Identity authentication method and device of SIM card, equipment and storage medium

Abstract

The invention provides an identity authentication method and device of an SIM card, equipment and a storage medium, and relates to the technical field of intelligent cards. The method comprises the following steps: a security platform obtains an identity authentication request which is sent by a terminal device and carries a card identity public key corresponding to an SIM card, and forwards the identity authentication request to an NAF platform; the NAF platform verifies the card identity public key based on a first verification key mechanism, generates first SIM card identity information, and returns the first SIM card identity information to the security platform; and the security platform verifies the card identity public key based on a second verification key mechanism different from the first verification key mechanism, generates second SIM card identity information, generates an authentication result for indicating whether the SIM card passes identity authentication according to the first SIM card identity information and the second SIM card identity information, and returns the authentication result to the terminal device. According to the method, the technical effect of improving the accuracy of the SIM card identity authentication result is achieved.

Description

Technical Field

[0001] The present application relates to the field of smart card technology, and in particular to an identity authentication method, device, equipment and storage medium for a SIM card. Background Art

[0002] With the development of Internet-related technologies, more and more networked applications are carried on mobile terminals. In order to ensure the security and integrity of information transmitted online, user identity authentication is required. Among them, authenticating user identity through Subscriber Identity Module (SIM) is one of the main methods in authentication technology.

[0003] The existing SIM card authentication method presets the card identity public key into the SIM card when authenticating different business systems and SIM cards, and synchronizes the card identity public key and the device key (card application access credential) through manual offline transmission to complete the SIM card identity authentication.

[0004] However, the prior art has the technical problem that the identity authentication result of the SIM card is inaccurate. Summary of the invention

[0005] The present application provides a SIM card identity authentication method, device, equipment and storage medium, which are used to solve the technical problem of inaccurate identity authentication results of SIM cards in the prior art.

[0006] In a first aspect, the present application provides a SIM card identity authentication method, which is applied to a security platform, including:

[0007] Obtaining an identity authentication request sent by a terminal device, wherein the identity authentication request carries a card identity public key of a SIM card installed in the terminal device;

[0008] Forwarding the identity authentication request to the NAF platform;

[0009] Acquire the first SIM card identity information returned by the NAF platform, where the first SIM card identity information is obtained by the NAF platform verifying the card identity public key based on a first verification key mechanism;

[0010] Verifying the card identity public key based on a second verification key mechanism to generate second SIM card identity information, wherein the first verification key mechanism and the second verification key mechanism are different;

[0011] An authentication result is generated according to the first SIM card identity information and the second SIM card identity information and is returned to the terminal device, where the authentication result is used to indicate whether the SIM card passes identity authentication.

[0012] Optionally, generating and returning an authentication result to the terminal device according to the first SIM card identity information and the second SIM card identity information includes:

[0013] If the identity information of the first SIM card is consistent with the identity information of the second SIM card, generating and returning to the terminal device an authentication result indicating that the SIM card has passed the identity authentication;

[0014] If the first SIM card identity information and the second SIM card identity information are inconsistent, an authentication result indicating that the SIM card has failed identity authentication is generated and returned to the terminal device.

[0015] Optionally, the method further comprises:

[0016] After the authentication result indicates that the SIM card has passed the identity authentication, the platform identity public key and public key HMAC data are returned to the terminal device; wherein the public key HMAC data is used to represent the HMAC data generated after the card identity public key is HMAC protected.

[0017] Optionally, before obtaining the identity authentication request sent by the terminal device, the method further includes:

[0018] Obtaining an access key acquisition request sent by the terminal device, wherein the access key acquisition request includes a tenant identifier and a target service application identifier;

[0019] Creating a target business application container corresponding to the tenant identifier and the target business application identifier according to the access key acquisition request, and allocating an access key to the target business application container;

[0020] The access key is returned to the terminal device.

[0021] Optionally, the method further comprises:

[0022] Receive a certificate acquisition request sent by the terminal device, where the certificate acquisition request includes a tenant identifier, a target service application identifier, and the SIM card identifier;

[0023] Obtain a target certificate according to the certificate acquisition request;

[0024] Storing the target certificate in the target business application container corresponding to the tenant identifier and the target business application identifier;

[0025] The target certificate is returned to the terminal device.

[0026] In a second aspect, the present application provides a SIM card identity authentication method, which is applied to a NAF platform, including:

[0027] Obtaining an identity authentication request sent by the security platform, wherein the identity authentication request carries the card identity public key of the SIM card;

[0028] Verify the card identity public key based on the first verification key mechanism to generate first SIM card identity information;

[0029] The first SIM card identity information is returned to the security platform, so that the security platform generates an authentication result according to the first SIM card identity information and the second SIM card identity information, wherein the second SIM card identity information is obtained by the security platform through verification of the card identity public key based on a second verification key mechanism, and the authentication result is used to indicate whether the SIM card passes the identity authentication, and the first verification key mechanism and the second verification key mechanism are different.

[0030] In a third aspect, the present application provides a SIM card identity authentication method, which is applied to a terminal device, including:

[0031] Sending an identity authentication request to the security platform, wherein the identity authentication request carries the card identity public key of the SIM card installed in the terminal device;

[0032] Obtain an authentication result, where the authentication result is generated by the security platform based on the first SIM card identity information and the second SIM card identity information, where the first SIM card identity information is obtained by the NAF platform verifying the card identity public key based on a first verification key mechanism, and the second SIM identity information is obtained by the security platform verifying the card identity public key based on a second verification key mechanism, where the first verification key mechanism and the second verification key mechanism are different, and the authentication result is used to indicate whether the SIM card passes the identity authentication.

[0033] Optionally, sending an identity authentication request to the security platform includes:

[0034] Obtaining the initial card identity public key of the SIM card in the terminal device through the security SDK of the target service application;

[0035] Perform HMAC protection on the initial card identity public key of the SIM card to generate the card identity public key;

[0036] According to the card identity public key, the identity authentication request is generated and sent to the security platform.

[0037] Optionally, after the authentication result indicates that the SIM card passes the identity authentication, the method further includes:

[0038] Receive the platform identity public key and public key HMAC data sent by the security platform, wherein the public key HMAC data is used to represent the HMAC data generated after the card identity public key is HMAC protected.

