Key retrieval method, server and user identification card

Abstract

The present application discloses a key retrieval method, a server and a user identity card, which belong to the field of communication technology. The method includes: responding to a key retrieval request sent by a terminal, sending a key retrieval instruction to a first user identity card; in the case of receiving an identity authentication request returned by the first user identity card, sending an information acquisition request to the terminal; receiving a first key parameter and a preset destination address returned by the terminal; performing identity authentication with the first user identity card according to the first key parameter and the destination address; in the case of passing the identity authentication, sending a verification pass message to the operator security server, so that the operator security server can obtain the first key through decryption, configure the second user identity card according to the first key and the second key parameter sent by the terminal, and enable the terminal to log in to the preset client through the second user identity card. The method can safely retrieve the key, thereby ensuring the information security and asset security of the user.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a key retrieval method, a server and a user identity card. Background Art

[0002] The Metaverse is a virtual world that is linked and created by technological means, mapped and interacted with the real world, and has a digital living space with a new social system. User information and assets in the Metaverse exist in digital form, and the identification of user identity depends on the user's private key. If the private key is lost, it may lead to the collapse of the user's personal universe.

[0003] In the related art, after a user loses a private key, he or she can retrieve the private key through the operator.

[0004] However, since operators have relatively absolute control over private keys, it is easy for criminals to maliciously obtain user private keys through operators, thereby posing a greater risk to users' assets in the metaverse and failing to effectively protect users' interests. Summary of the invention

[0005] To this end, the present application provides a key retrieval method, a server and a user identity card to solve the problem that criminals maliciously obtain user private keys through operators, resulting in loss of user information and assets.

[0006] In order to achieve the above-mentioned purpose, the first aspect of the present application provides a key retrieval method, which is applied to an operator service server, and the method includes:

[0007] In response to a key retrieval request sent by the terminal, a key retrieval instruction is sent to the first user identity card, wherein the key retrieval request is a request sent by the terminal when the first user identity card is lost, the first user identity card has a first key and a first key parameter for logging into a preset client, and the key retrieval instruction is used to instruct the first user identity card to generate an identity authentication request;

[0008] Upon receiving the identity verification request returned by the first user identity recognition card, sending an information acquisition request to the terminal;

[0009] Receiving the first key parameter and a preset destination address returned by the terminal;

[0010] performing identity authentication with the first user identification card according to the first key parameter and the destination address;

[0011] If the identity authentication is passed, a verification pass message is sent to the operator security server so that the operator security server receives the second key and the first key parameter sent by the terminal, decrypts the second key according to the first key parameter to obtain the first key, and configures the second user identity identification card according to the first key and the second key parameter sent by the terminal, so that the terminal logs in to the preset client through the second user identity identification card, and the second key is a key generated by the first user identity identification card using the first key parameter to encrypt the first key and send it to the destination address.

[0012] Further, performing identity authentication with the first user identification card according to the first key parameter and the destination address includes:

[0013] Encrypt the destination address using the first key parameter to obtain a first encryption result;

[0014] sending the first encryption result to the first user identity identification card, so that the first user identity identification card obtains an identity authentication result according to the first encryption result and the second encryption result, where the second encryption result is a result obtained by the first user identity identification card encrypting the destination address according to the first key parameter;

[0015] Receiving the identity authentication result returned by the first user identity recognition card;

[0016] Determine whether the identity authentication is passed according to the identity authentication result.

[0017] Further, the destination address is a designated address built into the first user identity card, or the destination address is a temporary address provided by the terminal;

[0018] In a case where the destination address is a temporary address provided by the terminal, after receiving the first key parameter and the preset destination address returned by the terminal, the method further includes:

[0019] The destination address is sent to the first user identity card.

[0020] In order to achieve the above-mentioned purpose, the second aspect of the present application provides a key retrieval method, which is applied to an operator security server, and the method includes:

[0021] In response to a verification pass message sent by the operator service server, obtaining a second key and a first key parameter provided by the terminal;

[0022] The verification pass message is a message sent by the operator service server when the identity authentication of the first user identity identification card is passed, the first user identity identification card has a built-in first key and the first key parameter for logging into the preset client, and the second key is a key generated by the first user identity identification card by encrypting the first key using the first key parameter and sending it to the destination address;

[0023] Decrypting the second key according to the first key parameter to obtain the first key;

[0024] When the second key parameter provided by the terminal is obtained, a second user identity card is configured according to the first key and the second key parameter, so that the terminal can log in to the preset client through the second user identity card.

[0025] In order to achieve the above-mentioned purpose, the third aspect of the present application provides a key retrieval method, which is applied to a first user identity card, and the method comprises:

[0026] Receiving a key retrieval instruction sent by an operator service server, wherein the key retrieval instruction is an instruction sent by the operator service server in response to a key retrieval request of a terminal;

[0027] Sending an identity authentication request to the operator service server;

[0028] Authenticate the identity of the operator service server using a preset destination address and a first key parameter built into the first user identity card;

[0029] When the operator service server passes the identity authentication, encrypting the first key using the first key parameter to obtain a second key;

[0030] The second key is sent to the destination address so that the terminal can obtain the second key from the destination address, and the second key and the first key parameters are provided to the operator security server, so that the operator security server decrypts the second key according to the first key parameters to obtain the first key, and configures the second user identity identification card based on the first key and the second key parameters provided by the terminal, so that the terminal can log in to the preset client through the second user identity identification card.

