IMEI of the target mobile terminal, and a public key for verifying the tool for writing SIMLock data to the target mobile terminal" into a Modem image file can be achieved by creating a folder corresponding to the SIMLock security data in a script file of the public key insertion tool—InsertKey—using the Python scripting language, and then creating multiple subfolders in sequence under the folder corresponding to the SIMLock security data: AuthStartKey, AuthEndKey, ImeiKey, SIMLockKey, and ReservedKey, to store the aforementioned data respectively.

[0129] During the compilation of the system installation package, the server sequentially reads the SIMLock security data from the AuthStartKey, AuthEndKey, ImeiKey, SIMLockKey, and ReservedKey subfolders. For the corresponding identifier field of the read SIMLock security data, the server locates the target storage area of ​​the read SIMLock security data in the Modem image file and stores the read SIMLock security data in the target storage area.

[0130] The secure data deployment method proposed in this invention involves the server inserting the following into a Modem image file during the compilation of the system installation package: SIMLock configuration data, a public key for verifying the target mobile terminal's IMEI, and a public key for verifying the tool used to write SIMLock data to the target mobile terminal. The security and integrity of the data inserted into the Modem image file are ensured by utilizing the signature verification mechanism of the terminal system's secure boot process. Since different functions use different public keys, the security of these public keys is increased, and their use is more flexible. For example, different public keys are used to verify the target mobile terminal's IMEI and to verify the SIMLock configuration data, ensuring that the verification of both the target mobile terminal's IMEI and the SIMLock configuration data is more flexible and secure.

[0131] In addition to SIMLock security data, the modem image file also stores other communication data. Therefore, to quickly and accurately insert the SIMLock security data into the reserved section of the modem image file during the compilation of the system installation package, an identifier can be set in the reserved section storing the SIMLock security data. One embodiment of the present invention proposes a method for inserting the read SIMLock security data into the modem image file of the system installation package, the steps of which are as follows:

[0132] Step S31: Set an identifier field in the first region of the Modem image file; the first region is adjacent to the target storage region pre-allocated to the SIMLock security data in the Modem image file.

[0133] The first region and the target storage region are adjacent storage addresses in the section reserved for SIMLock security data in the Modem image file.

[0134] The identifier field can be a Magic field. When the SIMLock security data includes at least one of the following: SIMLock configuration data, a verification public key for verifying the SIMLock configuration data, a public key for verifying the IMEI of the target mobile terminal, and a public key for verifying the tool for writing SIMLock data to the target mobile terminal, the identifier field corresponding to the target storage area storing different SIMLock security data can be obtained by parsing the data location using the structure. This can also be used to distinguish different SIMLock security data storage locations.

[0135] Step S32: Locate the identification field and locate the target storage area in the Modem image file based on the identification field.

[0136] Figure 4This is a schematic diagram illustrating the storage location of the identifier field in a Modem image file, as shown in one example of the present invention. Figure 4 As shown, the first area of ​​the storage identifier field is adjacent to the target storage area for storing SIMLock security data. When the target mobile terminal completes system installation and runs the Modem image file in local memory, the Section specifies that the address for storing the identifier field is adjacent to the address for storing the SIMLock security data. It can be understood that the data structure of the SIMLock security data in this embodiment of the invention can be: identifier field - SIMLock security data.

[0137] Step S33: Insert the SIMLock security data into the target storage area.

[0138] Figure 5 This is a schematic diagram showing the storage location of the current version number of the SIMlock software to which the SIMLock security data belongs in the Modem image file, as illustrated in one example of the present invention. Figure 6 This is a schematic diagram illustrating another storage location of the current version number of the SIMlock software to which the SIMLock security data belongs in the Modem image file, as shown in one example of the present invention. Figure 5 and Figure 6 As shown, in this embodiment of the invention, an address can also be allocated in the section reserved for SIMLock security data in the Modem image file to the version number of the SIMlock software to which the SIMLock security data belongs. The address allocated to the version number of the SIMlock software to which the SIMLock security data belongs is adjacent to the address allocated to the SIMLock security data itself, or the address allocated to the version number of the SIMlock software to which the SIMLock security data belongs is adjacent to the address allocated to the identifier field. It is understood that the data structure of the SIMLock security data in this embodiment of the invention can be: identifier field - SIMLock security data - version number of the SIMlock software to which the SIMLock security data belongs, or version number of the SIMlock software to which the SIMLock security data belongs - identifier field - SIMLock security data.

