Secure communication method, apparatus, device, system, medium and program product

Abstract

The application discloses a secure communication method, device, equipment, system, medium and program product, and belongs to the technical field of communication. The method comprises the following steps: receiving a certificate application message sent by a terminal device in the case that a one-way TLS link is established between the terminal device and a PKI service platform, wherein the certificate application message is obtained by encrypting the terminal device based on device information and service information of the terminal device by using a first public key in a SIM card in the terminal device; calling a function interface of a SIM card management platform, so that the SIM card management platform verifies the SIM card in the terminal device based on the certificate application message and decrypts the certificate application message by using a first private key corresponding to the SIM card to obtain a decryption result; and issuing a device certificate to the terminal device through the one-way TLS link in the case that the decryption result represents that the decryption is successful. The application can improve the communication security between the terminal device and the PKI service platform.

Description

Technical Field

[0001] This application belongs to the field of communication technology, and in particular relates to a secure communication method, device, equipment, system, medium and program product. Background Technology

[0002] In a Public Key Infrastructure (PKI) security framework, terminal devices can perform one-way authentication with the PKI server via a one-way Transport Layer Security (TLS) link; that is, the terminal device verifies the PKI server. After successful verification, the terminal device requests a device certificate from the PKI server. The PKI server does not authenticate the terminal device, making it easy for network attackers to steal the terminal device's device certificate. This allows attackers to forge the terminal device's identity and data, posing a significant data security risk and reducing the communication security between the terminal device and the PKI server. Summary of the Invention

[0003] This application provides a secure communication method, apparatus, device, system, medium, and program product that can improve communication security between terminal devices and PKI service platforms.

[0004] In a first aspect, embodiments of this application provide a secure communication method applied to a PKI service platform. The method includes: when a terminal device establishes a one-way TLS link with the PKI service platform, receiving a certificate request message sent by the terminal device, wherein the certificate request message is obtained by the terminal device by encrypting it using a first public key in the SIM card of the terminal device based on the terminal device's device information and service information; calling the function interface of the SIM card management platform to enable the SIM card management platform to verify the SIM card in the terminal device based on the certificate request message and to decrypt the certificate request message using the first private key corresponding to the SIM card, thereby obtaining a decryption result; and, if the decryption result indicates successful decryption, issuing a device certificate to the terminal device through the one-way TLS link.

[0005] Secondly, embodiments of this application provide a secure communication method applied to a SIM card management platform. The method includes: when a terminal device establishes a one-way TLS link with a PKI service platform, accepting a call initiated by the PKI service platform in response to a certificate request message sent by the terminal device; verifying the SIM card in the terminal device based on the certificate request message; and decrypting the certificate request message using the first private key corresponding to the SIM card to obtain a decryption result. The certificate request message is encrypted by the terminal device using the first public key within the SIM card in the terminal device based on device information and service information. The decryption result is then fed back to the PKI service platform, so that the PKI service platform, upon successful decryption, issues a device certificate to the terminal device via the one-way TLS link.

[0006] Thirdly, embodiments of this application provide a secure communication method applied to a terminal device, the terminal device having a SIM card. The method includes: when the terminal device establishes a one-way secure transport layer protocol (TLS) link with a PKI service platform, encrypting a certificate application message using a first public key in the SIM card based on the device information and service information of the terminal device; sending the certificate application message to the PKI service platform so that the PKI service platform calls the functional interface of the SIM card management platform, and the SIM card management platform verifies the SIM card in the terminal device based on the certificate application message and decrypts the certificate application message using the first private key corresponding to the SIM card to obtain a decryption result; if the decryption result indicates successful decryption, receiving a device certificate issued by the PKI service platform through the one-way TLS link.

[0007] Fourthly, this application provides a secure communication device applied to a PKI service platform. The device includes: a receiving module, used to receive a certificate request message sent by the terminal device when a one-way TLS link is established between the terminal device and the PKI service platform. The certificate request message is encrypted by the terminal device using a first public key stored in the SIM card of the terminal device based on the terminal device's device information and service information; an interface calling module, used to call the functional interface of the SIM card management platform, enabling the SIM card management platform to verify the SIM card in the terminal device based on the certificate request message and decrypt the certificate request message using the first private key corresponding to the SIM card, obtaining a decryption result; and a sending module, used to send a device certificate to the terminal device via the one-way TLS link when the decryption result indicates successful decryption.

[0008] Fifthly, this application provides a secure communication device applied to a SIM card management platform. The device includes: a processing module, configured to, when a unidirectional TLS link is established between a terminal device and a PKI service platform, accept a call initiated by the PKI service platform in response to a certificate request message sent by the terminal device; verify the SIM card in the terminal device based on the certificate request message; and decrypt the certificate request message using a first private key corresponding to the SIM card to obtain a decryption result. The certificate request message is encrypted by the terminal device using a first public key within the SIM card based on device information and service information. A sending module is configured to send the decryption result back to the PKI service platform, so that the PKI service platform, upon receiving a decryption result indicating successful decryption, issues a device certificate to the terminal device via the unidirectional TLS link.

[0009] Sixthly, embodiments of this application provide a terminal device having a SIM card. The terminal device includes: a message generation module, used to encrypt a certificate application message using a first public key in the SIM card based on the device information and service information of the terminal device when a one-way TLS link is established between the terminal device and a PKI service platform; a sending module, used to send the certificate application message to the PKI service platform so that the PKI service platform can call the function interface of the SIM card management platform, and the SIM card management platform can verify the SIM card in the terminal device based on the certificate application message and decrypt the certificate application message using the first private key corresponding to the SIM card to obtain a decryption result; and a receiving module, used to receive a device certificate issued by the PKI service platform through a one-way TLS link when the decryption result indicates successful decryption.

[0010] In a seventh aspect, embodiments of this application provide a secure communication device applied to a PKI service platform. The device includes a processor and a memory storing computer program instructions; the processor executes the computer program instructions to implement the secure communication method of the first aspect.

[0011] Eighthly, embodiments of this application provide a secure communication device applied to a SIM card management platform. The device includes a processor and a memory storing computer program instructions. When the processor executes the computer program instructions, it implements the secure communication method of the second aspect.

[0012] Ninthly, embodiments of this application provide a terminal device, characterized in that the terminal device has a SIM card, the terminal device includes: a processor and a memory storing computer program instructions; the processor executes the computer program instructions to implement the secure communication method of the third aspect.

[0013] In a tenth aspect, embodiments of this application provide a secure communication system, comprising: a PKI service platform for executing the secure communication method of the first aspect; a SIM card management platform communicatively connected to the PKI service platform for executing the secure communication method of the second aspect; and a terminal device communicatively connected to the PKI service platform for executing the secure communication method of the third aspect.

[0014] Eleventhly, embodiments of this application provide a computer-readable storage medium storing computer program instructions, which, when executed by a processor, implement the secure communication method of the first aspect, the secure communication method of the second aspect, or the secure communication method of the third aspect.

[0015] In a twelfth aspect, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements a secure communication method of the first aspect, a secure communication method of the second aspect, or a secure communication method of the third aspect.