[0031] Furthermore, the destination address is a designated address built into the first user identity card, or the destination address is a temporary address provided by the terminal and forwarded by the operator service server.

[0032] Furthermore, the using a preset destination address and a first key parameter built into the first user identity card to authenticate the operator service server includes:

[0033] receiving a first encryption result sent by the operator service server, where the first encryption result is a result obtained by the operator service server encrypting a destination address provided by the terminal using a first key parameter provided by the terminal;

[0034] Encrypting the destination address according to the first key parameter to obtain a second encryption result;

[0035] Obtaining an identity authentication result according to the first encryption result and the second encryption result;

[0036] The identity verification result is sent to the operator service server.

[0037] In order to achieve the above-mentioned purpose, the fourth aspect of the present application provides an operator service server, which includes:

[0038] a first sending module, configured to respond to a key retrieval request sent by a terminal and send a key retrieval instruction to a first user identity card, wherein the key retrieval request is a request sent by the terminal when the first user identity card is lost, the first user identity card has a first key and a first key parameter for logging into a preset client, and the key retrieval instruction is used to instruct the first user identity card to generate an identity authentication request;

[0039] A second sending module is used to send an information acquisition request to the terminal when receiving the identity authentication request returned by the first user identity recognition card;

[0040] A first receiving module, used to receive the first key parameter and a preset destination address returned by the terminal;

[0041] A first verification module, configured to perform identity authentication with the first user identification card according to the first key parameter and the destination address;

[0042] The third sending module is used to send a verification pass message to the operator security server when the identity authentication is passed, so that the operator security server receives the second key and the first key parameter sent by the terminal, decrypts the second key according to the first key parameter to obtain the first key, and configures the second user identity identification card according to the first key and the second key parameter sent by the terminal, so that the terminal logs in to the preset client through the second user identity identification card, and the second key is a key generated by the first user identity identification card using the first key parameter to encrypt the first key and send it to the destination address.

[0043] In order to achieve the above-mentioned purpose, the fifth aspect of the present application provides an operator security server, which includes:

[0044] An acquisition module, configured to acquire the second key and the first key parameters provided by the terminal in response to a verification pass message sent by the operator service server;

[0045] The verification pass message is a message sent by the operator service server when the identity authentication of the first user identity identification card is passed, the first user identity identification card has a built-in first key and the first key parameter for logging into the preset client, and the second key is a key generated by the first user identity identification card by encrypting the first key using the first key parameter and sending it to the destination address;

[0046] a decryption module, configured to decrypt the second key according to the first key parameter to obtain the first key;

[0047] The configuration module is used to configure a second user identity card according to the first key and the second key parameter when receiving the second key parameter sent by the terminal, so that the terminal can log in to the preset client through the second user identity card.

[0048] In order to achieve the above-mentioned purpose, the sixth aspect of the present application provides a user identity card, the user identity card comprising:

[0049] A second receiving module, configured to receive a key retrieval instruction sent by an operator service server, wherein the key retrieval instruction is an instruction sent by the operator service server in response to a key retrieval request of a terminal;

[0050] A fourth sending module, used to send an identity authentication request to the operator service server;

[0051] A second verification module, used to authenticate the operator service server using a preset destination address and a first key parameter built into the first user identity card;

[0052] an encryption module, configured to encrypt the first key using the first key parameter to obtain a second key when the operator service server passes identity authentication;

[0053] The fifth sending module is used to send the second key to the destination address so that the terminal can obtain the second key from the destination address, and provide the second key and the first key parameters to the operator security server, so that the operator security server decrypts the second key according to the first key parameters to obtain the first key, and configures the second user identity identification card based on the first key and the second key parameters provided by the terminal, so that the terminal can log in to the preset client through the second user identity identification card.

[0054] This application has the following advantages:

[0055] The key retrieval method, server and user identification card provided in the present application, the operator service server responds to the key retrieval request sent by the terminal, sends a key retrieval instruction to the first user identification card, and authenticates the identity with the first user identification card according to the first key parameter and the preset destination address, and sends a verification pass message to the operator security server if the identity authentication is passed; the operator security server obtains the second key and the first key parameter provided by the terminal, decrypts the second key according to the first key parameter, obtains the first key, and configures the second user identification card according to the first key and the second key parameter; the terminal logs in to the preset client through the second user identification card. The method divides the server on the operator side into an operator service server and an operator security server, and the operator service server performs services such as identity authentication, and the operator security server performs operations such as key decryption. Through service division and server division, the security of the user key retrieval process is guaranteed, thereby effectively reducing the occurrence of situations where criminals maliciously obtain user private keys through operators, resulting in losses of user information and assets. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] The accompanying drawings are used to provide further understanding of the present application and constitute a part of the specification. Together with the following specific embodiments, they are used to explain the present application, but do not constitute a limitation to the present application.

[0057] Figure 1 is a flow chart of a key retrieval method provided in an embodiment of the present application;

[0058] Figure 2is a flow chart of a key retrieval method provided in an embodiment of the present application;

[0059] Figure 3 is a flow chart of a key retrieval method provided in an embodiment of the present application;

[0060] Figure 4 is a block diagram of an operator service server provided in an embodiment of the present application;

[0061] Figure 5 is a block diagram of an operator security server provided in an embodiment of the present application;

[0062] Figure 6 is a block diagram of a user identity card provided in an embodiment of the present application;

[0063] Figure 7 is a schematic diagram of a key retrieval system provided in an embodiment of the present application;

[0064] Figure 8 This is a schematic diagram of the working process of a key retrieval method provided in an embodiment of the present application;

[0065] Fig. 9 It is a block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0066] The specific implementation of the present application is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described here is only used to illustrate and explain the present application, and is not used to limit the present application.

