Signature determination verification method, device and system of operating system, equipment and medium

Abstract

The invention provides a signature determination verification method, device and system of an operating system, equipment and a medium. The method comprises: receiving a first signature and first operating system data sent by an operation system, the first signature being obtained by the operation system according to first verification information, the first verification information being obtained by calculating the first operating system data according to a preset algorithm, and the first operating system data being operating system data of a test SIM card which is detected to be qualified; verifying the first operating system data according to the first signature; if the verification result is successful, obtaining a second signature according to the first verification information and the first signature; and determining the signature of the operating system of the SIM card to be made according to the second signature. According to the method provided by the invention, the problem that the operating system in the tested SIM card is inconsistent with the operating system in the actually produced SIM card is solved, and the security of the operating system of the SIM card is improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a signature determination and verification method, device, system, equipment and medium for an operating system. Background Art

[0002] With the development of mobile communication technology, SIM cards not only bear the core capability of traditional mobile communication network user identity identification, but also provide more and more value-added applications and service capabilities. SIM card production platforms have continuously iterated and optimized the functions of SIM card operating systems. As SIM card operating system versions become increasingly diverse, SIM card operating platforms have problems in supervising SIM card operating system versions.

[0003] In the prior art, the operation platform detects the operating system of the test SIM card, and the production platform produces the SIM card according to the operating system of the test SIM card. However, there is a problem that the operating system in the test SIM card is inconsistent with the operating system in the actually produced SIM card. Summary of the invention

[0004] The present application provides a signature verification method, device, system, equipment and medium for operating system, which are used to solve the problem in the prior art that the operating system in a test SIM card is inconsistent with the operating system in an actually produced SIM card.

[0005] In a first aspect, the present application provides a signature determination method for an operating system, which is applied to a production system, comprising:

[0006] Receive a first signature and first operating system data sent by the operating system, where the first signature is obtained by the operating system according to first verification information, the first verification information is obtained by calculating the first operating system data according to a preset algorithm, and the first operating system data is operating system data of a qualified test SIM card;

[0007] verifying the first operating system data according to the first signature;

[0008] If the verification result is passed, a second signature is obtained based on the first verification information and the first signature;

[0009] According to the second signature, the signature of the operating system of the SIM card to be manufactured is determined.

[0010] In this application, verifying the first operating system data returned by the operating system according to the first signature includes:

[0011] Decoding the first signature to obtain first verification information in the first signature;

[0012] Calculate the first operating system data according to a preset algorithm to obtain second verification information;

[0013] The first operating system data is verified according to the first verification information and the second verification information.

[0014] In this application, the second signature is obtained according to the first verification information and the first signature, including:

[0015] Obtaining a first key pair of the production system, where the first key pair is obtained according to a cryptographic machine of the production system;

[0016] The first verification information and the first signature are signed according to the first private key in the first key pair to obtain a second signature.

[0017] In the present application, receiving a first signature and first operating system data sent by an operating system includes:

[0018] Sending a detection request for detecting the operating system of the test SIM card to the operating system, the detection request including the first verification information and the first operating system data of the operating system;

[0019] If the detection result returned by the operating system is qualified, the first signature and the first operating system data sent by the operating system are received.

[0020] In this application, the method further comprises:

[0021] The first verification information and the second signature are written into the SIM card to be manufactured.

[0022] In a second aspect, the present application provides a signature determination method for an operating system, which is applied to an operating system, comprising:

[0023] Obtain a first signature according to the first verification information, wherein the first verification information is obtained by calculating the first operating system data according to a preset algorithm, and the first operating system data is the operating system data of the qualified test SIM card;

[0024] The first signature and the first operating system data are sent to the production system. The first signature is used by the production system to verify the first operating system sent by the operation system. The first signature is used by the production system to generate a second signature based on the first signature and the first verification information. The second signature is used by the production system to determine the signature of the operating system of the SIM card to be manufactured.

[0025] In this application, a first signature is obtained according to the first verification information, including:

[0026] Obtaining a second key pair of the operating system, where the second key pair is obtained according to a cryptographic machine of the operating system;

[0027] The first verification information is signed according to the second private key in the second key pair to obtain a first signature.

[0028] In this application, a first signature is obtained according to the first verification information, including:

[0029] Testing the operating system of the test SIM card according to a test request sent by the production system, the test request including first verification information and first operating system data of the operating system;

[0030] If the test result is qualified, a first signature is obtained according to the first verification information.

[0031] In this application, according to the test request sent by the production system, the operating system of the test SIM card is tested, including:

[0032] Calculate the first operating system data according to a preset algorithm to obtain third verification information;

[0033] If the third verification information is consistent with the first verification information, obtaining the second operating system data on the test SIM card;

[0034] Calculate the second operating system data according to a preset algorithm to obtain fourth verification information;

[0035] If the fourth verification information is consistent with the first verification information, the test SIM card is tested.