[0139] Figure 7 This is a flowchart of another secure data deployment method proposed in an embodiment of the present invention, as follows: Figure 7 As shown, another secure data deployment method proposed in this embodiment of the invention includes the following steps:

[0140] Step S111: During the compilation of the system installation package, insert the SIMLock security data into the Modem image file of the system installation package.

[0141] Step S112: Pre-allocate a second location area adjacent to the first area, or a third location area adjacent to the target storage area, to store the version number of the SIMlock software to which the SIMLock security data belongs.

[0142] Step S113: Insert the current version number of the SIMlock software to which the SIMLock security data belongs into the third location area.

[0143] Step S114: Send the system installation package to the target mobile terminal so that after the target mobile terminal starts the local system program, it reads the Modem image file containing the SIMLock security data and the current version number of the SIMlock software to which the SIMLock security data belongs into the local running memory and runs it.

[0144] This invention provides a basis for providing subsequent updates to the SIMlock software to which the SIMLock security data belongs by inserting the current version number of the SIMlock software into the Modem image file.

[0145] The SIMlock software to which the SIMLock security data belongs has a current version number. The target mobile terminal has a one-time programmable memory (EFUSE) with a padding field. The number of bits filled in the padding field is used to represent the version information of the SIMlock software to which the SIMLock security data belongs.

[0146] After the target mobile terminal completes system startup, it will run the Modem image file containing the current version number of the SIMlock software to which the SIMLock security data belongs in its local memory. The target mobile terminal reads the current version number from the third location area in the Modem image file; that is, it reads the current version number from the location area adjacent to the target storage location in the Modem image file, or from the location area adjacent to the first area in the Modem image file.

[0147] When the target mobile terminal determines that the current version number of the SIMlock software to which the read SIMLock security data belongs is greater than the number of bits already filled in the EFUSE padding field, it determines that the version of the SIMLock software currently installed on the local system is higher than the version number represented by the EFUSE padding field. For example, the number of bits already filled in the EFUSE padding field indicates that the target mobile terminal has upgraded the SIMLock software to which the SIMLock security data belongs N times before the current time. If the version number read from the third location area of ​​the Modem image file is N+1, then the SIMLock software to which the SIMLock security data belongs inserted in the Modem image file has undergone N+1 upgrades, and EFUSE is padded. Since the number of bits padded in EFUSE cannot be erased, using EFUSE to record the version number can prevent the version of the SIMLock software from being rolled back.

[0148] Figure 8 This is a schematic diagram of a one-time programmable memory with a fill field in one example of the present invention, as shown below. Figure 8 As shown in one example of the present invention, the EFUSE padding field has 4 digits. When the server compiles the system installation package for the first time, it inserts the version number "0" of the SIMLock software to which the SIMLock security data belongs into the Modem image file of the system installation package and sends the installation package to the target mobile terminal. After the target mobile terminal completes the system installation, it reads the version number "0" in the Modem image file. The number of digits already filled in the EFUSE padding field is zero. The target mobile terminal does not fill in the EFUSE padding field, and the EFUSE padding field is displayed as "0000".

[0149] After the first upgrade of the SIMLock software associated with the SIMLock security data, the version number "1" of the updated SIMLock software is inserted into the Modem image file of the system installation package. The installation package is then sent to the target mobile terminal. After the target mobile terminal completes the system installation, it reads the version number "1" from the Modem image file. The number of bits already filled in the EFUSE padding field is zero. The version number "1" of the SIMLock software associated with the SIMLock security data is greater than the number of bits already filled in the EFUSE padding field. The EFUSE padding field has no highest padding bit. The target mobile terminal fills the lowest bit of the field, and the EFUSE padding field is displayed as "0001".

[0150] After the SIMLock software associated with the SIMLock security data undergoes its second upgrade, the updated version number "2" of the SIMLock software associated with the SIMLock security data is inserted into the Modem image file of the system installation package. The installation package is then sent to the target mobile terminal. After the target mobile terminal completes the system installation, it reads the version number "2" from the Modem image file. The number of bits already filled in the EFUSE padding field is 1. Since the version number "2" of the SIMLock software associated with the SIMLock security data is greater than the number of bits already filled in the EFUSE padding field, the highest non-zero bit of the EFUSE padding field is located, and the highest non-zero bit is shifted left to obtain the bit to be filled. The target mobile terminal fills the bit to be filled, and the EFUSE padding field is displayed as "0011".

