Method and system for binding a card to a machine

Abstract

The application discloses a kind of machine-card binding method and system, wherein the method comprises the following steps: after terminal starts, check whether specific authentication application has been downloaded in eSIM card, if not, apply for downloading to platform, and install the authentication application on eSIM card;Terminal obtains the unique identification of eSIM card, and initiates request to platform to obtain authentication-related key;eSIM card initiates authentication request to terminal, and completes card-machine authentication based on the unique identification of eSIM card encrypted by authentication-related key returned by platform.The application mainly realizes machine-card binding by modifying card, and the authentication key derived by authenticating the unique identification of the card is passed through by the card side, and in the case of not passing authentication, the card can continue to work whether or not by the card end application, so as to achieve the purpose of binding for inventory card.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of smart cards, in particular to a method and system for binding a smart card to a device. BACKGROUND

[0002] Currently, the eSIM product introduced by the operator will be used in some illegal scenarios. For example, the eSIM card originally used on a watch is applied to other products after being illegally disassembled, or some eSIM cards of other operators are installed on devices not belonging to the operator. Therefore, the eSIM card needs to be bound to the device to prevent users from performing illegal operations.

[0003] In the prior art, the COS (Card Operation System) of the eSIM card needs to be changed to complete the binding, but in this way, the eSIM card will also be locked and cannot be used subsequently, and it is very troublesome to change the COS.

[0004] The traditional machine card binding scheme is to judge whether it is the currently bound device by obtaining the unique identifier IMEI of the terminal. However, the IMEI returned by the terminal is easy to be forged, so the binding judgment based on this field is defective.

[0005] Another machine card binding scheme is to prestore a set of same symmetric keys on the card side and the terminal side, or to dynamically negotiate a set of same symmetric keys through the key negotiation mechanism of the asymmetric algorithm, and then to verify whether the symmetric keys are correct by encrypting the random numbers generated by both sides. If yes, it is considered that the binding is successful, and if not, it is considered that the binding fails. This method needs to achieve two-way authentication, that is, the card side needs to authenticate the legality of the terminal, and the terminal also needs to authenticate the legality of the card side. At the same time, if the authentication fails, the card side needs to increase the restriction of authentication login to achieve the purpose of restricting the normal use of the terminal. Here, the card side increases the restriction of authentication login, and there is no such API interface on the standard eSIM card, so the COS needs to be modified to achieve the purpose.

[0006] For the two-way authentication process, the generation and distribution of symmetric keys, the conventional method is to modify the COS to prestore the keys or prestore the related certificates, and then to increase the binding processing flow to achieve the purpose. However, among them, the modification of the COS is basically infeasible for the existing cards.

[0007] Therefore, there is an urgent need for a machine card binding method to solve the above problems. SUMMARY

[0008] The main purpose of the present application is to realize the function of machine card binding without modifying the COS of the card, and to solve the problem that the eSIM product of the current operator is used in illegal scenarios.

[0009] The technical scheme adopted by the present application is:

[0010] A method for binding a terminal and a card is provided, comprising the following steps:

[0011] After the terminal is powered on, it is checked whether a specific authentication application has been downloaded on the eSIM card, and if not, the terminal applies to download the authentication application from the platform and installs the authentication application on the eSIM card;

[0012] The terminal obtains the unique identifier of the eSIM card and initiates a request to the platform to obtain the authentication-related key;

[0013] The eSIM card initiates an authentication request to the terminal, and completes the card-terminal authentication based on the unique identifier of the eSIM card encrypted by the authentication-related key returned by the platform.

[0014] In the above technical scheme, the authentication-related key returned by the platform is a white-box key, which includes a key for encrypting the unique identifier of the eSIM card and a message authentication code (MAC).

[0015] In the above technical scheme, the platform transmits the key to the terminal through TLS protection.

[0016] In the above technical scheme, the process of card-terminal authentication includes:

[0017] The terminal performs authentication initialization according to the authentication request of the eSIM card, generates an encrypted temporary key and a MAC message authentication code, and sends them to the eSIM card;

[0018] The eSIM card decrypts the temporary key and uses the temporary key to encrypt the unique identifier of the card, calculates the MAC and verifies it; if the MAC verification is incorrect, the eSIM card returns a re-authentication, and if the error occurs multiple times, the eSIM card is locked and no longer initiates an authentication request.

[0019] In the above technical scheme, the terminal initiates an authentication request to the eSIM card to complete the card-terminal authentication.