[0036] In a third aspect, the present application provides a signature verification method for an operating system, which is applied to a version detection system, including:

[0037] Obtain the first verification information and the second signature in the SIM card to be verified, the first verification information in the SIM card to be verified is written when the production system makes the card, and the second signature is obtained according to the method provided in this application;

[0038] Decoding the second signature according to the first public key in the first key pair to obtain the first verification information and the first signature in the second signature, wherein the first key pair is obtained according to the production system;

[0039] If the first verification information in the second signature is consistent with the first verification information in the SIM card to be verified, the first signature is decoded according to the second public key in the second key pair to obtain the first verification information in the first signature, and the second key pair is obtained according to the operating system;

[0040] If the first verification information in the first signature is consistent with the first verification information in the SIM card to be verified, the third operating system data in the SIM card to be verified is calculated according to a preset algorithm to obtain fifth verification information;

[0041] The operating system of the SIM card to be verified is verified according to the fifth verification information and the first verification information in the SIM card to be verified.

[0042] In a fourth aspect, the present application provides a signature determination device for an operating system, which is applied to a production system, comprising:

[0043] A receiving module, used to receive a first signature and first operating system data sent by the operating system, wherein the first signature is obtained by the operating system according to first verification information, the first verification information is obtained by calculating the first operating system data according to a preset algorithm, and the first operating system data is the operating system data of a qualified test SIM card;

[0044] A first verification module, used to verify the first operating system data according to the first signature;

[0045] A second signature module, configured to obtain a second signature based on the first verification information and the first signature if the verification result is passed;

[0046] The determination module is used to determine the signature of the operating system of the SIM card to be manufactured according to the second signature.

[0047] In a fifth aspect, the present application provides a signature determination device for an operating system, which is applied to an operating system, including:

[0048] A detection module, used to obtain a first signature according to first verification information, wherein the first verification information is obtained by calculating first operating system data according to a preset algorithm, and the first operating system data is operating system data of a test SIM card that has passed the test;

[0049] A first signature module, configured to obtain a first signature according to the first verification information if the detection result is qualified;

[0050] The sending module sends the first signature and the first operating system data to the production system, the first signature is used by the production system to verify the first operating system sent by the operation system, the first signature is used by the production system to generate a second signature according to the first signature and the first verification information, and the second signature is used by the production system to determine the signature of the operating system of the SIM card to be manufactured.

[0051] In a sixth aspect, the present application provides a signature verification device for an operating system, which is applied to a version detection system, including:

[0052] A first acquisition module is used to acquire first verification information and a second signature in the SIM card to be verified, where the first verification information in the SIM card to be verified is written when the production system makes the card, and the second signature is obtained according to the method provided in this application;

[0053] A first decoding module, used to decode the second signature according to the first public key in the first key pair to obtain the first verification information and the first signature in the second signature, wherein the first key pair is obtained according to the production system;

[0054] A second decoding module is used to decode the first signature according to the second public key in the second key pair to obtain the first verification information in the first signature if the first verification information in the second signature is consistent with the first verification information in the SIM card to be verified, and the second key pair is obtained according to the operating system;

[0055] A second acquisition module is used to calculate the third operating system data of the SIM card to be verified according to a preset algorithm to obtain fifth verification information if the first verification information in the first signature is consistent with the first verification information in the SIM card to be verified;

[0056] The second verification module is used to verify the operating system of the SIM card to be verified according to the fifth verification information and the first verification information in the SIM card to be verified.

[0057] In a seventh aspect, the present application provides a signature management system, including:

[0058] A production system, used to execute the signature determination method of the operating system according to the first aspect of the present application;

[0059] An operating system, used to execute the signature determination method of the operating system according to the second aspect of the present application;

[0060] A version detection system is used to execute the signature verification method of the operating system provided in the third aspect of the present application.

[0061] In an eighth aspect, the present application provides an electronic device, comprising: a processor, and a memory communicatively connected to the processor;

[0062] Memory stores computer-executable instructions;

[0063] The processor executes the computer-executable instructions stored in the memory to implement the method provided in the present application.

[0064] In a ninth aspect, the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the method provided by the present application.

[0065] The signature determination verification method, device, system, equipment and medium of the operating system provided in the present application obtain a first signature through first verification information, and then send the first signature and the first operating system data to the production system. The production system verifies the first operating system data according to the first signature. If the verification result is passed, the second signature is obtained according to the first verification information and the first signature. Finally, the signature of the operating system of the SIM card to be produced is determined according to the second signature. Through double signature, the problem of inconsistency between the operating system in the test SIM card and the operating system in the actual production SIM card is solved, and the security of the SIM card operating system is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0067] Figure 1 A schematic diagram of a scenario of a signature determination method for an operating system provided in an embodiment of the present application;

[0068] Figure 2 A flowchart of a signature determination method for an operating system provided in an embodiment of the present application;

[0069] Figure 3 A flowchart of a signature verification method for an operating system provided in an embodiment of the present application;

[0070] Figure 4 A schematic diagram of a signature determination device for an operating system provided in an embodiment of the present application Figure 1 ;

[0071] Figure 5 A schematic diagram of a signature determination device for an operating system provided in an embodiment of the present application Figure 2 ;

[0072] Figure 6 A schematic diagram of the structure of a signature verification device for an operating system provided in an embodiment of the present application;

[0073] Figure 7 A schematic diagram of the structure of a signature management system provided in an embodiment of the present application;

[0074] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0075] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0076] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0077] In order to clearly understand the technical solution of the present application, the solution of the prior art is first introduced in detail.

