Terminal device, server end and authentication system

Abstract

The application embodiment provides a terminal device, a server and an authentication system, wherein the terminal device comprises an interaction module, a first SIM card, a second SIM card, a first communication module, a client security authentication module and a controller; the client security authentication module is used for encrypting information to be sent by the terminal device and sending the encrypted information through the first communication module, and decrypting interaction information received by the first communication module. The application encrypts the VSIM interaction information in real time by using the actual physical module, improves the security of user service communication, and prevents theft. The client security authentication module is uniquely bound with the terminal device and cannot be mixed, so that the client security authentication module cannot be used by others again by using other devices, and the security of transmission data is affected.

Description

Technical Field

[0001] This invention belongs to the field of communication technology, and in particular relates to a terminal device, a server, and an authentication system. Background Technology

[0002] In the VSIM architecture of related technologies, the VSIM device activates the physical SIM card and successfully registers it on the network, establishing a data channel for the physical SIM card. The VSIM device uses this data channel to obtain a cloud card or virtual card allocated by the server. After obtaining the cloud card or virtual card, it initiates a registration authentication request to the card pool and receives authentication response data. It then performs dual-card communication based on the physical SIM card and the cloud card. That is, after establishing a connection between the client and the server, it directly receives plaintext VSIM / ESIM information data sent by the server. The above method is easily exploited by hackers through software vulnerabilities, causing serious losses to user information and property.

[0003] Alternatively, software algorithms can be used to encrypt or decrypt VSIM / ESIM information. For example, registration information is sent via an eSIM device, and the server processes the eSIM device's registration to obtain the registration information.

[0004] The corresponding LPASDK is generated using a compilation tool based on the registration information. The SDK includes LPAID and authentication value.

[0005] The eSIM device obtains its LPAID and authentication value, and transmits the LPAID and authentication value to the LPA management platform through the eSIM platform to request LPA identity authentication;

[0006] The LPA management platform uses the LPAID and authentication value from the eSIM device and the LPAID and authentication value from the SDK (Software Development Kit) to perform LPA (Local Profile Assistant) authentication to generate an authentication result, which is then returned to the eSIM platform. This method only uses software algorithms to protect the eSIM information; the entire interaction process still uses plaintext communication, which is detrimental to information security.

[0007] Based on the above, this application is hereby submitted. Summary of the Invention

[0008] This application adds a client-side security authentication module, which, in conjunction with the interaction module, avoids security vulnerabilities caused by software by actually using a physical security authentication module, compared to the software algorithm used to protect VSIM information in related technologies. Furthermore, the client-side security authentication module is bound one-to-one with the terminal device, greatly increasing communication security.

[0009] According to an embodiment of this application, a terminal device is proposed, comprising:

[0010] The interaction module is used to receive user input commands, output corresponding command request information, and display information corresponding to the received electrical signals;

[0011] The first SIM card was configured as a physical SIM.

[0012] The second SIM card is configured as a programmable SIM.

[0013] The first communication module is used for communication between the terminal device and the server;

[0014] The client security authentication module is electrically connected to the first communication module. The client security authentication module is used to encrypt the information to be sent by the terminal device and then send it through the first communication module, and to decrypt the interactive information received by the first communication module, so as to at least enable the second SIM card to establish a data connection with the server.

[0015] The controller is configured to initialize the client security authentication module after the control terminal device is powered on, and to uniquely match and bind the client security authentication module with the terminal device.

[0016] After the first SIM card establishes a data connection with the server, the terminal device is configured to VSIM mode;

[0017] The first communication module sends a request to the server to obtain VSIM information;

[0018] The client security authentication module is used to decrypt the VSIM information received from the server;

[0019] After receiving the registration request from the interactive module, it uses the VSIM information to search for and register on the network.

[0020] Upon receiving an authentication request from the server, the client security authentication module decrypts the request and then sends an authentication request response back to the server.

[0021] Once the VSIM server receives the authentication request response from the first communication module and completes network registration, the data connection between the second SIM card and the server is successfully established.

[0022] According to embodiments of this application, the client security authentication module can also be used to establish a data connection between the first SIM card and the server;

[0023] The controller is configured to send a two-way authentication message to the server through the first communication module after receiving the authentication password input by the interaction module.

[0024] After the terminal device establishes two-way authentication with the server, the control interaction module reads the information of the first SIM card and sends a physical card registration command to the server through the first communication module.

[0025] Upon receiving a registration request response from the server that has been decrypted by the client security authentication module, the client initiates an authentication request to the server and establishes a connection through the first communication module.

[0026] According to an embodiment of this application, after establishing a data connection, the information is encrypted by the client security authentication module and sent to the server. After receiving a reply from the server, the information is decrypted to verify that the data connection is successful.

[0027] According to an embodiment of this application, the client security authentication module includes:

[0028] The protocol processing unit is electrically connected to the first communication module to send encrypted information to the first communication module and to receive encrypted information from the first communication module; the protocol processing unit is also electrically connected to the interaction module to perform data transmission with the interaction module.

[0029] The service processing unit is electrically connected to the protocol processing unit. The service processing unit is used to encrypt the information to be sent and to decrypt the information received.

[0030] The main control unit is used to configure and initialize the service processing unit, receive data from the service processing unit, and analyze whether to perform encryption control or decryption control.

[0031] According to an embodiment of this application, the steps for uniquely matching and binding the client security authentication module with the terminal device are as follows:

[0032] After the terminal device is powered on, the main control unit configures and initializes the service processing unit;

[0033] After the interaction module receives the authentication password, the main control unit sends the device information to the protocol processing unit;

[0034] The protocol processing unit receives the device information, adds a frame header and a first flag bit to form the first information, and sends it to the service processing unit.

[0035] The business processing unit receives the first information and forwards it to the main control unit;

[0036] The main control unit generates a unique public-private key pair based on the first information and configures the business processing unit;

[0037] The business processing unit activates the cryptographic engine and sends an electrical signal to the main control unit to inform the main control unit that the cryptographic engine has been successfully activated.