[0020] In the above technical scheme, the process of card-terminal authentication includes:

[0021] The terminal performs authentication initialization, generates an encrypted temporary key and a MAC message authentication code, and sends them to the eSIM card to request authentication;

[0022] The eSIM card decrypts the temporary key and uses it to encrypt the unique identifier of the card, calculates the MAC, and sends it to the terminal;

[0023] The terminal verifies the MAC, and if the verification is incorrect, it returns a re-authentication, and if the error occurs multiple times, the eSIM card is locked and no longer initiates an authentication request.

[0024] According to the technical scheme, if the MAC check is successful, the temporary key is used to decrypt the unique identifier of the eSIM card, and comparison is performed, if correct, the eSIM card is normally authenticated and used.

[0025] The application further provides a machine-card binding system, comprising an eSIM card, a terminal and a platform, wherein:

[0026] The eSIM card is installed in the terminal.

[0027] The terminal is configured to check whether a specific authentication application has been downloaded from the eSIM card after starting up, and if not, apply to the platform for downloading and install the authentication application on the eSIM card; the terminal acquires the unique identifier of the eSIM card and initiates a request to the platform to acquire the authentication-related key.

[0028] The eSIM card performs self-checking after starting up, initiates an authentication request to the terminal, and completes the card-terminal authentication based on the unique identifier of the eSIM card encrypted by the authentication-related key returned by the platform.

[0029] According to the technical scheme, the process of the card-terminal authentication initiated by the eSIM card comprises:

[0030] The terminal performs authentication initialization according to the authentication request of the eSIM card, generates an encrypted temporary key and a MAC message authentication code and sends them to the eSIM card.

[0031] The eSIM card decrypts the temporary key and encrypts the unique identifier of the card using the temporary key, calculates the MAC and performs check; if the MAC check is incorrect, re-authentication is returned, and if incorrect for multiple times, the eSIM card is locked and no longer initiates the authentication request.

[0032] According to the technical scheme, the terminal is further configured to initiate an authentication request to the eSIM card and complete the card-terminal authentication.

[0033] The application has the following beneficial effects: the application mainly modifies the card to achieve the binding purpose, the authentication key is determined by the unique identifier of the card, and the authentication process is realized by installing an authentication application on the card, which is equivalent to the key derived by the card end and finally needs to be authenticated by the application of the card end. Only when the card-terminal authentication is successful can the machine-card binding be successful; regardless of whether the terminal side performs authentication, the card side needs to pass the authentication key derived by the unique identifier of the card; in the case of failed authentication, the card end application controls whether the card can continue to work, thereby achieving the purpose of realizing the binding of the stock card.

[0034] Further, in addition to the authentication request initiated by the eSIM card, the terminal side can also initiate the authentication request to complete the card-terminal authentication, and if the authentication fails, the card is locked.

[0035] Of course, implementing any of the products of the application does not necessarily require that all of the above-mentioned advantages be achieved at the same time. BRIEF DESCRIPTION OF DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor.

[0037] Figure 1 is a flow chart of a card-machine binding method according to an embodiment of the present application;

[0038] Figure 2 is a schematic diagram of the principle of card-machine binding according to an embodiment of the present application;

[0039] Figure 3 is a flow chart of authentication detection and initiation according to an embodiment of the card-machine binding method of the present application;

[0040] Figure 4 is a flow chart of the specific process of mutual authentication between the card and the device according to an embodiment of the present application. DETAILED DESCRIPTION

[0041] In order to make the objectives, technical solutions and advantages of the present application clearer, the following will further describe the present application in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0042] It should be noted that the diagrams provided in the embodiments of the present application only illustrate the basic concept of the present application in a schematic manner, and therefore the diagrams only show the components related to the present application, not the number, shape and size of the components when actually implemented. The actual implementation of each component may be arbitrarily changed in shape, number and proportion, and the layout pattern of the components may also be more complex.

[0043] In the present application, it should also be noted that, if terms such as "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer" and the like appear, the indicated orientation or positional relationship is based on the orientation or positional relationship shown in the drawings, and is only for the convenience of describing the present application and simplifying the description, and therefore cannot be understood as indicating or implying that the indicated device or element must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as limiting the present application. In addition, if the terms "first" and "second" appear, they are only for description and distinction purposes, and cannot be understood as indicating or implying relative importance.

[0044] As Figure 1As shown, the method for binding the terminal and the card in the embodiment of the application comprises the following steps:

[0045] S1, after the terminal is powered on, it is checked whether a specific authentication application has been downloaded on the eSIM card, if not, the terminal applies to download the authentication application from the platform, and installs the authentication application on the eSIM card;

[0046] S2, the terminal acquires the unique identifier of the eSIM card, and initiates a request to the platform to acquire the authentication-related key;

[0047] S3, the eSIM card initiates an authentication request to the terminal, and completes the terminal-card authentication by encrypting the unique identifier of the eSIM card based on the authentication-related key returned by the platform.