[0039] Optionally, before sending the identity authentication request to the security platform, the method further includes:

[0040] Sending an access key acquisition request to the security platform through the security SDK of the target business application, wherein the access key acquisition request includes a tenant identifier and a target business application identifier;

[0041] Obtain an access key sent by the security platform.

[0042] Optionally, the method further comprises:

[0043] Sending a certificate acquisition request to the security platform through the security SDK of the target business application, wherein the certificate acquisition request includes a tenant identifier, a target business application identifier, and the SIM card identifier;

[0044] Obtain the target certificate sent by the security platform.

[0045] In a fourth aspect, the present application provides an identity authentication device for a SIM card, which is applied to a security platform, including:

[0046] An acquisition module is used to acquire an identity authentication request sent by a terminal device, wherein the identity authentication request carries a card identity public key of a SIM card installed in the terminal device;

[0047] A sending module, used for forwarding the identity authentication request to the NAF platform;

[0048] The acquisition module is further used to acquire the first SIM card identity information returned by the NAF platform, where the first SIM card identity information is obtained by the NAF platform verifying the card identity public key based on a first verification key mechanism;

[0049] a verification module, configured to verify the card identity public key based on a second verification key mechanism to generate second SIM card identity information, wherein the first verification key mechanism and the second verification key mechanism are different;

[0050] The generating module is used to generate and return an authentication result to the terminal device according to the first SIM card identity information and the second SIM card identity information, wherein the authentication result is used to indicate whether the SIM card passes the identity authentication.

[0051] Optionally, the generating module is further used to:

[0052] If the identity information of the first SIM card is consistent with the identity information of the second SIM card, generating and returning to the terminal device an authentication result indicating that the SIM card has passed the identity authentication;

[0053] If the first SIM card identity information and the second SIM card identity information are inconsistent, an authentication result indicating that the SIM card has failed identity authentication is generated and returned to the terminal device.

[0054] Optionally, the sending module is further used to:

[0055] After the authentication result indicates that the SIM card has passed the identity authentication, the platform identity public key and public key HMAC data are returned to the terminal device; wherein the public key HMAC data is used to represent the HMAC data generated after the card identity public key is HMAC protected.

[0056] Optionally, the device further comprises: a processing module;

[0057] The acquisition module is further used to acquire an access key acquisition request sent by the terminal device, wherein the access key acquisition request includes a tenant identifier and a target service application identifier;

[0058] The processing module is used to create a target business application container corresponding to the tenant identifier and the target business application identifier according to the access key acquisition request, and allocate an access key to the target business application container;

[0059] The sending module is also used to return the access key to the terminal device.

[0060] Optionally, the device further includes: a receiving module and a storage module;

[0061] The receiving module is used to receive a certificate acquisition request sent by the terminal device, where the certificate acquisition request includes a tenant identifier, a target service application identifier, and the SIM card identifier;

[0062] The acquisition module is further used to acquire the target certificate according to the certificate acquisition request;

[0063] The storage module is used to store the target certificate in the target business application container corresponding to the tenant identifier and the target business application identifier;

[0064] The sending module is further configured to return the target certificate to the terminal device.

[0065] In a fifth aspect, the present application provides a SIM card identity authentication device, which is applied to a NAF platform, including:

[0066] An acquisition module is used to acquire an identity authentication request sent by a security platform, wherein the identity authentication request carries a card identity public key of a SIM card;

[0067] A verification module, used to verify the card identity public key based on a first verification key mechanism to generate first SIM card identity information;

[0068] a sending module, configured to return the first SIM card identity information to the security platform, so that the security platform generates an authentication result according to the first SIM card identity information and the second SIM card identity information, wherein the second SIM card identity information is obtained by the security platform through verification of the card identity public key based on a second verification key mechanism, and the authentication result is used to indicate whether the SIM card passes the identity authentication, and the first verification key mechanism and the second verification key mechanism are different.

[0069] In a sixth aspect, the present application provides a SIM card identity authentication device, applied to a terminal device, including:

[0070] A sending module, used to send an identity authentication request to the security platform, wherein the identity authentication request carries a card identity public key of the SIM card installed in the terminal device;

[0071] an acquisition module, used for acquiring an authentication result, wherein the authentication result is generated by the security platform based on the first SIM card identity information and the second SIM card identity information, wherein the first SIM card identity information is obtained by the NAF platform verifying the card identity public key based on a first verification key mechanism, and the second SIM identity information is obtained by the security platform verifying the card identity public key based on a second verification key mechanism, wherein the first verification key mechanism and the second verification key mechanism are different, and the authentication result is used to indicate whether the SIM card passes the identity authentication.

[0072] Optionally, the device further comprises: a processing module;

[0073] The acquisition module is further used to acquire the initial card identity public key of the SIM card in the terminal device through the security SDK of the target service application;

[0074] The processing module is used to perform HMAC protection on the initial card identity public key of the SIM card to generate the card identity public key; and generate and send the identity authentication request to the security platform according to the card identity public key.

[0075] Optionally, the device further includes: a receiving module, used to receive the platform identity public key and public key HMAC data sent by the security platform, wherein the public key HMAC data is used to represent the HMAC data generated after HMAC protection of the card identity public key.

[0076] Optionally, the sending module is further used to send an access key acquisition request to the security platform through a security SDK of the target business application, where the access key acquisition request includes a tenant identifier and a target business application identifier;

[0077] The acquisition module is also used to acquire the access key sent by the security platform.

[0078] Optionally, the sending module is further used to send a certificate acquisition request to the security platform through the security SDK of the target business application, where the certificate acquisition request includes a tenant identifier, a target business application identifier, and the SIM card identifier;

[0079] The acquisition module is also used to acquire the target certificate sent by the security platform.

[0080] In a seventh aspect of the present application, a server is provided, including:

[0081] Processor and memory;

[0082] Wherein, the memory stores computer-executable instructions;

[0083] The processor executes the computer-executable instructions stored in the memory to implement the SIM card identity authentication method as described in the first and second aspects and various possible implementations of the first and second aspects.

[0084] In an eighth aspect of the present application, a SIM card identity authentication device is provided, including:

[0085] Processor and memory;

[0086] Wherein, the memory stores computer-executable instructions;

[0087] The processor executes the computer-executable instructions stored in the memory to implement the SIM card identity authentication method as described in the third aspect and various possible implementations of the third aspect.