[0038] The main control unit adds a second flag bit to the received electrical signal to construct a reply frame and sends it to the service processing unit;

[0039] The business processing unit forwards the reply frame to the protocol processing unit according to the second flag bit added by the main control unit. The protocol processing unit then sends the reply frame to the interaction module to show that the client security authentication module has been successfully bound to the terminal device.

[0040] According to an embodiment of this application, the controller is configured as follows:

[0041] After receiving the authentication password input by the interaction module, the interaction module sends the authentication password to the protocol processing unit.

[0042] The protocol processing unit adds a frame header and a first flag bit to the authentication password to form the second information and forwards it to the service processing unit;

[0043] The service processing unit forwards the data to the main control unit in plaintext according to the flag bits;

[0044] The main control unit adds an encryption flag to the second information to construct an encrypted password frame and sends it to the business processing unit;

[0045] The business processing unit sends the encrypted password frame to the protocol processing unit;

[0046] The protocol processing unit sends the received encrypted password frame to the server through the first communication module;

[0047] The first communication module receives the response data from the server and sends it to the protocol processing unit;

[0048] The protocol processing unit adds a frame header and a first flag bit to the reply data to form third information and forwards it to the service processing unit;

[0049] The business processing unit sends the third information to the main control unit based on the first flag bit;

[0050] The main control unit adds a decryption flag to construct a decryption password frame and sends it to the business processing unit.

[0051] The business processing unit decrypts the reply data according to the decryption flag and sends it to the protocol processing unit;

[0052] The protocol processing unit sends the decrypted response data to the interaction module to indicate that authentication was successful.

[0053] According to an embodiment of this application, the controller is configured as follows:

[0054] The interaction module obtains the physical card registration information of the first SIM card and sends the physical card registration command to the protocol processing unit;

[0055] The protocol processing unit adds a frame header and a first flag bit to the physical card registration command to form the fourth information and forwards it to the service processing unit;

[0056] The business processing unit forwards the fourth information in plaintext to the main control unit based on the flag bit;

[0057] The main control unit adds an encryption flag to the fourth information to construct the first encrypted command frame and sends it to the service processing unit;

[0058] The business processing unit encrypts the first encrypted command frame according to the encryption flag and sends it to the protocol processing unit.

[0059] The business processing unit sends the received first encrypted command frame to the server through the first communication module;

[0060] The first communication module receives the registration command response data from the server and sends it to the protocol processing unit;

[0061] The protocol processing unit adds a frame header and a first flag bit to the registration command reply data to form the fifth information and forwards it to the service processing unit;

[0062] The business processing unit sends the fifth piece of information to the main control unit according to the protocol processing flag.

[0063] The main control unit adds a decryption flag to construct the first decryption command frame and sends it to the service processing unit;

[0064] The business processing unit decrypts the registration command response data according to the decryption flag and sends it to the protocol processing unit;

[0065] The protocol processing unit sends the decrypted registration command response data to the interaction module to indicate that the registration was successful.

[0066] According to an embodiment of this application, the controller is configured as follows:

[0067] The controller parses and loads the VSIM information, and sends a network search and registration command encrypted by the client security authentication module through the first communication module based on the VSIM information;

[0068] Receive the authentication request password from the server, decrypt it using the client security authentication module, and send the decrypted authentication request password to the interaction module;

[0069] The authentication request response is sent to the protocol processing unit through the interaction module;

[0070] The protocol processing unit adds a frame header and a first flag bit to the authentication request response request to form the twelfth information and forwards it to the service processing unit;

[0071] The business processing unit forwards the twelfth message in plaintext to the main control unit based on the flag bit;

[0072] The main control unit adds an encryption flag to the twelfth piece of information to construct an authentication request response frame and sends it to the service processing unit;

[0073] The business processing unit encrypts the authentication request response frame according to the encryption flag and sends it to the protocol processing unit;

[0074] The business processing unit sends the received authentication request response frame to the server through the first communication module;

[0075] After completing the network registration of the second SIM card, the terminal device establishes a network connection with the server.

[0076] According to an embodiment of this application, a server is proposed, comprising:

[0077] The server-side security authentication module is used to encrypt information sent by the server and then send it through the communication module, or to decrypt interactive information received by the communication module.

[0078] The VSIM remote management platform is configured to initialize the server-side security authentication module and uniquely match and bind the server-side security authentication module with the server.

[0079] The server establishes a data connection with the first SIM card of the terminal device;

[0080] Receives VSIM information requests decrypted by the server-side security authentication module, and encrypts the VSIM information using the server-side security authentication module before sending it to the terminal device;

[0081] It receives the Sohu registration request decrypted by the server-side security authentication module, and then encrypts the authentication request using the server-side security authentication module before sending it to the terminal device.

[0082] Receive the authentication request response decrypted by the server's security authentication mode;

[0083] Once online registration is complete, a network connection is established between the server and the terminal device.

[0084] According to an embodiment of this application, an authentication system is proposed, including the terminal device and server described above. Attached Figure Description

[0085] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0086] Figure 1 This is a hardware configuration block diagram of a terminal device according to an embodiment of the present disclosure;

[0087] Figure 2 This is a hardware configuration block diagram of a client security authentication module according to an embodiment of the present disclosure;

[0088] Figure 3 This is a signaling interaction diagram of data transmission by a terminal device according to an embodiment of the present disclosure;

[0089] Figure 4 This is a signaling interaction diagram of two-way authentication according to the embodiments of this disclosure;

[0090] Figure 5 This is a signaling interaction diagram showing the unique binding between the client security authentication module and the terminal device according to the embodiments of this disclosure;

[0091] Figure 6 This is a signaling interaction diagram within the client security authentication module during the authentication process according to the embodiments of this disclosure;

[0092] Figure 7 This is a signaling interaction diagram during the registration process of the first SIM card according to an embodiment of this disclosure;

[0093] Figure 8 This is a signaling interaction diagram in the network access authentication process of the second SIM card according to the embodiments of this disclosure;

[0094] Figure 9 This is a signaling interaction diagram for obtaining VSIM information according to an embodiment of this disclosure;

[0095] Figure 10 This is a signaling interaction diagram between the terminal device and the server during the authentication process according to the embodiments of this disclosure;