[0016] This application provides a secure communication method, apparatus, device, system, medium, and program product. The terminal device is equipped with a SIM card, which can pre-store a first public key corresponding to the SIM card. When the terminal device establishes a one-way TLS link with a PKI service platform, the terminal device, based on its own device information and service information, uses the first public key to encrypt a certificate application message and sends the message to the PKI service platform. The PKI service platform can call the functional interface of the SIM card management platform, instructing it to verify the terminal device's SIM card based on the certificate application message and decrypt the message using the first private key corresponding to the SIM card. If decryption is successful, it indicates that the terminal device possesses a first public key paired with the first private key, thus confirming its legitimacy. The interaction between the PKI service platform and the SIM card management platform achieves authentication of the terminal device. Even if a network attacker steals the root certificate chain, device certificate, and public key of the PKI service platform to simulate the terminal device, the attacker cannot obtain the first public key corresponding to the SIM card in the terminal device. Therefore, the attacker cannot verify the legitimacy and uniqueness of the terminal device's identity, thus failing to ensure data security and improve communication security between the terminal device and the PKI service platform. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1This is a schematic diagram of the architecture of a secure communication system provided in an embodiment of this application;

[0019] Figure 2 A flowchart illustrating a secure communication method provided in an embodiment of the first aspect of this application;

[0020] Figure 3 A flowchart illustrating a secure communication method provided in another embodiment of the first aspect of this application;

[0021] Figure 4 A flowchart illustrating a secure communication method provided in an embodiment of the second aspect of this application;

[0022] Figure 5 A flowchart illustrating a secure communication method provided in an embodiment of the third aspect of this application;

[0023] Figure 6 A flowchart illustrating a secure communication method provided in another embodiment of a third aspect of this application;

[0024] Figure 7 A flowchart illustrating an example of the communication interaction process between the terminal device, PKI service platform, and SIM card management platform provided in an embodiment of this application;

[0025] Figure 8 A schematic diagram of the structure of a secure communication device provided in an embodiment of the fourth aspect of this application;

[0026] Figure 9 A schematic diagram of the structure of a secure communication device provided in an embodiment of the fifth aspect of this application;

[0027] Figure 10 This is a schematic diagram of the structure of a terminal device provided in an embodiment of the sixth aspect of this application;

[0028] Figure 11 A schematic diagram of the structure of a secure communication device provided in an embodiment of the seventh aspect of this application. Detailed Implementation

[0029] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0030] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0031] In a PKI security architecture, terminal devices can perform one-way authentication with the PKI server via a one-way TLS link; that is, the terminal device verifies the PKI server. After successful verification, the terminal device requests a device certificate from the PKI server. The PKI server does not authenticate the terminal device, making it easy for network attackers to steal the terminal device's device certificate. This allows attackers to forge the terminal device's identity and data, posing a significant data security risk and reducing the communication security between the terminal device and the PKI server.

[0032] In some cases, to improve communication security between terminal devices and the PKI server, encryption hardware devices such as encryption machines can be deployed separately on the PKI server side. Device certificates are pre-encrypted and stored as ciphertext in the chip of the encryption hardware device, along with root and intermediate certificates. Encryption and decryption of device certificates are all performed within the chip. However, this approach cannot guarantee the security and reliability of certificate requests from terminal devices to the PKI server. When a terminal obtains a device certificate, it is highly likely that the certificate has already been forged and tampered with by network attackers. Furthermore, this approach requires dedicated encryption hardware, increasing the complexity and cost of the PKI security system. It also makes communication security dependent on the supplier of the encryption hardware, hindering effective control over communication security.

[0033] This application provides a secure communication method, apparatus, device, system, medium, and program product. The terminal device has a Subscriber Identity Module (SIM) card with a first public key pre-written in it. After the terminal device establishes a one-way TLS link with the PKI server, the terminal device can use the first public key pre-written in its SIM card to encrypt its device information and service information to obtain a certificate application message for applying for a device certificate. The PKI server can call the SIM card management platform to obtain the first private key corresponding to the first public key in the SIM card and decrypt it to complete the verification of the terminal device. After confirming that the terminal device is secure and reliable based on decryption and verification, the PKI server issues a device certificate to the terminal device, thus realizing the verification of the terminal device's security by the PKI server. Without adding new encryption hardware, this improves the communication security between the terminal device and the PKI server, establishing a more secure and reliable PKI security system.

[0034] The secure communication methods, devices, equipment, systems, media, and program products provided in this application are described below.

[0035] To facilitate understanding, we will first introduce the secure communication system used in secure communication methods. Figure 1 This is a schematic diagram of the architecture of a secure communication system provided in an embodiment of this application, as shown below. Figure 1 As shown, the secure communication system may include terminal device 11, PKI service platform 12, and SIM card management platform 13.

[0036] Terminal device 11 may include smart terminals in the Internet of Things (IoT), such as vehicle terminals, wearable terminals, home terminals, industrial terminals, and urban application terminals. For example, terminal device 11 may include, but is not limited to, in-vehicle terminals, smartphones, tablets, smart refrigerators, smart air conditioners, and smart streetlights. The terminal device is equipped with a SIM card, which can be obtained through the SIM card management platform 13. Terminal device 11 can communicate with PKI service platform 12. In this embodiment, terminal device 11 and PKI service platform may first establish a one-way TLS link communication.

[0037] The PKI service platform 12 can provide system information security services through public key technology and digital certificates. The PKI service platform 12 can generate and issue device certificates for terminal devices. The PKI service platform 12 can communicate with the SIM card management platform 13. Specifically, the PKI service platform 12 can instruct the SIM card management platform 13 to perform certain functional operations by calling its functional interfaces. The PKI service platform 12 may include devices such as servers; however, the type and number of devices implementing the functions of the PKI service platform 12 are not limited here.

[0038] The SIM card management platform 13 can manage SIM cards. SIM cards can be processed through the SIM card management platform 13, which can record relevant information about the processed SIM cards and the binding relationship between the SIM cards and the terminal device 11. The terminal device 11 is configured with a SIM card, meaning the terminal device 11 and the SIM card are bound together. In this embodiment, the SIM card management platform 13 can provide a first public key and a first private key corresponding to the SIM card. The first public key and the first private key are a pair of keys. Ciphertext information encrypted using the first public key can be decrypted using the first private key to obtain the plaintext information before encryption. The SIM card management platform 13 can pre-write the first public key corresponding to the SIM card into the SIM card. After the SIM card is installed in the terminal device 11, the terminal device 11 can read the first public key from the SIM card. The SIM card management platform 13 may include devices such as servers; the type and number of devices implementing the functions of the SIM card management platform 13 are not limited here.

[0039] The first aspect of this application provides a secure communication method that can be applied to a PKI service platform, that is, the secure communication method can be executed by the PKI service platform. Figure 2 A flowchart of a secure communication method provided in an embodiment of the first aspect of this application is shown below. Figure 2 As shown, the secure communication method may include steps S201 to S203.

[0040] In step S201, when a one-way TLS link is established between the terminal device and the PKI service platform, a certificate request message sent by the terminal device is received.

[0041] The terminal device and the PKI service platform can first establish a one-way TLS link. Specifically, the terminal device can send TLS information such as its TLS version to the PKI service platform; the PKI service platform will then send its TLS version, random number, public key, and other security information back to the terminal device; the terminal device will verify the legitimacy of the PKI service platform's certificate. If the verification of the certificate's legitimacy passes, the one-way TLS link will be established.