[0088] In a ninth aspect, the present application provides a computer-readable storage medium, which stores computer execution instructions. When the computer execution instructions are executed by a processor, they are used to implement the SIM card identity authentication method as described in the first to third aspects and various possible implementation methods of the first to third aspects above.

[0089] In a tenth aspect, the present application provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it is used to implement the SIM card identity authentication method as described in the first to third aspects and various possible implementation methods of the first to third aspects above.

[0090] The SIM card identity authentication method, apparatus, device and storage medium provided by the present application, in which an identity authentication request sent by a terminal device is obtained through a security platform, and the identity authentication request is forwarded to a NAF platform, wherein the identity authentication request carries a card identity public key of a SIM card installed in the terminal device; the security platform uses a SIM card security chip as a trusted carrier to implement secure storage of sensitive information such as keys and digital certificates, thereby avoiding the inability to simultaneously support access to multiple operators or business applications; the NAF platform verifies the card identity public key based on a first verification key mechanism, generates a first SIM card identity information, and returns the first SIM card identity information to the security platform ; The security platform verifies the card identity public key based on a second verification key mechanism different from the first verification key mechanism, generates a second SIM card identity information, and generates an authentication result indicating whether the SIM card has passed the identity authentication based on the first SIM card identity information and the second SIM card identity information, and returns the authentication result to the terminal device; The NAF platform and the security platform respectively verify the card identity public key of the SIM card through the pre-set first verification key mechanism and the second verification key mechanism, thereby reducing the possibility of data leakage caused by manual operation, thereby improving the processing speed of the card identity public key, and achieving the technical effect of improving the accuracy of the identity authentication result of the SIM card. BRIEF DESCRIPTION OF THE DRAWINGS

[0091] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0092] Figure 1 The overall architecture diagram of the SIM card identity authentication method provided in this application;

[0093] Figure 2 Functional diagram of the security platform provided for this application;

[0094] Figure 3 An interactive flow chart of the SIM card identity authentication method provided in this application;

[0095] Figure 4 SIM card identity authentication method flow provided for this application Figure 1 ;

[0096] Figure 5 SIM card identity authentication method flow provided for this application Figure 2 ;

[0097] Figure 6 SIM card identity authentication method flow provided for this application Figure 3 ;

[0098] Figure 7 SIM card identity authentication method flow provided for this application Figure 4 ;

[0099] Figure 8 Schematic diagram of the structure of the SIM card identity authentication device provided in this application Figure 1 ;

[0100] Fig. 9 Schematic diagram of the structure of the SIM card identity authentication device provided in this application Figure 2 ;

[0101] Fig.10 Schematic diagram of the structure of the SIM card identity authentication device provided in this application Figure 3 ;

[0102] Fig.11 A hardware structure diagram of a server provided for this application;

[0103] Fig.12 A hardware structure diagram of a terminal device provided for this application.

[0104] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0105] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0106] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in sequences other than those illustrated or described herein, for example.

[0107] In the embodiments of the present application, the words "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0108] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0109] In order to ensure the security and integrity of information transmitted online, user identity authentication is an indispensable step. Authentication of user identity through SIM card is one of the main technical means to achieve this goal. Therefore, SIM card authentication technology plays an important role in many fields such as mobile communications and the Internet of Things. SIM card plays a core role in mobile communication networks and is mainly used to identify and authenticate user identities. Each SIM card has a unique identifier, as well as encryption keys and algorithms stored in the card, which are key elements for authenticating user identities.

[0110] However, traditional SIM cards are usually designed for a single operator or a single business application. When performing SIM card identity authentication, the authentication process between different business systems and SIM cards is cumbersome, and it is usually necessary to manually preset the platform credential public key into the SIM card. This manual operation is not only inefficient and error-prone, but also increases management complexity. In addition, traditional authentication and credential management methods often rely on manual offline transmission of card credential public keys and device keys. This method has a high security risk because data leakage or tampering may occur during the transmission process, resulting in inaccurate SIM card identity authentication results.

[0111] In view of the above technical problems, the inventors found in the process of studying the identity authentication of SIM that the synchronization of the card credential public key and the device key through manual offline transmission is the main cause of data leakage. Based on this, the inventors considered that data can be transmitted through relevant platforms to avoid manual operations. The security platform and the NAF platform are two widely used security authentication and management mechanisms. The accuracy of the SIM card authentication results can be improved by interacting with the security platform and the NAF platform, and authenticating the SIM card in the security platform and the NAF platform respectively.

[0112] Figure 1 The overall architecture diagram of the SIM card identity authentication method provided in this application is as follows: Figure 1 As shown, in order to adapt to complex multi-tenant and multi-service application scenarios, the security platform capability center is used as the carrier entity for basic data configuration, business application management, user information management, certificate issuance service, and log audit functions; it supports one card with multiple spaces (business applications), and each space supports multiple containers. Each container contains one / set of certificates and keys, that is, the same SIM card supports the issuance of certificates for multiple business applications, and different spaces are isolated from each other and user permissions are independently configured. In addition, the process of SIM card identity authentication through the security platform relies on the encrypted session channel established by the authentication and key negotiation mechanism of the Generic Bootstrapping Architecture (GBA) to synchronize the card identity public key and the platform identity public key; among them, GBA is a user authentication mechanism. When the client interacts with the GBA application server (Network Application Function, NAF) platform, user authentication and authorization are performed. A shared user key (KS_NAF) is established between the NAF platform and the SIM card-based terminal device application, and the shared key is used to implement user authentication.

[0113] Figure 2 The functional diagram of the security platform provided for this application is as follows: Figure 2 As shown in the figure, the overall architecture of the security platform includes the resource layer, capability layer, and interface layer. The terminal side of the resource layer includes a national secret SIM card (with a security chip), which serves as the trust root on the terminal side to carry keys, digital certificates, secure storage, and trusted encryption and decryption, as well as signature authentication functions; the platform side of the resource layer includes computing resources (service host), storage (database), and cryptographic modules, which carry the platform side key security storage and business operation management functions.

