Signature method, related device and storage medium

Abstract

This application discloses a signature method, related equipment, and storage medium. The method includes: a service platform acquiring first data; determining a first certificate and encrypting the first data using the public key of the first certificate; sending a signature request to a SIM card; the signature request carrying at least the encrypted first data and a first identifier of the first certificate; the SIM card receiving the signature request; determining the first certificate using the first identifier and decrypting the encrypted first data using the private key of the first certificate; determining a second certificate, signing the decrypted first data using the private key of the second certificate, and returning a signature result to the service platform; the signature result carrying at least the signed first data; and the first certificate and the second certificate being different. The service platform receiving the signature result; determining the second certificate corresponding to the first data; and verifying the signature result using the second certificate. The scheme provided in this application improves the security of the signature by using different certificates to encrypt and sign data.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a signature method, related equipment, and storage medium. Background Technology

[0002] For businesses such as banking, e-commerce, and e-government, Public Key Infrastructure (PKI) technology is typically used to provide security services such as identity authentication, authorization, and digital signatures.

[0003] Among related technologies, mobile signature technology based on SIM cards has been implemented by combining PKI technology and SIM cards. Specifically, using the SIM card as the digital certificate carrier and combining it with PKI technology, a shield-level digital signature service is provided. However, this process is prone to problems such as digital signature forgery and data leakage, meaning that the security of the digital signature service is insufficient. Summary of the Invention

[0004] To address the related technical issues, embodiments of this application provide a signature method, related equipment, and storage medium.

[0005] The technical solution of this application embodiment is implemented as follows:

[0006] This application provides a signature method applied to a SIM card, including:

[0007] The system receives a signature request sent by the business platform; the signature request carries at least encrypted first data and a first identifier; the signature request is used to request a signature on the first data.

[0008] Using the first identifier, the first certificate is determined, and the private key of the first certificate is used to decrypt the encrypted first data;

[0009] A second certificate is determined, and the decrypted first data is signed using the private key of the second certificate. The signature result is then returned to the business platform. The signature result carries at least the signed first data. The signature result is used for verification by the business platform. The first certificate is different from the second certificate.

[0010] In the above method, the signature request also carries a second identifier and an application identifier; determining the second certificate includes:

[0011] Search the local database for at least two certificates corresponding to the application identifier;

[0012] Identify the second certificate corresponding to the second identifier from at least two certificates found.

[0013] In the above method, the signature request also carries an application identifier; determining the second certificate includes:

[0014] Using the application identifier, search for at least two corresponding certificates in the local database;

[0015] Based on the first strategy, the second certificate is determined from at least two certificates found.

[0016] In the above method, determining the second certificate from at least two found certificates according to the first strategy includes:

[0017] Based on the priority information corresponding to the at least two certificates found, the second certificate is determined from the at least two certificates found;

[0018] or,

[0019] The second certificate is determined from at least two certificates found using a random algorithm;

[0020] or,

[0021] Specify the second certificate from at least two certificates found.

[0022] In the above method, the signature request also carries an application identifier corresponding to the first data; determining the first certificate using the first identifier includes:

[0023] Search the local database for at least two certificates corresponding to the application identifier;

[0024] Identify the first certificate corresponding to the first identifier from at least two certificates found.

[0025] This application provides a signature method applied to a business platform, including:

[0026] Get the first data;

[0027] Identify the first certificate and use the public key of the first certificate to encrypt the first data;

[0028] A signature request is sent to the SIM card; the signature request carries at least encrypted first data and a first identifier of the first certificate; the signature request is used to request a signature of the first data;

[0029] Receive the signature result sent by the SIM card; the signature result carries at least the first data after signing;

[0030] The second certificate corresponding to the first data is determined, and the signature result is verified using the second certificate; the first certificate is different from the second certificate.

[0031] In the above method, when determining the first certificate, the method further includes:

[0032] According to the second strategy, the second certificate is determined in the local database;

[0033] The signature request also carries the application identifier corresponding to the first data and the second identifier of the second certificate.

[0034] In the above method, determining the second certificate in the local database according to the second strategy includes:

[0035] Based on the certificate priority information in the local database, the second certificate is determined from the local database;

[0036] or,

[0037] The second certificate is determined from the local database using a random algorithm;

[0038] or,

[0039] Specify the second certificate from the local database.

[0040] In the above method, the signature result also carries a second identifier; determining the second certificate corresponding to the first data and verifying the signature result using the second certificate includes:

[0041] Using the second identifier, the second certificate corresponding to the second identifier is determined in the local database;

[0042] The signature result is verified using the public key of the second certificate.

[0043] This application also provides a SIM card, including: a first processor and a first memory for storing a computer program capable of running on the processor.

[0044] Wherein, when the first processor is used to run the computer program, it executes the steps of any of the above-described methods on the SIM card side.

[0045] This application also provides a business platform, characterized in that it includes: a second processor and a second memory for storing computer programs capable of running on the processor.

[0046] Wherein, the second processor is used to execute the steps of any of the above-mentioned methods on the business platform side when running the computer program.

[0047] This application embodiment also provides a storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of any of the methods on the SIM card side or the steps of any of the methods on the service platform side.

[0048] The signature method, related devices, and storage medium provided in this application embodiment involve a service platform obtaining first data, determining a first certificate, and encrypting the first data using the public key of the first certificate; sending a signature request to the SIM card; the signature request carrying at least the encrypted first data and a first identifier of the first certificate; the signature request being used to request the signing of the first data; after receiving the signature request sent by the service platform, the SIM card using the first identifier to determine the first certificate, and decrypting the encrypted first data using the private key of the first certificate; determining a second certificate, signing the decrypted first data using the private key of the second certificate, and returning a signature result to the service platform; the signature result carrying at least the signed first data; the signature result being used for verification by the service platform; the first certificate being different from the second certificate; the service platform receiving the signature result sent by the SIM card; determining the second certificate corresponding to the first data, and verifying the signature result using the second certificate. The technical solution provided in this application embodiment involves the service platform and the SIM card using different certificates to encrypt and sign the data to be signed. By signing data with different certificates, the possibility of signature forgery due to certificate cracking is reduced, and the possibility of the data to be signed being stolen is also avoided, thus improving the security of the signature. Attached Figure Description

[0049] Figure 1 This is a flowchart illustrating a signature method in related technologies;

[0050] Figure 2 This is a schematic flowchart of the first signature method according to an embodiment of this application;