[0151] During each system installation package compilation process, the server compares the version of the SIMLock security data to be inserted into the Modem image file with the version of the SIMLock security data stored in the Modem image file currently installed on the target mobile terminal. If the version of the SIMLock security data to be inserted into the Modem image file is higher than that of the version of the SIMLock security data stored in the Modem image file currently installed on the target mobile terminal, the SIMLock security data to be inserted into the Modem image file will be inserted. If the version of the SIMLock security data to be inserted into the Modem image file is lower than that of the version of the SIMLock security data stored in the Modem image file currently installed on the target mobile terminal, the SIMLock security data will not be inserted into the Modem image file to prevent version rollback of the SIMLock functional module.

[0152] The steps of inserting SIMLock security data into the Modem image file of the system installation package in this embodiment of the invention include:

[0153] Step S41: Read the number of bits that have been filled in the fill field of the EFUSE.

[0154] Step S42: When the current version number of the SIMLock security data is greater than the number of bits already filled in the padding field of the EFUSE, insert the SIMLock security data into the Modem image file of the system installation package.

[0155] Figure 9 This is a flowchart illustrating the steps of another secure data deployment method proposed in this invention, applied to a mobile terminal, such as... Figure 9 As shown, the steps are as follows:

[0156] Step S311: Receive the system installation package sent by the server; wherein, during the compilation of the system installation package, the server inserts SIMLock security data into the Modem image file of the system installation package.

[0157] Step S312: Install the local system program by running the system installation package.

[0158] Step S312 includes the following sub-steps:

[0159] Step S312-1: Run the signing script file corresponding to the Modem image file, and read the private key, public key and public key hash value of the Modem image file corresponding to the Modem image file from the script file.

[0160] The script file corresponding to the modem image file contains the private key, the public key, and the public key hash value of the modem image file.

[0161] Step S312-1: Run the signing script file corresponding to the Modem image file, and read the private key, public key and public key hash value of the Modem image file corresponding to the Modem image file from the script file.

[0162] Step S312-2: Sign the Modem image file using the private key corresponding to the Modem image file to obtain image file signature data.

[0163] Step S312-3: After adding the image file signature data and the public key corresponding to the Modem image file to the Modem image file, write the hash value of the public key corresponding to the Modem image file into EFUSE.

[0164] The public key hash value corresponding to the Modem image file is written to the EFUSEBlock allocated to the Modem image file. The data written to the EFUSE Block cannot be erased, therefore the public key of the Modem image file is secure and reliable.

[0165] Step S313: During the startup of the local system program, perform security and integrity verification on the Modem image file containing the SIMLock security data.

[0166] Step S313 includes the following sub-steps:

[0167] Step S313-1: Read the public key corresponding to the Modem image file from the Modem image file, calculate the public key hash value, and compare it with the public key hash value corresponding to the Modem image file read from the EFUSE to determine the validity of the public key of the Modem image file.

[0168] Step S313-2: Verify the signature data of the Modem image file using the public key corresponding to the Modem image file.

[0169] Step S313-3: Determine that the Modem image file and the SIMLock security data inserted into the Modem image file have passed verification based on the signature verification result.

[0170] Step S314: After the local system program starts up, the Modem image file containing the SIMLock security data is read and run in the local memory.

[0171] To prevent version rollback, the mobile terminal is equipped with a one-time programmable memory (EFUSE), which has a padding field. The number of bits filled in the padding field is used to indicate the SIMlock software version number to which the SIMLock security data belongs. The adjacent area of ​​the target storage area in the Modem image file storing the SIMLock security data stores the current SIMlock software version number to which the SIMLock security data belongs.

[0172] The storage address reserved for the SIMLock security data in the modem image file can be configured such that the memory storage capacity is larger than the SIMLock security data itself. Therefore, the SIMLock software version number to which the SIMLock security data belongs can be stored at an address adjacent to the SIMLock security data storage address. The mobile terminal fills the EFUSE field with the version number inserted in the modem image file.

[0173] After the mobile terminal starts up, the SIMLock module will compare the current version number of the SIMLock software stored in the Modem image file with the version information represented by the fill field in EFUSE. If the current version number of the SIMLock software stored in the Modem image file is less than the version information represented by the fill field in EFUSE, an error will be reported, the Modem image file will be locked, and the mobile terminal will not be able to use the communication function normally. If the two are the same, the SIMLock software will run normally. If the current version number of the SIMLock software stored in the Modem image file is greater than the version information represented by the fill field in EFUSE, the current version number of the SIMLock software stored in the Modem image file will be updated in EFUSE.

[0174] After verifying the Modem image file, the mobile terminal also performs the following steps:

[0175] Step S315: Read the current version number of the SIMLock software to which the SIMLock security data belongs from the adjacent location area.