[0048] The authentication-related key returned by the platform is a white-box key, which contains a key for encrypting the unique identifier of the eSIM card and a MAC message authentication code. When transmitting the white-box key, the platform can transmit the key to the terminal through a TLS (Transport Layer Security) encryption channel.

[0049] Further, the process of terminal-card authentication comprises:

[0050] S31, the terminal performs authentication initialization according to the authentication request of the eSIM card, generates an encrypted temporary key and a message authentication code MAC, and sends them to the eSIM card;

[0051] S32, the eSIM card decrypts the temporary key, encrypts the unique identifier of the card using the temporary key, calculates the MAC and verifies it; if the MAC verification is incorrect, the eSIM card returns to re-authenticate, and if the error occurs multiple times, the eSIM card is locked and no longer initiates an authentication request. The MAC refers to a check value for verifying data integrity, and the algorithm used for verification calculation is not unique and can be 3DES, AES, etc.

[0052] If the MAC verification is successful, the terminal decrypts the unique identifier of the eSIM card using the temporary key, and compares it; if correct, the eSIM card is normally authenticated and used.

[0053] In the application, the terminal can also actively initiate an authentication request to the eSIM card to complete the terminal-card authentication. Specifically, the process of terminal-card authentication can comprise the following steps:

[0054] S41, the terminal performs authentication initialization, generates an encrypted temporary key and a MAC message authentication code, and sends them to the eSIM card to request authentication;

[0055] S42, the eSIM card decrypts the temporary key, encrypts the unique identifier of the card using the temporary key to obtain the MAC message authentication code to be verified, and sends it to the terminal;

[0056] S43, the terminal checks the MAC message authentication code to be verified, and returns re-authentication if it is wrong, and the eSIM card is locked if there are multiple errors, and authentication request is no longer initiated. If the check is successful, the eSIM card normally authenticates for use.

[0057] As shown in Figure 2 This embodiment takes the unique identification EID (electronic identity card identification) of the card as an example. The mutual authentication between the card and the terminal is mainly based on the unique identification EID of the card to determine whether it is in the mutual authentication state of the binding.

[0058] If not, the application on the card actively enters an abnormal state (such as a dead loop or other), thereby preventing the normal execution of the COS on the card.

[0059] Figure 3 The method is an authentication detection and initiation process, including the following steps:

[0060] 1) The device (i.e. the terminal) checks whether the card has downloaded the authentication application pushed by the platform, and if not, initiates a request for downloading the authentication application to the platform;

[0061] 2) The EID of the eSIM card is obtained and recorded, and an authentication request is initiated to the platform to apply for an encryption key and a verification key, such as a MAC key, which can use the last 8 bytes of the result after AES encryption as the MAC verification data;

[0062] 3) The platform records the EID of the eSIM according to the authentication request and applies for a key from the encryption machine, which can be transmitted through TLS to protect the white-box key;

[0063] 4) The device saves the white-box key and installs the authentication application on the eSIM card. After installing the authentication application, the eSIM card starts the application function to initiate authentication after self-checking.

[0064] Figure 4 The method is a specific process of mutual authentication between the card and the device, mainly including the following processes:

[0065] 1) Authentication initialization (encryption according to the key obtained from the platform to obtain an encrypted temporary key and MAC)

[0066] 2) The eSIM card checks the MAC (i.e. checks the correctness of the MAC calculated in the previous step, if it is inconsistent, it is considered that the MAC check fails), decrypts to obtain the temporary key, encrypts the EID of the eSIM card using the temporary key, and calculates the MAC.

[0067] 3) If the card side MAC check is wrong, return the card type re-authentication (so that the terminal can identify the error type and report), if there are multiple errors, the card is locked and the authentication process is no longer initiated.

[0068] 4) Only after the MAC verification is successful can the terminal obtain the ciphertext of the EID encrypted with the temporary key and the MAC, use the temporary key to decrypt the EID and compare the EID.

[0069] 5) If the verification is successful (i.e. the MAC address matches and the decrypted EID matches), the eSIM card can be authenticated and used normally.

[0070] 6) If the device fails to verify multiple times, the card will be locked, authentication will no longer be sent, and the authentication process will be terminated.