[0096] Figure 11 This is a hardware configuration diagram of the controller according to the embodiments of this disclosure;

[0097] Figure 12 This is a hardware configuration diagram of the server according to the embodiments of this disclosure;

[0098] Figure 13 This is a hardware configuration diagram of the authentication system according to the embodiments of this disclosure;

[0099] In the above figures:

[0100] Interaction Module 1; Protocol Processing Unit 21; Service Processing Unit 22; Main Control Unit 23;

[0101] First communication module 5; Client security authentication module 2; Server security authentication module 3;

[0102] VSIM remote management platform 4; terminal devices 100; servers 200;

[0103] Authentication system 300; First SIM card 7; Second SIM card 8;

[0104] Controller 8; Processor 105; Communication interface 106; Memory 107; Bus 108. Detailed Implementation

[0105] The present invention will now be described in detail through exemplary embodiments. However, it should be understood that, without further description, elements, structures, and features in one embodiment may be advantageously incorporated into other embodiments.

[0106] This application provides a terminal device 100, wherein, in this application, the terminal device 100 is defined as a device having a VSIM card and a physical SIM card.

[0107] It is known that a VSIM (Virtual SIM) card is a virtual SIM card, a data file that can be downloaded to a mobile terminal via the network. eSIM can also be considered a type of VSIM.

[0108] With a VSIM card, various terminals can connect to the Internet, make and receive calls, send text messages, etc., with no functional difference from a regular SIM card. Any device that can access a mobile network can use a VSIM card. The VSIM card's plug-and-play and pre-integrated-then-written-number characteristics bring convenience and efficiency to the mass production of IoT terminals.

[0109] In some embodiments, after a client establishes a connection with a server, the most common practice is to directly receive the plaintext data of vSIM / eSIM information sent by the server, or to use software algorithms to decrypt / authenticate the vSIM / eSIM data before obtaining the required information. However, the above methods are vulnerable to attacks by hackers through software vulnerabilities, resulting in serious losses of user information and property.

[0110] Once the terminal device 100 establishes a connection with the server 200, it can directly receive VSIM or ESIM plaintext information data sent by the server 200, or use software algorithms to decrypt or encrypt the VSIM or ESIM data information, and wait for authentication before obtaining the required information.

[0111] However, since VSIM cards are virtual cards, they are still vulnerable to attacks from outsiders through software vulnerabilities during data exchange, resulting in serious losses of user information and finances.

[0112] In some embodiments of this application, reference is made to Figure 1 The terminal device 100 includes an interaction module 1, a first SIM card 7, a second SIM card 8, a first communication module 5, a client security authentication module 2, and a controller 8.

[0113] The interaction module 1 is used to receive user input instructions, output corresponding instruction request information, and display the information corresponding to the received electrical signals, so as to realize the authentication, registration and other functions of the terminal device 100, so that users can understand the status of each node in the information interaction process, and can discover and solve problems in a timely manner when problems occur.

[0114] In some implementations, the interaction module 1 can be configured as a client or an app, which can receive user instructions, generate a new request message and send it to the corresponding module unit, and display the electrical signals received from other modules to inform the user of the working status of the corresponding node.

[0115] In the above embodiments, the first SIM card 7 is configured as a physical SIM card; the second SIM card 8 is configured as a programmable SIM, i.e., a VSIM card; and the first communication module 5 is used for communication between the terminal device 100 and the server 200.

[0116] The client security authentication module 2 is electrically connected to the first communication module 5. The client security authentication module 2 is used to encrypt the information to be sent by the terminal device 100 and then send it through the first communication module 5, and to decrypt the interactive information received by the first communication module 5, so as to at least enable the second SIM card 8 to establish a data connection with the server 200.

[0117] The controller 8 is configured to initialize the client security authentication module 2 after the terminal device 100 is powered on, and to uniquely match and bind the client security authentication module 2 with the terminal device 100.

[0118] After the first SIM card 7 establishes a data connection with the server 200, the terminal device 100 is configured to VSIM mode;

[0119] The first communication module 5 sends a request to the server 200 to obtain VSIM information;

[0120] The client security authentication module 2 is used to decrypt the VSIM information received from the server 200;

[0121] Upon receiving the registration request from interaction module 1, the network is searched and registered using VSIM information;

[0122] After receiving the authentication request from server 200, the client security authentication module 2 is used to decrypt the request, and then the authentication request response is encrypted by the client authentication module and sent to server 200.

[0123] Once the server 200 receives the authentication request response from the first communication module 5 and completes network registration, the data connection between the second SIM card 8 and the server 200 is successfully established.

[0124] With the above settings, during the process of establishing a data connection between the second SIM card 8 and the server 200, the client security authentication module 2 is used to encrypt the passwords or instructions sent by the terminal device 100 and decrypt the encrypted information received from the server 200, so as to ensure the security of data during the data establishment process and the subsequent data interaction process and prevent information leakage.

[0125] This solution encrypts and decrypts the network access authentication process information and vSIM information through the vSIM security authentication module. The module and the device are bound together. During each vSIM interaction, the client and server security authentication modules perform two-way authentication, generating public and private keys to encrypt the information sent by the communication module. At the same time, the module uses the generated public and private keys to decrypt the information received by the communication module.

[0126] In this application, the VSIM interaction information is encrypted in real time using an actual physical module, which improves the security of user business communication and prevents theft; at the same time, the VSIM card number resources are managed uniformly by the server-side security authentication module 3 and the VSIM remote management platform 4, which improves the security of network access management and permission management.

[0127] In some embodiments of this application, reference is made to Figure 4 The client security authentication module 2 can also be used to establish a data connection between the first SIM card 7 and the server 200;

[0128] The controller 8 is configured to send a two-way authentication message to the server 200 through the first communication module 5 after receiving the authentication password input by the interaction module 1.

[0129] After the terminal device 100 and the server 200 establish two-way authentication, the control interaction module 1 reads the information of the first SIM card 7 and sends a physical card registration command to the server 200 through the first communication module 5.

[0130] Upon receiving a registration request reply from server 200 that has been decrypted by client security authentication module 2, the system initiates an authentication request to server 200 and establishes a connection through the first communication module 5.