[0067] As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items.

[0068] The terms used in this application are only used to describe specific embodiments and are not intended to limit the present application.As used in this application, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0069] When the terms “comprising” and / or “made of…” are used in this application, it specifies the existence of the stated features, integers, steps, operations, elements and / or components, but does not exclude the existence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof.

[0070] Unless otherwise defined, all terms (including technical and scientific terms) used in this application have the same meaning as those commonly understood by those of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant art and this application, and will not be interpreted as having an idealized or overly formal meaning unless explicitly defined in this application.

[0071] The Metaverse is a virtual world that is linked and created by scientific and technological means, mapped and interacted with the real world, and has a digital living space with a new social system. User information and assets in the Metaverse exist in digital form, and the identification of user identity depends on the user's private key (i.e., key). Users can log in to their Metaverse client through their user identity card to view relevant information or conduct transactions.

[0072] If the key is lost, it may lead to the collapse of the user's personal universe. In related technologies, after losing the key, the user can retrieve the key through the operator. However, since the operator has a relatively absolute control over the key, it is easy for criminals to maliciously obtain the user's private key through the operator, thereby posing a greater risk to the user's assets in the metaverse and failing to effectively protect the user's interests.

[0073] Based on this, in the embodiment of the present application, when retrieving the user key, the operator service server first authenticates the first user identity card, and after the identity is authenticated, the operator security server with a higher security level completes the key retrieval and configuration of the new card. Since the operation process and operation results of the operator security server are not displayed to the outside (including the operator service server), the security of information such as keys can be effectively guaranteed.

[0074] In a first aspect, an embodiment of the present application provides a key retrieval method.

[0075] Figure 1 1 is a flowchart of a key retrieval method provided in an embodiment of the present application, and the key retrieval method can be applied to an operator service server. Figure 1 As shown, the key retrieval method includes the following steps:

[0076] Step S101, responding to a key retrieval request sent by a terminal, sending a key retrieval instruction to a first user identity card.

[0077] Among them, the key retrieval request is a request sent by the terminal when the first user identity card is lost. The first user identity card has a built-in first key and first key parameter for logging into the preset client. The key retrieval instruction is used to instruct the first user identity card to generate an identity authentication request.

[0078] In some possible implementations, the first user identity card is the user's (Subscriber Identity Model Card, SIM card), and the user pre-embeds the first key and the first key parameter in the first user identity card, so that the user can log in to the preset client based on the first key. The preset client may be a Metaverse client, and the first key parameter is a parameter used to retrieve the first key, which may be a password, a verification code, etc.

[0079] In some possible implementations, after the user loses the first user identity card, the user sends a key retrieval request to the operator service server online or offline. The operator service server instructs the terminal to provide identity verification information, and when the operator service server verifies that the user is a real and credible user through the identity verification information, it sends a key retrieval instruction to the first user identity card. The identity verification information may be the user's ID card information, or a security answer corresponding to a preset security question, etc., which is not limited in the embodiments of the present application.

[0080] It should be noted that the operator service server sends the key retrieval instruction to the first user identity card through the signaling channel, and the key retrieval instruction can be received as long as the terminal where the first user identity card is located is in the power-on state.

[0081] It should also be noted that the current execution entity is the operator's business server, which also includes the operator's security server for the operator. Generally speaking, the operator's business server is mainly used to execute routine business, and the operator's security server is used to execute business with a higher security level. The operation process and results of the operator's security server are not displayed to the outside world, so as to ensure the security of relevant information.

[0082] Step S102: upon receiving the identity authentication request returned by the first user identity recognition card, sending an information acquisition request to the terminal.

[0083] In some possible implementations, after receiving the key retrieval instruction, the first user identification card needs to confirm the legitimacy of the operator service server through identity authentication operation to prevent a third party from illegally stealing the key by using the identity of the operator service server.

[0084] In one example, the first user identity card sends an identity authentication request to the operator service server in response to the key retrieval instruction. Upon receiving the identity authentication request, the operator service server sends an information acquisition request to the terminal. The information acquisition request may carry a description of the information to be acquired. For example, the first key parameter and the destination address need to be acquired.

[0085] It should be understood that if the key retrieval instruction is not an instruction sent by the operator service server, the operator service server will no longer respond to the identity authentication request and may send a reminder message to the corresponding terminal.

[0086] Step S103: receiving the first key parameter and the preset destination address returned by the terminal.

[0087] In some possible implementations, if it is an online scenario, the terminal returns the first key parameter and a preset destination address to the operator service server via a mobile communication network or other communication network, wherein the destination address may be an email address or other specified address.

[0088] In some possible implementations, if it is an offline scenario, the operator service server instructs the user to input relevant information, and the user inputs the first key parameter and the destination address through the security keyboard.

[0089] In some possible implementations, the destination address is a designated address built into the first user identity card, or the destination address is a temporary address provided by the terminal. In the case where the destination address is a temporary address provided by the terminal, after step S102, the method further includes: the operator service server sends the destination address to the first user identity card.

[0090] Step S104: performing identity authentication with the first user identification card according to the first key parameter and the destination address.