[0051] Figure 3 This is a schematic diagram of the certificate storage structure in the SIM card local database according to an embodiment of this application;

[0052] Figure 4 This is a schematic flowchart of the second signature method according to an embodiment of this application;

[0053] Figure 5 This is a schematic flowchart of the third signature method according to an embodiment of this application;

[0054] Figure 6 This is a schematic diagram of the structure of a SIM card used in an application embodiment of this application;

[0055] Figure 7This is a schematic flowchart of the first signature method in the application embodiment of this application;

[0056] Figure 8 This is a schematic flowchart illustrating the second signature method in an application embodiment of this application;

[0057] Figure 9 This is a schematic diagram of the structure of the first signature device according to an embodiment of this application;

[0058] Figure 10 This is a schematic diagram of the second type of signature device structure according to an embodiment of this application;

[0059] Figure 11 This is a schematic diagram of the SIM card structure according to an embodiment of this application;

[0060] Figure 12 This is a schematic diagram of the business platform structure in an embodiment of this application;

[0061] Figure 13 This is a schematic diagram of the signature system structure according to an embodiment of this application. Detailed Implementation

[0062] The present application will now be described in further detail with reference to the accompanying drawings and embodiments.

[0063] Before providing a further detailed description of this application, the nouns and terms used in the embodiments of this application will be explained, and the nouns and terms used in the embodiments of this application shall be interpreted as follows.

[0064] (1) Data SMS: A type of binary SMS, consisting of protocol messages, security messages and application messages.

[0065] (2) SIM Shield Platform: Server-side, used to interact with SIM cards via data SMS, and also used to interact with business platforms via application programming interface (API).

[0066] (3) Business Platform: The business platform is the platform that uses the SIM Shield service, such as the bank's back office.

[0067] (4) SIM Card Application Tool Kit (STK): STK contains a series of interaction instructions between the terminal and the SIM card.

[0068] In related technologies, SIM card-based mobile signatures all adopt a single-certificate model, that is, using a key pair contained in a certificate to encrypt and sign business data; a SIM card-based mobile signature system includes a business platform, a SIM shield platform, and a SIM card. Specifically, such as... Figure 1 As shown, the SIM card-based mobile signature process includes the following steps:

[0069] Step 101: After obtaining the data to be signed, the business platform encrypts the data to be signed using the public key of the signing certificate and sends a signature authentication request to the SIM Shield platform.

[0070] Step 102: After receiving the signature authentication request, the SIM Shield platform returns a signature authentication receipt response to the business platform;

[0071] Step 103: The SIM Shield platform processes the signature authentication request and sends a signature instruction to the SIM card via SMS.

[0072] The signature instruction carries at least the encrypted data to be signed;

[0073] Step 104: After receiving the signature instruction, the SIM card displays the application name and application provider information carried in the signature instruction on the user terminal through the STK command;

[0074] Step 105: The SIM card receives the signature password entered by the user through the terminal. When the signature password is successfully verified, it obtains the encrypted data to be signed carried by the signature instruction and decrypts the encrypted data to be signed using the private key of the signature certificate. The SIM card signs the decrypted data to be signed using the signature rules and the private key of the signature certificate.

[0075] Step 106: The SIM card uploads the signature result to the SIM Shield platform;

[0076] The signature result shall at least carry the signed data to be signed;

[0077] Step 107: After processing the received signature result, the SIM Shield platform sends the signature authentication result to the business platform;

[0078] Step 108: After receiving the signature authentication result, the business platform returns a signature authentication result reception response to the SIM Shield platform. At the same time, it uses the public key of the signature certificate to verify the signed data to be signed carried in the signature authentication result.

[0079] In this process, since only one certificate is used, that is, a key pair, to encrypt and sign business data, the certificate is easily cracked, which can lead to signature forgery and leakage of business data, that is, there is a problem of low signature security.

[0080] Based on this, in various embodiments of this application, when signing data, the business platform and the SIM card use different certificates to encrypt and sign the data, realizing the separation of encryption certificate and signing certificate, i.e., dual certificate signing mode, which reduces the possibility of the signature being cracked, thereby improving the security of the signature.

[0081] This application provides a signature method applied to a SIM card, such as... Figure 2 As shown, it includes the following steps:

[0082] Step 201: Receive a signature request sent by the business platform; the signature request carries at least encrypted first data and a first identifier; the signature request is used to request a signature on the first data;

[0083] Step 202: Using the first identifier, determine the first certificate, and use the private key of the first certificate to decrypt the encrypted first data;

[0084] Step 203: Determine the second certificate, sign the decrypted first data using the private key of the second certificate, and return the signature result to the business platform; the signature result carries at least the signed first data; the signature result is used for verification by the business platform; the first certificate is different from the second certificate.

[0085] In practical applications, before step 201, after the SIM card receives the application identifier assigned by the SIM Shield platform, it can allocate storage space for the application corresponding to each application identifier, apply for a corresponding certificate for each application, and store it in the corresponding storage space; the applied certificate can be used for encryption or signing; each certificate contains a public key, a private key, and a Certificate Authority (CA) identifier; each application stores at least two certificates.

[0086] For example, the SIM card can generate a public-private key pair for application A based on the certificate application command sent by the user. Then, it sends the generated public key to the SIM Shield platform via SMS. Upon receiving the public key, the SIM Shield platform combines the public key with user-related information and sends the combined information to the SIM card. The SIM card signs the combined information using the generated private key and sends the signed information to the SIM Shield platform, enabling the platform to request a certificate from a Certificate Authority (CA) via Hypertext Transfer Protocol (HTTP). After the certificate application is completed, the SIM Shield platform receives the application certificate from the CA and sends it to the SIM card. Simultaneously, the SIM Shield platform also sends the application certificate to the business platform via API. After receiving the application certificate from the SIM Shield platform, the SIM card combines the application certificate with its private key to form certificate 'a', which is then stored in the storage space corresponding to application A. Figure 3 As shown, the SIM card allocates different storage spaces for application A and application B; application A corresponds to at least certificate a and certificate b; application B corresponds to at least certificate c and certificate d.

[0087] The SIM card can use a key pair generation algorithm to generate public and private key pairs, such as the RSA algorithm or the SM2 algorithm.