[0131] In the above scheme, data transmission during the bidirectional authentication, registration, and connection establishment process between the terminal device 100 and the server 200 is encrypted or decrypted using the client security authentication module 2 to protect the communication security of the first SIM card 7 during the connection establishment process.

[0132] In some embodiments of this application, reference is made to Figure 2 The client security authentication module 2 includes a protocol processing unit 21, a service processing unit 22, and a processing unit. The protocol processing unit 21 is electrically connected to the first communication module 5 to send encrypted information to the first communication module 5 and to receive encrypted information from the first communication module 5. The protocol processing unit 21 is also electrically connected to the interaction module 1 to transmit data with the interaction module 1.

[0133] The service processing unit 22 is electrically connected to the protocol processing unit 21. The service processing unit 22 is used to encrypt the information to be sent and decrypt the information to be received. The main control unit 23 is used to configure and initialize the service processing unit 22, receive data from the service processing unit 22 and analyze whether to perform encryption control or decryption control.

[0134] In the client security authentication module 2, the main control unit 23 is responsible for the entire control logic, the business processing unit 22 handles data encryption and decryption, and the protocol processing unit 21 handles complex protocol parsing and distribution.

[0135] Reference Figure 2 The main control unit 23 is responsible for configuring and initializing the service processing unit 22 in a secure manner, and for controlling the establishment and initialization of the security mechanism of the entire control system. It analyzes the data flowing from the service processing unit 22 into the main control unit 23 and determines whether to perform encryption or decryption control.

[0136] The business processing unit 22, namely the cryptographic FPGA, is mainly responsible for transparently encrypting data in this application.

[0137] In some embodiments, the service processing unit 22 is also responsible for functions such as service configuration and message forwarding, and provides a secure channel for data transmission between the main control unit 23 and the protocol processing unit 21.

[0138] In some embodiments of this application, after a data connection is established, the information is encrypted by the client security authentication module 2 and sent to the server 200. After receiving the reply information from the server 200, the information is decrypted to verify that the data connection is successful.

[0139] In some embodiments, refer to Figure 3 The method to verify whether the data connection is successful is as follows: initiate an authentication password through interaction module 1 and establish a data connection to send test information;

[0140] Protocol processing unit 21 adds a frame header and a first flag bit to the test information to form the sixth information and forwards it to service processing unit 22;

[0141] The business processing unit 22 forwards the sixth information in plaintext to the main control unit 23 according to the first flag bit;

[0142] The main control unit 23 adds an encryption flag to the sixth information to construct a second encrypted command frame and sends it to the service processing unit 22;

[0143] The service processing unit 22 encrypts the second encryption command frame according to the encryption flag and sends it to the protocol processing unit 21;

[0144] The service processing unit 22 sends the received second encrypted command frame to the server 200 through the first communication module;

[0145] The first communication module 5 receives the ACK response from the server 200 and sends it to the protocol processing unit 21;

[0146] Protocol processing unit 21 will add a frame header and a first flag bit to the reply ACK to form the seventh information and forward it to service processing unit 22;

[0147] The business processing unit 22 sends the seventh information to the main control unit 23 according to the first flag bit;

[0148] The main control unit 23 adds a decryption flag to construct a second decryption command frame and sends it to the service processing unit 22;

[0149] Service processing unit 22 decrypts the above-mentioned ACK reply according to the decryption flag and sends it to protocol processing unit 21;

[0150] Protocol processing unit 21 sends the decrypted ACK response to interaction module 1.

[0151] By sending test data to check whether the data was sent successfully and whether the data is normal, it is possible to determine whether the data connection was established correctly and whether the data transmission function is abnormal, thus providing a guarantee for subsequent data transmission.

[0152] In some embodiments of this application, reference is made to Figure 5 The steps for client security authentication module 2 to uniquely match and bind with terminal device 100 are as follows:

[0153] After the terminal device 100 is powered on, the main control unit 23 configures and initializes the service processing unit 22;

[0154] After receiving the authentication password, the main control unit 23 sends the device information to the protocol processing unit 21;

[0155] Protocol processing unit 21 receives device information, adds a frame header and a first flag bit to form first information, and sends it to service processing unit 22;

[0156] The service processing unit 22 receives the first information and forwards it to the main control unit 23;

[0157] The main control unit 23 generates a unique public-private key pair based on the first information and configures the business processing unit 22;

[0158] The business processing unit 22 activates the cryptographic engine and sends an electrical signal to the main control unit 23 to inform the main control unit 23 that the cryptographic engine has been successfully activated.

[0159] The main control unit 23 adds a second flag bit to the received electrical signal to construct a reply frame and sends it to the service processing unit 22;

[0160] The business processing unit 22 forwards the reply frame to the protocol processing unit 21 according to the second flag bit added by the main control unit 23. The protocol processing unit 21 sends the reply frame to the interaction module 1 to show that the client security authentication module 2 and the terminal device 100 are successfully bound.

[0161] Through the above, the client security authentication module 2 is uniquely bound to the terminal device 100, ensuring that the client security authentication module 2 will not be used with other devices during use, thus preventing others from operating the security authentication module using other devices and compromising communication security.

[0162] In this application, the network access authentication process interaction information and VSIM information are encrypted and decrypted through the client security authentication module 2. The client security authentication module 2 is bound to the terminal device 100. During each VSIM interaction, the client security authentication module 2 and the server security authentication module 3 perform bidirectional authentication and generate a public-private key pair to encrypt the information sent by the first communication module 5. At the same time, the client security authentication module uses the generated public-private key pair to decrypt the information received by the first communication module 5.

[0163] In some embodiments of this application, reference is made to Figure 6The controller 8 is configured such that when the interaction module 1 receives the authentication password input by the interaction module 1, the interaction module 1 sends the authentication password to the protocol processing unit 21.