[0091] In some possible implementations, the operator service server encrypts the destination address using the first key parameter to obtain a first encryption result, and sends the first encryption result to the first user identity card. The first user identity card encrypts the destination address according to its built-in first key parameter to obtain a second encryption result, and obtains an identity authentication result according to the first encryption result and the second encryption result, and then sends the identity authentication result to the operator service server. The operator service server receives the identity authentication result returned by the first user identity card, and determines whether the identity authentication is passed according to the identity authentication result.

[0092] In one example, the first encryption result is the result obtained by the operator service server using the first key parameter to encrypt the destination address according to the pre-agreed encryption algorithm. For example, the first encryption result C1=E PWD (addr), where PWD is the first key parameter provided by the terminal, addr is the destination address, and E() represents the encryption algorithm. Correspondingly, the second encryption result is the result obtained by the first user identity card encrypting the destination address using the built-in first key parameter according to the pre-agreed encryption algorithm. For example, the second encryption result C2 = E PWD’(addr'), where PWD' is the built-in first key parameter, addr' is the destination address corresponding to the first user identity card, and E() represents the encryption algorithm. When C1 and C2 are the same, the first user identity card determines that the verification is passed, and when C1 and C2 are different, the first user identity card determines that the verification is not passed.

[0093] It should be noted that if the terminal is a legitimate terminal, the PWD provided by it should be the same as the PWD' built into the first identity card, and addr should also be the same as addr'.

[0094] Step S105: If the identity authentication is passed, a verification pass message is sent to the operator's security server.

[0095] In some possible implementations, the operator security server receives the second key and the first key parameter sent by the terminal, decrypts the second key according to the first key parameter to obtain the first key, configures the second user identity card according to the first key and the second key parameter sent by the terminal, and enables the terminal to log in to the preset client through the second user identity card. The second key is a key generated by the first user identity card using the first key parameter to encrypt the first key and send it to the destination address.

[0096] Figure 2 1 is a flowchart of a key retrieval method provided in an embodiment of the present application, and the key retrieval method can be applied to an operator security server. Figure 2 As shown, the key retrieval method includes the following steps:

[0097] Step S201: In response to a verification success message sent by an operator service server, a second key and first key parameters provided by a terminal are obtained.

[0098] Among them, the verification pass message is a message sent by the operator business server when the identity authentication of the first user identity identification card is passed. The first user identity identification card has a built-in first key and first key parameter for logging into the preset client. The second key is a key generated by the first user identity identification card using the first key parameter to encrypt the first key and send it to the destination address.

[0099] In some possible implementations, when the first user identity card passes the identity authentication of the operator's service server, the first user identity card encrypts the first key using the first key parameter to generate a second key, and sends the second key to the destination address. Since the destination address is an address agreed upon by the user (terminal) and the first user identity card, the user (terminal) can obtain the second key from the destination address. After obtaining the second key, in an online scenario, the user sends the second key and the first key parameter to the operator's security server through the terminal; in an offline scenario, the user enters the second key and the first key parameter to the operator's security server through a secure keyboard.

[0100] It should be noted that the operator's business server cannot obtain the above-mentioned second key and other information. Therefore, the user's information security can be guaranteed at a mobile level, thereby ensuring the security of the user's assets in the Metaverse system.

[0101] Step S202: decrypt the second key according to the first key parameter to obtain the first key.

[0102] In some possible implementations, the second key SK'=F PWD’ (SK), where SK represents the first key, PWD' is the first key parameter built into the card, and F() represents the corresponding encryption algorithm. Correspondingly, the operator's security server uses the decryption algorithm corresponding to F() and uses the first key parameter PWD provided by the terminal to decrypt SK', thereby obtaining the first key SK.

[0103] Step S203: when the second key parameter provided by the terminal is obtained, a second user identity card is configured according to the first key and the second key parameter, so that the terminal can log in to the preset client through the second user identity card.

[0104] In some possible implementations, the second key parameter is a new key parameter. If the first key is retrieved after the second user identity card is lost, the key retrieval method needs to be performed based on the second key parameter.

[0105] In some possible implementations, the second user identity card is a new SIM card, and after configuring the SIM card according to the first key and the second key parameters, a final second user identity card is obtained. The terminal downloads a designated client based on the second user identity card, and logs in to the client using the first key built into the card.

[0106] Figure 31 is a flowchart of a key retrieval method provided in an embodiment of the present application. The key retrieval method can be applied to a first user identity card, which has a first key and a first key parameter for logging into a preset client. Figure 3 As shown, the key retrieval method includes the following steps:

[0107] Step S301: receiving a key retrieval instruction sent by an operator service server.

[0108] The key retrieval instruction is an instruction sent by the operator service server in response to the key retrieval request of the terminal.

[0109] In some possible implementations, the operator service server sends a key retrieval instruction through a signaling channel. As long as the terminal where the first user identity card is located is in a powered-on state, the key retrieval instruction can be received.

[0110] Step S302: Send an identity authentication request to the operator's service server.

[0111] In some possible implementations, after receiving the key retrieval instruction, the first user identification card needs to confirm the legitimacy of the operator service server through identity authentication operation to prevent a third party from illegally stealing the key by using the identity of the operator service server.

[0112] In one example, the identity authentication request may be in the form of a challenge question and answer. For example, the first user identity card sends a challenge question and answer to the operator service server, requiring the operator service server to encrypt the destination address using the first key parameter, obtain a first encryption result, and return the first encryption result to the first user identity card.

[0113] Step S303: Use the preset destination address and the first key parameter built into the first user identity card to authenticate the operator's service server.