[0078] With the development of mobile communication technology, SIM (Subscriber Identity Module) cards not only bear the core capability of traditional mobile communication network user identity identification, but also provide more and more value-added applications and service capabilities. SIM card suppliers (hereinafter referred to as card vendors) have continuously iterated and optimized the functions of the SIM card operating system (COS). As the SIM card COS versions become increasingly rich, operators are also facing new problems in the supervision of SIM card COS versions. Mainly reflected in:

[0079] 1. Among the card defects exposed during the use of SIM cards, some are COS defects that cannot be repaired by remote or offline update technology. For such problems, the relevant units often use direct card replacement to solve them, but the COS version information before and after the update has not been confirmed by the operator's SIM card testing unit. Since the operator's card testing unit cannot accurately grasp the full picture of the COS version that has been released, it is impossible to effectively analyze the causes of COS defects, the scope of impact, the effectiveness and extension of defect solutions, which is not conducive to controlling and improving the quality of SIM card products.

[0080] 2. There are many participants in the SIM card manufacturing and issuance chain. On the one hand, group companies, provincial companies, professional companies, industry customers, SIM card suppliers, and application providers all play their respective roles in SIM card specifications to varying degrees. On the other hand, due to the lack of effective methods in technical means and management mechanisms, the operator's card testing unit can only maintain the COS information of the test version provided by the SIM card supplier, and cannot promptly discover the difference between the actual version issued to the end customer and the test version.

[0081] Currently, operators mainly use the following methods to manage SIM card version information:

[0082] 1. Build a card management system to manage the data of each batch of cards. The main functions include: resource management, card production management, card management, card data management, key management, etc.

[0083] 2. Customize the OTA (Over-the-Air Technology) transmission protocol, and reflect some characteristics of the SIM card by defining some fields, such as: card merchant, card product, protocol version number, etc., and complete the information collection of these characteristics through data interaction between the OTA platform and the SIM card.

[0084] 3. Strengthen management methods, improve the management of all chain participants from the workflow, improve the management level of versions, and strengthen the management of card filing. Or, build a special version library platform to achieve the management of version libraries, sample cards, and problem cards.

[0085] 4. Build the SIM card COS remote update capability to realize the function of updating the card COS from a platform controllable by the operator.

[0086] The aforementioned technical means have the following deficiencies in COS version management:

[0087] 1. The SIM card information managed by the card management system mainly realizes the management of the resource data, authentication data and production data of the SIM card, but does not actually manage the COS of the SIM card. The actual COS version in the SIM card still lacks effective technical supervision means.

[0088] 2. Some characteristic data of the SIM card defined in the OTA transmission protocol only reflects some business data of the SIM card and does not realize the management of COS.

[0089] 3. Simply changing the original offline management of the SIM card version library to an online platform is actually just the maintenance of the COS version information, and does not play a direct role in the issuance and monitoring of SIM card COS.

[0090] 4. The operator's SIM card COS remote update capability enables the operator platform to directly update the card COS, but it cannot monitor the problem of related units replacing the card on their own without passing the version confirmation by the operator's testing unit.

[0091] In response to at least one of the above technical problems, the inventors discovered during research that the verification information of a qualified test SIM card can be signed by an operation system, and after obtaining a first signature, the operating system data of the test SIM card and the first signature are sent to a production system. After the production system verifies the operating system data according to the first signature, a second signature is obtained according to the verification information and the first signature, and the second signature is used as the signature of the SIM card to be manufactured, so as to ensure that the operating system data of the manufactured SIM card is consistent with the operating system data of the test SIM card according to the second signature, thereby preventing the operating system data of the test SIM card from being tampered with during transmission.

[0092] The following introduces the application scenarios of the signature determination method of the operating system provided in the embodiment of the present application.

[0093] Figure 1 A scenario diagram of a signature determination method for an operating system provided in an embodiment of the present application, such as Figure 1As shown, the scenario includes a production system, an operation system, and a version detection system, wherein the production system, the operation system, and the version detection system are in communication connection, and are used to enable the operation system to obtain a first signature according to the first verification information, and send the first signature and the first operating system data to the production system. It is also used to enable the production system to receive the first signature and the first operating system data sent by the operation system, and verify the first operating system data according to the first signature; if the verification result is passed, a second signature is obtained according to the first verification information and the first signature; and the signature of the operating system of the SIM card to be produced is determined according to the second signature. It is also used to enable the version detection system to obtain the first verification information and the second signature in the SIM card to be verified, decode the second signature according to the first public key in the first key pair, and obtain the first verification information and the first signature in the second signature; if the first verification information in the second signature is consistent with the first verification information in the SIM card to be verified, decode the first signature according to the second public key in the second key pair, and obtain the first verification information in the first signature; if the first verification information in the first signature is consistent with the first verification information in the SIM card to be verified, calculate the third operating system data according to a preset algorithm to obtain the fifth verification information; and verify the operating system of the SIM card to be verified according to the fifth verification information and the first verification information in the SIM card to be verified.

[0094] The production system may refer to a system used by card vendors for SIM card production management.

[0095] The operating system may refer to a system used by operators for SIM card version management.

[0096] The version detection system may refer to a system used by an operator for version detection of a SIM card.

[0097] Figure 2 A flowchart of a signature determination method for an operating system provided in an embodiment of the present application is applied to a production system and an operation system, such as Figure 2 As shown, the method includes:

[0098] S201. Obtain a first signature according to first verification information.