[0164] Protocol processing unit 21 adds a frame header and a first flag bit to the authentication password to form second information and forwards it to service processing unit 22;

[0165] Service processing unit 22 forwards the data to main control unit 23 in plaintext according to the flag bit;

[0166] The main control unit 23 adds an encryption flag bit to the second information to construct an encrypted password frame and sends it to the service processing unit 22;

[0167] The business processing unit 22 sends the encrypted password frame to the protocol processing unit 21;

[0168] Protocol processing unit 21 sends the received encrypted password frame to server 200 through first communication module 5;

[0169] The first communication module 5 receives the reply data from the server 200 and sends it to the protocol processing unit 21;

[0170] Protocol processing unit 21 adds a frame header and a first flag bit to the reply data to form third information and forwards it to service processing unit 22;

[0171] The business processing unit 22 sends the third information to the main control unit 23 according to the first flag bit;

[0172] The main control unit 23 adds a decryption flag to construct a decryption password frame and sends it to the service processing unit 22;

[0173] The business processing unit 22 decrypts the reply data according to the decryption flag and sends it to the protocol processing unit 21;

[0174] The protocol processing unit 21 sends the decrypted reply data to the interaction module 1 to indicate that the authentication was successful.

[0175] In some embodiments of this application, the client security authentication module 2 is used to encrypt and decrypt the registration process of the first SIM card 7 to ensure the security of the authentication process of the first SIM card 7.

[0176] Reference Figure 7 The controller 8 is configured such that the interaction module 1 obtains the physical card registration information of the first SIM card 7 and sends a physical card registration command to the protocol processing unit 21;

[0177] Protocol processing unit 21 adds a frame header and a first flag bit to the physical card registration command to form the fourth information and forwards it to service processing unit 22;

[0178] The business processing unit 22 forwards the fourth information in plaintext to the main control unit 23 according to the flag bit;

[0179] The main control unit 23 adds an encryption flag to the fourth information to construct the first encrypted command frame and sends it to the service processing unit 22;

[0180] The service processing unit 22 encrypts the first encryption command frame according to the encryption flag and sends it to the protocol processing unit 21;

[0181] The service processing unit 22 sends the received first encrypted command frame to the server 200 through the first communication module;

[0182] The first communication module 5 receives the registration command reply data from the server 200 and sends it to the protocol processing unit 21;

[0183] Protocol processing unit 21 adds a frame header and a first flag bit to the registration command reply data to form the fifth information and forwards it to service processing unit 22;

[0184] The business processing unit 22 sends the fifth information to the main control unit 23 according to the protocol processing flag bit;

[0185] The main control unit 23 adds a decryption flag to construct the first decryption command frame and sends it to the service processing unit 22;

[0186] Business processing unit 22 decrypts the registration command reply data according to the decryption flag and sends it to protocol processing unit 21;

[0187] The protocol processing unit 21 sends the decrypted registration command reply data to the interaction module 1 to indicate that the registration was successful.

[0188] In some embodiments of this application, after the terminal device 100 obtains the VSIM information, it uses the client security authentication module 2 to encrypt or decrypt the information during the VSIM card's network access process to ensure the security of the VSIM card's network access process.

[0189] Reference Figure 8 The controller 8 is configured to: parse and load the VSIM information, and send a network search and registration command encrypted by the client security authentication module 2 through the first communication module 5 according to the VSIM information;

[0190] Receive the authentication request password from server 200, decrypt it using client security authentication module 2, and send the decrypted authentication request password to interaction module 1;

[0191] The authentication request response is sent to the protocol processing unit 21 through the interaction module 1.

[0192] Protocol processing unit 21 adds a frame header and a first flag bit to the authentication request response request to form the twelfth information and forwards it to service processing unit 22;

[0193] The business processing unit 22 forwards the twelfth message in plaintext to the main control unit 23 according to the flag bit;

[0194] The main control unit 23 adds an encryption flag to the twelfth information to construct an authentication request response frame and sends it to the service processing unit 22;

[0195] The service processing unit 22 encrypts the authentication request response frame according to the encryption flag and sends it to the protocol processing unit 21;

[0196] The service processing unit 22 sends the received authentication request response frame to the server 200 through the first communication module;

[0197] After completing the network registration of the second SIM card 8, the terminal device 100 establishes a network connection with the server 200.

[0198] In some embodiments of this application, reference is made to Figure 9 The steps for obtaining VSIM information are as follows: Terminal device 100 is configured in VSIM mode, and controller 8 is configured as follows:

[0199] The interaction module 1 sends a VSIM information request to the protocol processing unit 21 to obtain VSIM information;

[0200] Protocol processing unit 21 adds a frame header and flag bits to the VSIM information request to form the eighth information and forwards it to service processing unit 22;

[0201] The business processing unit 22 forwards the eighth information in plaintext to the main control unit 23 according to the flag bit;

[0202] The main control unit 23 adds an encryption flag to the eighth information to construct a third encrypted command frame and sends it to the service processing unit 22;

[0203] The service processing unit 22 encrypts the third encryption command frame according to the encryption flag and sends it to the protocol processing unit 21;

[0204] The service processing unit 22 will receive the third encrypted command frame (i.e. Figure 9 The VSIM information frame in the first communication module is sent to the server 200.

[0205] The first communication module 5 receives the VSIM information from the server 200 and sends it to the protocol processing unit 21;

[0206] Protocol processing unit 21 adds a frame header to the VSIM information to form the ninth information and forwards it to service processing unit 22;

[0207] The business processing unit 22 sends the seventh information to the main control unit 23;

[0208] The main control unit 23 adds a decryption flag to construct a third decryption command frame and sends it to the service processing unit 22;

[0209] Service processing unit 22 decrypts the VSIM information according to the decryption flag and sends it to protocol processing unit 21;

[0210] Protocol processing unit 21 sends the decrypted VSIM information to interaction module 1.