[0176] Step S316: When the current version number is greater than the number of bits already filled in the EFUSE padding field, locate the highest non-zero bit of EFUSE.

[0177] Step S317: Move the target bit obtained by positioning the highest non-zero bit of EFUSE in the direction of the high bit of the fill field, and fill the target bit.

[0178] EFUSE can utilize electromigration (EM) to enable writing to fill fields.

[0179] Optional examples of the secure data deployment method implemented in this invention have been described in the embodiments applied on the server side, and the embodiments on the mobile terminal side will not repeat the same content.

[0180] Figure 10 This is a functional block diagram of the secure data deployment device proposed in this embodiment of the invention. The secure data deployment device is installed on a server, such as... Figure 10 As shown, the device includes:

[0181] The first insertion module 101 is used to insert SIMLock security data into the Modem image file of the system installation package during the compilation of the system installation package;

[0182] Storage module 102 is used to send the system installation package to the target mobile terminal, so that the target mobile terminal can read the Modem image file containing the SIMLock security data into its local memory and run it by starting a local system program.

[0183] Figure 10 The secure data deployment apparatus provided in the illustrated embodiments can be used to execute this specification. Figure 1 The implementation principle and technical effects of the method embodiment shown can be further referred to the relevant description in the method embodiment.

[0184] In one possible implementation, the first insertion module includes:

[0185] The write submodule is used to write the SIMLock security data into a script file that implements the function of inserting data into the Modem image file;

[0186] The execution submodule is used to run the script file and insert the read SIMLock security data into the Modem image file of the system installation package.

[0187] In one possible implementation, the device further includes:

[0188] An identifier setting module is used to set an identifier field in a first region of the Modem image file; the first region is adjacent to a target storage region pre-allocated to the SIMLock security data in the Modem image file.

[0189] The first insertion module includes:

[0190] The lookup submodule is used to look up the identification field and locate the target storage area in the Modem image file based on the identification field.

[0191] The insertion submodule is used to insert SIMLock security data into the target storage area.

[0192] In one possible implementation, the SIMLock software to which the SIMLock security data belongs is configured with a current version number, and the device further includes:

[0193] The second insertion module is used to insert the current version number of the SIMlock software to which the SIMLock security data belongs into the third location area.

[0194] In one possible implementation, the SIMlock software to which the SIMLock security data belongs is configured with a current version number, the target mobile terminal is configured with a one-time programmable memory (EFUSE), the one-time programmable memory is configured with a padding field, and the number of bits filled in the padding field is used to represent the version information of the SIMlock software to which the SIMLock security data belongs, and the device further includes:

[0195] The read module is used to read the number of bits that have been filled in the fill field of the EFUSE.

[0196] The first insertion module is specifically used to insert the SIMLock security data into the Modem image file of the system installation package when the current version number of the SIMlock software to which the SIMLock security data belongs is greater than the number of bits already filled in the padding field of the EFUSE.

[0197] In one possible implementation, the SIMLock security data includes any one or a combination of the following elements: SIMLock configuration data, a verification public key for verifying the SIMLock configuration data, a public key for verifying the IMEI of the target mobile terminal, and a public key for verifying the tool for writing SIMLock data to the target mobile terminal.

[0198] Figure 11 This is a functional block diagram of another secure data deployment device proposed in an embodiment of the present invention. The secure data deployment device is installed on a mobile terminal, such as... Figure 11 As shown, the device includes:

[0199] The receiving module 111 is used to receive the system installation package sent by the server; wherein, during the process of compiling the system installation package, the server inserts the SIMLock security data into the Modem image file of the system installation package;

[0200] Installation module 112 is used to install local system programs by running the system installation package;

[0201] Verification module 113 is used to perform security and integrity verification on the Modem image file containing the SIMLock security data during the startup of the local system program;

[0202] The startup module 114 is used to store the Modem image file containing the SIMLock security data in the local running memory after the local system program has started.

[0203] Figure 11 The secure data deployment apparatus provided in the illustrated embodiments can be used to execute this specification. Figure 2 The implementation principle and technical effects of the method embodiment shown can be further referred to the relevant description in the method embodiment.