[0099] In this embodiment, the operating system obtains the first signature according to the first verification information, and the first verification information may refer to the first operating system data calculated according to the preset algorithm. The first verification information may refer to a hash value, such as a COS standard hash value. The preset algorithm may refer to a hash value algorithm, and the first operating system data may be the operating system data of a qualified test SIM card.

[0100] The first operating system data may include: COS code and COS feature string. The COS code may refer to the SIM card COS program, which is responsible for executing various underlying operations of the SIM card, including but not limited to file system management, communication protocol processing, security function implementation, etc. The purpose of the signature verification method of the operating system referred to in this application is to monitor the changes of the COS code. The COS feature string refers to the card adaptation attribute corresponding to the COS code, which may include the SIM card supplier information providing the COS code, the card type information adapted by the COS, the operator production specification version information based on the COS, and the COS version number of the COS code. For example, the fixed length of the card adaptation attribute in the COS feature string can be a hexadecimal string with a length of 12 bytes. It includes the card vendor code (1 byte), the card type code (1 byte), the production specification code (2 bytes), the COS version number (3 bytes), and the reserved part (5 bytes).

[0101] The test SIM card may refer to a SIM card that the production system sends to the operation system for testing. If the test passes, the production system may carry out batch production according to the test SIM card.

[0102] Specifically, obtaining the first signature according to the first verification information may include:

[0103] Obtaining a second key pair of the operating system, where the second key pair is obtained according to a cryptographic machine of the operating system;

[0104] The first verification information is signed according to the second private key in the second key pair to obtain a first signature.

[0105] In this embodiment, the operation system and the production system each have a cryptographic machine for generating their own key pairs, the key pairs including a private key and a public key, wherein the private key is used for encryption and the public key is used for decryption. After obtaining the first verification information, the operation system obtains the private key in the key pair of the operation system, which is referred to as the second private key in the second key pair for the sake of distinction, and encrypts the first verification information with the second private key to obtain the first signature.

[0106] In some embodiments, obtaining the first signature according to the first verification information may further include:

[0107] Testing the operating system of the test SIM card according to a test request sent by the production system, the test request including first verification information and first operating system data of the operating system;

[0108] If the test result is qualified, a first signature is obtained according to the first verification information.

[0109] In this embodiment, before encrypting the first verification information, the operation system may also test the test SIM card according to the test request sent by the production system to ensure that the operating system of the test SIM card meets the operator's requirements, and then encrypt the first verification information representing the operating system of the test SIM card to obtain the first signature. If the operating system of the test SIM card does not meet the operator's requirements, the reason for the failure is notified to the production system for improvement.

[0110] Therefore, the first verification information in the operation system and the first operating system data of the test SIM card can be sent to the operation system by the production system, and the first verification information can be obtained by the production system according to the first operating system data and a preset algorithm.

[0111] Optionally, after the operating system is detected as qualified, the operating system of the test SIM card and its version information are stored in a database to facilitate the management of the versions of various operating systems.

[0112] Further, testing the operating system of the test SIM card according to the test request sent by the production system may include:

[0113] Calculate the first operating system data according to a preset algorithm to obtain third verification information;

[0114] If the third verification information is consistent with the first verification information, obtaining the second operating system data on the test SIM card;

[0115] Calculate the second operating system data according to a preset algorithm to obtain fourth verification information;

[0116] If the fourth verification information is consistent with the first verification information, the test SIM card is tested.

[0117] In this embodiment, in order to ensure the correctness of the first verification information sent by the production system, the operation system can also calculate the first operating system data according to a preset algorithm to obtain the third verification information calculated by the operation system, and compare the third verification information calculated by the operation system with the first verification information sent by the production system. If they are consistent, it means that the first operating system data and the first verification information have not been tampered with during data transmission. If they are inconsistent, it means that there is a problem with the first operating system data and the first verification information, and the production system needs to be informed to troubleshoot the problem. In particular, the preset algorithm can be sent to the operation system by the production system through an encrypted channel different from that used to send the detection request.

[0118] S202: Send the first signature and the first operating system data to the production system.

[0119] In this embodiment, after the operating system obtains the first signature, it sends the first signature and the first operating system data to the generating system, so that the generating system produces the SIM card according to the first operating system data sent by the operating system.

[0120] S203. Verify the first operating system data according to the first signature.

[0121] After the production system receives the first signature and the first operating system data sent by the operation system, the first operating system data is verified by the first signature to confirm whether the first operating system data sent by the operator has been tampered with.

[0122] Specifically, verifying the first operating system data returned by the operating system according to the first signature may include:

[0123] Decoding the first signature to obtain first verification information in the first signature;

[0124] Calculate the first operating system data according to a preset algorithm to obtain second verification information;

[0125] The first operating system data is verified according to the first verification information and the second verification information.

[0126] In this embodiment, the production system decodes the first signature according to the public key in the key pair of the operation system to obtain the first verification information in the first signature, and then calculates the first operating system data using a preset algorithm to obtain the second verification information. Finally, the first verification information and the second verification information in the first signature are compared to see if they are consistent. If they are consistent, it means that the first operating system data sent by the operation system is correct.

[0127] S204: If the verification result is passed, obtain a second signature based on the first verification information and the first signature.

[0128] In this embodiment, if the verification result of the production system on the first operating system data sent by the operation system is passed, the first verification information and the first signature are encrypted to obtain a second signature. The second signature of the production system includes the first signature of the operation system, indicating that the confirmation of the first operating system data by the production system is performed on the basis of the confirmation of the operation system. The method of re-signing the first signature can further improve the data security of the first operating system data.