[0211] In some embodiments, refer to Figure 8 The controller 8 parses and loads the VSIM information, and sends the network search registration password to the protocol processing unit 21 according to the VSIM information;

[0212] Protocol processing unit 21 adds a frame header and flag bits to the search registration password request to form the tenth information and forwards it to business processing unit 22;

[0213] The business processing unit 22 forwards the tenth information in plaintext to the main control unit 23 according to the flag bit;

[0214] The main control unit 23 adds an encryption flag to the tenth information to construct a network search registration password frame and sends it to the business processing unit 22;

[0215] Business processing unit 22 encrypts the network registration password frame according to the encryption flag and sends it to protocol processing unit 21;

[0216] The business processing unit 22 sends the received network registration password frame to the server 200 through the first communication module;

[0217] The first communication module 5 receives the authentication request password from the server 200 and sends it to the protocol processing unit 21;

[0218] Protocol processing unit 21 adds a frame header to the authentication request password to form the eleventh message and forwards it to service processing unit 22;

[0219] The business processing unit 22 sends the eleventh message to the main control unit 23;

[0220] The main control unit 23 adds a decryption flag to construct an authentication request password frame and sends it to the service processing unit 22;

[0221] The business processing unit 22 decrypts the authentication request password frame according to the decryption flag and sends it to the protocol processing unit 21;

[0222] Protocol processing unit 21 sends the decrypted authentication request password to interaction module 1.

[0223] In the embodiments shown in this application, controller 8 refers to a device that can generate operation control information based on instruction opcodes and timing signals, and instruct terminal device 100 to execute control instructions. For example, in response to received authentication requests and registration requests, controller 8 can perform operations related to the object selected by the above instructions.

[0224] This application embodiment also provides a hardware structure diagram of the controller 8, referring to... Figure 11 The controller 8 includes a processor 105, and optionally, a memory 107 and a communication interface 106 connected to the processor 105. The processor 105, memory 107, and communication interface 106 are connected via a bus 108.

[0225] Processor 105 may be a central processing unit (CPU), a network processor (NP), a digital signal processor (DSP), a microprocessor, a microcontroller, a programmable logic device (PLD), or any combination thereof. Processor 105 may also be any other device with processing capabilities, such as a circuit, device, or software module. Processor 105 may also include multiple CPUs, and processor 105 may be a single-core processor or a multi-core processor. Here, processor 105 may refer to one or more devices, circuits, or processing cores used for processing data (e.g., computer program instructions).

[0226] The processor provides computing and control capabilities to support the authentication, registration, and data transmission operations of the entire terminal device 100.

[0227] The memory 107 can be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions. It can also be an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer. This application embodiment does not impose any limitations on this. The memory 107 can exist independently or be integrated with the processor 105. The memory 107 may contain computer program code. The processor 105 is used to execute the computer program code stored in the memory 107, thereby implementing the control method for the multi-split air conditioning system provided in this application embodiment.

[0228] This memory provides an environment for the execution of computer programs corresponding to the running logic. When the computer program is executed by the processor, it enables the processor to perform a data interaction.

[0229] The communication interface 106 can be used to communicate with other devices or communication networks (such as Ethernet, radio access network (RAN), wireless local area network (WLAN), etc.). The communication interface 106 can be a module, circuit, transceiver, or any device capable of communication.

[0230] Bus 108 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Bus 108 can be divided into address bus, data bus, control bus, etc.

[0231] For ease of representation, Figure 11 The symbol is represented by only one thick line, but this does not indicate that there is only one bus 108 or one type of bus 108. Those skilled in the art will understand that... Figure 11The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the VSIM device to which the present application is applied. A specific VSIM device may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0232] It will be understood by those skilled in the art that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program includes program instructions and can be stored in a storage medium, which is a computer-readable storage medium. The program instructions are executed by at least one processor in the computer system to implement the process steps of the embodiments of the above methods.

[0233] This application proposes a terminal device 100, which includes an interaction module 1, a first SIM card 7, a second SIM card 8, a first communication module 5, a client security authentication module 2, and a controller 8. The client security authentication module 2 is used to encrypt information to be sent by the terminal device 100 before sending it through the first communication module, and to decrypt interaction information received by the first communication module 5. This application improves the security of user service communication and prevents theft by using an actual physical module to encrypt the sent VSIM interaction information in real time. Furthermore, the client security authentication module 2 is uniquely bound to the terminal device 100 and cannot be reused, preventing the client security authentication module 2 from being used by others on other devices and affecting the security of transmitted data.

[0234] This application also proposes a server 200, as shown in the reference. Figure 12 The server 200 includes a server-side security authentication module and a VSIM remote management platform 4, wherein:

[0235] The server-side security authentication module 3 is used to encrypt the information sent by the server 200 and then send it through the communication module, or to decrypt the interactive information received by the communication module.

[0236] The VSIM remote management platform 4 is configured to initialize the server-side security authentication module 3 and uniquely match and bind the server-side security authentication module 3 with the server 200.

[0237] Server 200 establishes a data connection with the first SIM card 7 of terminal device 100;

[0238] The system receives the VSIM information request decrypted by the server-side security authentication module 3, and then encrypts the VSIM information using the server-side security authentication module 3 before sending it to the terminal device 100.

[0239] The system receives the registration request for Sohu registration, which is decrypted by the server-side security authentication module 3, and then encrypts the authentication request using the server-side security authentication module 3 before sending it to the terminal device 100.

[0240] Receive the authentication request response decrypted by the server's 200 security authentication mode;

[0241] After completing network registration, server 200 establishes a network connection with terminal device 100.

[0242] By setting up a server-side security authentication module 3 on server 200, the interactive information and VSIM information in the network access authentication process of the VSIM card can be decrypted or encrypted, thereby improving the security of information exchange in the authentication process and preventing theft.

[0243] Among them, the VSIM card number resources are managed uniformly by the server-side security authentication module 3 and the VSIM remote management platform 4, which improves the security of network access management and permission management.

[0244] In some embodiments, during the authentication process of the first SIM card 7, encryption and decryption are performed using the server-side security authentication module 3.

[0245] Specifically, after the server-side security authentication module 3 completes the unique matching and binding with the server 200, the client-side security authentication module 2 and the server-side security authentication module 3 perform two-way authentication.

[0246] In some embodiments, the server-side security authentication module 3 receives the physical card registration command, decrypts it, and sends it in plaintext to the VSIM remote management platform 4;

[0247] VSIM remote management platform 4 sends a registration command and replies with an ACK to the server security authentication module 3. The server security authentication module 3 decrypts the reply and sends it to the terminal device 100.

[0248] The server-side security authentication module 3 receives the authentication request sent by the terminal device 100 and decrypts it, then sends the decrypted authentication request to the VSIM remote management platform 4.