[0204] In one possible implementation, the mobile terminal is equipped with a one-time programmable memory (EFUSE), and the installation module includes:

[0205] The first reading submodule is used to run the signing script file corresponding to the Modem image file, and read the private key, public key and public key hash value corresponding to the Modem image file in the script file;

[0206] The signature submodule is used to sign the Modem image file using the private key corresponding to the Modem image file, and obtain the image file signature data;

[0207] Add a submodule to add the image file signature data and the public key corresponding to the Modem image file to the Modem image file, and then write the hash value of the public key corresponding to the Modem image file into EFUSE;

[0208] The verification module includes:

[0209] The second reading submodule is used to read the public key corresponding to the Modem image file from the Modem image file, calculate the public key hash value, and compare it with the public key hash value corresponding to the Modem image file read from the EFUSE to determine the validity of the public key of the Modem image file;

[0210] The signature verification submodule is used to verify the signature data of the Modem image file using the public key corresponding to the Modem image file.

[0211] The determination submodule is used to determine, based on the signature verification result, whether the Modem image file and the SIMLock security data inserted into the Modem image file have passed verification.

[0212] In one possible implementation, the mobile terminal is provided with a one-time programmable memory (EFUSE), which has a padding field; the number of bits already filled in the padding field is used to represent the version number of the SIMlock software to which the SIMLock security data belongs; the adjacent area of ​​the target storage area storing the SIMLock security data in the Modem image file stores the current version number of the SIMlock software to which the SIMLock security data belongs; the device further includes:

[0213] The version number reading module is used to read the current version number of the SIMlock software to which the SIMLock security data belongs from the adjacent location area;

[0214] The positioning module is used to locate the highest non-zero bit of EFUSE when the current version number is greater than the number of bits already filled in the EFUSE padding field;

[0215] The filling module is used to move the highest non-zero bit of the EFUSE located by the positioning module in the direction of the high bit of the filling field to obtain the target bit, and fill the target bit.

[0216] In one possible implementation, the SIMLock security data includes any one or a combination of the following elements: SIMLock configuration data, a verification public key for verifying the SIMLock configuration data, a public key for verifying the IMEI of the target mobile terminal, and a public key for verifying the tool for writing SIMLock data to the target mobile terminal.

[0217] The apparatus provided in the above embodiments is used to execute the technical solutions of the above method embodiments. Its implementation principle and technical effects can be further referred to the relevant descriptions in the method embodiments, and will not be repeated here.

[0218] Figure 12 This is a schematic diagram of the structure of an electronic terminal device provided in an embodiment of the present invention. The electronic terminal device 1200 includes a processor 1210, a memory 1211, and a computer program stored in the memory 1211 and executable on the processor 1210. When the processor 1210 executes the program, it implements the steps in the aforementioned method embodiment. The electronic terminal device provided in this embodiment can be used to execute the technical solution of the method embodiment shown above. Its implementation principle and technical effect can be further referred to the relevant description in the method embodiment, which will not be repeated here.

[0219] Figure 13 This is a schematic diagram of the structure of a terminal device provided in one embodiment of this specification, as shown below. Figure 13 As shown, the terminal device described above may include at least one processor; and at least one memory communicatively connected to the processor, wherein the memory stores program instructions executable by the processor, and the processor can execute this specification by calling the program instructions. Figure 9 The illustrated embodiment provides a secure data deployment method.

[0220] The aforementioned terminal device can be a smart electronic device such as a smartphone, tablet computer, or laptop computer. This embodiment does not limit the form of the aforementioned terminal device.

[0221] It is understood that the structures illustrated in the embodiments of the present invention do not constitute a specific limitation on the terminal device 100. In other embodiments of the present invention, the terminal device 100 may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0222] like Figure 13 As shown, the terminal device 100 may include a processor 1110, an external memory interface 1120, an internal memory 121, a mobile communication module 150, and a wireless communication module 160.

[0223] The processor 1110 may also include a memory for storing instructions and data. In some embodiments, the memory in the processor 1110 is a cache memory. This memory can store instructions or data that the processor 1110 has just used or that are used repeatedly. If the processor 1110 needs to use the instruction or data again, it can retrieve it directly from the memory. This avoids repeated accesses, reduces the waiting time of the processor 1110, and thus improves the efficiency of the system.

[0224] Processor 1110 executes various functional applications and data processing by running programs stored in internal memory 121, such as implementing the present invention. Figure 6 The illustrated embodiment provides a secure data deployment method.

[0225] The wireless communication function of the terminal device 100 can be implemented through antenna 1, antenna 2, mobile communication module 150, wireless communication module 160, modem processor and baseband processor, etc.

[0226] Antennas 1 and 2 are used to transmit and receive electromagnetic wave signals. Each antenna in terminal device 100 can be used to cover one or more communication frequency bands. Different antennas can also be multiplexed to improve antenna utilization. For example, antenna 1 can be multiplexed as a diversity antenna for a wireless local area network. In some other embodiments, the antennas can be used in conjunction with a tuning switch.