[0042] The certificate application message is obtained by the terminal device using its device information and service information, encrypted with the first public key stored in the SIM card. The terminal device can read the first public key from its own SIM card, and based on its own device information and service information, perform RSA encryption using that first public key to obtain the certificate application message. The certificate application message is ciphertext encrypted with the first public key using RSA, and even if intercepted during transmission, it cannot be cracked or read, thus protecting data security. The device information of the terminal device can represent the terminal device. In some examples, the device information may include, but is not limited to, a device identifier and a SIM card identifier. The SIM card identifier represents the SIM card, and the terminal device and SIM card have a binding relationship; correspondingly, the SIM card identifier can also represent the terminal device. Service information may include, but is not limited to, the terminal device's device identifier, device type, device status, etc. For example, if the terminal device is a smart street light, the service information may include information that indicates the device status of the smart street light, such as brightness and battery level. The certificate application message may include a message header and a message body. The message body may be ciphertext obtained by encrypting the service information using the first public key. The message header may include device information.

[0043] After the terminal device establishes a one-way TLS link with the PKI service platform, the terminal device generates a certificate request message and sends it to the PKI service platform, which then receives the certificate request message.

[0044] In step S202, the function interface of the SIM card management platform is called so that the SIM card management platform can verify the SIM card in the terminal device based on the certificate application message and decrypt the certificate application message using the first private key corresponding to the SIM card to obtain the decryption result.

[0045] The PKI service platform calls the function interface of the SIM card management platform to instruct the SIM card management platform to verify the SIM card of the terminal device, and determines whether to obtain the first private key corresponding to the first public key to decrypt the certificate application message based on the verification result.

[0046] In some examples, the PKI service platform can also verify the access rights of terminal devices based on certificate request messages. The PKI service platform can obtain device information from the certificate request message and determine whether the terminal device has access rights based on this information. If the terminal device has access rights, it can call the functional interface of the SIM card management platform. Based on the device information, the PKI service platform can determine whether the terminal device is a known and trusted device, and whether the terminal device is registered on the PKI service platform. Specifically, the PKI service platform can have a device whitelist, which may include device information of known and trusted devices registered on the PKI service platform. The PKI service platform can search the device whitelist for the device information from the certificate request message. If the device information from the certificate request message exists in the device whitelist, it can be determined that the terminal device sending the certificate request message is registered on the PKI service platform, is a known and trusted terminal device, has access rights, and can call the functional interface of the SIM card management platform.

[0047] The terminal device's device information may include a SIM card identifier, which may include an Integrated Circuit Card Identity (ICCID). The SIM card identifier is used by the SIM card management platform for SIM card verification, including legitimacy verification and / or attribution verification. If the SIM card verification is successful, the SIM card management platform uses the SIM card identifier to obtain the first private key corresponding to the SIM card identifier. The PKI service platform can send certificate request messages to the SIM card management platform by calling its functional interface. The SIM card management platform can verify the SIM card based on the SIM card identifier in the certificate request message. The SIM card management platform records the SIM card identifiers of legitimate SIM cards. It can search among the legitimate SIM card identifiers for the SIM card identifier from the certificate request message. If the SIM card identifier from the certificate request message is found among the legitimate SIM card identifiers, the SIM card's legitimacy verification is successful. The SIM card management platform records the binding relationship between SIM card identifiers and terminal devices. It can determine whether the SIM card identifier and device identifier in the certificate application message are bound together. If a binding relationship exists, the SIM card's ownership verification is successful. If a SIM card identifier is already bound to a terminal device, other terminal devices cannot use that SIM card identifier to apply for a device certificate. Ownership verification prevents the reuse or malicious use of SIM card identifiers, further enhancing data security. Each SIM card's private key can be stored in the SIM card management platform's secure database, which can only be accessed by verified systems. Upon successful SIM card verification, the SIM card management platform can retrieve the first private key corresponding to the SIM card identifier from its secure database.

[0048] After obtaining the first private key corresponding to the SIM card identifier, the SIM card management platform uses the first private key to decrypt the certificate application message, obtains the decryption result, and sends the decryption result back to the PKI service platform. The decryption result can indicate whether the decryption was successful or failed. If the decryption result indicates successful decryption, it means that the certificate application message originated from the source device claimed in the certificate application message and has not been tampered with during transmission. If the decryption result indicates failed decryption, it means that the certificate application message was not sent by the source device claimed in the certificate application message, and / or, the certificate application message was tampered with during transmission, that is, the certificate application message may have security issues.

[0049] In step S203, if the decryption result indicates successful decryption, a device certificate is sent to the terminal device via a one-way TLS link.

[0050] A successful decryption result indicates that the certificate request message is secure and that the verification of the terminal device's identity and uniqueness has been completed. The PKI service platform can then generate a device certificate for the terminal device corresponding to the certificate request message and distribute the device certificate to the terminal device. The generated device certificate is transmitted to the terminal device via a one-way TLS link, ensuring secure transmission. After receiving the device certificate, the terminal device can save it and use it for authentication during subsequent communications with the PKI service platform.

[0051] In some examples, the device certificate includes a first public key, device information, certificate information, and a digital signature. The digital signature is generated based on the PKI service platform's second private key. It's important to note that the device certificate is encrypted using the PKI service platform's public key (i.e., the second public key); the first public key, device information, and certificate information are not in plaintext. Without decryption, the first public key, device information, and certificate information cannot be extracted from the device certificate. Specifically, the device information in the device certificate may include a SIM card identifier, and the certificate information may characterize the device certificate's attributes, such as its validity period. The digital signature, generated using the PKI service platform's private key (i.e., the second private key), proves that the device certificate originates from the PKI service platform and has not been tampered with.

[0052] If the decryption result indicates decryption failure, it means that the certificate request message may have a security issue, and the PKI service platform can further monitor the terminal device. For example, the PKI service platform can limit the frequency of certificate request messages from the terminal device to prevent brute-force attacks; or, it can monitor whether the number of certificate request messages received from the terminal device within a preset time period meets preset security risk conditions. If the number of certificate request messages received from the terminal device within the preset time period meets the preset security risk conditions, then the terminal device's access to the PKI service platform is restricted. In some examples, the decryption result may be disregarded; regardless of whether there is a decryption result or not, or regardless of whether the decryption result indicates successful or failed decryption, as long as the number of certificate request messages received from the terminal device within the preset time period meets the preset security risk conditions, the PKI service platform will restrict the terminal device's access to the PKI service platform. Security risk conditions can be set according to specific scenarios, needs, experience, etc., and are not limited here. For example, security risk conditions may include the number of certificate request messages received from the terminal device within a preset time period exceeding a security threshold. PKI service platforms can restrict terminal device access through methods including, but not limited to, sending warning messages to the terminal device, directly denying access, and forcibly reducing the frequency of the terminal device's access to the PKI service platform. By restricting terminal device access to the PKI service platform when risks exist, malicious attacks can be prevented, thereby further ensuring the security and reliability of the PKI service platform.

[0053] In this embodiment, the terminal device is equipped with a SIM card, which can pre-store the first public key corresponding to the SIM card. When the terminal device establishes a one-way TLS link with the PKI service platform, the terminal device, based on its own device information and service information, uses the first public key to encrypt a certificate application message and sends the certificate application message to the PKI service platform. The PKI service platform can call the function interface of the SIM card management platform, instructing the SIM card management platform to verify the SIM card of the terminal device based on the certificate application message and decrypt the certificate application message using the first private key corresponding to the SIM card. If the decryption is successful, it indicates that the terminal device has a first public key paired with the first private key, which is legitimate. The interaction between the PKI service platform and the SIM card management platform realizes the authentication of the terminal device. Even if a network attacker steals the root certificate chain, device certificate, and public key of the PKI service platform to simulate the terminal device, the network attacker cannot obtain the first public key corresponding to the SIM card in the terminal device, and therefore cannot pass the verification of the legitimacy and uniqueness of the terminal device's identity. This ensures data security and improves the communication security between the terminal device and the PKI service platform. Moreover, the embodiments of this application do not require additional encryption hardware devices, and the communication security is not limited by the supplier of encryption hardware devices. The verification of terminal devices can be completed using the existing SIM card management platform functions, reducing the complexity and construction cost of the PKI security system, and facilitating the control of communication security.