[0088] In practical applications, the SIM card can receive signature requests sent by the service platform through the SIM Shield platform. Specifically, after receiving the signature request from the service platform via API, the SIM Shield platform can process the signature request and then send the processed signature request to the SIM card via SMS. For example, after receiving the signature request via API, the SIM Shield platform can encode the signature request into a hexadecimal encoded string according to a preset format, and then send the encoded signature request to the SIM card via SMS.

[0089] Here, the SIM card can also send the signature result to the service platform through the SIM Shield platform. Specifically, after receiving the signature result sent by the SIM card via SMS, the SIM Shield platform processes the signature result and sends it to the service platform via API. Specifically, after receiving the signature result sent by the SIM card as a hexadecimal encoded string, the SIM Shield platform can decode it and then send the decoded signature result to the service platform via API.

[0090] Since the SIM card interacts with the service platform via SMS and through the SIM Shield platform, the certificate stored in the SIM card's local database can be protected, preventing the certificate from being stolen and the signature from being forged, thereby improving the security of the signature.

[0091] In step 202, in practical applications, when the SIM card uses the private key of the first certificate to decrypt the encrypted first data, it can use algorithms such as RSA and SM2 for decryption.

[0092] In step 203, in practical applications, when the SIM card uses the private key of the second certificate to sign the decrypted first data, it can use signature algorithms such as SHA1withRSA, SHA256withRSA, and SM3withSM2 to sign it.

[0093] In practical applications, the business platform can select an encryption certificate (i.e., the first certificate) and a signing certificate (i.e., the second certificate). By selecting the signing certificate from multiple certificates in the business platform's local database, the signing certificate is prevented from being easily stolen, thereby reducing the possibility of signature cracking and improving signature security. In this case, the business platform can return the certificate identification information to the SIM card so that the SIM card can find the corresponding certificate in the local database.

[0094] Based on this, in one embodiment, the signature request further carries a second identifier and an application identifier; determining the second certificate includes:

[0095] Search the local database for at least two certificates corresponding to the application identifier;

[0096] Identify the second certificate corresponding to the second identifier from at least two certificates found.

[0097] Here, after the business platform selects the first certificate and the second certificate, it sends the application identifier and the second identifier to the SIM card through a signature request. Accordingly, after receiving the signature request carrying the second identifier and the application identifier, the SIM card can first use the application identifier to look up the corresponding storage space and at least two certificates corresponding to the storage space in the local database, and then use the second identifier to determine the second certificate corresponding to the second identifier, i.e., the signature certificate, from the at least two certificates found.

[0098] In practical applications, the business platform can select the encryption certificate, and the SIM card can select a second certificate for signing. By having the SIM card select a signing certificate from multiple certificates in a local database, the possibility of signature forgery due to certificate theft is reduced, thus improving signature security.

[0099] Based on this, in one embodiment, the signature request also carries an application identifier; determining the second certificate includes:

[0100] Using the application identifier, search for at least two corresponding certificates in the local database;

[0101] Based on the first strategy, the second certificate is determined from at least two certificates found.

[0102] Here, when a second certificate is selected for signing via a SIM card, the signature request returned by the service platform needs to carry the application identifier corresponding to the first data, so that the SIM can find at least two certificates corresponding to the application through the application identifier, and then select the second certificate from at least two certificates corresponding to the application according to the first strategy.

[0103] In practical applications, the SIM card can select a second certificate from the local database in different ways.

[0104] In one embodiment, determining the second certificate from at least two found certificates according to the first strategy includes:

[0105] Based on the priority information corresponding to the at least two certificates found, the second certificate is determined from the at least two certificates found;

[0106] or,

[0107] The second certificate is determined from at least two certificates found using a random algorithm;

[0108] or,

[0109] Specify the second certificate from at least two certificates found.

[0110] In practical applications, when a SIM card applies for a certificate from a CA (Certificate Authority) through the SIM Shield platform, the priorities of the issued certificates differ due to the existence of different CAs; the certificate contains the CA's identifier. Specifically, for different types of services, the SIM Shield platform can determine different CAs based on the service's security level, allowing the SIM card to apply for a certificate from the corresponding CA through the SIM Shield platform. Different services may correspond to different CAs with different security levels, thus the priorities of the issued certificates may also differ. Furthermore, when a user sends a certificate application command to the SIM Shield platform through a service platform, they can specify a CA, sending the CA's identifier to the SIM Shield platform via the certificate application command, enabling the SIM card to apply for a certificate from the specified CA through the SIM Shield platform. Since users can specify different CAs for certificate applications as needed, the priorities of certificates issued by different CAs may differ. In other words, the SIM card can determine the priority information of at least two found certificates based on the correspondence between the CA's identifier and priority information.

[0111] The correspondence between CA institution identifiers and priority information can be preset as needed.

[0112] Here, when the SIM card finds at least two certificates, it can determine the second certificate based on their corresponding priority information. For example, the SIM card can select the certificate with the highest priority as the second certificate.

[0113] Here, when there are at least two certificates with the same priority information, a random algorithm can be used to select one of the at least two certificates with the same priority information as the second certificate; alternatively, based on the certificate's attributes, such as validity period, subject information, etc., one can select one of the at least two certificates with the same priority information as the second certificate; alternatively, based on the certificate's algorithm type, such as Chinese cryptographic standards, RSA2048, RSA1024, one can select one of the at least two certificates with the same priority information as the second certificate. This application embodiment does not limit this.

[0114] In practical applications, the SIM card can also randomly select one certificate from at least two found certificates as the second certificate using a random algorithm, such as the Linear Congruential Generator (LCG).

[0115] In practical applications, the SIM card can also be pre-set with a certificate identifier, and then the certificate corresponding to the pre-set certificate identifier can be used as a second certificate; wherein, the certificate identifier can be set as needed.

[0116] In practical applications, the SIM card needs to decrypt the encrypted initial data before signing it. Upon receiving a signature request, it also needs to obtain the application identifier corresponding to the initial data through the signature request so that the SIM card can find the corresponding private key in its local database and then perform decryption.

[0117] Based on this, in one embodiment, the signature request further carries an application identifier corresponding to the first data; the step of determining the first certificate using the first identifier includes:

[0118] Search the local database for at least two certificates corresponding to the application identifier;

[0119] Identify the first certificate corresponding to the first identifier from at least two certificates found.

[0120] In practical applications, when a SIM card receives a signature request, the request carries at least encrypted first data, a first identifier, and an application identifier corresponding to the first data. The SIM card can then locate at least two certificates corresponding to the application identifier, and determine the first certificate corresponding to the first identifier from among these two certificates. In this way, the private key can be extracted from the first certificate to decrypt the encrypted first data, allowing the SIM card to sign the decrypted first data using the private key of the second certificate.