[0071] This invention also provides a machine-card binding system, such as Figure 2 As shown, it includes an eSIM card, a terminal, and a platform, wherein:

[0072] The eSIM card is installed in the terminal;

[0073] After powering on, the terminal checks whether the eSIM card has downloaded a specific authentication application. If not, it requests the platform to download the application and installs it on the eSIM card. The terminal obtains the unique identifier of the eSIM card and sends a request to the platform to obtain the authentication key.

[0074] After powering on, the eSIM card performs a self-test and actively initiates an authentication request to the terminal. Both parties encrypt the unique identifier of the eSIM card based on the authentication-related key returned by the platform to complete the card-device authentication.

[0075] This system is mainly used to implement the card binding method described in the above embodiments, which will not be elaborated here.

[0076] This application also provides a computer-readable storage medium, such as flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, server, App application store, etc., which stores a computer program, and the program implements corresponding functions when executed by a processor. When the computer-readable storage medium of this embodiment is executed by a processor, it implements the card-machine binding method of the method embodiment.

[0077] It should be noted that, depending on the implementation needs, the various steps / components described in this application can be broken down into more steps / components, or two or more steps / components or parts of the operation of steps / components can be combined into new steps / components to achieve the purpose of this invention.

[0078] The size of the serial number of each step in the above embodiment does not mean the order of execution, and the execution order of each process should be determined according to its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0079] It should be understood that those of ordinary skill in the art can make improvements or changes according to the above description, and all these improvements and changes shall belong to the protection scope of the appended claims of the present application.

Claims

1. A method for binding a machine card, characterized in that, Includes the following steps: After the terminal is powered on, it checks whether the eSIM card has downloaded the specific authentication application. If not, it requests the platform to download the application and installs it on the eSIM card. The terminal obtains the unique identifier of the eSIM card and sends a request to the platform to obtain the key related to authentication; The eSIM card proactively initiates an authentication request to the terminal; The terminal initializes authentication based on the eSIM card's authentication request, generates an encrypted temporary key and a MAC message authentication code, and sends them to the eSIM card. The eSIM card is decrypted to obtain a temporary key, which is then used to encrypt the card's unique identifier. The MAC is then calculated and verified. If the MAC verification fails, the system will return to re-authenticate. If multiple failures occur, the eSIM card will be locked, and no further authentication requests will be initiated.

2. The method for binding a machine card according to claim 1, characterized in that, The authentication-related key returned by the platform is a white-box key, which contains a key used to encrypt the unique identifier of the eSIM card and a message authentication code (MAC).

3. The method for binding a machine card according to claim 1, characterized in that, The platform transmits keys to the terminal using TLS protection.

4. The method for binding a machine card according to claim 1, characterized in that, The terminal proactively initiates an authentication request to the eSIM card to complete the device-SIM card authentication.

5. The method for binding a machine card according to claim 4, characterized in that, The card authentication process includes: Terminal authentication initialization: Generates an encrypted temporary key and MAC message authentication code and sends them to the eSIM card to request authentication; The eSIM card is decrypted to obtain a temporary key, and its unique identifier is used to calculate the MAC and send it to the terminal. The terminal verifies the MAC address. If an error is found, it returns for re-authentication. If multiple errors occur, the eSIM card is locked, and no further authentication requests are initiated.

6. The method for binding a machine card according to claim 4 or 5, characterized in that, If the MAC verification is successful, the eSIM card's unique identifier is decrypted using the temporary key and compared. If correct, the eSIM card can be authenticated and used normally.

7. A machine-card binding system, characterized in that, This includes eSIM cards, terminals, and platforms, among which: The eSIM card is installed in the terminal; After powering on, the terminal checks whether the eSIM card has downloaded a specific authentication application. If not, it requests the platform to download the application and installs it on the eSIM card. The terminal obtains the unique identifier of the eSIM card and sends a request to the platform to obtain the authentication key. After powering on, the eSIM card performs a self-test and actively initiates an authentication request to the terminal. Both parties encrypt the unique identifier of the eSIM card based on the authentication-related key returned by the platform to complete the card-device authentication. The process of card-device authentication initiated by the eSIM card includes: The terminal initializes authentication based on the eSIM card's authentication request, generates an encrypted temporary key and a MAC message authentication code, and sends them to the eSIM card. The eSIM card is decrypted to obtain a temporary key, which is then used to encrypt the card's unique identifier. The MAC address is calculated and verified. If the MAC verification fails, the process returns for re-authentication. If multiple failures occur, the eSIM card is locked, and no further authentication requests are initiated.

8. The machine-card binding system according to claim 7, characterized in that, The terminal is also used to proactively initiate authentication requests to the eSIM card to complete the device-card authentication.

Images