[0227] Internal memory 121 can be used to store executable program code, including instructions. Internal memory 121 may include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback, image playback, etc.). The data storage area may store data created during the use of terminal device 100 (such as audio data, phonebook, etc.). Furthermore, internal memory 121 may include high-speed random access memory and may also include non-volatile memory, such as at least one disk storage device, flash memory device, universal flash storage (UFS), etc. Processor 1110 executes various functional applications and data processing of terminal device 100 by running instructions stored in internal memory 121 and / or instructions stored in memory located within processor 1110.

[0228] This invention provides a non-transitory computer-readable storage medium that stores computer instructions that cause the computer to execute the contents of this specification. Figures 1-2 The illustrated embodiment provides a secure data deployment method.

[0229] The aforementioned non-transitory computer-readable storage medium may be any combination of one or more computer-readable media. A computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium may be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM) or flash memory, optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this document, a computer-readable storage medium may be any tangible medium that contains or stores a program that may be used by or in connection with an instruction execution system, apparatus, or device.

[0230] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including—but not limited to—electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, capable of transmitting, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device.

[0231] Program code contained on a computer-readable medium may be transmitted using any suitable medium, including—but not limited to—wireless, wire, optical fiber, radio frequency (RF), etc., or any suitable combination thereof.

[0232] Computer program code for performing the operations described herein can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0233] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0234] In the description of the embodiments of the present invention, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this specification. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0235] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this specification, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0236] Any process or method described in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this specification includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as will be understood by those skilled in the art to which the embodiments of this specification pertain.

[0237] Depending on the context, the word "if" as used here can be interpreted as "when," "when," "in response to determination," or "in response to detection." Similarly, depending on the context, the phrase "if determination" or "if detection (of the stated condition or event)" can be interpreted as "when determination," "in response to determination," "when detection (of the stated condition or event)," or "in response to detection (of the stated condition or event)."

[0238] It should be noted that the terminals involved in the embodiments of the present invention may include, but are not limited to, personal computers (PCs), personal digital assistants (PDAs), wireless handheld devices, tablet computers, mobile phones, MP3 players, MP4 players, etc.

[0239] In the several embodiments provided in this specification, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0240] Furthermore, the functional units in the various embodiments of this specification can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in a combination of hardware and software functional units.

[0241] The integrated units implemented as software functional units described above can be stored in a computer-readable storage medium. These software functional units, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods described in the various embodiments of this specification. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0242] The above description is merely a preferred embodiment of this specification and is not intended to limit this specification. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of protection of this specification.

Claims

1. A secure data deployment method, characterized in that, Applied to a server, the method includes: During the compilation of the system installation package, SIMLock security data is inserted into the Modem image file of the system installation package; The system installation package is sent to the target mobile terminal so that the target mobile terminal can read the Modem image file containing the SIMLock security data into its local memory and run it after starting the local system program; The method further includes: An identifier field is set in a first region of the Modem image file; the first region is adjacent to the target storage region pre-allocated to the SIMLock security data in the Modem image file. The step of inserting SIMLock security data into the Modem image file of the system installation package includes: Locate the identification field and use the identification field to locate the target storage area in the Modem image file; Insert the SIMLock security data into the target storage area.

2. The method according to claim 1, characterized in that, The step of inserting SIMLock security data into the Modem image file of the system installation package includes: Write the SIMLock security data into a script file that implements the function of inserting data into the Modem image file; Run the script file to insert the read SIMLock security data into the Modem image file of the system installation package.

3. The method according to claim 1 or 2, characterized in that, The SIMLock software to which the SIMLock security data belongs has a current version number set, and the method further includes: A second location area adjacent to the first area, or a third location area adjacent to the target storage area, is pre-allocated to store the version number of the SIMlock software to which the SIMLock security data belongs; Insert the current version number of the SIMlock software to which the SIMLock security data belongs into the third location area.

4. The method according to claim 1 or 2, characterized in that, The SIMlock software to which the SIMLock security data belongs is configured with a current version number. The target mobile terminal is configured with a one-time programmable memory (EFUSE), which has a padding field. The number of bits filled in the padding field is used to represent the version information of the SIMlock software to which the SIMLock security data belongs. The method further includes: Read the number of bits that have been filled in the padding field of the EFUSE; The step of inserting SIMLock security data into the Modem image file of the system installation package includes: When the current version number of the SIMlock software to which the SIMLock security data belongs is greater than the number of bits already filled in the EFUSE padding field, the SIMLock security data is inserted into the Modem image file of the system installation package.