[0114] Figure 3 The interactive flow chart of the SIM card identity authentication method provided in this application is as follows: Figure 3As shown, the software part of the method is composed of a security card application, a security software development kit (SDK) and a security platform. The security card application is a smart card application running on a SIM card chip, and has functions such as key management, certificate management, secure storage, access control (PIN verification), and password services (encryption and decryption, signature verification). The security SDK runs in business applications and provides security card application capability calls to applications on terminal devices with a standard, unified, friendly and easy-to-use interface protocol. The security SDK provides SKF-C version and JAVA version, which are compatible with Android and Linux operating systems. The security platform provides product operation and fault diagnosis services to users. When Software as a Service (SaaS) deployment is carried out in the field of the Internet of Things, it provides services to users based on the Connectivity Management Platform (CMP) of the Internet of Things, which is responsible for operating and managing the functional platform of the SIM card, and providing SIM card operation and management services to global administrators and tenant administrators, and also includes interface services for the security SDK and the business application platform.

[0115] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0116] Figure 4 SIM card identity authentication method flow provided for this application Figure 1 .like Figure 4 As shown, an identity authentication method for a SIM card provided in an embodiment of the present application includes:

[0117] S101. The terminal device sends an identity authentication request to the security platform, wherein the identity authentication request carries the card identity public key installed in the SIM card.

[0118] As can be understood, a SIM card is a smart card used to store user identity and related information. The card identity public key of a SIM card is usually used to encrypt and verify communications to ensure the security and integrity of data. Specifically, the card identity public key of a SIM card is the public key part of an asymmetric encryption key pair. The card identity public key is usually generated by the manufacturer or issuing agency of the SIM card and written into the SIM card when the card is issued.

[0119] When a terminal device connects to the network through a SIM card, first, the security platform will initialize the connection with the SIM card, obtain the identity authentication request sent by the terminal device, and require the SIM card to provide its card identity public key; secondly, the SIM card sends its card identity public key to the security platform. The specific steps for the terminal device to send an identity authentication request to the security platform are as follows:

[0120] Step a1: The terminal device obtains the initial card identity public key of the SIM card through the security SDK of the target service application;

[0121] Step a2: The security card application running on the SIM card performs HMAC protection on the initial card identity public key of the SIM card to generate a card identity public key;

[0122] Specifically, the security SDK requests to export the initial card identity public key of the SIM card, and the security card application running on the SIM card exports the initial card identity public key and protects it with a Hash-based Message Authentication Code (HMAC).

[0123] Step a3: The terminal device generates an identity authentication request based on the card identity public key and sends it to the security platform.

[0124] It is understandable that in order to ensure the security, controllability and compliance of the terminal device when accessing the security platform, the security platform should allocate a corresponding access key to the terminal device before the terminal device sends an identity authentication request to the security platform. The specific steps are as follows:

[0125] Step b1: The terminal device sends an access key acquisition request to the security platform through the security SDK of the target business application; wherein the access key acquisition request includes a tenant identifier and a target business application identifier;

[0126] Step b2: The security platform creates a target business application container corresponding to the tenant identifier and the target business application identifier according to the access key acquisition request, and allocates an access key to the target business application container;

[0127] Step b3: The security platform returns the access key to the terminal device.

[0128] For example, Figure 5 SIM card identity authentication method flow provided for this application Figure 2 ,like Figure 5As shown, first, the security platform is initialized, and the target business application that interacts with the security platform corresponding to the terminal device is determined, wherein the initialization of the security platform specifically includes presetting the platform signature public and private key pair, encryption public and private key pair, protection key, default administrator personal identification number (PIN), card application version information, etc., and the platform presets the card public key and card credential import; secondly, according to the access key acquisition request including the tenant identifier and the target business application identifier sent by the terminal device, the corresponding target business application container is created, and the access key is assigned to the target business application container. It can be understood that the creation of the target business application container can support the access of multiple operators or business applications, which means that each SIM card can be bound to multiple specific networks or service providers, and can be flexibly adjusted according to the needs of different business applications.

[0129] Furthermore, after receiving the access key sent from the security platform, the terminal device needs to initialize the security SDK to complete the registration of the SIM card. The specific steps are as follows: obtain the security capabilities corresponding to the SIM card through the security SDK, and arrange and aggregate the security capabilities, where the security capabilities corresponding to the SIM card include certificate application, PIN code management, digital signature, encryption and decryption, secure storage, etc.; at the same time, the target business application sends parameters including tenant identification, target business application identification, access key and corresponding access key identification to the security SDK; based on the above parameters and the arranged and aggregated security capabilities, the SIM card status interface of the security platform is called through the security SDK to obtain the corresponding SIM card status information based on the SIM status interface; further, the security SDK obtains the SIM card status information returned by the security platform, processes the SIM card status information, and determines the card information parameters corresponding to the SIM card status information; at the same time, the device information parameters corresponding to the terminal device are determined, and the security SDK sends the card information parameters and the device information parameters to the security platform to register the SIM card.

[0130] In addition, in order to ensure that the communication between the security platform and the terminal device is secure, reliable and complete, the terminal device should also obtain the corresponding certificate from the security platform. The specific steps are as follows:

[0131] Step c1: The terminal device sends a certificate acquisition request to the security platform through the security SDK; wherein the certificate acquisition request includes the tenant ID, the target service application ID, and the SIM card ID;

[0132] Among them, after the SIM card is successfully registered, the security SDK sends the SIM card identifier corresponding to the SIM and the pre-set target random number signature to the security platform for verification. If the verification fails, the result of the failed verification returned by the security platform is received. If the verification succeeds, a certificate acquisition request is sent to the security platform through the security SDK.

[0133] Exemplarily, first, the security SDK concatenates the SIM card identifier and the target random number signature into a string or data block, uses an encryption algorithm (such as a cryptographic hash function) to generate a hash value for the string or database, and uses a private key to encrypt the hash value to generate a signature; secondly, the security platform receives the SIM card identifier and the target random number signature, uses the same encryption algorithm to generate a hash value for the received SIM card identifier and the target random number signature, and then uses the public key to decrypt the received signature to obtain the hash value generated by the SIM card; finally, compare the two hash values. If they are consistent, it means that the signature verification is successful, otherwise the signature verification fails.