[0121] Accordingly, embodiments of this application also provide a signature method, applied to a business platform, such as... Figure 4 As shown, it includes the following steps:

[0122] Step 401: Obtain the first data;

[0123] Step 402: Determine the first certificate and use the public key of the first certificate to encrypt the first data;

[0124] Step 403: Send a signature request to the SIM card; the signature request carries at least encrypted first data and a first identifier of the first certificate; the signature request is used to request a signature of the first data;

[0125] Step 404: Receive the signature result sent by the SIM card; the signature result carries at least the first data after signing;

[0126] Step 405: Determine the second certificate corresponding to the first data, and use the second certificate to verify the signature result; the first certificate and the second certificate are different.

[0127] Here, the business platform can obtain the first data by receiving data sent by the terminal, or by reading data from a local database. This application embodiment does not limit the method by which the business platform obtains the first data.

[0128] In practical applications, before step 401, after the service platform receives the application identifier assigned by the SIM platform, it can allocate storage space for each application corresponding to the application identifier to store the certificate corresponding to the application; wherein, each application stores at least two certificates; the certificate contains a public key and a CA authority identifier; the certificate includes an encryption certificate (i.e., the first certificate) and a signature certificate (i.e., the second certificate).

[0129] Here, the certificates stored by the business platform do not contain the corresponding private keys.

[0130] In practical applications, the business platform can interact with the SIM card through the SIM Shield platform. Specifically, the business platform sends a signature request to the SIM Shield platform via API, enabling the SIM Shield platform to process the signature request and send it to the SIM card via SMS.

[0131] Here, the business platform can also receive the signature result sent by the SIM card through the SIM Shield platform. Specifically, the SIM Shield platform receives the signature result sent by the SIM card, processes the signature result, and then sends it to the business platform via API.

[0132] In practical applications, in step 405, after the business platform determines the second certificate corresponding to the first data, it can extract the public key of the second certificate. Using the public key and the signature result, it determines whether the signature verification is successful based on the signature verification algorithm. The signature result includes at least the signed first data. The signature verification algorithm can include RSA and SM2 algorithms. Specifically, during the process of the SIM card signing the first data using the private key of the second certificate, the first data is actually encrypted using the private key of the second certificate. Correspondingly, the business platform can decrypt the signed first data using the public key of the second certificate, and then match the decrypted first data with the first data. When the decrypted first data matches the first data, the signature verification is considered successful.

[0133] In practical applications, the business platform can select the first certificate to encrypt the first data, and can also select the second certificate for the SIM card to use for signing.

[0134] In one embodiment, when determining the first certificate, the method further includes:

[0135] According to the second strategy, the second certificate is determined in the local database;

[0136] The signature request also carries the application identifier corresponding to the first data and the second identifier of the second certificate.

[0137] The second strategy can be the same as the first strategy, or it can be different from the first strategy.

[0138] In practical applications, when the business platform selects the second certificate according to the second strategy and sends a signature request to the SIM card, the signature request also carries the application identifier corresponding to the first data and the second identifier of the second certificate. In this way, the SIM card can find the first certificate and the second certificate in the corresponding local database, and can then use the first certificate to decrypt the encrypted first data, and use the second certificate to sign the decrypted first certificate.

[0139] In practical applications, business platforms can use different methods to select a second certificate from the local database.

[0140] In one embodiment, determining the second certificate in the local database according to the second strategy includes:

[0141] Based on the certificate priority information in the local database, the second certificate is determined from the local database;

[0142] or,

[0143] The second certificate is determined from the local database using a random algorithm;

[0144] or,

[0145] Specify the second certificate from the local database.

[0146] In practical applications, due to the existence of different Certificate Authorities (CAs), the priorities of certificates stored on the business platform also differ; each certificate contains the CA's identifier. Specifically, for different types of services, the SIM Shield platform can determine different CAs based on the service's security level, allowing the SIM card to apply for certificates from the corresponding CA through the SIM Shield platform. Different services may correspond to different CAs with different security levels; therefore, the priorities of the issued certificates may also differ, and consequently, the priorities of the certificates stored on the business platform will also differ. Furthermore, when a user sends a certificate application command to the SIM Shield platform through the business platform, they can specify the CA, sending the CA's identifier to the SIM Shield platform via the certificate application command, enabling the SIM card to apply for certificates from the specified CA through the SIM Shield platform. Since users can specify different CAs for certificate applications as needed, the priorities of certificates issued by different CAs may differ, and consequently, the priorities of certificates stored on the business platform will also differ. In other words, the business platform can determine the certificate priority information in its local database based on the correspondence between the CA's identifier and priority information.

[0147] The correspondence between the CA institution's identifier and priority information can be preset as needed.

[0148] Here, when the business platform determines the second certificate in its local database, it can do so based on the corresponding priority information. For example, the business platform can select the certificate with the highest priority as the second certificate.

[0149] Here, when there are at least two certificates with the same priority, a random algorithm can be used to select one of the at least two certificates with the same priority information as the second certificate; alternatively, based on the certificate's attributes, such as validity period and subject information, one can select one of the at least two certificates with the same priority information as the second certificate; alternatively, based on the certificate's algorithm type, such as Chinese cryptographic standards, RSA2048, or RSA1024, one can select one of the at least two certificates with the same priority information as the second certificate. This application embodiment does not limit this.

[0150] In practical applications, the business platform can also randomly select a certificate from the local database as a second certificate using a random algorithm, such as the Linear Congruential Generator (LCG).

[0151] In practical applications, the business platform can also pre-set a certificate identifier, and then use the certificate corresponding to the pre-set certificate identifier as a second certificate; wherein, in practical applications, the certificate identifier can be set as needed.

[0152] In practical applications, the first certificate can be selected through the business platform, and the second certificate can be selected through the SIM card. In this case, the business platform also needs to obtain the identifier corresponding to the second certificate through the signature result in order to verify the signature result.

[0153] Based on this, in one embodiment, the signature result further carries a second identifier; determining the second certificate corresponding to the first data and verifying the signature result using the second certificate includes:

[0154] Using the second identifier, the second certificate corresponding to the second identifier is determined in the local database;

[0155] The signature result is verified using the public key of the second certificate.