[0054] In some embodiments, after obtaining a device certificate, the terminal device can use the device certificate for authentication during subsequent communication with the PKI service platform. Figure 3 A flowchart illustrating a secure communication method provided in another embodiment of the first aspect of this application. Figure 3 and Figure 2 The difference is that, Figure 3 The secure communication method shown may also include steps S204 to S206.

[0055] In step S204, a service message sent by the terminal device is received.

[0056] The service message includes a device certificate and a first ciphertext, which is obtained by the terminal device using a first public key to encrypt the service information. When the terminal device needs to interact with the PKI service platform, it can use the first public key to encrypt the service information to obtain the first ciphertext, generate a service message based on the first ciphertext and the device certificate, and send it to the PKI service platform. After receiving the service message sent by the terminal device, the PKI service platform processes the message to obtain the service information.

[0057] In step S205, the device certificate is decrypted using the second private key of the PKI service platform, and the first public key is obtained from the device certificate.

[0058] The device certificate may include a first public key, device information, certificate information, and a digital signature. The device certificate is encrypted using the public key of the PKI service platform, which is also the second public key. The PKI service platform can decrypt the device certificate using the second private key paired with the second public key to obtain the first public key.

[0059] In step S206, based on the first public key, the function interface of the SIM card management platform is called to obtain the first private key from the SIM card management platform, and the first ciphertext is decrypted using the first private key to obtain the service information.

[0060] The PKI service platform can use the first public key to call the functional interface of the SIM card management platform to obtain the first private key paired with the first public key. In some examples, the SIM card management platform can provide the first private key to the PKI service platform, which then uses the first private key to decrypt the first ciphertext to obtain the service information. In other examples, the PKI service platform can transmit the first ciphertext to the SIM card management platform, which uses the first private key to decrypt the first ciphertext to obtain the service information and then feeds the service information back to the PKI service platform.

[0061] Terminal devices can use device certificates to perform secondary verification of their identity with the PKI service platform, ensuring the data security of communication between the terminal device and the PKI service platform.

[0062] In some examples, the PKI service platform has a root certificate. After receiving service messages from the terminal device, the PKI service platform can use the root certificate to verify the device certificate. If the device certificate verification is successful, the PKI service platform can establish a two-way secure channel with the terminal device. The root certificate can verify whether the device certificate is issued by the PKI service platform. Successful device certificate verification indicates that the device certificate is issued by the PKI service platform, the terminal device is a trusted terminal device, and a two-way secure channel can be established between the terminal device and the PKI service platform. The two-way secure channel is an encrypted secure channel, and the data sent through the two-way secure channel is guaranteed to be secure, thereby further improving the communication security between the terminal device and the PKI service platform.

[0063] The second aspect of this application provides a secure communication method applied to a SIM card management platform, that is, the secure communication method can be executed by the SIM card management platform. Figure 4 A flowchart of a secure communication method provided in an embodiment of the second aspect of this application is shown below. Figure 4 As shown, the secure communication method includes steps S301 and S302.

[0064] In step S301, when a one-way TLS link is established between the terminal device and the PKI service platform, the terminal device accepts the call initiated by the PKI service platform in response to the certificate request message sent by the terminal device, verifies the SIM card in the terminal device based on the certificate request message, and decrypts the certificate request message using the first private key corresponding to the SIM card to obtain the decryption result.

[0065] The certificate application message is encrypted by the terminal device using the first public key stored in the SIM card in the terminal device, based on device information and service information.

[0066] In step S302, the decryption result is fed back to the PKI service platform so that the PKI service platform can issue a device certificate to the terminal device through a one-way TLS link if the decryption result indicates that the decryption was successful.

[0067] The specific details of steps S301 and S302 can be found in the relevant descriptions in the above embodiments, and will not be repeated here.

[0068] In this embodiment, the terminal device is equipped with a SIM card, which can pre-store the first public key corresponding to the SIM card. When the terminal device establishes a one-way TLS link with the PKI service platform, the terminal device, based on its own device information and service information, uses the first public key to encrypt a certificate application message and sends the message to the PKI service platform. The SIM card management platform receives calls from the PKI service platform, verifies the terminal device's SIM card based on the certificate application message, and decrypts the message using the first private key corresponding to the SIM card. If decryption is successful, it indicates that the terminal device possesses a first public key paired with the first private key, thus confirming its legitimacy. The interaction between the SIM card management platform and the PKI service platform enables authentication of the terminal device. Even if a network attacker steals the terminal device's root certificate chain, device certificate, and the PKI service platform's public key to simulate the terminal device, the attacker cannot obtain the first public key corresponding to the SIM card in the terminal device. Therefore, the attacker cannot verify the legitimacy and uniqueness of the terminal device's identity, thereby ensuring data security and improving communication security between the terminal device and the PKI service platform. Moreover, the embodiments of this application do not require additional encryption hardware devices, and the communication security is not limited by the supplier of encryption hardware devices. The verification of terminal devices can be completed using the existing SIM card management platform functions, reducing the complexity and construction cost of the PKI security system, and facilitating the control of communication security.

[0069] In some embodiments, the device information includes the SIM card identifier of the SIM card. Step S301 can be further refined as follows: obtaining the SIM card identifier from the certificate application message; verifying the SIM card using the SIM card identifier, the SIM card verification including legitimacy verification and / or attribution verification; if the SIM card verification is successful, obtaining the first private key corresponding to the SIM card identifier based on the SIM card identifier; decrypting the certificate application message using the first private key to obtain the decryption result.

[0070] In some embodiments, the device information in the certificate request message is used by the PKI service platform to determine whether the terminal device has access rights. Step S301 can be further refined as follows: if the PKI service platform determines that the terminal device has the necessary permissions, the PKI service platform accepts the call initiated by the terminal device in response to the certificate request message sent by the terminal device.

[0071] In some examples, the device certificate includes a first public key, device information, certificate information, and a digital signature, which is generated based on a second private key from the PKI service platform.

[0072] In some embodiments, the secure communication method may further include: when the PKI service platform decrypts the device certificate in the received service message using the PKI service platform's second private key to obtain the first public key, accepting a call from the PKI service platform to obtain the first private key corresponding to the first public key. The first private key is used to decrypt the first ciphertext to obtain service information. The service message includes a device certificate and the first ciphertext, which is obtained by the terminal device encrypting the service information using the first public key.

[0073] The third aspect of this application provides a secure communication method that can be applied to a terminal device, wherein the terminal device has a SIM card, and the secure communication method can be executed by the terminal device. Figure 5 A flowchart of a secure communication method provided in an embodiment of a third aspect of this application is shown below. Figure 5 As shown, the secure communication method may include steps S401 to S403.

[0074] In step S401, when a one-way TLS link is established between the terminal device and the public key infrastructure (PKI) service platform, the certificate application message is encrypted using the first public key in the SIM card based on the device information and service information of the terminal device.