[0134] Step c2: The security platform obtains the target certificate according to the certificate acquisition request;

[0135] For example, Figure 6 SIM card identity authentication method flow provided for this application Figure 3 ,like Figure 6 As shown, the corresponding administrator password is generated by processing and calculating the certificate information corresponding to the certificate space name and the container name, wherein the administrator password is usually a high-strength password used to access and configure security hardware; if the space in the SIM card requires multiple PIN codes, these PIN code information can be stored by configuring the card space PIN code information table, and then according to the administrator password, the target business application identifier and the SIM card identifier, the required PIN code is derived from the card space PIN code information table through a preset algorithm (such as a hash function).

[0136] During the process of generating the target certificate, the security SDK receives the PIN code sent by the security platform. Specifically, the security SDK enters the card application authentication process (creates an application, opens an application, creates a container, and opens a container). After the PIN code is verified, the security SDK executes the signature key pair generation process to generate a responsive signature key pair and certificate request information; the security SDK uses the signature key pair private key to sign the certificate request information, and then assembles the certificate request signature information. After the assembly is completed, the security SDK calls the security platform's certificate application interface to issue a certificate, so as to perform a certificate issuance operation based on the security platform and determine the corresponding issuance result.

[0137] Step c3: The security platform stores the target certificate in the target business application container corresponding to the tenant identifier and the target business application identifier, and returns the target certificate to the terminal device.

[0138] Specifically, the security platform calls the corresponding certificate information acquisition interface according to the received certificate acquisition request, and queries the certificate space name and container name associated with the target business application based on the certificate information acquisition interface, and analyzes the certificate space name and container name to determine the certificate information corresponding to the certificate space name and container name. Further, the security platform processes the certificate information to obtain the PIN code corresponding to the SIM card used to generate the target certificate; sends the PIN code to the security SDK running in the target business application for processing, and obtains the certificate issuance request returned by the security SDK. At this time, the security platform will call the certificate authority (CA) to issue the certificate online. After successful issuance, it will save the user's issued certificate list and return the successful issuance information to the security SDK to store the target certificate in the target business application container corresponding to the tenant identifier and the target business application identifier, and return the target certificate to the terminal device.

[0139] Furthermore, if the security SDK receives the information of successful issuance, it will execute the certificate saving process (import signature certificate, import encryption key pair, import encryption certificate, close container, close application), and support national secret dual certificates; after the certificate is saved successfully, the security SDK notifies the security platform of the certificate saving result so that the security platform can record the log.

[0140] S102: After the security platform obtains the identity authentication request, it forwards the identity authentication request to the NAF platform.

[0141] Among them, the NAF platform is a key component in GBA that interacts with the security platform. Its main functions and roles include secure communication, service access control, key management, authentication and authorization, and support for multiple applications. Among them, GBA is an architecture for establishing secure sessions in mobile networks, allowing authentication and key negotiation between devices and networks to establish encrypted communication channels.

[0142] S103: The NAF platform verifies the card identity public key based on the first verification key mechanism, generates first SIM card identity information, and returns the first SIM card identity information to the security platform.

[0143] It can be understood that the NAF platform ensures the security and integrity of the communication by verifying the card identity public key of the SIM card, which can be achieved by encrypting and decrypting the card identity public key using the session key (Ks_NAF), or by further confirming the first SIM card identity information through a corresponding authentication mechanism such as a challenge-response mechanism. The present application does not limit the verification key mechanism of the NAF platform.

[0144] For example, Figure 7 SIM card identity authentication method flow provided for this application Figure 4 ,like Figure 7 As shown, the NAF platform in the GBA can provide network authentication capabilities, and a shared user key (KS_NAF) is established between the NAF platform and the target service application based on the SIM card, and the shared key is used to implement user authentication to obtain the corresponding first SIM card identity information; in addition, the terminal device side and the security platform side authentication and key negotiation can be completed through the security SDK and the security platform to generate the internal keys (confidentiality key, integrity key) of this session.

[0145] S104. The security platform verifies the card identity public key based on the second verification key mechanism to generate second SIM card identity information; wherein the first verification key mechanism and the second verification key mechanism are different.

[0146] Specifically, after receiving the card identity public key of the SIM card, the security platform will use a pre-stored trusted root certificate or other verification mechanism to verify whether the card identity public key of the SIM card is valid and credible; once the verification is passed, the security platform will use the card identity public key to find and associate the corresponding second SIM card identity information.

[0147] S105: The security platform generates an authentication result based on the first SIM card identity information and the second SIM card identity information and returns it to the terminal device.

[0148] It can be understood that the NAF platform performs a first authentication on the card identity public key based on the first authentication key mechanism, and the security platform performs a second authentication on the card identity public key based on the second authentication key mechanism different from the first authentication key mechanism, which is equivalent to performing a double authentication on the card identity public key, thereby ensuring that the identity information of the SIM card is credible. Specifically, the purpose of the security platform performing consistency authentication on the received first SIM card identity information and the second SIM card identity information is to ensure the matching and consistency of the first SIM card identity information and the second SIM card identity information, and to prevent data tampering or identity fraud; wherein, consistency authentication can be implemented in a variety of ways, for example, using a hash function to perform hash calculation on the first SIM card identity information and the second SIM card identity information, and comparing the hash values, or using digital signature technology to verify the signatures of the first SIM card identity information and the second SIM card identity information; if the consistency authentication passes, it indicates that the first SIM card identity information and the second SIM card identity information are credible and consistent.

[0149] Furthermore, if the first SIM card identity information and the second SIM card identity information are consistent, an authentication result indicating that the SIM has passed the identity authentication is generated and returned to the terminal device; if the first SIM card identity information and the second SIM card identity information are inconsistent, an authentication result indicating that the SIM has not passed the identity authentication is generated and returned to the terminal device.

[0150] In addition, after the authentication result indicates that the SIM card has passed the identity authentication, the security platform returns the platform identity public key and public key HMAC data to the terminal device; wherein the public key HMAC data is used to represent the HMAC data generated after the card identity public key is HMAC protected. Specifically, if the authentication result indicates that the SIM card has passed the identity authentication, the platform identity public key corresponding to the security platform is determined based on the card identity public key, and the platform identity public key and public key HMAC data are sent to the security SDK, which will save the authentication result, platform identity public key and public key HMAC data. At the same time, the security SDK will send a public key verification request to the security card application to perform public key integrity verification on the platform identity public key based on the security card application; if the public key integrity verification passes, the security SDK will synchronize the platform identity public key to the target business application.