[0156] In practical applications, once the SIM card identifies the second certificate, it uses the private key of the second certificate to sign the decrypted first data. This involves encrypting the decrypted first data using the private key of the second certificate and returning a signature result; the signature result also carries an application identifier. After receiving the signature result, the service platform can find at least two certificates corresponding to the application identifier in its local database, and then identify the second certificate corresponding to the second identifier from among the found at least two certificates. The service platform can then extract the public key of the second certificate, combine it with a signature verification algorithm to decrypt the signed first data, and match the decrypted first data with the first data. The signature verification algorithm includes RSA and SM2 algorithms. If the decrypted first data matches the first data, the verification is considered successful; otherwise, the verification is considered unsuccessful.

[0157] This application also provides a signature method, such as... Figure 5 As shown, it includes the following steps:

[0158] Step 501: The business platform obtains the first data;

[0159] Step 502: The business platform determines the first certificate and uses the public key of the first certificate to encrypt the first data;

[0160] Step 503: The service platform sends a signature request to the SIM card;

[0161] The signature request carries at least encrypted first data and a first identifier of the first certificate; the signature request is used to request a signature on the first data.

[0162] Step 504: The SIM card uses the first identifier to determine the first certificate, and uses the private key of the first certificate to decrypt the encrypted first data;

[0163] Step 505: The SIM card determines the second certificate and uses the private key of the second certificate to sign the decrypted first data;

[0164] Step 506: The SIM card returns the signature result to the service platform;

[0165] The signature result carries at least the first data after signing; the signature result is used for verification by the business platform; the first certificate is different from the second certificate.

[0166] Step 507: The business platform determines the second certificate corresponding to the first data and uses the second certificate to verify the signature result.

[0167] It should be noted that the specific processing procedures for the business platform and SIM card have been detailed above and will not be repeated here.

[0168] The signature method provided in this application embodiment involves a service platform acquiring first data, determining a first certificate, and encrypting the first data using the public key of the first certificate; sending a signature request to the SIM card; the signature request carrying at least the encrypted first data and a first identifier of the first certificate; the signature request being used to request the signing of the first data; after receiving the signature request from the service platform, the SIM card using the first identifier to determine the first certificate, and decrypting the encrypted first data using the private key of the first certificate; determining a second certificate, signing the decrypted first data using the private key of the second certificate, and returning a signature result to the service platform; the signature result carrying at least the signed first data; the signature result being used for verification by the service platform; the first certificate being different from the second certificate; the service platform receiving the signature result sent by the SIM card; determining the second certificate corresponding to the first data, and verifying the signature result using the second certificate. The technical solution provided in this application embodiment uses different certificates for encrypting and signing the data to be signed by the service platform and the SIM card, respectively. Signing data with different certificates reduces the possibility of signature forgery due to certificate cracking, and also avoids the possibility of the data to be signed being stolen, thus improving signature security.

[0169] The present application will be further described in detail below with reference to application examples.

[0170] The signature system framework of this application embodiment includes a service platform, a SIM shield platform, and a SIM card; wherein, as shown in the example... Figure 6 As shown, a SIM card can specifically include:

[0171] The communication module is used to communicate with the SIM Shield platform via data SMS.

[0172] The computation module is used to generate public-private key pairs, perform encryption and decryption processes, perform signature processing, and interact with the communication module and certificate storage module.

[0173] The certificate storage module is used to store the certificates corresponding to the applications.

[0174] This application example demonstrates the process by which the business platform selects an encryption certificate and a signing certificate for signing, such as... Figure 7 As shown, it includes the following steps:

[0175] Step 701: The business platform selects an encryption certificate (i.e., the first certificate) and encrypts the data to be signed (i.e., the first data);

[0176] Here, since the local database stores at least two certificates that have been applied for with a CA authority, the business platform can select an encryption certificate from the local database based on the certificate priority information, a random algorithm, or a specified method.

[0177] Then, the business platform can extract the public key of the encryption certificate and use it to encrypt the data to be signed.

[0178] Step 702: The business platform selects a signing certificate (i.e., a second certificate);

[0179] In practical applications, after selecting an encryption certificate, the business platform can choose another certificate from its local database as the signing certificate. Specifically, the business platform can select the signing certificate based on certificate priority information, a random algorithm, or a specified method.

[0180] Step 703: The service platform sends a signature request to the SIM Shield platform;

[0181] The signature request includes encrypted data to be signed, an encryption certificate identifier (i.e., a first identifier), a signature certificate identifier (i.e., a second identifier), and an application identifier; the application identifier is determined based on the data to be signed.

[0182] In practical applications, the business platform can send a signature request to the SIM Shield platform via API.

[0183] Step 704: The SIM Shield platform encodes the signature request;

[0184] In practical applications, since the SIM Shield platform sends instructions to the SIM card via SMS, after receiving the signature request, it needs to encode the signature request into a hexadecimal encoded string, which is the signature instruction.

[0185] Step 705: The SIM Shield platform sends a signature command to the SIM card;

[0186] The signature instruction includes encrypted data to be signed, an encryption certificate identifier, a signature certificate identifier, and an application identifier.

[0187] Here, the SIM Shield platform sends a signature command to the SIM card's communication module via SMS.

[0188] Step 706: The SIM card retrieves the encryption certificate and decrypts the data to be signed;

[0189] Here, after the SIM card's communication module receives the signature instruction, it sends it to the calculation module. The calculation module can find at least two certificates corresponding to the application identifier in the certificate storage module, and then determine the encryption certificate corresponding to the encryption certificate identifier from the at least two certificates.

[0190] Then, the computing module can extract the private key from the encryption certificate and decrypt the encrypted data to be signed.

[0191] Step 707: The SIM card retrieves the signature certificate and performs a signature;

[0192] In practical applications, the computing module can also find at least two certificates corresponding to the application identifier in the certificate storage module, and then determine the signature certificate corresponding to the signature certificate identifier from the at least two certificates.

[0193] Then, the processing module extracts the private key from the signing certificate and signs the decrypted data to be signed.

[0194] Step 708: The SIM card returns a signature result instruction to the SIM Shield platform;

[0195] The signature result instruction includes an application identifier and the data to be signed after signing.

[0196] Here, the SIM card's communication module can send the signature result to the SIM Shield platform via SMS.

[0197] Step 709: The SIM Shield platform returns the signature result to the service platform;

[0198] In practical applications, the SIM Shield platform decodes the signature result instruction and returns the signature result to the business platform via API.