[0114] In some possible implementations, the destination address is a designated address built into the first user identity card, or the destination address is a temporary address provided by the terminal. In the case where the destination address is a temporary address provided by the terminal, the operator service server needs to send the destination address provided by the terminal to the first user identity card through a signaling channel so that the first user identity card performs identity authentication and subsequent operations based on the destination address; when the destination address is a designated address built into the first user identity card, the first user identity card can directly use the designated address to perform identity authentication and subsequent operations.

[0115] In some possible implementations, the operator service server encrypts the destination address using the first key parameter to obtain a first encryption result, and sends the first encryption result to the first user identity card. The first user identity card encrypts the destination address according to its built-in first key parameter to obtain a second encryption result, and obtains an identity authentication result according to the first encryption result and the second encryption result, and then sends the identity authentication result to the operator service server. The operator service server receives the identity authentication result returned by the first user identity card, and determines whether the identity authentication is passed according to the identity authentication result.

[0116] In one example, the first encryption result is the result obtained by the operator service server using the first key parameter to encrypt the destination address according to the pre-agreed encryption algorithm. For example, the first encryption result C1=E PWD (addr), where PWD is the first key parameter, addr is the destination address, and E() represents the encryption algorithm. Correspondingly, the second encryption result is the result obtained by the first user identification card encrypting the destination address using the built-in first key parameter according to the pre-agreed encryption algorithm. For example, the second encryption result C2 = E PWD’ (addr'), where PWD' is the built-in first key parameter, addr' is the destination address corresponding to the first user identity card, and E() represents the encryption algorithm. When C1 and C2 are the same, the first user identity card determines that the verification is passed, and when C1 and C2 are different, the first user identity card determines that the verification is not passed.

[0117] Step S304: When the operator service server passes the identity authentication, the first key parameter is used to encrypt the first key to obtain a second key.

[0118] In some possible implementations, the second key SK'=F PWD’ (SK), where SK represents the first key, PWD' is the first key parameter built into the card, and F() represents the corresponding encryption algorithm.

[0119] Step S305: Send the second key to the destination address.

[0120] In some possible implementations, since the destination address is an address agreed upon by the user (terminal) and the first user identity card, the user (terminal) can obtain the second key from the destination address. After obtaining the second key, in an online scenario, the user sends the second key and the first key parameters to the operator security server through the terminal; in an offline scenario, the user inputs the second key and the first key parameters to the operator security server through a secure keyboard. The operator security server decrypts the second key using the first key parameters according to a pre-agreed decryption algorithm, obtains the first key, and configures the second user identity card based on the first key and the second key parameters provided by the terminal. The terminal downloads the specified client based on the second user identity card, and logs in to the client using the first key built into the card.

[0121] The step division of the above methods is only for the purpose of clear description. When implemented, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this patent; adding insignificant modifications to the algorithm or process or introducing insignificant designs without changing the core design of the algorithm and process are all within the scope of protection of this patent.

[0122] In a second aspect, an embodiment of the present application provides an operator service server, an operator security server and a user identity card.

[0123] Figure 4 is a block diagram of an operator service server provided in an embodiment of the present application. Figure 4 As shown, the operator service server includes the following modules:

[0124] The first sending module 401 is used to respond to the key retrieval request sent by the terminal and send a key retrieval instruction to the first user identity card.

[0125] Among them, the key retrieval request is a request sent by the terminal when the first user identity card is lost. The first user identity card has a built-in first key and first key parameter for logging into the preset client. The key retrieval instruction is used to instruct the first user identity card to generate an identity authentication request.

[0126] The second sending module 402 is configured to send an information acquisition request to the terminal upon receiving the identity authentication request returned by the first user identity recognition card.

[0127] The first receiving module 403 is configured to receive a first key parameter and a preset destination address returned by the terminal.

[0128] In some possible implementations, the destination address is a designated address built into the first user identity card, or the destination address is a temporary address provided by the terminal. In the case where the destination address is a temporary address provided by the terminal, the operator service server needs to send the destination address provided by the terminal to the first user identity card through a signaling channel.

[0129] The first verification module 404 is used to perform identity verification with the first user identification card according to the first key parameter and the destination address.

[0130] In some possible implementations, the first verification module 404 includes: a first encryption unit, a first sending unit, a first receiving unit, and a result determination unit. The first encryption unit is used to encrypt the destination address using the first key parameter to obtain a first encryption result; the first sending unit is used to send the first encryption result to the first user identity identification card, so that the first user identity identification card can obtain an identity authentication result according to the first encryption result and the second encryption result, and the second encryption result is the result obtained by the first user identity identification card encrypting the destination address according to the first key parameter; the first receiving unit is used to receive the identity authentication result returned by the first user identity identification card; the result determination unit is used to determine whether the identity authentication is passed according to the identity authentication result.

[0131] The third sending module 405 is used to send a verification pass message to the operator security server when the identity authentication is passed, so that the operator security server can receive the second key and the first key parameter sent by the terminal, decrypt the second key according to the first key parameter, obtain the first key, configure the second user identity identification card according to the first key and the second key parameter sent by the terminal, so that the terminal logs in to the preset client through the second user identity identification card, and the second key is a key generated by the first user identity identification card using the first key parameter to encrypt the first key and send it to the destination address.

[0132] Figure 5 is a block diagram of an operator security server provided in an embodiment of the present application. Figure 5 As shown, the operator security server includes the following modules:

[0133] The acquisition module 501 is used to acquire the second key and the first key parameters provided by the terminal in response to the verification pass message sent by the operator service server.