[0075] In step S402, a certificate request message is sent to the PKI service platform so that the PKI service platform can call the function interface of the SIM card management platform. The SIM card management platform verifies the SIM card in the terminal device based on the certificate request message and decrypts the certificate request message using the first private key corresponding to the SIM card to obtain the decryption result.

[0076] In step S403, if the decryption result indicates successful decryption, the device certificate issued by the PKI service platform is received through a one-way TLS link.

[0077] In this embodiment, the terminal device is equipped with a SIM card, which can pre-store the first public key corresponding to the SIM card. When the terminal device establishes a one-way TLS link with the PKI service platform, the terminal device, based on its own device information and service information, uses the first public key to encrypt a certificate application message and sends the certificate application message to the PKI service platform. The PKI service platform calls the SIM card management platform to verify the SIM card of the terminal device based on the certificate application message and decrypt the certificate application message using the first private key corresponding to the SIM card. If decryption is successful, it indicates that the terminal device has a first public key paired with the first private key, and its legitimacy is confirmed. The interaction between the PKI service platform and the SIM card management platform realizes the authentication of the terminal device. Even if a network attacker steals the root certificate chain, device certificate, and public key of the PKI service platform to simulate the terminal device, the network attacker cannot obtain the first public key corresponding to the SIM card in the terminal device, and therefore cannot pass the verification of the legitimacy and uniqueness of the terminal device's identity. This ensures data security and improves the communication security between the terminal device and the PKI service platform. Moreover, the embodiments of this application do not require additional encryption hardware devices, and the communication security is not limited by the supplier of encryption hardware devices. The verification of terminal devices can be completed using the existing SIM card management platform functions, reducing the complexity and construction cost of the PKI security system, and facilitating the control of communication security.

[0078] In some embodiments, device information includes a SIM card identifier. The SIM card identifier is used by the SIM card management platform for SIM card verification. SIM card verification includes legitimacy verification and / or attribution verification. If SIM card verification is successful, the SIM card management platform uses the SIM card identifier to obtain a first private key corresponding to the SIM card identifier.

[0079] In some embodiments, the device information in the certificate application message is used by the PKI service platform to determine whether the terminal device has access rights. If the terminal device has access rights, the PKI service platform calls the function interface of the SIM card management platform.

[0080] In some examples, the device certificate includes a first public key, device information, certificate information, and a digital signature, which is generated based on a second private key from the PKI service platform.

[0081] In some embodiments, the secure communication method may further include: if the number of times the terminal device sends certificate application messages to the PKI service platform within a preset time period meets a preset security risk condition, the terminal device's access to the PKI service platform is restricted by the PKI service platform.

[0082] Figure 6 A flowchart illustrating a secure communication method provided in another embodiment of a third aspect of this application. Figure 6 and Figure 5 The difference is that, Figure 6 The secure communication method shown may also include steps S404 and S405.

[0083] In step S404, after receiving the device certificate issued by the PKI service platform through a one-way TLS link, the first ciphertext is obtained by encrypting the business information using the first public key, and a business message is generated based on the first ciphertext and the device certificate.

[0084] In step S405, a service message is sent to the PKI service platform so that the PKI service platform can use its second private key to decrypt the device certificate to obtain the first public key, and use the first public key to call the function interface of the SIM card management platform to obtain the first private key. The first private key is then used to decrypt the first ciphertext to obtain the service information.

[0085] The specific details of steps S404 and S405 can be found in the relevant descriptions in the above embodiments, and will not be repeated here.

[0086] In some embodiments, the PKI service platform has a root certificate. The secure communication method may further include: after sending a service message to the PKI service platform, and provided that the PKI service platform successfully verifies the device certificate using the root certificate, establishing a bidirectional secure channel with the PKI service platform.

[0087] For ease of explanation, the following example illustrates the communication interaction between the terminal device, the PKI service platform, and the SIM card management platform. Figure 7 A flowchart illustrating an example of the communication interaction process between the terminal device, PKI service platform, and SIM card management platform provided in this application embodiment is shown below. Figure 7 As shown, the communication interaction process includes steps a1 to a11.

[0088] In step a1, the terminal device sends its TLS information to the PKI service platform.

[0089] In step a2, the PKI service platform sends security information back to the terminal device.

[0090] In step a3, the terminal device verifies the legitimacy of the PKI service platform's platform certificate. If the legitimacy verification passes, proceed to step a4; otherwise, stop the current interaction.

[0091] In step a4, the terminal device establishes a one-way TLS link with the PKI service platform.

[0092] In step a5, the terminal device sends a certificate request message to the PKI service platform.

[0093] In step a6, the PKI service platform calls the SIM card management platform interface to verify the SIM card. If the SIM card verification is successful, proceed to step a7; otherwise, stop the certificate application process.

[0094] In step a7, the SIM card management platform obtains the first private key based on the SIM card identifier of the SIM card.

[0095] In step a8, the SIM card management platform uses the first private key to decrypt the certificate application message and obtain the decryption result.

[0096] In step a9, the SIM card management platform sends the decryption result to the PKI service platform.

[0097] In step a10, if the decryption result indicates successful decryption, the PKI service platform generates a device certificate based on the certificate application message.

[0098] In step a11, the PKI service platform issues a device certificate to the terminal device via a one-way TLS link.

[0099] The specific details of steps a1 to a11 above can be found in the relevant descriptions in the above embodiments, and will not be repeated here.

[0100] The fourth aspect of this application provides a secure communication device applied to a PKI service platform. Figure 8 A schematic diagram of the structure of a secure communication device provided in an embodiment of the fourth aspect of this application is shown below. Figure 8 As shown, the secure communication device 500 includes a receiving module 501, an interface calling module 502, and a sending module 503.

[0101] The receiving module 501 can be used to receive certificate request messages sent by the terminal device when a one-way secure transport layer protocol TLS link is established between the terminal device and the PKI service platform. The certificate request message is obtained by the terminal device through encryption using the first public key in the user identification SIM card in the terminal device based on the device information and service information of the terminal device.

[0102] The interface call module 502 can be used to call the function interface of the SIM card management platform, so that the SIM card management platform can verify the SIM card in the terminal device based on the certificate application message and decrypt the certificate application message using the first private key corresponding to the SIM card to obtain the decryption result.

[0103] The sending module 503 can be used to send a device certificate to the terminal device via a one-way TLS link when the decryption result indicates that the decryption was successful.

[0104] In some embodiments, device information includes a SIM card identifier. The SIM card identifier is used by the SIM card management platform for SIM card verification. SIM card verification includes legitimacy verification and / or attribution verification. If SIM card verification is successful, the SIM card management platform uses the SIM card identifier to obtain a first private key corresponding to the SIM card identifier.

[0105] In some embodiments, the interface calling module 502 may be specifically used to: obtain device information from the certificate application message, determine whether the terminal device has access rights based on the device information, and, if the terminal device has access rights, call the function interface of the SIM card management platform.

[0106] In some examples, the device certificate includes a first public key, device information, certificate information, and a digital signature, which is generated based on a second private key from the PKI service platform.

[0107] In some embodiments, the secure communication device 500 may further include an access restriction module. The access restriction module may be used to restrict the terminal device's access to the PKI service platform if the number of times a certificate application message is received from the terminal device within a preset time period meets a preset security risk condition.

[0108] In some embodiments, the secure communication device 500 may further include a decryption module.