[0199] Step 710: The business platform verifies the signature result;

[0200] Here, the business platform extracts the public key of the selected signing certificate and then uses it to decrypt the signed data. Next, the business platform matches the decrypted data with the original data. If the match is successful, the verification is complete; otherwise, the verification fails.

[0201] In this application example, the service platform selects an encryption certificate, and the SIM card selects a signing certificate for signing, as follows: Figure 8 As shown, it includes the following steps:

[0202] Step 801: The business platform selects an encryption certificate (i.e., the first certificate) to encrypt the data to be signed (i.e., the first data);

[0203] Here, since the local database stores at least two certificates that have been applied for with a CA authority, the business platform can select an encryption certificate from the local database based on the certificate priority information, a random algorithm, or a specified method.

[0204] Then, the business platform can extract the public key of the encryption certificate and use it to encrypt the data to be signed.

[0205] Step 802: The service platform sends a signature request to the SIM Shield platform;

[0206] The signature request includes encrypted data to be signed, an encrypted certificate identifier (i.e., a first identifier), and an application identifier; the application identifier is determined based on the data to be signed.

[0207] In practical applications, the business platform can send a signature request to the SIM Shield platform via API.

[0208] Step 803: The SIM Shield platform encodes the signature request;

[0209] In practical applications, since the SIM Shield platform sends instructions to the SIM card via SMS, after receiving the signature request, it needs to encode the signature request into a hexadecimal encoded string, which is the signature instruction.

[0210] Step 804: The SIM Shield platform sends a signature command to the SIM card;

[0211] The signature instruction includes encrypted data to be signed, an encrypted certificate identifier, and an application identifier.

[0212] Here, the SIM Shield platform sends a signature command to the SIM card's communication module via SMS.

[0213] Step 805: The SIM card retrieves the encryption certificate and decrypts the data to be signed;

[0214] Here, after the SIM card's communication module receives the signature instruction, it sends it to the calculation module. The calculation module can find at least two certificates corresponding to the application identifier in the certificate storage module, and then determine the encryption certificate corresponding to the encryption certificate identifier from the at least two certificates.

[0215] Then, the computing module can extract the private key from the encryption certificate and decrypt the encrypted data to be signed.

[0216] Step 806: Select a signature certificate for the SIM card;

[0217] In practical applications, the SIM card's processing module can find at least two certificates corresponding to the application identifier from the certificate storage module, and then select a signing certificate from the found at least two certificates. For example, the SIM card's processing module can select a signing certificate based on certificate priority information, a random algorithm, or a specified method.

[0218] Step 807: Sign the SIM card.

[0219] After selecting a signature certificate, the SIM card's processing module can extract the private key of the signature certificate and sign the encrypted data to be signed.

[0220] Step 808: The SIM card returns a signature result instruction to the SIM Shield platform;

[0221] The signature result instruction includes an application identifier, a signature certificate identifier, and the data to be signed after signing.

[0222] Here, the SIM card's communication module can send the signature result to the SIM Shield platform via SMS.

[0223] Step 809: The SIM Shield platform returns the signature result to the service platform;

[0224] In practical applications, the SIM Shield platform decodes the signature result instruction and returns the signature result to the business platform via API.

[0225] Step 810: The business platform retrieves the signature certificate;

[0226] Here, the business platform can search for at least two certificates corresponding to the application identifier in the local database, and then determine the signature certificate corresponding to the signature certificate identifier from the at least two certificates; the signature certificate contains a public key.

[0227] Step 811: The business platform verifies the signature result;

[0228] Here, the business platform extracts the public key of the signature certificate from the determined signature certificate, and then uses the public key to decrypt the signed data to be signed. Next, the business platform matches the decrypted data to be signed with the original data to be signed. If the match is successful, the verification is passed; if the match fails, the verification is unsuccessful.

[0229] In this application embodiment, the SIM card is configured with a separate storage space for each application. Each application can apply for multiple certificates and store them in the SIM card. In this way, for the data to be signed, a dual-certificate signing mode can be implemented during signing. That is, the business platform and the SIM card can select different certificates from the multiple certificates corresponding to the application to encrypt and sign the data to be signed, thereby reducing the risk of certificate being cracked and signature being forged, and ensuring the security of the signature.

[0230] Furthermore, the use of different encryption and signing certificates, with the private key of the encryption certificate stored on the SIM card, makes the encrypted data to be signed difficult to crack. This is because the encrypted data to be signed can only be decrypted using the private key of the encryption certificate. Since the private key of the encryption certificate is stored on the SIM card, it is difficult to steal, thus making the encrypted data to be signed difficult to crack. Additionally, the SIM card interacts with the business platform through the SIM Shield platform, further ensuring that the certificate stored on the SIM card cannot be stolen. Typically, the data to be signed is highly sensitive; this helps protect sensitive data from leakage.

[0231] To implement the SIM card-side method of this application embodiment, this application embodiment also provides a signature device disposed on the SIM card, such as... Figure 9 As shown, the device includes:

[0232] The first receiving unit 901 is used to receive a signature request sent by the business platform; the signature request carries at least encrypted first data and a first identifier; the signature request is used to request a signature on the first data;

[0233] The first processing unit 902 uses the first identifier to determine a first certificate and uses the private key of the first certificate to decrypt the encrypted first data; it also determines a second certificate and uses the private key of the second certificate to sign the decrypted first data; the first certificate and the second certificate are different.

[0234] The first sending unit 903 is used to return a signature result to the service platform; the signature result carries at least the first data after signing; the signature result is used for verification by the service platform.

[0235] Here, the functions of the first receiving unit 901 and the first sending unit 903 are equivalent to the functions of the communication module in the application embodiment; the function of the first processing unit 902 is equivalent to the function of the computing module in the application embodiment.

[0236] In one embodiment, the first processing unit 902 is configured to:

[0237] Search the local database for at least two certificates corresponding to the application identifier;

[0238] Identify the second certificate corresponding to the second identifier from at least two certificates found.

[0239] Here, the function of the local database is equivalent to the function of the certificate storage module in the application embodiment.

[0240] In one embodiment, the first processing unit 902 is configured to:

[0241] Using the application identifier, search for at least two corresponding certificates in the local database;

[0242] Based on the first strategy, the second certificate is determined from at least two certificates found.