[0134] Among them, the verification pass message is a message sent by the operator business server when the identity authentication of the first user identity identification card is passed. The first user identity identification card has a built-in first key and first key parameter for logging into the preset client. The second key is a key generated by the first user identity identification card using the first key parameter to encrypt the first key and send it to the destination address.

[0135] The decryption module 502 is used to decrypt the second key according to the first key parameter to obtain the first key.

[0136] The configuration module 503 is used to configure the second user identity card according to the first key and the second key parameters when receiving the second key parameters sent by the terminal, so that the terminal can log in to the preset client through the second user identity card.

[0137] Figure 6 is a block diagram of a user identity card provided in an embodiment of the present application. Figure 6 As shown, the user identification card includes the following modules:

[0138] The second receiving module 601 is used to receive a key retrieval instruction sent by an operator service server.

[0139] The key retrieval instruction is an instruction sent by the operator service server in response to the key retrieval request of the terminal.

[0140] The fourth sending module 602 is used to send an identity authentication request to the operator service server.

[0141] The second verification module 603 is used to authenticate the operator service server using a preset destination address and a first key parameter built into the first user identity card.

[0142] In some possible implementations, the second verification module 603 includes: a second receiving unit, a second encryption unit, a verification unit, and a second sending unit. The second receiving unit is used to receive a first encryption result sent by the operator service server, where the first encryption result is a result obtained by the operator service server using a first key parameter provided by the terminal to encrypt the destination address provided by the terminal; the second encryption unit is used to encrypt the destination address according to the first key parameter to obtain a second encryption result; the verification unit is used to obtain an identity authentication result according to the first encryption result and the second encryption result; and the second sending unit is used to send the identity authentication result to the operator service server.

[0143] The encryption module 604 is used to encrypt the first key using the first key parameter to obtain the second key when the operator service server passes the identity authentication.

[0144] The fifth sending module 605 is used to send the second key to the destination address so that the terminal can obtain the second key from the destination address, and provide the second key and the first key parameters to the operator security server, so that the operator security server decrypts the second key according to the first key parameters to obtain the first key, and configures the second user identity identification card based on the first key and the second key parameters provided by the terminal, so that the terminal can log in to the preset client through the second user identity identification card.

[0145] In some possible implementations, the destination address is a designated address built into the first user identity card, or the destination address is a temporary address provided by the terminal. In the case where the destination address is a temporary address provided by the terminal, the operator service server needs to send the destination address provided by the terminal to the first user identity card through a signaling channel.

[0146] In a third aspect, an embodiment of the present application provides a key retrieval system.

[0147] Figure 7 Schematic diagram of a key retrieval system provided in an embodiment of the present application. Figure 7 As shown, the key retrieval system includes: a terminal 701 , an operator security server 702 , an operator service server 703 , a destination address server 704 , a first user identity card 705 , and a second user identity card 706 .

[0148] Reference Figure 7 After losing the first user identity card 705, the terminal 701 sends a key retrieval request to the operator service server 703, and the operator service server 703 sends a key retrieval instruction to the first user identity card 705 through the signaling channel. The first user identity card 705 and the operator service server 703 perform identity authentication. If the identity authentication is passed, the first user identity card 705 uses the first key parameter built in the card to encrypt the first key and sends it to the destination address server 704 corresponding to the destination address, so that the terminal 701 obtains the second key from the destination address server 704. In response to the verification pass message sent by the operator service server 703, the operator security server 702 obtains the second key and the first key parameter from the terminal 701, decrypts the second key according to the first key parameter, obtains the first key, and configures the second user identity card 706 according to the first key and the second key parameter provided by the terminal 701. The terminal 701 can log in to the preset client using the second user identity card 706.

[0149] Figure 8 Schematic diagram of the working process of a key retrieval method provided in an embodiment of the present application. Figure 8 As shown, the working process of the key retrieval method includes:

[0150] Step S801: The terminal sends a key retrieval request to the operator service server.

[0151] Step S802: The operator service server sends a key retrieval instruction to the first user identity card in response to the key retrieval request.

[0152] Step S803: The first user identity card sends an identity authentication request to the operator service server.

[0153] Step S804: the operator service server sends an information acquisition request to the terminal, and the terminal returns the first key parameter and the destination address to the operator service server.

[0154] Step S805: The operator service server encrypts the destination address using the first key parameter to obtain a first encryption result.

[0155] Step S806: The operator service server sends the first encryption result to the first user identity card.

[0156] Step S807: the first user identification card encrypts the preset destination address according to the built-in first key parameter to obtain a second encryption result, and obtains an identity authentication result according to the first encryption result and the second encryption result.

[0157] Step S808: The first user identity card sends the identity authentication result to the operator service server.

[0158] Step S809: When the operator service server passes the identity authentication, the first user identity identification card encrypts the first key using the first key parameter to obtain the second key.

[0159] Step S810: The first user identity card sends the second key to a destination address server.

[0160] Step S811: When the operator service server passes the identity authentication, the operator service server sends a verification pass message to the operator security server.

[0161] Step S812: The operator security server sends an information acquisition instruction to the terminal in response to the verification pass message.

[0162] Step S813: The terminal responds to the information acquisition instruction and acquires the second key from the destination address server.

[0163] Step S814: The terminal sends the second key and the first key parameters to the operator security server.