[0151] In the SIM card identity authentication device provided by the present application, the terminal device sends an access key acquisition request and a certificate acquisition request to the security platform through the security SDK of the target service application, and receives the access key and target certificate returned by the security platform; further, the terminal device sends an identity authentication request carrying the card identity public key corresponding to the SIM card to the security platform, and the security platform forwards the card identity public key to the NAF platform; the security platform uses the SIM card security chip as a trusted carrier to realize the secure storage of sensitive information such as keys and digital certificates, thereby avoiding the inability to simultaneously support the access of multiple operators or service applications; the NAF platform verifies the card identity public key based on the first verification key mechanism, generates the first SIM card identity information, and returns the first SIM card identity information to the security platform, and the security platform verifies the card identity public key based on the first verification key mechanism A second verification key mechanism with a different verification key mechanism verifies the card identity public key and generates a second SIM card identity information; if the first SIM card identity information and the second SIM card identity information are inconsistent, an authentication result indicating that the SIM card has not passed the identity authentication is generated; if the first SIM card identity information and the second SIM card identity information are consistent, an authentication result indicating that the SIM card has passed the identity authentication is generated, and the platform identity public key and public key HMAC data are returned to the terminal device; the NAF platform and the security platform respectively perform dual authentication on the card identity public key of the SIM card through the pre-set first verification key mechanism and the second verification key mechanism, thereby reducing the possibility of data leakage caused by manual operation and the inaccuracy of the authentication result, thereby improving the accuracy of the identity authentication result of the SIM card.

[0152] Figure 8 Schematic diagram of the structure of the SIM card identity authentication device provided in this application Figure 1 .like Figure 8 As shown, the present application provides a SIM card identity authentication device 800, which is applied to a security platform, including: an acquisition module 801, a sending module 802, a verification module 803, and a generation module 804.

[0153] The acquisition module 801 is used to acquire an identity authentication request sent by a terminal device, wherein the identity authentication request carries a card identity public key of a SIM card installed in the terminal device;

[0154] A sending module 802 is used to forward the identity authentication request to the NAF platform;

[0155] The acquisition module 801 is further used to acquire the first SIM card identity information returned by the NAF platform, where the first SIM card identity information is obtained by the NAF platform verifying the card identity public key based on a first verification key mechanism;

[0156] A verification module 803, configured to verify the card identity public key based on a second verification key mechanism to generate second SIM card identity information, wherein the first verification key mechanism and the second verification key mechanism are different;

[0157] The generating module 804 is used to generate and return an authentication result to the terminal device according to the first SIM card identity information and the second SIM card identity information, wherein the authentication result is used to indicate whether the SIM card passes the identity authentication.

[0158] Optionally, the generating module 804 is further configured to:

[0159] If the identity information of the first SIM card is consistent with the identity information of the second SIM card, generating and returning to the terminal device an authentication result indicating that the SIM card has passed the identity authentication;

[0160] If the first SIM card identity information and the second SIM card identity information are inconsistent, an authentication result indicating that the SIM card has failed identity authentication is generated and returned to the terminal device.

[0161] Optionally, the sending module 802 is further configured to:

[0162] After the authentication result indicates that the SIM card has passed the identity authentication, the platform identity public key and public key HMAC data are returned to the terminal device; wherein the public key HMAC data is used to represent the HMAC data generated after the card identity public key is HMAC protected.

[0163] Optionally, the device further includes: a processing module 805;

[0164] The acquisition module 801 is further configured to acquire an access key acquisition request sent by the terminal device, wherein the access key acquisition request includes a tenant identifier and a target service application identifier;

[0165] The processing module 805 is used to create a target business application container corresponding to the tenant identifier and the target business application identifier according to the access key acquisition request, and allocate an access key to the target business application container;

[0166] The sending module 802 is further configured to return the access key to the terminal device.

[0167] Optionally, the device further includes: a receiving module 806 and a storage module 807;

[0168] The receiving module 806 is used to receive a certificate acquisition request sent by the terminal device, where the certificate acquisition request includes a tenant identifier, a target service application identifier, and the SIM card identifier;

[0169] The acquisition module 801 is further used to acquire the target certificate according to the certificate acquisition request;

[0170] The storage module 807 is used to store the target certificate in the target business application container corresponding to the tenant identifier and the target business application identifier;

[0171] The sending module 802 is further configured to return the target certificate to the terminal device.

[0172] Fig. 9 Schematic diagram of the structure of the SIM card identity authentication device provided in this application Figure 2 .like Fig. 9 As shown, the present application provides a SIM card identity authentication device 900, which is applied to the NAF platform, including: an acquisition module 901, a verification module 902, and a sending module 903.

[0173] The acquisition module 901 is used to acquire the identity authentication request sent by the security platform, wherein the identity authentication request carries the card identity public key of the SIM card;

[0174] Verification module 902, used to verify the card identity public key based on a first verification key mechanism to generate first SIM card identity information;

[0175] The sending module 903 is used to return the first SIM card identity information to the security platform, so that the security platform generates an authentication result according to the first SIM card identity information and the second SIM card identity information, wherein the second SIM card identity information is obtained by the security platform through verification of the card identity public key based on a second verification key mechanism, and the authentication result is used to indicate whether the SIM card passes the identity authentication, and the first verification key mechanism and the second verification key mechanism are different.

[0176] Fig.10 Schematic diagram of the structure of the SIM card identity authentication device provided in this application Figure 3 .like Fig.10 As shown, the present application provides a SIM card identity authentication device, which is applied to a terminal device and includes: a sending module 1001 and an obtaining module 1002.

[0177] The sending module 1001 is used to send an identity authentication request to the security platform, wherein the identity authentication request carries the card identity public key of the SIM card installed in the terminal device;

[0178] The acquisition module 1002 is used to obtain an authentication result, where the authentication result is generated by the security platform based on the first SIM card identity information and the second SIM card identity information, where the first SIM card identity information is obtained by the NAF platform verifying the card identity public key based on a first verification key mechanism, and the second SIM identity information is obtained by the security platform verifying the card identity public key based on a second verification key mechanism, where the first verification key mechanism and the second verification key mechanism are different, and the authentication result is used to indicate whether the SIM card passes the identity authentication.