[0243] In one embodiment, the first processing unit 902 is configured to:

[0244] Based on the priority information corresponding to the at least two certificates found, the second certificate is determined from the at least two certificates found;

[0245] or,

[0246] The second certificate is determined from at least two certificates found using a random algorithm;

[0247] or,

[0248] Specify the second certificate from at least two certificates found.

[0249] In one embodiment, the first processing unit 902 is configured to:

[0250] Search the local database for at least two certificates corresponding to the application identifier;

[0251] Identify the first certificate corresponding to the first identifier from at least two certificates found.

[0252] In practical applications, the first receiving unit 901 and the first sending unit 902 can be implemented by the communication interface in the signature device; the first processing unit 902 can be implemented by the processor in the signature device.

[0253] To implement the method on the business platform side of this application embodiment, this application embodiment also provides a signature device, which is set on the business platform, such as... Figure 10 As shown, the device includes:

[0254] The second receiving unit 1001 is used to acquire first data; receive the signature result sent by the SIM card; the signature result carries at least the first data after signing;

[0255] The second processing unit 1002 is used to determine the first certificate and encrypt the first data using the public key of the first certificate;

[0256] The second sending unit 1003 is used to send a signature request to the SIM card; the signature request carries at least encrypted first data and a first identifier of the first certificate; the signature request is used to request a signature of the first data.

[0257] Verification unit 1004 is used to determine the second certificate corresponding to the first data and to verify the signature result using the second certificate; the first certificate is different from the second certificate.

[0258] In one embodiment, the second processing unit 1002 is configured to:

[0259] According to the second strategy, the second certificate is determined in the local database;

[0260] The signature request also carries the application identifier corresponding to the first data and the second identifier of the second certificate.

[0261] In one embodiment, the second processing unit 1002 is configured to:

[0262] Based on the certificate priority information in the local database, the second certificate is determined from the local database;

[0263] or,

[0264] The second certificate is determined from the local database using a random algorithm;

[0265] or,

[0266] Specify the second certificate from the local database.

[0267] In one embodiment, the verification unit 1004 is configured to:

[0268] Using the second identifier, the second certificate corresponding to the second identifier is determined in the local database;

[0269] The signature result is verified using the public key of the second certificate.

[0270] In practical applications, the second sending unit 1003 can be implemented by the communication interface in the signature device; the second processing unit 1002 and the verification unit 1004 can be implemented by the processor in the signature device; the second acquisition unit 1001 can be implemented by the processor in the signature device in combination with the communication interface.

[0271] It should be noted that the signature device provided in the above embodiments is only illustrated by the division of the above-described program units. In practical applications, the above processing can be assigned to different program units as needed, that is, the internal structure of the device can be divided into different program units to complete all or part of the processing described above. In addition, the signature device and signature method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.

[0272] Based on the hardware implementation of the above program modules, and in order to implement the SIM card-side method of the embodiments of this application, the embodiments of this application also provide a SIM card, such as... Figure 11 As shown, the SIM card 1100 includes:

[0273] The first communication interface 1101 is capable of exchanging information with the business platform;

[0274] The first processor 1102 is connected to the first communication interface 1101 to enable information interaction with the service platform. When running a computer program, it executes the methods provided by one or more technical solutions on the SIM card side. The computer program is stored on the first memory 1103.

[0275] Specifically, the first communication interface 1101 is used to receive a signature request sent by the business platform; the signature request carries at least encrypted first data and a first identifier; the signature request is used to request the first data to be signed; a signature result is returned to the business platform; the signature result carries at least the signed first data; the signature result is used for verification by the business platform;

[0276] The first processor 1102 is configured to use the first identifier to determine a first certificate and use the private key of the first certificate to decrypt the encrypted first data; determine a second certificate and use the private key of the second certificate to sign the decrypted first data; the first certificate is different from the second certificate.

[0277] In one embodiment, the first processor 1102 is configured to search for at least two certificates corresponding to the application identifier in a local database; and to determine a second certificate corresponding to the second identifier from the at least two certificates found.

[0278] In one embodiment, the first processor 1102 is configured to use the application identifier to search for at least two corresponding certificates in a local database; and determine a second certificate from the at least two certificates found according to a first strategy.

[0279] In one embodiment, the first processor 1102 is configured to determine the second certificate from the at least two certificates found based on priority information corresponding to the at least two certificates found; or, determine the second certificate from the at least two certificates found using a random algorithm; or, specify the second certificate from the at least two certificates found.

[0280] In one embodiment, the first processor 1102 is configured to search for at least two certificates corresponding to the application identifier in a local database; and determine the first certificate corresponding to the first identifier from the at least two certificates found.

[0281] It should be noted that the specific processing procedures of the first processor 1102 and the first communication interface 1101 can be understood by referring to the above method.

[0282] Of course, in practical applications, the various components in the SIM card are coupled together through the bus system 1104. It can be understood that the bus system 1104 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 1104 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, in... Figure 11 The general designated all buses as Bus System 1104.

[0283] The first memory 1103 in this embodiment is used to store various types of data to support the operation of the SIM card 1100. Examples of such data include any computer program used to operate on the SIM card 1100.

[0284] The methods disclosed in the above embodiments of this application can be applied to the first processor 1102, or implemented by the first processor 1102. The first processor 1102 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware or by instructions in the form of software in the first processor 1102. The first processor 1102 may be a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The first processor 1102 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in the first memory 1103. The first processor 1102 reads the information in the first memory 1103 and completes the steps of the aforementioned method in combination with its hardware.

[0285] In an exemplary embodiment, the SIM card 1100 may be implemented by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to perform the aforementioned method.

[0286] Based on the hardware implementation of the above program modules, and in order to implement the method on the business platform side of the embodiments of this application, the embodiments of this application also provide a business platform, such as... Figure 12 As shown, the business platform 1200 includes:

[0287] The second communication interface 1201 is capable of exchanging information with the SIM card;

[0288] The second processor 1202 is connected to the second communication interface 1201 to enable information interaction with the SIM card. When running a computer program, it executes the methods provided by one or more technical solutions on the aforementioned business platform side. The computer program is stored on the second memory 1203.

[0289] Specifically, the second communication interface 1201 is used to acquire first data; send a signature request to the SIM card; the signature request carries at least the encrypted first data and the first identifier of the first certificate; the signature request is used to request a signature on the first data; receive a signature result sent by the SIM card; the signature result carries at least the signed first data;

[0290] The second processor 1202 is configured to determine a first certificate and encrypt the first data using the public key of the first certificate; determine a second certificate corresponding to the first data and verify the signature result using the second certificate; the first certificate and the second certificate are different.