[0129] Specifically, obtaining the second signature according to the first verification information and the first signature may include:

[0130] Obtaining a first key pair of the production system, where the first key pair is obtained according to a cryptographic machine of the production system;

[0131] The first verification information and the first signature are signed according to the first private key in the first key pair to obtain a second signature.

[0132] In this embodiment, in order to further increase the security of the first operating system data, based on the first signature of the operating system, the production system obtains a key pair from the cryptographic machine on the production system side, which is referred to as the first key pair for distinction, and then uses the first private key in the first key pair to sign the first verification information and the first signature to obtain a second signature. The first signature and the second signature improve the security of the first operating system data and prevent the first operating system data from being tampered with during transmission.

[0133] S205: Determine the signature of the operating system of the SIM card to be manufactured according to the second signature.

[0134] In this embodiment, after the second signature is obtained, the signature of the operating system of the SIM card to be manufactured is determined.

[0135] In some implementations, the first verification information and the second signature can also be written into the SIM card to be manufactured, thereby improving the security of the operating system of the SIM card to be manufactured. When the manufactured SIM card needs to be tested, the second signature in the SIM card can be read, and the second public key of the operation system and the first public key of the production system can be used to decode them respectively to determine whether the verification information of the operating system data in the SIM card is consistent with the verification information in the second signature. If they are consistent, it means that the operating system data of the SIM card has not been tampered with.

[0136] In other implementations, the first verification information, the second signature, the COS feature string and the first signature may also be written into the SIM card to be manufactured.

[0137] Specifically, a COS management control area can be set up in the EEPROM (Electrically Erasable Programmable read only memory) / Flash (for memory) area of ​​the SIM card to be manufactured. This area stores the COS standard hash value, COS feature string, first signature and second signature. The SIM card also opens the COS management command / API for the version detection system to realize the reading of COS data in the COS management control area and the real-time acquisition of the hash data of the actual COS in the card.

[0138] The embodiment of the present application provides a method for determining the signature of an operating system, and obtains a first signature through first verification information. Then, the first signature and the first operating system data are sent to the production system. The production system verifies the first operating system data according to the first signature. If the verification result is passed, a second signature is obtained according to the first verification information and the first signature. Finally, the signature of the operating system of the SIM card to be manufactured is determined according to the second signature. The problem of inconsistency between the operating system in the test SIM card and the operating system in the actual production SIM card is solved, and the security of the SIM card operating system is improved.

[0139] Figure 3 A flowchart of a signature verification method for an operating system provided in an embodiment of the present application is applied to a version detection system, such as Figure 3 As shown, the method includes:

[0140] S301, obtaining first verification information and a second signature from a SIM card to be verified.

[0141] In this embodiment, in order to verify the consistency of the operating system version of the issued SIM card with the operating system version of the detection SIM card, and to promptly discover the issuance of the operating system version of the unauthorized SIM card, it is first necessary to obtain the first verification information and the second signature in the SIM card to be verified, wherein the first verification information in the SIM card to be verified is written when the production system makes the card, and the second signature is obtained according to the signature determination method of the operating system provided in this application. The version detection system can generate a COS air interface command and read the first verification information and the second signature on the SIM card to be verified over the air.

[0142] S302. Decode the second signature according to the first public key in the first key pair to obtain the first verification information and the first signature in the second signature, wherein the first key pair is obtained according to the production system.

[0143] In this embodiment, in order to verify whether the first verification information in the SIM card to be verified is confirmed by the production system, the version detection system obtains the first public key in the first key pair from the production system, and then decodes the second signature according to the first public key to obtain the first verification information and the first signature in the second signature.

[0144] S303: If the first verification information in the second signature is consistent with the first verification information in the SIM card to be verified, the first signature is decoded according to the second public key in the second key pair to obtain the first verification information in the first signature. The second key pair is obtained according to the operating system.

[0145] In this embodiment, if the first verification information in the second signature is consistent with the first verification information in the SIM card to be verified, it means that the first verification information in the SIM card to be verified has been confirmed by the production system. In order to verify whether the first verification information in the SIM card to be verified has been confirmed by the operation system, the version detection system obtains the second public key in the second key pair from the operation system, and then decodes the first signature according to the second public key to obtain the first verification information in the first signature.

[0146] S304: If the first verification information in the first signature is consistent with the first verification information in the SIM card to be verified, the third operating system data in the SIM card to be verified is calculated according to a preset algorithm to obtain fifth verification information.

[0147] In this embodiment, if the first verification information in the first signature is consistent with the first verification information in the SIM card to be verified, it means that the first verification information in the SIM card to be verified has been confirmed by the operating system. In order to verify whether the operating system data in the SIM card to be verified matches the first verification information in the SIM card to be verified, the version detection system generates a COS air interface command, obtains the third operating system data currently actually used on the SIM card to be verified through the air, and then calculates the third operating system data according to a preset algorithm to obtain the fifth verification information of the third operating system data.

[0148] S305: Verify the operating system of the SIM card to be verified according to the fifth verification information and the first verification information in the SIM card to be verified.