[0179] Optionally, the device further includes: a processing module 1003;

[0180] The acquisition module 1002 is further used to acquire the initial card identity public key of the SIM card in the terminal device through the security SDK of the target service application;

[0181] The processing module 1003 is used to perform HMAC protection on the initial card identity public key of the SIM card to generate the card identity public key; and generate and send the identity authentication request to the security platform according to the card identity public key.

[0182] Optionally, the device further includes: a receiving module 1004, used to receive the platform identity public key and public key HMAC data sent by the security platform, wherein the public key HMAC data is used to represent the HMAC data generated after the card identity public key is HMAC protected.

[0183] Optionally, the sending module 1001 is further configured to send an access key acquisition request to the security platform through a security SDK of a target business application, wherein the access key acquisition request includes a tenant identifier and a target business application identifier;

[0184] The acquisition module 1002 is further used to acquire the access key sent by the security platform.

[0185] Optionally, the sending module 1001 is further used to send a certificate acquisition request to the security platform through the security SDK of the target business application, where the certificate acquisition request includes a tenant identifier, a target business application identifier, and the SIM card identifier;

[0186] The acquisition module 1002 is further used to acquire the target certificate sent by the security platform.

[0187] Fig.11 A hardware structure diagram of a server provided for this application. Fig.11 As shown, the server 1100 includes:

[0188] Processor 1101 and memory 1102;

[0189] Memory stores computer-executable instructions;

[0190] The processor executes the computer-executable instructions stored in the memory 1102, so that the server executes the identity authentication method of the SIM card as described above.

[0191] It should be understood that the processor 1101 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), or application-specific integrated circuits (ASIC). A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be implemented by a combination of hardware and software modules in the processor. The memory 1102 may include a high-speed random access memory (RAM), or may also include a non-volatile memory (NVM), such as at least one disk storage, or may be a USB flash drive, a mobile hard disk, a read-only memory, a disk, or an optical disk.

[0192] Fig.12This is a hardware structure diagram of a terminal device provided by this application. Fig.12 As shown, the terminal device 1200 includes:

[0193] Processor 1201 and memory 1202;

[0194] Memory stores computer-executable instructions;

[0195] The processor executes the computer-executable instructions stored in the memory 1202, so that the terminal device executes the identity authentication method of the SIM card as described above.

[0196] It should be understood that the processor 1201 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), or application-specific integrated circuits (ASIC). A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be implemented by a combination of hardware and software modules in the processor. The memory 1202 may include a high-speed random access memory (RAM), or may also include a non-volatile memory (NVM), such as at least one disk memory, or may be a USB flash drive, a mobile hard disk, a read-only memory, a disk, or an optical disk.

[0197] The embodiment of the present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the identity authentication method of the SIM card as described above.

[0198] The embodiment of the present application also provides a computer program product accordingly. The computer program product includes a computer program. When the computer program is executed by a processor, it is used to implement the identity authentication method of the SIM card as described above.

[0199] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present application.

[0200] It should be further noted that, although the various steps in the flowchart are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless there is a clear description in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowchart may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0201] It should be understood that the above-mentioned device embodiments are only illustrative, and the device of the present application can also be implemented in other ways. For example, the division of units / modules in the above-mentioned embodiments is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units, modules or components can be combined, or can be integrated into another system, or some features can be ignored or not executed.

[0202] In addition, unless otherwise specified, each functional unit / module in each embodiment of the present application may be integrated into one unit / module, each unit / module may exist physically separately, or two or more units / modules may be integrated together. The above-mentioned integrated unit / module may be implemented in the form of hardware or in the form of a software program module.

[0203] If the integrated unit / module is implemented in the form of hardware, the hardware may be a digital circuit, an analog circuit, etc. The physical implementation of the hardware structure includes but is not limited to transistors, memristors, etc. If not specifically stated, the processor may be any appropriate hardware processor, such as a CPU, a GPU, an FPGA, a DSP, an ASIC, etc. If not specifically stated, the storage unit may be any appropriate magnetic storage medium or magneto-optical storage medium, such as a resistive random access memory RRAM (Resistive Random Access Memory), a dynamic random access memory DRAM (Dynamic Random Access Memory), a static random access memory SRAM (Static Random-Access Memory), an enhanced dynamic random access memory EDRAM (Enhanced Dynamic Random Access Memory), a high-bandwidth memory HBM (High-Bandwidth Memory), a hybrid memory cube HMC (Hybrid Memory Cube), etc.

[0204] If the integrated unit / module is implemented in the form of a software program module and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a memory and includes several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned memory includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0205] In the above embodiments, the description of each embodiment has its own emphasis. For the part not described in detail in a certain embodiment, please refer to the relevant description of other embodiments. The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0206] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0207] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A SIM card identity authentication method, characterized in that: Applied to security platforms, including: Obtaining an identity authentication request sent by a terminal device, wherein the identity authentication request carries a card identity public key of a subscriber identity module SIM card installed in the terminal device; Forwarding the identity authentication request to the application server NAF platform; Acquire the first SIM card identity information returned by the NAF platform, where the first SIM card identity information is obtained by the NAF platform verifying the card identity public key based on a first verification key mechanism; Verifying the card identity public key based on a second verification key mechanism to generate second SIM card identity information, wherein the first verification key mechanism and the second verification key mechanism are different; An authentication result is generated according to the first SIM card identity information and the second SIM card identity information and is returned to the terminal device, where the authentication result is used to indicate whether the SIM card passes identity authentication.

2. The method according to claim 1, characterized in that The generating and returning the authentication result to the terminal device according to the first SIM card identity information and the second SIM card identity information includes: If the identity information of the first SIM card is consistent with the identity information of the second SIM card, generating and returning to the terminal device an authentication result indicating that the SIM card has passed the identity authentication; If the first SIM card identity information and the second SIM card identity information are inconsistent, an authentication result indicating that the SIM card has failed identity authentication is generated and returned to the terminal device.