[0291] In one embodiment, the second processor 1202 is used to determine the second certificate in a local database according to a second strategy; the signature request also carries the application identifier corresponding to the first data and the second identifier of the second certificate.

[0292] In one embodiment, the second processor 1202 is configured to determine the second certificate from the local database based on the certificate priority information in the local database; or, determine the second certificate from the local database using a random algorithm; or, specify the second certificate from the local database.

[0293] In one embodiment, the second processor 1202 is configured to use the second identifier to determine the second certificate corresponding to the second identifier in a local database; and to use the public key of the second certificate to verify the signature result.

[0294] It should be noted that the specific processing procedures of the second processor 1202 and the second communication interface 1201 can be understood by referring to the above method.

[0295] Of course, in practical applications, the various components in the business platform are coupled together through the bus system 1204. It can be understood that the bus system 1204 is used to implement communication between these components. In addition to the data bus, the bus system 1204 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 12 The general designated all buses as Bus System 1204.

[0296] The second memory 1203 in this embodiment is used to store various types of data to support the operation of the service platform 1200. Examples of such data include any computer program used to operate on the service platform 1200.

[0297] The methods disclosed in the embodiments of this application can be applied to the second processor 1202, or implemented by the second processor 1202. The second processor 1202 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware or by instructions in the form of software in the second processor 1202. The second processor 1202 may be a general-purpose processor, a DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The second processor 1202 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in the second memory 1203. The second processor 1202 reads the information in the second memory 1203 and completes the steps of the aforementioned method in combination with its hardware.

[0298] In an exemplary embodiment, the service platform 1200 may be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general-purpose processors, controllers, MCUs, microprocessors, or other electronic components to perform the aforementioned methods.

[0299] To implement the method provided in the embodiments of this application, the embodiments of this application also provide a signature system, such as... Figure 13 As shown, the system includes: SIM card 1301 and service platform 1302.

[0300] It should be noted that the specific processing procedures of the SIM card 1301 and the service platform 1302 have been described in detail above and will not be repeated here.

[0301] In an exemplary embodiment, this application also provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, such as a first memory 1103 storing a computer program, which can be executed by the first processor 1102 of the SIM card 1100 to complete the steps described in the aforementioned SIM card-side method; or a second memory 1203 storing a computer program, which can be executed by the second processor 1202 of the service platform 1200 to complete the steps described in the aforementioned service platform-side method. Computer-readable storage media can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disc, or compact disc read-only memory (CD-ROM); magnetic surface memory can be disk storage or magnetic tape storage.

[0302] It should be noted that terms such as "first" and "second" are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0303] Furthermore, the technical solutions described in the embodiments of this application can be combined arbitrarily without conflict.

[0304] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A signature method, characterized in that, Applied to the SIM card for the User Identification Module, including: The system receives a signature request sent by the business platform; the signature request carries at least encrypted first data and a first identifier; the signature request is used to request a signature on the first data. Using the first identifier, a first certificate is determined, and the private key of the first certificate is used to decrypt the encrypted first data; the first certificate is selected by the business platform. A second certificate is determined, and the decrypted first data is signed using the private key of the second certificate. The signature result is then returned to the business platform. The signature result carries at least the signed first data. The signature result is used for verification by the business platform. The first certificate is different from the second certificate. The second certificate is selected by the business platform or the SIM card.

2. The method according to claim 1, characterized in that, The signature request also carries a second identifier and an application identifier; The determination of the second certificate includes: Search the local database for at least two certificates corresponding to the application identifier; Identify the second certificate corresponding to the second identifier from at least two certificates found.

3. The method according to claim 1, characterized in that, The signature request also carries an application identifier; determining the second certificate includes: Using the application identifier, search for at least two corresponding certificates in the local database; Based on the first strategy, the second certificate is determined from at least two certificates found.

4. The method according to claim 3, characterized in that, The step of determining the second certificate from at least two certificates found according to the first strategy includes: Based on the priority information corresponding to the at least two certificates found, the second certificate is determined from the at least two certificates found; or, The second certificate is determined from at least two certificates found using a random algorithm; or, Specify the second certificate from at least two certificates found.

5. The method according to any one of claims 1 to 4, characterized in that, The signature request also carries an application identifier corresponding to the first data; the step of using the first identifier to determine the first certificate includes: Search the local database for at least two certificates corresponding to the application identifier; Identify the first certificate corresponding to the first identifier from at least two certificates found.

6. A signature method, characterized in that, Applied to business platforms, including: Get the first data; A first certificate is identified, and the first data is encrypted using the public key of the first certificate; the first certificate is selected by the business platform. A signature request is sent to the SIM card; the signature request carries at least encrypted first data and a first identifier of the first certificate; the signature request is used to request a signature of the first data; Receive the signature result sent by the SIM card; the signature result carries at least the first data after signing; The second certificate corresponding to the first data is determined, and the signature result is verified using the second certificate; the first certificate is different from the second certificate; the second certificate is selected by the business platform or SIM card.

7. The method according to claim 6, characterized in that, When determining the first certificate, the method further includes: According to the second strategy, the second certificate is determined in the local database; The signature request also carries the application identifier corresponding to the first data and the second identifier of the second certificate.

8. The method according to claim 7, characterized in that, The step of determining the second certificate in the local database according to the second strategy includes: Based on the certificate priority information in the local database, the second certificate is determined from the local database; or, The second certificate is determined from the local database using a random algorithm; or, Specify the second certificate from the local database.

9. The method according to claim 6, characterized in that, The signature result also carries a second identifier; determining the second certificate corresponding to the first data and verifying the signature result using the second certificate includes: Using the second identifier, the second certificate corresponding to the second identifier is determined in the local database; The signature result is verified using the public key of the second certificate.

10. A SIM card, characterized in that, include: A first processor and a first memory for storing computer programs capable of running on the processor. Wherein, when the first processor is used to run the computer program, it performs the steps of the method according to any one of claims 1 to 5.

11. A business platform, characterized in that, include: A second processor and a second memory for storing computer programs that can run on the processor. Wherein, when the second processor is used to run the computer program, it performs the steps of the method according to any one of claims 6 to 9.

12. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5, or the steps of the method according to any one of claims 6 to 9.

Images