[0149] In this embodiment, the fifth verification information of the third operating system data is compared with the first verification information in the SIM card to be verified. If the fifth verification information of the third operating system data is consistent with the first verification information in the SIM card to be verified, it means that the operating system of the SIM card to be verified has been confirmed by the production system and the operation system and meets the requirements.

[0150] Exemplarily, the version detection system may include an interface layer, an application layer, and a presentation layer.

[0151] The interface layer realizes the connection with the air interface and the machine-card interface of the SIM card. The version detection system supports the collection of COS data of the SIM card through the air mode and the machine-card interface.

[0152] The application layer implements the ability to detect the COS version of the SIM card, realizes COS data signature, standard COS hash value calculation in the card, COS feature string management, signature of the operation system and signature data collection of the production system, as well as the collection of the hash value of the COS actually used in the card.

[0153] The presentation layer provides a visual human-computer interaction service page for the operation system to manage the production system, COS code, and COS feature string, trigger COS version detection for specified users, and display and count the results of card COS version detection.

[0154] The specific detection process is as follows: the version detection system reads the COS standard hash value, COS feature string, the first signature of the operating system, and the second signature of the production system in the COS version management control area on the SIM card to be verified through air or card reader. The version detection system needs to undergo security authentication to read the above information to ensure that only authorized parties can use it. At the same time, a secure encryption channel mechanism is used to ensure that the data will not be tampered with or intercepted when reading and verifying the signature. Then the public key of the production system is first imported, and the second signature of the production system is verified using the public key of the production system. If the verification is successful, it means that the standard COS hash value and the second signature of the production system have not been tampered with and have been confirmed by the production system. Then the public key of the operating system is imported again, and the first signature of the operating system is verified using the public key of the operating system. If the verification is successful, it means that the standard COS hash value has not been tampered with and has been confirmed by the operating system. Finally, the version detection system uses the SIM card API to obtain the operating system data and its hash value currently in use on the card, and compares it with the standard COS hash value read. If the hash values ​​are consistent, it means that the COS version is normal, otherwise it means that the version is abnormal and needs to be tracked and processed.

[0155] The embodiment of the present application provides a signature verification method for an operating system. The second signature is decoded by the first public key in the first key pair to obtain the first verification information and the first signature in the second signature. If the first verification information in the second signature is consistent with the first verification information in the SIM card to be verified, the first signature is decoded according to the second public key in the second key pair to obtain the first verification information in the first signature. If the first verification information in the first signature is consistent with the first verification information in the SIM card to be verified, the third operating system data in the SIM card to be verified is calculated according to a preset algorithm to obtain the fifth verification information. The operating system of the SIM card to be verified is verified according to the fifth verification information and the first verification information in the SIM card to be verified. This method can timely discover the release of the operating system version of the unauthorized SIM card, which helps to improve the quality management level and management capabilities of the SIM card. It also ensures the authenticity and integrity of the operating system and guarantees the security of the trust chain of all parties.

[0156] Figure 4 A schematic diagram of a signature determination device for an operating system provided in an embodiment of the present application Figure 1 , applied to a production system, the device 40 comprises:

[0157] The receiving module 401 is used to receive a first signature and first operating system data sent by the operating system, where the first signature is obtained by the operating system according to first verification information, the first verification information is obtained by calculating the first operating system data according to a preset algorithm, and the first operating system data is the operating system data of a qualified test SIM card;

[0158] A first verification module 402, used to verify the first operating system data according to the first signature;

[0159] The second signature module 403 is used to obtain a second signature according to the first verification information and the first signature if the verification result is passed;

[0160] The determination module 404 is used to determine the signature of the operating system of the SIM card to be manufactured according to the second signature.

[0161] In some implementations, the first verification module 402 is further configured to:

[0162] Decoding the first signature to obtain first verification information in the first signature;

[0163] Calculate the first operating system data according to a preset algorithm to obtain second verification information;

[0164] The first operating system data is verified according to the first verification information and the second verification information.

[0165] In some implementations, the second signature module 403 is further configured to:

[0166] Obtaining a first key pair of the production system, where the first key pair is obtained according to a cryptographic machine of the production system;

[0167] The first verification information and the first signature are signed according to the first private key in the first key pair to obtain a second signature.

[0168] In some implementations, the receiving module 401 is further configured to:

[0169] Sending a detection request for detecting the operating system of the test SIM card to the operating system, the detection request including the first verification information and the first operating system data of the operating system;

[0170] If the detection result returned by the operating system is qualified, the first signature and the first operating system data sent by the operating system are received.

[0171] Figure 5 A schematic diagram of a signature determination device for an operating system provided in an embodiment of the present application Figure 2 , applied to an operating system, the device 50 comprises:

[0172] The detection module 501 is used to obtain a first signature according to first verification information, wherein the first verification information is obtained by calculating first operating system data according to a preset algorithm, and the first operating system data is operating system data of a test SIM card that has passed the test;

[0173] A first signature module 502, configured to obtain a first signature according to the first verification information if the detection result is qualified;

[0174] The sending module 503 sends the first signature and the first operating system data to the production system. The first signature is used by the production system to verify the first operating system sent by the operation system. The first signature is used by the production system to generate a second signature based on the first signature and the first verification information. The second signature is used by the production system to determine the signature of the operating system of the SIM card to be manufactured.

[0175] In some implementations, the first signature module 502 is further configured to:

[0176] Obtaining a second key pair of the operating system, where the second key pair is obtained according to a cryptographic machine of the operating system;

[0177] The first verification information is signed according to the second private key in the second key pair to obtain a first signature.