[0109] The receiving module 501 can be specifically used to: receive a service message sent by a terminal device, the service message including a device certificate and a first ciphertext, the first ciphertext being obtained by the terminal device using a first public key based on the service information.

[0110] The decryption module can be used to: decrypt device certificates using the second private key of the PKI service platform, and obtain the first public key from the device certificate.

[0111] The interface call module 502 can be specifically used to: based on the first public key, call the function interface of the SIM card management platform to obtain the first private key from the SIM card management platform, and use the first private key to decrypt the first ciphertext to obtain business information.

[0112] In some embodiments, the PKI service platform has a root certificate. The secure communication device 500 may also include an authentication module and a secure channel establishment module.

[0113] The verification module can be used to verify device certificates using root certificates.

[0114] The secure channel establishment module can be used to establish a two-way secure channel with the terminal device if the device certificate verification is successful.

[0115] The fifth aspect of this application provides a secure communication device that can be applied to a SIM card management platform. Figure 9 A schematic diagram of the structure of a secure communication device provided in an embodiment of the fifth aspect of this application is shown below. Figure 9 As shown, the secure communication device 600 may include a processing module 601 and a transmitting module 602.

[0116] The processing module 601 can be used to receive a call initiated by the PKI service platform in response to a certificate request message sent by the terminal device when a one-way secure transport layer protocol (TLS) link is established between the terminal device and the public key infrastructure (PKI) service platform. It can also verify the SIM card in the terminal device based on the certificate request message, and decrypt the certificate request message using the first private key corresponding to the SIM card to obtain the decryption result. The certificate request message is obtained by the terminal device by encrypting it using the first public key in the SIM card in the terminal device based on device information and service information.

[0117] The sending module 602 can be used to send the decryption result back to the PKI service platform, so that the PKI service platform can issue a device certificate to the terminal device through a one-way TLS link when the decryption result indicates that the decryption was successful.

[0118] In some embodiments, the device information includes the SIM card identifier of the SIM card. The processing module 601 may be specifically configured to: obtain the SIM card identifier from the certificate request message; verify the SIM card using the SIM card identifier, the SIM card verification including legitimacy verification and / or attribution verification; if the SIM card verification is successful, obtain a first private key corresponding to the SIM card identifier based on the SIM card identifier; and decrypt the certificate request message using the first private key to obtain a decryption result.

[0119] In some embodiments, the device information in the certificate request message is used by the PKI service platform to determine whether the terminal device has access rights. The processing module 601 may specifically be used to: accept a call initiated by the PKI service platform in response to the certificate request message sent by the terminal device, provided that the PKI service platform determines that the terminal device has the necessary permissions.

[0120] In some examples, the device certificate includes a first public key, device information, certificate information, and a digital signature, which is generated based on a second private key from the PKI service platform.

[0121] In some embodiments, the processing module 601 can also be used to: accept a call from the PKI service platform to obtain the first public key corresponding to the first public key, when the PKI service platform uses its second private key to decrypt the device certificate in the received service message to obtain the first public key. The first private key is used to decrypt the first ciphertext to obtain service information. The service message includes a device certificate and the first ciphertext, which is obtained by the terminal device encrypting the service information using the first public key.

[0122] The sixth aspect of this application provides a terminal device having a SIM card. Figure 10 This is a schematic diagram of the structure of a terminal device provided in an embodiment of the sixth aspect of this application, as shown below. Figure 10 As shown, the terminal device 700 may include a message generation module 701, a sending module 702, and a receiving module 703.

[0123] The message generation module 701 can be used to encrypt and obtain a certificate application message based on the device information and service information of the terminal device and the first public key in the SIM card when a one-way secure transport layer protocol TLS link is established between the terminal device and the public key infrastructure PKI service platform.

[0124] The sending module 702 can be used to send a certificate application message to the PKI service platform, so that the PKI service platform can call the function interface of the SIM card management platform, and the SIM card management platform can verify the SIM card in the terminal device based on the certificate application message and decrypt the certificate application message using the first private key corresponding to the SIM card to obtain the decryption result.

[0125] The receiving module 703 can be used to receive the device certificate issued by the PKI service platform through a one-way TLS link when the decryption result indicates that the decryption was successful.

[0126] In some embodiments, the device information includes a SIM card identifier. The SIM card identifier is used by the SIM card management platform for SIM card verification, which includes legitimacy verification and / or attribution verification. If the SIM card verification is successful, the SIM card management platform uses the SIM card identifier to obtain a first private key corresponding to the SIM card identifier.

[0127] In some embodiments, the device information in the certificate application message is used by the PKI service platform to determine whether the terminal device has access rights. If the terminal device has access rights, the PKI service platform calls the function interface of the SIM card management platform.

[0128] In some examples, the device certificate includes a first public key, device information, certificate information, and a digital signature, which is generated based on a second private key from the PKI service platform.

[0129] In some embodiments, if the number of times a terminal device sends certificate application messages to a PKI service platform within a preset time period meets a preset security risk condition, the terminal device's access to the PKI service platform is restricted by the PKI service platform.

[0130] In some embodiments, the message generation module 701 can also be used to: encrypt the first ciphertext using the first public key based on the business information, and generate a business message based on the first ciphertext and the device certificate.

[0131] The sending module 702 can also be used to: send a service message to the PKI service platform so that the PKI service platform can use its second private key to decrypt the device certificate to obtain the first public key, and use the first public key to call the function interface of the SIM card management platform to obtain the first private key, and use the first private key to decrypt the first ciphertext to obtain the service information.

[0132] In some embodiments, the PKI service platform has a root certificate. The terminal device 700 may also include a secure channel establishment module, which can be used to establish a bidirectional secure channel with the PKI service platform if the verification of the device certificate by the PKI service platform using the root certificate is successful.

[0133] It should be noted that the aforementioned secure communication device 500, secure communication device 600, and terminal device 700 are devices corresponding to the aforementioned secure communication method. All implementation methods in the above method embodiments are applicable to the embodiments of the aforementioned secure communication device 500, secure communication device 600, and terminal device 700, and can achieve the same technical effect.

[0134] The seventh aspect of this application provides a secure communication device that can be applied to a PKI service platform. Figure 11 A schematic diagram of the structure of a secure communication device provided in an embodiment of the seventh aspect of this application is shown below. Figure 11 As shown, the secure communication device 800 includes a memory 801, a processor 802, and a computer program stored in the memory 801 and executable on the processor 802.

[0135] In some examples, the processor 802 described above may include a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits that may be configured to implement the embodiments of this application.

[0136] Memory 801 may include read-only memory (ROM), random access memory (RAM), disk storage media device, optical storage media device, flash memory device, electrical, optical, or other physical / tangible memory storage device. Therefore, typically, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the secure communication method in the first aspect embodiment of this application.

[0137] The processor 802 runs a computer program corresponding to the executable program code by reading the executable program code stored in the memory 801, so as to implement the secure communication method in the first aspect embodiment described above.

[0138] In some examples, the secure communication device 800 may also include a communication interface 803 and a bus 804. For example, Figure 11 As shown, the memory 801, processor 802, and communication interface 803 are connected through bus 804 and complete communication with each other.

[0139] The communication interface 803 is mainly used to enable communication between various modules, devices, units, and / or equipment in the embodiments of this application. Input devices and / or output devices can also be connected through the communication interface 803.