[0249] The VSIM remote management platform 4 sends an ACK reply, which is then encrypted by the server-side security authentication module 3 and sent to the terminal device 100.

[0250] In some embodiments, during the network access authentication process of the second SIM card 8, encryption and decryption are performed using a server-side security module.

[0251] Specifically, the server-side security authentication module 3 decrypts the received VSIM information request and sends it to the VSIM remote management platform 4;

[0252] The VSIM remote management platform 4 encrypts the VSIM information via the server-side security authentication module 3 and sends it to the terminal device 100.

[0253] The server-side security authentication module 3 decrypts the received Sohu registration request and sends it to the VSIM remote management platform 4;

[0254] The VSIM remote management platform 4 sends the authentication request to the terminal device 100 after it is encrypted by the server-side security authentication module 3.

[0255] The server-side security authentication module 3 decrypts the received authentication request response and sends it to the VSIM remote management platform 4. The VSIM remote management platform 4 completes network registration, and the terminal device 100 establishes a network connection with the server 200.

[0256] The server 200 proposed in this application includes a server-side security authentication module 3 and a VSIM remote management platform 4. The server-side security authentication module 3 is used to encrypt information sent by the server 200 before sending it through the communication module, or to decrypt received interactive information. The VSIM remote management platform 4 initializes the server-side security authentication module 3 and uniquely matches and binds it to the server 200. First, it establishes a data connection with the first SIM card 7. Then, after receiving a decrypted VSIM information request, it sends encrypted VSIM information to the terminal device 100. Next, it receives a decrypted network registration request and sends an encrypted authentication request to the terminal device 100. Finally, after receiving a decrypted authentication request response, it establishes network registration for the second SIM card 8. By using the server-side security authentication module 3, a physical module, to encrypt the sent VSIM interactive information in real time, the security of user business communication is improved, and theft is prevented.

[0257] This application proposes an authentication system 300, referring to... Figure 13 The system includes the terminal device 100 in the above embodiments and the server 200 in the above embodiments.

[0258] Reference Figure 4 , 10 The interaction flow of the aforementioned authentication system 300 is as follows:

[0259] 1. After the terminal device 100 is powered on, it initializes the client security authentication module 2 and the server security authentication module 3.

[0260] 2. The client security authentication module 2 is uniquely matched and bound to the terminal device 100, and the server security authentication module 3 is uniquely matched and bound to the server 200;

[0261] 3. The user enters the authentication password through interactive module 1;

[0262] 4. The client security authentication module 2 receives the authentication password and initiates two-way authentication with the server 200;

[0263] 5. Server 200 receives the two-way authentication request, performs two-way authentication interaction with client security authentication module 2, and generates public and private keys;

[0264] 6. After successful two-way authentication, the interaction module 1 obtains the physical card information and sends a physical card registration command to the server 200;

[0265] 7. Client security authentication module 2 parses the physical card registration command to generate a public-private key pair to encrypt the entire sent information;

[0266] 8. The VSIM remote management platform 4 processes and responds to the registration request decrypted by the server-side security authentication module 3;

[0267] 9. Upon receiving the decrypted response, interaction module 1 initiates an authentication request and establishes a data connection;

[0268] 10. Client security authentication module 2 uses public and private keys to encrypt sent information;

[0269] 11. Server 200 responds to the received requests and data connection requests;

[0270] 12. When interaction module 1 receives a success message from the server, it sets the device to VSIM mode;

[0271] 13. After successfully setting up VSIM mode, request VSIM information from the server via 200.

[0272] 14. Upon receiving the request, server 200 encrypts and sends the VSIM information through server-side security authentication module 3.

[0273] 15. Terminal device 100 decrypts the VSIM information through client security authentication module 2;

[0274] 16. After the interaction module 1 has finished parsing and loading the VSIM information, it uses the new VSIM information to search for and register on the network.

[0275] 17. Server 200 receives the registration application from Soowang and responds with an authentication request;

[0276] 18. Terminal device 100 processes the received authentication request and sends an authentication request response;

[0277] 19. Server 200 receives the authentication request response from the client, completes network registration, and the data connection is successfully established.

[0278] This application adds a client security authentication module 2 to the terminal device 100 and a server security authentication module 3 to the server 200 to encrypt and decrypt the interactive data and VSIM information between the terminal device 100 and the server 200 during the network access authentication process. During VSIM interaction, the client security authentication module 2 and the server security authentication module 3 perform bidirectional authentication and generate public and private keys to encrypt information sent by the communication module. Simultaneously, the security authentication module uses the generated public and private keys to decrypt information received by the communication module.

[0279] In conjunction with the interaction module 1, compared to software algorithms protecting VSIM information in related technologies, using an actual physical module can avoid the security vulnerabilities caused by software. Furthermore, by binding the security authentication module and the device one-to-one, it effectively prevents others from accessing and using the device through other devices, greatly increasing communication security and preventing theft.

[0280] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0281] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For example, the division of each unit is merely a logical functional division, and there may be other division methods in actual implementation. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.

[0282] The steps in the method of this invention can be adjusted, merged, or reduced in order according to actual needs. The units in the device of this invention can be merged, divided, or reduced according to actual needs. Furthermore, the functional units in the various embodiments of this invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0283] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a terminal device to execute all or part of the steps of the methods described in the various embodiments of the present invention during its network access authentication process.

[0284] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0285] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Since these modifications and variations fall within the scope of the claims and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A terminal device, characterized in that, include: An interaction module is used to receive instructions input by the user, output request information corresponding to the instructions, and display information corresponding to the received electrical signals; The first SIM card, configured as a physical SIM card; A second SIM card, configured as a programmable SIM; The first communication module is used for communication between the terminal device and the server; A client security authentication module is electrically connected to the first communication module. The client security authentication module is used to encrypt the information to be sent by the terminal device and send it through the first communication module, and to decrypt the interactive information received by the first communication module, so as to at least enable the second SIM card to establish a data connection with the server. The controller is configured to initialize the client security authentication module after the terminal device is powered on, and to uniquely match and bind the client security authentication module with the terminal device. After the first SIM card establishes a data connection with the server, the terminal device is configured to VSIM mode; The first communication module sends a request to the server to obtain VSIM information; The client security authentication module is used to decrypt the VSIM information received from the server. After receiving the registration request input by the interaction module, the network is searched and registered using the VSIM information; Upon receiving an authentication request from the server, the client security authentication module decrypts the request and then encrypts the authentication request response before sending it to the server. Once the VSIM server receives the authentication request response sent by the first communication module and completes network registration, the data connection between the second SIM card and the server is successfully established.