[0178] In some implementations, the first signature module 502 is further configured to:

[0179] Testing the operating system of the test SIM card according to a test request sent by the production system, the test request including first verification information and first operating system data of the operating system;

[0180] If the test result is qualified, a first signature is obtained according to the first verification information.

[0181] In some implementations, the first signature module 502 is further configured to:

[0182] Calculate the first operating system data according to a preset algorithm to obtain third verification information;

[0183] If the third verification information is consistent with the first verification information, obtaining the second operating system data on the test SIM card;

[0184] Calculate the second operating system data according to a preset algorithm to obtain fourth verification information;

[0185] If the fourth verification information is consistent with the first verification information, the test SIM card is tested.

[0186] Figure 6 A schematic diagram of the structure of a signature verification device for an operating system provided in an embodiment of the present application, which is applied to a version detection system, wherein the device 60 includes:

[0187] The first acquisition module 601 is used to acquire the first verification information and the second signature in the SIM card to be verified, where the first verification information in the SIM card to be verified is written when the production system makes the card, and the second signature is obtained according to the signature determination method of the operating system provided in this application;

[0188] A first decoding module 602 is used to decode the second signature according to the first public key in the first key pair to obtain the first verification information and the first signature in the second signature, wherein the first key pair is obtained according to the production system;

[0189] The second decoding module 603 is used to decode the first signature according to the second public key in the second key pair to obtain the first verification information in the first signature if the first verification information in the second signature is consistent with the first verification information in the SIM card to be verified, and the second key pair is obtained according to the operating system;

[0190] The second acquisition module 604 is used to calculate the third operating system data of the SIM card to be verified according to a preset algorithm to obtain fifth verification information if the first verification information in the first signature is consistent with the first verification information in the SIM card to be verified;

[0191] The second verification module 605 is used to verify the operating system of the SIM card to be verified according to the fifth verification information and the first verification information in the SIM card to be verified.

[0192] Figure 7 A structural diagram of a signature management system provided in an embodiment of the present application, the signature management system 70 includes:

[0193] Production system 701, used to execute the above-mentioned signature determination method of the operating system;

[0194] An operating system 702, used to execute the above-mentioned operating system signature determination method;

[0195] The version detection system 703 is used to execute the above-mentioned signature verification method of the operating system.

[0196] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 8 As shown, the electronic device 80 includes:

[0197] The electronic device 80 may include a processor 801 with one or more processing cores, a memory 802 with one or more computer-readable storage media, a communication component 803 and other components. The processor 801 , the memory 802 and the communication component 803 are connected via a bus 804 .

[0198] In a specific implementation process, at least one processor 801 executes computer execution instructions stored in the memory 802, so that at least one processor 801 executes the above signature determination and verification method of the operating system.

[0199] The specific implementation process of the processor 801 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0200] In the above Figure 8 In the illustrated embodiment, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0201] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-volatile Memory, NVM), such as at least one disk memory.

[0202] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0203] In some embodiments, a computer program product is also proposed, including a computer program or instructions, which, when executed by a processor, implements the steps in the signature determination and verification method of any of the above-mentioned operating systems.

[0204] The specific implementation of the above operations can be found in the previous embodiments, which will not be described in detail here.

[0205] A person of ordinary skill in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0206] To this end, an embodiment of the present application provides a computer-readable storage medium, in which multiple instructions are stored, and the instructions can be loaded by a processor to execute the steps in the signature determination and verification method of any operating system provided in the embodiment of the present application.

[0207] The storage medium may include: a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0208] According to one aspect of the present application, a computer program product or a computer program is provided. The computer program product or the computer program comprises computer instructions stored in a computer-readable storage medium.

[0209] Since the instructions stored in the storage medium can execute the steps in the signature determination and verification method of any operating system provided in the embodiments of the present application, the beneficial effects that can be achieved by the signature determination and verification method of any operating system provided in the embodiments of the present application can be achieved. Please refer to the previous embodiments for details and will not be repeated here.

[0210] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0211] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A method for determining a signature of an operating system, characterized in that: Applied to production systems, including: receiving a first signature and first operating system data sent by the operating system, where the first signature is obtained by the operating system according to first verification information, the first verification information is obtained by calculating first operating system data according to a preset algorithm, and the first operating system data is operating system data of a qualified test SIM card; Verifying the first operating system data according to the first signature; If the verification result is passed, obtaining a second signature according to the first verification information and the first signature; The signature of the operating system of the SIM card to be manufactured is determined according to the second signature.

2. The method according to claim 1, characterized in that The verifying, according to the first signature, the first operating system data returned by the operating system includes: Decoding the first signature to obtain first verification information in the first signature; Calculate the first operating system data according to the preset algorithm to obtain second verification information; The first operating system data is verified according to the first verification information and the second verification information.

3. The method according to claim 1, characterized in that The obtaining a second signature according to the first verification information and the first signature includes: Acquire a first key pair of the production system, where the first key pair is obtained according to a cryptographic machine of the production system; The first verification information and the first signature are signed according to the first private key in the first key pair to obtain a second signature.