[0164] Step S815: The operator security server decrypts the second key according to the first key parameter to obtain the first key.

[0165] Step S816: The operator security server configures a second user identity card according to the first key and the second key parameter sent by the terminal, so that the terminal logs in to the preset client through the second user identity card.

[0166] The functions or modules included in the device provided in the embodiments of the present application can be used to execute the method described in the first aspect method embodiment above. Its specific implementation and technical effects can refer to the description of the above method embodiment. For the sake of brevity, they will not be repeated here.

[0167] It should be noted that all modules involved in this embodiment are logic modules. In practical applications, a logic unit can be a physical unit, a part of a physical unit, or a combination of multiple physical units. In addition, in order to highlight the innovative part of this application, this embodiment does not introduce units that are not closely related to solving the technical problems proposed by this application, but this does not mean that there are no other units in this embodiment.

[0168] Fig. 9 It is a block diagram of an electronic device provided in an embodiment of the present application.

[0169] Reference Fig. 9 , an embodiment of the present application provides an electronic device, comprising:

[0170] One or more processors 901;

[0171] A memory 902 having one or more programs stored thereon, which, when executed by one or more processors, enables the one or more processors to implement any one of the above-mentioned key retrieval methods;

[0172] One or more I / O interfaces 903 are connected between the processor and the memory and are configured to implement information exchange between the processor and the memory.

[0173] Among them, the processor 901 is a device with data processing capabilities, including but not limited to a central processing unit (CPU); the memory 902 is a device with data storage capabilities, including but not limited to random access memory (RAM, more specifically SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory (FLASH); the I / O interface (read-write interface) 903 is connected between the processor 901 and the memory 902, and can realize information interaction between the processor 901 and the memory 902, including but not limited to a data bus (Bus), etc.

[0174] In some embodiments, the processor 901 , the memory 902 , and the I / O interface 903 are connected to each other through a bus, and further connected to other components of the computing device.

[0175] This embodiment further provides a computer-readable medium on which a computer program is stored. When the program is executed by a processor, the key retrieval method provided in this embodiment is implemented. To avoid repeated description, the specific steps of the key retrieval method are not repeated here.

[0176] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the invented method described above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some physical components or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0177] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0178] Those skilled in the art will understand that although some embodiments described herein include certain features included in other embodiments but not other features, the combination of features from different embodiments is meant to be within the scope of the present embodiment and to form different embodiments.

[0179] It is to be understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of the present application, but the present application is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and substance of the present application, and these modifications and improvements are also considered to be within the scope of protection of the present application.

Claims

1. A key retrieval method, characterized in that: Applied to an operator service server, the method includes: In response to a key retrieval request sent by the terminal, a key retrieval instruction is sent to the first user identity card, wherein the key retrieval request is a request sent by the terminal when the first user identity card is lost, the first user identity card has a first key and a first built-in key parameter for logging in to a preset client, and the key retrieval instruction is used to instruct the first user identity card to generate an identity authentication request; Upon receiving the identity verification request returned by the first user identity recognition card, sending an information acquisition request to the terminal; Receiving a first terminal key parameter and a preset destination address returned by the terminal; Perform identity authentication with the first user identity identification card according to the first terminal key parameter and the destination address, wherein the identity authentication with the first user identity identification card according to the first terminal key parameter and the destination address includes encrypting the destination address using the first terminal key parameter to obtain a first encryption result; sending the first encryption result to the first user identity identification card so that the first user identity identification card can obtain an identity authentication result according to the first encryption result and a second encryption result, the second encryption result being a result obtained by the first user identity identification card encrypting the destination address according to the first built-in key parameter; receiving the identity authentication result returned by the first user identity identification card; and determining whether the identity authentication is passed according to the identity authentication result; If the identity authentication is passed, a verification pass message is sent to the operator security server so that the operator security server receives the second key and the first terminal key parameter sent by the terminal, decrypts the second key according to the first terminal key parameter to obtain the first key, configures the second user identity identification card according to the first key and the second key parameter sent by the terminal, and enables the terminal to log in to the preset client through the second user identity identification card, the second key is a key generated by the first user identity identification card using the first built-in key parameter to encrypt the first key and send it to the destination address, and the second key is obtained by the terminal from the destination address.

2. The key retrieval method according to claim 1, characterized in that: The destination address is a designated address built into the first user identity card, or the destination address is a temporary address provided by the terminal; In a case where the destination address is a temporary address provided by the terminal, after receiving the first terminal key parameter and the preset destination address returned by the terminal, the method further includes: The destination address is sent to the first user identity card.

3. A key retrieval method, characterized in that: Applied to an operator security server, the method comprises: In response to a verification pass message sent by the operator service server, obtaining a second key and a first terminal key parameter provided by the terminal; The verification pass message is a message sent by the operator service server when the identity authentication of the first user identity identification card is passed, the first user identity identification card has a built-in first key and a first built-in key parameter for logging into a preset client, the first terminal key parameter and the first built-in key parameter are used for identity authentication with a preset destination address, and the second key is a key generated by encrypting the first key by the first user identity identification card using the first built-in key parameter and sent to the destination address; Decrypting the second key according to the first terminal key parameter to obtain the first key; When the second key parameter provided by the terminal is obtained, a second user identity card is configured according to the first key and the second key parameter, so that the terminal can log in to the preset client through the second user identity card.