5. The method according to claim 1 or 2, characterized in that, The SIMLock security data includes any one or a combination of the following elements: SIMLock configuration data, a verification public key for verifying the SIMLock configuration data, a public key for verifying the IMEI of the target mobile terminal, and a public key for verifying the tool that writes SIMLock data to the target mobile terminal.

6. A secure data deployment method, characterized in that, Applied to a mobile terminal, the method includes: The server receives a system installation package sent by the server; wherein, during the compilation of the system installation package, the server inserts the SIMLock security data into the Modem image file of the system installation package; Install local system programs by running the system installation package; During the startup of the local system program, the security and integrity of the Modem image file containing the SIMLock security data are verified. After the local system program starts up, the Modem image file containing the SIMLock security data is read and run in the local memory. The first region in the Modem image file is provided with an identification field. The first region in the Modem image file is adjacent to the target storage region pre-allocated to the SIMLock security data. The SIMLock security data is inserted into the target storage region by the server, and the target storage region is located by the server based on the identification field.

7. The method according to claim 6, characterized in that, The mobile terminal is equipped with a one-time programmable memory (EFUSE) to install local system programs by running the system installation package, including: Run the signing script file corresponding to the Modem image file, and read the private key, public key and public key hash value of the Modem image file from the script file. The Modem image file is signed using the private key corresponding to the Modem image file to obtain image file signature data; After adding the Modem image file signature data and the corresponding public key to the Modem image file to the Modem image file, the hash value of the corresponding public key to the Modem image file is written to EFUSE; Perform security and integrity verification on the Modem image file containing the inserted SIMLock security data, including: Read the public key corresponding to the Modem image file from the Modem image file, calculate the public key hash value, and compare it with the public key hash value corresponding to the Modem image file read from the EFUSE to determine the validity of the public key of the Modem image file; The signature data of the Modem image file is verified using the public key corresponding to the Modem image file. Based on the verification results, the Modem image file and the SIMLock security data inserted into the Modem image file have been verified.

8. The method according to claim 6, characterized in that, The mobile terminal is equipped with a one-time programmable memory (EFUSE), which has a padding field. The number of bits already filled in the padding field is used to represent the SIMlock software version information to which the SIMLock security data belongs. The adjacent storage area of ​​the target storage region in the Modem image file storing the SIMLock security data stores the current version number of the SIMlock software to which the SIMLock security data belongs. The method further includes: Read the current version number of the SIMlock software to which the SIMLock security data belongs from the adjacent location area; When the current version number is greater than the number of bits already filled in the EFUSE padding field, locate the highest non-zero bit of EFUSE; The highest non-zero bit of the EFUSE position is moved towards the high-order bit direction of the fill field to obtain the target bit, and the target bit is filled.

9. The method according to any one of claims 6-8, characterized in that, The SIMLock security data includes any one or a combination of the following elements: SIMLock configuration data, a verification public key for verifying the SIMLock configuration data, a public key for verifying the mobile terminal IMEI, and a public key for verifying the tool that writes SIMLock data to the mobile terminal.

10. A data security deployment device, characterized in that, The device, located on a server, includes: The first insertion module is used to insert SIMLock security data into the Modem image file of the system installation package during the compilation of the system installation package; The storage module is used to send the system installation package to the target mobile terminal, so that the target mobile terminal can read the Modem image file containing the SIMLock security data and run it in its local memory after starting the local system program; The device further includes: An identifier setting module is used to set an identifier field in a first region of the Modem image file, wherein the first region is adjacent to a target storage region pre-allocated to the SIMLock security data in the Modem image file. The first insertion module includes: The lookup submodule is used to look up the identification field and locate the target storage area in the Modem image file based on the identification field. The insertion submodule is used to insert SIMLock security data into the target storage area.

11. The apparatus according to claim 10, characterized in that, The first insertion module includes: The write submodule is used to write the SIMLock security data into a script file that implements the function of inserting data into the Modem image file; The execution submodule is used to run the script file and insert the read SIMLock security data into the Modem image file of the system installation package.

12. The apparatus according to claim 10 or 11, characterized in that, The SIMLock software to which the SIMLock security data belongs is configured with a current version number, and the device further includes: The allocation module is used to pre-allocate a second location area adjacent to the first area, or a third location area adjacent to the target storage area, to store the version number of the SIMlock software to which the SIMLock security data belongs; The second insertion module is used to insert the current version number of the SIMlock software to which the SIMLock security data belongs into the third location area.