2. The terminal device according to claim 1, characterized in that, The client security authentication module can also be used to establish a data connection between the first SIM card and the server. The controller is configured to send a two-way authentication message to the server through the first communication module after receiving the authentication password input by the interaction module. After the terminal device establishes two-way authentication with the server, it controls the interaction module to read the information of the first SIM card and sends a physical card registration command to the server through the first communication module. Upon receiving a registration request response from the server that has been decrypted by the client security authentication module, the client initiates an authentication request to the server and establishes a connection through the first communication module.

3. The terminal device according to claim 2, characterized in that, After establishing a data connection, the information is encrypted by the client security authentication module and sent to the server. Upon receiving a response from the server, the information is decrypted to verify the successful data connection.

4. The terminal device according to any one of claims 1-3, characterized in that, The client security authentication module includes: The protocol processing unit is electrically connected to the first communication module to send encrypted information to the first communication module and to receive encrypted information from the first communication module; the protocol processing unit is also electrically connected to the interaction module to perform data transmission with the interaction module. A service processing unit, electrically connected to the protocol processing unit, is used to encrypt information to be sent and decrypt information received. The main control unit is used to configure and initialize the service processing unit, receive data from the service processing unit, and analyze whether to perform encryption control or decryption control.

5. The terminal device according to claim 4, characterized in that, The steps for uniquely matching and binding the client security authentication module with the terminal device are as follows: After the terminal device is powered on, the main control unit configures and initializes the service processing unit; After the interaction module receives the authentication password, the main control unit sends device information to the protocol processing unit; The protocol processing unit receives the device information, adds a frame header and a first flag bit to form first information, and sends it to the service processing unit. The service processing unit receives the first information and forwards it to the main control unit; The main control unit generates a unique public-private key pair based on the first information and configures the business processing unit. The business processing unit activates the cryptographic engine and sends an electrical signal to the main control unit to inform the main control unit that the cryptographic engine has been successfully activated. The main control unit adds a second flag bit to the received electrical signal to construct a reply frame and sends it to the service processing unit; The service processing unit forwards the reply frame to the protocol processing unit according to the second flag bit added by the main control unit. The protocol processing unit sends the reply frame to the interaction module to show that the client security authentication module is successfully bound to the terminal device.

6. The terminal device according to claim 4, characterized in that, The controller is configured to: Upon receiving the authentication password input by the interaction module, the interaction module sends the authentication password to the protocol processing unit. The protocol processing unit adds a frame header and a first flag bit to the authentication password to form second information and forwards it to the service processing unit. The service processing unit forwards the data to the main control unit in plaintext according to the flag bit. The main control unit adds an encryption flag bit to the second information to construct an encrypted password frame and sends it to the service processing unit. The business processing unit sends the encrypted password frame to the protocol processing unit; The protocol processing unit sends the received encrypted password frame to the server through the first communication module; The first communication module receives the response data from the server and sends it to the protocol processing unit; The protocol processing unit adds a frame header and a first flag bit to the reply data to form third information and forwards it to the service processing unit. The service processing unit sends the third information to the main control unit according to the first flag bit; The main control unit adds a decryption flag to construct a decryption password frame and sends it to the service processing unit. The service processing unit decrypts the reply data according to the decryption flag and sends it to the protocol processing unit; The protocol processing unit sends the decrypted response data to the interaction module to indicate successful authentication.

7. The terminal device according to claim 6, characterized in that, The controller is configured to: The interaction module obtains the physical card registration information of the first SIM card and sends the physical card registration command to the protocol processing unit; The protocol processing unit adds a frame header and a first flag bit to the physical card registration command to form fourth information and forwards it to the service processing unit. The service processing unit forwards the fourth information in plaintext to the main control unit according to the flag bit; The main control unit adds an encryption flag to the fourth information to construct a first encrypted command frame and sends it to the service processing unit. The service processing unit encrypts the first encryption command frame according to the encryption flag and sends it to the protocol processing unit; The service processing unit sends the received first encrypted command frame to the server through the first communication module; The first communication module receives the registration command response data from the server and sends it to the protocol processing unit; The protocol processing unit adds a frame header and a first flag bit to the registration command reply data to form the fifth information and forwards it to the service processing unit. The service processing unit sends the fifth information to the main control unit according to the protocol processing flag bit; The main control unit adds a decryption flag to construct a first decryption command frame and sends it to the service processing unit. The business processing unit decrypts the registration command reply data according to the decryption flag and sends it to the protocol processing unit; The protocol processing unit sends the decrypted registration command response data to the interaction module to indicate successful registration.

8. The terminal device according to claim 4, characterized in that, The controller is configured to: The controller parses and loads the VSIM information, and sends a network search and registration command encrypted by the client security authentication module through the first communication module based on the VSIM information. The system receives an authentication request password from the server, decrypts it using the client security authentication module, and sends the decrypted authentication request password to the interaction module. The interaction module sends an authentication request response to the protocol processing unit. The protocol processing unit adds a frame header and a first flag bit to the authentication request response request to form the twelfth information and forwards it to the service processing unit. The service processing unit forwards the twelfth message in plaintext to the main control unit according to the flag bit; The main control unit adds an encryption flag to the twelfth information to construct an authentication request response frame and sends it to the service processing unit. The business processing unit encrypts the authentication request response frame according to the encryption flag and sends it to the protocol processing unit. The service processing unit sends the received authentication request response frame to the server through the first communication module; After completing the network registration of the second SIM card, the terminal device establishes a network connection with the server.

9. An authentication system, characterized in that, Includes the terminal device as described in any one of claims 1-8.

Images