4. The method according to any one of claims 1 to 3, characterized in that: The receiving the first signature and the first operating system data sent by the operating system includes: Sending a detection request for detecting the operating system of the test SIM card to the operating system, the detection request including first verification information and first operating system data of the operating system; If the detection result returned by the operating system is qualified, the first signature and the first operating system data sent by the operating system are received.

5. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: The first verification information and the second signature are written into the SIM card to be manufactured.

6. A method for determining a signature of an operating system, characterized in that: Applied to operational systems, including: Obtaining a first signature according to first verification information, wherein the first verification information is obtained by calculating first operating system data according to a preset algorithm, and the first operating system data is operating system data of a qualified test SIM card; The first signature and the first operating system data are sent to the production system, the first signature is used by the production system to verify the first operating system sent by the operation system, the first signature is used by the production system to generate a second signature based on the first signature and the first verification information, and the second signature is used by the production system to determine the signature of the operating system of the SIM card to be manufactured.

7. The method according to claim 6, characterized in that The step of obtaining a first signature according to the first verification information includes: Obtaining a second key pair of the operating system, where the second key pair is obtained according to a cryptographic machine of the operating system; The first verification information is signed according to the second private key in the second key pair to obtain a first signature.

8. The method according to any one of claims 6-7, characterized in that: According to the first verification information, a first signature is obtained, including: Detecting the operating system of the test SIM card according to a detection request sent by the production system, wherein the detection request includes first verification information and first operating system data of the operating system; If the test result is qualified, a first signature is obtained according to the first verification information.

9. The method according to claim 8, characterized in that The step of testing the operating system of the test SIM card according to the test request sent by the production system includes: Calculate the first operating system data according to a preset algorithm to obtain third verification information; If the third verification information is consistent with the first verification information, obtaining the second operating system data on the test SIM card; Calculate the second operating system data according to the preset algorithm to obtain fourth verification information; If the fourth verification information is consistent with the first verification information, the test SIM card is tested.

10. A signature verification method for an operating system, characterized in that: Applied to version detection system, including: Obtaining first verification information and a second signature in the SIM card to be verified, wherein the first verification information in the SIM card to be verified is written when the production system makes the card, and the second signature is obtained according to any one of the methods of claims 1 to 9; Decoding the second signature according to a first public key in a first key pair to obtain first verification information and a first signature in the second signature, wherein the first key pair is obtained according to a production system; If the first verification information in the second signature is consistent with the first verification information in the SIM card to be verified, the first signature is decoded according to the second public key in the second key pair to obtain the first verification information in the first signature, and the second key pair is obtained according to the operating system; If the first verification information in the first signature is consistent with the first verification information in the SIM card to be verified, calculating the third operating system data in the SIM card to be verified according to the preset algorithm to obtain fifth verification information; The operating system of the SIM card to be verified is verified according to the fifth verification information and the first verification information in the SIM card to be verified.

11. A signature determination device for an operating system, characterized in that: Applied to production systems, including: a receiving module, configured to receive a first signature and first operating system data sent by an operating system, wherein the first signature is obtained by the operating system according to first verification information, the first verification information is obtained by calculating first operating system data according to a preset algorithm, and the first operating system data is operating system data of a qualified test SIM card; A first verification module, configured to verify the first operating system data according to the first signature; A second signature module, configured to obtain a second signature according to the first verification information and the first signature if the verification result is passed; The determination module is used to determine the signature of the operating system of the SIM card to be manufactured according to the second signature.

12. A signature determination device for an operating system, characterized in that: Applied to operational systems, including: A detection module, configured to obtain a first signature according to first verification information, wherein the first verification information is obtained by calculating first operating system data according to a preset algorithm, and the first operating system data is operating system data of a test SIM card that has passed the test; A first signature module, configured to obtain a first signature according to the first verification information if the detection result is qualified; a sending module, which sends the first signature and the first operating system data to the production system, wherein the first signature is used by the production system to verify the first operating system sent by the operation system, wherein the first signature is used by the production system to generate a second signature according to the first signature and the first verification information, and wherein the second signature is used by the production system to determine the signature of the operating system of the SIM card to be manufactured.

13. A signature verification device for an operating system, characterized in that: Applied to version detection system, including: A first acquisition module is used to acquire first verification information and a second signature in the SIM card to be verified, wherein the first verification information in the SIM card to be verified is written when the production system makes the card, and the second signature is obtained according to any one of the methods of claims 1 to 9; a first decoding module, configured to decode the second signature according to a first public key in a first key pair to obtain first verification information and a first signature in the second signature, wherein the first key pair is obtained according to a production system; a second decoding module, configured to decode the first signature according to a second public key in a second key pair to obtain the first verification information in the first signature if the first verification information in the second signature is consistent with the first verification information in the SIM card to be verified, wherein the second key pair is obtained according to an operating system; a second obtaining module, configured to calculate the third operating system data of the SIM card to be verified according to the preset algorithm to obtain fifth verification information if the first verification information in the first signature is consistent with the first verification information in the SIM card to be verified; The second verification module is used to verify the operating system of the SIM card to be verified according to the fifth verification information and the first verification information in the SIM card to be verified.

14. A signature management system, characterized in that: include: A production system for executing the signature determination method of an operating system as described in any one of claims 1 to 5; An operating system, used to execute the signature determination method of the operating system described in any one of claims 6 to 9; A version detection system, used to execute the signature verification method of the operating system described in claim 10.

15. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 10.

16. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 10 when executed by a processor.

Images