13. The apparatus according to claim 10 or 11, characterized in that, The SIMlock software to which the SIMLock security data belongs is configured with a current version number. The target mobile terminal is configured with a one-time programmable memory (EFUSE), which has a padding field. The number of bits already filled in the padding field is used to represent the version information of the SIMlock software to which the SIMLock security data belongs. The device further includes: The read module is used to read the number of bits that have been filled in the fill field of the EFUSE. The first insertion module is specifically used to insert the SIMLock security data into the Modem image file of the system installation package when the current version number of the SIMlock software to which the SIMLock security data belongs is greater than the number of bits already filled in the padding field of the EFUSE.

14. The apparatus according to claim 10 or 11, characterized in that, The SIMLock security data includes any one or a combination of the following elements: SIMLock configuration data, a verification public key for verifying the SIMLock configuration data, a public key for verifying the IMEI of the target mobile terminal, and a public key for verifying the tool that writes SIMLock data to the target mobile terminal.

15. A secure data deployment device, characterized in that, The device, configured on a mobile terminal, includes: A receiving module is used to receive a system installation package sent by a server; wherein, during the compilation of the system installation package, the server inserts the SIMLock security data into the Modem image file of the system installation package; An installation module is used to install local system programs by running the system installation package; The verification module is used to perform security and integrity verification on the Modem image file containing the SIMLock security data during the startup of the local system program. The startup module is used to read the Modem image file containing the SIMLock security data and run it in the local memory after the local system program has started. The first region in the Modem image file is provided with an identification field. The first region in the Modem image file is adjacent to the target storage region pre-allocated to the SIMLock security data. The SIMLock security data is inserted into the target storage region by the server, and the target storage region is located by the server based on the identification field.

16. The apparatus according to claim 15, characterized in that, The mobile terminal is equipped with a one-time programmable memory (EFUSE), and the installation module includes: The first reading submodule is used to run the signing script file corresponding to the Modem image file, and read the private key, public key and public key hash value corresponding to the Modem image file in the script file; The signature submodule is used to sign the Modem image file using the private key corresponding to the Modem image file, and obtain the image file signature data; Add a submodule to add the image file signature data and the public key corresponding to the Modem image file to the Modem image file, and then write the hash value of the public key corresponding to the Modem image file into EFUSE; The verification module includes: The second reading submodule is used to read the public key corresponding to the Modem image file from the Modem image file, calculate the public key hash value, and compare it with the public key hash value corresponding to the Modem image file read from the EFUSE to determine the validity of the public key of the Modem image file; The signature verification submodule is used to verify the signature data of the image file using the public key corresponding to the Modem image file. The determination submodule is used to determine, based on the signature verification result, whether the Modem image file and the SIMLock security data inserted into the Modem image file have passed verification.

17. The apparatus according to claim 15, characterized in that, The mobile terminal is equipped with a one-time programmable memory (EFUSE), which has a padding field. The number of bits already filled in the padding field indicates the version number of the SIMlock software to which the SIMLock security data belongs. The adjacent storage area in the Modem image file storing the target storage area of ​​the SIMLock security data stores the current version number of the SIMlock software to which the SIMLock security data belongs. The device further includes: The version number reading module is used to read the current version number of the SIMlock software to which the SIMLock security data belongs from the adjacent location area; The positioning module is used to locate the highest non-zero bit of EFUSE when the current version number is greater than the number of bits already filled in the EFUSE padding field; The filling module is used to move the highest non-zero bit of the EFUSE located by the positioning module in the direction of the high bit of the filling field to obtain the target bit, and fill the target bit.

18. The apparatus according to any one of claims 15-17, characterized in that, The SIMLock security data includes any one or a combination of the following elements: SIMLock configuration data, a verification public key for verifying the SIMLock configuration data, a public key for verifying the mobile terminal IMEI, and a public key for verifying the tool that writes SIMLock data to the mobile terminal.

19. A server, comprising: At least one processor; as well as At least one memory communicatively connected to the processor, characterized in that, The memory stores program instructions that can be executed by the processor, and the processor can execute the method as described in any one of claims 1 to 5 by calling the program instructions.

20. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions cause the computer to perform the method as described in any one of claims 1 to 5.

21. A mobile terminal, comprising: At least one processor; as well as At least one memory communicatively connected to the processor, characterized in that, The memory stores program instructions that can be executed by the processor, which can invoke the program instructions to perform the method as described in any one of claims 6 to 9.

22. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions cause the computer to perform the method as described in any one of claims 6 to 9.

Images