4. A key retrieval method, characterized in that: Applied to a first user identity card, the first user identity card having a first key and a first built-in key parameter for logging into a preset client, the method comprises: Receiving a key retrieval instruction sent by an operator service server, wherein the key retrieval instruction is an instruction sent by the operator service server in response to a key retrieval request of a terminal; Sending an identity authentication request to the operator service server; Use a preset destination address and a first built-in key parameter built into the first user identity identification card to authenticate the operator service server, wherein the use of the preset destination address and the first built-in key parameter built into the first user identity identification card to authenticate the operator service server includes receiving a first encryption result sent by the operator service server, the first encryption result being a result obtained by the operator service server encrypting the destination address provided by the terminal using a first terminal key parameter provided by the terminal; encrypting the destination address according to the first built-in key parameter to obtain a second encryption result; obtaining an identity authentication result according to the first encryption result and the second encryption result; and sending the identity authentication result to the operator service server; When the operator service server passes the identity authentication, encrypt the first key using the first built-in key parameter to obtain a second key; The second key is sent to the destination address so that the terminal can obtain the second key from the destination address, and the second key and the first terminal key parameter are provided to the operator security server, so that the operator security server decrypts the second key according to the first terminal key parameter to obtain the first key, and configures the second user identity identification card based on the first key and the second key parameter provided by the terminal, so that the terminal can log in to the preset client through the second user identity identification card.

5. The key retrieval method according to claim 4, characterized in that: The destination address is a designated address built into the first user identity card, or the destination address is a temporary address provided by the terminal and forwarded by the operator service server.

6. An operator service server, characterized in that: include: a first sending module, configured to respond to a key retrieval request sent by a terminal and send a key retrieval instruction to a first user identity card, wherein the key retrieval request is a request sent by the terminal when the first user identity card is lost, the first user identity card has a first key and a first built-in key parameter for logging into a preset client, and the key retrieval instruction is used to instruct the first user identity card to generate an identity authentication request; A second sending module is used to send an information acquisition request to the terminal when receiving the identity authentication request returned by the first user identity recognition card; A first receiving module, used for receiving a first terminal key parameter and a preset destination address returned by the terminal; A first verification module is used to perform identity authentication with the first user identity identification card according to the first terminal key parameter and the destination address, wherein the identity authentication with the first user identity identification card according to the first terminal key parameter and the destination address includes encrypting the destination address using the first terminal key parameter to obtain a first encryption result; sending the first encryption result to the first user identity identification card so that the first user identity identification card can obtain an identity authentication result according to the first encryption result and a second encryption result, the second encryption result being a result obtained by the first user identity identification card encrypting the destination address according to the first built-in key parameter; receiving the identity authentication result returned by the first user identity identification card; and determining whether the identity authentication is passed according to the identity authentication result; The third sending module is used to send a verification pass message to the operator security server when the identity authentication is passed, so that the operator security server receives the second key and the first terminal key parameter sent by the terminal, decrypts the second key according to the first terminal key parameter to obtain the first key, and configures the second user identity identification card according to the first key and the second key parameter sent by the terminal, so that the terminal logs in to the preset client through the second user identity identification card, the second key is the key generated by the first user identity identification card using the first built-in key parameter to encrypt the first key and send it to the destination address, and the second key is obtained by the terminal from the destination address.

7. An operator security server, characterized in that: include: An acquisition module, configured to acquire a second key and a first terminal key parameter provided by the terminal in response to a verification pass message sent by the operator service server; The verification pass message is a message sent by the operator service server when the identity authentication of the first user identity identification card is passed, the first user identity identification card has a built-in first key and a first built-in key parameter for logging into a preset client, the first terminal key parameter and the first built-in key parameter are used for identity authentication with a preset destination address, and the second key is a key generated by encrypting the first key by the first user identity identification card using the first built-in key parameter and sent to the destination address; a decryption module, configured to decrypt the second key according to the first terminal key parameter to obtain the first key; The configuration module is used to configure a second user identity card according to the first key and the second key parameter when receiving the second key parameter sent by the terminal, so that the terminal can log in to the preset client through the second user identity card.

8. A user identification card, characterized in that: Applied to a first user identity card, the first user identity card has a first key and a first built-in key parameter for logging into a preset client, and the user identity card includes: A second receiving module, configured to receive a key retrieval instruction sent by an operator service server, wherein the key retrieval instruction is an instruction sent by the operator service server in response to a key retrieval request of a terminal; A fourth sending module, used to send an identity authentication request to the operator service server; A second verification module is used to authenticate the operator service server using a preset destination address and a first built-in key parameter built into the first user identity identification card, wherein the authentication of the operator service server using the preset destination address and the first built-in key parameter built into the first user identity identification card includes receiving a first encryption result sent by the operator service server, the first encryption result being a result obtained by the operator service server encrypting the destination address provided by the terminal using the first terminal key parameter provided by the terminal; encrypting the destination address according to the first built-in key parameter to obtain a second encryption result; obtaining an identity authentication result according to the first encryption result and the second encryption result; and sending the identity authentication result to the operator service server; an encryption module, configured to encrypt the first key using the first built-in key parameter to obtain a second key when the operator service server passes identity authentication; The fifth sending module is used to send the second key to the destination address so that the terminal can obtain the second key from the destination address, and provide the second key and the first terminal key parameter to the operator security server, so that the operator security server decrypts the second key according to the first terminal key parameter to obtain the first key, and configures the second user identity identification card based on the first key and the second key parameter provided by the terminal, so that the terminal can log in to the preset client through the second user identity identification card.

Images