[0140] Bus 804 includes hardware, software, or both, that couples the components of secure communication device 800 together. For example, and not as a limitation, bus 804 may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-E) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 804 may include one or more buses. Although specific buses are described and illustrated in the embodiments of this application, this application considers any suitable bus or interconnection.

[0141] This application provides an eighth aspect of a secure communication device applicable to a SIM card management platform. The secure communication device may include a memory, a processor, and a computer program stored in the memory and executable on the processor.

[0142] The memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform operations described with reference to the secure communication method in the second aspect embodiment of the present application.

[0143] The processor runs a computer program corresponding to the executable program code by reading the executable program code stored in the memory, in order to implement the secure communication method in the second aspect embodiment described above.

[0144] In some examples, secure communication devices may also include a communication interface and a bus. The memory, processor, and communication interface are connected via the bus to communicate with each other.

[0145] The specific implementation methods and connection relationships of the memory, processor, communication interface and bus can be found in the relevant description of the secure communication device 800 in the above embodiments, and will not be repeated here.

[0146] A ninth aspect of this application provides a terminal device having a SIM card. The terminal device may include a memory, a processor, and a computer program stored in the memory and executable on the processor.

[0147] The memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform operations described with reference to the secure communication method in the third aspect embodiment of the present application.

[0148] The processor runs a computer program corresponding to the executable program code by reading the executable program code stored in the memory, in order to implement the secure communication method in the third aspect embodiment described above.

[0149] In some examples, the terminal device may also include a communication interface and a bus. The memory, processor, and communication interface are connected via the bus to communicate with each other.

[0150] The specific implementation methods and connection relationships of the memory, processor, communication interface and bus can be found in the relevant description of the secure communication device 800 in the above embodiments, and will not be repeated here.

[0151] This application provides a tenth aspect of a secure communication system. The secure communication system may include a PKI service platform, a SIM card management platform, and a terminal device. The PKI service platform is used to execute the secure communication method described in the first aspect embodiment above, the SIM card management platform is used to execute the secure communication method described in the second aspect embodiment above, and the terminal device is used to execute the secure communication method described in the third aspect embodiment above. For details regarding the PKI service platform, SIM card management platform, terminal device, and their respective executed secure communication methods, please refer to the relevant descriptions in the above embodiments, which achieve the same technical effects. To avoid repetition, these details will not be repeated here.

[0152] The eleventh aspect of this application provides a computer-readable storage medium storing computer program instructions. When executed by a processor, these computer program instructions can implement the secure communication methods described in the first, second, or third aspects of the above-described embodiment, achieving the same technical effects. To avoid repetition, further details are omitted here. The aforementioned computer-readable storage medium may include non-transitory computer-readable storage media, such as read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks, etc., and is not limited thereto.

[0153] The twelfth aspect of this application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the secure communication method in the first aspect embodiment, the secure communication method in the second aspect embodiment, or the secure communication method in the third aspect embodiment, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0154] It should be clarified that the various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. For the device embodiments, equipment embodiments, system embodiments, computer-readable storage medium embodiments, and computer program product embodiments, the relevant parts can be referred to the description section of the method embodiments. This application is not limited to the specific steps and structures described above and shown in the figures. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application. Furthermore, for the sake of brevity, detailed descriptions of known methods and techniques are omitted here.

[0155] The aspects of this application have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by dedicated hardware performing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0156] Those skilled in the art will understand that the above embodiments are exemplary and not restrictive. Different technical features appearing in different embodiments can be combined to achieve beneficial effects. Based on a study of the drawings, specification, and claims, those skilled in the art should be able to understand and implement other variations of the disclosed embodiments. In the claims, the term "comprising" does not exclude other means or steps; the quantifier "a" does not exclude a plurality; the terms "first" and "second" are used to identify names and not to indicate any particular order. No reference numerals in the claims should be construed as limiting the scope of protection. The functionality of multiple parts appearing in the claims can be implemented by a single hardware or software module. The appearance of certain technical features in different dependent claims does not mean that these technical features cannot be combined to achieve beneficial effects.

Claims

1. A secure communication method, characterized by, The method, applied to a Public Key Infrastructure (PKI) service platform, includes: When a one-way secure transport layer protocol (TLS) link is established between the terminal device and the PKI service platform, a certificate application message sent by the terminal device is received. The certificate application message is obtained by the terminal device by encrypting it using the first public key in the user identification SIM card of the terminal device based on the device information and service information of the terminal device. The function interface of the SIM card management platform is called so that the SIM card management platform can verify the SIM card in the terminal device based on the certificate application message and decrypt the certificate application message using the first private key corresponding to the SIM card to obtain the decryption result; If the decryption result indicates successful decryption, a device certificate is generated for the terminal device corresponding to the certificate application message, and the device certificate is sent to the terminal device through the one-way TLS link.

2. The method of claim 1, wherein, The device information includes the SIM card identifier of the SIM card; The SIM card identifier is used by the SIM card management platform to verify the SIM card. The SIM card verification includes legality verification and / or attribution verification. If the SIM card verification is successful, the SIM card identifier is used by the SIM card management platform to obtain the first private key corresponding to the SIM card identifier.

3. The method of claim 1, wherein, The function interface for calling the SIM card management platform includes: Obtain the device information from the certificate application message, and determine whether the terminal device has access rights based on the device information; If the terminal device has the necessary access permissions, it invokes the functional interface of the SIM card management platform.

4. The method of claim 1, wherein, The device certificate includes the first public key, the device information, certificate information, and a digital signature, wherein the digital signature is generated based on the second private key of the PKI service platform.

5. The method of claim 1, wherein, Also includes: If the number of times the certificate application message is received from the terminal device within a preset time period meets the preset security risk conditions, then the terminal device's access to the PKI service platform will be restricted.

6. The method of claim 1, wherein, After issuing the device certificate to the terminal device via the TLS link, the process further includes: The terminal device receives a service message sent by the terminal device. The service message includes the device certificate and a first ciphertext, which is obtained by the terminal device using the first public key based on the service information. The device certificate is decrypted using the second private key of the PKI service platform, and the first public key is obtained from the device certificate; Based on the first public key, the first private key is obtained from the SIM card management platform by calling the function interface of the SIM card management platform, and the first ciphertext is decrypted using the first private key to obtain the business information.

7. The method of claim 6, wherein, The PKI service platform has a root certificate; After receiving the service message sent by the terminal device, the method further includes: The device certificate is verified using the root certificate; If the device certificate verification is successful, a two-way secure channel is established with the terminal device.

8. A secure communication method, characterized in that, The method, applied to a user identification SIM card management platform, includes: When a one-way secure transport layer protocol (TLS) link is established between a terminal device and a public key infrastructure (PKI) service platform, the system accepts a call initiated by the PKI service platform in response to a certificate request message sent by the terminal device. Based on the certificate request message, the system verifies the SIM card in the terminal device and decrypts the certificate request message using the first private key corresponding to the SIM card to obtain a decryption result. The certificate request message is obtained by the terminal device by encrypting it using the first public key in the SIM card in the terminal device based on device information and service information. The decryption result is fed back to the PKI service platform, so that if the decryption result indicates that the decryption was successful, the PKI service platform generates a device certificate for the terminal device corresponding to the certificate application message, and issues the device certificate to the terminal device through the one-way TLS link.