3. The method according to claim 1, characterized in that The method further comprises: After the authentication result indicates that the SIM card has passed the identity authentication, the platform identity public key and public key HMAC data are returned to the terminal device; wherein the public key HMAC data is used to represent the HMAC data generated after the card identity public key is HMAC protected.

4. The method according to any one of claims 1 to 3, characterized in that: Before obtaining the identity authentication request sent by the terminal device, the method further includes: Obtaining an access key acquisition request sent by the terminal device, wherein the access key acquisition request includes a tenant identifier and a target service application identifier; Creating a target business application container corresponding to the tenant identifier and the target business application identifier according to the access key acquisition request, and allocating an access key to the target business application container; The access key is returned to the terminal device.

5. The method according to claim 4, characterized in that The method further comprises: Receive a certificate acquisition request sent by the terminal device, where the certificate acquisition request includes a tenant identifier, a target service application identifier, and the SIM card identifier; Obtain a target certificate according to the certificate acquisition request; Storing the target certificate in the target business application container corresponding to the tenant identifier and the target business application identifier; The target certificate is returned to the terminal device.

6. A SIM card identity authentication method, characterized in that: Applied to the NAF platform of application servers, including: Obtaining an identity authentication request sent by the security platform, wherein the identity authentication request carries a card identity public key of a customer identity module SIM card; Verify the card identity public key based on the first verification key mechanism to generate first SIM card identity information; The first SIM card identity information is returned to the security platform, so that the security platform generates an authentication result according to the first SIM card identity information and the second SIM card identity information, wherein the second SIM card identity information is obtained by the security platform through verification of the card identity public key based on a second verification key mechanism, and the authentication result is used to indicate whether the SIM card passes the identity authentication, and the first verification key mechanism and the second verification key mechanism are different.

7. A SIM card identity authentication method, characterized in that: Applied to terminal equipment, including: Sending an identity authentication request to the security platform, wherein the identity authentication request carries the card identity public key of the subscriber identity module SIM card installed in the terminal device; Obtain an authentication result, where the authentication result is generated by the security platform based on the first SIM card identity information and the second SIM card identity information, where the first SIM card identity information is obtained by the application server NAF platform verifying the card identity public key based on a first verification key mechanism, and the second SIM identity information is obtained by the security platform verifying the card identity public key based on a second verification key mechanism, where the first verification key mechanism and the second verification key mechanism are different, and the authentication result is used to indicate whether the SIM card passes the identity authentication.

8. The method according to claim 7, characterized in that The sending of the identity authentication request to the security platform includes: Obtaining the initial card identity public key of the SIM card in the terminal device through the target business application's security software development kit SDK; Performing HMAC protection on the initial card identity public key of the SIM card to generate the card identity public key; According to the card identity public key, the identity authentication request is generated and sent to the security platform.

9. The method according to claim 8 or 7, characterized in that: After the authentication result indicates that the SIM card has passed the identity authentication, the method further includes: Receive the platform identity public key and public key HMAC data sent by the security platform, wherein the public key HMAC data is used to represent the HMAC data generated after the card identity public key is HMAC protected.

10. The method according to claim 8, characterized in that Before sending the identity authentication request to the security platform, the method further includes: Sending an access key acquisition request to the security platform through the security SDK of the target business application, wherein the access key acquisition request includes a tenant identifier and a target business application identifier; Obtain an access key sent by the security platform.

11. The method according to claim 10, characterized in that The method further comprises: Sending a certificate acquisition request to the security platform through the security SDK of the target business application, wherein the certificate acquisition request includes a tenant identifier, a target business application identifier, and the SIM card identifier; Obtain the target certificate sent by the security platform.

12. A SIM card identity authentication device, characterized in that: Applied to security platforms, including: An acquisition module, used to acquire an identity authentication request sent by a terminal device, wherein the identity authentication request carries a card identity public key of a subscriber identity module SIM card installed in the terminal device; A sending module, used for forwarding the identity authentication request to the application server NAF platform; The acquisition module is further used to acquire the first SIM card identity information returned by the NAF platform, where the first SIM card identity information is obtained by the NAF platform verifying the card identity public key based on a first verification key mechanism; a verification module, configured to verify the card identity public key based on a second verification key mechanism to generate second SIM card identity information, wherein the first verification key mechanism and the second verification key mechanism are different; The generating module is used to generate and return an authentication result to the terminal device according to the first SIM card identity information and the second SIM card identity information, wherein the authentication result is used to indicate whether the SIM card passes the identity authentication.

13. A SIM card identity authentication device, characterized in that: Applied to the NAF platform of application servers, including: An acquisition module is used to acquire an identity authentication request sent by a security platform, wherein the identity authentication request carries a card identity public key of a customer identity module SIM card; A verification module, used to verify the card identity public key based on a first verification key mechanism to generate first SIM card identity information; a sending module, configured to return the first SIM card identity information to the security platform, so that the security platform generates an authentication result according to the first SIM card identity information and the second SIM card identity information, wherein the second SIM card identity information is obtained by the security platform through verification of the card identity public key based on a second verification key mechanism, and the authentication result is used to indicate whether the SIM card passes the identity authentication, and the first verification key mechanism and the second verification key mechanism are different.

14. A SIM card identity authentication device, characterized in that: Applied to terminal equipment, including: A sending module, used to send an identity authentication request to the security platform, wherein the identity authentication request carries a card identity public key of a customer identity module SIM card installed in the terminal device; an acquisition module, used for acquiring an authentication result, wherein the authentication result is generated by the security platform based on the first SIM card identity information and the second SIM card identity information, wherein the first SIM card identity information is obtained by the application server NAF platform verifying the card identity public key based on a first verification key mechanism, and the second SIM identity information is obtained by the security platform verifying the card identity public key based on a second verification key mechanism, wherein the first verification key mechanism and the second verification key mechanism are different, and the authentication result is used to indicate whether the SIM card passes the identity authentication.

15. A server, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the SIM card identity authentication method according to any one of claims 1 to 6.

16. A terminal device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the SIM card identity authentication method according to any one of claims 7 to 11.

17. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the identity authentication method for a SIM card according to any one of claims 1 to 11.

18. A computer program product, characterized in that The invention comprises a computer program, which is used to implement the identity authentication method of the SIM card according to any one of claims 1 to 11 when being executed by a processor.

Images