9. The method according to claim 8, characterized in that, The device information includes the SIM card identifier of the SIM card; The step of verifying the SIM card in the terminal device based on the certificate request message, and decrypting the certificate request message using the first private key corresponding to the SIM card to obtain the decryption result, includes: The SIM card identifier is obtained from the certificate application message, and the SIM card is verified using the SIM card identifier. The SIM card verification includes legality verification and / or attribution verification. If the SIM card is successfully verified, the first private key corresponding to the SIM card identifier is obtained based on the SIM card identifier; The certificate application message is decrypted using the first private key to obtain the decryption result.

10. The method according to claim 8, characterized in that, The device information in the certificate application message is used by the PKI service platform to determine whether the terminal device has access rights. The call initiated by the PKI service platform in response to the certificate request message sent by the terminal device includes: If the PKI service platform determines that the terminal device has the necessary permissions, it will accept the call initiated by the PKI service platform in response to the certificate request message sent by the terminal device.

11. The method according to claim 8, characterized in that, The device certificate includes the first public key, the device information, certificate information, and a digital signature, wherein the digital signature is generated based on the second private key of the PKI service platform.

12. The method according to claim 8, characterized in that, Also includes: When the PKI service platform uses its second private key to decrypt the device certificate in the received service message to obtain the first public key, the system accepts a call from the PKI service platform to obtain the first private key corresponding to the first public key. The first private key is used to decrypt the first ciphertext to obtain the service information. The service message includes the device certificate and the first ciphertext, which is obtained by the terminal device using the first public key based on the service information.

13. A secure communication method, characterized in that, Applied to a terminal device having a user identification SIM card, the method includes: When the terminal device establishes a one-way secure transport layer protocol (TLS) link with the public key infrastructure (PKI) service platform, the certificate application message is encrypted using the first public key in the SIM card based on the device information and service information of the terminal device. The certificate application message is sent to the PKI service platform so that the PKI service platform can call the function interface of the SIM card management platform. The SIM card management platform verifies the SIM card in the terminal device based on the certificate application message and decrypts the certificate application message using the first private key corresponding to the SIM card to obtain the decryption result. If the decryption result indicates successful decryption, the PKI service platform generates a device certificate for the terminal device corresponding to the certificate application message and receives the device certificate issued by the PKI service platform through the one-way TLS link.

14. The method according to claim 13, characterized in that, The device information includes the SIM card identifier of the SIM card; The SIM card identifier is used by the SIM card management platform to verify the SIM card. The SIM card verification includes legality verification and / or attribution verification. If the SIM card verification is successful, the SIM card identifier is used by the SIM card management platform to obtain the first private key corresponding to the SIM card identifier.

15. The method according to claim 13, characterized in that, The device information in the certificate application message is used by the PKI service platform to determine whether the terminal device has access rights. If the terminal device has access rights, the PKI service platform calls the function interface of the SIM card management platform.

16. The method according to claim 13, characterized in that, The device certificate includes the first public key, the device information, certificate information, and a digital signature, wherein the digital signature is generated based on the second private key of the PKI service platform.

17. The method according to claim 13, characterized in that, If the number of times the terminal device sends the certificate application message to the PKI service platform within a preset time period meets the preset security risk conditions, the terminal device's access to the PKI service platform will be restricted by the PKI service platform.

18. The method according to claim 13, characterized in that, After receiving the device certificate issued by the PKI service platform via the one-way TLS link, the method further includes: Based on the business information, the first ciphertext is obtained by encrypting it using the first public key, and a business message is generated based on the first ciphertext and the device certificate. The service message is sent to the PKI service platform so that the PKI service platform can use its second private key to decrypt the device certificate to obtain the first public key, and use the first public key to call the function interface of the SIM card management platform to obtain the first private key. The first private key is then used to decrypt the first ciphertext to obtain the service information.

19. The method according to claim 18, characterized in that, The PKI service platform has a root certificate; After sending the service message to the PKI service platform, the method further includes: If the PKI service platform verifies the device certificate using the root certificate and the verification is successful, a two-way secure channel is established with the PKI service platform.

20. A secure communication device, characterized in that, The device, applied to a Public Key Infrastructure (PKI) service platform, includes: The receiving module is used to receive a certificate application message sent by the terminal device when a one-way secure transport layer protocol (TLS) link is established between the terminal device and the PKI service platform. The certificate application message is obtained by the terminal device by encrypting it using the first public key in the user identification SIM card of the terminal device based on the device information and service information of the terminal device. The interface call module is used to call the function interface of the SIM card management platform, so that the SIM card management platform can verify the SIM card in the terminal device based on the certificate application message and decrypt the certificate application message using the first private key corresponding to the SIM card to obtain the decryption result; The sending module is used to generate a device certificate for the terminal device corresponding to the certificate application message when the decryption result indicates that the decryption was successful, and to send the device certificate to the terminal device through the one-way TLS link.

21. A secure communication device, characterized in that, The device, used in a user identification SIM card management platform, includes: The processing module is configured to, when a one-way Secure Transport Layer Protocol (TLS) link is established between the terminal device and the Public Key Infrastructure (PKI) service platform, accept a call initiated by the PKI service platform in response to a certificate request message sent by the terminal device, verify the SIM card in the terminal device based on the certificate request message, and decrypt the certificate request message using the first private key corresponding to the SIM card to obtain a decryption result. The certificate request message is obtained by the terminal device by encrypting it using the first public key in the SIM card in the terminal device based on device information and service information. The sending module is used to send the decryption result back to the PKI service platform, so that if the decryption result indicates that the decryption was successful, the PKI service platform will generate a device certificate for the terminal device corresponding to the certificate application message and issue the device certificate to the terminal device through the one-way TLS link.

22. A terminal device, characterized in that, The terminal device includes a user identification SIM card. The terminal device comprises: The message generation module is used to encrypt a certificate application message using the first public key in the SIM card, based on the device information and service information of the terminal device, when a one-way secure transport layer protocol TLS link is established between the terminal device and the public key infrastructure PKI service platform. The sending module is used to send the certificate application message to the PKI service platform, so that the PKI service platform can call the function interface of the SIM card management platform, and the SIM card management platform can verify the SIM card in the terminal device based on the certificate application message and decrypt the certificate application message using the first private key corresponding to the SIM card to obtain the decryption result. The receiving module is configured to, when the decryption result indicates successful decryption, generate a device certificate for the terminal device corresponding to the certificate application message through the PKI service platform, and receive the device certificate issued by the PKI service platform through the one-way TLS link.

23. A secure communication device, characterized in that, The device, used in a Public Key Infrastructure (PKI) service platform, includes: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, it implements the secure communication method as described in any one of claims 1 to 7.

24. A secure communication device, characterized in that, The device, used in a user identification SIM card management platform, includes: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, it implements the secure communication method as described in any one of claims 8 to 12.

25. A terminal device, characterized in that, The terminal device has a user identification SIM card, and the terminal device includes: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, it implements the secure communication method as described in any one of claims 13 to 19.

26. A secure communication system, characterized in that, include: A public key infrastructure (PKI) service platform for executing the secure communication method as described in any one of claims 1 to 7; The user identification SIM card management platform is communicatively connected to the PKI service platform and is used to execute the secure communication method as described in any one of claims 8 to 12. The terminal device is communicatively connected to the PKI service platform and is used to execute the secure communication method as described in any one of claims 13 to 19.

27. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions that, when executed by a processor, implement the secure communication method as described in any one of claims 1 to 19.

28. A computer program product, characterized in that, It includes a computer program that, when executed by a processor, implements the secure communication method according to any one of claims 1 to 19.

Images